Question: represent the article for finding a single-sentence tldr.

Question: In this paper, we propose an improved quantitative evaluation framework for Generative Adversarial Networks (GANs) on generating domain-specific images, where we improve conventional evaluation methods on two levels: the feature representation and the evaluation metric. Unlike most existing evaluation frameworks which transfer the representation of ImageNet inception model to map images onto the feature space, our framework uses a specialized encoder to acquire fine-grained domain-specific representation. Moreover, for datasets with multiple classes, we propose Class-Aware Frechet Distance (CAFD), which employs a Gaussian mixture model on the feature space to better fit the multi-manifold feature distribution. Experiments and analysis on both the feature level and the image level were conducted to demonstrate improvements of our proposed framework over the recently proposed state-of-the-art FID method. To our best knowledge, we are the first to provide counter examples where FID gives inconsistent with human judgments. It is shown in the experiments that our framework is able to overcome the shortness of FID and improves robustness. Code will be made available. Generative Adversarial Networks (GANs) have shown outstanding abilities on many computer vision tasks including generating domain-specific images BID7, style transfer, super resolution BID20, etc. The basic idea of GANs is to hold a two-player game between generator and discriminator, where the discriminator aims to distinguish between real and fake samples while the generator tries to generate samples as real as possible to fool the discriminator. Researchers have been continuously exploring better GAN architectures. However, developing a widely-accepted GAN evaluation framework remains to be a challenging topic BID35. Due to a lack of GAN benchmark , newly proposed GAN variants are validated on different evaluation frameworks and therefore incomparable. Because human judgements are inherently limited by manpower resource, good quantitative evaluation frameworks are of very high importance to guide future research on designing, selecting, and interpreting GAN models. There have been varieties of efforts on designing sample-based evaluation for GANs on its ability of generating domain-specific images. The goal is to measure the distance between the generated samples and the real in the dataset. Most existing methods utilized the ImageNet BID29 inception model to map images onto the feature space. The most widely used criteria is probably the Inception Score BID31, which measures the distance via Kullback-Leiber Divergence (KLD). However, it is probability based and is unable to report overfitting. Recently, Frechet Inception Distance (FID) was proposed BID11 on improving Inception Score. It directly measures Frechet Distance on the feature space with the Gaussian assumption. It has been proved that FID is far better than Inception Score BID13 BID15 BID24. However, we argue that assuming normality on the whole feature distribution may lose class information on labeled datasets. In this work, we propose an improved quantitative sample-based evaluating criteria. We improve conventional evaluation methods on two levels: the feature representation and the evaluation metric. Unlike most existing methods including the Inception Score BID31 and FID BID11, our framework uses a specialized encoder trained on the dataset to get domain-specific representation. We argue that applying the ImageNet model to either labeled or unlabeled datasets is ineffective. Moreover, we propose Class-Aware Frechet Distance (CAFD) in our framework to measure the distribution distance of each class (mode) respectively on the feature space to include class information. Instead of the single Gaussian assumption, we employ a Gaussian mixture model (GMM) to better fit the feature distribution. We also include KL divergence (KLD) between mode distribution of real data and generated samples into the framework to help detect mode dropping. Experiments and analysis on both the feature level and the image level were conducted to demonstrate the improved effectiveness of our proposed framework. To our best knowledge, we are the first BID4 to provide counter examples where FID is inconsistent with human judgements (See FIG0). It is shown in the experiments that our framework is able to overcome the shortness of existing methods. Evaluation Methods. Several GAN evaluation methods have been proposed by researchers. While model-based methods including Parzen window estimation and the annealed importance sampling (AIS) BID36 ) require either density estimation or observation on the inner structure of the decoder, model-agnostic methods BID11 BID31 BID15 BID23 are more popular in the GAN community. These methods are sample based. Most of them map images onto the feature space via an ImageNet pretrained model and measure the similarity of the distribution between the dataset and the generated data. Maximum mean discrepancy (MMD) was proposed by and it has been further used in classifier two-sample tests BID23, where statistical hypothesis testing is used to assess whether two sample sets are from the same distribution. Inception Score BID31, along with its improved version Mode Score, was the most widely used metric in the last two years. FID BID11 was proposed on improving the Inception Score. Recently, several interesting methods were also proposed including classification accuracy BID33, precisionrecall measuring BID30 and skill rating BID26. These metrics give complementary perspectives towards sample-based methods. Studies on Existing Frameworks. It is common BID2 in the literature to see algorithms which use existing metrics to optimize early stopping, hyperparameter tuning, and even model architecture. Thus, comparison and analysis on previous evaluation methods have been attracting more and more attention recently BID35 BID13 BID15 BID24. While Inception Score was the most popular metric in the last two years, it was believed to be misleading in recent literature BID11 BID13 BID24 BID4 BID2. Applying the ImageNet model to encode features in Inception Score is ineffective BID35 BID2 BID28. The recently proposed FID has been proved to be far better than Inception Score BID11 BID13 BID15. And its robustness was experimentally demonstrated recently in a technical report BID24. However, we argue that FID still has problems and provide counter examples where FID gives inconsistent with human judgements. Moreover, we propose an improved version of evaluation which overcomes its shortness. The evaluation problem can be formulated as modeling the distance between two distributions P r and P g, where P r denotes the distribution of real samples in the dataset and P g denotes the distributions of new samples generated by GAN models. The main difficulties for GANs on generating domain-specific images can be summarized into three types below.