Question: Represent the scientific article to find a short TLDR

Question: The goal of compressed sensing is to learn a structured signal $x$ from a limited number of noisy linear measurements $y \approx Ax$. In traditional compressed sensing, ``structure'' is represented by sparsity in some known basis. Inspired by the success of deep learning in modeling images, recent work starting with~\cite{BDJP17} has instead considered structure to come from a generative model $G: \R^k \to \R^n$. We present two establishing the difficulty of this latter task, showing that existing bounds are tight. First, we provide a lower bound matching the~\cite{BDJP17} upper bound for compressed sensing from $L$-Lipschitz generative models $G$. In particular, there exists such a function that requires roughly $\Omega(k \log L)$ linear measurements for sparse recovery to be possible. This holds even for the more relaxed goal of \emph{nonuniform} recovery. Second, we show that generative models generalize sparsity as a representation of structure. In particular, we construct a ReLU-based neural network $G: \R^{2k} \to \R^n$ with $O$ layers and $O(kn)$ activations per layer, such that the range of $G$ contains all $k$-sparse vectors. In compressed sensing, one would like to learn a structured signal x ∈ R n from a limited number of linear measurements y ≈ Ax. This is motivated by two observations: first, there are many situations where linear measurements are easy, in settings as varied as streaming algorithms, single-pixel cameras, genetic testing, and MRIs. Second, the unknown signals x being observed are structured or "compressible": although x lies in R n, it would take far fewer than n words to describe x. In such a situation, one can hope to estimate x well from a number of linear measurements that is closer to the size of the compressed representation of x than to its ambient dimension n. In order to do compressed sensing, you need a formal notion of how signals are expected to be structured. The classic answer is to use sparsity. Given linear measurements 1 y = Ax of an arbitrary vector x ∈ R n, one can hope to recover an estimate x * of x satisfying for some constant C and norm ·. In this paper, we will focus on the 2 norm and achieving the guarantee with 3/4 probability. Thus, if x is well-approximated by a k-sparse vector x, it should be accurately recovered. Classic such as [CRT06] show that is achievable when A consists of m = O(k log n k) independent Gaussian linear measurements. This bound is tight, and in fact no distribution of matrices with fewer rows can achieve this guarantee in either 1 or 2 [DIPW10]. Although compressed sensing has had success, sparsity is a limited notion of structure. Can we learn a richer model of signal structure from data, and use this to perform recovery? In recent years, deep convolutional neural networks have had great success in producing rich models for representing the manifold of images, notably with generative adversarial networks (GANs) [GPAM + 14] and variational autoencoders (VAEs) [KW14]. These methods produce generative models G: R k → R n that allow approximate sampling from the distribution of images. So a natural question is whether these generative models can be used for compressed sensing. In [BJPD17] it was shown how to use generative models to achieve a guarantee analogous to: for any L-Lipschitz G: R k → R n, one can achieve where r, δ > 0 are parameters, B k (r) denotes the radius-r 2 ball in R k and Lipschitzness is defined with respect to the 2 -norms, using only m = O(k log Lr δ) measurements. Thus, the recovered vector is almost as good as the nearest point in the range of the generative model, rather than in the set of k-sparse vectors. We will refer to the problem of achieving the guarantee in as "functionsparse recovery". Our main theorem is that the [BJPD17] is tight: for any setting of parameters n, k, L, r, δ, there exists an L-Lipschitz function G: R k → R n such that any algorithm achieving with 3/4 probability must have Ω(min(k log Lr δ, n)) linear measurements. Notably, the additive error δ that was unnecessary in sparse recovery is necessary for general Lipschitz generative model recovery. A concurrent paper [LS19] proves a lower bound for a restricted version of. They show a lower bound when the vector that x lies in the image of G and for a particular value of δ. Our , in comparison, apply to the most general version of the problem and are proven using a simpler communication complexity technique. The second in this paper is to directly relate the two notions of structure: sparsity and generative models. We produce a simple Lipschitz neural network G sp: R 2k → R n, with ReLU activations, 2 hidden layers, and maximum width O(kn), so that the range of G contains all k-sparse vectors. A second of [BJPD17] is that for ReLU-based neural networks, one can avoid the additive δ term and achieve a different from: using O(kd log W) measurements, if d is the depth and W is the maximum number of activations per layer. Applying this to our sparsity-producing network G sp implies, with O(k log n) measurements, recovery achieving the standard sparsity guarantee. So the generative-model representation of structure really is more powerful than sparsity. As described above, this paper contains two : an Ω(min(k log Lr δ, n)) lower bound for compressed sensing relative to a Lipschitz generative model, and an O-layer generative model whose range contains all sparse vectors. These are orthogonal, and we outline each in turn. Over the last decade, lower bounds for sparse recovery have been studied extensively. The techniques in this paper are most closely related to the techniques used in [DIPW10]. Similar to [DIPW10], our proof is based on communication complexity. We will exhibit an LLipschitz function G and a large finite set Z ⊂ Im(G) ⊂ B n (R) of points that are well-separated. Then, given a point x that is picked uniformly at random from Z, we show how to identify it from Ax using the function-sparse recovery algorithm. This implies Ax also contains a lot of information, so m must be fairly large. Formally, we produce a generative model whose range includes a large, well-separated set: log(|X|) = Ω min(k log( Lr R)), n Now, suppose we have an algorithm that can perform function-sparse recovery with respect to G from Theorem 2.1, with approximation factor C, and error δ < R/8 within the radius r ball in k-dimensions. Set t = Θ(log n), and for any z 1, z 2,..., z t ∈ Z = G(X) take The idea of the proof is the following: given y = Az, we can recover z such that and so, because Z has minimum distance R/ √ 6, we can exactly recover z t by rounding z to the nearest element of Z. But then we can repeat the process on (Az − Az t) to find z t−1, then z t−2, up to z 1, and learn t lg |Z| = Ω(tk log(Lr/R)) bits