Question: Represent the scientific article to find a short TLDR

Question: Despite the impressive performance of deep neural networks (DNNs) on numerous learning tasks, they still exhibit uncouth behaviours. One puzzling behaviour is the subtle sensitive reaction of DNNs to various noise attacks. Such a nuisance has strengthened the line of research around developing and training noise-robust networks. In this work, we propose a new training regularizer that aims to minimize the probabilistic expected training loss of a DNN subject to a generic Gaussian input. We provide an efficient and simple approach to approximate such a regularizer for arbitrarily deep networks. This is done by leveraging the analytic expression of the output mean of a shallow neural network, avoiding the need for memory and computation expensive data augmentation. We conduct extensive experiments on LeNet and AlexNet on various datasets including MNIST, CIFAR10, and CIFAR100 to demonstrate the effectiveness of our proposed regularizer. In particular, we show that networks that are trained with the proposed regularizer benefit from a boost in robustness against Gaussian noise to an equivalent amount of performing 3-21 folds of noisy data augmentation. Moreover, we empirically show on several architectures and datasets that improving robustness against Gaussian noise, by using the new regularizer, can improve the overall robustness against 6 other types of attacks by two orders of magnitude. Deep neural networks (DNNs) have emerged as generic models that can be trained to perform impressively well in a variety of learning tasks ranging from object recognition and semantic segmentation to speech recognition and bioinformatics . Despite their increasing popularity, flexibility, generality, and performance, DNNs have been recently shown to be quite susceptible to small imperceptible input noise (; ;). Such analysis gives a clear indication that even state-of-the-art DNNs may lack robustness. Consequently, there has been an ever-growing interest in the machine learning community to study this uncanny behaviour. In particular, the work of demonstrates that there are systematic approaches to constructing adversarial attacks that in misclassification errors with high probability. Even more peculiarly, some noise perturbations seem to be doubly agnostic , i.e. there exist deterministic perturbations that can in misclassification errors with high probability when applied to different networks, irrespective of the input (denoted network and input agnostic). Understanding this degradation in performance under adversarial attacks is of tremendous importance, especially for real-world DNN deployment, e.g. self-driving cars/drones and equipment for the visually impaired. A standard and popular means to alleviate this nuisance is noisy data augmentation in training, i.e. a DNN is exposed to noisy input images during training so as to bolster its robustness during inference. Several works have demonstrated that DNNs can in fact benefit from such augmentation . However, data augmentation in general might not be sufficient for two reasons. Particularly with high-dimensional input noise, the amount of data augmentation necessary to sufficiently capture the noise space will be very large, which will increase training time. Data augmentation with high energy noise can negatively impact the performance on noise-free test examples. This can be explained by the fundamental trade-off between accuracy and robustness . It can also arise from the fact that augmentation forces the DNN to have the same prediction for two vastly different versions of the same input, noise-free and a substantially corrupted version. Despite the impressive performance of DNNs on various tasks, they have been shown to be very sensitive to certain types of noise, commonly referred to as adversarial examples, particularly in the recognition task . Adversarial examples can be viewed as small imperceptible noise that, once added to the input of a DNN, its performance is severely degraded. This finding has incited interest in studying/measuring the robustness of DNNs. The literature is rich with work that aims to unify and understand the notion of network robustness. For instance, suggested a spectral stability analysis for a wide class of DNNs by measuring the Lipschitz constant of the affine transformation describing a fully-connected or a convolutional layer. This was extended to compute an upper bound for a composition of layers, i.e. a DNN. However, this measure sets an upper bound on the robustness over the entire input domain and does not take into account the noise distribution. Later, Fawzi et al. (2017a) defined robustness as the mean support of the minimum adversarial perturbation, which is now the most common definition for robustness. Not only was robustness studied against adversarial perturbations but also against geometric transformations to the input. emphasized the independence of the robustness measure to the ground truth class labels and that it should only depend on the classifier and the dataset distribution. Subsequently, two different metrics to measure DNN robustness were proposed: one for general adversarial attacks and another for noise sampled from uniform distribution. showed the trade-off between robustness and test error from a theoretical point of view on a simple classification problem with hyperspheres. On the other hand, and based on various robustness analyses, several works proposed various approaches in building networks that are robust against noise sampled from well known distributions and against generic adversarial attacks. For instance, proposed a model that was trained to classify adversarial examples with statistical hypothesis testing on the distribution of the dataset. Another approach is to perform statistical analysis on the latent feature space instead , or train a DNN that rejects adversarial attacks . Moreover, the geometry of the decision boundaries of DNN classifiers was studied by Fawzi et al. (2017b) to infer a simple curvature test for this purpose. Using this method, one can restore the orig- Figure 1: Overview of the proposed graph for training Gaussian robust networks. The yellow block corresponds to an arbitrary network Φ(., θ) viewed as the composition of two subnetworks separated by a ReLU. The stream on the bottom computes the output mean µ4 of the network Φ(:, θ) assuming that (i) the noise input distribution is independent Gaussian with variances σ 2 x, and (ii) Ω(. : θ2) is approximated by a linear function. This evaluation for the output mean is efficient as it only requires an extra forward pass (bottom stream), as opposed to other methods that employ computationally and memory intensive network linearizations or data augmentation. inal label and classify the input correctly. Restoring the original input using defense mechanisms, which can only detect adversarial examples, can be done by denoising (ridding it from its adversarial nature) so long as the noise perturbation is well-known and modeled apriori . A fresh approach to robustness was proposed by , where they showed that using bounded ReLUs (if augmented with Gaussian noise) to limit the output range can improve robustness. A different work proposed to distill the learned knowledge from a deep model to retrain a similar model architecture as a means to improving robustness . This training approach is one of many adversarial training strategies for robustness. More closely to our work is , where a new training regularizer was proposed for a large family of DNNs. The proposed regularizer softly enforces that the upper bound of the Lipshitz constant of the output of the network to be less than or equal to one. Moreover and very recently, the work of has derived analytic expressions for the output mean and covariance of networks in the form of (Affine, ReLU, Affine) under a generic Gaussian input. This work also demonstrates how a (memory and computation expensive) two-stage linearization can be employed to locally approximate a deep network with a two layer one, thus enabling the application of the derived expressions on the approximated shallower network. Most prior work requires data augmentation, training new architectures that distill knowledge, or detect adversaries a priori, ing in expensive training routines that may be ineffective in the presence of several input noise types. To this end, we address these limitations through our new regularizer that aims to fundamentally tackle Gaussian input noise without data augmentation and, as a consequence, improves overall robustness against other types of attacks. Background on Network Moments. Networks with a single hidden layer of the form (Affine, ReLU, Affine) can be written in the functional form g(x) = Bmax (Ax + c 1, 0 p) + c 2. The max is an element-wise operator, A ∈ R p×n, and B ∈ R d×p. Thus, g: showed that: Note that µ 2 = Aµ x + c 1, σ 2 = diag (Σ 2), Σ 2 = AΣ x A, Φ and ϕ are the standard Gaussian cumulative (CDF) and density (PDF) functions, respectively. The vector multiplication and division are element-wise operations. Lastly, diag extracts the diagonal elements of a matrix into a vector. For ease of notation, we let To extend the of Theorem to deeper models, a two-stage linearization was proposed in , where (A, B) and (c 1, c 2) are taken to be the Jacobians and biases of the first order Taylor approximation to the two network functions around a ReLU layer in a DNN. Refer to for more details about this expression and the proposed linearization. Proposed Robust Training Regularizer. To propose an alternative to noisy data augmentation to address its drawbacks, one has to realize that this augmentation strategy aims to minimize the expected training loss of a DNN when subjected to noisy input distribution D through sampling. In fact, it minimizes an empirical loss that approximates this expected loss when enough samples are present during training. When sampling is insufficient (a drawback of data augmentation in highdimensions), this approximation is too loose and robustness can suffer. However, if we have access to an analytic expression for the expected loss, expensive data augmentation can be averted. This is the key motivation of the paper. Mathematically, the training loss can be modeled as Here, Φ: R n → R d is any arbitrary network with parameters θ, is the loss function, are the noise-free data-label training pairs, and α ≥ 0 is a trade off parameter. While the first term in Equation 1 is the standard empirical loss commonly used for training, the second term is often replaced with its Monte Carlo estimate through data augmentation. That is, for each training example x i, the second term is approximated with an empirical average ofÑ noisy examples of This will increase the size of the dataset by a factor ofÑ, which will in turn increase training