• Lack of generating ability. Either the generator cannot generate useful samples or the GAN training cannot diverge.• Mode collapse. Different modes collapse to a new mixed mode in the generated samples. (e.g. An animal resembling both a horse and a deer.)• Mode dropping. Only part of the modes in the dataset are generated while some modes are implicitly ignored. (e.g. The handwritten 5 can hardly be generated by GAN trained on MNIST.) Therefore, a good evaluation framework should be consistent to human judgements, penalize on mode collapse and mode dropping. Most of the conventional methods utilized an ImageNet pretrained inception model to map images onto the feature space. Inception Score, which was originally formulated as Eq. FORMULA0, ignored information in the dataset completely. Thus, its original formulation was considered to be relatively misleading. DISPLAYFORM0 The Mode Score was proposed to overcome this shortness. Its formulation is shown in Eq.. By including the prior distribution of the ground truth labels, Mode Score improved Inception Score on reporting mode dropping. DISPLAYFORM1 FID BID11, which was formulated in Eq., was proposed on improving Inception Score BID31. DISPLAYFORM2 (µ g, C g), (µ r, C r) are the first-order and second-order statistics for generated samples and real data respectively. Unlike the previous two metrics which are probability-based, FID directly measures Frechet distance on the feature space. It uses an ImageNet model for encoding features and assumes normality on the whole feature distribution. FID was believed to be better than Inception Score BID13 BID15 BID24. However, we argue that FID still has two major problems (See Section 3.1 and 3.2). As both Inception Score BID31 and Mode Score ) is probabilitybased, applying the ImageNet pretrained model on non-ImageNet dataset is relatively meaningless. This misuse of representation on Inception Score was mentioned previously BID28. However, we argue that applying the ImageNet model to map the generated images to the feature space in FID can also be misleading. While both of the BID2 BID28 mentioned that applying the ImageNet pretrained model to the probability-based metric Inception Score BID31 ) is inadequate, the trend for applying it to feature-based metric such as FID BID11 ) is widely followed. BID2 pointed out that because classes are unmatched, the p(y|x) and p(y *) in the formulation of Inception Score are meaningless. However, we argue that applying the ImageNet model for mapping the generated images to the feature space in FID can also be misleading for the two reasons below. First, On labeled datasets with multiple classes, the class labels unmatch those in ImageNet. For example, the class'Bird' in CIFAR-10 (BID19) is divided into several sophisticated category labels in ImageNet. This will make the CNN representations trained on ImageNet is either meaningless or over-complicated. Specifically, some features distinguishing the "acoustic guitar" from "electric guitar" are hardly useful on CIFAR-10 while fine-grained features distinguishing "African hunting dog" from "Cape hunting dog" (which all belong to the category "dog" in CIFAR-10) are not needed as well. On unlabeled datasets with images from a single class such as CelebA, applying the ImageNet inception model is also inappropriate. The categories of ImageNet labels are so sophisticated that the trained model needs to encode diverse features on various objects. However, this will get encoded features limited to a relatively low-dimensional subspace lack of fine-grained information. For example, the ImageNet models can hardly distinguish different faces. In Section 5.1, we designed experiments on both the feature level and the image level to demonstrate the effects of using different representations. We argue that the single Gaussian assumption in FID is over-simplified. As the training decreases intra-class distance and increases inter-class distance, the features are distributed in groups by their class labels. Thus, we propose that on datasets with multiple classes, the feature distribution is better fitted by a Gaussian mixture model. Considering the specific Gaussian mixture model where x ∼ N (µ i, C i) with probability p i, we can derive the first and second moment of the feature distribution in Eq. and Eq.. DISPLAYFORM0 It should be noted that when the feature is n-dimensional and there are K classes in total, there are a total of K(n 2 +n 2 + n + 1) variables in the model. However, directly modeling the whole distribution Gaussian as in FID will in n 2 +n 2 + n degrees of freedom, which is a relatively small number. Thus, FID detects mode-related problems in an implicit way. Either simply dropping a mode or linearly combining images increases FID by unintentionally changing the mean µ. However, FID gets to be misleading when the deficiency type becomes more complicated (See FIG1 . As discussed in Section 3.1, applying the ImageNet inception model to either labeled or unlabeled datasets is ineffective. We argue that a specialized domain-specific encoder should be used for sample-based evaluation. While the features encoded by the ImageNet model are limited within a low-dimensional subspace, the domain-specific model could encode more fine-grained information, making the encoded features much more effective. Specifically, we propose to use the widely used variational autoencoder (VAE) BID17 to acquire the specialized embedding for a specific dataset. In labeled datasets, we can add a cross-entropy loss for training the VAE model. In Section 5.1, we show that simply training an autoencoder can already get better domain-specific representations on CelebA. Before introducing our improved evaluation metric, we would firstly take a step back towards existing popular metrics. Both Inception Score BID31 and Mode Score measure distance between probability distribution while FID BID11 directly measures distance on the feature space. Probability-based metrics better handle mode-related problems (with the correct use of a domain-specific encoder), while directly measuring distance between features better models the generating ability. In fact, we believe these two perspectives are complementary. Thus, we propose a class-aware metric on the feature space to combine the two perspectives together. For datasets with multiple classes, the feature distribution is better fit with mixture Gaussian (See Section 3.2). Thus, we propose Class-Aware Frechet Distance (CAFD) to include class information. Specifically, we compute probability-based Frechet Distance between real data and generated samples in each class respectively. class 0 1 2 3 4 5 dist 64.8 ± 0.5 18.9 ± 0.2 80.5 ± 1.1 81.3 ± 0.3 64.5 ± 0.6 79.0 ± 0.4 class 6 7 8 9 average dist 65.2 ± 0.3 46.8 ± 0.3 90.4 ± 0.3 59.8 ± 0.2 65.1 ± 0.4As previously discussed in Section 4.1, we train a domain-specific VAE along with the cross