total. Thus Az must contain this many bits of information; but if the entries of A are rational numbers with poly(n) bounded numerators and (the same) poly(n) bounded denominator, then each entry of Az can be described in O(t + log n) bits, so There are two issues that make the above outline not totally satisfactory, which we only briefly address how to resolve here. First, the theorem statement makes no supposition on the entries of A being polynomially bounded. To resolve this, we perturb z with a tiny (polynomially small) amount of additive Gaussian noise, after which discretizing Az at an even tinier (but still polynomial) precision has negligible effect on the failure probability. The second issue is that the above outline requires the algorithm to recover all t vectors, so it only applies if the algorithm succeeds with 1 − 1/t probability rather than constant probability. This is resolved by using a reduction from the augmented indexing problem, which is a one-way communication problem where Alice has z 1, z 2,..., z t ∈ Z, Bob has i ∈ [Z] and z i+1, · · ·, z n, and Alice must send Bob a message so that Bob can output z i with 2/3 probability. This still requires Ω(t log |Z|) bits of communication, and can be solved in O(m(t + log n)) bits of communication by sending Az as above. Formally, our lower bound states: A is an algorithm which picks a matrix A ∈ R m×n, and given Ax returns an x * satisfying with probability ≥ 3/4, then m = Ω(min(k log(Lr/δ), n)). Constructing the set. The above lower bound approach, relies on finding a large, well-separated set Z as in Theorem 2.1. We construct this aforementioned set Z within the n-dimensional 2 ball of radius R such that any two points in the set are at least Ω(R) apart. Furthermore, since we wish to use a function-sparse recovery algorithm, we describe a function G: R k → R n and set the radius R such that G is LLipschitz. In order to get the desired lower bound, the image of G needs to contain a subset of at least (Lr) Ω(k) points. First, we construct a mapping as described above from R to R n/k i.e we need to find (Lr) points in B n/k (R) that are mutually far apart. We show that certain binary linear codes over the alphabet {±R/ √ n} yield such points that are mutually R/ √ 3k apart. We construct a O(L)-Lipschitz mapping of O(√ Lr) points in the interval [0, r/ √ k] to a subset of these points. In order to extend this construction to a mapping from R k to R n, we apply the above function in a coordinate-wise manner. This would in a mapping with the same Lipschitz parameter. The points in R n that are images of these points lie in a ball of radius R but could potentially be R/ √ 3k close. To get around this, we use an error correcting code over a large alphabet to choose a subset of these points that is large enough and such that they are still mutually R/ √ 6 far apart. 2.2 Sparsity-producing generative model. To produce a generative model whose range consists of all k-sparse vectors, we start by mapping R 2 to the set of positive 1-sparse vectors. For any pair of angles θ 1, θ 2, we can use a constant number of unbiased ReLUs to produce a neuron that is only active at points whose representation (r, θ) in polar coordinates has θ ∈ (θ 1, θ 2). Moreover, because unbiased ReLUs behave linearly, the activation can be made an arbitrary positive real by scaling r appropriately. By applying this n times in parallel, we can produce n neurons with disjoint activation ranges, making a network R 2 → R n whose range contains all 1-sparse vectors with nonnegative coordinates. By doing this k times and adding up the , we produce a network R 2k → R n whose range contains all k-sparse vectors with nonnegative coordinates. To support negative coordinates, we just extend the k = 1 solution to have two ranges within which it is non-zero: for one range of θ the output is positive, and for another the output is negative. This in the following theorem: Theorem 2.3. There exists a 2 layer neural network In this section, we prove a lower bound for the sample complexity of function-sparse recovery by a reduction from a communication game. We show that the communication game can be won by sending a vector Ax and then performing function-sparse recovery. A lower bound on the communication complexity of the game implies a lower bound on the number of bits used to represent Ax if Ax is discretized. We can then use this to lower bound the number of measurements in A. Since we are dealing in bits in the communication game and the entries of a sparse recovery matrix can be arbitrary reals, we will need to discretize each measurement. We show first that discretizing the measurement matrix by rounding does not change the ing measurement too much and will allow for our reduction to proceed. Matrix conditioning. We first show that, without loss of generality, we may assume that the measurement matrix A is well-conditioned. In particular, we may assume that the rows of A are orthonormal. We can multiply A on the left by any invertible matrix to get another measurement matrix with the same recovery characteristics. If we consider the singular value decomposition A = U ΣV *, where U and V are orthonormal and Σ is 0 off the diagonal, this means that we can eliminate U and make the entries of Σ be either 0 or 1. The is a matrix consisting of m orthonormal rows. Discretization. For well-conditioned matrices A, we use the following lemma (similar to one from [DIPW10] ) to show that we can discretize the entries without changing the behavior by much: Lemma 3.1. Let A ∈ R m×n be a matrix with orthonormal rows. Let A be the of rounding A to b bits per entry. Then for any v ∈ R n there exists an s ∈ R n with A v = A(v − s) and Proof. Let A = A − A be the error when discretizing A to b bits, so each entry of A is less than 2 −b. Then for any v and s = A T A v, we have As = A v and The Augmented Indexing problem. As in [DIPW10], we use the Augmented Indexing communication game which is defined as follows: There are two parties, Alice and Bob. Alice is given a string y ∈ {0, 1} d. Bob is given an index i ∈ [d], together with y i+1, y i+2,..., y d. The parties also share an arbitrarily long common random string r. Alice sends a single message M (y, r) to Bob, who must output y i with probability at least 2/3, where the probability is taken over r. We refer to this problem as Augmented Indexing. The communication cost of Augmented Indexing is the minimum, over all correct protocols, of length |M (y, r)| on the worst-case choice of r and y. The following theorem is well-known and follows from Lemma 13 of [MNSW98] (see, for example, an explicit proof in [DIPW10]) A well-separated set of points. We would like to prove Theorem 2.1, getting a large set of wellseparated points in the image of a Lipschitz generative model. Before we do this, though, we