Question: Represent the article for finding a single-sentence TLDR!

Question: One of the fundamental tasks in understanding genomics is the problem of predicting Transcription Factor Binding Sites (TFBSs). With more than hundreds of Transcription Factors (TFs) as labels, genomic-sequence based TFBS prediction is a challenging multi-label classification task. There are two major biological mechanisms for TF binding: sequence-specific binding patterns on genomes known as “motifs” and interactions among TFs known as co-binding effects. In this paper, we propose a novel deep architecture, the Prototype Matching Network (PMN) to mimic the TF binding mechanisms. Our PMN model automatically extracts prototypes (“motif”-like features) for each TF through a novel prototype-matching loss. Borrowing ideas from few-shot matching models, we use the notion of support set of prototypes and an LSTM to learn how TFs interact and bind to genomic sequences. On a reference TFBS dataset with 2.1 million genomic sequences, PMN significantly outperforms baselines and validates our design choices empirically. To our knowledge, this is the first deep learning architecture that introduces prototype learning and considers TF-TF interactions for large scale TFBS prediction. Not only is the proposed architecture accurate, but it also models the underlying biology. Genomic sequences build the basis of a large body of research on understanding the biological processes in living organisms. Enabling machines to read and comprehend genomes is a longstanding and unfulfilled goal of computational biology. One of the fundamental task to understand genomes is the problem of predicting Transcription Factor Binding Sites (TFBSs), attracting much attention over the years BID5. Transcription Factors (TFs) are proteins which bind (i.e., attach) to DNA and control whether a gene is expressed or not. Patterns of how different genes expressed or not expressed control many important biological phenomena, including diseases such as cancer. Therefore accurate models for identifying and describing the binding sites of TFs are essential in understanding cells. Owing to the development of chromatin immunoprecipitation and massively parallel DNA sequencing (ChIP-seq) technologies BID26 ), maps of genome-wide binding sites are currently available for multiple TFs in a few cell types across human and mouse genomes via the ENCODE BID5 database. However, ChIP-seq experiments are slow and expensive; they have not been performed for many important cell types or organisms. Therefore, computational methods to identify TFBS accurately remain essential for understanding the functioning and evolution of genomes. An important feature of TFs is that they typically bind to sequence-specific patterns on genomes, known as "motifs" BID25. Motifs are essentially a blueprint, or a "prototype" which a TF searches for in order to bind. However, motifs are only one part in determining whether or not a TF will bind to specific locations. If a TF binds in the absence of its motif, or it does not bind in the presence of its motif, then it is likely there are some external causes such as an interaction with another TF, known as co-binding effects in biology BID46. This indicates that when designing a genomic-sequence based TFBS predictor, we should consider two modeling challenges: how to automatically extract "motifs"-like features and how to model the co-binding patterns and consider such patterns in predicting TFBSs. In this paper, we address both proposing a novel deep-learning model: prototype matching network (PMN).To address the first challenge of motif learning and matching, many bioinformatics studies tried to predict TFBSs by constructing motifs using position weight matrices (PWMs) which best represented the positive binding sites. To test a sequence for binding, the sequence is compared against the PWMs to see if there is a close match BID37. PWM-matching was later outperformed by convolutional neural network (CNN) and CNN-variant models that can learn PWM-like filters BID0. Different from basic CNNs, our proposed PMN is inspired by the idea of "prototype-matching" BID44 BID14. These studies refer to the CNN type of model as the "feature-matching" mode of pattern recognition. While pure feature matching has proven effective, studies have shown a "prototype effect" where objects are likely recognized as a whole using a similarity measure from a blurred prototype representation, and prototypes do not necessarily match the object precisely BID44. It is plausible that humans use a combination of feature matching and prototype matching where feature-matching is used to construct a prototype for testing unseen samples BID14. For TFBS prediction, the underlying biology evidently favors computation models that can learn "prototypes" (i.e. effective motifs). Although motifs are indirectly learned in convolutional layers, existing deep learning studies of TFBS (details in Section 3) have not considered the angle of "motif-matching" using a similarity measure. We, instead, propose a novel prototype-matching loss to learn prototype embedding automatically for each TF involved in the data. None of the previous deep-learning studies for TFBS predictions have considered tackling the second challenge of including the co-binding effects among TFs in data modeling. From a machine learning angle, the genomic sequence based TFBS prediction is a multi-label sequence classification task. Rather than learning a prediction model for each TF (i.e., each label) predicting if the TF will bind or not on input, a joint model is ideal for outputting how a genomic sequence input is attached by a set of TFs (i.e., labels). The so-called "co-binding effects" connect deeply to how to model the dependency and combinations of TFs (labels). Multi-label classification is receiving increasing attention in deep learning BID9 BID47 (detailed review in Section 3). Modeling the multi-label formulation for TFBS is an extremely challenging task because the number of labels (TFs) is in hundreds to thousands (e.g. 1,391 TFs in BID41). The classic solution for multi-label classification using the powerset idea (i.e., the set of all subsets of the label set) is clearly not feasible BID40. Possible prior information about TF-TF interactions is unknown or limited in the biology literature. To tackle these obstacles, our proposed model PMN borrows ideas from the memory network and attention literature. BID43 proposed a "matching network" model where they train a differentiable nearest neighbor model to find the closest matching image from a support set on a new unseen image. They use a CNN to extract features and then match those features against the support set images. We replace this support set of images with a learned support set of prototypes from the large-scale training set of TFBS prediction, and we use this support set to match against a new test sample. The key difference is that our PMN model is not for few-shot learning and we seek to learn the support set (prototypes). BID43 uses an attentionLSTM to model how a test sample matches to different items in the support set through softmax based attention. Differently, we use what we call a combinationLSTM to model how the embedding of a test sample matches to a combination of relevant prototypes. Using multiple "hops", the combinationLSTM updates the embedding of the input sequence by searching for which TFs (prototypes) are more relevant in the label combination. Instead of explicitly modeling interactions among labels, we try to use the combinationLSTM to mimic the underlying biology. The combinationLSTM tries to learn prototype embedding and represent high-order label combinations through a weighted sum of prototype embedding. This weighted summation can model many "co-binding effects" reported in the biology literature BID46 ) (details in Section 2).In summary, we propose a novel PMN model by combining few-shot matching and prototype feature learning. To our knowledge, this is the first deep learning architecture to model TF-TF interactions in an end-to-end model. In addition, this is also the first paper to introduce large scale prototype learning using a deep learning architecture. On a reference TFBS dataset with 2.1 million genomic sequences, PMN significantly outperforms the state-of-the-art TFBS prediction baselines. We validate the learned prototypes through an existing database about TF-TF interactions. The TF groups obtained by clustering prototype embedding evidently captures the "cooperative effects" that has not been modeled by previous TFBS prediction works. The main contributions of our model are: DISPLAYFORM0 On the left is an overview of the model. The input sequence x is encoded asx using f (3-layer CNN).x is then matched against the learned prototypes using the combinationLSTM for K "hops" so that it can update its output based on TF interactions for this input sequence. The final outputŷ is based on a concatenation of the final updated sequence vector h K from the LSTM, and final read vector r K from the matching. On the right is a closer look at the internal aspects of the combinationLSTM.• We propose a novel model by combining few-shot matching with large-scale prototype feature learning.• We design a novel prototype-matching loss to learn "motif"-like features in deep learning, which is important for the TFBS prediction task.• We extend matching models from the few-shot single-label task to a large-scale multi-label task for genomic sequence classification.• We implement an attention LSTM module to model label interactions in a novel way.• Our model favors design choices mimicking the underlying biological processes. We think such modeling strategies are more fundamental especially on datasets from biology. Given a DNA sequence x (composed of characters A,C,G,T) of length T, we want to classify x as a positive or negative binding site for each transcription factor T F 1, T F 2,..., T F in our dataset (i.e. multi-label binary classification). To do this, we seek to match x to a bank of learned TF prototype vectors, {p 1, ..., p}, where each prototype is loosely representative of a motif. In addition, since TFs may bind or not bind based on other TFs, we model the interactions among TFs in order to make a prediction. An overview of our model can be seen in Figure 1. The input sequence x ∈ R 4×t is encoded using a function f (3-layer CNN, which has shown to be sufficient for genomic feature extraction) to produce sequence embeddingx ∈ R d: DISPLAYFORM0 Each prototype vector p i ∈ R d is learned via a lookup table with a constant input integer at each position (e.g. 1 as input to the first position and t as input to position t). I.e. the prototypes are produced by a multiplication of the identity matrix I and the learned lookup table matrix W ∈ R |T F s|×d. DISPLAYFORM1 Since our learned prototypes, p i are randomly initialized, we introduce a prototype matching loss L p, which forces a prototype to correspond to a specific TF. Our prototype matching loss is explained in section 2.4. Once we have the sequence and prototype embedding vectors, we want to compare the sequence to the prototypes to get binding site probabilities for each TF. The main idea is that we want to modify the sequence embeddingx conditioned on matching against the prototypes. Since interactions among TFs influence binding, we cannot simply match the sequence to the prototypes. To obtain TF interactions, we use an LSTM (combinationLSTM), similar to the attention LSTM (attLSTM) in BID43. Our combinationLSTM is what does the actual matching for classification, whereas BID43 use the output of the attLSTM to make the final matching prediction. The combinationLSTM uses K "hops" to process the prototypes p 1, p 2,..., p by matching against an updated sequence embeddingĥ k. The hops allow the combinationLSTM to update the output vector based on which TFs match simultaneously. At each hop, the LSTM accepts a constantx, a concatenation of the previous LSTM hidden state h k−1 and read vector r r k−1, as well as the previous LSTM cell output c k−1. h 0 and c 0 are initialized with zeros, and r 0 is initialized with the mean of all prototype vectors, DISPLAYFORM0 The output hidden stateĥ k is matched against each prototype using cosine similarity, producing a similarity score. Since this similarity is in the range [-1,1], we feed this output through sigmoid function, weighted by hyperparameter (we use =20) to produce the similarity score w DISPLAYFORM1 The read vector r is updated by a weighted sum of the prototype vectors using the matching scores. At each hop, h k is updated using the current LSTM output hidden state and the sequence embedding.