Question:
represent the scientific article to find a short tldr
Given Deep neural networks have become the state-of-the-art models in numerous machine learning tasks. However, general guidance to network architecture design is still missing. In our work, we bridge deep neural network design with numerical differential equations. We show that many effective networks, such as ResNet, PolyNet, FractalNet and RevNet, can be interpreted as different numerical discretizations of differential equations. This finding brings us a brand new perspective on the design of effective deep architectures. We can take advantage of the rich knowledge in numerical analysis to guide us in designing new and potentially more effective deep networks. As an example, we propose a linear multi-step architecture (LM-architecture) which is inspired by the linear multi-step method solving ordinary differential equations. The LM-architecture is an effective structure that can be used on any ResNet-like networks. In particular, we demonstrate that LM-ResNet and LM-ResNeXt (i.e. the networks obtained by applying the LM-architecture on ResNet and ResNeXt respectively) can achieve noticeably higher accuracy than ResNet and ResNeXt on both CIFAR and ImageNet with comparable numbers of trainable parameters. In particular, on both CIFAR and ImageNet, LM-ResNet/LM-ResNeXt can significantly compress (>50%) the original networks while maintaining a similar performance. This can be explained mathematically using the concept of modified equation from numerical analysis. Last but not least, we also establish a connection between stochastic control and noise injection in the training process which helps to improve generalization of the networks. Furthermore, by relating stochastic training strategy with stochastic dynamic system, we can easily apply stochastic training to the networks with the LM-architecture. As an example, we introduced stochastic depth to LM-ResNet and achieve significant improvement over the original LM-ResNet on CIFAR10. Deep learning has achieved great success in may machine learning tasks. The end-to-end deep architectures have the ability to effectively extract features relevant to the given labels and achieve state-of-the-art accuracy in various applications BID3 ). Network design is one of the central task in deep learning. Its main objective is to grant the networks with strong generalization power using as few parameters as possible. The first ultra deep convolutional network is the ResNet BID16 which has skip connections to keep feature maps in different layers in the same scale and to avoid gradient vanishing. Structures other than the skip connections of the ResNet were also introduced to avoid gradient vanishing, such as the dense connections BID20, fractal path BID27 and Dirac initialization BID50. Furthermore, there has been a lot of attempts to improve the accuracy of image classifications by modifying the residual blocks of the ResNet. BID49 suggested that we need to double the number of layers of ResNet to achieve a fraction of a percent improvement of accuracy. They proposed a widened architecture that can efficiently improve the accuracy. BID51 pointed out that simply modifying depth or width of ResNet might not be the best way of architecture design. Exploring structural diversity, which is an alternative dimension in network design, may lead to more effective networks. In BID43, BID51, BID47, and BID19, the authors further improved the accuracy of the networks by carefully designing residual blocks via increasing the width of each block, changing the topology of the network and following certain empirical observations. In the literature, the network design is mainly empirical. It remains a mystery whether there is a general principle to guide the design of effective and compact deep networks. Observe that each residual block of ResNet can be written as u n+1 = u n + ∆tf (u n) which is one step of forward Euler discretization (AppendixA.1) of the ordinary differential equation (ODE) u t = f (u) (E, 2017). This suggests that there might be a connection between discrete dynamic systems and deep networks with skip connections. In this work, we will show that many state-of-the-art deep network architectures, such as PolyNet BID51, FractalNet BID27 and RevNet BID12, can be consider as different discretizations of ODEs. From the perspective of this work, the success of these networks is mainly due to their ability to efficiently approximate dynamic systems. On a side note, differential equations is one of the most powerful tools used in low-level computer vision such as image denoising, deblurring, registration and segmentation BID36 BID2 BID4. This may also bring insights on the success of deep neural networks in low-level computer vision. Furthermore, the connection between architectures of deep neural networks and numerical approximations of ODEs enables us to design new and more effective deep architectures by selecting certain discrete approximations of ODEs. As an example, we design a new network structure called linear multi-step architecture (LM-architecture) which is inspired by the linear multi-step method in numerical ODEs BID1. This architecture can be applied to any ResNet-like networks. In this paper, we apply the LM-architecture to ResNet and ResNeXt BID47 ) and achieve noticeable improvements on CIFAR and ImageNet with comparable numbers of trainable parameters. We also explain the performance gain using the concept of modified equations from numerical analysis. It is known in the literature that introducing randomness by injecting noise to the forward process can improve generalization of deep residual networks. This includes stochastic drop out of residual blocks BID21 and stochastic shakes of the outputs from different branches of each residual block BID11. In this work we show that any ResNet-like network with noise injection can be interpreted as a discretization of a stochastic dynamic system. This gives a relatively unified explanation to the stochastic learning process using stochastic control. Furthermore, by relating stochastic training strategy with stochastic dynamic system, we can easily apply stochastic training to the networks with the proposed LM-architecture. As an example, we introduce stochastic depth to LM-ResNet and achieve significant improvement over the original LM-ResNet on CIFAR10. The link between ResNet FIG0 ) and ODEs were first observed by E, where the authors formulated the ODE u t = f (u) as the continuum limit of the ResNet u n+1 = u n + ∆tf (u n). BID31 bridged ResNet with recurrent neural network (RNN), where the latter is known as an approximation of dynamic systems. BID40 and BID30 also regarded ResNet as dynamic systems that are the characteristic lines of a transport equation on the distribution of the data set. Similar observations were also made by BID5; they designed a reversible architecture to grant stability to the dynamic system. On the other hand, many deep network designs were inspired by optimization algorithms, such as the network LISTA BID14 and the ADMM-Net BID48. Optimization algorithms can be regarded as discretizations of various types of ODEs BID18, among which the simplest example is gradient flow. Another set of important examples of dynamic systems is partial differential equations (PDEs), which have been widely used in low-level computer vision tasks such as image restoration. There were some recent attempts on combining deep learning with PDEs for various computer vision tasks, i.e. to balance handcraft modeling and data-driven modeling. BID32 and BID33 proposed to use linear combinations of a series of handcrafted PDE-terms and used optimal control methods to learn the coefficients. Later, BID10 extended their model to handle classification tasks and proposed an learned PDE model (L-PDE). However, for classification tasks, the dynamics (i.e. the trajectories generated by passing data to the network) should be interpreted as the characteristic lines of a PDE on the distribution of the data set. This means that using spatial differential operators in the network is not essential for classification tasks. Furthermore, the discretizations of differential operators in the L-PDE are not trainable, which significantly reduces the network's expressive power and stability. BID28 proposed a feed-forward network in order to learn the optimal nonlinear anisotropic diffusion for image denoising. Unlike the previous work, their network used trainable convolution kernels instead of fixed discretizations of differential operators, and used radio basis functions to approximate the nonlinear diffusivity function. More recently, BID34 designed a network, called PDE-Net, to learn more general evolution PDEs from sequential data. The learned PDE-Net can accurately predict the dynamical behavior of data and has the potential to reveal the underlying PDE model that drives the observed data. In our work, we focus on a different perspective. First of all, we do not require the ODE u t = f (u) associate to any optimization problem, nor do we assume any differential structures in f (u). The optimal f (u) is learned for a given supervised learning task. Secondly, we draw a relatively comprehensive connection between the architectures of popular deep networks and discretization schemes of ODEs. More importantly, we demonstrate that the connection between deep networks and numerical ODEs enables us to design new and more effective deep networks. As an example, we introduce the LM-architecture to ResNet and ResNeXt which improves the accuracy of the original networks. We also note that, our viewpoint enables us to easily explain why ResNet can achieve good accuracy by dropping out some residual blocks after training, whereas dropping off sub-sampling layers often leads to an accuracy drop BID44. This is simply because each residual block is one step of the discretized ODE, and hence, dropping out some residual blocks only amounts to modifying the step size of the discrete dynamic system, while the sub-sampling layer is not a part of the ODE model. Our explanation is similar to the unrolled iterative estimation proposed by BID13, while the difference is that we believe it is the data-driven ODE that does the unrolled iterative estimation. In this section we show that many existing deep neural networks can be consider as different numerical schemes approximating ODEs of the form u t = f (u). Based on such observation, we introduce a new structure, called the linear multi-step architecture (LM-architecture) which is inspired by the well-known linear multi-step method in numerical ODEs. The LM-architecture can be applied to any ResNet-like networks. As an example, we apply it to ResNet and ResNeXt and demonstrate the performance gain of such modification on CIFAR and ImageNet data sets. PolyNet FIG0 ), proposed by BID51, introduced a PolyInception module in each residual block to enhance the expressive power of the network. The PolyInception model includes polynomial compositions that can be described as DISPLAYFORM0 We observe that PolyInception model can be interpreted as an approximation to one step of the backward Euler (implicit) scheme (AppendixA.1): DISPLAYFORM1 Indeed, we can formally rewrite (I − ∆tf) −1 as DISPLAYFORM2 Therefore, the architecture of PolyNet can be viewed as an approximation to the backward Euler scheme solving the ODE u t = f (u). Note that, the implicit scheme allows a larger step size BID1, which in turn allows fewer numbers of residual blocks of the network. This explains why PolyNet is able to reduce depth by increasing width of each residual block to achieve state-of-the-art classification accuracy. FractalNet BID27 FIG0 ) is designed based on self-similarity. It is designed by repeatedly applying a simple expansion rule to generate deep networks whose structural layouts are truncated fractals. We observe that, the macro-structure of FractalNet can be interpreted as the well-known Runge-Kutta scheme in numerical analysis. Recall that the recursive fractal structure of FractalNet can be written as DISPLAYFORM3 For simplicity of presentation, we only demonstrate the FractalNet of order 2 (i.e. c ≤ 2). Then, every block of the FractalNet (of order 2) can be expressed as DISPLAYFORM4, which resembles the Runge-Kutta scheme of order 2 solving the ODE u t = f (u) (see AppendixA.2).RevNet FIG0 ), proposed by BID12, is a reversible network which does not require to store activations during forward propagations. The RevNet can be expressed as the following discrete dynamic system DISPLAYFORM5 RevNet can be interpreted as a simple forward Euler approximation to the following dynamic systeṁ DISPLAYFORM6 Note that reversibility, which means we can simulate the dynamic from the end time to the initial time, is also an important notation in dynamic systems. There were also attempts to design reversible scheme in dynamic system such as BID35. DISPLAYFORM7 We have shown that architectures of some successful deep neural networks can be interpreted as different discrete approximations of dynamic systems. In this section, we proposed a new struc-ture, called linear multi-step structure (LM-architecture), based on the well-known linear multi-step scheme in numerical ODEs (which is briefly recalled in Appendix A.3). The LM-architecture can be written as follows DISPLAYFORM0 where k n ∈ R is a trainable parameter for each layer n. A schematic of the LM-architecture is presented in Figure 2. Note that the midpoint and leapfrog network structures in BID5 are all special case of ours. The LM-architecture is a 2-step method approximating the ODE u t = f (u). Therefore, it can be applied to any ResNet-like networks, including those mentioned in the previous section. As an example, we apply the LM-architecture to ResNet and ResNeXt. We call these new networks the LM-ResNet and LM-ResNeXt. We trained LM-ResNet and LM-ResNeXt on CIFAR BID25 ) and Imagenet BID37, and both achieve improvements over the original ResNet and ResNeXt. Implementation Details. For the data sets CIFAR10 and CIFAR100, we train and test our networks on the training and testing set as originally given by the data set. For ImageNet, our models are trained on the training set with 1.28 million images and evaluated on the validation set with 50k images. On CIFAR, we follow the simple data augmentation in BID28 for training: 4 pixels are padded on each side, and a 32×32 crop is randomly sampled from the padded image or its horizontal flip. For testing, we only evaluate the single view of the original 32×32 image. Note that the data augmentation used by ResNet BID16 BID47 is the same as BID28. On ImageNet, we follow the practice in BID26; BID39. Images are resized with its shorter side randomly sampled in for scale augmentation BID39. The input image is 224×224 randomly cropped from a resized image using the scale and aspect ratio augmentation of BID42. For the experiments of ResNet/LM-ResNet on CIFAR, we adopt the original design of the residual block in BID17, i.e. using a small two-layer neural network as the residual block with bn-relu-conv-bn-reluconv. The residual block of LM-ResNeXt (as well as LM-ResNet164) is the bottleneck structure used by BID47 ) that takes the form 1 × 1, 64 3 × 3, 64 1 × 1, 256. We start our networks with a single 3 × 3 conv layer, followed by 3 residual blocks, global average pooling and a fully-connected classifier. The parameters k n of the LM-architecture are initialized by random sampling from U[−0.1, 0]. We initialize other parameters following the method introduced by BID15. On CIFAR, we use SGD with a mini-batch size of 128, and 256 on ImageNet. During training, we apply a weight decay of 0.0001 for LM-ResNet and 0.0005 for LM-ResNeXt, and momentum of 0.9 on CIFAR. We apply a weight decay of 0.0001 and momentum of 0.9 for both LM-ResNet and LM-ResNeXt on ImageNet. For LM-ResNet on CIFAR10 (CIFAR100), we start with the learning rate of 0.1, divide it by 10 at 80 and 120 epochs and terminate training at 160 epochs. For LM-ResNeXt on CIFAR, we start with the learning rate of 0.1 and divide it by 10 at 150 and 225 epochs, and terminate training at 300 epochs. Figure 2: LM-architecture is an efficient structure that enables ResNet to achieve same level of accuracy with only half of the parameters on CIFAR10. Results. Testing errors of our proposed LM-ResNet/LM-ResNeXt and some other deep networks on CIFAR are presented in TAB1. Figure 2 shows the overall improvements of LM-ResNet over ResNet on CIFAR10 with varied number of layers. We also observe noticeable improvements of both LM-ResNet and LM-ResNeXt on CIFAR100. BID47 claimed that ResNeXt can achieve lower testing error without pre-activation (pre-act). However, our show that LMResNeXt with pre-act achieves lower testing errors even than the original ResNeXt without pre-act. Training and testing curves of LM-ResNeXt are plotted in Figure3. In TAB1, we also present testing errors of FractalNet and DenseNet BID20 on CIFAR 100. We can see that our proposed LM-ResNeXt29 has the best . Comparisons between LM-ResNet and ResNet on ImageNet are presented in TAB2. The LM-ResNet shows improvement over ResNet with comparable number of trainable parameters. Note that the of ResNet on ImageNet are obtained from "https://github.com/KaimingHe/deep-residual-networks". It is worth noticing that the testing error of the 56-layer LM-ResNet is comparable to that of the 110-layer ResNet on CIFAR10; the testing error of the 164-layer LM-ResNet is comparable to that of the 1001-layer ResNet on CI-FAR100; the testing error of the 50-layer LM-ResNet is comparable to that of the 101-layer ResNet on ImageNet. We have similar on LM-ResNeXt and ResNeXt as well. These indicate that the LM-architecture can greatly compress ResNet/ResNeXt without losing much of the performance. We will justify this mathematically at the end of this section using the concept of modified equations from numerical analysis. Explanation on the performance boost via modified equations. Given a numerical scheme approximating a differential equation, its associated modified equation BID45 ) is another differential equation to which the numerical scheme approximates with higher order of accuracy than the original equation. Modified equations are used to describe numerical behaviors of numerical schemes. For example, consider the simple 1-dimensional transport equation u t = cu x. 101, pre-act 22.6 6.4Figure 3: Training and testing curves of ResNext29 (16x64d, pre-act) and and LM-ResNet29 (16x64d, pre-act) on CIFAR100, which shows that the LM-ResNeXt can achieve higher accuracy than ResNeXt. Both the Lax-Friedrichs scheme and Lax-Wendroff scheme approximates the transport equation. However, the associated modified equations of Lax-Friedrichs and Lax-Wendroff are DISPLAYFORM1 respectively, where r = 2∆t ∆x. This shows that the Lax-Friedrichs scheme behaves diffusive, while the Lax-Wendroff scheme behaves dispersive. Consider the forward Euler scheme which is associated to ResNet, DISPLAYFORM2 Thus, the modified equation of forward Euler scheme reads aṡ DISPLAYFORM3 Consider the numerical scheme used in the LM-structure DISPLAYFORM4 Then, the modified equation of the numerical scheme associated to the LM-structure DISPLAYFORM5 Comparing FORMULA11 with, we can see that when k n ≤ 0, the second order termü of is bigger than that of. The termü represents acceleration which leads to acceleration of the convergence of u n when f = −∇g BID41; BID46. When f (u) = L(u) with L being an elliptic operator, the termü introduce dispersion on top of the dissipation, which speeds up the flow of u n. In fact, this is our original motivation of introducing the LM-architecture. Note that when the dynamic is truly a gradient flow, i.e. f = −∇g, the difference equation of the LM-structure has a stability condition −1 ≤ k n ≤ 1. In our experiments, we do observe that most of the coefficients are lying in (−1, 1) FIG1. Moreover, the network is indeed accelerating at the end of the dynamic, for the learned parameters {k n} are negative and close to −1 FIG1 ). Although the original ResNet BID16 did not use dropout, several work BID21 BID11 showed that it is also beneficial to inject noise during training. In this section we show that we can regard such stochastic learning strategy as an approximation to a stochastic dynamic system. We hope the stochastic dynamic system perspective can shed lights on the discovery of a guiding principle on stochastic learning strategies. To demonstrate the advantage of bridging stochastic dynamic system with stochastic learning strategy, we introduce stochastic depth during training of LM-ResNet. Our indicate that the networks with proposed LM-architecture can also greatly benefit from stochastic learning strategies. As an example, we show that the two stochastic learning methods introduced in BID21 and BID11 can be considered as weak approximations of stochastic dynamic systems. Shake-Shake Regularization. introduced a stochastic affine combination of multiple branches in a residual block, which can be expressed as DISPLAYFORM0 where η ∼ U. To find its corresponding stochastic dynamic system, we incorporate the time step size ∆t and consider DISPLAYFORM1 which reduces to the shake-shake regularization when ∆t = 1. The above equation can be rewritten as DISPLAYFORM2 Since the random variable DISPLAYFORM3 2 ), following the discussion in Appendix B, the network of the shake-shake regularization is a weak approximation of the stochastic dynamic system DISPLAYFORM4 where dB t is an N dimensional Brownian motion, 1 N ×1 is an N -dimensional vector whose elements are all 1s, N is the dimension of X and f i (X), and denotes the pointwise product of vectors. Note from that we have alternatives to the original shake-shake regularization if we choose ∆t = 1.Stochastic Depth. BID21 randomly drops out residual blocks during training in order to reduce training time and improve robustness of the learned network. We can write the forward propagation as DISPLAYFORM5 where P(η n = 1) = p n, P(η n = 0) = 1 − p n. By incorporating ∆t, we consider DISPLAYFORM6 which reduces to the original stochastic drop out training when ∆t = 1. The variance of DISPLAYFORM7 is 1. If we further assume that (1 − 2p n) = O(√ ∆t), the condition of Appendix B.2 is satisfied for small ∆t. Then, following the discussion in Appendix B, the network with stochastic drop out can be seen as a weak approximation to the stochastic dynamic system DISPLAYFORM8 Note that the assumption (1 − 2p n) = O(√ ∆t) also suggests that we should set p n closer to 1/2 for deeper blocks of the network, which coincides with the observation made by BID21 Figure 8 ).In general, we can interpret stochastic training procedures as approximations of the following stochastic control problem with running cost DISPLAYFORM9 where L(·) is the loss function, T is the terminal time of the stochastic process, and R is a regularization term. BID17 110,pre-act Orignial 6.37ResNet BID21 In this section, we extend the stochastic depth training strategy to networks with the proposed LMarchitecture. In order to apply the theory of Itô process, we consider the 2nd orderẌ + g(t)Ẋ = f (X) (which is related to the modified equation of the LM-structure) and rewrite it as a 1st order ODE systemẊ = Y,Ẏ = f (X) − g(t)Y. Following a similar argument as in the previous section, we obtain the following stochastic procesṡ DISPLAYFORM10 which can be weakly approximated by DISPLAYFORM11 where P(η n = 1) = p n, P(η n = 0) = 1 − p n. Taking ∆t = 1, we obtain the following stochastic training strategy for LM-architecture DISPLAYFORM12 The above derivation suggests that the stochastic learning for networks using LM-architecture can be implemented simply by randomly dropping out the residual block with probability p. Implementation Details. We test LM-ResNet with stochastic training strategy on CIFAR10. In our experiments, all hyper-parameters are selected exactly the same as in BID21. The probability of dropping out a residual block at each layer is a linear function of the layer, i.e. we set the probability of dropping the current residual block as DISPLAYFORM13 where l is the current layer of the network, L is the depth of the network and p L is the dropping out probability of the previous layer. In our experiments, we select p L = 0.8 for LM-ResNet56 and p L = 0.5 for LM-ResNet110. During training with SGD, the initial learning rate is 0.1, and is divided by a factor of 10 after epoch 250 and 375, and terminated at 500 epochs. In addition, we use a weight decay of 0.0001 and a momentum of 0.9.Results. Testing errors are presented in TAB3. Training and testing curves of LM-ResNet with stochastic depth are plotted in Figure5. Note that LM-ResNet110 with stochastic depth