prove a k = 1 analog: There is a set of points P in B n ⊂ R n of size 2 Ω(n) such that for each pair of points x, y ∈ P x − y ∈ 1 3, 2 3 Proof. Consider a τ -balanced linear code over the alphabet {± 1 √ n} with message length M. It is known that such codes exist with block length O(M/τ 2) [BATS09]. Setting the block length to be n and τ = 1/6, we get that there is a set of 2 Ω(n) points in R n such that the pairwise hamming distance is between Now we wish to extend this to arbitrary k while achieving the parameters in Theorem 2.1. Proof of Theorem 2.1. We first define an O(L)-Lipschitz map g: R → R n/k that goes through a set of points that are pairwise Θ R √ k apart. Consider the set of points P from Lemma 3.3 scaled, Lr/R). Choose subset P that such that it contains exactly min (Lr/R, exp(Ω(n/k))) points and let g 1: [0, r/ √ k] → P be a piecewise linear function that goes through all the points in P in order. Then, we define g: R → R n/k as: Also, for every point (x 1, . . ., However, there still exist distinct points x, y ∈ I k (for instance points that differ at exactly one coordinate) We construct a large subset of the points in I k such that any two points in this subset are far apart using error correcting codes. Consider the A ⊂ P s.t. |A| > |P | /2 is a prime. For any integer z > 0, there is a prime between z and 2z, so such a set A exists. Consider a Reed-Solomon code of block length k, message length k/2, distance k/2 and alphabet A. The existence of such a code implies that there is a subset X of (P) k of size at least (|P | /2) k/2 such that every pair of distinct elements from this set disagree in k/2 coordinates. This translates into a distance of in 2-norm. So, if we set G = g ⊗k and we get have a set of (|P | /2) k/2 ≥ (min(exp(Ω(n/k)), Lr/R)) k/2 points which are apart in 2-norm, lie within the 2 ball of radius R. Lower bound. We now prove the lower bound for function-sparse recovery. Proof of Theorem 2.2. An application of Theorem 2.1 with R = √ Lrδ gives us a set of points Z and G such that Z = G(X) ⊆ R n such that log(|Z|) = Ω(min(k log( Lr δ), n)), and for all x ∈ Z, x 2 ≤ √ Lrδ and for all x, x ∈ Z, x − x 2 ≥ √ Lrδ/ √ 6. Let d = log |X| log n, and let D = 16 √ 3(C + 1). We will show how to solve the Augmented Indexing problem on instances of size d = log(|Z|) · log(n) = Ω(k log(Lr) log n) with communication cost O(m log n). The theorem will then follow by Theorem 3.2. Alice is given a string y ∈ {0, 1} d, and Bob is given i ∈ [d] together with y i+1, y i+2,..., y d, as in the setup for Augmented Indexing. Alice splits her string y into log n contiguous chunks y 1, y 2,..., y log n, each containing log |X| bits. She uses y j as an index into the set X to choose x j. Alice defines Alice and Bob use the common randomness R to agree upon a random matrix A with orthonormal rows. Both Alice and Bob round A to form A with b = Θ(log(n)) bits per entry. Alice computes A x and transmits it to Bob. Note that, since x ∈ ± 1 √ n the x's need not be discretized. From Bob's input i, he can compute the value j = j(i) for which the bit y i occurs in y j. Bob's input also contains y i+1,..., y n, from which he can reconstruct x j+1,..., x log n, and in particular can compute Bob then computes A z, and using A x and linearity, he can compute So from Lemma 3.1, there exists some s with A w = A(w − s) and Ideally, Bob would perform recovery on the vector A(w −s) and show that the correct point x j is recovered. However, since s is correlated with A and w, Bob needs to use a slightly more complicated technique. Bob first chooses another vector u uniformly from B n (R/D j) and computes A(w − s − u) = A w − Au. He then runs the estimation algorithm A on A and A(w − s − u), obtainingŵ. We have that u is independent of w and s, and that so as a distribution over u, the ranges of the random variables w − s − u and w − u overlap in at least a 1 − 1/n fraction of their volumes. Therefore w − s − u and w − u have statistical distance at most 1/n. The distribution of w − u is independent of A, so running the recovery algorithm on A(w − u) would work with probability at least 3/4. Hence with probability at least 3/4 − 1/n ≥ 2/3 (for n large enough),ŵ satisfies the recovery criterion for w − u, meaning Now, Since δ < Lr/4, this distance is strictly bounded by R/2 √ 6. Since the minimum distance in X is R/ √ 6, this means D j x j −ŵ 2 < D j x −ŵ 2 for all x ∈ X, x = x j. So Bob can correctly identify x j with probability at least 2/3. From x j he can recover y j, and hence the bit y i that occurs in y j. Hence, Bob solves Augmented Indexing with probability at least 2/3 given the message A x. Each entry of A x takes O(log n) bits to describe because A is discretized to up to log(n) bits and Hence, the communication cost of this protocol is O(m · log n). By Theorem 3.2, m log n = Ω(min(k log(Lr/δ), n) · log n), or m = Ω(min(k log(Lr/δ), n)). We show that the set of all k-sparse vectors in R n is contained in the image of a 2 layer neural network. This shows that function-sparse recovery is a generalization of sparse recovery. Lemma 4.1. There exists a 2 layer neural network G: Our construction is intuitively very simple. We define two gadgets G. Then, we set the i th output node (G(x 1, x 2) Varying the distance of (x 1, x 2) from the origin will allow us to get the desired value at the output node i. In a similar manner, G − i which produces negative values at output node i of G with the internal nodes defined as: The last ReLU activation preserves only negative values. Since G This is positive only when θ ∈ (β, π + β). Similarly, cos(β + α/2)x 1 − sin(β + α/2)x 2 = t sin(θ − (β + α/2)) and is positive only when θ ∈ (β + α/2, π + β + α/2). So, a + (i),1 and a + (i),2 are both non-zero when θ ∈ (β + α/2, π + β). Using some elementary trigonometry, we may see that: In Fact A.1, we show a proof of the above identity. Observe that when θ > β + α, this term is negative and hence b i = 0. So, we may conclude that G + i ((x 1, x 2)) = 0 if and only if (x 1, x 2) = (t sin(θ), t cos(θ)) with θ ∈ ((i−1)α, iα). Also, observe that G + i (t sin(β +α/2), t cos(β +α/2)) = t. Similarly G Proof of Theorem 2.3. Given a vector z that is non-zero at k coordinates, let i 1 < i 2 < · · · < i k be the indices at which z is non-zero. We may use copies of G from Lemma 4.1 to generate 1-sparse vectors v 1,..., v k such that (v j) ij = z ij. Then, we add these vectors to obtain z. It is clear that we only used k copies of G to create G sp. So, G sp can be represented by a neural network with 2 layers. Theorem 1 provides a reduction which uses only 2 layers. Then, using the algorithm from Theorem 3, we can recover the correct k-sparse vector using O(kd log(nk)) measurements. Since d = 4 and ≤ n, this requires only O(k log n) linear measurements to perform 2 / 2 (k, C)-sparse recovery.