complexity. As discussed earlier, network performance on the noise-free examples can also be negatively impacted. Note that obtaining a closed form expression for the second term in Equation 1 for some of the popularly used losses is more complicated than deriving expressions for the output mean of the network Φ itself, e.g. in Theorem. Therefore, we propose to replace this loss with the following surrogate Because of Jensen's inequality, Equation 2 is a lower bound to Eq Equation 1 when is convex, which is the case for most popular losses including 2 -loss and cross-entropy loss. The proposed second term in Equation 2 encourages that the output mean of the network Φ of every noisy example (x i + n) matches the correct class label y i. This regularizer will stimulate a separation among the output mean of the classes if the training data is subjected to noise sampled from D. Having access to an analytic expression for these means will prompt a simple inexpensive training, where the actual size of the training set is unaffected and augmentation is avoided. This form of regularization is proposed to replace data augmentation. While a closed-form expression for the second term of Equation 2 might be infeasible for a general network Φ, an expensive approximation can be attained. In particular, Theorem Equation 1 provides an analytic expression to evaluate the second term in Equation 2, for when D is Gaussian and when the network is approximated by a two-stage linearization procedure as However, it is not clear how to utilize such a to regularize networks during training with Equation 2 as a loss. This is primarily due to the computationally expensive and memory intensive network linearization proposed in. Specifically, the linearization parameters (A, B, c 1, c 2) are a function of the network parameters, θ, which are updated with every gradient descent step on Equation 2; thus, two-stage linearization has to be performed in every θ update step, which is infeasible. proposes a generic approach to train robust arbitrary networks against noise sampled from an arbitrary distribution D. Since the problem in its general setting is too broad for detailed analysis, we restrict the scope of this work to the class of networks, which are most popularly used and parameterized by θ, Φ(.; θ): with ReLUs as nonlinear activations. Moreover, since random Gaussian noise was shown to exhibit an adversarial nature;; , and it is one of the most well studied noise models for the useful properties it exhibits, we restrict D to the case of Gaussian noise. In particular, D is independent zero-mean Gaussian noise at the input, i.e. x, where σ 2 x ∈ R n is a vector of variances and Diag reshapes the vector elements into a diagonal matrix. Generally, it is still difficult to compute the second term in Equation 2 under Gaussian noise for arbitrary networks. However, if we have access to an inexpensive approximation of the network, avoiding the computationally and memory expensive network linearization in , an approximation to the second term in Equation 2 can be used for efficient robust training directly on θ. Consider the l th ReLU layer in Φ(.; θ). the network can be expressed as Φ(.; θ) = Ω(ReLU l (Υ(., θ 1)); θ 2 ). Note that the parameters of the overall network Φ(.; θ) is the union of the parameters of the two subnetworks Υ(.; θ 1) and Ω(.; θ 2), i.e. θ = θ 1 ∪ θ 2. Throughout this work and to simplify the analysis, we set l = 1. With such a choice of l, the first subnetwork Υ(., θ 1) is affine with θ 1 = {A, c 1}. However, the second subnetwork Ω(., θ 2) is not linear in general, and thus, one can linearize Ω(., θ 2) at E n∼N (0,Σx) [ReLU 1 (Υ (x i + n; θ 1))] = T (µ 2, σ 2) = µ 3. Note that µ 3 is the output mean after the ReLU and µ 2 = Ax i + c 1, since Υ(x i + n; θ 1) = A (x i + n) + c 1. Both T (., .) and σ 2 are defined in Equation 1. Thus, linearizing Ω at µ 3 with linearization parameters (B, c 2) being the Jacobian of Ω and c 2 = Ω(µ 3, θ 2) − Bµ 3, we have that, for any point v i close to µ 3: Ω(v i, θ 2) ≈ Bv i + c 2. While computing (B, c 2) through linearization is generally very expensive, computing the approximation to Equation 2 requires explicit access to neither B nor c 2. Note that this second term for l = 1 is given as: The approximation follows from the assumption that the input to the second subnetwork Ω(.; θ 2), i.e. Or simply, that the input to Ω is close to the mean inputs, i.e. µ 3, to Ω under Gaussian noise. The penultimate equality follows from the linearity of the expectation. As for the last equality, (B, c 2) are the linearization parameters of Ω at µ 3, where c 2 = Ω(µ 3, θ 2) − Bµ 3 by the first order Taylor approximation. Thus, computing the second term of Equation 2 according to Equation 3 can be simply approximated by a forward pass of µ 3 through the second network Ω. As for computing µ 3 = T (µ 2, σ 2), note that µ 2 = Ax i + c 1 in Equation 3, which is equivalent to a forward pass of x i through the first subnetwork because Υ(., θ 1) is linear with θ 1 = {A, c 1}. Moreover, since σ 2 = diag (AΣ x A), we have: The expression for σ 2 can be efficiently computed by simply squaring the linear parameters in the first subnetwork and performing a forward pass of the input noise variance σ 2 x through Υ without the bias c 1 and taking the element-wise square root. Lastly, it is straightforward to compute T (µ 2, σ 2) as it is an elementwise function in Equation 1. The overall computational graph in Figure 1 shows a summary of the computation needed to evaluate the loss in Equation 2 using only forward passes through the two subnetworks Υ and Ω. It is now possible with the proposed efficient approximation of our proposed regularizer in Equation 2 to efficiently train networks on noisy training examples that are corrupted with noise N (0, Σ x) without any form of prohibitive data augmentation. In this section, we conduct experiments on multiple network architectures and datasets to demonstrate the effectiveness of our proposed regularizer in training more robust networks, especially in comparison with data augmentation. To standardize robustness evaluation, we first propose a new unified robustness metric against additive noise from a general distribution D and later specialize it when D is Gaussian. Lastly, we show that networks trained with our proposed regularizer not only outperform in robustness networks trained with Gaussian augmented data. Moreover, we show that such networks are also much more magnitudes times robust against other types of attacks. On the Robustness Evaluation Metric. While there is a consensus on the definition of robustness in the presence of adversarial attacks, as the smallest perturbation required to fool a network, i.e. to change its prediction, it is not straightforward to extend such a definition to additive noise sampled from a distribution D. In particular, the work of tried to address this difficulty by defining the robustness of a classifier around an example x as the distance between x and the closest Figure 2: General trade-off between accuracy and robustness on LeNet. We see, in all plots, that the accuracy tends to be negatively correlated with robustness over varying noise levels and amount of augmentation. Baseline refers to training with neither data augmentation nor our regularizer. However, it is hard to compare the performance of our method against data augmentation from these plots as we can only compare the robustness of models with similar noise-free testing accuracy. decision boundary. However, this definition is difficult to compute in practice and is not scalable, as it requires solving a generally nonconvex optimization problem for every testing example x that may also suffer from poor local minima. To remedy these drawbacks, we present a new robustness metric for generic additive noise. Robustness Against Additive Noise. Consider a classifier Ψ with ψ(x) = arg max i Ψ i (x) as the predicted class label for the example x regardless of the correct class label y i. We define the robustness on a sample x against a generic additive noise sampled from a distribution D as Here, the proposed robustness metric D (x) measures the probability of the classifier to preserve the original prediction of the noise-free example ψ(x) after adding noise, ψ(x + n), from distribution D. Therefore, the robustness over a testing dataset T can be defined as the expected robustness over the test dataset: , for ease, we relax Equation 4 from the probability of preserving the prediction score to a 0/1 robustness over mrandomly sampled examples from D. That is, D (x) = 1 means that, among m randomly sampled noise from D added to x, none changed the prediction from ψ(x). However, if a single example of these m samples changed the prediction from ψ(x), we set D (x) = 0. Thus, the robustness score is the average of this measure over the testing dataset T. Robustness Against Gaussian Noise. For additive Gaussian noise, i.e. D = N (0, Σ x = Diag σ 2 x), robustness is averaged over a range of testing variances σ 2 x. We restrict σ x to 30 evenly sampled values in [0, 0.5], where this set is denoted as A 1. In practice, this is equivalent to sampling m Gaussian examples for each σ x ∈ A, and if none of the m samples changes the prediction of the classifier ψ from the original noise-free example, the robustness for that sample at that σ x noise level is set to 1 and then averaged over the complete testing set. Then, the robustness is the average over multiple σ x ∈ A. To make the computation even more efficient, instead of sampling a large number of Gaussian noise samples (m), we only sample a single noise sample with the average energy over D. That is, we sample a single n of norm n 2 = σ x √ n. This is due to the fact that Experimental Setup. In this section, we demonstrate the effectiveness of the proposed regularizer in improving robustness. Several experiments are performed with our objective Equation 2, where we strike a comparison with data augmentation approaches. Architecture Details. The input images in MNIST (gray-scale) and CIFAR (colored) are squares with sides equal to 28 and 32, respectively. Since AlexNet was originally trained on ImageNet of report for models with a test accuracy that is at least as good as the accuracy of the baseline with a tolerance: 0%, 0.39%, and 0.75% for MNIST, CIFAR10, CIFAR100, respectively. Only the models with the highest robustness are presented. Training with our regularizer can attain similar/better robustness than 21-fold noisy data augmentation on MNIST and CIFAR100, while maintaining a high noise-free test accuracy. sides equal to 224, we will marginally alter the implementation of AlexNet in to accommodate for this difference. First, we change the number of hidden units in the first fully-connected layer (in LeNet to 4096, AlexNet to 256, LeNet on MNIST to 3136). For AlexNet, we changed