training strategy achieved a 4.80% testing error on CIFAR10, which is even lower that the ResNet1202 reported in the original paper. The benefit of stochastic training has been explained from difference perspectives, such as Bayesian BID23 and information theory BID38 BID0. The stochastic Brownian motion involved in the aforementioned stochastic dynamic systems introduces diffusion which leads to information gain and robustness. In this section we briefly recall some concepts from numerical ODEs that are used in this paper. The ODE we consider takes the form u t = f (u, t). Interested readers should consult BID1 for a comprehensive introduction to the subject. The simplest approximation of u t = f (u, t) is to discretize the time derivative u t by un+1−un ∆t and approximate the right hand side by f (u n, t n). This leads to the forward (explicit) Euler scheme u n+1 = u n + ∆tf (u n, t n).If we approximate the right hand side of the ODE by f (u n+1, t n+1), we obtain the backward (implicit) Euler scheme u n+1 = u n + ∆tf (u n+1, t n+1).The backward Euler scheme has better stability property than the forward Euler, though we need to solve a nonlinear equation at each step. Runge-Kutta method is a set of higher order one step methods, which can be formulate aŝ DISPLAYFORM0 a ij f (û j, t n + c j ∆t), DISPLAYFORM1 b j f (û j, t n + c j ∆t).Here,û j is an intermediate approximation to the solution at time t n +c j ∆t, and the coefficients {c j} can be adjusted to achieve higher order accuracy. As an example, the popular 2nd-order Runge-Kutta takes the formx n+1 = x n + ∆tf (x n, t n),x n+1 = x n + ∆t 2 f (x n, t n) + ∆t 2 f (x n+1, t n+1). Liear multi-step method generalizes the classical forward Euler scheme to higher orders. The general form of a k−step linear multi-step method is given by where, α j, β j are scalar parameters and α 0 = 0, |α j | + |β j | = 0. The linear multi-step method is explicit if β 0 = 0, which is what we used to design the linear multi-step structure. In this section we follow the setting of Kesendal FORMULA11 and BID9. We first give the definition of Brownian motion. The Brownian motion B t is a stochastic process satisfies the following assumptions, a positive would be This paper bridges deep network architectures with numerical (stochastic) differential equations. This new perspective enables new designs of more effective deep neural networks. & a negative would be Are HMMs a special case of RNNs? We investigate a series of architectural transformations between HMMs and RNNs, both through theoretical derivations and empirical hybridization and provide new insights.

Question: We present a method for translating music across musical instruments and styles. This method is based on unsupervised training of a multi-domain wavenet autoencoder, with a shared encoder and a domain-independent latent space that is trained end-to-end on waveforms. Employing a diverse training dataset and large net capacity, the single encoder allows us to translate also from musical domains that were not seen during training. We evaluate our method on a dataset collected from professional musicians, and achieve convincing translations. We also study the properties of the obtained translation and demonstrate translating even from a whistle, potentially enabling the creation of instrumental music by untrained humans. Humans have always created music and replicated it -whether it is by singing, whistling, clapping, or, after some training, playing improvised or standard musical instruments. This ability is not unique to us, and there are many other vocal mimicking species that are able to repeat music from hearing. Music is also one of the first domains to be digitized and processed by modern computers and algorithms. It is, therefore, somewhat surprising that in the core music task of mimicry, AI is still much inferior to biological systems. In this work, we present a novel way to produce convincing musical translation between instruments and styles. For example 1, we convert the audio of a Mozart symphony performed by an orchestra to an audio in the style of a pianist playing Beethoven. Our ability builds upon two technologies that have recently become available: (i) the ability to synthesize high quality audio using autoregressive models, and (ii) the recent advent of methods that transform between domains in an unsupervised way. The first technology allows us to generate high quality and realistic audio and thanks to the teacher forcing technique, autoregressive models are efficiently trained as decoders. The second family of technologies contributes to the practicality of the solution, since posing the learning problem in the supervised setting, would require a parallel dataset of different musical instruments. In our architecture, we employ a single, universal, encoder and apply it to all inputs (universal here means that a single encoder can address all input music, allowing us to achieve capabilities that are known as universal translation). In addition to the advantage of training fewer networks, this also enables us to convert from musical domains that were not heard during training to any of the domains encountered. The key to being able to train a single encoder architecture, is making sure that the domain-specific information is not encoded. We do this using a domain confusion network that provides an adversarial signal to the encoder. In addition, it is important for the encoder not to memorize the input signal but to encode it in a semantic way. We achieve this by distorting the input audio by random local pitch modulation. During training, the network is trained as a denoising autoencoder, which recovers the undistorted version of the original input. Since the distorted input is no longer in the musical domain of the output, the network learns to project out-of-domain inputs to the desired output domain. In addition, the network no longer benefits from memorizing the input signal and employs a higher-level encoding. Asked to convert one musical instrument to another, our network shows a level of performance that seems to approach that of musicians. When controlling for audio quality, which is still lower for generated music, it is many times hard to tell which is the original audio file and which is the output of the conversion that mimics a completely different instrument. The network is also able to successfully process unseen musical instruments such as drums, or other sources, such as whistles. Domain Transfer Recently, there has been a considerable amount of work, mostly on images and text, which performs unsupervised translation between domains A and B, without being shown any matching pairs, i.e., in a completely unsupervised way. Almost all of this work employs GAN constraints BID8, in order to ensure a high level of indistinguishability between the translations of samples in A and samples from the domain B. In our work, the output is generated by an autoregressive model and training takes place using the ground truth output of the previous time steps ("teacher forcing"), instead of the predicted ones. A complete autoregressive inference is only done during test time, and it is not practical to apply such inference during training in order to get a realistic generated ("fake") sample for the purpose of training the GAN.Another popular constraint is that of circularity, namely that by mapping from A to B and back to A a reconstruction of the original sample is obtained BID39 BID38. In our work, for the same reason mentioned above, the output during training does not represent the future test time output, and such a constraint is unrealistic. An application of circularity in audio was present in BID13, where a non-autoregressive model between vocoder features is used to convert between voices in an unsupervised way. Cross domain translation is not restricted to a single pair of domains. The recent StarGAN BID1 method creates multiple cycles for mapping between multiple (more than two) domains. The method employs a single generator that receives as input the source image as well as the specification of the target domain. It then produces the analog "fake" image from the target domain. Our work employs multiple decoders, one per domain, and attempts to condition a single decoder on the selection of the output domain failed to produce convincing . UNIT BID20 employs an encoder-decoder pair per each domain, where the latent spaces of the domains are assumed to be shared. This is achieved by sharing the network layers that are distant from the image (the top layers of the encoder and the bottom layers of the decoder), similarly to CoGAN BID19. Cycle-consistency is also added, and structure is added to the latent space using a variational autoencoder BID17 loss terms. Our method employs a single encoder, which eliminates the need for many of the associated constraints. In addition, we do not impose a VAE loss term BID17 on the latent space of the encodings and instead employ a domain confusion loss BID6. The work of BID21 investigates the problem of learning invariant representations by employing the Maximum Mean Discrepancy (MMD), which we do not use. Audio Synthesis WaveNet (van den BID36) is an autoregressive model that predicts the probability distribution of the next sample, given the previous samples and an input conditioning signal. Its generated output is currently considered of the highest naturalness, and is applied in a range of tasks. In BID26, the authors have used it for denoising waveforms by predicting the middle ground-truth sample from its noisy input support. Recent contributions in Text-To-Speech(TTS) BID25 BID30 have successfully conditioned wavenet on linguistic and acoustic features to obtain state of the art performance. In VQ-VAE (van den BID35, voice conversion was obtained by employing a variational autoencoder that produces a quantized latent space that is conditioned on the speaker identity. Similar to our work, the decoder is based on WaveNet. However, we impose a greater constraint on the latent space by (a) having a universal encoder, forcing the embeddings of all domains to lie in the same space, yet (b) training a separate reconstructing decoder for each domain, provided that (c) the latent space is domain independent, thereby reducing source-target pathways memorization, which is also accomplished by (d) employing augmentation to distort the input signal. Invariance is achieved in VQ-VAE through the strong bottleneck effect achieved by discretization. Despite some effort, we were not able to use a discrete latent space here. Recently, BID4 explored discretization as a method to capture long-range dependencies in unconditioned music generation, for up to 24 seconds. We focus on translation, and the conditioning on the source signal carries some long-range information on the development of the music. Consider an analogy to a myopic language translation system, where the input is a story in English and the output is a story in Spanish. Even if the translation occurs one sentence at a time, the main theme of the story is carried by the "conditioning" on the source text. The architecture of the autoencoder we employ is the wavenet-autoencoder presented in BID5. In comparison to this work, our inputs are not controlled and are collected from consumer media. Our overall architecture differs in that multiple decoders and an additional auxiliary network, which is used for disentangling the domain information from the other aspects of the music representation, are trained and by the addition of an important augmentation step. In the supervised learning domain, an audio style transfer between source and target spectrograms was performed with sequence-to-sequence recurrent networks BID10. This method requires matching pairs of samples played on different instruments. In another fully supervised work BID9 ), a graphical model aimed at modeling polyphonic tones of Bach was trained on notes, capturing the specificity of Bach's chorales. This model is based on RNNs and requires a large corpus of notes of a particular instrument produced with a music editor. Style Transfer Style transfer is often confused with domain translation and the distinction is not always clear. In the task of style transfer, the "content" remains the same between the input and the output, but the "style" is modified. Notable contributions in the field