ĥ DISPLAYFORM2 In the TFBS task, eq. 5 is the important factor for modelling TF combinations. The output vector r can model multiple prototypes matching at once through a linear combination. Furthermore, the LSTM with K hops is needed because of the fact that a TF binding may influence other TFs in a sequential manner. For example, if T F i matches toĥ k in the first hop, r k is then used to outputĥ k+1 which can match to T F j at the next hop. In this case,ĥ k+1 is a joint representation ofx and the current matched prototypes, represented by r k. At each hop, the LSTM fine-tunes w k in order to find T F binding combinations. |T F s| is computed from a concatenation of the final hidden state and read vectors [h k ; r K] after the K th hop using a linear transform and an element-wise sigmoid function to get a probability of binding for each TF.: DISPLAYFORM0 To classify a sequence, we use a standard binary cross entropy loss between each label y i for T F i, and the corresponding T F i outputŷ i, which we call the classification loss, L c, for each label. We also introduce a prototype matching loss L p, which forces a prototype to correspond to a specific TF since prototypes are learned from random initializations. The prototype matching loss works by using an L 2 between the true label y i for T F i and the final matching weight w K i between updated sequence h K and prototype p i. This loss forces a prototype to match to all of its positive binding sequences. Each w K i is from the final prototype matching weights after the K th hop from Eq. FORMULA1 whether the study has a joint deep architecture for multi-label prediction or not, if the study learns prototype features ("motifs" in the TFBS literature), whether the study models how input samples match prototypes, if it uses RNN to model high-order combinations of labels, and finally if the method considers current sample inputs for modeling label combinations. All previous TFBS studies do not model label interactions. PMN combines several key strategies from deep learning literature including: (a) learning label-specific prototype embedding BID35 through prototype-matching loss, (b) using RNN to model higher-order label combinations, and (c) using LSTM to model such combinations dynamically (conditioned on the current input) BID43 Image DISPLAYFORM0 DISPLAYFORM1 The important thing is that the loss is computed from the final weights w K. This allows the LSTM to attend to certain TFs at different hops before making its final decision, modeling the co-binding of TFs. The hyperparameter λ controls the amount that each prototype is mapped to a specific TF. λ=0 corresponds to random prototypes since we are not forcing p i to match to a specific sequence. Thus, the final loss L is a summation of both the classification loss and the prototype matching loss: DISPLAYFORM2 DISPLAYFORM3 2.5 TRAINING We trained our model using Adam BID13 ) with a batch size of 512 sequences for 40 epochs. Our were based on the test set from the best performing validation epoch. We use dropout BID36 for regularization. TF, the binding preference is generally represented in the form of a position weight matrix (PWM) BID38 BID24 ) (also called position-specific scoring matrix) derived from a position frequency matrix (PFM). Recently this technique was outperformed by different variations of deep convolutional models BID1 BID29 BID32. While motif-based PWMs are compact and interpretable, they can under-fit ChIP-seq data by failing to capture subtle but detectable and important sequence signals, such as direct DNA-binding preferences of certain TFs, cofactor binding sequences, accessibility signals, or other discriminative sequence features BID2 ). The formulation of TFBS prediction belongs to a general category of "biological sequence classification". Sequence analysis plays an important role in the field of bioinformatics. Various methods have previously been proposed, including generative (e.g., Hidden Markov Models-HMMs) and discriminative approaches. Among the discriminative approaches, string kernel methods provide some of the most accurate , such as for remote protein fold and homology detections BID20 BID15. We omit a full survey of this topic due to its vast body of previous literature and loose connection to our TFBS formulations. Memory Matching Network and Attention RNN: Attention in combination with RNNs has been successfully used for many tasks BID3. Various methods have extended the single step attention approach to attention with multiple'hops' BID39; BID16. For example, for the Question Answering task, BID16 introduced the Dynamic Memory Network which uses an iterative attention process coupled with an RNN over multiple'episodes'. BID16 show that the attention gets more focused over successive hops or'episodes' over the input, reaffirming the need for recurrent episodes. Most of these models are for sequential inputs. For tasks that involve a set (i.e., no order) as input or/and as output, BID42 introduced a general framework employing a similar content based attention with associative memory. To deal with non-sequential inputs, the input elements are stored as a unordered external memory. It uses an LSTM coupled with a dynamic attention mechanism over the memory vectors. After'K' hops of the LSTM, the final output/memory retrieved from the process block does not depend on the ordering of the input elements. BID43 leverage this set framework for few-shot learning by introduce the "matching network" (MN) model. The MN model learns nearest neighbor classifier to find the closest matching image from a support set on a new unseen image. To this end, they use the same'process' block from BID42 with modifications to incorporate'matching'. In each hop over the support set, they'match' or compare the hidden state of the attLSTM with each of the support set elements. They use the output of the attLSTM to do the final support set matching. In our model, we use a set of learned prototype vectors instead of the support set of images. Both our model and the MN model uses an LSTM to learn the interactions among the items in the support set. However, the MN model uses a softmax attention and we use a sigmoid attention (due to the multi-label output). We compare a baseline model using a softmax attention (details in section 4.1). BID14. Prototype theory, on the other hand, proposes that objects are recognized as a whole and prototypes do not necessarily match the object precisely BID44. In this sense, the prototypes are blurred abstract representations which include all of the object's features. BID14 show that pattern recognition is likely a combination of both feature-matching and prototype-matching. Transcription factors bind to motifs on DNA sequences, which we view as prototypes, the blurred features are constructed from a CNN (featurematching). Our method is motivated by the prototype-matching theory, where instead of searching for exact features to match against, the model tests an unseen sample against a set of prototypes using a defined similarity metric to make a classification. BID35 introduces prototypical networks for zero and one-shot learning, which assumes that the data points belonging to a particular class cluster around a single prototype. This prototype is representative for its class. In this model, each prototype embedding is the average embedding of all examples belonging to a certain class. This method is equivalent to a linear classifier if the Euclidean distance metric is used. While this method successfully learns a single prototype embedding for each class, it does not utilize a recurrent-attention mechanism over the support set. The prototypes in their method are restricted to the average embedding of its class and do not consider interactions among classes. Instead, our prototypes are the learned embedding for each label and play important roles in modelling the interactions among labels. BID31 proposed a method for learning k-prototypes within each class, instead of just one. This in turn requires a k-means classifier to first group the intra-class embeddings before separating inter-class embeddings. Multi-label Classification in Deep Learning: Multi-label classification is receiving increasing attention in image classification and object recognition. In a multi-label classification task, multiple labels may be assigned to each instance. A problem transformation method for multilabel classification considers each different set of labels as a single label. Thus, it learns a binary classifier for every element in the powerset of the labels BID40. However, this may not be feasible in the case of a large number of labels. The most common and a more feasible problem transformation method learns a binary classifier for each label BID40. BID8 use ranking to train deep convolutional neural networks for multi-label image classification. In Hypotheses-CNN-Pooling BID47, the output from different hypotheses are aggregated with max pooling. These models treat the labels independently from each other. However, modeling the dependencies or co-occurrences of the labels is essential to gain a complete understanding of the image. To this end, BID30 propose a chaining method to model label correlations. BID49 BID7 and BID9 use graphical models to capture these dependencies. However, these approaches only model low order label correlations and can be computationally expensive. is the state-of-the-art multi-label study for object recognition. To characterize the high-order label dependencies, this model leverages the ability of an LSTM to model long-term dependency in a sequence. Briefly, the label prediction is treated as an'ordered prediction path'. This prediction path is essentially modeled by the RNN. While the CNN is used to extract image features, the RNN model takes the current label prediction as input at each time step and generates an embedding for the next predicted label. Although the RNN