all pooling kernel sizes from 3 to 2 and the padding size of conv1 from 2 to 5. Second, we swapped each maxpool with the preceding ReLU, which makes training and inference more efficient. Third, we enforce that the first layer in all the models is a convolution followed by ReLU as discussed earlier. Lastly, to simplify analysis, we removed all dropout layers. We leave the details of the optimization hyper-parameters to the appendix. Results. For each model and dataset, we compare baseline models, i.e. models trained with noisefree data and without our regularization, with two others: one using data augmentation and another using our proposed regularizer. Each of the latter has two configurable variables: the level of noise controlled by σ Accuracy vs. Robustness. We start by demonstrating that data augmentation tends to improve the robustness, as captured by (T) over the test set, at the expense of decreasing the testing accuracy on the noise-free examples. Realizing this is essential for a fair comparison, as one would need to compare the robustness of networks that only have similar noise-free testing accuracies. To this end, we ran 60 training experiments with data augmentation on LeNet with three datasets (MNIST, CIFAR10, and CIFAR100), four augmentation levels (Ñ ∈ {2, 6, 11, 21}), and five noise levels (σ x ∈ A = {0.125, 0.25, 0.325, 0.5, 1.0}). In contrast, we ran robust training experiments using Equation 2 with the trade-off coefficient α ∈ {0.5, 1, 1.5, 2, 5, 10, 20} on the same datasets, but we extended the noise levels σ x to include the extreme noise regime of σ x ∈ {2, 5, 10, 20}. These noise levels are too large to be used for data augmentation, especially since x ∈ n; however, as we will see, they are still beneficial for our proposed regularizer. Figure 2 shows both the testing accuracy and robustness as measured by (T) over a varying range of training σ x for the data augmentation approach of LeNet on MNIST, CIFAR-10 and CIFAR-100. It is important to note here that the main goal of these plots is not to compare the robustness score, but rather, to demonstrate a very important trend. In particular, increasing the training σ x for each approach degrades testing accuracy on noise-free data. However, the degradation in our approach is much more graceful since the trained LeNet model was never directly exposed to individually corrupted examples during training as opposed to the data augmentation approach. Note that our regularizer enforces the separation between the expected output prediction analytically. Moreover, the robustness of both methods consistently improves as the training σ x increases. This trend holds even on the easiest dataset (MNIST). Interestingly, models trained with our regularizer enjoy an improvement in testing accuracy over the baseline model. Such behaviour only emerges with a large factor of augmentation, N = 21, and a small enough training σ x on MNIST. This indicates that models can benefit from better accuracy with a good approximation of Equation 1 through our proposed objective or through extensive Monte Carlo estimation. However, as σ x increases, Monte Carlo estimates of the second term in Equation 1 via data augmentation (withÑ = 21) is no longer enough to capture the noise. Robustness Comparison. For fair comparison, it is essential to only compare the robustness of networks that achieve similar testing accuracy, since perfect robustness is attainable with a deterministic classifier that assigns the same class label regardless of the input. In fact, we proposed a unified robustness metric for the reason that most commonly used metrics are disassociated from Table 1: Gaussian robustness improves overall robustness. We report the robustness metrics corresponding to various attacks (PGD, LBFGS, FGSM, and DF2), our proposed GNR metric, and the test accuracy ACC for LeNet and AlexNet networks trained on MNIST and CIFAR100 using our proposed regularizer with noise variance σ in training. Note that σ = 0 corresponds to baseline models trained without our regularizer. We observe that training networks with our proposed regularizer (designed for additive Gaussian attacks) not only improves the robustness against Gaussian attacks but also against 6 other types of attacks which 4 of them listed here and the others are left for appendix. the ground-truth labels and only consider model predictions. Therefore, we filtered out the from Figure 2 by removing all the experiments that achieved lower test accuracy than the baseline model. Figure 3 summarizes these for LeNet. Now, we can clearly see the difference between training with data augmentation and our approach. For MNIST (Figure 3a), we achieved the same robustness as 21-fold data augmentation without feeding the network with any noisy examples during training and while preserving the same baseline accuracy. Interestingly, for CIFAR10 (Figure 3b), our method is twice as robust as the best robustness achieved via data augmentation. Moreover, for CIFAR100 (Figure 3c), we are able to outperform data augmentation by around 5%. Finally, for extra validation, we also conducted the same experiments with AlexNet on CIFAR10 and CIFAR100 which can be found in the appendix. We can see that our proposed regularizer can improve robustness by 15% on CIFAR10 and around 25% on CIFAR100. It is interesting to note that for CIFAR10, data augmentation could not improve the robustness of the trained models without drastically degrading the testing accuracy on the noise-free examples. Moreover, it is interesting to observe that the best robustness achieved through data augmentation is even worse than the baseline. This could be due to the trade-off coefficient α in Equation 1. Towards General Robustness via Gaussian Robustness. Here, we investigate whether improving robustness to Gaussian input noise can improve robustness against other types of attacks. Specifically, we compare the robustness of models trained using our proposed regularizer (robust again Gaussian attacks) with baseline models subject to different types of attacks: Projected Gradient Descent (PGD) and LBFGS attacks , Fast Sign Gradient Method (FGSM) , and DeepFool L2Attack (DF2) as provide by. For all these attacks, we report the minimum energy perturbation that can change the network prediction. We also report our Gaussian Network Robustness (GNR) metric, which is the Gaussian version of Equation 4 along with the testing accuracy (ACC). We perform experiments on LeNet on MNIST, CIFAR10 and CIFAR100 datasets and on AlexNet on both CI-FAR10 and CIFAR100. Due to space constraints, we show the robustness for only LeNet on MNIST and AlexNet of CIFAR100 and leave the rest along with two other types of attacks for the appendix. Table 1 shows that improving GNR through our data augmentation free regularizer can significantly improve all robustness metrics. For instance, comparing LeNet trained with our proposed regularizer against LeNet trained without any regularization, i.e. σ = 0, we see that robustness against all types of attacks improves by almost two orders of magnitude, while maintaining a similar testing accuracy. A similar improvement in performance is consistently present for AlexNet on CIFAR100. Addressing the sensitivity problem of deep neural networks to adversarial perturbation is of great importance to the machine learning community. However, building robust classifiers against this noises is computationally expensive, as it is generally done through the means of data augmentation. We propose a generic lightweight analytic regularizer, which can be applied to any deep neural network with a ReLU activation after the first affine layer. It is designed to increase the robustness of the trained models under additive Gaussian noise. We demonstrate this with multiple architectures and datasets and show that it outperforms data augmentation without observing any noisy examples. A EXPERIMENTAL SETUP AND DETAILS. All experiments, are conducted using PyTorch version 0.4.1. All hyperparameters are fixed and Table 2 we report the setup for the two optimizers. In particular, we use the Adam optimizaer with β 1 = 0.9, β 2 = 0.999, = 10 −8 with amsgrad set to False. The second optimizer is with momentum=0.9, dampening=0, with Nesterov acceleration. In each experiment, we randomly split the training dataset into 10% validation and 90% training and monitor the validation loss after each epoch. If validation loss did not improve for lr patience epochs, we reduce the learning rate by multiplying it by lr factor. We start with an initial learning rate of lr initial. The training is terminated only if the validation loss did not improve for loss patience number of epochs or if the training reached 100 epochs. We report the of the model with the best validation loss. In particular, one can observe that with σ large than 0.7 the among of noise is severe even for the human level. Training on such extreme noise levels will deem data augmentation to be difficult. We measure the robustness against Gaussian noise by averaging over a range of input noise levels, where at each level for each image, we consider it misclassified if the probability of it being misclassified is greater than a certain threshold. The final robustness is the average over multiple testing σ x. This is special case of the more general case in Equation. We then report the area under the curve of the robustness with varying testing σ x as shown in Figure 6. The area under this curve thus represents the overall robustness of a given model under several varying input noise standard deviation σ x. We report the robustness of several architectures over several datasets with and without our trained regularizer. We show that our proposed efficient regularizer not only improves the robustness against Gaussin noise attacks but againts several other types of attacks. Table 3 summarizes the types of attacks used for robustness evaluation. reported models trained with our regularizer on CIFAR10 and CIFAR100 on all training σx are within 1.68% and 4.83% of the baseline accuracy, respectively. The models trained with the proposed regularizer achieve better robustness than 11-fold and 6-fold noisy data augmentation on CIFAR10 and CIFAR100, respectively. 34.65 35.50 Table 4: Gaussian robustness improves overall robustness. We report the robustness metrics corresponding to various attacks (PGD, LBFGS, FGSM, AGA, AUA and DF2), our proposed GNR metric, and the test accuracy ACC for LeNet and AlexNet networks trained on MNIST, CIFAR10 and CIFAR100 using our proposed regularizer with noise variance σ in training. Note that σ = 0 corresponds to baseline models trained without our regularizer. We observe that training networks with our proposed regularizer (designed for additive Gaussian attacks) not only improves the robustness against Gaussian attacks but also against 6 other types of attacks.

