Question: Represent the text to find a very short summary (1-2 sentences max)

Question: Neural networks with low-precision weights and activations offer compelling efficiency advantages over their full-precision equivalents. The two most frequently discussed benefits of quantization are reduced memory consumption, and a faster forward pass when implemented with efficient bitwise operations. We propose a third benefit of very low-precision neural networks: improved robustness against some adversarial attacks, and in the worst case, performance that is on par with full-precision models. We focus on the very low-precision case where weights and activations are both quantized to $\pm$1, and note that stochastically quantizing weights in just one layer can sharply reduce the impact of iterative attacks. We observe that non-scaled binary neural networks exhibit a similar effect to the original \emph{defensive distillation} procedure that led to \emph{gradient masking}, and a false notion of security. We address this by conducting both black-box and white-box experiments with binary models that do not artificially mask gradients. The ability to fool machine learning models by making small changes to their input severely limits their potential for safe use in many real-world scenarios. Example vulnerabilities include a seemingly innocuous audio broadcast that is interpreted by a speech recognition model in a smartphone, with the intent to trigger an e-transfer, as well as pictures or identity documents that are automatically tagged as someone other than the real individual. The two most common threat models when evaluating the security of a system are the black-box and white-box assumptions, which represent varying degrees of information that an adversary may possess. In a black-box threat model, an adversary has similar abilities to a normal user that interacts with a system by providing inputs and observing the corresponding outputs. Under this threat model, an adversary generally does not know details of the model architecture or dataset used to train the model. Of course, an adversary is free to assume that a convolutional architecture was likely used if the input domain is images, or a recurrent model for speech or text. In a white-box threat model, an adversary has complete access to the model architecture and parameters. In the case of neural networks, white-box attacks frequently rely on gradient information to craft especially strong adversarial examples, where strong means that the example is very close to the original input as defined by some distance norm (e.g. L 0 -number of features modified, L 2 -mean squared distance), yet is very likely to cause the model to yield the incorrect output. For both threat types, targeted attacks where a model is made to fail in a specific way (e.g. causing a handwritten '7' look like a '3') represents a stronger attack than simple misclassification. The problem with deploying machine learning systems that are secured in a traditional sense, is that adversarial examples have been shown to generalize well between models with different source and target architectures BID19 BID16 Tramèr et al., 2017). This means that a secured model can be compromised in an approximately white-box setting by training and attacking a substitute model that approximates the decision boundary of the model under attack BID16. Thus, to make strong about the robustness of a machine learning model to adversarial attacks, both threat models should be considered. Tangent to research on defences against adversarial attacks, significant progress has been made towards training very low-precision deep neural networks to accuracy levels that are competitive with full-precision models BID4 BID22 BID20. The current motivation for extreme quantization is the ability to deploy these models under hardware resource constraints, acceleration, or reduced power consumption. Ideally, 32× compression is possible by using 1-bit to represent single-precision floating point parameters. By similarly quantizing activations, we can reduce run-time memory consumption as well. These savings enable large scale deployment of neural networks on the billions of existing embedded devices. Very low-precision models were designed with deployment in mind, and may be responsible for making critical decisions in embedded systems, all subject to reverse engineering and a diverse set of real world attacks. With much at stake in applications like autonomous navigation, robotics, and network infrastructure, understanding how very low-precision neural networks behave in adversarial settings is essential. To that end, we make the following contributions:• To the best of our knowledge, we are the first to formally evaluate and interpret the robustness of binary neural networks (BNNs) to adversarial attacks on the MNIST BID10 ) and CIFAR-10 datasets.• We compare and contrast the properties of low-precision neural networks that confer adversarial robustness to previously proposed defense strategies. We then combine these properties to propose an optimal defense strategy.• We attempt to generalize and make recommendations regarding the suitability of lowprecision neural networks against various classes of attacks (e.g. single step vs. iterative). Since the initial disclosure of adversarial examples by BID19 and BID2, many defense strategies have been proposed and subsequently defeated. It is generally accepted that strategies for mitigating the impact of these examples still lag behind state of the art attacks, which are capable of producing adversarial examples that are indistinguishable from unmodified inputs as perceived by humans. In general, there are two approaches to defending against adversarial examples: reactive-detecting the presence of adversarial examples, such as through some notion of confidence-based outlier detection. On the other hand, a proactive approach aims to improve the robustness of the underlying model, which may involve adding an extra class to which malicious inputs should be assigned BID13. The latter approach is important for building reliable systems where a sensible decision must be made at all times. In this work, we focus solely on the proactive approach. To define adversarial examples, we require some measurement of distance that can be computed between perturbed inputs and naturally occurring inputs. In the visual domain, it is convenient if the metric approximates human perceptual similarity, but is not required. Various L p norms have been used in the literature: L 0 -number of features modified, L 2 -mean squared distance, L ∞ -limited only in the maximum perturbation applied to any feature. We evaluate at least one attack that is cast in terms of each respective distance metric, and leave discussion of the optimal distance metric to future work. The most compelling explanation for the existence of adversarial examples proposed to date is the linearity hypothesis. The elementary operators, matrix dot-products and convolutions used at each layer of a neural network are fundamentally too linear. Furthermore, the non-linearity applied at each layer is usually itself either piecewise linear (e.g. ReLU), or we have specifically encouraged the network through initialization or regularization to have small weights and activations such that its units (e.g. sigmoid, tanh) operate in their linear regions. By adding noise to inputs which is highly correlated with the sign of the model parameters, a large swing in activation can be induced. Additionally, the magnitude by which this noise must be scaled to have this effect tends to diminish as the input dimensionality grows. This piecewise linearity also makes neural networks easy to attack using the gradient of the output with respect to the input, and consequently, the ing incorrect predictions are made with high-confidence. Fortunately, we are reminded that the universal approximation theorem suggests that given sufficient capacity, a neural network should at least be able to represent the type of function that resists adversarial examples. The most successful defense mechanism to date, adversarial training, is based on this premise, and attempts to learn such a function. The fast gradient sign method (FGSM) is one such procedure for crafting this damaging noise, and is still used today despite not being state-of-the-art in the white-box setting, as it is straightforward to compute, and yields examples that transfer well between models.The linearity hypothesis was one of the main reasons for initially considering binarized neural networks as a natural defense against adversarial examples. Not only are they highly regularized by default through severely quantized weights, but they appear to be more non-linear and discontinuous than conventional deep neural networks (DNNs). Additionally, we suspect that the same characteristics making them challenging to train, make them difficult to attack with an iterative procedure. At the same time, assumptions regarding the information required by an effective adversary have become more and more relaxed, to the extent that black-box attacks can be especially damaging with just a small set of labeled input-output pairs BID16.Perhaps the most striking feature of adversarial examples is how well they generalize between models with different architectures while trained on different datasets BID16. It was shown by BID9 that 2/3 of adversarial ImageNet examples survive various camera and perspective transformations after being printed on paper and subsequently photographed and classified by a mobile phone. The most successful black-box attacks have the secured model (Oracle) assign labels to a set of real or synthetic inputs, which can be used to train a substitute model that mimics the Oracle's decision boundary BID16. A single step attack, such as FGSM, can be used on the smooth substitute model to generate examples that transfer, without having access to the original training data, architecture, or training procedure used by the Oracle. BID16 showed they are able to compromise machine learning models 80% of the time on small datasets like MNIST using various shallow MLP-based substitute models. There is not a particularly high correlation between test accuracy and transferability of adversarial examples; therefore despite not attaining great on the original MNIST task, a simple substitute learns enough to compromise the Oracle. This technique was shown to overcome gradient masking approaches, such as in the case with models that either obscure or have no gradient information, such as k-nearest neighbors or decision trees. With strong adversarial training of the model to be defended, attacks generated using the substitute model do not transfer as well. Therefore, to be compelling, BNNs should be able to handle training with large while maintaining competitive test accuracy on clean inputs relative to full-precision. The strongest white-box attacks all use an iterative procedure; however, the ing examples do not transfer as well as single step methods. An iterative attack using the Adam optimizer was proposed by BID3 that outperforms other expensive optimization based approaches BID19, the Jacobian-based saliency map attack (JSMA) BID14, and Deepfool BID12 in terms of three L p norms previously used as an adversarial example distance metrics in the literature. We have made our best attempt to use state-of-the-art attacks in our experiments. Figure 1: Blocks used in binary convolution architecture. In Figure 1, we depict the quantization scheme applied to the base convolutional neural network provided in the CleverHans library tutorials BID15. In the first layer, we retain weights and activations in single-precision floating point. Weights in hidden layers are binarized