utilizes its hidden state to model the label dependencies, it is not dynamically conditioned on input samples. StarSpace BID48 is a method to learn entity embeddings in the input space which can handle multi-label outputs. Our method is different in that it extracts relationships directly among the outputs rather than in the input space. Dataset: We constructed our own dataset from ChIP-seq experiments in the ENCODE project database BID5. ChIP-seq experiments give binding affinity p-values for certain locations in the human genome for a specific cell type. We divided the entire human genome up into 200-length sequences, using a sliding window of 50 basepairs. We then extracted the 200-length windows surrounding the peak locations for 86 transcription factors in the human lymphoblastoid cell line (GM12878). Any peak with a measured p-value of at least 1 was considered a positive binding peak (it is important to note that we could get better by setting a higher treshold, but we were interested in modelling all potential peaks). For each window in the genome, if any of the TF windows have a >50% overlap, we consider this a positive binding site window. We discard all windows with no TFs binding, ing in a total of 2,084,501 binding site windows, or about 14% of the human genome. Data Statistics: We use windows in chromosomes 1, 8, and 21 as a validation set (331,884 sequences), chromosomes 3, 12, and 17 as a test set (306,297 sequences), and the rest as training (1,446,320 sequences). The number of positive training windows for each TF ranges from 793 (<1% of training samples) to 380,824 (23% of training samples). The validation and test splits have similar percentages. About 40% of the windows have more than 1 TF binding to it, and each window has about 5 TFs binding. A overview summary of the dataset is shown in TAB4 and a per-TF summary of the dataset is shown in FIG0. To test the PMN model on our TFBS dataset, we constructed 3 model variations 1. CNN As commonly used in previous models BID28, we use a baseline 3-layer CNN model. We use {512,256,128} kernels of widths {9,5,3} at the 3 layers, respectively. The output of the CNN is maxpooled across the length, ing in a final output vector of size 128. This architecture is used for both the single-label and multi-label CNN models. Table 4: TFBS Prediction Across 86 TFs in GM12878 Cell Line. We compare our PMN model to two CNN baseline models (single-label and multi-label). We use the same CNN model and extend it using prototypes and the combinationLSTM to create our PMN model. λ represents the weighting of the prototype loss in eq. 10. Results are shown using statistics across all 86 TFs, where our PMN model outperforms the CNN models based on all 3 metrics used. The PMN also outperforms both CNN models significantly using a pairwise t-test. 2. PMN no LSTM To demonstrate the effectiveness of the combinationLSTM module, we implement a PMN with no LSTM to iteratively update its weightings. In this model, we use eq. 5-9, except that we replaceĥ k in eq. 9 withx since there is no LSTM. The output (eq. 11) is then a concatenation of r andx. We still use the full prototype loss (λ = 1) in this model. 3. PMN, softmax att Since softmax attention is typically used in attention models, we explored using a softmax function to replace eq. 6 from k = 0 until k = K − 1, and then an elementwise sigmoid function (i.e. eq. 6) for the final output since it is multi-label classification. 4. PMN, sigmoid att The full PMN model utilizes the LSTM module in eq. 6 over K hops. We implement 3 variations of the prototype loss (λ = 0, λ = 0.5, λ = 1), where λ = 0 represents no prototype loss, or random prototypes. We observed that λ > 1 did not in improved . We then extended the baseline CNN to use the learned prototypes p i, and prototype matching LSTM (combinationLSTM). We call the combination of the CNN, prototypes, and combinationLSTM a PMN. We use K = 5 hops for the combinationLSTM because each sample has on average 5 positive label outputs. We also compared against a baseline single-task model for each TF, which assumes no interactions among TFs. Metrics: We use three separate metrics which are commonly used in large scale TFBS prediction. Since our labels are very unbalanced, we use area under ROC curve (auROC). However, auROC may not give a fair evaluation in unbalanced datasets BID21 BID4. So we also use area under precision-call curve (auPR), and recall at 50% false discovery rate. Table 4 shows the of our models across the 86 TF labels. The joint CNN (multi-label) model outperformed the single label CNN models in auROC and auPR. The main advantage of the joint model is that it is faster than an individual model for each TF. The joint model's improvement over the single-task models was not significant (p-value < 0.05) based on a one-tailed pairwise t-test. This is presumably because the joint model finds motifs similar among all motifs, but it doesn't model interactions among TF labels. The PMN model outperformed both baseline CNN models in all 3 metrics. In addition, the improvement of the PMN over both CNN models was significant using a one-tailed pairwise t-test. We hypothesize that the combinationLSTM module accurately models co-binding better, leading to an increase in performance. In FIG1, we show the per-epoch mean auROC of the PMN vs CNN model. There are two important factors to note from this plot. First, the PMN models all outperform the baseline CNN. Second, the PMN models converge faster than the CNN. We hypothesize that the prototypes and similarity measure help the model generalize quickly. We assume this is the case since prototype matching models have been shown to work in few-shot cases BID43 BID35. Table 5: Column "TF-A" represents a TF in one of the clusters obtained from hierarchical clustering. The subsequent column contains TFs that belong to the same cluster and, according to TRRUST database BID10, share target genes with TF-A. Remaining columns show the number of overlapping target genes between each TF and TF-A pair as well as their p-values for TF-TF cooperativity obtained from TRRUST. An interesting thing to note here is that in Cluster 1 and 2, TF that is away from TF-A in the cluster has lower p-value than the TF that is closer. This is also validated in TFs with the smallest amount of samples. In the 10 TFs with the smallest amount of samples, the PMN (λ = 1) has a 1.86% increase in mean auROC over the CNN. In the 10 TFs with the largest amount of samples, however, the PMN only in an increase of 0.94%.Biological Validation of Learned Prototype Embedding: In our PMN model, we are learning a prototype for each TF that represents "motif"-like features for that TF. Each prototype is processed by the combinationLSTM which is capturing the information about TFs that bind simultaneously (or TF-TF cooperativity). Thus, we hypothesize that our prototype not only learns its TF embedding but should also reflect the TF-TF cooperativity. This information is biologically relevant as it answers a critical question in the field -"What TFs work together (or cooperate) to regulate a particular gene of interest?". To test this hypothesis, we performed hierarchical cluster analysis on the prototypes for the 86 TFs and obtained multiple clusters containing 2 or more TFs (Figure in Appendix). Next, we searched TFs from each cluster in a reference database of human transcriptional regulatory interactions called TRRUST BID10. For each TF, say "TF-A", in its database, TRRUST displays a list of TFs that regulate the same target genes as TF-A. It also shows the measures of the significance of their cooperativity as p-values, using protein-protein interactions derived from major databases. Having no expert knowledge in biology, we found some interesting that are summarized in Table 5. We found pairs of TFs (in Clusters 1-6), whose prototypes had been clustered together, to have significant (p-value < 0.0001) cooperativity curated in TRRUST database. These observations indicate that each prototype is learning sufficient combinatorial information that allows the clustering algorithm to group the TFs that cooperate during gene regulation. Therefore, the learned prototypes are not only guiding the model to better predictions but are capturing an embedding that can provide insights into the TF-TF cooperativity in the actual biological scenario. Sequence analysis plays an important role in the field of bioinformatics. A prominent task is to understand how Transcription Factor proteins (TFs) bind to DNA. Researchers in biology hypothesize that each TF searches for certain sequence patterns on genome to bind to, known as "motifs". Accordingly we propose a novel prototype matching network (PMN) for learning motif-like prototype features. On a support set of learned prototypes, we use a combinationLSTM for modeling label dependencies. The combinationLSTM tries to learn and mimic the underlying biological effects among labels (e.g. co-binding). Our on a dataset of 2.1 million genomic strings show that the prototype matching model outperforms baseline variations not having prototype-matching or not using the combinationLSTM. This empirically validates our design choices to favor those mimicking the underlying biological mechanisms. Our PMN model is a general classification approach and not tied to the TFBS applications. We show this generality by applying it on the MNIST dataset and obtain convincing in Appendix Section 7.1. MNIST differs from TFBS prediction in its smaller training size as well as in its multi-class properties. We plan a few future directions to extend the PMN. First, TFBSs vary across different cell types, cell stages and genomes. Extending PMN for considering the knowledge transfer is especially important for unannotated cellular contexts (e.g., cell types of rare diseases or rare organisms). Another direction is to add more domain-specific features. While we show that using prototype matching and the combinationLSTM can help modelling TF combinations, there are additional raw feature extraction methods that we could add in order to obtain better representations of genomics sequences. These include reverse complement sequence inputs or convolutional parameter sharing BID32, or an RNN to model lower level spatial interactions BID28 among motifs. 7.1 MNIST To validate the learned prototype matching on another task, we compare our PMN model against a standard CNN model on the MNIST dataset. We use a 3-layer CNN with {32,32,32} kernels of sizes {5,5,5} at the 3 layers, respectively. For the MNIST experiments, the PMN models do not show a drastic improvement over the baseline CNN. The are shown in TAB7. However, we do note that based on the per-epoch plots in Figure 4, the PMN models do converge faster than the baseline CNN. In addition, we show in figure 5 that the PMN embeddings are better separated than the CNN embeddings. This is likely due to the fact that the PMN uses a similarity metric, and the fact that it can update its embedding based on which number prototypes it matches to. In other words, if an image looks similar to several numbers (e.g. "5" and "6"), the PMN can update its output based on which one it matches more to. Note that although we train using a prototype loss for each class, we do not constrain the matching to only match to one prototype.