represent the tldr for finding the corresponding scientific article
Fewshot example: "A new generative modeling technique based on asymmetrical adversarial training, and its applications to adversarial example detection and robust classification" == "The vulnerabilities of deep neural networks against adversarial examples have become a significant concern for deploying these models in sensitive domains. Devising a definitive defense against such attacks is proven to be challenging, and the methods relying on detecting adversarial samples are only valid when the attacker is oblivious to the detection mechanism. In this paper, we consider the adversarial detection problem under the robust optimization framework. We partition the input space into subspaces and train adversarial robust subspace detectors using asymmetrical adversarial training (AAT). The integration of the classifier and detectors presents a detection mechanism that provides a performance guarantee to the adversary it considered. We demonstrate that AAT promotes the learning of class-conditional distributions, which further gives rise to generative detection/classification approaches that are both robust and more interpretable. We provide comprehensive evaluations of the above methods, and demonstrate their competitive performances and compelling properties on adversarial detection and robust classification problems. Deep neural networks have become the staple of modern machine learning pipelines, achieving stateof-the-art performance on extremely difficult tasks in various applications such as computer vision , speech recognition , machine translation , robotics , and biomedical image analysis . Despite their outstanding performance, these networks are shown to be vulnerable against various types of adversarial attacks, including evasion attacks (aka, inference or perturbation attacks) (; b; b;) and poisoning attacks . These vulnerabilities in deep neural networks hinder their deployment in sensitive domains including, but not limited to, health care, finances, autonomous driving, and defense-related applications and have become a major security concern. Due to the mentioned vulnerabilities, there has been a recent surge toward designing defense mechanisms against adversarial attacks (; ; b; ; ;), which has in turn motivated the design of stronger attacks that defeat the proposed defenses (b; b; a; b; ; ; ;). Besides, the proposed defenses have been shown to be limited and often not effective and easy to overcome . Alternatively, a large body of work has focused on detection of adversarial examples (; ; ; ; ; ; ; ; ; ; ; ; ;). While training robust classifiers focuses on maintaining performance in presence of adversarial examples, adversarial detection only cares for detecting these examples. The majority of the current detection mechanisms focus on non-adaptive threats, for which the attacks are not specifically tuned/tailored to bypass the detection mechanism, and the attacker is oblivious to the detection mechanism. In fact, Carlini & Wagner (2017a) and showed that the detection methods presented in (; ; ; ; ; ; ;), are significantly less effective than their claimed performances under adaptive attacks. The current solutions are mostly heuristic approaches that cannot provide performance guarantees to the adversary they considered. In this paper, we are interested in detection mechanisms for adversarial examples that can withstand adaptive attacks. Unlike previous approaches that assume adversarial and natural samples coming from different distributions, thus rely on using a single classifier to distinguish between them, we instead partition the input space into subspaces based on the classification system's output and perform adversarial/natural sample classification in these subspaces. Importantly, the mentioned partitions allow us to drop the adversarial constrain and employ a novel asymmetrical adversarial training (AAT) objective to train robust binary classifiers in the subspaces. Figure 1 demonstrates our idea of space partitioning and robust detector training. Our qualitative show that AAT supports detectors to learn class-conditional distributions, which further motivates generative detection/classification solutions that are both robust and interpretable. Our specific contributions are: • We develop adversarial example detection techniques that provide performance guarantees to norm constrained adversaries. Empirically, our best models improve previous state-ofthe-art mean L 2 distortion from 3.68 to 4.47 on the MNIST dataset, and from 1.1 to 1.5 on the CIFAR10 dataset. • We study powerful and versatile generative classification models derived from our detection framework and demonstrate their competitive performances over discriminative robust classifiers. While defense mechanisms based on ordinary adversarial training are vulnerable to unrecognizable inputs (e.g., rubbish examples), inputs that cause confident predictions of our models have human-understandable semantic meanings. • We demonstrate that AAT not only induces robustness as ordinary adversarial training methods do, but also promotes the learning of class-conditional distributions. Intuitively, the learning mechanism is similar to that of GANs, but the objective doesn't learn a fixed generator. On 1D and 2D benchmarking datasets we show this flexibility allows us to precisely control the data generation process such that the detector could be pushed to a good approximation of the underlying density function. (In case of GANs at the global optimum the discriminator converges to a degenerated uniform solution.) Our image generation on CIFAR10 and ImageNet rival that of state-of-the-art GANs. Adversarial attacks. Since the pioneering work of , a large body of work has focused on designing algorithms that achieve successful attacks on neural networks (b; ; b; ; a; b). More recently, iterative projected gradient descent (PGD), initially proposed by Kurakin et al. (2016b), has been empirically identified as the most effective approach for performing norm ball constrained attacks, and the attack reasonably approximates the optimal attack . Adversarial detection techniques. The majority of the methods developed for detecting adversarial attacks are based on the following core idea: given a trained K-class classifier, f: R d → {1...K}, and its corresponding natural training samples,, generate a set of adversarially attacked samples, and devise a mechanism to discriminate D from D. For instance, use this exact idea and learn a binary classifier to distinguish the natural and adversarially perturbed sets. append a new "attacked" class to the classifier, f, and re-train a secured network that classifies natural images, x ∈ D, into the K classes and all attacked images, x ∈ D, to the (K + 1)-th class. In contrast to; , which aim at detecting adversarial examples directly from the image content, trained a binary classifier that receives as input the intermediate layer features extracted from the classifier network f, and distinguished D from D based on such input features. More importantly, considered the so-called case of adaptive/dynamic adversary and proposed to harden the detector against such attacks using a similar adversarial training approach as in Goodfellow et al. (2014b). Unfortunately, the mentioned detection methods are significantly less effective under an adaptive adversary equipped with a strong attack (a;)... K} be the classifier that is used to do classification on D. With the labels and predicted labels the dataset respectively forms the partition, 1} be a set of binary classifiers (detectors), in which h k is trained to discriminate natural samples classified as k, from adversarial samples that fool the network, f (·), to be classified as k. Also, let D be a set of L p norm bounded adversarial examples crafted from D: Consider the following procedure to determine whether a sample x in D ∪ D is an adversarial example: First obtain the estimated class label k:= f (x), then use the k-th detector to predict: if h k (x) = 1 then x a natural sample, otherwise it's an adversarial sample. The detection accuracy of the algorithm is given by where Thus minimizing the algorithm's classification error is equivalent to minimizing classification error of individual detectors. Employing empirical risk minimization, detector k, parameterized by θ k, is trained by where L is a loss function that measures the distance between h k's output and the supplied label (e.g., the binary cross-entropy loss). In the case of adaptive attacks, when the adversary aims to fool both the classifier and detectors, the accuracy of a naively trained detector could be significantly reduced. In order to be robust to adaptive attacks, inspired by the idea of robust