include BID7 BID34 BID12, which synthesize a new image that minimizes the content loss with respect to the content-donor sample and the style loss with respect to one or more samples of a certain style. The content loss is based on comparing the activations of a network training for an image categorization task. The style loss compares the statistics of the activations in various layers of the categorization layer. An attempt at audio style transfer is described in BID0.Concatenative Synthesis In the computer music and audio effects literature, the conversion task we aim to solve is tackled by concatenating together short pieces of audio from the target domain, such that the output audio resembles the input audio from the source domain BID37; BID28; Zils & Pachet FORMULA0; BID31. The method has been extensively researched, see the previous work section of BID24 and the online resource of BID29. A direct comparison to such methods is challenging, since many of the methods have elaborate interfaces with many tunable parameters that vary from one conversion task to the next. To the extent possible, we compare with some of the published in Sec. 4.2, obtaining what we believe to be clearly superior . Our domain translation method is based on training multiple autoencoder pathways, one per musical domain, such that the encoders are shared. During training, a softmax-based reconstruction loss is applied to each domain separately. The input data is randomly augmented, prior to applying the encoder, in order to force the network to extract high-level semantic features, instead of simply memorizing the data. In addition, a domain confusion loss BID6 ) is applied to the latent space to ensure that the encoding is not domain-specific. A diagram of the translation architecture is shown in FIG0. We reuse an existing autoencoder architecture that is based on a WaveNet decoder and a WaveNetlike dilated convolution encoder BID5. The WaveNet of each decoder is conditioned on the latent representation produced by the encoder. In order to reduce the inferencetime, the nv-wavenet CUDA kernels provided by NVIDIA (https://github.com/NVIDIA/ nv-wavenet) were used after modification to better match the architecture suggested by van den Oord et al. FORMULA0, as described below. The encoder is a fully convolutional network that can be applied to any sequence length. The network has three blocks of ten residual-layers, a total of thirty layers. Each residual-layer contains a RELU nonlinearity, a non-causal dilated convolution with an increasing kernel size, a second RELU, and a 1 × 1 convolution followed by the residual summation of the activations before the first RELU. There is a fixed width of 128 channels. After the three blocks, there is an additional 1 × 1 layer. An average pooling with a kernel size of 50 milliseconds (800 samples) follows in order to obtain an encoding in R 64, which implies a temporal down sampling by a factor of ×12.5.The encoding is upsampled temporally to the original audio rate, using nearest neighbor interpolation and is used to condition a WaveNet decoder. The conditioning signal is passed through a 1 × 1 layer that is different for each WaveNet layer. The audio (both input and output) is quantized using 8-bit mu-law encoding, similarly to both BID36 BID5, which in some inherent loss of quality. The WaveNet decoder has either four blocks of 10 residual-layers and a ing receptive field of 250 milliseconds (4,093 samples), as in BID5, or 14 layer blocks and a much larger receptive field of 4 seconds. Each residual-layer contains a causal dilated convolution with an increasing kernel size, a gated hyperbolic tangent activation, a 1 × 1 convolution followed by the residual summation of the layer input, and a 1 × 1 convolution layer which introduces a skip connection. Each residual-layer is conditioned on the encoding described above. The summed skip connections are passed through two fully connected layers and a softmax activation to output the next timestep probability. A detailed diagram of the WaveNet autoencoder is shown in FIG0.We modify the fast nv-wavenet CUDA inference kernels, which implement the architecture suggested by BID25, and create efficient WaveNet kernels that implement the WaveNet architecture suggested by BID5. Specifically, we make the following modifications to nv-wavenet: (i) we add initialization of skip connections with previous WAV samples, (ii) we increase the kernel capacity to support 128 residual channels and (iii) we also add the conditioning to the last fully connected layer. In order to improve the generalization capability of the encoder, as well as to enforce it to maintain higher-level information, we employ a dedicated augmentation procedure that changes the pitch locally. The ing audio is of a similar quality but is slightly out of tune. Specifically, we perform our training on segments of one second length. For augmentation, we uniformly select a segment of length between 0.25 and 0.5 seconds, and modulate its pitch by a random number between -0.5 and 0.5 of half-steps, using librosa BID22. Let s j be an input sample from domain j = 1, 2,..., k, k being the number of domains employed during training. Let E be the shared encoder, and D j the WaveNet decoder for domain j. Let C be the domain classification network, and O(s, r) be the random augmentation procedure applied to a sample s with a random seed r. The network C predicts which domain the input data came from, based on the latent vectors. It applies three 1D-convolution layers, with the ELU BID2 nonlinearity. The last layer projects the vectors to dimension k and the vectors are subsequently averaged to a single R k vector. A detailed diagram of network C is shown as part of FIG0.During training, the domain classification network C minimizes the classification loss DISPLAYFORM0 and the music to music autoencoders j = 1, 2,... are trained with the loss DISPLAYFORM1 where L(o, y) is the cross entropy loss applied to each element of the output o and the corresponding element of the target y separately. Note that the decoder D j is an autoregressive model that is conditioned on the output of E. During training, the autoregressive model is fed the target output s j from the previous time-step, instead of the generated output. To perform the actual transformation from a sample s from any domain, even from an unseen musical domain, to output domain j, we apply the autoencoder of domain j to it, without applying the distortion. The new sampleŝ j is, therefore, given as D j (E(s)). The bottleneck during inference is the WaveNet autoregressive process, which is optimized by the dedicated CUDA kernels. We conduct music translation experiments, using a mix of human evaluation and qualitative analysis, in order to overcome the challenges of evaluating generative models. The experiments were done in two phases. In the first phase, described in an earlier technical report BID23, we train our network on six arbitrary classical musical domains: (i) Mozart's symphonies conducted by Karl Böhm, (ii) Haydn's string quartets, performed by the Amadeus Quartet, (iii) J.S Bach's cantatas for orchestra, chorus and soloists, (iv) J.S Bach's organ works, (v) Beethoven's piano sonatas, performed by Daniel Barenboim, and (vi) J.S Bach's keyboard works, played on Harpsichord. The music recordings by Bach (iii,iv,vi) are from the Teldec 2000 Complete Bach collection. In the second phase, in order to allow reproducibility and sharing of the code and models, we train on audio data from MusicNET BID33. Domains were chosen as the largest domains that show variability between composers and instruments. The following six domains were selected: (i) J.S Bach's suites for cello, (ii) Beethoven's piano sonatas, (iii) Cambini's Wind Quintet, (iv) J.S Bach's fugues, played on piano, (v) Beethoven's violin sonatas and (vi) Beethoven's string quartet. This public dataset is somewhat smaller than the data used in phase one. The phases differ in the depth of the decoders: in the first phase, we employed blocks of ten layers, while in the second, we shifted to larger receptive fields and blocks of 14. The training and test splits are strictly separated by dividing the tracks (or audio files) between the two sets. The segments used in the evaluation experiments below were not seen during training. During training, we iterate over the training domains, such that each training batch contains 16 randomly sampled one second samples from a single domain. Each batch is first used to train the domain classification network C, and then to train the universal encoder and the domain decoder, given the updated discriminator. The method was implemented in the PyTorch framework, and trained on eight Tesla V100 GPUs for a total of 6 days. We used the ADAM optimization algorithm with a learning rate of 10 −3 and a decay factor of 0.98 every 10,000 samples. We weighted the confusion loss with λ = 10 −2. The first set of experiments compared the method to human musicians using the phase one network. Since human musicians, are equipped by evolution with music skills, selected among their peers according to their talent, and who have trained for decades, we do not expect to do better than humans at this point. To perform this comparsion, music from domain X was converted to piano, for various X. The piano was selected for practical reasons: pianists are in higher availability than other musicians and a piano is easier to produce than, e.g., an orchestra. Three professional musicians with a diverse were employed for the conversion task: E, who is a conservatory graduate with an extensive in music theory and piano performance, and also specializes in transcribing music; M, who is a professional producer, composer, pianist and audio engineer, who is an expert in musical transcription; and A who is a music producer, editor, and a skilled player of keyboards and other instruments. The task used for comparison was to convert 60 segments of five seconds each to piano. Three varied sources were used. 20 of the segments were from Bach's keyboard works, played on a Harpsichord, and 20 others were from Mozart's 46 symphonies conducted by Karl Böhm, which are orchestral works. The last group of 20 segments was a mix of three different domains that were not encountered during training -Swing Jazz, metal guitar riffs, and instrumental Chinese music. The 60 music segments were encoded by the universal encoder and decoded by the WaveNet trained on Beethoven's piano sonatas, as performed by Daniel Barenboim. In order to compare between the conversions, we employed human evaluation, which is subjective and could be a mix of the assessment of the audio quality and the assessment of the translation itself. This limits the success of the automatic method, since the quality of the algorithm's output is upper bounded by the neural network architecture and cannot match that of a high quality recording. Since there is a trade-off between the fidelity to the original piece and the ability to create audio in the target domain, we present two scores: audio quality of the output piano and a matching score for the translation. While one can argue that style is hard to define and, therefore, such subjective experiments are not well founded, there are many similar MOS experiments in image to image translation, e.g., BID18, and indeed MOS studies are used exactly where the translation metric is perceptual and subjective. Specifically, Mean Opinion Scores (MOS) were collected using the CrowdMOS BID27 package. Two questions were asked: FORMULA0 what is the quality of the audio, and how well does the converted version match the original. The are shown in Tab. 1. It shows that our audio quality is considerably lower than the produced by humans, using a keyboard connected to a computer (which should be rated as near perfect and makes any other audio quality in the MOS experiment pale in comparison). Regarding the translation success, the conversion from Harpsichord is better than the conversion from Orchestra. Surprisingly, the conversion from unseen domains is more successful than both these domains. In all three cases, our system is outperformed by the human musicians, whose conversions will soon be released to form a public benchmark. Lineup experiment In another set of experiments, we evaluate the ability of persons to identify the source musical segment from