Represent this text to find a much much longer article about it with say hundreds-thousands of words.

We combine the matching network framework for few shot learning into a large scale multi-label model for genomic sequence classification.

Represent this text to find a much much longer article about it with say hundreds-thousands of words!


Question: Represent this text!

Question: Previous work shows that adversarially robust generalization requires larger sample complexity, and the same dataset, e.g., CIFAR-10, which enables good standard accuracy may not suffice to train robust models. Since collecting new training data could be costly, we focus on better utilizing the given data by inducing the regions with high sample density in the feature space, which could lead to locally sufficient samples for robust learning. We first formally show that the softmax cross-entropy (SCE) loss and its variants convey inappropriate supervisory signals, which encourage the learned feature points to spread over the space sparsely in training. This inspires us to propose the Max-Mahalanobis center (MMC) loss to explicitly induce dense feature regions in order to benefit robustness. Namely, the MMC loss encourages the model to concentrate on learning ordered and compact representations, which gather around the preset optimal centers for different classes. We empirically demonstrate that applying the MMC loss can significantly improve robustness even under strong adaptive attacks, while keeping state-of-the-art accuracy on clean inputs with little extra computation compared to the SCE loss. The deep neural networks (DNNs) trained by the softmax cross-entropy (SCE) loss have achieved state-of-the-art performance on various tasks . However, in terms of robustness, the SCE loss is not sufficient to lead to satisfactory performance of the trained models. It has been widely recognized that the DNNs trained by the SCE loss are vulnerable to adversarial attacks (a; ; ;), where human imperceptible perturbations can be crafted to fool a high-performance network. To improve adversarial robustness of classifiers, various kinds of defenses have been proposed, but many of them are quickly shown to be ineffective to the adaptive attacks, which are adapted to the specific details of the proposed defenses. Besides, the methods on verification and training provably robust networks have been proposed (a; b; ; . While these methods are exciting, the verification process is often slow and not scalable. Among the previously proposed defenses, the adversarial training (AT) methods can achieve state-of-the-art robustness under different adversarial settings b). These methods either directly impose the AT mechanism on the SCE loss or add additional regularizers. Although the AT methods are relatively strong, they could sacrifice accuracy on clean inputs and are computationally expensive . Due to the computational obstruction, many recent efforts have been devoted to proposing faster verification methods ) and accelerating AT procedures (; a). However, the problem still remains. show that the sample complexity of robust learning can be significantly larger than that of standard learning. Given the difficulty of training robust classifiers in practice, they further postulate that the difficulty could stem from the insufficiency of training samples in the commonly used datasets, e.g., CIFAR-10 . Recent work intends to solve this problem by utilizing extra unlabeled data , while we focus on the complementary strategy to exploit the labeled data in hand more efficiently. Note that although the samples in the input space are unchangeable, we could instead manipulate the local sample distribution, i.e., sample density in the feature space via appropriate training objectives. Intuitively, by inducing high-density feature regions, there would be locally sufficient samples to train robust classifiers and return reliable predictions.! ""# ∈ %&, %& + ∆% (low sample density)! ""# ∈ % *, %* + ∆% (high sample density) +, *!.#/ ∈ %&, %& + ∆% (medium sample density)!.#/ ∈ %*, %* + ∆% (medium sample density) Learned features of training data with label 0 Prefixed feature center of label 0 in ℒ223 Contours of the objective loss (45 > 47, ∆4 is a small value) Moving directions of learned features during training Similar to our attempt to induce high-density regions in the feature space, previous work has been proposed to improve intra-class compactness. Contrastive loss and triplet loss are two classical objectives for this purpose, but the training iterations will dramatically grow to construct image pairs or triplets, which in slow convergence and instability. The center loss avoids the pair-wise or triplet-wise computation by minimizing the squared distance between the features and the corresponding class centers. However, since the class centers are updated w.r.t. the learned features during training, the center loss has to be jointly used with the SCE loss to seek for a trade-off between inter-class dispersion and intra-class compactness. Therefore, the center loss cannot concentrate on inducing strong intra-class compactness to construct high-density regions and consequently could not lead to reliable robustness, as shown in our experiments. In this paper, we first formally analyze the sample density distribution induced by the SCE loss and its other variants ) in Sec. 3.2, which demonstrates that these previously proposed objectives convey unexpected supervisory signals on the training points, which make the learned features tend to spread over the space sparsely. This undesirable behavior mainly roots from applying the softmax function in training, which makes the loss function only depend on the relative relation among logits and cannot directly supervise on the learned representations. We further propose a novel training objective which can explicitly induce high-density regions in the feature space and learn more structured representations. To achieve this, we propose the MaxMahalanobis center (MMC) loss (detailed in Eq.) as the substitute of the SCE loss. Specifically, in the MMC loss, we first preset untrainable class centers with optimal inter-class dispersion in the feature space according to, then we encourage the features to gather around the centers by minimizing the squared distance similar with the center loss. The MMC loss can explicitly control the inter-class dispersion by a single hyperparameter, and further concentrate on improving intra-class compactness in the training procedure to induce high-density regions, as intuitively shown in Fig. 1. Behind the simple formula, the MMC loss elegantly combines the favorable merits of the previous methods, which leads to a considerable improvement on the adversarial robustness. In experiments, we follow the suggestion by that we test under different threat models and attacks, including the adaptive attacks on MNIST, CIFAR-10, and CIFAR-100 . The demonstrate that our method can lead to reliable robustness of the trained models with little extra computation, while maintaining high clean accuracy with faster convergence rates compared to the SCE loss and its variants. When combined with the existing defense mechanisms, e.g., the AT methods, the trained models can be further enhanced under the attacks different from the one used to craft adversarial examples for training. This section first provides the notations, then introduces the adversarial attacks and threat models. In this paper, we use the lowercases to denote variables and the uppercases to denote mappings. Let L be the number of classes, we define the softmax function, where [L]:= {1, · · ·, L} and h is termed as logit. A deep neural network (DNN) learns a non-linear mapping from the input x ∈ R p to the feature z = Z(x) ∈ R d. One common training objective for DNNs is the softmax cross-entropy (SCE) loss: for a single input-label pair (x, y), where 1 y is the one-hot encoding of y and the logarithm is defined as element-wise. Here W and b are the weight matrix and bias vector of the SCE loss, respectively. Previous work has shown that adversarial examples can be easily crafted to fool DNNs (; ;). A large amount of attacking methods on generating adversarial examples have been introduced in recent years (a; ; ; ; ; ;). Given the space limit, we try to perform a comprehensive evaluation by considering five different threat models and choosing representative attacks for each threat model following: White-box l ∞ distortion attack: We apply the projected gradient descent (PGD) method, which is efficient and widely studied in previous work . White-box l 2 distortion attack: We apply the C&W (a) method, which has a binary search mechanism on its parameters to find the minimal l 2 distortion for a successful attack. Black-box transfer-based attack: We use the momentum iterative method (MIM) that is effective on boosting adversarial transferability. Black-box gradient-free attack: We choose SPSA since it has broken many previously proposed defenses. It can still perform well even when the loss is difficult to optimize. General-purpose attack: We also evaluate the general robustness of models when adding Gaussian noise or random rotation on the input images. Furthermore, to exclude the false robustness caused by, e.g., gradient mask, we modify the above attacking methods to be adaptive attacks (b;) when evaluating on the robustness of our method. The adaptive attacks are much more powerful than the non-adaptive ones, as detailed in Sec. 4.2. Various theoretical explanations have been developed for adversarial examples; ). In particular, show that training robust classifiers requires significantly larger sample complexity compared to that of training standard ones, and they further postulate that the difficulty of training robust classifiers stems from, at least partly, the insufficiency of training samples in the common datasets. Recent efforts propose alternatives to benefit training with extra unlabeled data , while we explore the complementary way to better use the labeled training samples for robust learning. Although a given sample is fixed in the input space, we can instead manipulate the local sample distribution, i.e., sample density in the feature space, via designing appropriate training objectives. Intuitively, by inducing high-density regions in the feature space, it can be expected to have locally sufficient samples to train robust models that are able to return reliable predictions. In this section, we first formally define the notion of sample density in the feature space. Then we provide theoretical analyses of the sample density induced by the SCE loss and its variants. Finally, we propose our new Max-Mahalanobis center (MMC) loss and demonstrate its superiority compared to previous losses. Given a training dataset D with N input-label pairs, and the feature mapping Z trained by the objective L(Z(x), y) on this dataset, we define the sample density nearby the feature point z = Z(x) following the similar definition in physics as Here Vol(·) denotes the volume of the input set, ∆B is a small neighbourhood containing the feature point z, and ∆N = |Z(D) ∩ ∆B| is the number of training points in ∆B, where Z(D) is the set of all mapped features for the inputs in D. Note that the mapped feature z is still of the label y. In the training procedure, the feature distribution is directly induced by the training loss L, where minimizing the loss value is the only supervisory signal for the feature points to move . This means that the sample density varies mainly along the orthogonal direction w.r.t. the loss contours, while the density along a certain contour could be approximately considered as the same. For example, in the right panel of Fig. 1, the sample density induced by our MMC loss (detailed in Sec. 3.3) changes mainly along the radial direction, i.e., the directions of red arrows, where the loss contours are dashed concentric circles. Therefore, supposing L(z, y) = C, we choose where ∆C > 0 is a small value. Then Vol(∆B) is the volume between the loss contours of C and C + ∆C for label y in the