entropy on datasets with multiple classes and use its learned representations. In our evaluation framework, we also made use of the predicted probability p(y|x). To calculate the expected mean of each class in a specific set S of generated samples, we can derive the formulation below in Eq.. DISPLAYFORM0 where DISPLAYFORM1 Similarly, The covariance matrix in each class is shown in Eq.. DISPLAYFORM2 We compute Frechet distance in each of the K classes and average the to get Class-Aware Frechet Distance (CAFD) in Eq.. DISPLAYFORM3 This improved form based on mixture Gaussian assumption can better evaluate the actual distance compared to the original FID. Moreover, when CAFD is applied to evaluating a specific GAN model, we could get better class-aware understanding towards the generating ability. For example, as shown in TAB0, the selected model generates digit 1 well but struggles on other classes. This information will provide guidance for researchers on how well their generative models perform on each mode and may explain what specific problems exist. As both FID and CAFD aim to model how well domain-specific images are generated, they are not designed to deal with mode dropping, where some of the modes are missed in the generated samples. Thus, motivated by Mode Score , we propose that KL divergence KL(p(y *)||p(y)) should be included as auxiliary scores into the evaluation framework. To sum up, the correct use of encoder, the CAFD and the KL divergence term combine for a complete sample-based evaluation framework. Our proposed method combines the advantages of Inception Score BID31, Mode Score and FID BID11 and overcomes their shortness. Our method is sensitive to different representations. Different selection of encoders can in changes on the evaluation . Experiments in Section 5.1 demonstrate that the ImageNet inception model will give misleading (See FIG0 . Thus, a domain-specific encoder should be used in each evaluation pipeline. Because the representation is not fixed, the correct use (with In this section, we study the representation for mapping the generated images onto the feature space. As discussed in Section 4.1, applying the pretrained ImageNet inception model to sample-based evaluation methods is inappropriate. We firstly investigated the features generated by different encoders on CelebA, which is a widely used dataset containing more than 200k face images. Then, we gave an intuitive demonstration where FID BID11 using ImageNet pretrained representations gives inconsistent with human judgements. We give two proposals of domain-specific encoders in the experiment: an autoencoder and a VAE BID17 . Both proposed encoders share a similar network architecture which is the inverse structure of the 4-conv DCGAN . The embedding is dimensioned 2048, which is the same as the dimension of ImageNet features. We train both models for 25 epochs. The loss weight of the KLD term in VAE is 1e-5. We conducted principle component analysis (PCA) on three feature sets encoded on CelebA: 1) ImageNet inception model. 2) proposed autoencoder 3) proposed VAE. TAB1 shows the percent of explained variance on the first 5 components. Although the ImageNet model should have much greater representation capability than the 4-conv encoder, its first two components has much higher explained variance (9.35% and 7.04%). This supports our claim that the features encoded by ImageNet are limited in a low-dimensional subspace. It can be also noted that VAE better makes use of the feature space compared to the naive autoencoder. To better demonstrate the deficiency of the ImageNet model, we performed three different types of adjustments on the first 10,000 images on CelebA: a) Random noise uniformly distributed in [-33,33] was applied on each pixel. b) Each image was divided into 8x8=64 regions and seven of them were sheltered by a pixel sampled from the face. c) Each image was first divided into 4x4=16 regions and random exchanges were performed twice.. The ImageNet inception model fails to encode fine-grained features on faces. a) Random noise uniformly distributed in [-33,33] was applied on each pixel. b) Each image was divided into 8x8=64 regions and seven of them were sheltered by a pixel sampled from the face. c) Each image was first divided into 4x4=16 regions and random exchanges were performed twice. Results are shown in FIG0. With the ImageNet inception model, it is obvious that FID gave inconsistent with human judgements (See TAB4). In fact, when similar adjustments were conducted with the overall color maintained, FID fluctuated within only a small range. The ImageNet model mainly extracts general features on color, shape to better classify objects in the world while domain-specific facial textures cannot be well represented. For comparison, we applied the trained autoencoder and VAE onto the case. Also, we tried to apply the representation of the discriminator after GAN training, which was previously proposed in. Specifically, we use the features right before the final fc layer for the discriminator. Results are shown in TAB2. It is shown that only representations derived from the domain-specific encoder including the autoencoder and VAE are effective and give consistent with human judgements. The discriminator which learns to discriminate fake samples from the real cannot learn good representation for distance measurement. Thus, for datasets where images are from a single class such as CelebA and LSUN Bedrooms BID38, the representation should be acquired via training a domain-specific encoder such as a VAE. In this way our sample-based evaluation employs specialized representations, which can provide more fine-grained information related to the specific domain. In this section, we used the domain-specific representations and studied the improvements of the evaluation metric CAFD proposed in our framework against the state-of-the-art metric FID BID11. In datasets with multiple classes, the Gaussian mixture model in CAFD will better fit the feature distribution. First, we performed user study to demonstrate the improved consistency of our method. Then, An intuitive case for further demonstration is given where CAFD shows great robustness while FID fails to give consistent with human judgements. For implementation details, on the MNIST dataset, we trained a variational autoencoder (VAE) BID17 with the kl loss weight 1e-5 for the specialized encoder and added the cross-entropy term with a loss weight of 1.0. BID8. We use the domain-specific representation of VAE for embedding images. (See TAB6 5.2.1 USER STUDY Evaluating the evaluation metrics is a non-trivial task, as the best criterion is the consistency with human judgements. Therefore, we performed user study to compare our proposed method with the existing ones including Inception Score BID31, Mode Score and FID BID11 . Our setting is consistent with BID15 . 