the conversions. We present, in each test, a set of six segments. One segment is a real segment from a random domain out of the ones used to train our network, and five are the associated translations. We shuffle the segments and ask which is the original one and which are conversions. To equate the quality of the source to that of the translations and prevent identification by quality, we attach the source after passing it through its domain's autoencoder. The translation is perfectly authentic, if the distribution of answers is uniform. However, the task is hard to define. In a first attempt, Amazon Mechanical Turk (AMT) freelancers tended to choose the Mozart domain as the source, regardless of the real source and the presentation order, probably due to its relatively complex nature in comparison to the other domains. This is shown in the confusion matrix of FIG1. We, therefore, asked two amateur musicians (T, a guitarist, and S a dancer and a drummer with a in piano) and the professional musician A (from the first experiment) to identify the source sample out of the six options, based on authenticity. The , in FIG1 show that there is a great amount of confusion. T and A failed in most cases, and A tended to show a similar bias to the AMT freelancers. S also failed to identify the majority of the cases, but showed coherent confusion patterns between pairs of instruments. NSynth pitch experiments NSynth BID5 is an audio dataset containing samples of 1,006 instruments, each sample labeled with a unique pitch, timbre, and envelope. Each sample is a four second monophonic 16kHz snippet, ranging over every pitch of a standard MIDI piano as well as five different velocities. It was not seen during training of our system. We measure the correlation of embeddings retrieved using the encoder of our network across pitch for multiple instruments. The first two columns (from the left hand side) of FIG2 show selfcorrelations, while the third column shows correlation across instruments. As can be seen, the embedding encodes pitch information very clearly, despite being trained on complex polyphonic audio. The cosine similarity between the two instruments for the same pitch is, on average, 0.90-0.95 (mean of the diagonal), depending on the pair of instruments. In order to freely share our trained models and allow for maximal reproducibility, we have retrained the network with data from MusicNet BID33. The following experiments are based on this network and are focused on understanding the properties of the conversion. The description is based on the supplementary media available at musictranslation.github.io.Are we doing more than timbral transfer? Is our system equivalent to pitch estimation followed by rendering with a different instrument, or can it capture stylistic musical elements? We demonstrate that our system does more than timbral transfer in two ways. Consider the conversions presented in supplementary S1, which consist of many conversion examples from each of the domains to every other domain. There are many samples where it is clear that more than timbral transfer is happening. For example, when converting Beethoven's string quartet music to a wind quintet (Sample #30), an ornamentation note is added in the output that is nowhere to be found in the input music; when converting Beethoven's violin sonata to Beethoven's solo piano (Samples #24 and #23), the violin line seamlessly integrated into the piano part; when converting Beethoven's solo piano music to Bach's solo cello (Sample #9), the bass line of the piano is converted to cello. It is perhaps most evident when converting solo piano to piano and violin; an identity transformation would have been a valid translation, but the network adds a violin part to better match the output distribution. To further demonstrate the capabilities of our system, we train a network on two piano domains: MusicNet solo piano recordings of Bach and Beethoven. We reduce the size of the latent space to 8 to limit the ability of the original input to be repeated exactly, thereby encouraging the decoders to be more "creative" than they normally would, with the goal of observing how decoders trained on different training data will use their freedom of expression. The input we employ is a simple MIDI synthesized as a piano. Supplementary S2 presents a clear stylistic difference: one can hear some counterpoint in the Bach sample, whereas the Beethoven output exhibits a more "Sturm und Drang" feeling, indicating that the network learns stylistic elements from the training data. DISPLAYFORM0 Comparison with previous methods We compare our with those of Concatenative Synthesis methods in supplementary S3. To do that, we use our system to translate target files from published of two works in that field, and present the methods' side-by-side. Samples 1 and 2 are compared with the published of BID3, a work comparing several Concatenative Synthesis methods, and uses a violin passage as source audio input. Sample 3 is compared with MATConcat , which uses a corpus of string quartets as a source material. Sample 1 is a fugue performed on a piano. We show that we are able to convincingly produce string quartet and wind ensemble renditions of the piece. To push our model to its boundaries, we also attempt to convert the polyphonic fugue to solo cello, obtaining a rather convincing . We believe that our surpass in naturalness those obtained by concatenative methods. Sample 2 is an orchestra piece, which for our system is data that has never been seen during training. We convert it to piano, solo cello and a wind quintet, achieving convincing , that we believe surpass the concatenative synthesis . Sample 3 is another orchestra piece, which includes a long drum roll, followed by brass instruments. It is not quite well-defined how to convert a drum roll to a string quartet, but we believe our rendition is more coherent. Our method is able to render the brass instruments and orchestral music after the drum roll more convincingly than MATConcat, which mimics the audio volume but loses most musical content. Universality Note that our network has never observed drums, brass instruments or an entire orchestra during training, and, therefore, the of supplementary S3 also serve to demonstrate the versatility of the encoder module ing from our training procedure (and so do those of S2). Supplementary S4 presents more out-of-domain conversion , including other domains from MusicNet, whistles, and even spontaneous hand clapping. The universality property hinges on the success of training a domain-independent representation. As can be seen in the confusion matrices given in FIG3, the domain classification network does not do considerably better than chance when the networks converge. Ablation Analysis We conducted three ablation studies. In the first study, the training procedure did not use the augmentation procedure of Sec. 3.2. This ed in a learning divergence during training, and we were unable to obtain a working model trained without augmentation, despite considerable effort. In order to investigate the option of not using augmentation in a domain where training without it converges, we have applied our method to the task of voice conversion. Our experiments show a clear advantage for applying augmentation, see Appendix A. Additional experiments were conducted, for voice conversion, using the VQ-VAE method of van den BID35.In the second ablation study, the domain classification network was not used (λ = 0). Without requiring that the shared encoder remove domain-specific information from the latent representation of the input, the network learned to simply encode all information in the latent vectors, and all decoders learned to turn this information back to the original waveform. This ed in a model that does not do any conversion at all. Finally, we performed an ablation study on the latent code size, in which we convert a simple MIDI clip to the Beethoven domain and the Bach domain. Samples are available as supplementary S6. As can be heard, a latent dimensionality of 64 tends to reconstruct the input (unwanted memorization). A model with a latent space of 8 (used in S2) performs well. A model with a latent dimensionality of 4 is more creative, less related to the input midi, and also suffers from a reduction in quality. Semantic blending We blend two encoded musical segments linearly in order to check the additivity of the embedding space. For that, we have selected two random five second segments i and j from each domain and embedded both using the encoder, obtaining e i and e j. We then combine the embeddings as follows: starting with 3.5 seconds from e i, we combine the next 1.5 seconds of e i with the first 1.5 seconds of e j using a linear weighting with weights 1−t/1.5 and t/1.5 respectively, where t ∈ [0, 1.5]. We then use the various decoders to generate audio. The are natural and the shift is completely seamless, as far as we observe. See supplementary S5 for samples. The samples also demonstrate that in the scenario we tested, one can alternatively use fade-in and fade-out to create a similar effect. We therefore employ a second network that is used for a related task of voice conversion (see Appendix A) and demonstrate that in the case of voice conversion, latent space embedding is clearly superior to converting the audio itself. These samples can also be found in supplementary S5 for details and samples. Our work demonstrates capabilities in music conversion, which is a high-level task (a terminology that means that they are more semantic than low-level audio processing tasks), and could open the door to other high-level tasks, such as composition. We have initial that we find interesting: by reducing the size of the latent space, the decoders become more "creative" and produce outputs that are natural yet novel, in the sense that the exact association with the original input is lost. This work is part of Adam Polyak's Ph. D thesis research conducted at Tel Aviv University. We further evaluate our method on the task of voice conversion, which is not as challenging as the music conversion task explored in this work. It is, therefore, a convenient test bed when comparing to the VQ-VAE (van den) method, which, as we mention in the paper, did not perform well in our music-based experiments, and which was shown by the authors to work on voice conversion. In addition, as mentioned in Sec. 4.2, successful training on the music domains requires data augmentation. In voice conversion, we were able to successfully train our network even without data augmentation, and we can therefore perform a direction comparison. We apply our method, a variant without data augmentation, and the VQVQE method on three publicly available datasets: "Nancy" from Blizzard 2011 BID15, Blizzard 2013 BID16 and LJ BID11 dataset. The generated samples are obtained by converting an audio produced by the Google Cloud TTS robot to these three voices. The models are evaluated by their quality using the Mean Opinion Score, as obtained with the CrowdMOS BID27 package. As can be seen in Tab. 2, samples generated by our WaveNet autoencoder based method are of higher quality than those of VQ-VAE. A second is that the method trains well in voice conversion, even without the data augmentation. However, this leads to inferior . We slightly modify the WaveNet autoencoder used in our method for the voice conversion task. Specifically, we modify the size of the latent encoding to be in R 48, instead of R 64. The rest of the model details remain the same as in the music translation task. In our implementation of the VQ-VAE, the encoder was composed of 6 one-dimensional convolution layer with a ReLU activation. As in the original paper, the convolutions were with a stride of 2 and kernel size of 4. Therefore, the mu-law quantized waveform is temporally downsampled by ×64. We used a dictionary of 512 vectors in R 128. The obtained quantized encoding is upsampled and serves to condition a decoder which reconstructs the input waveform. Here as well, we follow the original paper and implement a single WaveNet decoder for all three speaker domains, this is achieved by concatenating the quantized encoding with a learned speaker embedding. We train the VQ-VAE using dictionary updates with Exponential Moving Averages (EMA) with a decay parameter of γ = 0.99 and a commitment parameter of β = 1.