feature space. Generalized SCE loss. To better understand how the SCE loss and its variants ) affect the sample density of features, we first generalize the definition in Eq. as: where the logit h = H(z) ∈ R L is a general transformation of the feature z, for example, h = W z +b in the SCE loss. We call this family of losses as the generalized SCE (g-SCE) loss. propose the large-margin Gaussian Mixture (L-GM) loss, where under the assumption that the learned features z distribute as a mixture of Gaussian. Here µ i and Σ i are extra trainable means and covariance matrices respectively, m is the margin, and δ i,y is the indicator function. propose the Max-Mahalanobis linear discriminant analysis (MMLDA) loss, where under the similar mixture of Gaussian assumption, but the main difference is that µ * i are not trainable, but calculated before training with optimal inter-class dispersion. These two losses both fall into the family of the g-SCE loss with quadratic logits: where B i are the bias variables. Besides, note that for the SCE loss, there is According to Eq., the SCE loss can also be regraded as a special case of the g-SCE loss with quadratic logits, where 2 and Σ i = I are identity matrices. Therefore, later when we refer to the g-SCE loss, we assume that the logits are quadratic as in Eq. by default. The contours of the g-SCE loss. To provide a formal representation of the sample density induced by the g-SCE loss, we first derive the formula of the contours, i.e., the closed-form solution of L g-SCE (Z(x), y) = C in the space of z, where C ∈ (0, +∞) is a given constant. Let C e = exp(C) ∈ (1, +∞), from Eq., we can represent the contours as the solution of The function in Eq. does not provide an intuitive closed-form solution for the contours, since the existence of the term log l =y exp(h l). However, note that this term belongs to the family of Log-Sum-Exp (LSE) function, which is a smooth approximation to the maximum function . Therefore, we can locally approximate the function in Eq. with whereỹ = arg max l =y h l. In the following text, we apply colored characters with tilde likeỹ to better visually distinguish them. According to Eq., we can define L y,ỹ (z) = log[exp(hỹ − h y) + 1] as the local approximation of the g-SCE loss nearby the feature point z, and substitute the neighborhood For simplicity, we assume scaled identity covariance matrix in Eq., i.e., Σ i = σ i I, where σ i > 0 are scalars. Through simple derivations (detailed in Appendix A.1), we show that if σ y = σỹ, the solution of L y,ỹ (z) = C is a (d − 1)-dimensional hypersphere with the center M y,ỹ = (σ y −σỹ) −1 (σ y µ y −σỹµỹ); otherwise if σ y = σỹ, the hypersphere-shape contour will degenerate to a hyperplane. Figure 2: Intuitive illustration on the inherent limitations of the g-SCE loss. Reasonably learned features for a classification task should distribute in clusters, so it is counter-intuitive that the feature points tend to move to infinity to pursue lower loss values when applying the g-SCE loss. In contrast, MMC induces models to learn more structured and orderly features. The induced sample density. Since the approximation in Eq. depends on the specific y andỹ, we define the training subset includes the data with the true label of class k, while the highest prediction returned by the classifier is classk among other classes. Then we can derive the approximated sample density in the feature space induced by the g-SCE loss, as stated in the following theorem:, and σ k = σk, then the sample density nearby the feature point z based on the approximation in Eq. is, and where for the input-label pair in Limitations of the g-SCE loss. Based on Theorem 1 and the approximation in Eq., let * will act as a tight lower bound for C, i.e., the solution set of C < C * is empty. This will make the training procedure tend to avoid this case since the loss C cannot be further minimized to zero, which will introduce unnecessary biases on the returned predictions. On the other hand, if σ k < σk, C could be minimized to zero. However, when C → 0, the sample density will also tend to zero since there is B k,k + log(Ce−1) σ k −σk → ∞, which means the feature point will be encouraged to go further and further from the hypersphere center M k,k only to make the loss value C be lower, as intuitively illustrated in Fig. 2(a). This counter-intuitive behavior mainly roots from applying the softmax function in training. Namely, the softmax normalization makes the loss value only depend on the relative relation among logits. This causes indirect and unexpected supervisory signals on the learned features, such that the points with low loss values tend to spread over the space sparsely. Fortunately, in practice, the feature point will not really move to infinity, since the existence of batch normalization layers , and the squared radius from the center M k,k increases as O(| log C|) when minimizing the loss C. These theoretical are consistent with the empirical observations on the two-dimensional features in previous work (cf. Fig. 1 in). Another limitation of the g-SCE loss is that the sample density is proportional to N k,k, which is on average N/L 2. For example, there are around 1.3 million training data in ImageNet , but with a large number of classes L = 1, 000, there are averagely less than two samples in each D k,k. These limitations inspire us to design the new training loss as in Sec 3.3. Remark 1. If σ k = σk (e.g., as in the SCE loss), the features with loss values in [C, C + ∆C] will be encouraged to locate between two hyperplane contours without further supervision, and consequently there will not be explicit supervision on the sample density as shown in the left panel of Fig. 1. Remark 2. Except for the g-SCE loss, propose the center loss in order to improve the intra-class compactness of learned features, formulated as L Center (Z(x), y) = 1 2 z − µ y 2 2. Here the center µ y is updated based on a mini-batch of learned features with label y in each training iteration. The center loss has to be jointly used with the SCE loss as L SCE + λL Center, since simply supervise the DNNs with the center loss term will cause the learned features and centers to degrade to zeros . This makes it difficult to derive a closed-form formula for the induced sample density. Besides, the center loss method cannot concentrate on improving intra-class compactness, since it has to seek for a trade-off between inter-class dispersion and intra-class compactness. Inspired by the above analyses, we propose the Max-Mahalanobis center (MMC) loss to explicitly learn more structured representations and induce high-density regions in the feature space. The MMC loss is defined in a regression form without the softmax function as Here L] are the centers of the Max-Mahalanobis distribution (MMD). The MMD is a mixture of Gaussian distribution with identity covariance matrix and preset centers µ *, where µ * l 2 = C MM for any l ∈ [L], and C MM is a hyperparameter. These MMD centers are invariable during training, which are crafted according to the criterion: µ * = arg min µ max i =j µ i, µ j. Intuitively, this criterion is to maximize the minimal angle between any two centers, which can provide optimal inter-class dispersion as shown in. In Appendix B.1, we provide the generation algorithm for µ * in MMC. We derive the sample density induced by the MMC loss in the feature space, as stated in Theorem 2. Similar to the previously introduced notations, here we define the subset D k = {(x, y) ∈ D|y = k} and and L MMC (z, y) = C, the sample density nearby the feature point z is where for the input-label pair in D k, there is L MMC ∼ p k (c). According to Theorem 2, there are several attractive merits of the MMC loss, as described below. Inducing higher sample density. Compared to Theorem 1, the sample density induced by MMC is proportional to N k rather than N k,k, where N k is on average N/L. It facilitates producing higher sample density. Furthermore, when the loss value C is minimized to zero, the sample density will exponentially increase according to Eq., as illustrated in Fig. 2(b). The right panel of Fig. 1 also provides an intuitive insight on this property of the MMC loss: since the loss value C is proportional to the squared distance from the preset center µ * y, the feature points with lower loss values are certain to locate in a smaller volume around the center. Consequently, the feature points of the same class are encouraged to gather around the corresponding center, such that for each sample, there will be locally enough data in its neighborhood for robust learning. The MMC loss value also becomes a reliable metric of the uncertainty on returned predictions. Better exploiting model capacity. Behind the simple formula, the MMC loss can explicitly monitor inter-class dispersion by the hyperparameter C MM, while enabling the network to concentrate on minimizing intra-class compactness in training. Instead of repeatedly searching for an internal tradeoff in training as the center loss, the monotonicity of the supervisory signals induced by MMC can better exploit model capacity and also lead to faster convergence, as empirically shown in Fig. 3(a). Avoiding the degradation problem. The MMC loss can naturally avoid the degradation problem encountered in when the center loss is not jointly used with the SCE loss, since the preset centers µ * for MMC are untrainable. In the test phase, the network trained by MMC can still return a normalized prediction with the softmax function. More details about the empirical superiorities of the MMC loss over other previous losses are demonstrated in Sec. 4. Remark 3. In Appendix B.2, we discuss on why the squared-error form in Eq. is preferred compared to, e.g., the absolute form or the Huber form in the adversarial setting. We further introduce flexible variants of the MMC loss in Appendix B.3, which can better adapt to various tasks.. Note that there is Σ i = 1 2 I in Eq. for the MMLDA loss, similar with the SCE loss. Thus the MMLDA method cannot explicitly supervise on the sample density and induce high-density regions in the feature space, as analyzed in Sec. 3.2. Compared to the MMLDA method, the MMC loss introduces extra supervision on intra-class compactness, which facilitates better robustness. In this section, we empirically demonstrate several attractive merits of applying the MMC loss. We experiment on the widely used MNIST, CIFAR-10, and CIFAR-100 datasets . The main baselines for MMC is SCE , Center loss , MMLDA, and L-GM . The network architecture applied is ResNet-32 with five core layer blocks . Here we use MMC-10 to indicate the MMC loss with C MM = 10, where C MM is assigned based on the cross-validation in. The hyperparameters for the center loss, L-GM loss and the MMLDA method all follow the settings in the original papers; ). The pixel values are scaled to the interval. For each training loss with or without the AT mechanism, we apply the momentum SGD optimizer with the initial learning rate of 0.01, and train for 40 epochs on MNIST, 200 epochs on CIFAR-10 and CIFAR-100. The learning rate decays with a factor of 0.1 at 100 and 150 epochs, respectively. When applying the AT mechanism, the adversarial examples for training are crafted by 10-steps targeted or untargeted PGD with = 8/255. In Fig. 3(a), we provide the curves of the test error rate w.r.t. the training time. Note that the MMC loss induces faster convergence rate and requires little extra computation compared to the SCE loss and its variants, while keeping comparable performance on the clean images. In comparison, implementing the AT mechanism is computationally expensive in training and will sacrifice the accuracy on the clean images. As stated in, only applying the existing attacks with default hyperparameters is not sufficient to claim reliable robustness. Thus, we apply the adaptive versions of existing attacks when evading the networks trained by the MMC loss (detailed in Appendix B.4). For instance, the non-adaptive objectives for PGD are variants of the SCE loss, while the adaptive objectives are −L MMC (z, y) and