15 volunteers were first trained to tell generated samples from the groundtruth in the dataset. Then, paired image sets were randomly sampled and volunteers were asked to tell the better sets. Finally, we counted pairs where the metric agreed the voted by the volunteers. We conducted experiments on MNIST with two settings for the experiments: 'easy' and 'hard'. The 'easy' setting is where random pairs are sampled from the intermediate of GAN training, while the 'hard' setting is where only random pairs with the difference of FID of two sampled sets within a threshold are included. TAB3 shows the . It is worth noting that in hard cases, the of Inception Score BID31 are relatively meaningless (50%), which makes it hard to be applied as guidance for improving the quality of generated images by GANs. In both'easy' and'hard' settings, our method gets consistent gain compared to baseline approaches. In this experiment, we gave an intuitive case where FID fails to give consistent with human judgements. We used two different settings of representations and focused on the evaluation metric within each setting. Specifically, Besides the VAE, we also train a classifier on MNIST and use its representation as a supporting experimental setting. BID7. We use two setting of different representations in this experiment: a domain-specific classifier and a VAE. For VAE,'generated' and'hack' are the sampled images in FIG1. Compared to FID, CAFD are more robust to feature-level adjustments. FID, as an overall statistical measure, is able to detect either a single mode dropping or a trivial linear combination of two images. However, as its formulation has relatively limited constraints, it can be hacked in complicated scenarios. Considering the features extracted from MNIST test data, which has a zero FID with itself. We performed operations below on the features. Step 1 Performed principle component analysis (PCA) on the original features. Step 2 Normalized each axis to zero mean and unit variance. Step 3 Switched the normalized projection of the first two component. Step 4 Unnormalized the data and reconstructed features. The adjusted features are completely different with the original one with zero FID maintained. The over-simplified Gaussian assumption on overall distribution cannot tell the differences while our proposed method is able to report the changes with CAFD raising from 0 to 246.2 (539.8) for VAE (classifier). (See TAB6 Furthermore, We used FGSM BID8 to reconstruct the images from the adjusted features in both settings. Specifically, we first trained an decoder for initialization via an AutoEncoder with the encoder fixed. Then, we performed pixelwise adjustment via FGSM BID8 to lower the reconstruction error. Because the used encoder has a relatively simple structure, the final reconstruction error is still relatively high after optimized. For comparison, We trained a simple WGAN-GP model and took samples (generated by intermediate models during training) with comparable FID with our constructed images. Visualization for the VAE setting are shown in FIG1.It is obvious that the quality of constructed images are much worse than the generated samples. After axis permutation, the constructed images suffers from mode collapse. There are many pictures in the right which resemble more than one digits and are hard to recognize. However, for the VAE (classifier) setting, it still received a FID of 25.4 (72.8) lower than 49.9 (73.1) received by generated samples. For comparison, The of CAFD on these cases are shown in TAB6. While FID gives misleading , CAFD are much more robust on the adjusted features. Compared to the constructed images (211.6 (468.6)), the generated images received a much lower CAFD (80.7 (201.4)), which is consistent with human judgements. (See Table 6) Thus, for both settings demonstrates the improved effectiveness of the evaluation metric in our proposed evaluation framework. In this paper, we aimed to tackle the very important problem of evaluating the Generative Adversarial Networks. We presented an improved sample-based evaluation, which improves conventional methods on both representation and evaluation metric. We argue that a domain-specific encoder is needed and propose Class-Aware Frechet Distance to better fit the feature distribution. To our best knowledge, we are the first to provide counter examples where the state-of-the-art FID method is inconsistent with human judgements. Experiments and analysis on both the feature level and the image level have shown that our framework is more effective. Therefore, the encoder should be specifically trained for datasets of which the labels are different from ImageNet. To attain effective representations on non-ImageNet datasets, we need to ensure that the class labels of data used for training GAN models are consistent with those of data used for training the encoder. The Gaussian assumption on the features were commonly used in the literature. Although there are non-linear operations such as relu and max-pooling in the neural network, assuming the normality simplifies the model and enables numerical expression. However, in labeled dataset with multiple classes, the Gaussian assumption is relatively over-simplified. In this experiment, we performed Anderson-Darling test (AD-test) BID32 to quantatively study the normality of the data. Specifically, to test the multivariate normality on a set of features, we first performed principle component analysis (PCA) on the data, and then applied AD-test to the first 10 components and averaged the . We compared the test on each class and the whole training set on MNIST. We used a simple 2-conv structure trained on the MNIST classification task as our feature encoder with a output dimension 1024. To reduce the influence of sample number on the , we divided the whole features randomly into 10 sets to study the normality of the mixed features. Results are shown in Table 9. Although the p-value of both features are small, features within a single class get much greater than the mixed features. It can be inferred that compared to the whole training set, features within each class are much more Gaussian. Thus, the basic assumption of CAFD in our proposed framework is more reasonable compared to the FID BID11 method. The idea of Generative Adversarial Network was originally proposed in BID7. It has been applied to various computer vision tasks BID20 BID40. Researchers have been continuously developing better GAN architectures BID10 BID14 and training strategies BID1 BID12 on generating domain-specific images. Deep convolutional networks were firstly in- Table 9: P-value of AD-test BID32 on features of each class and the whole training images. The whole features were randomly divided into 10 sets. Compared to the mixed features, features encoding images from a single class are more Gaussian.

Represent the TLDR for finding the corresponding scientific article

This paper improves existing sample-based evaluation for GANs and contains some insightful experiments.