An automatic method for converting music between instruments and styles

Represent this text to find a much much longer article about it with say hundreds-thousands of words

We leverage deterministic autoencoders as generative models by proposing mixing functions which combine hidden states from pairs of images. These mixes are made to look realistic through an adversarial framework.


Question: Represent the scientific article to find a short TLDR

Question: Most existing defenses against adversarial attacks only consider robustness to L_p-bounded distortions. In reality, the specific attack is rarely known in advance and adversaries are free to modify images in ways which lie outside any fixed distortion model; for example, adversarial rotations lie outside the set of L_p-bounded distortions. In this work, we advocate measuring robustness against a much broader range of unforeseen attacks, attacks whose precise form is unknown during defense design. We propose several new attacks and a methodology for evaluating a defense against a diverse range of unforeseen distortions. First, we construct novel adversarial JPEG, Fog, Gabor, and Snow distortions to simulate more diverse adversaries. We then introduce UAR, a summary metric that measures the robustness of a defense against a given distortion. Using UAR to assess robustness against existing and novel attacks, we perform an extensive study of adversarial robustness. We find that evaluation against existing L_p attacks yields redundant information which does not generalize to other attacks; we instead recommend evaluating against our significantly more diverse set of attacks. We further find that adversarial training against either one or multiple distortions fails to confer robustness to attacks with other distortion types. These underscore the need to evaluate and study robustness against unforeseen distortions. Neural networks perform well on many benchmark tasks yet can be fooled by adversarial examples or inputs designed to subvert a given model. Adversaries are usually assumed to be constrained by an L ∞ budget (; ;), while other modifications such as adversarial geometric transformations, patches, and even 3D-printed objects have also been considered (; ;). However, most work on adversarial robustness assumes that the adversary is fixed and known in advance. Defenses against adversarial attacks are often constructed in view of this specific assumption . In practice, adversaries can modify and adapt their attacks so that they are unforeseen. In this work, we propose novel attacks which enable the diverse assessment of robustness to unforeseen attacks. Our attacks are varied (§2) and qualitatively distinct from current attacks. We propose adversarial JPEG, Fog, Gabor, and Snow attacks (sample images in Figure 1). We propose an unforeseen attack evaluation methodology (§3) that involves evaluating a defense against a diverse set of held-out distortions decoupled from the defense design. For a fixed, held-out distortion, we then evaluate the defense against the distortion for a calibrated range of distortion sizes whose strength is roughly comparable across distortions. For each fixed distortion, we summarize the robustness of a defense against that distortion relative to a model adversarially trained on that distortion, a measure we call UAR. We provide code and calibrations to easily evaluate a defense against our suite of attacks at https://github.com/iclr-2020-submission/ advex-uar. By applying our method to 87 adversarially trained models and 8 different distortion types (§4), we find that existing defenses and evaluation practices have marked weaknesses. Our show New Attacks JPEG Fog Gabor Snow Figure 1: Attacked images (label "espresso maker") against adversarially trained models with large ε. Each of the adversarial images above are optimized to maximize the classification loss. that existing defenses based on adversarial training do not generalize to unforeseen adversaries, even when restricted to the 8 distortions in Figure 1. This adds to the mounting evidence that achieving robustness against a single distortion type is insufficient to impart robustness to unforeseen attacks (; ; Tramèr &). Turning to evaluation, our demonstrate that accuracy against different L p distortions is highly correlated relative to the other distortions we consider. This suggest that the common practice of evaluating only against L p distortions to test a model's adversarial robustness can give a misleading account. Our analysis demonstrates that our full suite of attacks adds substantive attack diversity and gives a more complete picture of a model's robustness to unforeseen attacks. A natural approach is to defend against multiple distortion types simultaneously in the hope that seeing a larger space of distortions provides greater transfer to unforeseen distortions. Unfortunately, we find that defending against even two different distortion types via joint adversarial training is difficult (§5). Specifically, joint adversarial training leads to overfitting at moderate distortion sizes. In summary, we propose a metric UAR to assess robustness of defenses against unforeseen adversaries. We introduce a total of 4 novel attacks. We apply UAR to assess how robustness transfers to existing attacks and our novel attacks. Our demonstrate that existing defense and evaluation methods do not generalize well to unforeseen attacks. We consider distortions (attacks) applied to an image x ∈ R 3×224×224, represented as a vector of RGB values. Let f: R 3×224×224 → R 100 be a model mapping images to logits 1, and let (f (x), y) denote the cross-entropy loss. For an input x with true label y and a target class y = y, our adversarial attacks attempt to find x such that 1. the attacked image x is obtained by applying a constrained distortion to x, and 2. the loss (f (x), y ) is minimized (targeted attack). Adversarial training is a strong defense baseline against a fixed attack which updates using an attacked image x instead of the clean image x at each training iteration. We consider 8 attacks: L ∞ , L 2 , L 1 , Elastic , JPEG, Fog, Gabor, and Snow. We show sample attacked images in Figure 1 and the corresponding distortions in Figure 2. The JPEG, Fog, L∞ (4.1m, 11.1k, 32) L2 (1.3m, 4.8k, 99) L1 (224k, 2.6k, 218) Elastic (3.1m, 15.2k, 253) New Attacks JPEG (5.4m, 18.7k, 255) Fog (4.1m, 13.2k, 89) Gabor (3.7m, 13.3k, 50) Snow (11.3m, 32.0k, 255) Figure 2: Scaled pixel-level differences between original and attacked images for each attack (label "espresso maker"). The L 1, L 2, and L ∞ norms of the difference are shown after the attack name. Our novel attacks display behavior which is qualitatively different from that of the L p attacks. Attacked images are shown in Figure 1, and unscaled differences are shown in Figure 9, Appendix B.1. Gabor, and Snow attacks are new to this paper, and the L 1 attack uses the Frank-Wolfe algorithm to improve on previous L 1 attacks. We now describe the attacks, whose distortion sizes are controlled by a parameter ε. We clamp output pixel values to. Existing attacks. The L p attacks with p ∈ {1, 2, ∞} modify an image x to an attacked image x = x+δ. We optimize δ under the constraint δ p ≤ ε, where · p is the L p -norm on R 3×224×224. The Elastic attack warps the image by allowing distortions x = Flow(x, V), where V: {1, . . ., 224} 2 → R 2 is a vector field on pixel space, and Flow sets the value of pixel (i, j) to the bilinearly interpolated original value at (i, j) + V (i, j). We construct V by smoothing a vector field W by a Gaussian kernel (size 25 × 25, std. dev. 3 for a 224 × 224 image) and optimize W under W (i, j) ∞ ≤ ε for all i, j. This differs in details from but is similar in spirit. Novel attacks. As discussed in for defense, JPEG compression applies a lossy linear transformation JPEG based on the discrete cosine transform to image space, followed by quantization. The JPEG attack imposes the L ∞ -constraint JPEG(x) − JPEG(x) ∞ ≤ ε on the attacked image x. We optimize z = JPEG(x) and apply a right inverse of JPEG to obtain x. Initialization Optimized Figure 3: Snow before and after optimization. Our novel Fog, Gabor, and Snow attacks are adversarial versions of non-adversarial distortions proposed in the literature. Fog and Snow introduce adversarially chosen partial occlusions of the image resembling the effect of mist and snowflakes, respectively; stochastic versions of Fog and Snow appeared in. Gabor superimposes adversarially chosen additive Gabor noise onto the image; a stochastic version appeared in. These attacks work by optimizing a set of parameters controlling the distortion over an L ∞ -bounded set. Specifically, values for the diamond-square algorithm, sparse noise, and snowflake brightness (Figure 3) are chosen adversarially for Fog, Gabor, and Snow, respectively. Optimization. To handle L ∞ and L 2 constraints, we use randomly-initialized projected gradient descent (PGD), which optimizes the distortion δ by gradient descent and projection to the L ∞ and L 2 balls . For L 1 constraints, this projection is more difficult, and previous L 1 attacks resort to heuristics (; Tramèr &). We use the randomly- Figure 4: Accuracies of L 2 and Elastic attacks at different distortion sizes against a ResNet-50 model adversarially trained against L 2 at ε = 9600 on ImageNet-100. At small distortion sizes, the model appears to defend well against Elastic, but large distortion sizes reveal a lack of transfer. initialized Frank-Wolfe algorithm , which replaces projection by a simpler optimization of a linear function at each step (pseudocode in Appendix B.2). We now propose a method to assess robustness against unforeseen distortions, which relies on evaluating a defense against a diverse set of attacks that were not used when designing the defense. Our method must address the following issues: • The range of distortion sizes must be wide enough to avoid the misleading behavior in which robustness appears to transfer at low distortion sizes but not at high distortion sizes (Figure 4); • The set of attacks considered must be sufficiently diverse. We first provide a method to calibrate distortion sizes and then use it to define a summary metric that assesses the robustness of a defense against a specific unforeseen attack. Using this metric, we are able to assess diversity and recommend a set of attacks to evaluate against. Calibrate distortion size using adversarial training. As shown in Figure 4, the correlation between adversarial robustness against different distortion types may look different for different ranges of distortion sizes. It is therefore critical to evaluate on a wide enough range of distortion size ε. We choose the minimum and maximum distortion sizes ε using the following principles; sample images at ε min and ε max are shown in Figure 5b. 1. The minimum distortion size ε min is the largest ε for which the adversarial validation accuracy against an adversarially trained model is comparable to that of a model trained and evaluated on unattacked data (for ImageNet-100, within 3 of 87). 