L MMC (z, y t) in the untargeted and targeted modes for PGD, respectively. Here y t is the target label. To verify that the adaptive attacks are more effective than the non-adaptive ones, we modify the network architecture with a two-dimensional feature layer and visualize the PGD attacking procedure in Fig. 3(b). The two panels separately correspond to two randomly selected clean inputs indicated by black stars. The ten colored clusters in each panel consist of the features of all the 10,000 test samples in MNIST, where each color corresponds to one class. We can see that the adaptive attacks are indeed much more efficient than the non-adaptive one. We first investigate the white-box l ∞ distortion setting using the PGD attack, and report the in Table 1. According to, we evaluate under different combinations of the attacking parameters: the perturbation, iteration steps, and the attack mode, i.e., targeted or untargeted. Following the setting in, we choose the perturbation = 8/255 and 16/255, with the step size be 2/255. We have also run PGD-100 and PGD-200 attacks, and find that the accuracy converges compared to PGD-50. In each PGD experiment, we ran several times with different random restarts to guarantee the reliability of the reported . Ablation study. To investigate the effect on robustness induced by high sample density in MMC, we substitute uniformly sampled center set ), i.e., µ r = {µ r l} l∈ [L] for the MM center set µ *, and name the ed method as "MMC-10 (rand)" as shown in Table 1. There is also µ r l 2 = C MM, but µ r is no longer the solution of the min-max problem in Sec. 3.3. From the in Table 1, we can see that higher sample density alone in "MMC-10 (rand)" can already lead to much better robustness than other baseline methods even under the adaptive attacks, while using the optimal center set µ * as in "MMC-10" can further improve performance. When combining with the AT mechanism, the trained models have better performance under the attacks different from the one used to craft adversarial examples for training, e.g, PGD un 50 with = 16/255. Then we investigate the white-box l 2 distortion setting. We apply the C&W attack, where it has a binary search mechanism to find the minimal distortion to successfully mislead the classifier under the untargeted mode, or lead the classifier to predict the target label in the targeted mode. Following the suggestion in Carlini & Wagner (2017a), we set the binary search steps to be 9 with the initial constant c = 0.01. The iteration steps for each value of c are set to be 1,000 with the learning rate of 0.005. In the Part I of Table 2, we report the minimal distortions found by the C&W attack. As expected, it requires much larger distortions to successfully evade the networks trained by MMC. As suggested in, providing evidence of being robust against the black-box attacks is critical to claim reliable robustness. We first perform the transfer-based attacks using PGD and MIM. Since the targeted attacks usually have poor transferability, we only focus on the untargeted mode in this case, and the are shown in Fig. 4. We further perform the gradient-free attacks using the SPSA method and report the in the Part II of Table 2. To perform numerical approximations on gradients in SPSA, we set the batch size to be 128, the learning rate is 0.01, and the step size of the finite difference is δ = 0.01, as suggested by. We also evaluate under stronger SPSA attacks with batch size to be 4096 and 8192 in Table 3, where the = 8/255. With larger batch sizes, we can find that the accuracy under the black-box SPSA attacks converges to it under the white-box PGD attacks. These indicate that training with the MMC loss also leads to robustness under the black-box attacks, which verifies that our method can induce reliable robustness, rather than the false one caused by, e.g., gradient mask. To show that our method is generally robust, we further test under the general-purpose attacks. We apply the Gaussian noise ) and rotation transformation, which are not included in the data augmentation for training. The are given in the Part III of Table 2. Note that the AT methods are less robust to simple transformations like rotation, as also observed in previous work. In comparison, the models trained by the MMC loss are still robust to these easy-to-apply attacks. In Table 4 and Table 5, we provide the on CIFAR-100 under the white-box PGD and C&W attacks, and the black-box gradient-free SPSA attack. The hyperparameter setting for each attack is the same as it on CIFAR-10. Compared to previous defense strategies which also evaluate on CIFAR-100 , MMC can improve robustness more significantly, while keeping better performance on the clean inputs. Compared to the on CIFAR-10, the averaged distortion of C&W on CIFAR-100 is larger for a successful targeted attack and is much smaller for a successful untargeted attack. This is because when only the number of classes increases, e.g., from 10 to 100, it is easier to achieve a coarse untargeted attack, but harder to make a subtle targeted attack. Note that in Table 5, we also train on the ResNet-110 model with eighteen core block layers except for the ResNet-32 model. The show that MMC can further benefit from deep network architectures and better exploit model capacity to improve robustness. Similar properties are also observed in previous work when applying the AT methods. In contrast, as shown in Table 5, the models trained by SCE are comparably sensitive to adversarial perturbations for different architectures, which demonstrates that SCE cannot take full advantage of the model capacity to improve robustness. This verifies that MMC provides effective robustness promoting mechanism like the AT methods, with much less computational cost. In this paper, we formally demonstrate that applying the softmax function in training could potentially lead to unexpected supervisory signals. To solve this problem, we propose the MMC loss to learn more structured representations and induce high-density regions in the feature space. In our experiments, we empirically demonstrate several favorable merits of our method: (i) Lead to reliable robustness even under strong adaptive attacks in different threat models; (ii) Keep high performance on clean inputs comparable TO SCE; (iii) Introduce little extra computation compared to the SCE loss; (iv) Compatible with the existing defense mechanisms, e.g., the AT methods. Our analyses in this paper also provide useful insights for future work on designing new objectives beyond the SCE framework. In this section, we provide the proof of the theorems proposed in the paper. According to the definition of sample density we separately calculate ∆N and Vol(∆B). Since Now we calculate Vol(∆B) by approximating it with Vol(∆B y,ỹ). We first derive the solution of L y,ỹ = C. For simplicity, we assume scaled identity covariance matrix, i.e., Σ i = σ i I, where Note that each value of c corresponds to a specific contour, where M i,j and B i,j can be regraded as constant w.r.t. c. When B i,j < (σ i − σ j) −1 c, the solution set becomes empty. Specially, if σ i = σ j = σ, the hypersphere-shape contour will degenerate to a hyperplane: For example, for the SCE loss, the solution of the contour is z (W i − W j) = b j − b i + c. For more general Σ i, the are similar, e.g., the solution in Eq. will become a hyperellipse. Now it easy to show that the solution of L y,ỹ = C when y = k,ỹ =k is the hypersphere: According to the formula of the hypersphere surface area , the volume of ∆B y,ỹ is Vol(∆B y,ỹ) = 2π where Γ(·) is the gamma function. Finally we can approximate the sample density as A.2 PROOF OF THEOREM 2 Similar to the proof of Theorem 1, there is Unlike for the g-SCE, we can exactly calculate Vol(∆B) for the MMC loss. Note that the solution of L MMC = C is the hypersphere: According to the formula of the hypersphere surface area , we have where Γ(·) is the gamma function. Finally we can obtain the sample density as B TECHNICAL DETAILS In this section, we provide more technical details we applied in our paper. Most of our experiments are conducted on the NVIDIA DGX-1 server with eight Tesla P100 GPUs. We give the generation algorithm for crafting the Max-Mahalanobis Centers in Algorithm 1, proposed by. Note that there are two minor differences from the originally proposed algorithm. First is that in they use C = µ i 2 2, while we use C MM = µ i 2. Second is that we denote the feature z ∈ R d, while they denote z ∈ R p. The Max-Mahalanobis centers generated in the low-dimensional cases are quite intuitive and comprehensible as shown in Fig. 5. For examples, when L = 2, the Max-Mahalanobis centers are the two vertexes of a line segment; when L = 3, they are the three vertexes of an equilateral triangle; when L = 4, they are the four vertexes of a regular tetrahedron. according to the tree structure. Specifically, we first assign a virtual center (i.e., the origin) to the root node. For any child node n c in the tree, we denote its parent node as n p, and the number of its brother nodes as L c. We locally generate a set of MM centers as, where s is the depth of the child node n c, C s is a constant with smaller values for larger s. Then we assign the virtual center to each child node of n p from µ np + µ (s,Lc), i.e., a shifted set of crafted MM centers, where µ np is the virtual center assigned to n p. If the child node n c is a leaf node, i.e., it correspond to a class label l, then there is µ Ada = L MMC (z, y t)−L MMC (z, y), where y t is the targeted label,ỹ is generally the highest predicted label except for y as defined in Sec. 3.2. These objectives refer to previous work by Carlini & Wagner (2017a; b). Specifically, the adaptive objectives L Ada are used in the C&W attacks. In Fig. 6, we demonstrate the attacking mechanisms induced by different adaptive adversarial objectives. Note that we only focus on the gradients and ignore the specific method which implements the attack. Different adaptive objectives are preferred under different adversarial goals. For examples, when decreasing the confidence of the true label is the goal, L un,1 Ada is the optimal choice; in order to mislead the classifier to predict an untrue label or the target label, L There are many previous work in the face recognition area that focus on angular margin-based softmax (AMS) losses (; ; ;). They mainly exploit three basic operations: weight normalization (WN), feature normalization (FN), and angular margin (AN). It has been empirically shown that WN can benefit the cases with unbalanced data ; FN can encourage the models to focus more on hard examples; AN can induce larger inter-class margins and lead to better generalization in different facial tasks . However, there are two critical differences between our MMC loss and these AMS losses: Difference one: The inter-class margin • The AMS losses induce the inter-class margins mainly by encouraging the intra-class compactness, while the weights are not explicitly forced to have large margins . • The MMC loss simultaneously fixes the class centers to be optimally dispersed and encourages the intra-class distribution to be compact. Note that both of the two mechanisms can induce inter-class margins, which can finally lead to larger inter-class margins compared to the AMS losses. Difference two: The normalization • The AMS losses use both WN and FN to exploit the angular metric, which makes the normalized features distribute on hyperspheres. The good properties of the AMS losses are at the cost of abandoning the radial degree of freedom, which may reduce the capability of models. • In the MMC loss, there is only WN on the class centers, i.e., µ * y = C MM, and we leave the degree of freedom in the radial direction for the features to keep model capacity. However, note that the MMC loss z − µ * y 2 2 ≥ (z 2 − C MM) 2 is a natural penalty term on the feature norm, which encourage z 2 to not be far from C MM. This prevents models from increasing feature norms for easy examples and ignoring hard examples, just similar to the effect caused by FN but more flexible.