optimization , we incorporate the attack into the training objective: where D f \k = {x : f (x) = k, y = k, x ∈ D}, and we assume that perturbation budget is large enough such that ∀x ∈ D f \k, ∃δ ∈ S, s.t. f (x + δ) = k. Now by dropping the f (x + δ) = k constrain we could derive an upper bound for the first loss term: max The detector could instead be trained by minimizing this upper bound using the following unconstrained objective, Further, we use the fact that when D is used as the training set, f could overfit on D such that D \k = {x i : y i = k} and D k are respectively good approximations of D f \k and D f k. This leads to our proposed asymmetrical adversarial training (AAT) objective: In a nutshell, each detector is trained using in-class natural samples and detector-adversarial examples crafted from out-of-class samples. We use iterative PGD attack to solve the inner maximization. Because of the integrated adversary, objective 5 is no longer a straightforward discriminative objective. Our investigations (Appendix A) showed that the objective promotes detectors to learn conditional data distributions. Similar to GANs' objective (a), the AAT objective presents a minimax problem, where the adversary tries to generate perturbed samples that look like the target class data, and the detector is trained by discriminating between target class data and perturbed data. The key difference is that instead of learning a mapping from latent space distribution to the data distribution (a.k.a., the generator), AAT relies on gradient descent (a.k.a., PGD attack) to generate data samples. This is crucial, as it allows us to perform fine-grained control over the generation process (especially by constraining on perturbation limit), so that the discriminator (detector) could retain density information (see Appendix A) and not converge to a degenerate uniform solution as in the case of GANs (a;). Unfortunately, the detector does not define an explicit density function. Under the energy-based learning framework , we could, however, obtain the joint probability of the input and a class category using the Gibbs distribution:, where Z Θ is an unknown normalizing constant, and E θ k (x) = −z(h k (x)) (see Appendix A for justification). We could then apply the Bayes classification rule to obtain a generative classifier: H(x) = arg max k p(x, k) = arg max k z(h k (x)). In addition, we could base on p(x, k) to reject low probability inputs. We implement the reject option by thresholdingk-th detector's logit output, wherek is the predicted class. In the context of adversarial example detection, rejected samples are considered as adversarial examples. We first test the robustness of individual detectors. We show that, once we train a detector with an adequately configured PGD attack, its performance cannot be significantly reduced by an adversary with much stronger configurations (stronger in terms of steps and step-size). Although the PGD attack can reasonably solve the inner maximization in objective 5, it is not clear whether the optimization landscape of the asymmetrical objective is the same as its symmetrical counterparts. For instance, we found that the step-size used by to train their CIFAR10 robust classifier would not induce robustness to our detectors (see Appendix D.2.2). We also face a unique challenge when training with objective 5: the number of positive and negative samples are highly imbalanced. Our solution is to use re-sampling to balance positive and negative classes. Furthermore, we use adversarial finetuning on CIFAR10 and ImageNet to speed up the training of our detectors. With the robustness test, we show that robust optimization also introduces robustness within this new training paradigm. We use AUC (area under the ROC Curve) to measure detection performances. The metric could be interpreted as the probability that the detector assigns a higher score to a random positive sample than to a random negative example. While the true-positive and the false-positive rates are the commonly used metrics for measuring the detection performance, they require a detection threshold to be specified. AUC, however, is an aggregated measurement of detection performance across a range of thresholds, and we found it to be a more stable and reliable metric. For the k-th detector h k, its AUC is computed on the set {(x, 0): \k )} (refer to loss 4). Having validated the robustness of individual detectors, we evaluate the overall performance of our integrated detection system. Recalling our detection rule, we first obtain the estimated class label k:= f (x), then use the k-th detector's logit output z(h k (x)) to predict: if z(h k (x)) ≥ T k, then x is a natural sample, otherwise it is an adversarially perturbed sample. For the sake of this evaluation, we use a universal threshold for all the detectors: ∀k ∈ {1...K} T k = T, and report detection performance at a range of universal thresholds. In practice, however, the optimal value of each detector's detection threshold T k should be determined by optimizing a utility function. to denote the test set that contains natural samples, and to denote the corresponding perturbed test set. For a given threshold T, we compute the true positive rate (TPR) on D and false positive rate (FPR) on D. These two metrics are respectively defined as and In the FPR definition we use f (x) = y to constrain that only true adversarial examples are counted as false positives. This constraint is necessary, as we found that for the norm ball constraint we considered in the experiments, not all perturbed samples are adversarial examples that cause misclassification on f. In order to craft the perturbed dataset D, we consider three attacking scenarios. Classifier attack. This attack corresponds to the scenario where the adversary is oblivious to the detection mechanism. For a given natural sample x and its label y, the perturbed sample x is computed by minimizing the loss, where z(f (x)) is the classifier's logit outputs. This objective is derived from the CW attack (b) and used in MadryLab (b) and MadryLab (a) to perform untargeted attacks. Detectors attack. In this scenario adversarial examples are produced by attacking only the detectors. We construct a single detection function H by using the i-th detector's logit output as its i-th logit output:. H is then treated as a single network, and the perturbed sample x for a given input (x, y) is computed by minimizing the loss Note that, according to our detection rule, a low value of the detector's logit output indicates detection of an adversarial example, thus by minimizing the negative of logit output we make the perturbed example harder to detect. H could also be fed directly to the CW loss 8 or to cross-entropy loss, but we found the attack based on the loss in 9 to be significantly more effective. Combined attack. With the goal of fooling both the classifier and detectors, perturbed samples are produced by attacking the integrated detection system. We consider two loss functions for realizing the combined attack. The first is based on the combined loss function (a) that has been shown to be effective against an array of detection methods. Given a natural example x and its label y, same as the detectors-attack scenario, we first construct a single detection function H by aggregating the logit outputs of individual detectors: z(H(x)) i:= z(h i (x)). We then use the aggregated detector's largest logit output max k =y z(H(x)) k (low value of this quantity indicates detection of an adversarial example) and the classifier logit outputs z(f (x)) to construct a surrogate classifier g, with its logit outputs being A perturbed example x is then computed by minimizing the loss function In practice we observe that the optimization of this loss tends to stuck at the point where max i =y z(f (x)) i keeps changing signs while max j =y z(H(x)) j stays as a large negative number (which indicates detection). To derive a more effective attack we consider a simple combination of loss 8 and loss 9: The objective is straightforward: if x is not yet an adversarial example on f, optimize it for that goal; otherwise optimize it for fooling the aggregated detector. We mention briefly here that we perform the same performance analysis of our generative detection method (as detailed in Section 3.2) by computing TPR on D and FPR on D. We use the loss 9 to perform attacks against the generative detection method, but also provide of attacks based on cross-entropy loss and CW loss 8. Integrated classification. In addition to the generative classifier proposed in Section 3.2, we introduce another classification scheme that provides a reject option. The scheme is based an integration of the naive classifier f and the detectors: for a given