either de-terministically or stochastically, as in BID4, and activations were always binarized deterministically. Unlike in BID4, we stochastically quantize weights at test time as a possible defense against iterative attacks. Under the stochastic binarization scheme, weights are sampled once per forward pass from a Bernoulli distribution with probability given by passing the real valued weight through the hard sigmoid function from BID4. Lastly, we map the Bernoulli samples ∈ to ±1 by multiplying by 2 and subtracting 1 2.We do not find that this significantly slows down training with TensorFlow BID0 on a modern GPU, but these networks take between 3-4× as many epochs as a deterministically quantized binary network to converge. We use the straight through estimator (STE) to back-propagate gradients through the quantization step BID1. We optionally insert a small (e.g 1e-2) tunable scalar after the ReLU in hidden layers, to compensate for an increase in the L1 norm of the activations due to binarization. BID20 also used this approach to reach similar accuracy gains as those conferred by the more expensive XNOR-Net channel-wise normalization scheme BID17. Convolution kernels were initialized from a truncated normal distribution with σ=0.2 for accumulating full-precision weight updates, and were quantized to ±1 in the forward pass. Batch normalization was applied before quantizing activations to ensure they were centered around zero BID6.We report test error rates for these models on MNIST with varying capacity in Table 6 of Appendix A. Capacity is denoted by the number of kernels in the first layer, K Layer1. All subsequent layers had exactly double this number of kernels. Models were trained for 15 epochs unless indicated otherwise. In general, models with full-precision weights and activations under-fit the naturally occurring data less than a binary equivalent, with error rates of approximately 1% and 2%, respectively. With the addition of the small learned scaling factor, the binary models converge to approximately the same error rate as the full-precision model on MNIST and CIFAR-10.We experiment with three different types of adversarial training, depending on the combination of dataset and attack: FGSM with fixed, FGSM with sampled from a truncated normal distribution as in, and projected gradient descent (PGD) BID11, which is the state-of-the-art adversarial training procedure for MNIST. We do not necessarily pair all training methods against all attacks. The model's own best prediction is used as the true label to minimize in adversarial training, unless otherwise noted to prevent the label leaking effect. We first attempt to fool our binarized networks with single step attacks in a whitebox setting, and progressively scale up to stronger state-of-the-art attacks. All experiments were conducted by seeding the TensorFlow random number generator with the value 1234. All experiments were conducted in TensorFlow, and used either v2.0.0 of CleverHans BID15, or Foolbox, a Python toolbox for creating adversarial examples BID18. All attacks were clipped to the anticipated input range during adversarial training and evaluation. For single step attacks, we fix the magnitude of the perturbation and attack the whole test set, then report accuracy on the new test set. The general procedure for iterative attacks is to fix the step size per iteration or learning rate, and number of iterations. We then report accuracy on the perturbed test set after this many iterations while keeping other hyper-parameters constant. The FGSM is a simple but effective single step attack first introduced in, and defined in eq. The attack linearly approximates the gradient of the loss used to train the model with respect to the input. The gradient is thresholded by taking its sign, scaled by a uniform constant, and added to, or subtracted from, the input, depending on if we wish to minimize the current class, or move in the direction of a target class: DISPLAYFORM0 2 In TensorFlow this can be accomplished with: 2 * Bernoulli(probs=tf.clip by value((x + 1.)/ 2., 0., 1.))).sample -1To confer robustness to more than one value of with which an adversary may use to attack, the adversarial training procedure from proposes to sample a unique for each training example from a truncated normal distribution. We set the standard deviation to σ = ceil(max * 255/2). We consider up to max = 0.3, as this is a common upper limit for a L ∞ norm perturbation that is not easily perceived by humans, and corresponds to a 30% change in pixel intensity for an arbitrary number of pixels. Table 1: Accuracy on adversarial examples generated with a FGSM misclassification attack on the MNIST test set with three values of. Three different models were evaluated: A is full-precision, B is binary, and C is binary with a learned scalar. Models trained with, and without, adversarial training are shown. The'+' suffix indicates the model was trained for the last 5 epochs with the procedure from. All values averaged over four runs for models trained from scratch. Model In Table 1, it can be observed that a plain binary network without adversarial training (B) achieves the best robustness to FGSM, with nearly 90% accuracy for = 0.1 for the highest capacity model. We postpone a formal explanation of this outlier for the discussion. Our for large agree with observations made by BID11 where they found FGSM to be suboptimal for training as it yields a limited set of adversarial examples. We suspect that the reason neither scaled nor unscaled binary models performed well when trained with an adversary and tested on larger values of is because by the time adversarial training was introduced at epoch 10, both had entered into a state of decreased learning. Our binary weight implementation makes updates to real valued weights during training, which are binarized in the forward pass. The real valued weights tend to polarize as the model converges, ing in fewer sign changes. Regularization schemes actually encouraging the underlying real valued weights to polarize around ±1 have been proposed BID20 ), but we do not find this to be particularly helpful after sweeping a range of settings for the regularization constant λ. Regardless, in this case, the binary models did not benefit from adversarial training to the same extent that the full-precision models did. DISPLAYFORM1 We find that adversarial training with binary models is somewhat of a balancing act. If a strong adversary is introduced to the model too early, it may fail to converge for natural inputs. If introduced too late, it may be difficult to bring the model back into its malleable state, where it is willing to flip the sign of its weights. Despite this challenge, the scaled binary model (C+) (see Figure 1 for location of optional scalar) reaped significant benefits from adversarial training and its accuracy was on par with the full-precision model for = 0.1.To investigate the low performance observed against large in Table 1, models A and C were trained from scratch with 40 iterations of PGD BID11. TAB1 shows the of this new training and subsequent FGSM attack performed identically to that of Table 1. A similar trend was found in TAB1, where the lowest capacity models struggle to become robust against large. Once the scaled binary model had sufficient capacity, it actually slightly outperforms its fullprecision equivalent for all values of. With this, we have demonstrated that not only can BNNs achieve competitive accuracy on clean inputs with significantly fewer resources, but they can also allocate excess capacity in response to state-of-the-art adversaries. The Carlini-Wagner L2 attack (CWL2) is an iterative process guided by an optimizer such as Adam, that produces strong adversarial examples by simultaneously minimizing distortion, and manipulating the logits per the attack goal. We use the implementation from CleverHans BID15 and show in TAB2 and FIG0. Only binary models are shown in TAB2 because all but two full-precision models had zero accuracy after running CWL2 for 100 iterations. The best full-precision model was A256+ with 1.8±0.9% accuracy. We note that the stochastically quantized binary models with scaling to prevent gradient masking ('S' prefix) underfit somewhat on the training set, and had test error rates of 8±1%, 5±2%, and 3±1% for each of S64, S128, and S256 averaged over four runs. For S256, this test error can be compared with an unscaled binary model which only achieves 22±3% accuracy with gradient masking compared to 46±3% without. In FIG0, it can be observed that binary and full-precision models perform somewhat similarly for the first few iterations of the CWL2 attack, but beyond 10-20 iterations, the accuracy of fullprecision models drops off quickly, regardless of having performed adversarial training. We note that PGD, defined with respect to the L ∞ norm, makes no claim of increasing robustness to L 2 attacks, such as CWL2. Interestingly, it can be seen that the binary model benefited from adversarial training considerably when evaluated at 10 to 100 attack iterations, while the full-precision model did not. These benefits eventually disappear to within the margin of random error after continuing to 1000 iterations, as recommended by BID3. At this point, both B and B+ had accuracy of 19±3%, by which time the full-precision models had long flatlined at zero. Meanwhile, S64 maintained 38 ± 3% accuracy after 1000 iterations, nearly double that of the deterministically quantized models. Running these attacks to 1000 iterations was two orders of magnitude more time consuming than training these models from scratch (without PGD training); therefore we believe this targeted attack represents a fairly substantial level of effort on behalf of the adversary. We run the substitute model training procedure from BID16 using CleverHans v2.0.0, for both MNIST and CIFAR-10 datasets with and without FGSM adversarial training. As a substitute model, we use a two-layer MLP with 200 hidden units and ReLU activations. The substitute is trained on 150 images withheld from the test set, and augmented by perturbing the images in the direction of maximal variability of the substitute model, as defined by the Jacobian. Six epochs of data augmentation with λ = 0.1 were used in combination with 10 substitute model training epochs after each augmentation step. The oracle was again trained for 15 epochs for MNIST, and 20 epochs for CIFAR-10. Results for the black-box experiment on the MNIST dataset are shown in TAB3. Full-precision networks had a moderate advantage over undefended binary models B and C. Only the highest capacity full-precision model benefited from FGSM adversarial training, while the scaled binary model benefited regardless of capacity. There was a small positive relationship between accuracy and capacity for both A and C when trained with PGD, and there was almost no loss in accuracy in this setting after binarization. PGD was more effective than stochasticity here as it leads to learning a more optimal decision boundary, rather than confusing an adversary with dynamic gradient information. We suspect that plain BNNs implement two different kinds of gradient masking. We discovered the first by tracking the L1 norm of the hidden layer activations and unscaled logits. BNNs operate with larger range and variance than'normal' networks, which can be explained by virtue of convolving inputs with greater magnitude (±1) compared with the typically small values taken by weights and activations. For our 64 kernel CNN, the logits were about 4× larger than the scaled or full-precision networks. This is analogous to the more complex defensive distillation procedure in which the model to be secured is trained with soft-labels generated by a teacher