Represent this text to find a much much longer article about it with say hundreds-thousands of words:

We propose a extension of the batch normalization, show a first-of-its-kind convergence analysis for this extension and show in numerical experiments that it has better performance than the original batch normalizatin.


Question: Represent the scientific article to find a short TLDR

Question: Recent efforts on training light-weight binary neural networks offer promising execution/memory efficiency. This paper introduces ResBinNet, which is a composition of two interlinked methodologies aiming to address the slow convergence speed and limited accuracy of binary convolutional neural networks. The first method, called residual binarization, learns a multi-level binary representation for the features within a certain neural network layer. The second method, called temperature adjustment, gradually binarizes the weights of a particular layer. The two methods jointly learn a set of soft-binarized parameters that improve the convergence rate and accuracy of binary neural networks. We corroborate the applicability and scalability of ResBinNet by implementing a prototype hardware accelerator. The accelerator is reconfigurable in terms of the numerical precision of the binarized features, offering a trade-off between runtime and inference accuracy. Convolutional Neural Networks (CNNs) have shown promising inference accuracy for learning applications in various domains. These models are generally over-parameterized to facilitate the convergence during the training phase BID7; BID4 ). A line of optimization methodologies such as tensor decomposition BID9; BID16 ), parameter quantization; BID5 ), sparse convolutions BID10; ), and binary networks; BID11 ) have been proposed to reduce the complexity of neural networks for efficient execution. Among these works, binary neural networks in two particular benefits: (i) They reduce the memory footprint by a factor of 32 compared to the full-precision model; this is specifically important since memory access plays an essential role in the execution of CNNs on resource-constrained devices. (ii) Binary networks replace the costly multiplications with simple XNOR operations BID11; BID12 ), reducing the execution time and energy consumption significantly. Considering the prior art, there exist two major challenges associated with binary neural networks. First, the convergence rate of the existing solutions for training binary CNNs is considerably slower than their full-precision counterparts. Second, in order to achieve comparable classification accuracy, binarized neural networks often compensate for the numerical precision loss by employing high dimensional feature maps in a wide CNN topology, which in turn reduces the effective compression rate. As a , full-precision networks often surpass binary networks in terms of convergence rate and final achievable accuracy. In this paper, we propose ResBinNet, a novel solution for increasing the convergence rate and the final accuracy of binary networks. The global flow of ResBinNet is depicted in FIG0. The first phase, which we call Soft Binarization, includes two methodologies that we propose to address the aforementioned challenges for training binary CNNs. First, we introduce a Residual Binarization scheme which allows the number of possible values for activation units to be reconfigurable at runtime. To this purpose, we learn a multi-level residual representation for the features within the CNN to adaptively increase the numerical precision of the activation units. Second, we introduce a novel weight binarization approach, called Tempreture Adjustment, which aims to gradually enforce binarization constraints over the weight parameters throughout the training phase. The two interlinked methods significantly improve both the convergence rate and the final accuracy of ResBinNet compared to prior art. Once the soft training phase is finished, we convert the weights to actual binary values. Fine-tuning of the model is then performed in Hard Binarization phase using existing training algorithms (e.g. BinaryNets)) in few epochs (e.g. one epoch). ResBinNet is designed to fulfill certain goals: (i) It should enable reconfigurability for binary neural networks; in other words, the number of residual binary representatives should be adjustable to offer a trade-off between inference accuracy and computation time.(ii) The multi-level binarized features should be compatible with the XNOR multiplication approach proposed in the existing literature.(iii) ResBinNet should speed up the convergence rate of binarized CNNs. (iv) Current hardware accelerators for binary CNNs should be able to benefit from ResBinNet with minimum modification in their design. In summary, the contributions of this paper are as follows:• Proposing residual binarization, a methodology for learning multi-level residual representations for each feature map in binary CNNs.• Introducing temperature adjustment as a practical approach for gradual (soft) binarization of CNN weights.• Analyzing the trade-off between accuracy and execution time of ResBinNet on a real hardware design.• Evaluating ResBinNet convergence rate and accuracy on three datasets: MNIST, SVHN, and CIFAR-10.• Development of an open-source Application Program Interface (API) for ResBinNet 1.The remainder of the paper is organized as follows: In Section 2, we describe the residual binarization method for binarizing activations. Section 3 explains the temperature adjustment technique for binarizing weights. In Section 4, we discuss how particular ResBinNet operations (e.g. multi-level XNOR-popcount) can be efficiently implemented on existing hardware accelerators. Experiments are discussed in Section 5. Finally, we discuss the related work and in Sections 6 and 7. A binarization scheme converts value x to the binarized estimation e x, which can take one of the possible values γ or −γ. This representation allows us to represent e x with a single bit b x. In particular, for a given layer within the CNN, we can store the single full-precision value of γ as a representative for all features, and reduce the memory footprint by storing bits b x instead of x for each feature. Assuming that both the weights and input features of a CNN layer are binarized, each dot product between a feature vector x and weight vector w can be efficiently computed using XNOR-popcount operations as previously suggested in; BID11 ). Let x = γ x s x and w = γ w s w where {γ x, γ w} are scalar values and {s x, s w} are the corresponding sign vectors. The binary representations of {x, y}, which we denote by {b x, b w}, are simply computed by encoding the sign vectors s to binary vectors. The dot product between x and w can be computed as: DISPLAYFORM0 where xnorpopcount(., .) returns the number of set bits in the element-wise XNOR of the input binary vectors. Figure 2: Schematic flow for computing 3 levels of residual