Represent this text to find a much much longer article about it with say hundreds-thousands of words

An efficient estimate to the Gaussian first moment of DNNs as a regularizer to training robust networks.

Represent the TLDR for finding the corresponding scientific article

We propose a new, efficient algorithm to construct adversarial examples by means of deformations, rather than additive perturbations.


Question: Represent the scientific article to find a short TLDR

Question: Reading comprehension is a challenging task, especially when executed across longer or across multiple evidence documents, where the answer is likely to reoccur. Existing neural architectures typically do not scale to the entire evidence, and hence, resort to selecting a single passage in the document (either via truncation or other means), and carefully searching for the answer within that passage. However, in some cases, this strategy can be suboptimal, since by focusing on a specific passage, it becomes difficult to leverage multiple mentions of the same answer throughout the document. In this work, we take a different approach by constructing lightweight models that are combined in a cascade to find the answer. Each submodel consists only of feed-forward networks equipped with an attention mechanism, making it trivially parallelizable. We show that our approach can scale to approximately an order of magnitude larger evidence documents and can aggregate information from multiple mentions of each answer candidate across the document. Empirically, our approach achieves state-of-the-art performance on both the Wikipedia and web domains of the TriviaQA dataset, outperforming more complex, recurrent architectures. Reading comprehension, the task of answering questions based on a set of one more documents, is a key challenge in natural language understanding. While data-driven approaches for the task date back to BID11, much of the recent progress can be attributed to new largescale datasets such as the CNN/Daily Mail Corpus BID8, the Children's Book Test Corpus BID9 and the Stanford Question Answering Dataset (SQuAD) BID21. These datasets have driven a large body of neural approaches BID24 BID16 BID22 BID27, inter alia) that build complex deep models typically driven by long short-term memory networks BID12. These models have given impressive on SQuAD where the document consists of a single paragraph and the correct answer span is typically only present once. However, they are computationally intensive and cannot scale to large evidence texts. Such is the case in the recently released TriviaQA dataset BID14, which provides as evidence, entire webpages or Wikipedia articles, for answering independently collected trivia-style questions. So far, progress on the TriviaQA dataset has leveraged existing approaches on the SQuAD dataset by truncating documents and focusing on the first 800 words BID14 BID18. This has the obvious limitation that the truncated document may not contain the evidence required to answer the question 1. Furthermore, in TriviaQA there is often useful evidence spread throughout the supporting documents. This cannot be harnessed by approaches such as that greedily search for the best 1-2 sentences in a document. For example, in Fig.1 the answer does not appear in the first 800 words. The first occurrence of the answer string is not sufficient to answer the question. The passage starting at token 4089 does contain all of the information required to infer the answer, but this inference requires us to resolve the two complex co-referential phrases in'In the summer of that year they got married in a church'. Access to other mentions of Krasner and Pollock and the year 1945 is important to answer this question. Figure 1: Example from TriviaQA in which multiple mentions contain information that is useful in inferring the answer. Only the italicized phrase completely answers the question (Krasner could have married multiple times) but contains complex coreference that is beyond the scope of current natural language processing. The last phrase is more easy to interpret but it misses the clue provided by the year 1945.In this paper we present a novel cascaded approach to extractive question answering (§3) that can accumulate evidence from an order of magnitude more text than previous approaches, and which achieves state-of-the-art performance on all tasks and metrics in the TriviaQA evaluation. The model is split into three levels that consist of feed-forward networks applied to an embedding of the input. The first level submodels use simple bag-of-embeddings representations of the question, a candidate answer span in the document, and the words surrounding the span (the context). The second level submodel uses the representation built by the first level, along with an attention mechanism BID2 that aligns question words with words in the sentence that contains the candidate span. Finally, for answer candidates that are mentioned multiple times in the evidence document, the third level submodel aggregates the mention level representations from the second level to build a single answer representation. At inference time, predictions are made using the output of the third level classifier only. However, in training, as opposed to using a single loss, all the classifiers are trained using the multi-loss framework of BID1, with gradients flowing down from higher to lower submodels. This separation into submodels and the multi-loss objective prevents adaptation between features BID10. This is particularly important in our case where the higher level, more complex submodels could subsume the weaker, lower level models c.f. BID1.To summarize, our novel contributions are• a non-recurrent architecture enabling processing of longer evidence texts consisting of simple submodels • the aggregation of evidence from multiple mentions of answer candidates at the representation level • the use of a multi-loss objective. Our experimental (§4) show that all the above are essential in helping our model achieve state-of-the-art performance. Since we use only feed-forward networks along with fixed length window representations of the question, answer candidate, and answer context, the vast majority of computation required by our model is trivially parallelizable, and is about 45× faster in comparison to recurrent models. Most existing approaches to reading comprehension BID24 BID16 BID22 BID27 BID25 BID15, inter alia) involve using recurrent neural nets (LSTMs BID12 or memory nets BID26) along with various flavors of the attention mechanism BID2 to align the question with the passage. In preliminary experiments in the original TriviaQA paper, BID14 explored one such approach, the BiDAF architecture BID22, for their dataset. However, BiDAF is designed for SQuAD, where the evidence passage is much shorter (122 tokens on an average), and hence does not scale to the entire document in TriviaQA (2895 tokens on an average); to work around this, the document is truncated to the first 800 tokens. Pointer networks with multi-hop reasoning, and syntactic and NER features, have been used recently in three architectures -Smarnet BID4, Reinforced Mnemonic Reader BID13 and MEMEN BID18 for both SQuAD and TriviaQA. Most of the above also use document truncation.Approaches such as first select the top sentences using a very coarse model and then run a recurrent architecture on these sentences to find the correct span. BID3 propose scoring spans in each paragraph with a recurrent network architecture separately and then take taking the span with the highest score. Our approach is different from existing question-answering architectures in the following aspects. First, instead of using one monolithic architecture, we employ a cascade of simpler models that enables us to analyze larger parts of the document. Secondly, instead of recurrent neural networks, we use only feed-forward networks to improve scalability. Third, our approach aggregates information from different mentions of the same candidate answer at the representation level rather than the score level, as in other approaches BID15 BID14. Finally, our learning problem also leverages the presence of several correct answer spans in the document, instead of considering only the first mention of the correct answer candidate. For the reading comprehension task (§3.1), we propose a cascaded model architecture arranged in three different levels (§3.2). Submodels in the lower levels (§3.3) use simple features to score candidate answer spans. Higher level submodels select the best answer candidate using more expensive attention-based features (§3.4) and by aggregating information from different occurrences of each answer candidate in the document (§3.5). The submodels score all the potential answer span candidates in the evidence document 2, each represented using simple bags-of-embeddings. Each submodel is associated with its own objective and the final objective is given by a linear combination of all the objectives (§3.6). We conclude this section with a runtime analysis of the model (§3.7). We take as input a sequence of question word embeddings q = {q 1 . . . q m}, and document word embeddings d = {d 1 . . . d n}, obtained from a dictionary of pre-trained word embeddings. Each candidate answer span, s = {d s1 . . . d so} is a collection of o ≤ l consecutive word embeddings from the document, where l is the maximum length of a span. The set of all candidate answer spans is S:= {s i} nl i=1. Limiting spans to length l minimally affects oracle accuracy (see Section §4) and allows the approach to scale linearly with document size. Since the same spans of text can occur multiple times in each document, we also maintain the set of unique answer candidate spans, u ∈ S u, and a mapping between each span and the unique answer candidate that it corresponds to, s u. In TriviaQA, each answer can have multiple alternative forms, as shown in Fig.1. The set of correct answer strings is S * and our task is to predict a single answer candidateû ∈ S. We first describe our meta-architecture, which is a collection of simple submodels M k (·) organized in a cascade. The idea of modeling separate classifiers that use complementary features comes from BID1 who found this gave considerable gains over combining all the features into a single model for a conversational system. As shown in FIG0, our architecture consists of two submodels M 1, M 2 at the first level, one submodel M 3 at the second, and one submodel M 4 at the third level. Each submodel M k returns a score, φ DISPLAYFORM0 s that is fed as input to the submodel at the next level. φ DISPLAYFORM1 DISPLAYFORM2 DISPLAYFORM3 Using their respective scores, φs, the models M 1...M 3 define a distribution over all spans, while M 4 uses φ u to define a distribution over all unique candidates, as follows: DISPLAYFORM4 In training, our total loss is given by an interpolation of losses for each of M 1,.., M 4. However, during inference we make a single prediction, simply computed asû = arg max u∈Su φu. The first level is the simplest, taking only bags of embeddings as input. This level contains two submodels, one that looks at the span and question together (§3.3.1), and another that looks at the span along with the local context in which the span appears (§3.3.2). We first describe the span representations used by both. Span Embeddings: We denote a span of length o as a vector s, containing• averaged document token embeddings, and • a binary feature γ qs indicating whether the spans contains question tokens DISPLAYFORM0 The binary feature γ qs is motivated by the question-in-span feature from BID3, we use the question-in-span feature, motivated by the observation that questions rarely contain the answers that they are seeking and it helps the model avoid answers that are over-complete -containing information already known by the questioner. The question + span component of the level 1 submodel predicts the correct answer using a feedforward neural network on top of fixed length question and span representations. The span representation is taken from above and we represent the question with a weighted average of the question embeddings. Question Embeddings: Motivated by BID16 we learn a weight δ qi for each of the words in the question using the parameterized function defined below. This allows the model to learn to focus on the important words in the question. δ qi is generated with a two-layer feed-forward net with rectified linear unit (ReLU) activations BID17 BID7, DISPLAYFORM0 where U, V, w, z, a and b are parameters of the feed-forward network. Since all three submodels rely on identically structured feed-forward networks and linear prediction layers, from now on we will use the abbreviations ffnn and linear as shorthand for the functions defined above. The scores, δ qi are normalized and used to generate an aggregated question vectorq as follows. DISPLAYFORM1 Now that we have