model. When training the teacher, a softmax temperature, T 1 is used. The distilled model is trained on the labels assigned by the teacher and using the same T. At test time, the model is deployed with T = 1, which causes the logits to explode with respect to their learned values. The logits saturate the softmax function and cause gradients to vanish, leading FGSM and JSMA to fail at a higher rate. However, this defense is defeated with a close enough guess for T, or via a black box attack BID3.The second type of gradient masking is less easily overcome, and has to do with gradients being inherently discontinuous and non-smooth, as seen in FIG1 of Appendix B. We believe that this effect is what gives scaled BNNs an advantage over full-precision with respect to targeted attacks. Even more importantly, through a regularization effect, the decision boundary for the MLP with binary units FIG1 ) better represents the actual function to be learned, and is less susceptible to adversarial examples. But why does gradient masking have a disproportionate effect when attacking compared with training on clean inputs? Models'A' and'B' were trained to within 1.2% test accuracy, while'B' had improvements of 9.0% and 29.5% on JSMA and CWL2 attacks respectively, corresponding to 8× and 25× difference in accuracy, respectively, for adversarial vs. clean inputs. For JSMA, the performance gap can be attributed to the sub-optimality of the attack as it uses logits rather than softmax probabilities. Furthermore, to achieve its L0 goal, pairs of individual pixels are manipulated which is noisy process in a binarized model. The success of model'S' with stochastically quantized weights in its third convolutional layer against iterative attacks is more easily explained. Adversarial examples are not random noise, and do not occur in random directions. In fact, neural networks are extremely robust to large amounts of benign noise. An iterative attack that attempts to fool our stochastically quantized model faces a unique model at every step, with unique gradients. Thus, the direction that minimizes the probability of the true class in the first iteration is unlikely to be the same in the second. An iterative attack making n steps is essentially attacking an ensemble of n models. By making a series of small random steps, the adversary is sent on the equivalent of a wild goose chase and has a difficult time making progress in any particularly relevant direction to cause an adversarial example. We have shown that for binarized neural networks, difficulty in training leads to difficulty when attacking. Although we did not observe a substantial improvement in robustness to single step attacks through binarization, by introducing stochasticity we have reduced the impact of the strongest attacks. Stochastic quantization is clearly far more computationally and memory efficient than a traditional ensemble of neural networks, and could be run entirely on a micro-controller with a pseudo random number generator. Our adversarial accuracy on MNIST against the best white-box attack (CWL2) is 71±2% (S64+) compared with the best full-precision model 1.8±0.9% (A256+). Blackbox were competitive between binary and full-precision on MNIST, and binary models were slightly more robust for CIFAR-10, which we attribute to their improved regularization. Beyond their favourable speed and resource usage, we have demonstrated another benefit of deploying binary neural networks in industrial settings. Future work will consider other types of low-precision models as well as other adversarial attack methods. Table 6: Error on clean MNIST test set for models with varying capacity and precision. A is fullprecision, B is binary, and C is binary with a learned scalar applied to the ReLU in hidden layers. All models were trained with Adam for 15 epochs with a batch size of 128 and a learning rate of 1e-3. For adversarially trained models, we used 20 iterations of PGD BID11 We reproduce the toy problem in BID14 of learning the two-input logical AND function with a simple MLP having two neurons in each layer. The only difference between our experiment and the original is that we train a 3-hidden-layer MLP (as opposed to 2-layers) with the Adam optimizer for 1k epochs, with a learning rate of 0.1. We use 3 layers since this is the smallest number of layers where the middle one can be quantized without directly touching the input or output, which would adversely impact learning. Here, a "quantized" layer means that its weights and activations are thresholded to +1 and -1, and a straight through estimator BID1 is used to backpropagate gradients for learning. All configurations in the AND experiment learn a reasonable decision boundary; however, the MLPs with a single quantized hidden layer had highly non-linear forward gradients, as can be seen in FIG1. As training progresses, the forward derivative was highly dynamic and took on a variety of different shapes with sharp edges and peaks. When the MLP was allowed more capacity by doubling the number of hidden units (see Figure 4), the forward derivative was almost entirely destroyed. If one was to use this information to construct a saliency map, only two regions would be proposed (with poor directional information), and once exhausted there would be no further choices more insightful than random guessing. In Figure 5 we compare the logits of full-precision and binary networks under varying degrees of FGSM perturbation. We noticed that for softmax temperature T between 0.6-0.7 the direction in which increasing the perturbation causes an adversarial example flips. We observe no similar effect for full-precision models. Additionally the full-precision logits respond to scaling in an approximately linear manner, whereas there is very little change in logits for the binary case apart from the 180 degree flip. We used values of in the range of actual attacks conducted in the paper, however the piecewise linear effect from is still there for with large absolute value.

We conduct adversarial attacks against binarized neural networks and show that we reduce the impact of the strongest attacks, while maintaining comparable accuracy in a black-box setting

This paper identifies classes of problems for which adversarial examples are inescapable, and derives fundamental bounds on the susceptibility of any classifier to adversarial examples.


Question: Represent the text to find a very short summary (1-2 sentences max)

Question: Unsupervised bilingual dictionary induction (UBDI) is useful for unsupervised machine translation and for cross-lingual transfer of models into low-resource languages. One approach to UBDI is to align word vector spaces in different languages using Generative adversarial networks (GANs) with linear generators, achieving state-of-the-art performance for several language pairs. For some pairs, however, GAN-based induction is unstable or completely fails to align the vector spaces. We focus on cases where linear transformations provably exist, but the performance of GAN-based UBDI depends heavily on the model initialization. We show that the instability depends on the shape and density of the vector sets, but not on noise; it is the of local optima, but neither over-parameterization nor changing the batch size or the learning rate consistently reduces instability. Nevertheless, we can stabilize GAN-based UBDI through best-of-N model selection, based on an unsupervised stopping criterion. A word vector space -also sometimes referred to as a word embedding -associates similar words in a vocabulary with similar vectors. Learning a projection of one word vector space into another, such that similar words -across the two word embeddings -are associated with similar vectors, is useful in many contexts, with the most prominent example being the alignment of vocabularies of different languages. This is a key step in machine translation of low-resource languages ). An embedding of English words may associate thoughtful, considerate, and gracious with similar vectors, for example, but for English-Icelandic translation, it would be useful to have access to a cross-lingual word embedding space in which hugulsamur (lit.: 'thoughtful') was also associated with a similar vector. Such joint embeddings of words across languages can also be used to extract bilingual dictionaries. Projections between word vector spaces have typically been learned from dictionary seeds. In seminal papers such as BID22 and BID11, these seeds would comprise thousands of words, but BID31 showed that we can learn reliable projections from as little as 50 words. and BID15 subsequently showed that the seed can be replaced with just words that are identical across languages; and BID1 showed that numerals can also do the job, in some cases; both proposals removing the need for an actual dictionary. Even more recently, a handful of papers have proposed an entirely unsupervised approach to projecting word vector spaces onto each other, based on Generative Adversarial Networks (GANs) BID12. We present the core idea behind such approaches in §3, but briefly put, GANs are used to learn a linear transformation to minimize the divergence between a target distribution (say the Icelandic embeddings) and a source distribution (the English embeddings projected into the Icelandic space).The possibility of unsupervised bilingual dictionary induction (UBDI) has seemingly removed the data bottleneck in machine translation, evoking the idea that we can now learn to translate without human supervision ). Yet, it remains an open question whether the initial, positive extrapolate to real-world scenarios of learning translations between low-resource language pairs. recently presented suggesting that UBDI is challenged by some language pairs exhibiting very different morphosyntactic properties, as well as when the monolingual corpora are very different. In this paper, we identify easy, hard, and impossible instances of GAN-based UBDI, and apply a simple test for discriminating between them. The hard cases exhibit instability, i.e. their success depends heavily on initialization. We set up a series of experiments to investigate these hard cases. Our contributions We introduce a distinction between easy, hard, and impossible alignment problems over pairs of word vector spaces and show that a simple linearity test can be used to tell these cases apart. We show that the impossible cases are caused not necessarily by linguistic differences, but rather by properties of the corpora and the embedding algorithms. We also show that in the hard cases, the likelihood of being trapped in local minima depends heavily on the shape and density of the vector sets, but not on noise. Changes in the number of parameters, batch size, and learning rate do not alleviate the instability. Yet, using an unsupervised model selection method over N different initializations to select the best generators, leads to a 6.74% average error reduction over standard MUSE.Structure of the paper §2 presents MUSE BID6, an approach to GAN-based UBDI. Here we also discuss theoretical from the GAN literature, relevant to our case, and show a relation to a common point set registration method. In §3, we use a test based on Procrustes Analysis to discriminate between easy, hard, and impossible cases, discussing its relation with tests of isomorphism and isospectrality. We then focus on the hard cases, where linear transformations provably exist, but GANs exhibit considerable instability. Through a series of experiments, we analyze what affects the instability of GAN-based UBDI. §4 presents our unsupervised best-of-N model selection method for stabilizing GAN-based UBDI. In this section, we discuss the dynamics of GAN-based UBDI and how the training behavior