input x and its prediction label We respectively use loss 12 and 9 to attack the integrated classifier and the generative classifier. Performance metric. In the context of robust classification, the performance of a robust classifier is measured using standard accuracy and robust accuracy -accuracies respectively computed on the natural dataset and perturbed dataset. We provide a similar performance analysis of the above classification models. On the natural dataset, we compute the accuracy as the fraction of samples that are correctly classified (f (x) = y) and at the same time not rejected (z(h k (x)) ≥ T ): On the perturbed dataset we compute the error as the fraction of samples that are misclassified (f (x) = y) and at the same time not rejected: Note that in this case the error is no longer a complement of the accuracy. For a classification system with a reject option, any perturbed samples that are rejected should be considered as properly handled, regardless of whether they are misclassified. Thus on the perturbed dataset, the error, which is the fraction of misclassified and not rejected samples, is a more proper notion of such system's performance. For a standard robust classifier, its perturbed set error is computed as the complement of its accuracy on the perturbed set. Using different p-norm and maximum perturbation constrains we trained four detection systems (each has 10 base detectors), with training and validation adversarial examples optimized using PGD attacks of different steps and step-size (see Table 6). At each step of PGD attack we use the Adam optimizer to perform gradient descent, both for L 2 and L ∞ constrained scenarios. Appendix B.1 provides more training details. Robustness . The robustness test in Table 1 confirm that the base detectors trained with objective 5 are able to withstand much stronger PGD attacks, for both L 2 and L ∞ scenarios. Normalized steepest descent is another popular choice for performing PGD attack (; MadryLab, b; a), for which we got similar robustness (Table 8). Further on the complete list of performances of the L ∞ = 0.3 and L ∞ = 0.5 trained detectors, cross-norm and cross-perturbation test , and random restart test are included in Appendix D.1. Table 1: AUC scores of the first two detectors (k = 0, 1) tested with different strengths of PGD attacks using Adam optimizer. PGD attack steps, step-size Detection . Figure 2a shows that the combined attack is the most effective attack against integrated detection. Generative detection (attacked using loss 9) outperforms integrated detection, especially when the detection threshold is low (the region where TPR is high). In Figure 12 we confirm that loss 9 is more effective than CW loss and cross-entropy loss for attacking generative detection. Notably, the red curve that overlaps the y-axis shows that integrated detection can perfectly detect adversarial examples crafted by attacking only the classifier (using objective 8). In Table 2 we compare the performances of our generative detection method with the state-of-the-art detection method as identified by Carlini & Wagner (2017a). Our method using L ∞ = 0.5 trained base detectors is able to outperform the state-of-the-art method by a large margin. Appendix C describes the procedure we used to compute the mean L 2 distortion of our method. Classification . In Figure 2b, we compare the robust classification performance of our methods and a state-of-the-art robust classifier. While the performance of the robust classifier is fixed, by using different rejection thresholds, our classification methods provide the option to balance standard accuracy and robust error. The generative classifier outperforms the integrated classifier when the rejection threshold is low (i.e., when the perturbed set error is high). We observe that a stronger attack (= 0.4) breaks the robust classifier, while the generative classifier still exhibits robustness, even though both systems are trained with the same L ∞ = 0.3 constrain. shows perturbed samples by performing targeted attacks against the generative classifier and robust classifier. We observe that perturbed samples produced by attacking the generative classifier have distinguishably visible features of the target class, indicating that the base detectors, from which the generative classifier is built, have successfully learned the class-conditional distributions, and the perturbation has to change the semantics of the underlying sample for a successful attack. In contrast, perturbations introduced by attacking the robust classifier are not interpretable, even though they could cause high logit output of the target classes (see Figure 13 for the logit outputs distribution). Following this path and use a larger perturbation limit, it is straightforward to generate unrecognizable images that cause highly confident predictions of the robust classifier. Perturbed samples (generative classifier) Perturbed samples (robust classifier) Figure 3: Natural samples and corresponding perturbed samples produced by performing a targeted attack against the generative classifier and robust classifier . Targets from top row to bottom row are digit class from 0 to 9. We perform the targeted attack by maximizing the logit output of the targeted class, using L ∞ = 0.4 constrained PGD attack of steps 100 and step-size 0.01. We note that both classifiers use L ∞ = 0.3 for their training constraint. On CIFAR10 we train the base detectors using L ∞ = 8 constrain PGD attack of steps 40 and step size 0.5. Note that the scale of and step-size here is 0-255 (rather than 0-1 as in the case of MNIST). The robust classifier that we will compare with is trained with the same L ∞ = 8 constraint but with a different step-size (see Appendix D.2.2 for a discussion of step-sizes). Appendix B.2 provides the training details. Robustness . Table 3 shows that the base detector models can withstand attacks that are significantly stronger than the training attack. In Appendix D.2.1 we present random restart test , cross-norm and cross-perturbation test , and robustness test for L 2 based models. Detection . Consistent with the MNIST , in Figure 4a combined attack is the most effective method against integrated detection. Similarly, the generative detection outperforms integrated detection when the detection threshold is low (i.e., where TPR is high). In this figure we use loss 9 to attack generative detection, and in Figure 14 we show that it's more effective than attack based on cross-entropy loss and CW loss. In Table 4 our method outperforms the state-of-the-art adversarial detection method. Classification . In Figure 4b, we did not observe a dramatic decrease in the robust classifier's performance when we increase the perturbation limit to = 12. Integrated classification can reach the standard accuracy of a regular classifier, but at the cost of significantly increasing error on the perturbed set. Figure 5 shows some perturbed samples produced by attacking the generative classifier and robust classifier. While these two classifiers have similar errors on the perturbed set, samples produced by attacking the generative classifier have more visible features of the targets, which indicates that the adversary has to change more semantic in order to cause the same error. Figures 6 and 15 demonstrate that hard to recognize images are able to cause high logit outputs of the robust classifier. Such examples highlight a major defect of the defense mechanisms based on ordinary adversary training: they could be easily fooled by unrecognizable inputs (; b;). In contrast, samples that cause high logit outputs of the generative classifier all have clear semantic meaning. Since both classifiers are trained with L ∞ = 8 constrain, these indicate that AAT improves robust and interpretable feature learning. (See Appendix E for Gaussian noise attack and a discussion about the interpretability of our approach.) The visual similarity between generated samples in Figure 6 and real samples further suggests that detectors have successfully learned the conditional data distributions. Similarly, on ImageNet, we show asymmetrical adversarial training induces detection robustness and supports the learning of class-conditional distributions. Our experiment is based on Restricted ImageNet , a subset of ImageNet that has its samples reorganized into customized categories. The dog category contains images of different dog breeds collected from ImageNet class between 151 and 268. We trained a dog class detector by finetuning a pre-trained ResNet50 model. The dog category covers a range of ImageNet classes, with each one having its logit output. We use the subnetwork defined by the logit output of class 151 as the detector (in principle logit output of other classes