2. The maximum distortion size ε max is the smallest ε which either (a) yields images which confuse humans when applied against adversarially trained models or (b) reduces accuracy of adversarially trained models (ATA below) to below 25. In practice, we select ε min and ε max according to these criteria from a sequence of ε which is geometrically increasing with ratio 2. We choose to evaluate against adversarially trained models because attacking against strong defenses is necessary to produce strong visual distortions (Figure 5a). We introduce the constraint that humans recognize attacked images at ε max because we find cases for L 1, Fog, and Snow where adversarially trained models maintain non-zero accuracy for distortion sizes producing images incomprehensible to humans. An example for Snow is shown in Figure 5b. UAR: an adversarial robustness metric. We measure a model's robustness against a specific distortion type by comparing it to adversarially trained models, which represent an approximate ceiling on performance with prior knowledge of the distortion type. For distortion type A and size ε, let the Adversarial Training Accuracy ATA(A, ε) be the best adversarial accuracy on the test set that can be achieved by adversarially training a specific architecture (ResNet-50 for ImageNet-100, ResNet-56 for CIFAR-10) against A. other than ResNet-50 or ResNet-56, we recommend using the ATA values computed with these architectures to allow for uniform comparisons. Given a set of distortion sizes {ε 1, . . ., ε n}, we propose the summary metric UAR (Unforeseen Attack Robustness) normalizing the accuracy of a model M against adversarial training accuracy: Here Acc(A, ε, M) is the accuracy of M against distortions of type A and magnitude ε. We expect most UAR scores to be lower than 100 against held-out distortion types, as an UAR score greater than 100 means that a defense is outperforming an adversarially trained model on that distortion. The normalizing factor in is required to keep UAR scores roughly comparable between distortions, as different distortions can have different strengths as measured by ATA at the chosen distortion sizes. Having too many or too few ε k values in a certain range may cause an attack to appear artificially strong or weak because the functional relation between distortion size and attack strength (measured by ATA) varies between attacks. To make UAR roughly comparable between distortions, we evaluate at ε increasing geometrically from ε min to ε max by factors of 2 and take the subset of ε whose ATA values have minimum 1 -distance to the ATA values of the L ∞ attack at geometrically increasing ε. For example, when calibrating Elastic in Table 1, we start with ε min = 0.25 and ε max = 16 based on our earlier criteria. We then compute the ATAs at the 7 geometrically increasing ε values ε ∈ {0.25, 0.5, 1, 2, 4, 8, 16}. We consider size-6 subsets of those ATA values, view them as vectors of length 6 in decreasing order, and compute the 1 -distance between these vectors and the vector for L ∞ shown in the first row of Table 1. Finally, we select the ε values for Elastic in Table 1 as those corresponding to the size-6 subset with minimum 1 -distance to the vector for L ∞. For our 8 distortion types, we provide reference values of ATA(A, ε) on this calibrated range of 6 distortion sizes on ImageNet-100 (Table 1, §4) and CIFAR-10 (Table 3, Appendix C.3.2). This allows UAR computation for a new defense using 6 adversarial evaluations and no adversarial training, reducing computational cost from 192+ to 6 NVIDIA V100 GPU-hours on ImageNet-100. Evaluate against diverse distortion types. Since robustness against different distortion types may have low or no correlation (Figure 6b), measuring performance on different distortions is important to avoid overfitting to a specific type, especially when a defense is constructed with it in mind (as with adversarial training). Our in §4 demonstrate that choosing appropriate distortion types to evaluate against requires some care, as distortions such as L 1, L 2, and L ∞ that may seem different can actually have highly correlated scores against defenses (see Figure 6). We instead recommend evaluation against our more diverse attacks, taking the L ∞, L 1, Elastic, Fog, and Snow attacks as a starting point. We apply our methodology to the 8 attacks in §2 using models adversarially trained against these attacks. Our reveal that evaluating against the commonly used L p -attacks gives highly correlated information which does not generalize to other unforeseen attacks. Instead, they suggest that evaluating on diverse attacks is necessary and identify a set of 5 attacks with low pairwise robustness transfer which we suggest as a starting point when assessing robustness to unforeseen adversaries. Dataset and model. We use two datasets: CIFAR-10 and ImageNet-100, the 100-class subset of ImageNet-1K containing every 10 th class by WordNet ID order. We use ResNet-56 for CIFAR-10 and ResNet-50 as implemented in torchvision for ImageNet-100 . We give training hyperparameters in Appendix A. Adversarial training and evaluation procedure. We construct hardened models using adversarial training . To train against attack A, for each mini-batch of training images, we select a uniform random (incorrect) target class for each image. For maximum distortion size ε, we apply the targeted attack A to the current model with distortion size ε ∼ Uniform(0, ε) and update the model with a step of stochastic gradient descent using only the ing adversarial images (no clean images). The random size scaling improves performance especially against smaller distortions. We use 10 optimization steps for all attacks during training except for Elastic, where we use 30 steps due to its more difficult optimization problem. When PGD is used, we use step size ε/ √ steps, the optimal scaling for non-smooth convex functions (; 1983). We adversarially train 87 models against the 8 attacks from §2 at the distortion sizes described in §3 and evaluate them on the ImageNet-100 and CIFAR-10 validation sets against 200-step targeted attacks with uniform random (incorrect) target class. This uses more steps for evaluation than train- Fog ε = 8192 Gabor ε = 3200 (a) UAR scores for adv. trained defenses (rows) against attacks (columns) on ImageNet-100. See Figure 12 for more ε values and Appendix C.3.2 for CIFAR-10 . ing per best practices . We use UAR to analyze the in the remainder of this section, directing the reader to Figures 10 and 11 (Appendix C.2) for exhaustive and to Appendix D for checks for robustness to random seed and number of attack steps. Existing defense and evaluation methods do not generalize to unforeseen attacks. The many low off-diagonal UAR scores in Figure 6a make clear that while adversarial training is a strong baseline against a fixed distortion, it only rarely confers robustness to unforeseen distortions. Notably, we were not able to achieve a high UAR against Fog except by directly adversarially training against it. Despite the general lack of transfer in Figure 6a, the fairly strong transfer between the L p -attacks is consistent with recent progress in simultaneous robustness to them . Figure 6b shows correlations between UAR scores of pairs of attacks A and A against defenses adversarially trained without knowledge 3 of A or A. The demonstrate that defenses trained without knowledge of L p -attacks have highly correlated UAR scores against the different L p attacks, but this correlation does not extend to their evaluations against other attacks. This suggests that L pevaluations offer limited diversity and may not generalize to other unforeseen attacks. The L ∞, L 1, Elastic, Fog, and Snow attacks offer greater diversity. Our on L p -evaluation suggest that more diverse attack evaluation is necessary for generalization to unforeseen attacks. As the unexpected correlation between UAR scores against the pairs (Fog, Gabor) and (JPEG, L 1) in Figure 6b demonstrates, even attacks with very different distortions may have correlated behaviors. Considering all attacks in Figure 6 together in signficantly more diversity, which we suggest for evaluation against unforeseen attacks. We suggest the 5 attacks (L ∞, L 1, Elastic, Fog, and Snow) with low UAR against each other and low correlation between UAR scores as a good starting point. A natural idea to improve robustness against unforeseen adversaries is to adversarially train the same model against two different types of distortions simultaneously, with the idea that this will cover a larger portion of the space of distortions. We refer to this as joint adversarial training (; Tramèr &). For two attacks A and A, at each training step, we compute the attacked image under both A and A and backpropagate with respect to gradients induced by the image with greater loss. This corresponds to the "max" loss described in Tramèr &. We jointly train models for (L ∞, L 2), (L ∞, L 1), and (L ∞, Elastic) using the same setup as before Normal Training L∞ ε = 16, L1 ε = 612000 Normal Training Transfer for jointly trained models. Figure 7 reports UAR scores for jointly trained models using ResNet-50 on ImageNet-100; full evaluation accuracies are in Figure 19 (Appendix E). Comparing to Figure 6a and Figure 12 (Appendix E), we see that, relative to training against only L 2, joint training against (L ∞, L 2) slightly improves robustness against L 1 without harming robustness against other attacks. In contrast, training against (L ∞, L 1) is worse than either training against L 1 or L ∞ separately (except at small ε for L 1). Training against (L ∞, Elastic) also performs poorly. Joint training and overfitting. Jointly trained models achieve high training accuracy but poor validation accuracy (Figure 8) that fluctuates substantially for different random seeds (Table 4, Appendix E.2). Figure 8 shows the overfitting behavior for (L ∞, Elastic): L ∞ validation accuracy decreases significantly during training while training accuracy increases. This contrasts with standard adversarial training (Figure 8), where validation accuracy levels off as training accuracy increases. Overfitting primarily occurs when training against large distortions. We successfully trained against the (L ∞, L 1) and (L ∞, Elastic) pairs for small distortion sizes with accuracies comparable to but slightly lower than observed in Figure 11 for training against each attack individually (Figure 18, Appendix E). This agrees with behavior reported by Tramèr & on CIFAR-10. Our intuition is that harder training tasks (more diverse distortion types, larger ε) make overfitting more likely. We briefly investigate the relation between overfitting and model capacity in Appendix E.3; validation accuracy appears slightly increased for ResNet-101, but overfitting remains. We have seen that robustness to one attack provides limited information about robustness to other attacks, and moreover that adversarial training provides limited robustness to unforeseen attacks. These suggest a need to modify or