of GANs can help us understand their limitations as applied to UBDI. Two families of approaches to UBDI exist: using GANs BID3 BID6 BID34 and using iterative closest point BID16. We focus on GAN-based UBDI, and more specifically on MUSE BID6, but at the end of this section we establish a relation between the two families of algorithms. A GAN consists of a generator and a discriminator. The generator G is trained to fool the discriminator D. The generator can be any differentiable function; in MUSE, it is a linear transform Ω. Let e ∈ E be an English word vector, and f ∈ F a French word vector, both of dimensionality d. The goal of the generator is then to choose Ω ∈ R d×d such that ΩE has a distribution close to F. The discriminator is a map D w: X → {0, 1}, implemented in MUSE as a multi-layered perceptron. The objective of the discriminator is to discriminate between vector spaces F and ΩE. During training, the model parameters Ω and w are optimized using stochastic gradient descent by alternately updating the parameters of the discriminator based on the gradient of the discriminator loss and the parameters of the generator based on the gradient of the generator loss, which, by definition, is the inverse of the discriminator loss. The loss function used in MUSE and in our experiments below is cross-entropy. In each iteration, we sample N vectors e ∈ E and N vectors f ∈ F and update the discriminator parameters w according to DISPLAYFORM0 Theoretically, the optimal parameters are a solution to the min-max problem: DISPLAYFORM1 If a generator wins the game against an ideal discriminator on a very large number of samples, then F and ΩE can be shown to be close in Jensen-Shannon divergence, and thus the model has learned the true data distribution. This , referring to the distributions of the data, p data, and the distribution, p g, G is sampling from, is from BID12: If G and D have enough capacity, and at each step of training, the discriminator is allowed to reach its optimum given G, and p g is updated so as to improve the criterion DISPLAYFORM2 then p g converges to p data. This relies on a number of assumptions that do not hold in practice. The generator in MUSE, which learns a linear transform Ω, has very limited capacity, for example, and we are updating Ω rather than p g. In practice, therefore, during training, MUSE alternates between k steps of optimizing the discriminator and one step of optimizing the generator. Another common problem with training GANs is that the discriminator loss quickly drops to zero, when there is no overlap between p g and p data ; but note that in our case, the discriminator is initially presented with IE and F, for which there is typically no trivial solution, since the embedding spaces are likely to overlap. We show in §4 that discriminator and generator loss are poor model selection criteria, however; instead we propose a simple criterion based on cosine similarities between nearest neighbors in the learned alignment. From ΩE and F, we can extract a bilingual dictionary using nearest neighbor queries, i.e., by asking what is the nearest neighbor of ΩE in F, or vice versa. MUSE uses a normalized nearest neighbor retrieval method to reduce the influence of hubs BID24 BID9. The method is called cross-domain similarity local scaling (CSLS) and used to expand high-density areas and condense low-density ones. The mean similarity of a source language embedding Ωe to its k nearest neighbors in the target language (k = 10 suggested) is defined as µ DISPLAYFORM3 where cos is the cosine similarity. µ F (f i) is defined in an analogous manner for every i. CSLS(e, f i) is then calculated as 2cos(e, DISPLAYFORM4 . MUSE uses an unsupervised validation criterion based on CSLS. The translations of the top 10k most frequent words in the source language are obtained with CSLS and average pairwise cosine similarity is computed over them. This metric is considered indicative of the closeness between the projected source space and the target space, and is found to correlate well with supervised evaluation metrics. After inducing a bilingual dictionary, E d and F d, by querying ΩE and F with CSLS, MUSE performs a refinement step based on the Procrustes algorithm BID26, whereby the singular value decomposition of DISPLAYFORM5 The idea of minimizing nearest neighbor similarity for unsupervised model selection is also found in point set registration and lies at the core of iterative closest point (ICP) optimization BID4. ICP typically minimizes the λ 2 distance (mean squared error) between nearest neighbor pairs. The ICP optimization algorithm works by assigning each transformed vector to its nearest neighbor and then computing the new relative transformation that minimizes the cost function with respect to this assignment. ICP can be shown to converge to local optima BID4, in polynomial time BID10. ICP easily gets trapped in local optima, however, exact algorithms only exist for two-and three-dimensional point set registration, and these algorithms are slow BID33. Generally, it holds that the optimal solution to the GAN min-max problem is also optimal for ICP. To see this, note that a GAN minimizes the Jensen-Shannon divergence between F and ΩE. The optimal solution to this is F = ΩE. As sample size goes to infinity, this means the L 2 loss in ICP goes to 0. In other words, ICP loss is minimal if an optimal solution to the UBDI min-max problem is found. ICP was independently proposed for UBDI in BID16. They report their method only works using PCA initialization. We explored PCA initialization for MUSE, but observed the opposite effect, namely that PCA initialization leads to a degradation in performance. A function Ω from E to F is a linear transformation if Ω(f + g) = Ω(f) + Ω(g) and Ω(kf) = kΩ(f) for all elements f, g of E, and for all scalars k. An invertible linear transformation is called an isomorphism. The two vector spaces E and F are called isomorphic, if there is an isomorphism from E to F. Equivalently, if the kernel of a linear transformation between two vector spaces of the same dimensionality contains only the zero vector, it is invertible and hence an isomorphism. Most work on supervised or unsupervised alignment of word vector spaces relies on the assumption that they are approximately isomorphic, i.e., isomorphic after removing a small set of vertices BID22 BID3 BID34 BID6. In this section, show that word vector spaces are not necessarily approximately isomorphic. We will refer to cases of non-approximately isomorphic word vector spaces as impossible cases. The possible cases can be further divided into easy and hard cases; corresponding to the cases where GAN-based UBDI is stable and unstable (i.e., performance is highly dependent on initialization), respectively. It is not difficult to see why hard cases may arise when using GANs for unsupervised alignment of vector spaces. One example of a hard (but not impossible) problem instance is the case of two smoothly populated vector spaces on unit spheres. In this case, there is an infinite set of equally good linear transformations (rotations) that achieve the same training loss. Similarly, for two binary-valued, n-dimensional vector spaces with one vector in each possible position. Here the number of local optima would be 2 n, but since the loss is the same in each of them the loss landscape is highly non-convex, and the basin of convergence is therefore very small BID33. The chance of aligning the two spaces using gradient descent optimization would be 1 2 n. In other words, minimizing the Jensen-Shannon divergence between the word vector distributions, even in the easy case, is not always guaranteed to uncover an alignment between translation equivalents. From the above, it follows that alignments between linearly alignable vector spaces cannot always be learned using UBDI methods. In §3.1, we test for approximate isomorphism to decide whether two vector spaces are linearly alignable. §3.2-3.3 are devoted to analyzing when alignments between linearly alignable vector spaces can be learned. In our experiments in §3 and 4, Bengali and Cebuano embeddings are pretrained by FastText; 1 all others are trained using FastText on Polyglot.2 In the experiments in §5, we use FastText embeddings pretrained on Wiki and Common Crawl data. 3 If not indicated otherwise, we use MUSE with default parameters BID6. Procrustes fit ) is a simple linearity test, which, as we find, captures the dynamics of GAN-based UBDI well. Compared to isomorphism and isospectrality tests, Procrustes fit is inexpensive and can be run with bigger dictionary seeds. Procrustes fit The idea behind this test is to apply a Procrustes analysis (see §2) on a sizeable dictionary seed (5000 tokens), to measure the training fit. Since U V T E = F if and only if E and F are isomorphic, the Procrustes fit tests the linear alignability between two embedding spaces exists. We can correlate the Procrustes fit measure with the performance of UBDI. While UBDI is motivated by cases where dictionary seeds are not available, and Procrustes fit relies on dictionary seeds, a strong correlation can act as a sanity check on UBDI, as well as a tool to help us understand its limitations. The relationship between Procrustes fit and UBDI performance is presented in FIG0 and shows a very strong correlation. One immediate is that the poor UBDI performance on languages such as Bengali and Cebuano is not a of GANs being a poor estimator of the linear transforms, but rather a of there not being a good linear transform from English into these languages. Isomorphism and isospectrality We briefly compare Procrustes fit to two similarity measures for nearest neighbor graphs of vector spaces, introduced in graph of a word vector space is obtained by adding edges between any word vertex and its nearest neighbor. Note that only cycles of length 2 are possible in a nearest neighbor graph. Two nearest neighbor graphs are graph isomorphic if they contain the same number of vertices connected in the same way. Two isomorphic vector spaces have isomorphic nearest neighbor graphs, but not vice versa. We say that the nearest neighbor graphs are k-subgraph isomorphic if the nearest neighbor graphs for the most frequent k words (in the source language and their translations) are isomorphic. There are exact algorithms, e.g., VF2 BID7, for checking whether two nearest neighbor graphs are graph isomorphic. These algorithms do not scale easily to graphs with hundreds of thousands of nodes, however. Also, the algorithms do not identify approximate isomorphism, unless run on all subgraphs with k vertices removed. Such tests are therefore impractical. instead introduce a spectral metric based on eigenvalues of the Laplacian of the nearest neighbor graphs, similar to metrics used for graph matching problems in computer vision BID25 and biology BID20. The metric quantifies to what extent the nearest neighbor graphs are isospectral. Note that (approximately) isospectral graphs need not be (approximately) isomorphic, but (approximately) isomorphic graphs are always (approximately) isospectral. Let A 1 and A 2 be the adjacency matrices of the nearest neighbor graphs G 1 and G 2 of our two word embeddings, respectively. Let L 1 = D 1 − A 1 and L 2 = D 2 − A 2 be the Laplacians of the nearest neighbor graphs, where D 1 and D 2 are the corresponding diagonal matrices of degrees. We then compute the eigensimilarity of the Laplacians of the nearest neighbor graphs, L 1 and L 2. For each graph, we find the smallest k such that the sum of the k largest Laplacian eigenvalues is <90% of the Laplacian eigenvalues. We take the smallest k of the two, and use the sum of the squared differences between the largest k Laplacian eigenvalues DISPLAYFORM0. Note that ∆ = 0 means