in the range should also work). Due to computational constraints, we only validated the robustness of a L ∞ = 0.02 trained detector (trained with PGD attack of steps 40 and step-size 0.001), and we present the in Table 5 Generated by attacking generative classifier Generated by attacking robust classifier Figure 6: Images generated from class-conditional Gaussian noise by performing targeted attack against the generative classifier and robust classier. we use PGD attack of steps 60 and step-size 0.5 × 255 to perform L 2 = 30 × 255 constrained attack (same as . The Gaussian noise inputs from which these two plots are generated are the same. Samples not selected. In this paper, we studied the problem of adversarial detection under the robust optimization framework and proposed a novel adversarial detection scheme based on input space partitioning. Our formulation leads to a new generative modeling technique which we called asymmetrical adversarial training (AAT). AAT's capability to learn class-conditional distributions further gives rise to generative detection/classification methods that show competitive performance and improved interpretability. In particular, our generative classifier is more resistant to "rubbish examples", a significant threat to even the most successful defense mechanisms. High computational cost (see Appendix F for more discussion) is a major drawback of our methods, and in the future, we will explore the idea of shared computation between detectors. A A DEEPER LOOK AT ASYMMETRICAL ADVERSARIAL TRAINING Under the energy-based learning framework , the AAT objective could be understood as learning an energy function that has low energy outputs on target class data points, and high energy outputs anywhere else. The energy function in this case could be defined using the logit output of the target detector:. Using the Gibbs distribution we could obtain a density function and it should be interpreted as the joint distribution of the data point and the corresponding class category p(x, k) =, where Z Θ is a normalizing constant known as the partition function, and could be computed in our case as Z Θ = k exp(−E θ k (x))dx. (We note a similar formulation is used by .) When x is in high dimensional space, Z Θ is intractable, but for generative classification, only knowing the unnormalized probability will suffice. While ordinary discriminative training only learns a good discriminative boundary, AAT is able to learns the underlying density function. In Figure 7 we provide a schematic illustration of this phenomenon ( on real 1D data is in Figure 8). In Figure 9 we observe similar on 2D benchmarking datasets (; ; ; ;) that detectors are able to cover all models of the distributions. We note that unlike GANs that at the global optimum the discriminator converge to uniform solution and thus could not retain density information (a;), by properly constraining the adversary (especially on the perturbation limit), AAT is able to stably push the detector to a good approximation of the underlying density function. Being able to do reliable (implicit) density estimation justifies our energy-based generative classification formulation (we leave the theoretical analysis of the objective's convergence property to future work). The compelling property of AAT generalizes to the case of high dimensional data. In the following, we present CIFAR10 and ImageNet image generation for our models and state-of-the-art GANs models (Figure 10 vs. Figure 11 for CIFAR10, and Figure 21 vs. Figure 23 for ImageNet). While images generated by our models are not necessarily more "realistic", they clearly have captured the structures of the target objects. In particular, the in Figure 21 show that our model is only modeling the main structures of target objects, but not other irrelevant elements like s and other objects. We note that apart from being able to produce state-of-the-art image generation , our approach at the same time provides classification/detection performance guarantee against norm constrained adversarial examples, while other generative models cannot . The ing energy function after training. The blue data distribution has two modes, but the energy function is not able to capture this structure due to its minute effects on the discriminative objective. (c) By solving the inner maximization in objective 5 red points are pushed towards to the low energy region, but (crucially) they are not collapsed to the lowest energy point due to the perturbation limit. The gap between the two sets of blue points is now filled with red points; minimizing the loss ] causes the energy function to be pulled up on this region. (d) The energy function after training is able to capture the internal structure of the blue data. The positive class data (blue points) are sampled from a mixture of Gaussians (mean 0.4 with std 0.01, and mean 0.6 with std 0.005, each with 250 samples). Both the blue and red data has 500 samples. The estimated density function is computed using Gibbs distribution and network logit outputs. PGD attack steps 20, step size 0.05, and perturbation limit = 0.3. Figure 9: 2D datasets (top row, blue points are class 1 data, and red points are class 0 data, both have 1000 data points) and sigmoid outputs of AAT trained models (bottom row). The architecture of the MLP model for solving these tasks is 2-500-500-500-500-500-1. PGD attack steps 10, step-size 0.05, and perturbation limit L ∞ = 0.5. We use 50K samples from the original training set for training and the rest 10K samples for validation, and report test performances based on the epoch-saved checkpoint that gives the best validation performance. All base detectors are trained using a network consisting of two max-pooled convolutional layers each with 32 and 64 filters, and a fully connected layer of size 1024, same as the one used in. At each iteration we sample a batch of 320 samples, from which in-class samples are used as positive samples, and out-of-class samples are used as the source for adversarial examples that will be used as negative samples. To balance positive and negative examples at each batch, we resample the out-of-class set to have same number of samples as in-class set. All base detectors are trained for 100 epochs. Table 6: MNIST dataset PGD attack steps and step-sizes for base detector training and validation. We train our CIFAR10 base detectors using the ResNet50 model . To speedup training, we take advantage of a natural trained classifier: the subnetwork of f that defines the output logit z(f (·)) k is essentially a "detector", that would output high values for samples of class k, and low values for others. Our detector is then trained by finetuning the subnetwork using objective 5. Our pretrained classifier has a test accuracy of 95.01% (fetched from the CIFAR10 adversarial challenge (MadryLab, a)). At each iteration of training we sample a batch of 300 samples, from which in-class samples are used as positive samples, while an equal number of out-of-class samples are used as sources for adversarial examples. Adversarial examples for training L 2 and L ∞ models are both optimized using PGD attack with normalized steepest descent (MadryLab, b). We report based on the best performances on the CIFAR10 test set (thus don't claim generalization performance of the proposed method). We first find the detection threshold T with which the detection system has 0.95 TPR. We construct a new loss function by adding a weighted loss term that measures perturbation size to objective 9 We then use unconstrained PGD attack to optimize L(x). We use binary search to find the optimal c, where in each bsearch attempt if x is a false positive (max i z(H(x)) i = y and max i =y z(H(x)) i > T ) we consider the current c as effective and continue with a larger c. The configurations for performing binary search and PGD attack are detailed in Table 7. The c upper bound is established such that with this upper bound, no samples except those that are inherently misclassified by the generative classifier, could be perturbed as a false positive. With these settings, our MNIST generative detector with L ∞ = 0.3 base detectors reached 0.9962 FPR, generative detector with L ∞ = 0.5 base detectors reached 0.9936 FPR, and CIFAR10 generative detector reached 0.9995 FPR. We note that it's very difficult to find the optimal c in loss 15 using binary search, hence performance based on mean L 2 distortion is not precise, and we encourage future work to measure detection performances based on norm constrained attacks (as in Figure 2a). Table 8: AUC scores of the first two base detectors under different strengths of PGD attacks using normalized steepest descent. The gradient descent rules for L 2 and L ∞ constrained attacks are respectively x