binary estimates e. As we go deeper in levels, the estimation becomes more accurate. Multi-level Residual Binarization: Imposing binary constraints on weights and activations of a neural network inherently limits the model's ability to provide the inference accuracy that a floatingpoint counterpart can achieve. To address this issue, we propose a multi-level binarization scheme where the residual errors are sequentially binarized to increase the numerical precision of the estimation. Figure 2 presents the procedure to compute an estimate e from input x. Each level of the graph (say the i th level) computes the corresponding estimate e i by taking the sign of its input (the residual error from the (i − 1) th level), multiplying it by a parameter γ i, and adding ±γ i to the estimate of the previous level. In addition, it computes the residual error r i and feeds it to the input of the next level. The estimates of deeper levels are therefore more accurate representations for the input x. Note that the estimate e i in level i can be represented using a stream of i bits corresponding to the signs of inputs to the first i levels. Residual Binary Activation Function: Similar to previous works which use the Sign function as the activation function, in this paper we use the residual binarization to account for the activation function. The difference between our approach and the single-bit approach is shown in FIG2. Each level has a separate full-precision representative γ i, which should be learned in the training phase. In this setting, the gradients in the backward propagation are computed the same way as in the conventional single-bit binarization; BID11 ), regardless of the number of residual levels. In the forward propagation, however, the computed of our approach provide a more accurate approximation. For instance, if we employ 2 levels of residual binarization, the activation function can take 2 2 = 4 different values. In general, the total number of possible values for the activation functions for an l-level residual binarization scheme is 2 l.Multi-level XNOR-popcount: In ResBinNet, the dot product of an l-level residual-binarized feature vector e and a vector of binary weights w can be rendered using l subsequent XNOR-popcount operations. Let e = l i=1 γ ei s ei and w = γ w s w, where s ei and s w correspond to the sign of i th residual in e and sign of w, respectively. The dot product between e and w is computed as: DISPLAYFORM1 where {b ei, b w} are the binary representations corresponding to {s ei, s w}, respectively. Note that the subsequent XNOR-popcount operations can be performed sequentially, thus, the same memory used for operating on b ei can be reused for operating on b ei+1. As a , the actual memory footprint for a multi-level residual binarization is the same as that of a single-level binarization, provided that the bit streams are processed sequentially. Residual Encoding: In order to convert matrix-vector multiplications into XNOR-popcount operations, we need to encode a feature x into a stream of binary values {b ei |i ∈ 1, 2, . . ., l}. The pseudo code for this operation, which we call Residual Encoding, is presented in Algorithm 1.Algorithm 1 l-level residual encoding algorithm inputs: γ1, γ2,..., γ l, x outputs: be1, be2,..., be l 1: r ← x 2: e ← 0 3: DISPLAYFORM2 e ← e + Sign(r) × γi 6: r ← r − Sign(r) × γi 7: end for 3 TEMPERATURE ADJUSTMENT Approximating the weights of a neural network with binary values often in loss of accuracy in the pertinent model. In this section, we explain our methodology to minimize the approximation error during the training, such that the trained weights exhibit lower binarization errors. Let W denote the parameter set within a certain layer of the neural network. Instead of directly using W to compute the layer's output, we perform a change of variable θ = γ H(αW) and compute the output using θ. Here, H is a bounded, monotonically-increasing function such as the Hyperbolic Tangent function that is applied on W element-wise. Parameter γ is a trainable parameter that adjusts the maximum and minimum values that θ can take. Parameter α, which we call the Temperature henceforth, controls the slope of function H. Figure 4a and 4b illustrate the effect of parameters α and γ on the nonlinear change of variable θ = γ T anh(αW). Note that θ acts as a semi-binarized parameter set in the soft training phase. As we increase the temperature parameter, H becomes closer to the binary sign function, meaning that the pertinent θ will exhibit less error when approximated with ±γ. Note that W and γ are the trainable parameters in this setting. Parameter θ is used in the forward propagation phase of the soft training, while in the backward propagation step W is updated. Effect on Training: Let g θ and g W be the gradients of the training loss function with respect to θ and W, respectively, then we have g W = g θ × ∂θ ∂W. In other words, the magnitude of the gradient that actually flows through W is controlled by ∂θ ∂W. If θ is close to ±γ, the gradient will be filtered out; otherwise, the gradients will flow through W.Effect of the Temperature on Gradients: Figure 4c illustrates how the temperature parameter can affect the gradient filtering term ∂θ ∂W during the training. As we increase the temperature, elements of W that are closer to 0 receive amplified gradients, while the elements that are closer to the binary regime (i.e. θ ≈ ±γ) encounter damped gradients. This means that increasing the temperature parameter α will push most of the weights to the binary regime with a bigger force; therefore, a neural network trained with high temperature values exhibits a smaller binarization error. Temperature Adjustment: Setting a high temperature at the beginning of the training will eliminate most of the gradients, preventing the training loss from being optimized. To address this problem, we start the soft binarization phase with a low temperature (e.g. α = 1) and slightly increase it at the end of each mini-batch. This approach gradually adapts the weights to binary values during the training. Figure 5 presents an example of the histogram of the semi-binarized weights θ in different training epochs. As can be seen, the distribution is gradually shifted towards binary values as the training proceeds. After soft binarization, the parameter set θ can be used as an initial point for existing hard binarization schemes such as the method proposed by ). As We illustrate in Section 5, the soft binarization methodology significantly increases the convergence rate of binary CNNs. In this section, we show that the modifications required to incorporate residual binarization into existing hardware accelerators for binary CNNs are minimal. ResBinNet provides a trade-off between inference accuracy and the execution time, while keeping the implementation cost (e.g area cost) almost intact; as a , ResBinNet readily offers users a decision on the latency of their learning