the graphs are isospectral, and the metric goes to infinite. Thus, the higher ∆ is, the less similar the graphs (i.e., their Laplacian spectra). Isospectrality varies with Procrustes fit; to see this, we show that DISPLAYFORM1 F, in this case Ω = I. Two isomorphic graphs also have the same set of sorted eigenvalues, i.e., DISPLAYFORM2 In general, it holds that if we add an edge to a graph G, to form G, its spectrum changes monotonically BID29. Since the Procrustes fit evaluates the nearest neighbor graph, it follows that a change in the nearest neighbor graph leading to a drop in Procrustes fit will also lead to a drop in eigenvector similarity. However, isomorphism and isospectrality tests are computationally expensive, and in practice, we have to sample subgraphs and run the tests on multiple subgraphs, which leads to a poor approximation of the similarities of the two embedding graphs. In practice, Procrustes fit, k-subgraph isomorphism, and k-subgraph isospectrality thus all rely on a dictionary. The tests are therefore not diagnostic tools, but means to understand the dynamics of UBDI. Procrustes fit is more discriminative (since vector space isomorphism entails nearest neighbor graph isomorphism, not vice versa) and computationally more efficient. In our experiments, it also correlates much better with UBDI performance (MUSE in Table 2 ; the correlation coefficient is 96%, compared to 0% for k-subgraph isomorphism (not listed in Table 2), and -27% for k-subgraph isospectrality with k = 10.Observation 1 Impossible cases are not (solely) the of linguistic differences, but also of corpus characteristics. English-Bengali and English-Cebuano are not linearly alignable according to our Procrustes fit tests. There can be two explanations for such an observation: linguistic differences between the two languages or variance in the monolingual corpora for Bengali and Cebuano, i.e. noise and little support per word. We test for this by applying the Procrustes fit test to the word vector spaces of Bengali and a higher resource related language, Hindi. The Procrustes fit for Bengali-Hindi is even lower than for compared to 46.25, respectively). This finding is surprising as we would expect Bengali and Hindi to align well due to their relatedness. The thus suggests that the Bengali embeddings are of insufficient quality, which can largely explain the poor alignment found by the GAN. This is further supported by follow-up experiments we ran aligning a word vector space for English and a word vector space induced from scrambled English sentences (learned on two different 10% samples of Wikipedia), which can be thought of as a sample from a synthetic language that completely diverges from English in its syntactic properties.5 GAN-based UBDI was able to near-perfectly recover the word identities without supervision, showing that its success is not easily impeded by linguistic differences. Observation 2 Impossible cases can also be the of the inductive biases of the underlying word embedding algorithms. One observation made in BID6 is that the performance of MUSE degrades a little when using alternative embedding algorithms, but that alignment is still possible. We, however, observe that this is not the case if using different, monolingual embedding algorithms, i.e., if using FastText for English and Hyperwords for Spanish. While such embeddings are still linearly alignable (as verified by computing their Procrustes fits), GAN-based UBDI consistently fails on such cases. This also holds for the case of aligning FastText for English and Hyperwords for English, as observed in BID14. In order to better understand the dynamics of GAN-based UBDI in hard cases, i.e., when the GAN suffers from local minima, we introduce three ablation transformations, designed to control for properties of the word vector spaces: unit length normalization, PCA-based pruning, and noising. The of GAN-based UBDI after applying these transforms are reported in Table 2.Observation 3 GAN-based UBDI becomes more unstable and performance deteriorates with unit length normalization. This ablation transform performs unit length normalization (ULN) of all vectors x, i.e., x = x ||x|| 2, and is often used in supervised bilingual dictionary induction BID32 BID1. We use this transform to project word vectors onto a sphere -to control for shape information. If vectors are distributed smoothly over two spheres, there is no way to learn an alignment in the absence of dictionary seed; in other words, if UBDI is unaffected by this transform, UBDI learns from density information alone. While supervised methods are insensitive to or benefit from ULN, we find that UBDI is very sensitive to such normalization (see Table 2, M-unit). We verify that supervised alignment is not affected by ULN by checking the Procrustes fit (§3.1), which remains unchanged under this transformation. Observation 4 GAN-based UBDI becomes more unstable and performance deteriorates with PCA pruning. In order to control for density, we apply PCA to our word vector spaces, reducing them to 25 dimensions, and prune our vocabularies to remove density clusters by keeping all but one of the nearest neighbors vectors on an integer grid. This removes about 10% of our vocabularies. We then apply UBDI to the original vectors for the remaining words. This smoothening of the embeddings in highly unstable and reduced performance (see Table 2, M-PCA). In other words, density information, while less crucial than shape information, is important for the stability of UBDI, possibly by reducing the chance of getting stuck in local optima. This is in contrast with the on using ICP for UBDI in BID16 Table 2: Main experiments; average performance and stability across 10 runs. We consider a P@1 score below 1% a fail. MUSE is the MUSE system with default parameters. Ablation transforms: M-unit uses unit length normalization to evaluate the impact of shape; M-PCA uses PCA-based pruning to evaluate the impact of density; M-noise uses 25% random vectors injected in the target language space to evaluate the impact of noise. M-discr uses discriminator loss for model selection, as a baseline for M-cosine; M-cosine uses our model selection criterion. The macro-averaged error reduction of M-cosine over MUSE for the HARD languages is 7%; and 4% across all language pairs. using PCA initialization with 50 dimensions. We ran experiments with 25, 50, and 100 dimensions, with or without pruning, observing significant drops in performance across the board. Observation 5 GAN-based UBDI is largely unaffected by noise injection. We add 25% random vectors, randomly sampled from a hypercube bounding the vector set. GAN-based UBDI are not consistently affected by noise injection (see Table 2, M-noise). This is because the injected vectors rarely end up in the seed dictionaries used for the Procrustes analysis step. In follow-up experiments on Greek and Hungarian, we find that GAN-based UBDI gets stuck in local optima in hard cases, and over-parameterization, increasing batch size or decreasing learning rate does not help. Observation 6 In the hard cases, GAN-based UBDI gets stuck in local optima. In cases where linear alignment is possible, but UBDI is unstable, the model might get stuck in a local optimum, which is the of the discriminator loss not increasing in the region around the current discriminator model. We analyze the discriminator loss in these areas by plotting it as a function of the generator parameters for the failure cases of two of the hard alignment cases, namely English-Greek and English-Hungarian. We plot the loss surface along its intersection with a line segment connecting two sets of parameters BID13 BID21. In our case, we interpolate between the model induced by GAN-based UBDI and the (oracle) model obtained using supervised Procrustes analysis. Result are shown in FIG2. The green loss curves represent the current discriminator's loss along all the generators between the current generator and the generator found by Procrustes analysis. In all cases, we see that while performance (P@1 and mean cosine similarity) goes up, there is an initial drop in the discriminator loss, which suggests there is no learning signal in this direction for GAN-based UBDI. This is along a line segment representing the shortest path from the failed generator to the oracle generator, of course; linear interpolation provides no guarantee there are no almost-as-short paths with plenty of signal. A more sophisticated sampling method is to sample along two random direction vectors BID13; BID21. We used an alternative strategy of sampling from normal distributions with fixed variance that were orthogonal to the line segment. We observed the same pattern, leading us to the that instability is caused by local optima. Observation 7 Over-parameterization does not consistently help in the hard cases. Recent work has observed that over-parameterization leads to smoother loss landscapes and makes optimization easier BID5. We experiment with widening our discriminators to smoothen the loss landscape, but are inconsistent: for Hungarian, this made GAN-based UBDI more stable; for Greek, less stable (see FIG2).Observation 8 Changing the batch size or the learning rate to hurt the discriminator also does not help. Previous work has shown that large learning rate and small batch size contribute towards SGD finding flatter minima BID17, but in our experiments, we are interested in the discriminator not ending up in flat regions, where there is no signal to update the generator. We therefore experiment with smaller learning rate and larger batch sizes. The motivation behind both is decreasing the scale of random fluctuations in the SGD dynamics BID27 BID2, enabling the discriminator to explore narrower regions in the loss landscape. See FIG2 for . Increasing the batch size or varying the learning rate (up or down) clearly comes at a cost, and it seems the MUSE default hyperparameters are close to optimal. In this section, we compare two unsupervised model selection criteria. We train three models with different random seeds in parallel and use the selection criterion to select one of these models to train for the remaining epochs. The first criterion is the discriminator loss during training, which is used in BID8, for example. In contrast, we propose to use the mean cosine similarity between all translations predicted by the CSLS method (see §2), which was used as an unsupervised stopping criterion by BID6.Observation 9 In the hard cases, model selection with cosine similarity can stabilize GAN-based UBDI. As we see in Table 2, the selection criterion based on discriminator loss (M-discr) increases the instability of UBDI, leading to 4/10 failed alignments for Greek compared to 2/10 without model selection, for example. Cosine similarity (M-cosine) in contrast leads to perfectly stable UBDI. Note that if the probability of getting stuck in a local optimum that leads to a poor alignment is β, using n random restarts and oracle model selection we increase the probability of finding a good alignment to 1 − (1 − β) n. In our experiments, n = 3. Some pairs of word vector spaces are not alignable based on distributional information alone. For other pairs, GANs can be used to induce such an alignment, but the degree of instability is very susceptible to the shape and density of the word vector spaces, albeit not to noise. Instability is caused by local optima, but not remedied by standard techniques such as over-parameterization, increasing the batch size or decreasing the learning rate. We propose an unsupervised model selection criterion that enables stable learning, leading to a~7% error reduction over MUSE, and present further observations about the alignability of word vector distributions.