n+1 = x n − γ ∇f (xn) ∇f (xn) 2 and x n+1 = x n − γ · sign(∇f (x n)). Table 9: AUC scores of the first two base detectors under cross-norm and cross-perturbation attacks. L ∞ based attacks use steps 200 and step-size 0.01, and L 2 based attacks uses steps 200 and step-size 0.1. Table 10: AUC scores of the first MNIST base detector under fixed start and multiple random restarts attacks. These two tests use the same attack configuration: the L ∞ = 0.5 trained base detector is attacked using L ∞ = 0.5 constrained PGD attack of steps 200 and step-size 0.01, and the L 2 = 5.0 trained base detector is attacked using L 2 = 5.0 constrained PGD attack of steps 200 and step-size 0.1. Table 11: AUC scores of all L ∞ = 0.3 trained base detectors. Tested with L ∞ = 0.3 constrained PGD attacks of steps 200 and step-size 0.01. Table 12: AUC scores of all L ∞ = 0.5 trained base detectors. Tested with L ∞ = 0.5 constrained PGD attacks of steps 200 and step-size 0.01. Table 13: AUC scores of the first CIFAR10 base detector under fixed start and multiple random restarts attacks. The L ∞ = 2.0 base detector is attacked using PGD attack of steps 10 and stepsize 0.5, and the L ∞ = 8.0 base detector is attacked using PGD attack of steps 40 and step-size 0.5. Table 16: AUC scores of L ∞ = 2.0 trained base detectors under L ∞ = 2.0 constrained PGD attack of steps 10 and step-size 0.5. Table 17: AUC scores of L ∞ = 8.0 trained base detectors under L ∞ = 8.0 constrained PGD attack of steps 40 and step-size 0.5. We found training with adversarial examples optimized with a sufficiently small step-size to be essential for detection robustness. In table 18 we tested two L ∞ = 2.0 base detectors respectively trained with 0.5 and 1.0 step-size. The step-size 1.0 model is not robust when tested with a much smaller step-size. We observe that when training the step-size 1.0 model, training set adv AUC reached 1.0 in less than one hundred iterations, but test set natural AUC plummeted to around 0.95 and couldn't recover thereafter. (Please refer to Figure 16 for the definitions of adv AUC and nat AUC.) This suggests that naturally occurring data samples, and adversarial examples produced using a large step-size, live in two quite different data spaces -training a classifier to separate these two kinds of data is easy, but the performance won't generalize to real attacks. was able to train their CIFAR10 robust classifier using step-size 2, we found this step-size not working in our case. To study the effects of perturbation limit on asymmetrical adversarial training, we compare one L ∞ = 2.0 trained and one L ∞ = 8.0 trained base detector. In Figure 16 we show the training and testing history of these two models. The = 2.0 model history show that by adversarial finetuning the model reach robustness in just a few thousands of iterations, and the performance on natural samples is preserved (test natural AUC begins at 0.9971, and ends at 0.9981). Adversarial finetuning on the = 8.0 model didn't converge after an extended 20K iterations of training. The gap between train adv AUC and test adv AUC of the = 8.0 model is more pronounced, and we observed a decrease of test natural AUC from 0.9971 to 0.9909. The comparison shows that training with larger perturbation limit is more time and resource consuming, and could lead to performance decrease on natural samples. The benefit is that the model learns more interpretable features. In Figure 17, perturbations generated by attacking the naturally trained classifier (corresponds to 0 perturbation limit) don't have clear semantic. In contrast, perturbed samples of the L ∞ = 8 model are completely recognizable. Figure 18: ImageNet 224×224×3 random samples generated from class-conditional Gaussian noise by attacking robust classifier and detector models trained with different constrains. Note than large perturbation models are still under training and haven't reached robustness. Please refer to for the detail about how the class-conditional Gaussian is estimated. In this section we use Gaussian noise attack experiment to motivate a discussion about the interpretabilities of our generative classification model and discriminative robust classification model . Our approach is more interpretable in the sense that it provides a probabilitic view of the decision making process of the classification problem, and this probabilistic interpolation is further supported by the experimental . We first discuss how these two approaches determine the posterior class probabilities. For the discriminative classifier, the posterior probabilities are computed from the logit outputs of the classifier using the softmax function p(k|x) = exp(z(f (x)) k ) K j=1 exp(z(f (x))j ). For our generative classifier, the posterior probabilities are computed in two steps: in the first, we train our base detectors, which is the process of solving the inference problem of determining the joint probability p(x, k) (see Appendix A), and in the second, we use Bayes rule to compute the posterior probability p(k|x) =. Coincidentally, the formulas for computing the posterior probabilities take the same form. But in our approach, the exponential of the logit output of a detector (i.e., exp(z(h k (x)))) has a clear probabilistic interpretation: it's the unnormalized joint probability of the input and the corresponding class category. We use Gaussian noise attack to demonstrate that this probabilistic interpretation is consistent with our visual perception. We start from a Gaussian noise image, and gradually perturb it to cause higher and higher logit outputs. This is implemented by targeted PGD attack against logit outputs of these two classification models. The ing images in Figure 24 show that, for our model, the logit output increase direction is the semantic changing direction; while for the discriminative robust model, the perturbed image computed by increasing logit outputs are not as clearly interpretable. In particular, the perturbed images that cause high logit outputs of the robust classifiers are not recognizable. In this section we provide an analysis of the computational cost of our generative classification approach. In terms of memory requirements, if we assume the softmax classifier (i.e., the discriminative robust classifier) and the detectors use the same architecture (i.e., only defer in the final layer) then the detector-based generative classifier is approximately K times more expensive than the Kclass softmax classifier. This also means that the computational graph of the generative classifier is K times larger than the softmax classifier. Indeed, in the CIFAR10 task, on our Quadro M6000 24GB GPU (TensorFlow 1.13.1), the inference speed of the generative classifier is roughly ten times slower than the softmax classifier. We next benchmark the training speed of these two types of classifiers. The generative classifier has K logit outputs, with each one defined by the logit output of a detector. Same with the softmax classifier, except that the K outputs share the parameters in the convolutional part. Now consider ordinary adversarial training on the softmax classifier and asymmetrical adversarial training on the generative classifier. To train the softmax classifier, we use batches of N samples. For the generative classifier, we train each detector with batches of 2 × M samples (M positive samples and M negative samples). At each iteration, we need to respectively compute N and M × K adversarial examples for these two classifiers. Now we test the speed of the following two scenarios: 1) compute the gradient w.r.t. to N samples on a single computational graph, and 2) compute the gradient w.r.t to M × K samples on K computational graphs, with each graph working on M samples. We assume in scenario 2 that all the computational graphs are loaded to GPUs, and their computations are in parallel. In our CIFAR10 experiment, we used batches consisting of 30 positive samples and 30 negative samples to train each ResNet50 based detectors. , the softmax classifier was trained with batches of 128 samples. In this case, K = 10, M = 30, and N = 128. On our GPU, scenario 1 took 683 ms ± 6.76 ms per loop, while scenario 2 took 1.85 s ± 42.7 ms per loop. In this case, we could expect asymmetrical adversarial training to be about 2.7 times slower than ordinary adversarial training, if not considering parameter gradient computation. (If we choose to use a large batch size the computational cost will increase accordingly.)"

Lower bound for compressed sensing w/ generative models that matches known upper bounds

Represent the TLDR for finding the corresponding scientific article

We prove that for a large class of functions f there exists an interval certified robust network approximating f up to arbitrary precision.