representations of both the question and the span, the question + span model computes a hidden layer representation of the question-span pair as well as a scalar score for the span candidate as follows: DISPLAYFORM2 s ) where [x; y] represents the concatenation of vectors x and y. The span + short context component builds a representation of each span in its local linguistic context. We hypothesize that words in the left and right context of a candidate span are important for the modeling of the span's semantic category (e.g. person, place, date). Unlike level 1 which builds a question representation independently of the document, the level 2 submodel considers the question in the context of each sentence in the document. This level aligns the question embeddings with the embeddings in each sentence using neural attention BID2 BID16 BID27 BID22, specifically the attend and compare steps from the decomposable attention model of. The aligned representations are used to predict if the sentence could contain the answers. We apply this attention to sentences, not individual span contexts, to prevent our computational requirements from exploding with the number of spans. Subsequently, it is only because level 2 includes the level 1 representations h s and h s that it can assign different scores to different spans in the same sentence. Sentence Embeddings: We define g s = {d gs,1 . . . d g s,G} to be the embeddings of the G words of the sentence that contains s. First, we measure the similarity between every pair of question and sentence embeddings by passing them through a feed-forward net, ffnn att1 and using the ing hidden layers to compute a similarity score, η. Taking into account this similarity, attended vectors q i andd gs,j are computed for each question and sentence token, respectively. DISPLAYFORM0 The original vector and its corresponding attended vector are concatenated and passed through another feed-forward net, ffnn att2 the final layers from which are summed to obtain a question-aware sentence vectorḡ s, and a sentence context-aware question vector,q. DISPLAYFORM1 Using these attended vectors as features, along with the hidden layers from level 1 and the questionspan feature, new scores and hidden layers are computed for level 2: DISPLAYFORM2 s;q;ḡ s; γ qs ]), φ DISPLAYFORM3 s ) In this level, we aggregate information from all the candidate answer spans which occur multiple times throughout the document. The hidden layers of every span from level 2 (along with the question-in-span feature) are passed through a feed-forward net, and then summed if they correspond to the same unique span, using the s u map. The sum, h u is then used to compute the score and the hidden layer 3 for each unique span, u in the document. DISPLAYFORM0 DISPLAYFORM1 The hidden layer in level 3 is used only for computing the score φu, mentioned here to preserve consistency of notation. To handle distant supervision, previous approaches use the first mention of the correct answer span (or any of its aliases) in the document as gold BID14. Instead, we leverage the existence of multiple correct answer occurrences by maximizing the probability of all such occurrences. Using Equation 1, the overall objective, (U *, V *, w *, z *, a *, b *) is given by the total negative log likelihood of the correct answer spans under all submodels: DISPLAYFORM0 where λ 1,..,.λ 4 are hyperparameters, such that 4 i=1 λ i = 1, to weigh the contribution of each loss term. We briefly discuss the asymptotic complexity of our approach. For simplicity assume all hidden dimensions and the embedding dimension are ρ and that the complexity of matrix(ρ×ρ)-vector(ρ×1) multiplication is O(ρ 2). Thus, each application of a feed-forward network has O(ρ 2) complexity. Recall that m is the length of the question, n is the length of the document, and l is the maximum length of each span. We then have the following complexity for each submodel:Level 1 (Question + Span): Building the weighted representation of each question takes O(mρ 2) and running the feed forward net to score all the spans requires O(nlρ 2), for a total of O(mρ 2 + nlρ 2). Level 2: Computing the alignment between the question and each sentence in the document takes O(nρ 2 + mρ 2 + nmρ) and then scoring each span requires O(nlρ 2). This gives a total complexity of O(nlρ 2 + nmρ), since we can reasonably assume that m < n. Thus, the total complexity of our approach is O(nlρ 2 + mnρ). While the nl and nm terms can seem expensive at first glance, a key advantage of our approach is that each sub-model is trivially parallelizable over the length of the document (n) and thus very amenable to GPUs. Moreover note that l is set to 5 in our experiments since we are only concerned about short answers. The TriviaQA dataset BID14 contains a collection of 95k trivia question-answer pairs from several online trivia sources. To provide evidence for answering these questions, documents are collected independently, from the web and from Wikipedia. Performance is reported independently in either domain. In addition to the answers from the trivia sources, aliases for the answers are collected from DBPedia; on an average, there are 16 such aliases per answer entity. Answers and their aliases can occur multiple times in the document; the average occurrence frequency is almost 15 times per document in either domain. The dataset also provides a subset on the development and test splits which only contain examples determined by annotators to have enough evidence in the document to support the answer. In contrast, in the full development and test split of the data, the answer string is guaranteed to occur, but not necessarily with the evidence needed to answer the question. Data preprocessing: All documents are tokenized using the NLTK 4 tokenizer. Each document is truncated to contain at most 6000 words and at most 1000 sentences (average the number of sentences per document in Wikipedia is about 240). Sentences are truncated to a maximum length of 50 (avg sentence length in Wikipedia is about 22). Spans only up to length l = 5 are considered and cross-sentence spans discarded -this in an oracle exact match accuracy of 95% on the Wikipedia development data. To be consistent with the evaluation setup of BID14, for the Wikipedia domain we create a training instance for every question (with all its associated documents), while on the web domain we create a training instance for every question-document pair. Hyperparameters: We use GloVe embeddings BID20 of dimension 300 (trained on a corpus of 840 billion words) that are not updated during training. Each embedding vector is normalized to have 2 norm of 1. Out-of-vocabulary words are hashed to one of 1000 random embeddings, each initialized with a mean of 0 and a variance of 1. Dropout regularization BID23 ) is applied to all ReLU layers (but not for the linear layers). We additionally tuned the following hyperparameters using grid search and indicate the optimal values in parantheses: network size (2-layers, each with 300 neurons), dropout ratio (0.1), learning rate (0.05), context size, and loss weights (λ 1 = λ 2 = 0.35, λ 3 = 0.2, λ 4 = 0.1). We use Adagrad BID6 for optimization (default initial accumulator value set to 0.1, batch size set to 1). Each hyperparameter setting took 2-3 days to train on a single NVIDIA P100 GPU. The model was implemented in Tensorflow BID0. Table 1 presents our on both the full test set as well as the verified subsets, using the exact match (EM) and F 1 metrics. Our approach achieves state-of-the-art performance on both the Wikipedia and web domains outperforming considerably more complex models 5. In the web domain, except for the verified F 1 scores, we see a similar trend. Surprisingly, we outperform approaches which use multi-layer recurrent pointer networks with specialized memories BID4 BID13 6. DISPLAYFORM0 Wikipedia Dev (EM) Table 2: Model ablations on the full Wikipedia development set. For row labeled **, explanation provided in Section §4.3. Table 2 shows some ablations that give more insight into the different contributions of our model components. Our final approach (3-Level Cascade, Multiloss) achieves the best performance. Training with only a single loss in level 3 (3-Level Cascade, Single Loss) leads to a considerable decrease in performance, signifying the effect of using a multi-loss architecture. It is unclear if combining the two submodels in level 1 into a single feed-forward network that is a function of the question, span and short context (3-Level Cascade, Combined Level 1) is significantly better than our final model. Although we found it could obtain high , it was less consistent across different runs and gave lower scores on average (49.30) compared to our approach averaged over 4 runs (51.03). Finally, the last three rows show the of using only smaller components of our model instead of the entire architecture. In particular, our model without the aggregation submodel (Level 1 + Level 2 Only) performs considerably worse, showing the value of aggregating multiple mentions of the same span across the document. As expected, the level 1 only models are the weakest, showing that attending to the document is a powerful method for reading comprehension. FIG2 shows the behavior of the k-best predictions of these smaller components. While the difference between the level 1 models becomes more enhanced when considering the top-k candidates, the difference between the model without the aggregation submodel (Level 1 + Level 2 Only) and our full model is no longer significant, indicating that the former might not be able to distinguish between the best answer candidates as well as the latter. The effect of truncation on Wikipedia in FIG2 (right) indicates that more scalable approaches that can take advantage of longer documents have the potential to perform better on the TriviaQA task. Multiple Mentions: TriviaQA answers and their aliases typically reoccur in the document (15 times per document on an average). To verify whether our model is able to predict answers which occur frequently in the document, we look at the frequencies of the predicted answer spans in FIG3 (left). This distribution follows the distribution of the gold answers very closely, showing that our model learns the frequency of occurrence of answer spans in the document. Speed: To demonstrate the computational advantages of our approach we implemented a simple 50-state bidirectional LSTM baseline (without any attention) that runs through the document and predicts the start/end positions separately. FIG3 shows the speedup ratio of our approach compared to this LSTM baseline as the length of the document is increased (both approaches use a P100 GPU). For a length of 200 tokens, our approach is about 8× faster, but for a maximum length of 10,000 tokens our approach is about 45× faster, showing that our method can more easily take advantage of GPU parallelization. We observe the following phenomena in the (see Table 3) which provide insight into the benefits of our architecture, and some directions of future work. Lower levels get the prediction right, but not the upper levels. Model predicts entities from the question. Table 3: Example predictions from different levels of our model. Evidence context and aggregation are helpful for model performance. The model confuses between entities of the same type, particularly in the lower levels. Aggregation helps As motivated in Fig 1, we observe that aggregating mention representations across the evidence text helps (row 3). Lower levels may contain, among the top candidates, multiple mentions of the correct answer (row 4). However, since they cannot aggregate these mentions, they tend to perform worse. Moreover, level 3 does not just select the most frequent candidate, it selects the correct one (row 2).Context helps Models which take into account the context surrounding the span do better (rows 1-4) than the level 1 (question + span) submodel, which considers answer spans completely out of context. Entity-type confusion Our model still struggles to resolve confusion between different entities of the same type (row 4). Context helps mitigate this confusion in many cases (rows 1-2). How-ever, sometimes the lower levels get the answer right, while the upper levels do not (row 5) -this illustrates the value of using a multi-loss architecture with a combination of models. Our model still struggles with deciphering the entities present in the question (row 5), despite the question-in-span feature. We presented a 3-level cascaded model for TriviaQA reading comprehension. Our approach, through the use of feed-forward networks and bag-of-embeddings representations, can handle longer evidence documents and aggregated information from multiple occurrences of answer spans throughout the document. We achieved state-of-the-art performance on both Wikipedia and web domains, outperforming several complex recurrent architectures.