Represent the short summary for finding the corresponding scientific article (long)

An empirical investigation of GAN-based alignment of word vector spaces, focusing on cases, where linear transformations provably exist, but training is unstable.

Represent this text to find a much much longer article about it with say hundreds-thousands of words

This work aims to provide quantitative answers to the relative importance of concepts of interest via concept activation vectors (CAV). In particular, this framework enables non-machine learning experts to express concepts of interest and test hypotheses using examples (e.g., a set of pictures that illustrate  the concept). We show that CAV can be learned given a relatively small set of examples. Hypothesis testing with CAV can answer whether a particular concept (e.g., gender) is more important in predicting a given class (e.g., doctor) than other sets of concepts. Interpreting networks with CAV does not require any retraining or modification of the network.


Question: represent the text to find a very short summary (1-2 sentences max)

Question: Owing to the ubiquity of computer software, software vulnerability detection (SVD) has become an important problem in the software industry and in the field of computer security. One of the most crucial issues in SVD is coping with the scarcity of labeled vulnerabilities in projects that require the laborious manual labeling of code by software security experts. One possible way to address is to employ deep domain adaptation which has recently witnessed enormous success in transferring learning from structural labeled to unlabeled data sources. The general idea is to map both source and target data into a joint feature space and close the discrepancy gap of those data in this joint feature space. Generative adversarial network (GAN) is a technique that attempts to bridge the discrepancy gap and also emerges as a building block to develop deep domain adaptation approaches with state-of-the-art performance. However, deep domain adaptation approaches using the GAN principle to close the discrepancy gap are subject to the mode collapsing problem that negatively impacts the predictive performance. Our aim in this paper is to propose Dual Generator-Discriminator Deep Code Domain Adaptation Network (Dual-GD-DDAN) for tackling the problem of transfer learning from labeled to unlabeled software projects in the context of SVD in order to resolve the mode collapsing problem faced in previous approaches. The experimental on real-world software projects show that our proposed method outperforms state-of-the-art baselines by a wide margin. In the software industry, software vulnerabilities relate to specific flaws or oversights in software programs which allow attackers to expose or alter sensitive information, disrupt or destroy a system, or take control of a program or computer system . The software vulnerability detection problem has become an important issue in the software industry and in the field of computer security. Computer software development employs of a vast variety of technologies and different software development methodologies, and much computer software contains vulnerabilities. This has necessitated the development of automated advanced techniques and tools that can efficiently and effectively detect software vulnerabilities with a minimal level of human intervention. To respond to this demand, many vulnerability detection systems and methods, ranging from open source to commercial tools, and from manual to automatic methods have been proposed and implemented. Most of the previous works in software vulnerability detection (SVD) (; ; ; ; ; ;) have been developed based on handcrafted features which are manually chosen by knowledgeable domain experts who may have outdated experience and underlying biases. In many situations, handcrafted features normally do not generalize well. For example, features that work well in a certain software project may not perform well in other projects . To alleviate the dependency on handcrafted features, the use of automatic features in SVD has been studied recently (; ;). These works have shown the advantages of automatic features over handcrafted features in the context of software vulnerability detection. However, most of these approaches lead to another crucial issue in SVD research, namely the scarcity of labeled projects. Labelled vulnerable code is needed to train these models, and the process of labeling vulnerable source code is very tedious, time-consuming, error-prone, and challenging even for domain experts. This has led to few labeled projects compared with the vast volume of unlabeled ones. A viable solution is to apply transfer learning or domain adaptation which aims to devise automated methods that make it possible to transfer a learned model from the source domain with labels to the target domains without labels. Studies in domain adaptation can be broadly categorized into two themes: shallow and deep domain adaptations (; ; . These recent studies have shown the advantages of deep over shallow domain adaptation (i.e., higher predictive performance and capacity to tackle structural data). Deep domain adaptation encourages the learning of new representations for both source and target data in order to minimize the divergence between them (; ; . The general idea is to map source and target data to a joint feature space via a generator, where the discrepancy between the source and target distributions is reduced. Notably, the work of employed generative adversarial networks (GANs) to close the discrepancy gap between source and target data in the joint space. However, most of aforementioned works mainly focus on transfer learning in the computer vision domain. The work of is the first work which applies deep domain adaptation to SVD with promising predictive performance on real-world source code projects. The underlying idea is to employ the GAN to close the gap between source and target domain in the joint space and enforce the clustering assumption to utilize the information carried in the unlabeled target samples in a semi-supervised context. GANs are known to be affected by the mode collapsing problem . In particular, recently studied the mode collapsing problem and further classified this into the missing mode problem i.e., the generated samples miss some modes in the true data, and the boundary distortion problem i.e., the generated samples can only partly recover some modes in the true data. It is certain that deep domain adaptation approaches that use the GAN principle will inherently encounter both the missing mode and boundary distortion problems. Last but not least, deep domain adaptation approaches using the GAN principle also face the data distortion problem. The representations of source and target examples in the joint feature space degenerate to very small regions that cannot preserve the manifold/clustering structure in the original space. Our aim in this paper is to address not only deep domain adaptation mode collapsing problems but also boundary distortion problems when employing the GAN as a principle in order to close the discrepancy gap between source and target data in the joint feature space. Our two approaches are: i) apply manifold regularization for enabling the preservation of manifold/clustering structures in the joint feature space, hence avoiding the degeneration of source and target data in this space; and ii) invoke dual discriminators in an elegant way to reduce the negative impacts of the missing mode and boundary distortion problems in deep domain adaptation using the GAN principle as mentioned before. We name our mechanism when applied to SVD as Dual Generator-Discriminator Deep Code Domain Adaptation Network (Dual-GD-DDAN). We empirically demonstrate that our Dual-GD-DDAN can overcome the missing mode and boundary distortion problems which is likely to happen as in Deep Code Domain Adaptation (DDAN) in which the GAN was solely applied to close the gap between the source and target domain in the joint space (see the discussion in Sections 2.4 and 3.3, and the visualization in Figure 3). In addition, we incorporate the relevant approaches -minimizing the conditional entropy and manifold regularization with spectral graph -proposed in to enforce the clustering assumption and arrive at a new model named Dual Generator-Discriminator Semi-supervised Deep Code Domain Adaptation Network (Dual-GD-SDDAN). We further demonstrate that our Dual-GD-SDDAN can overcome the mode collapsing problem better than SCDAN in, hence obtaining better predictive performance. We conducted experiments using the data sets collected by , that consist of five real-world software projects: FFmpeg, LibTIFF, LibPNG, VLC and Pidgin to compare our proposed Dual-GD-DDAN and Dual-GD-SDDAN with the baselines. The baselines consider to include VULD (i.e., the model proposed in without domain adaptation), MMD, DIRT-T, DDAN and SCDAN as mentioned and D2GAN (a variant of the GAN using dual-discriminator to reduce the mode collapse for which we apply this mechanism in the joint feature space). Our experimental show that our proposed methods are able to overcome the negative impact of the missing mode and boundary distortion problems inherent in deep domain adaptation approaches when solely using the GAN principle as in DDAN and SCDAN. In addition, our method outperforms the rival baselines in terms of predictive performance by a wide margin. is also a sequence of L embedding vectors. We wish to bridge the gap between the source and target domains in the joint feature space. This allows us to transfer a classifier trained on the source domain to predict well on the target domain. We preprocess data sets before inputting into the deep neural networks. Firstly, we standardize the source code by removing comments, blank lines and non-ASCII characters. Secondly, we map user-defined variables to symbolic names (e.g., "var1", "var2") and user-defined functions to symbolic names (e.g., "func1", "func2"). We also replace integers, real and hexadecimal numbers with a generic <num> token and strings with a generic <str> token. Thirdly, we embed statements in source code into vectors. In particular, each statement x consists of two parts: the opcode and the statement information. We embed both opcode and statement information to vectors, then concatenate the vector representations of opcode and statement information to obtain the final vector representation i of statement x. For example, in the following statement (C programming language) "if(func3(func4(num,num),&var2)!=var11)", the opcode is if and the statement information is (func3(func4(num,num),&var2)!