application by compromising the inference accuracy. As an example, we consider the FPGA accelerator for binary CNNs proposed by BID12 ). We refer the reader to the mentioned paper for details about the original design. Here, we describe the modifications that we integrated into the specific components of their design to accommodate residual binarization. The modified accelerator will be publicly available on Github 2. FIG4 depicts a schematic view of the original hardware and our modified accelerator. Note that in the original implementation, each layer takes a single binary vector b in and computes a single output vector b out while the modified version processes l streams of binary vectors where l is the desired number of residual levels. Matrix-Vector Multiplication: Both in the original and the modified accelerators, the matrix-vector multiplication unit is the most computationally intensive among all other operations. In the original design, this unit takes a binary vector b in and outputs a full-precision vector y. To accommodate residual binarization, we modify this module as follows: the XNOR-popcount operation is sequentially performed on the stream of binary vectors b in,i. Each XNOR-popcount in a different vector y i. Then, the output is computed as y = i γ i y i. Note that the computation overhead of the summation is negligible compared to the XNOR-popcount operation, thus, the runtime of multilevel XNOR-popcount with l-level residual representations is approximately l times the runtime of the conventional XNOR-popcount in the original design. Batch-Normalization and Activation Function: Batch-Normalization in the inference phase can be viewed as multiplying a vector y by constant vector g and subtracting vector t to obtain the normalized vector y norm. The original design in BID12 ) does not require the multiplication step since only the sign of y norm matters to compute the output of the activation function (the Sign function). In our design, the multiplication step is necessary since the value of y norm affects the output of our activation function, which is encoded using Algorithm 1 and sent to the next layer to be used as an input. The original implementation simply computes the Boolean OR of the binary values to perform max pooling over the features within a window. In ResBinNet, however, features are represented with l-bit residual representations. As a , performing Boolean OR over the binary encodings is no longer equivalent to performing max-pooling over the features. Nevertheless, the pooling operation can be performed over the encoded values directly. Assume full-precision values e x and e y, with l-level binary encodings b x and b y, respectively. Considering ordered positive γ i values (i.e. γ 1 > γ 2 > . . . > γ l > 0), we can easily conclude that if e x < e y then b x < b y. We implement our API using Keras BID1 ) library with a Tensorflow backend. The synthesis reports (resource utilization and latency) for the FPGA accelerator are gathered using Vivado Design Suite BID15 ). For temperature adjustment (Section 3), we use a "hard tanh" nonlinearity and gradually increase the temperature by incrementing α at the end of each epoch. We evaluate ResBinNet by comparing the accuracy, number of training epochs, size of the network, and execution time. Proof-of-concept evaluations are performed for three datasets: MNIST, CIFAR-10, and SVHN. Table 1 presents the architecture of the trained neural networks. The architectures are picked from BID12 ). Table 1: Network architectures for evaluation benchmarks. C64 denotes a 3 × 3 convolution with 64 output channels, M P stands for 2 × 2 max pooling, BN represents batch normalization, and D512 means a dense layer with 512 outputs. The residual binarizations are shown using RB. DISPLAYFORM0 Effect of the model size on accuracy: As discussed in BID12 ), the final accuracy of the binary CNN for a particular application is correlated with the shape of the network. For instance, authors of the paper report that the accuracy of MNIST for the architecture in TAB0 varies in the range (95.83%-98.4%) when the number of neurons in hidden layers is varied from 256 to 1024. Similarly, the architecture in BID12 ) for CIFAR-10 is a smaller version of the architecture originally trained by ). Using this smaller architecture drops the accuracy from 88.6% to 80.1%. In our evaluations, we show that ResBinNet can reduce the accuracy drop using more residual binary levels for the activations of the smaller model. Effect of the number of epochs on accuracy: Compared to full-precision neural networks, binarized CNNs usually need more training epochs to achieve the same accuracy. For example, the CIFAR-10 architecture in ) is trained for 500 epochs, while the fullprecision version of the same network can achieve comparable accuracy in roughly 50 iterations 3. Here, we argue that soft binarization in ResBinNet can significantly reduce the number of training epochs for binary CNNs. TAB0 compares ResBinNet with two prior arts, namely Binarynet and FINN. Both baselines use the same training methodology, but the network architectures in FINN are considerably smaller, which leads to lower accuracy rates for FINN. We evaluate ResBinNet using the small architectures of FINN. The training of ResBinNet consists of a soft binarization phase and a single fine-tuning epoch. Note that the fine-tuning phase uses the same algorithm as the two baselines. The higher accuracy of Binarynet compared to our approach is a direct of employing a large architecture and training for many epochs. For each benchmark, the comparison between our approach and the same network architecture of FINN is followed:• CIFAR-10: Compared to FINN, ResBinNet achieves higher accuracy for more than 1 level of residual binarization. We argue that, even for 1-level binarization, the same accuracy is viable if we fine-tune the soft-binarized model (after 50 epochs) for more than 1 epochs (FINN and ResBinNet use the same algorithms in this phase). In addition, the convergence rate of ResBinNet is improved as the number of residual levels is increased.