represent the tldr for finding the corresponding scientific article

We propose neural cascades, a simple and trivially parallelizable approach to reading comprehension, consisting only of feed-forward nets and attention that achieves state-of-the-art performance on the TriviaQA dataset.

Represent the short summary for finding the corresponding scientific article (long).

This work aims to provide quantitative answers to the relative importance of concepts of interest via concept activation vectors (CAV). In particular, this framework enables non-machine learning experts to express concepts of interest and test hypotheses using examples (e.g., a set of pictures that illustrate  the concept). We show that CAV can be learned given a relatively small set of examples. Hypothesis testing with CAV can answer whether a particular concept (e.g., gender) is more important in predicting a given class (e.g., doctor) than other sets of concepts. Interpreting networks with CAV does not require any retraining or modification of the network.


Question: Represent the article for finding a single-sentence TLDR

Question: Compressed forms of deep neural networks are essential in deploying large-scale computational models on resource-constrained devices. Contrary to analogous domains where large-scale systems are build as a hierarchical repetition of small- scale units, the current practice in Machine Learning largely relies on models with non-repetitive components. In the spirit of molecular composition with repeating atoms, we advance the state-of-the-art in model compression by proposing Atomic Compression Networks (ACNs), a novel architecture that is constructed by recursive repetition of a small set of neurons. In other words, the same neurons with the same weights are stochastically re-positioned in subsequent layers of the network. Empirical evidence suggests that ACNs achieve compression rates of up to three orders of magnitudes compared to fine-tuned fully-connected neural networks (88× to 1116× reduction) with only a fractional deterioration of classification accuracy (0.15% to 5.33%). Moreover our method can yield sub-linear model complexities and permits learning deep ACNs with less parameters than a logistic regression with no decline in classification accuracy. The universe is composed of matter, a physical substance formed by the structural constellation of a plethora of unitary elements denoted as atoms. The type of an atom eventually defines the respective chemical elements, while structural bonding between atoms yields molecules (the building blocks of matter and our universe). In Machine Learning a neuron is the infinitesimal nucleus of intelligence (i.e. {atom, matter} ↔ {neuron, AI}), whose structural arrangement in layers produces complex intelligence models. Surprisingly, in contrast to physical matter where molecules often reuse quasi-identical atoms (i.e. repeating carbon, hydrogen, etc.), neural networks do not share the same neurons across layers. Instead, the neurons are parameterized through weights which are optimized independently for every neuron in every layer. Inspired by nature, we propose a new paradigm for constructing deep neural networks as a recursive repetition of a fixed set of neurons. Staying faithful to the analogy we name such models as Atomic Compression Networks (ACNs). Extensive experimental show that by repeating the same set of neurons, ACNs achieve unprecedented compression in terms of the total neural network parameters, with a minimal compromise on the prediction quality. Deep neural networks (DNN) achieve state-of-the-art prediction performances on several domains like computer vision ) and natural language processing . Therefore, considerable research efforts are invested in adopting DNNs for mobile, embedded, or Internet of Things (IoT) devices . Yet, multiple technical issues related to restricted resources, w.r.t. computation and memory, prevent their straightforward application in this particular domain; ). Even though prior works investigate neural compression techniques like pruning or low-rank parameter factorization, they face fragility concerns regarding the tuning of hyperparameters and network architecture, besides struggling to balance the trade-off between compression and accuracy . • a novel compression paradigm for neural networks composed of repeating neurons as the atomic network components and further motivated by function composition; • compression rates of up to three orders of magnitudes compared to a cross-validated fullyconnected network on nine real-world vector datasets; • first work to achieve sub-linear model complexities measured in the number of trained parameters compared to connected architectures on several computer vision tasks. 2 RELATED WORK Our approach of training a set of neurons and (re-)using them in building the network architecture is partially related to the existing scheme of modular neural networks (MNN). End-to-End Module Networks (a;) are deep neural network models that are constructed from manual module blueprints defined for different sub-tasks in question answering. The Compositional Recursive Learner proposed by employs a curriculum learning approach to learn modular transformations while Routing Networks (RN) consist of a set of pre-defined modules (which each can be a NN) and a meta controller (called router) that decides in which order these modules are consecutively applied to a given input. Modular Networks are an extension to RNs employing conditional computation with Expectation-Maximization. Finally the recent work of focuses on the recursive formulation of the Routing Network, consecutively applying one of a set of modules to an input. The crucial difference to our approach is that our neurons are much smaller than the general modules of MNN and that we reuse the same components on the same network level (e.g. within the same layer) while the modules of MNN are only applied sequentially. A different extension of the RN is the model of which uses the router in a gating mechanism to control the input to a set of shared RNN modules similar to a Mixture of Experts model . Although Mixture of Experts models are related, they normally do not stack and recursively reuse components within the same network but have a comparably shallow architecture. Another related field of research is that of neural architecture search (NAS) . It is concerned with the automatic discovery of high performing neural network architectures for diverse tasks. There exists a multitude of search-approaches including (Neuro-)Evolution and Reinforcement Learning . A sub-field of NAS is the dedicated search for neural modules called cells or blocks ), which can be reused in the network architecture. Although this is related to our approach, the discovered cells are usually much more complex than single neurons and only share their architecture while each cell has a different set of weights, therefore not reducing the total number of required parameters. Although parameter sharing approaches exist, they either share weights between different evolved macro-architectures or only use them to warm start cells with a parameter copy on initialization, which then is refined in subsequent fine tuning steps , missing the advantage of the recursive sharing scheme employed by ACNs. Although recent works like achieve huge speed-ups, the large amount of time required to find suitable architectures remains a major disadvantage, while our approach can be trained from scratch in one go. One popular way for network compression is the pruning of unimportant weights from the network, an idea first appearing several decades ago to prevent over-fitting by reducing the network complexity . The seminal work by Han et al. (2015b) proposes an iterative procedure consisting of training and pruning weights with small magnitudes. focus on pruning filters of trained CNNs based on the L 1 -norm while Louizos et al. (2017b) and consider L 0 -norm regularization. In contrast employ a pruning schedule on the channel with the smallest effect on the activations of the subsequent layer. Molchanov et al. (2016; use Taylor expansion to calculate importance scores for different channels to prune CNNs. Similarly neuron importance scores based on the reconstruction error of responses in the final layers are used by while propose an adaptive pruning scheme for sub-groups of weights. Furthermore there also exist recent Bayesian approaches to weight pruning (; a;). The input masks are shown by colored arrows to respective neurons, where f 1 (red) has 2, f 2 (orange) has 3 and f m (green) has 4 inputs. The output layer f out (blue) is an independent module which is not reused. Another path of research utilizes factorization approaches to produce low-rank approximations to the weight matrices of DNNs . Alternatively vector quantization methods can be applied to the parameter matrices, e.g. dividing the weights into sub-groups which are represented by their centroid . SqueezeNet introduced by adapts so-called squeeze modules which reduce the number of channels while TensorNet uses the Tensor-Train format to tensorize the dense weight matrices of FC layers. use the Kronecker product to achieve layer-wise compression. Recent work combines several of the aforementioned methods in hybrid models. Han et al. (2015a) use pruning together with layer-wise quantization and additional Huffman coding. Tucker decomposition supported by a variational Bayesian matrix factorization is employed while jointly apply pruning and quantization techniques in a single framework. A special variant of compression methods for DNNs is the teacher-student approach also known as network distillation (; ;), which utilizes the relation of two models, a fully trained deep teacher model and a significantly