=var11). To embed the opcode, we multiply the one-hot vector of the opcode by the opcode embedding matrix. To embed the statement information, we tokenize it to a sequence of tokens (e.g., (,func3,(,func4,(,num,num,),&,var2,),!=,var11,)), construct the frequency vector of the statement information, and multiply this frequency vector by the statement information embedding matrix. In addition, the opcode embedding and statement embedding matrices are learnable variables. To handle sequential data in the context of domain adaptation of software vulnerability detection, the work of proposed an architecture referred to as the Code Domain Adaptation Network (CDAN). This network architecture recruits a Bidirectional RNN to process the sequential input from both source and target domains (i.e., x . A fully connected layer is then employed to connect the output layer of the Bidirectional RNN with the joint feature layer while bridging the gap between the source and target domains. Furthermore, inspired by the Deep Domain Adaptation approach , the authors employ the source classifier C to classify the source samples, the domain discriminator D to distinguish the source and target samples and propose Deep Code Domain Adaptation (DDAN) whose objective function is as follows: where seeking the optimal generator G *, the domain discriminator D *, and the source classifier C * is found by solving: Figure 1: An illustration of the missing mode and boundary distortion problems of DDAN. In the joint space, the target distribution misses source mode 2, while the source distribution can only partly cover the target mode 2 in the target distribution and the target distribution can only partly cover the source mode 1 in the source distribution. We observe that DDAN suffers from several shortcomings. First, the data distortion problem (i.e., the source and target data in the joint space might collapse into small regions) may occur since there is no mechanism in DDAN to circumvent this. Second, since DDAN is based on the GAN approach, DDAN might suffer from the mode collapsing problem . In particular, has recently studied the mode collapsing problem of GANs and discovered that they are also subject to i) the missing mode problem (i.e., in the joint space, either the target data misses some modes in the source data or vice versa) and ii) the boundary distortion problem (i.e., in the joint space either the target data partly covers the source data or vice versa), which makes the target distribution significantly diverge from the source distribution. As shown in Figure 1, both the missing mode and boundary distortion problems simultaneously happen since the target distribution misses source mode 2, while the source distribution can only partly cover the target mode 2 in the target distribution and the target distribution can only partly cover the source mode 1 in the source distribution. We employ two discriminators (namely, D S and D T) to classify the source and target examples and vice versa and two separate generators (namely, G S and G T) to map the source and target examples to the joint space respectively. In particular, D S produces high values on the source examples in the joint space (i.e., G S x S) and low values on the target examples in the joint space (i.e., G T x T), while D T produces high values on the target examples in the joint space (i.e., G T x T) and low values on the source examples (i.e., G S x S). The generator G S is trained to push G S x S to the high value region of D T and the generator G T is trained to push G T x T to the high value region of D S. Eventually, both D S G S x S and D S G T x T are possibly high and both are possibly high. This helps to mitigate the issues of missing mode and boundary distortion since as in Figure 1, if the target mode 1 can only partly cover the source mode 1, then D T cannot receive large values from source mode 1. Another important aspect of our approach is to maintain the cluster/manifold structure of source and target data in the joint space via the manifold regularization to avoid the data distortion problem. To address the two inherent problems in the DDAN mentioned in Section 2.4, we employ two different generators G S and G T to map source and target domain examples to the joint space and two discriminators D S and D T to distinguish source examples against target examples and vice versa together with the source classifier C which is used to classify the source examples with labels as shown in Figure 2. We name our proposed model as Dual Generator-Discriminator Deep Code Domain Adaptation Network (Dual-GD-DDAN). Updating the discriminators The two discriminators D S and D T are trained to distinguish the source examples against the target examples and vice versa as follows: where θ > 0. Note that a high value of θ encourages D s and D T place higher values on G S x S and G T x T respectively. Updating the source classifier The source classifier is employed to classify the source examples with labels as follows: min, y i where specifies the cross-entropy loss function for the binary classification (e.g., using crossentropy). Updating the generators The two generators G S and G T are trained to i) maintain the manifold/cluster structures of source and target data in their original spaces to avoid the data distortion problem and ii) move the target samples toward the source samples in the joint space and resolve the missing mode and boundary distortion problems in the joint space. To maintain the manifold/cluster structures of source and target data in their original spaces, we propose minimizing the manifold regularization term as: min where M (G S, G T) is formulated as: where the weights are defined as are the last hidden states of the bidirectional RNN with input x. To move the target samples toward the source samples and resolve the missing mode and boundary distortion problems in the joint space, we propose minimizing the following objective function: where K (G S, G T) is defined as: Moreover, the source generator G S has to work out the representation that is suitable for the source classifier, hence we need to minimize the following objective function: GD-DDAN). The generators G S and G T take the sequential code tokens of the source domain and target domain in vectorial form respectively and map this sequence to the joint layer (i.e., the joint space). The discriminators D S and D T are invoked to discriminate the source and target data. The source classifier C is trained on the source domain with labels. We note that the source and target networks do not share parameters and are not identical. Finally, to update G S and G T, we need to minimize the following objective function: where α, β > 0 are two non-negative parameters. Below we explain why our proposed Dual-GD-DDAN is able to resolve the two critical problems that occur with the DDAN approach. First, if x 4). This increases the chance of the two representations residing in the same cluster in the joint space. Therefore, Dual-GD-DDAN is able to preserve the clustering structure of the source data in the joint space. By using the same argument, we reach the same for the target domain. Second, following Eqs., the discriminator D S is trained to encourage large values for the source modes (i.e., G S x S), while the discriminator D T is trained to produce large values for the target modes (i.e., G T x T). Moreover, as in Eq., G s is trained to move the source domain examples x S to the high-valued region of D T (i.e., the target modes or G T x T) and G T is trained to move the target examples x T to the high-valued region of D S (i.e., the source modes or G S x S). As a consequence, eventually, the source modes (i.e., G S x S) and target modes (i.e., G T x T) overlap, while D S and D T place large values on both source (i.e., G S x S) and target (i.e., G T x T) modes. The mode missing problem is less likely to happen since, as shown in Figure 1, if the target data misses source mode 2, then D T cannot receive large values from source mode 2. Similarly, the boundary distortion problem is also less likely to happen since as in Figure 1, if the target mode 1 can only partly cover the source mode 1, then D T cannot receive large values from source mode 1. Therefore, Dual-GD-DDAN allows us to reduce the impact of the missing mode and boundary distortion problems, hence making the target distribution more identical to the source distribution in the joint space. When successfully bridging the gap between the source and target domains in the joint layer (i.e., the joint space), the target samples can be regarded as the unlabeled portion of a semi-supervised learning problem. Based on this observation, Nguyen et al. proposed to enforce the clustering assumption by minimizing the conditional entropy and using the spectral graph to inspire the smoothness of the source classifier C. Using our proposed Dual-GD-DDAN, the conditional entropy H (C, G S, G T) is defined as: Let SG = (V, E) where the set of vertices V = S ∪ T be the spectral graph defined as in. The smoothness-inspired term is defined as: where B u specifies the Bernoulli distribution with P (y = 1 | u) = C (u) and, and KL (B u, B v) specifies the Kullback-Leibler divergence between two distributions. Here we note that u = G S x S and v = G T x T are two representations of the source sample x S and the target sample x T in the joint space. We incorporate these two terms into our Dual Generator-Discriminator mechanism to propose Dual Generator-Discriminator Semi-supervised Deep Code Domain Adaptation Network (Dual-GD-SDDAN) with the following objective function: where γ, λ are two non-negative parameters. We present experimental of applying our Dual-GD-DDAN approach to five real-world software projects . We compare our proposed Dual-GD-DDAN with VulDeePecker without domain adaptation, MMD, D2GAN, DIRT-T and DDAN using the architecture CDAN proposed in. We further compare our proposed Dual Generator-Discriminator Semi-supervised Deep Code Domain Adaptation (Dual-GD-SDDAN) and Semi-supervised Deep Code Domain Adaptation (SCDAN) introduced in. We use the real-world data sets collected by , which contain the source code of vulnerable and non-vulnerable functions obtained from five real-world software projects, namely FFmpeg (#vul-funcs: 187, #non-vul-funcs: 5,427), LibTIFF (#vul-funcs: 81, #non-vul-funcs: 695), LibPNG (#vul-funcs: 43, #non-vul-funcs: 551), VLC (#vul-funcs: 25, #non-vul-funcs: 5,548) and Pidgin (#vul-funcs: 42, #non-vul-funcs: 8,268) where #vul-funcs and #non-vul-funcs is the number of vulnerable and non-vulnerable functions respectively. The data sets contain both multimedia (FFmpeg, VLC, Pidgin) and image (LibPNG, LibTIFF) application categories. In our experiment, some of the data sets from the multimedia category were used as the source domain