move beyond adversarial training. While joint adversarial training is one possible alternative, our show it often leads to overfitting. Even ignoring this, it is not clear that joint training would confer robustness to attacks outside of those trained against. Evaluating robustness has proven difficult, necessitating detailed study of best practices even for a single fixed attack . We build on these best practices by showing how to choose and calibrate a diverse set of unforeseen attacks. Our work is a supplement to existing practices, not a replacement-we strongly recommend following the guidelines in and in addition to our recommendations. Some caution is necessary when interpreting specific numeric in our paper. Many previous implementations of adversarial training fell prone to gradient masking , with apparently successful training occurring only recently . While evaluating with moderately many PGD steps helps guard against this, shows that an L ∞ -trained model that appeared robust against L 2 actually had substantially less robustness when evaluating with 10 6 PGD steps. If this effect is pervasive, then there may be even less transfer between attacks than our current suggest. For evaluating against a fixed attack, and can be seen as existing alternatives to UAR. They work by estimating "empirical robustness", which is the expected minimum ε needed to successfully attack an image. However, these apply only to attacks which optimize over an L p -ball of radius ε, and CLEVER can be susceptible to gradient masking. In addition, empirical robustness is equivalent to linearly averaging accuracy over ε, which has smaller dynamic range than the geometric average in UAR. Our add to a growing line of evidence that evaluating against a single known attack type provides a misleading picture of the robustness of a model (; ; ; Tramèr & ;). Going one step further, we believe that robustness itself provides only a narrow window into model behavior; in addition to robustness, we should seek to build a diverse toolbox for understanding machine learning models, including visualization , disentanglement of relevant features , and measurement of extrapolation to different datasets or the long tail of natural but unusual inputs . Together, these windows into model behavior can give us a clearer picture of how to make models reliable in the real world. For ImageNet-100, we trained on machines with 8 NVIDIA V100 GPUs using standard data augmentation. Following best practices for multi-GPU training , we ran synchronized SGD for 90 epochs with batch size 32×8 and a learning rate schedule with 5 "warm-up" epochs and a decay at epochs 30, 60, and 80 by a factor of 10. Initial learning rate after warm-up was 0.1, momentum was 0.9, and weight decay was 10 −4. For CIFAR-10, we trained on a single NVIDIA V100 GPU for 200 epochs with batch size 32, initial learning rate 0.1, momentum 0.9, and weight decay 10 −4. We decayed the learning rate at epochs 100 and 150. We show the images corresponding to the ones in Figure 2, with the exception that they are not scaled. The non-scaled images are shown in Figure 9. We chose to use the Frank-Wolfe algorithm for optimizing the L 1 attack, as Projected Gradient Descent would require projecting onto a truncated L 1 ball, which is a complicated operation. In contrast, Frank-Wolfe only requires optimizing linear functions g x over a truncated L 1 ball; this can be done by sorting coordinates by the magnitude of g and moving the top k coordinates to the boundary of their range (with k chosen by binary search). This is detailed in Algorithm 1. We will present with two additional versions of the JPEG attack which impose L 1 or L 2 constraints on the attack in JPEG-space instead of the L ∞ constraint discussed in Section 2. To avoid confusion, in this appendix, we denote the original JPEG attack by L ∞ -JPEG and these variants by New Attacks JPEG (5.4m, 18.7k, 255) Fog (4.1m, 13.2k, 89) Gabor (3.7m, 13.3k, 50) Snow (11.4m, 32.0k, 255) Figure 9: Differences of the attacked images and original image for different attacks (label "espresso maker"). The L 1, L 2, and L ∞ norms of the difference are shown in parentheses. As shown, our novel attacks display qualitatively different behavior and do not fall under the L p threat model. These differences are not scaled and are normalized so that no difference corresponds to white. Algorithm 1 Pseudocode for the Frank-Wolfe algorithm for the L 1 attack. s k ← index of the coordinate of g by with k th largest norm 9: end for 10: S k ← {s 1, . . ., s k}. 12: else 16: end if end for 19: 20: 21: Averagex with previous iterates 31: end for 32:x ← x (T) we find that they have extremely similar , so we omit L 1 -JPEG in the full analysis for brevity and visibility. Calibration values for these attacks are shown in Table 2. We show the full of all adversarial attacks against all adversarial defenses for ImageNet-100 in Figure 11. As described, the L p attacks and defenses give highly correlated information on heldout defenses and attacks respectively. Thus, we recommend evaluating on a wide range of distortion types. Full UAR scores are also provided for ImageNet-100 in Figure 12. We further show selected in Figure 13. As shown, a wide range of ε is required to see the full behavior. Attack (adversarial training) Normal training Gabor ε = 6.25 Gabor ε = 12.5 Gabor ε = 25 Gabor ε = 400 Gabor ε = 800 Gabor ε = 1600 Figure 13: Adversarial accuracies of attacks on adversarially trained models for different distortion sizes on ImageNet-100. For a given attack ε, the best ε to train against satisfies ε > ε because the random scaling of ε during adversarial training ensures that a typical distortion during adversarial training has size smaller than ε. We show the of adversarial attacks and defenses for CIFAR-10 in Figure 14. We experienced difficulty training the L 2 and L 1 attacks at distortion sizes greater than those shown and have omitted those runs, which we believe may be related to the small size of CIFAR-10 images. The ε calibration procedure for CIFAR-10 was similar to that used for ImageNet-100. We started with the perceptually small ε min values in Table 3 and increased ε geometrically with ratio 2 until adversarial accuracy of an adversarially trained model dropped below 40. Note that this threshold Table 3 and Figure 15. We omitted calibration for the L 2 -JPEG attack because we chose too small a range of ε for our initial training experiments, and we plan to address this issue in the future. We replicated our for the first three rows of Figure 11 with different random seeds to see the variation in our . As shown in Figure 16, deviations in are minor. We replicated the in Figure 11 with 50 instead of 200 steps to see how the changed based on the number of steps in the attack. As shown in Figure 17, the deviations are minor. We show the evaluation accuracies of jointly trained models in Figure 18. We show all the attacks against the jointly adversarially trained defenses in Figure 19. In Table 4, we study the dependence of joint adversarial training to random seed. We find that at large distortion sizes, joint training for certain pairs of distortions does not produce consistent over different random initializations. Table 4: Train and val accuracies for joint adversarial training at large distortion are dependent on seed. For train and val, ε is chosen uniformly at random between 0 and ε, and we used 10 steps for L ∞ and L 1 and 30 steps for elastic. Single adversarial training baselines are also shown. As a first test to understand the relationship between model capacity and overfitting, we trained ResNet-101 models using the same procedure as in Section 5. Briefly, overfitting still occurs, but ResNet-101 achieves a few percentage points higher than ResNet-50. We show the training curves in Figure 20 and the training and validation numbers in Table 5. "Common" visual corruptions such as (non-adversarial) fog, blur, or pixelation have emerged as another avenue for measuring the robustness of computer vision models (; ;). Recent work suggests that robustness to such common corruptions is linked to adversarial robustness and proposes corruption robustness as an easily computed indicator of adversarial robustness . We consider this alternative to our methodology by testing corruption robustness of our models on the ImageNet-C benchmark. Experimental setup. We evaluate on the 100-class subset of the corruption robustness benchmark ImageNet-C introduced in with the same classes as ImageNet-100, which we call ImageNet-C-100. It is the ImageNet-100 validation set with 19 common corruptions at 5 severities. We use the JPEG files available at https://github.com/hendrycks/ robustness. We show average accuracies by distortion type in Figure 21. Adversarial training against small distortions increases corruption robustness. The first column of each block in Figure 21 shows that training against small adversarial distortions generally increases average accuracy compared to an undefended model. However, training against larger distortions often decreases average accuracy, largely due to the ing decrease in clean accuracy. Adversarial distortions and common corruptions can affect defenses differently. Our L p -JPEG and elastic attacks are adversarial versions of the corresponding common corruptions. While training against adversarial JPEG at larger ε improves robustness against adversarial JPEG attacks (Figure 12 in Appendix C.2), Figure 21 shows that robustness against common JPEG corruptions decreases as we adversarially train against JPEG at larger ε, though it remains better than for normally trained models. Similarly, adversarial Elastic training at large ε begins to hurt robustness to its common counterpart. This is likely because common corruptions are easier than adversarial distortions, hence the increased robustness does not make up for the decreased clean accuracy. We show sample images of our attacks against undefended models trained in the normal way in Figure 22. Normal training Elastic ε = 0.125 Figure 15: UAR scores on CIFAR-10. Displayed UAR scores are multiplied by 100 for clarity. Attack (evaluation) L2 ε = 150 L2 ε = 300 L2 ε = 600 L2 ε = 1200 L2 ε = 2400 L2 ε = 4800 Normal training B ri g h tn e ss C o n tr a st E la st ic P ix e la te J P E G S p e c k le N o is e G a u ss ia n B lu r S p a tt e r S a tu ra te Normal training L∞ ε = 1 L∞ ε = 2 L∞ ε = 4 L∞ ε = 8 L∞ ε = 16 L∞ ε = 32 L2 ε = 150 L2 ε = 300 L2 ε = 600 L2 ε = 1200 L2 ε = 2400 L2 ε = 4800 L1 ε = 9562.44 L1 ε = 19125 L1 ε = 76500 L1 ε = 153000 L1 ε = 306000 L1 ε = 612000

Represent this text to find a much much longer article about it with say hundreds-thousands of words!

We propose several new attacks and a methodology to measure robustness against unforeseen adversarial attacks.

Redistributing and growing weights according to the momentum magnitude enables the training of sparse networks from random initializations that can reach dense performance levels with 5% to 50% weights while accelerating training by up to 5.6x.