smaller and more shallow student model to distill the knowledge into a much more compressed form. There exist different approaches to the design and training of the student model, e.g. utilizing special regularization or quantization techniques . A crucial advantage of ACNs is that we do not waste time and computational resources on training a large, over-parameterized architecture which is prone to over-fitting and usually needs a lot of training data only to compress it afterwards (e.g. by pruning or distillation). Instead we directly train smaller models which bootstrap their capacity by recursively-stacked neurons and therefore are more compact and can be trained efficiently with less data. Furthermore, the aforementioned approaches are often quite limited in achieving large compression without degrading the prediction performance. HashedNets use random weight sharing within the parameter matrix of each layer and introduce an additional hashing formulation of the forward pass and the gradient updates. Our model is different from these approaches since we share neurons which can have an arbitrary number of weights and don't restrict the sharing to the same layer, but enable sharing across layers, too. As an additional complementary method to the aforementioned approaches one can train networks with reduced numerical precision of their parameters . This achieves further compression and experiments show that it leads only to a marginal degradation of model accuracy. Taking this idea to the extreme constrain the values of all weights and activations to be either +1 or -1. A neuron can be understood as an arbitrary function f (x; θ): The idea is to stochastically apply the same neuron with the same weights to the outputs of neurons from the previous layer. The different functions or components f i then form a global set M, f 1, f 2,..., f m ∈ M which defines the set of parameters (indexed by the neurons) which is available to the model. Additionally we add the output layer f out which is a unique FC layer that is not reused anywhere else in the network (see figure 1). The most naive approach to recursion is repeating whole layers with shared weights. Each module is represented by a FC layer mapping from a layer input dimension D in to the output dimension D out. The architecture is depicted in figure 1a. More generally this approach can also be written in terms of a function composition (see equation 1). Sharing layers forces them to have equal input and output dimensions, ing in rectangular-shaped neural architectures. For comparison with our neuron level ACN in the ablation study in the experiment section we reference this approach with random sampling of the sequential network composition by LayerNet. In contrast to repeating entire layers, ACN reuses the most atomic components of a neural network which are represented by its single neurons. Consequently a full network layer in the model consists of several neurons which do not need to be all different, but the same neuron can be reused more than once in the same layer (see figure 1b). Each neuron p ∈ M has an input dimension d p which we choose randomly from a preset range of dimensions D. When inserting the neuron into a layer, we randomly sample d p connections to the neurons of the previous layer forming a mask δ p on its activation z. While the trainable parameters (weights and bias) of the neurons are shared, this connection mask is different for every neuron in every layer. The procedure for sampling the ACN architecture is shown in algorithm 1. Equation 2 shows the forward pass through a ACN neuron layer, where Π represents the projection (selection) of the mask indices δ from the activation of the previous layers: To reduce the additional memory complexity of these input masks we can store the seed of the pseudo random generator used for sampling the masks and are able to reproduce them on the fly in the forward pass at inference time. Since the input masks of the neurons are completely random, situations may arise in which not all elements of z are forwarded to the next layer. However in our experiments we find that this case happens only very rarely granted that the number of neurons per layer and the greater part of the input dimensions D are sufficiently large. To gain more insights into the potential of ACN we perform a small study on a synthetic curve fitting problem. We compare a simple FC network with a varying number of layers and neurons to an ACN with approximately the same number of parameters. The curve fitting problem is a regression task on the function f (x) = 3.5x 3 − 3 sin(x) + 0.5 sin(8x 2 + 0.5π) 2. To achieve the best possible fit for the models we perform a hyper-parameter grid search including the dimension of hidden layers, learning rate and the number of different modules for the recursive net. Details can be found in appendix A.2. Considering our knowledge about the true function which includes powers of x we boost the performance of both models by squaring the neuron activations. Figure 2: Plots of the model fit to the curve data. The first row shows the fit of the FC baseline, the second that of ACN. In the columns the respective number of model parameters as well as the achieved MSE on the test set are given above the plots. Since an arbitrary number of parameters cannot always be achieved with each model, the next nearest number with a competitive model was selected, e.g. in the first column with 17 and 18 parameters respectively. As can be seen in figure 2, ACN consistently achieves a better fit in terms of MSE than the FC baseline. Already an ACN with only 32 parameters is sufficient to approximately fit even the highly non-linear parts of the function while the FC network only achieves a comparable fit with actually more than twice the number of parameters. This can be explained by some intuition about function composition. Consider a function f (x) = (αx + β) 2, f: R → R with sole parameters α and β. Then we can create much more complex functions with the same set of parameters by composition f (f (x)) = α 3 x 2 + 2α 2 βx + αβ 2 + β 2. Extending this to other functions g, h,... (which each can be a neuron) enables us to create complex functions with a small set of parameters. Furthermore compared to a standard FCN our ACN achieves much deeper architectures with the same number of parameters what further improves the fitting capability. We evaluate the performance of the proposed algorithms using nine publicly available real-world classification datasets and three image datasets. The selected datasets and their characteristics are detailed in appendix A.1. The datasets were chosen from the OpenML-CC18 benchmark 1 which is a curated high quality version of the OpenML100 benchmark . Details on the employed hyper-parameters and training setup can be found in appendix A.2. We compare our model to six different baseline models: • FC: A standard FC network of comparable size. It was shown in that this is a simple but strong baseline which often outperforms more sophisticated methods. • RER: Random Edge Removal first introduced in Cireşan et al.. For this baseline a number of connections is randomly dropped from a FC network on initialization. In contrast to dropout the selected connections are dropped completely and accordingly the network is trained and also evaluated as sparse version. • TensorNet : This model builds on a generalized low-rank quantization method that treats the weight matrices of FC layers as a two dimensional tensor which can be decomposed into the Tensor-Train (TT) format . The authors also compare their model to HashedNet and claim to outperform it by 1.2%. To train TensorNet on our datasets we introduce two FC layers mapping from the input to the consecutive TT layers and from the last TT layer back to the output dimension. • BC: The Bayesian compression method of Louizos et al. (2017a) uses scale mixtures of normals as sparsity-inducing priors on groups of weights, extending the variational dropout approach of to completely prune unimportant neurons while training a model from scratch. We achieve varying levels of compression and accuracy by specifying different thresholds for the variational dropout rate of the model. • TP: use first and second order Taylor expansions to compute importance scores for filters and weights which then are used to prune respective parts of the network. In our experiments we use the method which the authors report as best, introducing pruning gates directly after batch normalization layers. To realize different levels of compression we prune increasingly bigger parts of the network based on the calculated importance scores in an iterative fine tuning procedure. • LogisticRegression: A linear model. The of the experimental study on the real-world datsets are shown in figure 3 while table 1 shows the for the image datasets. All are obtained by running each model-hyperparameter combination with three different random seeds and averaging the ing performance metric and number of parameters. The standard deviation between runs can be found in table 5 in appendix A.3. Table 1: Classification test accuracy on image datasets -in each row the best model (selected based on validation accuracy) up to the specified maximum number of parameters is shown. Therefore the model and its test accuracy values do not change for greater numbers of parameters, if a smaller model has a better validation accuracy. For some models very small versions could not be trivially achieved (indicated by "-"). All trained models are fully connected architectures. We did not train ACN for more than 500,000 parameters. As can be seen in figure 3, ACN consistently outperforms all other models on all of the nine real-world datasets for very small models, for datasets with a huge