whilst other data sets from the image category were used as the target domain (see Table 1). For training the eight methods -VulDeePecker, MMD, D2GAN, DIRT-T, DDAN, Dual-GD-DDAN, SCDAN and Dual-GD-SDDAN -we use one-layer bidirectional recurrent neural networks with LSTM cells where the size of hidden states is in {128, 256} for the generators. For the source classifier and discriminators, we use deep feed-forward neural networks with two hidden layers in which the size of each hidden layer is in {200, 300}. We embed the opcode and statement information in the {150, 150} dimensional embedding spaces respectively. We employ the Adam optimizer with an initial learning rate in {0.001, 0.0001}. The mini-batch size is 64. The trade-off parameters α, β, γ, λ are in {10 −1, 10 −2, 10 −3}, θ is in {0, 1} and 1/(2σ 2) is in {2 −10, 2 −9}. We split the data of the source domain into two random partitions containing 80% for training and 20% for validation. We also split the data of the target domain into two random partitions. The first partition contains 80% for training the models of VulDeePecker, MMD, D2GAN, DIRT-T, DDAN, Dual-GD-DDAN, SCDAN and Dual-GD-SDDAN without using any label information while the second partition contains 20% for testing the models. We additionally apply gradient clipping regularization to prevent over-fitting in the training process of each model. We implement eight mentioned methods in Python using Tensorflow which is an open-source software library for Machine Intelligence developed by the Google Brain Team. We run our experiments on a computer with an Intel Xeon Processor E5-1660 which had 8 cores at 3.0 GHz and 128 GB of RAM. For each method, we run the experiments 5 times and then record the average predictive performance. Quantitative Results We first investigate the performance of our proposed Dual-GD-DDAN compared with other methods including VulDeePecker (VULD) without domain adaptation , DDAN, MMD, D2GAN and DIRT-T with VAP applied in the joint feature layer using the architecture CDAN introduced in. The VulDeePecker method is only trained on the source data and then tested on the target data, while the MMD, D2GAN, DIRT-T, DDAN and Dual-GD-DDAN methods employ the target data without using any label information for domain adaptation. Quantitative Results To quantitatively demonstrate the efficiency of our proposed Dual-GD-DDAN in alleviating the boundary distortion problem caused by using the GAN principle, we reuse the experimental setting in Section 5.2 . The basic idea is, given two data sets S 1 and S 2, to quantify the degree of cover of these two data sets. We train a classifier C 1 on S 1, then test on S 2 and another classifier C 2 on S 2, then test on S 1. If these two data sets cover each other well with reduced boundary distortion, we expect that if C 1 predicts well on S 1, then it should predict well on S 2 and vice versa if C 2 predicts well on S 2, then it should predict well on S 1. This would seem reasonable since if boundary distortion occurs (i.e., assume that S 2 partly covers S 1), then C 2 trained on S 2 would struggle to predict S 1 well which is much larger and possibly more complex. Therefore, we can utilize the magnitude of the accuracies and the accuracy gap of C 1 and C 2 when predicting their training and testing sets to assess the severity of the boundary distortion problem. Figure 3: A 2D t-SNE projection for the case of the FFmpeg → LibPNG domain adaptation. The blue and red points represent the source and target domains in the joint space respectively. In both cases of the source and target domains, data points labeled 0 stand for non-vulnerable samples and data points labeled 1 stand for vulnerable samples. Inspired by this observation, we compare our Dual-GD-DDAN with DDAN using the representations of the source and target samples in the joint feature space corresponding to their best models. In particular, for a given pair of source and target data sets and for comparing each method, we train a neural network classifier on the best representations of the source data set in the joint space, then predict on the source and target data set and do the same but swap the role of the source and target data sets. We then measure the difference of the corresponding accuracies as a means of measuring the severity of the boundary distortion. We choose to conduct such a boundary distortion analysis for two pairs of the source (FFmpeg and Pidgin) and target (LibPNG) domains. As shown in Table 2, all gaps obtained by our Dual-GD-DDAN are always smaller than those obtained by DDAN, while the accuracies obtained by our proposed method are always larger. We can therefore conclude that our Dual-GD-DDAN method produces a better representation for source and target samples in the joint space and is less susceptible to boundary distortion compared with the DDAN method. Visualization We further demonstrate the efficiency of our proposed Dual-GD-DDAN in alleviating the boundary distortion problem caused by using the GAN principle. Using a t-SNE projection, with perplexity equal to 30, we visualize the feature distributions of the source and target domains in the joint space. Specifically, we project the source and target data in the joint space (i.e., G (x)) into a 2D space with domain adaptation (DDAN) and with dual-domain adaptation (Dual-GD-DDAN). In Figure 3, we observe these cases when performing domain adaptation from a software project (FFmpeg) to another (LibPNG). As shown in Figure 3, with undertaking domain adaptation (DDAN, the left figure) and dual-domain adaptation (Dual-GD-DDAN, the right figure), the source and target data sampled are intermingled especially for Dual-GD-DDAN. However, it can be observed that DDAN when solely applying the GAN is seriously vulnerable to the boundary distortion issue. In particular, in the clusters/data modes 2, 3 and 4 (the left figure), the boundary distortion issue occurs since the blue data only partly cover the corresponding red ones (i.e., the source and target data do not totally mix up). Meanwhile, for our Dual-GD-DDAN, the boundary distortion issue is much less vulnerable, and the mixing-up level of source and target data is significantly higher in each cluster/data mode. In this section, we compare the performance of our Dual Generator-Discriminator Semi-supervised Deep Code Domain Adaptation (Dual-GD-SDDAN) with Semi-supervised Deep Code Domain Adaptation (SCDAN) on four pairs of source and target domain including FFmpeg → LibTIFF, FFmpeg → LibPNG, VLC→ LibPNG and Pidgin → LibTIFF. In Table 3, the experimental show that our Dual-GD-SDDAN achieves a higher performance than SCDAN for detecting vulnerable and non-vulnerable functions in terms of FPR, Precision and F1-measure in almost cases of the source and target domains, especially for F1-measure. For example, to the case of the source domain (VLC) and target domain (LibPNG), our Dual-GD-SDDAN achieves an F1-measure of 76.19% compared with an F1-measure of 72.73% obtained with SCDAN. These further demonstrate the ability of our Dual-GD-SDDAN for dealing with the mode collapsing problem better than SCDAN, hence obtaining better predictive performance in the context of software domain adaptation. Software vulnerability detection (SVD) is an important problem in the software industry and in the field of computer security. One of the most crucial issues in SVD is to cope with the scarcity of labeled vulnerabilities in projects that require the laborious labeling of code by software security experts. In this paper, we propose the Dual Generator-Discriminator Deep Code Domain Adaptation Network (Dual-GD-DDAN) method to deal with the missing mode and boundary distortion problems which arise from the use of the GAN principle when reducing the discrepancy between source and target data in the joint space. We conducted experiments to compare our Dual-GD-DDAN method with the state-of-the-art baselines. The experimental show that our proposed method outperforms these rival baselines by a wide margin in term of predictive performances. We give an example of source code functions obtained from the VLC and LibPNG projects, to demonstrate that transfer learning for software vulnerability detection between different projects is plausible and promising. Both C language functions obtained from the VLC and LibPNG projects depicted in Figure 4 invoke the memcpy function which is used to copy one memory buffer to another. The misuse of this function can cause a buffer overflow error if insufficient memory is allocated in the target buffer for all of the data to be copied from the source buffer. Furthermore, these functions also share rather similar semantic and syntactic relationships (i.e. the C language programming syntax, loop structure etc). Therefore, a model that can capture the characteristics of the first function in the first project should be able to confidently predict the second function in the second project. It therefore makes sense to undertake transfer learning from the first project to the second project. Figure 4: An example of two source code functions (with some parts omitted for brevity) in the C programming language obtained from the VLC (Left) and LibPNG project (Right). These two source code examples highlight the same vulnerability due to the misuse of the memcpy function. In this section, we introduce work related to ours. First, we present the recent work in automatic feature learning for software vulnerability detection. Finally, we present the recent work in deep domain adaptation. Automatic feature learning in software vulnerability detection minimizes intervention from security experts (; ;). Particularly, shared the same approach employing a Recurrent Neutral Network (RNN) to transform sequences of code tokens to vectorial features for automatic feature learning, which are then fed to a separate classifier (e.g., Support Vector Machine or Random Forest ) for classification purposes. However, owing to the independence of learning the vector representations and training the classifier, it is likely that the ing vector representations of may not fit well with classifiers to enhance the predictive performance. To deal with this problem, the study introduced in combined the learning of the vector representations and the training of a classifier in a deep neural network. This work

Represent this text to find a much much longer article about it with say hundreds-thousands of words

Our aim in this paper is to propose a new approach for tackling the problem of transfer learning from labeled to unlabeled software projects in the context of SVD in order to resolve the mode collapsing problem faced in previous approaches.

Represent the short summary for finding the corresponding scientific article (long)