Represent the TLDR for finding the corresponding scientific article

Applying the softmax function in training leads to indirect and unexpected supervision on features. We propose a new training objective to explicitly induce dense feature regions for locally sufficient samples to benefit adversarial robustness.

Represent this text to find a much much longer article about it with say hundreds-thousands of words

This paper identifies classes of problems for which adversarial examples are inescapable, and derives fundamental bounds on the susceptibility of any classifier to adversarial examples.


Question: Represent the article for finding a single-sentence TLDR

Question: We present an analytic framework to visualize and understand GANs at the unit-, object-, and scene-level. We first identify a group of interpretable units that are closely related to object concepts with a segmentation-based network dissection method. Then, we examine the causal effect of interpretable units by measuring the ability of interventions to control objects in the output. Finally, we examine the contextual relationship between these units and their surrounding by inserting the discovered object concepts into new images. We show several practical applications enabled by our framework, from comparing internal representations across different layers and models, to improving GANs by locating and removing artifact-causing units, to interactively manipulating objects in the scene. We first identify a group of interpretable units that are related to semantic classes (Figure 1a, b). These units' featuremaps closely match the semantic segmentation of a particular object class (e.g., trees). Then, we intervene in units in the network to cause a type of object to disappear or appear (Figure 1c, d). Finally, we study contextual relationships by observing where we can insert the object concepts in new images and how this intervention interacts with other objects in the image (Figure 4). This framework allows us to compare representations across different layers, GAN variants, and datasets; to debug and improve GANs by locating artifact-causing units (Figure 1e We analyze the internal GAN representations by decomposing the featuremap r at a layer into positions P ⊂ P and unit channels u ∈ U. To identify a unit u with semantic behavior, we upsample and threshold the unit, and measure how well it matches an object class c in the image x as identified by a supervised semantic segmentation network s c (x) BID5 IoU DISPLAYFORM0, where t u,c = arg max DISPLAYFORM1 This approach is inspired by the observation that many units in classification networks locate emergent object classes when upsampled and thresholded BID0. Here, the threshold t u,c is chosen to maximize the information quality ratio, that is, the portion of the joint entropy H which is mutual information I BID4.To identify a sets of units U ⊂ U that cause semantic effects, we intervene in the network G(z) = f (h(z)) = f (r) by decomposing the featuremap r into two parts (r U,P, r U,P), and forcing the components r U,P on and off. Given an original image x = G(z) ≡ f (r) ≡ f (r U,P, r U,P), we can intervene in the network and generate an image with units U ablated at pixels P: DISPLAYFORM2 Or an image with units U activated to a high level c at pixels P: DISPLAYFORM3 We measure the average causal effect (ACE) BID2 of units U on class c as: DISPLAYFORM4 2 AND DISCUSSION Analysis of the semantics and causal behavior of the internal units of a GAN reveals several new findings. Units matching diverse objeccts emerge on more diverse models. Internal units for more object classes emerge as the architecture becomes more diverse. FIG2 compares three models BID3 ) that introduce two innovations on baseline Progressive GANs. The number of types of objects, parts, and materials matching units increases by more than 40% as minibatch-stdev is introduced; and pixelwise normalization increase units that match semantic classes by 19%. Interpretable units emerge in the middle layers, not at the initial layers. In classifier networks, units matching high-level concepts appear in layers furthest from the pixels BID6. In contrast, in a GAN, it is mid-level layers 4 to 7 that have the largest number of units that match semantic objects and object parts. A selection of layers is shown in Figure 3. Our framework can also analyze the causes of failures and repair some GAN artifacts. Figure 1e shows several annotated units that are responsible for typical artifacts consistently appearing across different images. We can fix these errors by ablating 20 artifact-causing units. Figure 1g shows that artifacts are successfully removed and the artifact-free pixels stay the same, improving the generated . TAB2 summarizes quality improvements: we compute the Fréchet Inception Distance BID1 between the generated images and real images using 50 000 real images and 10 000 generated images with high activations on these units. We also collect 20 000 annotations of realism on Amazon MTurk, with 1 000 images per method. An identical "door" intervention at layer4 of each pixel in the featuremap has a different effect on final convolutional feature layer, depending on the location of the intervention. In the heatmap, brighter colors indicate a stronger effect on the layer14 feature. A request for a door has a larger effect in locations of a building, and a smaller effect near trees and sky. At right, the magnitude of feature effects at every layer is shown, measured by mean normalized feature changes. In the line plot, feature changes for interventions that in human-visible changes are separated from interventions that do not in noticeable changes in the output. Characterizing contextual relationships using insertion We can also learn about the operation of a GAN by forcing units on and inserting these features into specific locations in scenes. Figure 4 shows the effect of inserting 20 layer4 causal door units in church scenes. We insert units by setting their activation to the mean activation level at locations at which doors are present. Although this intervention is the same in each case, the effects vary widely depending on the context. The doors added to the five buildings in Figure 4 appear with a diversity of visual attributes, each with an orientation, size, material, and style that matches the building. We also observe that doors cannot be added in most locations. The locations where a door can be added are highlighted by a yellow box. The bar chart in Figure 4 shows average causal effects of insertions of door units, conditioned on the object class at the location of the intervention. Doors can be created in buildings, but not in trees or in the sky. A particularly good location for inserting a door is one where there is already a window. Tracing the causal effects of an intervention To investigate the mechanism for suppressing the visible effects of some interventions, we perform an insertion of 20 door-causal units on a sample of locations and measure the changes in later layer featuremaps caused by interventions at layer 4. To quantify effects on downstream features, and the effect on each each feature channel is normalized by its mean L1 magnitude, and we examine the mean change in these normalized featuremaps at each layer. In FIG4, these effects that propagate to layer14 are visualized as a heatmap: brighter colors indicate a stronger effect on the final feature layer when the door intervention is in the neighborhood of a building instead of trees or sky. Furthermore, we graph the average effect on every layer at right in FIG4, separating interventions that have a visible effect from those that do not. A small identical intervention at layer4 is amplified to larger changes up to a peak at layer12.Interventions provide insight on how a GAN enforces relationships between objects. We find that even if we try to add a door in layer4, that choice can be vetoed by later layers if the object is not appropriate for the context.

represent the short summary for finding the corresponding scientific article (long)
Examples:

"Rectification in deep neural networks naturally leads them to favor an invariant representation." == "A central goal in the study of the primate visual cortex and hierarchical models for object recognition is understanding how and why single units trade off invariance versus sensitivity to image transformations. For example, in both deep networks and visual cortex there is substantial variation from layer-to-layer and unit-to-unit in the degree of translation invariance. Here, we provide theoretical insight into this variation and its consequences for encoding in a deep network. Our critical insight comes from the fact that rectification simultaneously decreases response variance and correlation across responses to transformed stimuli, naturally inducing a positive relationship between invariance and dynamic range. Invariant input units then tend to drive the network more than those sensitive to small image transformations. We discuss consequences of this relationship for AI: deep nets naturally weight invariant units over sensitive units, and this can be strengthened with training, perhaps contributing to generalization performance. Our predict a signature relationship between invariance and dynamic range that can now be tested in future neurophysiological studies. Invariances to image transformations, such as translation and scaling, have been reported in single units in visual cortex, but just as often sensitivity to these transformations has been found (, Sharpee et al. 2013, . Similarly, in deep networks there is variation in translation invariance both within and across layers (, , , . Notionally, information about the position of the features composing objects may be important to category selectivity. For example, the detection of eyes, nose, and lips are not sufficient for face recognition, the relative positions of these parts must also be encoded. Thus it is reasonable to expect some balance between invariance and sensitivity to position. We empirically observe that in a popular deep network, in both its trained and untrained state, invariant units tend to have higher dynamic range than sensitive units (Figure 1B and C). This raises the possibility that the effective gain on invariant units into the subsequent layer is stronger than that of sensitive units. Here we provide theoretical insight into how rectification in a deep network could naturally biase networks to this difference between invariant and sensitive units. We do this by examining how co-variance of a multivariate normal distribution is influenced by rectification, and we then test these insights in a deep neural network. The response of a unit in a feed forward neural network is: r = w · g(S) where S is the response of all n input units in the previous layer, g the non-linearity of rectification g(x) = max(0, x), w is the n × 1 vector of weights, and r is the response of the unit. Randomly sampling from a distribution of input images, the response S takes on a distribution with some expectation and covariance across these images: E[S] = µ (an n × 1 vector), and Cov[S] = Σ (an n × n matrix). The application of the non-linearity transforms these moments: E[g(S)] =μ, Cov[g(S)] =Σ. Let S 1 be the responses to randomly sampled input images and S 2 the responses to a transformation of those same images. So the moments of the full distribution are: Σ 2,1Σ2,2, whereΣ 1,1 is the covariance of rectified input units responding to the original images,Σ 2,2 is the covariance of rectified input units to the transformed images andΣ 1,2 is the covariance between rectified input units responding to the reference and transformed images. We note we only define the 1st two moments above and no assumption about the distribution of the rectified responses is made. The covariance of an output unit with weights w on the n rectified input units is: T so the correlation between the response of the output unit to the reference and transformed images is: Below we investigate how theΣ i,j depend on Σ i,j and µ, which provides insight into a relationship betweenρ andσ 2. We begin by examining a model of a single rectified input unit responding to the reference and transformed images. We model the responses, S 1 and S 2, of a single input unit to the reference and transformed inputs, respectively, as a bivariate normal distribution: When these responses are acted on by rectification, both the variances of the responses and the correlation between the sets of responses is decreased. This observation is analogous to that of de la where they investigated the influence of neuronal firing threshold rectification on the pairwise correlations between neurons as a function of firing rate. We extend this observation in the next section to consider how this effect influences invariance in downstream units. It is instructive to consider a schematic (In the following section, we will write the correlation and variance after rectification explicitly as a function of the relevant parameters:σ(µ/σ) 2 andρ(µ/σ, ρ). Here we extend from the single input unit case to the multi-input unit case by examining the invarianceρ ing from taking weighted combinations of rectified input units. Our key insight is that invariance increases to the degree that directions of maximal variance in the response distribution of rectified input units are integrated. For a first order approximation of this relationship we approximate input covariance before rectification as an identity matrix scaled by the average variance: This approximation improves as off diagonal covariance shrinks andσ increases. Thus our approximate model is: =σ 2 I whereσ 2 is averaged across the diagonals of the original S 1 and T where means are approximated by averaging across the original S 1 and S 2. Cov[S 1, S 2] = Σ 1,2 =ρ σ 2 I where ρσ 2 > 0 justified by the assumption of a small transformation thus correlation is positive. For convenience sort the µ i in from high to low, then it naturally follows that the eigenvectors ofΣ 1,2 andΣ 1,1 are the same: I the identity (since the covariance matrices are diagonal) and the eigenvalues are simply the entries of the diagonal (in order from high to low sinceρ, andσ 2 are decreasing in µ; see Figure 2B) so we have: thus we have the geometric picture described in Figure 3A exactly. The denominator as a function of the direction of a unit length w (length of w does not change ρ) is an axis aligned ellipsoid with length along the ith axis ofσ 2 (µ i /σ). Notice that the numerator is the variation of the output unit thus more invariant units contribute more variance than less invariant units assuming there is not a negative correlation between w 2 i andσ 2 iρ i. The numerator is another axis aligned ellipsoid (blue) with length along the ith axis ofσ 2 (µ i /σ)ρ(µ i /σ, ρ) this numerator ellipsoid is contained within the denominator sinceρ ≤ 1. Recognizingρ as a weighted arithmetic mean with with weights c i = (note c i = 1) we see that if there is not a negative correlation of w i 2 withσ Performing simulations of a few simple input unit covariance structures shows that theρ toσ 2 relationship is maintained, though its form changes (Figure 3B). Integrating over a population of input units the form of the relationship changes from the single input unit case (Figure 3B black dashed and dotted line). Figure 3B red and cyan) overall variance increases because correlated input units are being added. Here we analyze the covariance structure of the inputs of a popular deep neural network (AlexNet) for translations of input images. We first tested the network in its untrained state by presenting a collection of 500 image patches drawn from the 2012 ImageNet validation set. References images were cropped enough to allow the original and translated images to fit within the maximal receptive field of the units being tested. We included a small and a large translation, and at each convolutional layer we measured the correlation and variance. We find a positive relationship at all layers with significant Spearman's ranked correlation for both transformations (Table 1 Untrained). The strength of the relationship tended to be stronger for the smaller translation (Figure 1C, orange). Thus in a popular deep network with no training, units which tended to have greater invariance also had higher dynamic range. We repeated the same analysis in AlexNet after it was fully trained for object recognition. Again we observed a significant positive relationship (Table 1 Trained; Figure 1B). The relationship was somewhat weaker than in the trained network. Thus training weakens but does not remove the bias of the network to associate higher dynamic range with higher translation invariance. Finally, we asked whether the network may compensate for this imbalance by placing weights of higher magnitude on low dynamic range units (a negative correlation betweenσ 2 i and w 2 i), thus effectively removing this bias. We measured whether the percent of weight magnitude on a given input unit across output units was greater for input units with higher variance. We found Conv3 (r s = 0.34) and Conv4 (r s = 0.19) tended to have higher weights on higher variance input units while there was no correlation in Conv2 and and Conv5. This indicates the network does not compensate for the imbalance in dynamic range between invariant and sensitive units but actually sometimes emphasizes it. We have documented an empirical relationship between the dynamic range of unrectified units in a deep network and their invariance. We provided a simple 1st order statistical model to explain this effect in which rectification caused the population representation to primarily vary in dimensions that were invariant to small image perturbations, whereas small perturbations were represented in directions of lower variance. Further work can investigate whether this imbalance improves generalization because of the emphasis placed on invariant over sensitive units. We note this relationship is weaker in the trained then untrained network further work can udnerstand this difference. Our approximations assumed low covariance between input units and homoegenous input variance while this may be expected in a random network it may not be true in a trained network. More crucially further theoretical work should consider the influence of co-variance between input units and invariance of output units as a function of weights. To extend insights from simplified, artificial networks to neurobiology, it will first of all be important to test whether cortical neurons showing more invariance also tend to have a higher dynamic range. If they do, this will establish a fundamental theoretical connection between computations of deep networks and the brain. We thank our reviewers for their careful and insightul comments. Above we have taken their comments into account in editing our final draft. Below we address their three main concerns. It is instructive to consider a schematic (Figure 2A) of the distribution of responses. The probability mass of the response is broken into 4 quadrants, the 1st green is unaffected by rectifications, the 2nd (purple) is projected onto the vertical axis (thick purple), the 3rd (red) is projected onto the origin (red dot), and the 4th (green) projected onto the horizontal axis (thick green). The diagonal line is the line of best fit expressing the linear relationship and the vertical line is a conditional distribution whose variance is the conditional residual which averaged gives the residual variance of the linear relationship.σ 2 decreases as µ/σ decreases because the spread of the distribution is truncated to the degree that the distribution falls beneath the threshold. For correlation it is useful 3 to consider: 2 V ar(S 1) decreases more rapidly then the average residual E[V ar(S 2 |S 1)]. Notionally we can think of V ar[E[S 2 |S 1]] as the vertical height of the diagonal line that has not been truncated (solid not truncated, dashed truncated) in Figure 2A and E[V ar(S 2 |S 1)] as the average length of vertical lines not truncated. Notice that the ratio of truncated to untruncated is lower for the diagonal then the vertical average. In the figure at µ = 0 the diagonal line is cut in half and so is the length of a vertical line drawn here. But at all other positions (µ > 0) where a vertical line would be drawn the vertical solid lines length is truncated less than half thus on average the vertical line is less truncated than the diagonals vertical length. We would like to emphasize we are not arguing that rectification explains the generalization properties of networks only that its influence on covariance may be one of many factors influencing invariance. We would like to emphasize that in this paper we pursue intuition by trying to understand a simple approximation to rectifications influence on invariance which in a simple analytic form. Our first approximation is to remove off-diagonal covariances. Since the influences of off-diagonals are additive they can be seen as modulating the effects induced by the diagonals: Thus here we analytically study the first order effect of rectification in output neurons on the basis of the variance but not covariance of their inputs. Finally we approximate the diagonal of the input variance with the average variance an approximation which minimizes squared error variation in σ 2 will hurt the strength of this approximation but not change the main effect unless this variation is negatively correlated with µ i thus canceling out the relationship between correlation and variance. We would not expect this negative correlation in an untrained network and further work can check whether this, potentially interesting, relationship exists in trained networks. We note that normalization enforces this approximation and thus these approximations may be particularly suited to networks using normalization. Distribution in quadrant I is preserved (pink), quadrant II, IV collapsed onto S1 and S2 axis respectively (thick green, blue lines), and III mapped onto origin (red). (B) Plottingσ 2 (µ/σ) againstρ(µ/σ, ρ) there is a positive relationship because both are increasing with µ/σ. ρ is transformed to Fisher's z andσ 2 plotted on log axis revealing an approximate relationship: a(σ 2) b = z(ρ)."

GAN representations are examined in detail, and sets of representation units are found that control the generation of semantic concepts in the output.

Represent the short summary for finding the corresponding scientific article (long)

We propose a novel architecture that traverses an image pyramid in a top-down fashion, while it visits only the most informative regions along the way.