feature space even for models with up to 10,000 parameters. This shows that the ACN architecture is very efficient w.r.t. its parameters and the required amount of training-data and that on these datasets the recursive nature and parameter sharing throughout the architecture has a positive impact on the predictive efficiency compared to the number of parameters. For larger models the advantage of ACN decreases and the other models catch Figure 3: Plots of the model classification error on the test set for different numbers of parameters. For each tick on the x-axis the model with the best validation accuracy under the threshold for the number of parameters is selected. In the titles next to the name of the dataset we indicate the dimension of the respective feature space. For some methods very small models could not be achieved so they have no points plotted on the left part of the plots (e.g. a fully connected network will not have less parameters than a linear model with number of inputs × number of classes many parameters) up or even outperform it by a small margin, e.g. in case of the InternetAds dataset, however ACN remains competitive. TensorNet usually is at least a factor of two larger than the other models and therefore is only shown in the last bin. The same applies for TP and BC on the optdigits, theorem and nomao/spambase datasets respectively. To evaluate the parameter efficiency of our technique we compare ACN and FC (as the best performing baseline) to a large optimal FC network trained on the same dataset (doing a hyper-parameter search with the same parameters mentioned in section 4.2 and five increasingly large architectures). We show the regarding the relative compression rate and the respective loss in model performance in table 2. Say n is the number of model parameters of the large baseline and n that of the evaluated model, then the compression rate is given by ρ = n/n. Our model achieves compression rates of 88 up to more than 1100 times while the loss in test accuracy is kept at around 0.15% up to 5.33%. In comparison FC achieves compression of 67 up to 528 times with accuracy loss between 0.28% and 7.13%. For all datasets except spambase and theorem ACNs realize higher compression rates than FC as well as a smaller loss in accuracy in 5/9 cases. However since the comparison to a large model baseline can be biased by model selection and the thoroughness of the respective hyper-parameter search, we also investigate how the performance and capacity of the models compare w.r.t. a linear baseline. The in table 2 confirm the trend that is observed in the comparison to the large model. On the image datasets ACN consistently and significantly outperforms all other models for up to 100,000 parameters. On MNIST our smallest model has 4091 parameters and outperforms a linear model with 7850 by 1.8% although the baseline has nearly twice as many parameters. The same trend can be observed for FashionMNIST (7057 / 7850 with a difference of 2.04%) and CIFAR10 where an ACN with 7057 parameters employs less than a quarter of the 30730 parameters needed by the simplest linear model and outperfoms it by a overwhelming 8.63%. Surprisingly the LayerNet outperfoms all other models for the category < 500, 000. For more than 500,000 parameters the FC network performs best. Although the on CIFAR10 first might seem rather poor compared to the approximately 96% accuracy which is achieved by CNN , the best achieved by dedicated FC networks lie around 56% and are only topped by a specifically designed network with linear bottleneck layers and unsupervised pre-training . While our model sacrifices some processing time for higher compression, the forward pass at inference time still works in a matter of milliseconds on a standard CPU. To investigate the effect of the chosen level of sharing and recursion we perform a small ablation study. We compare ACN with parameter-sharing and recursion on a neuron-level with the simpler approach of sharing and reusing whole layers described as the LayerNet architecture in section 3. Therefore we also report the performance for the LayerNet in an extra column in the tables 5 and 1. The imply that in general the recursion on neuron-level is much more effective to achieve competitive models with high compression, outperforming the LayerNet in all but one case for less than 10,000 parameters. However the LayerNet seems to have a beneficial regularization effect on large models, what is notable especially on the image datasets. In this paper we presented Atomic Compression Networks (ACN), a new network architecture which recursively reuses neurons throughout the model. We evaluate our model on nine vector and three image datasets where we achieve promising regarding the compression rate and the loss in model accuracy. In general ACNs achieve much tinier models with only a small to moderate decrease of accuracy compared to six other baselines. For future work we plan to include skip connections in the architecture and to extend the idea to CNNs and the sharing of kernel parameters as well as for the FC layers. Another interesting path of research is the combination of the ACN scheme with NAS methods to further optimize the efficiency and performance of the created architectures. A.1 DATASET DETAILS Table 3 shows detailed attributes for the datasets selected from the OpenML-CC18 benchmark. The selection criteria were datasets with more than 3000 instances and more than 50 original features. The number of features reported in the table is the number of features after one-hot-encoding. For the image datasets- we employ the original train/test splits and use a random 20% of the training set for validation leading to a train/val/test split of 0.64/0.16/0.2. The datasets- are split randomly using the same fractions. We do not use any kind of additional transformation or data augmentation beyond those which was already originally applied to the respective datasets. bioresponse 3751 1776 2 45.77 HAR 10299 561 6 13.65 InternetAds 3279 3113 2 14.00 isolet 7797 617 26 3.82 nomao 34465 174 2 28.56 optdigits 5620 64 10 9.86 spambase 4601 57 2 39.40 Given the large computational demands of deep learning architectures, a proper full hyper-parameter search is infeasible for the models employed on the real-world datasets. Under these circumstances we follow the established trend of using some specific deep architectures designed based on expert knowledge together with a small selected parameter grid containing learning rate (0.01, 0.001), use of batch normalization and dropout probability (0.0, 0.3). To enable a fair comparison the hyper-parameter search for every model type which is trained from scratch is done for the same number of combinations. Accordingly for each dataset we evaluate eight different architectures per model type where we vary the number of hidden layers and the width of these layers, for ACN M and D are different between some of the eight varying architectures. The size of the set of modules M is varied in the range between 3 and 5 for the LayerNet (ablation study) and between 16 and 512 for the ACN. The range of input dimensions D is set to a subset of depending on the maximum width of the used hidden layers and the respective input dimension. In case of the TensorNet we vary the dimension of the tensor-train layers and the length of the tensor-train decomposition between different architectures per dataset together with the aforementioned parameter grid. All other parameters remain at their default values . For the two pruning approaches BC and TP we train two different large FC architectures with the described hyper-parameter grid and then prune the networks in small steps, selecting the best architecture within every parameter bin. The models are trained for 25 epochs on batches of size 64 for the real-world datasets and 128 for the image datasets. In order to minimize the loss we apply stochastic gradient descent update steps using Adam and halve the initial learning rate every 10 epochs. The only exception is Tp where we use SGD with a momentum term of 0.99 as proposed by the authors but employ the same learning rate schedule. Finally, in order to avoid exploding gradients the gradient norm is truncated to a maximum of 10. Apart from the TensorNet for which we adapt the publicly available Tensorflow Code 2, all models are implemented using the PyTorch 1.1 framework. For BC 3 and TP 4 we adapt the public PyTorch code base provided by the authors. In this section we show the presented in figure 3 in tabular form in table 5. Furthermore for completeness we present additional regarding two simple sparsification baselines in table 6 employing L1-regularization (L1) and iterative hard tresholding (L1+HT) (b) but without explicit cardinality constraint . The additional baseline models perform mostly on par with the small FC baseline, sometimes slightly better or slightly worst. The biggest change can be seen on the splice dataset where the additional baselines perform better than FC and ACN in the three bins with the highest number of parameters. The additional baselines were trained and evaluated following the same experimentation and hyperparameter protocol as the other models.

Represent the TLDR for finding the corresponding scientific article

We advance the state-of-the-art in model compression by proposing Atomic Compression Networks (ACNs), a novel architecture that is constructed by recursive repetition of a small set of neurons.

Represent the short summary for finding the corresponding scientific article (long)

We propose Janossy pooling, a method for learning deep permutation invariant functions designed to exploit relationships within the input sequence and tractable inference strategies such as a stochastic optimization procedure we call piSGD