• SVHN and MNIST: For these datasets, ResBinNet achieves a higher accuracy with even fewer epochs compared to CIFAR-10. The final accuracy and the convergence speed also exhibit improvement as the number of residual levels is increased from 1 to 3.We now evaluate the area overhead and execution time of ResBinNet for the modified hardware architecture, which we discussed previously in Section 4. We compare the implementation of the CNN architecture used for the CIFAR-10 and SVHN tasks (See Table 1). FIG5 compares the hardware resource utilization, and execution time per input. The resource utilization of ResBinNet is evaluated in FIG5, which compares the utilization (in %) for different resources of the FPGA (i.e. BRAM, DSP, LUT, and Registers). For each resource, we compare the baseline with different number of residual binarization levels in ResBinNet. Asides from the DSP utilization, which is required for full-precision multiplications in batch normalization, the other three resources show a modest increase in utilization, meaning that the residual binarization method offers a scalable design for real-world systems. FIG5 compares the latency (runtime) of ResBinNet with the baseline accelerator. In particular, we consider multi-level residual binarization with 1, 2, and 3 residual levels which are denoted by RBN1, RBN2, and RBN3, respectively. The numbers on top of the bars show the accuracy of the corresponding binarized CNN for CIFAR-10 task. As can be seen, ResBinNet enables users to achieve higher accuracy by tolerating a higher latency, which is almost linear with respect to the number of residual levels. Training CNNs with binary weights and/or activations has been the subject of very recent works BID2; BID11;; BID12 ). The authors of Binaryconnect BID2 ) suggest a probabilistic methodology that leverages the full-precision weights to generate binary representatives during forward pass while in the back-propagation the full-precision weights are updated. ) is the first work attempting to binarize both weight and activations of CNN. In this work, authors also suggest replacing the costly dot products by XNOR-popcount operations. XNOR-net BID11 ) proposes to use scale factors during training, which in an improved accuracy. The aforementioned works propose optimization solutions that enable the use of binarized values in CNNs which, in turn, enable the design of simple and efficient hardware accelerators. The downside of these works is that, aside from changing the architecture of the CNN BID12 ), they do not offer any other reconfigurability in their designs. On another track of research, the reconfigurability of CNN accelerators has been investigated. This line of research focuses on using adaptive low bit-width representations for compressing the parameters and/or simplifying the pertinent arithmetic operations BID17; BID6; BID0 ). The proposed solutions, however, do not enjoy the same simplified XNOR-popcount operations as in binarized CNNs. Among the aforementioned works, a unified solution which is both reconfigurable and binarized is missing. To the best of our knowledge, ResBinNet is the first to offer a solution which is reconfigurable and, at the same time, enjoys the benefits of binarized CNNs. Our goal in the design of ResBinNet was to remain consistent with the existing CNN optimization solutions. As shown in the paper, ResBinNet is compatible with the accelerators designed for binarized CNNs. This paper introduces ResBinNet, a novel reconfigurable binarization scheme which aims to improve the convergence rate and the final accuracy of binary CNNs. The proposed training is twofold: (i) In the first phase, called soft binarization, we introduce two distinct methodologies designed for binarizing weights and feature within CNNs, namely residual binarization, and temperature adjustment. Residual binarization learns a multi-level representation for features of CNN to provide an arbitrary numerical precision during inference. Temperature adjustment gradually imposes binarization constraints on the weights. (ii) In the second phase, which we call hard binarization, the model is fine-tuned in few training epochs. Our experiments demonstrate that the joint use of residual binarization and temperature adjustment improves the convergence rate and the accuracy of the binarized CNN. We argue that ResBinNet methodology can be adopted by current CNN hardware accelerators as it requires minimal modification to existing binarized CNN solutions. Developers can integrate the approaches proposed in this paper into their deep learning systems to provide users with a trade-off between application latency and inference accuracy.

Residual Binary Neural Networks significantly improve the convergence rate and inference accuracy of the binary neural networks.

Represent this text to find a much much longer article about it with say hundreds-thousands of words

We propose a new compression method, Inter-Layer Weight Prediction (ILWP) and quantization method which quantize the predicted residuals between the weights in convolution layers.


Question: represent the natural language

Question: In real-world machine learning applications, large outliers and pervasive noise are commonplace, and access to clean training data as required by standard deep autoencoders is unlikely. Reliably detecting anomalies in a given set of images is a task of high practical relevance for visual quality inspection, surveillance, or medical image analysis. Autoencoder neural networks learn to reconstruct normal images, and hence can classify those images as anomalous if the reconstruction error exceeds some threshold. In this paper, we proposed an unsupervised method based on subset scanning over autoencoder activations. The contributions of our work are threefold. First, we propose a novel method combining detection with reconstruction error and subset scanning scores to improve the anomaly score of current autoencoders without requiring any retraining. Second, we provide the ability to inspect and visualize the set of anomalous nodes in the reconstruction error space that make a sample noised. Third, we show that subset scanning can be used for anomaly detection in the inner layers of the autoencoder. We provide detection power for several untargeted adversarial noise models under standard datasets. Neural networks generate a large amount of activation data when processing an input. This work applies anomalous pattern detection techniques on this activation data in order to determine if the input is anomalous. Examples of an anomalous input can be noised samples by an adversary (; ; a; a), human annotation errors , etc. The goal of anomalous pattern detection is to quantify, detect, and characterize the data that are generated by an alternative process. Since anomalies are rare and come from diverse sources, it is not feasible to obtain labeled datasets of all possible anomalies/attacks. If an observation deviates from the learned model, it is classified as an anomaly . In real-world problems, large outliers and pervasive perturbations are commonplace, and one may not have access to clean training data as required by standard deep denoising autoencoders due to reasons such as human annotation errors and poisoning techniques (b). Autoencoders differ from classical classifier networks such as Convolutional Neural Networks (CNNs). Autoencoders do not require labels because the expected output is the input data. The autoencoder is trained to minimize the reconstruction error L(x, x). During the prediction step, anomaly detection can be performed by looking at the distribution of mean reconstruction error L(w, d(e(w))) when w ∈ X clean and L(w, d(e(w))) when w ∈ X adv . An example of both, clean and noise reconstruction error distribution can be seen in Figure 4 (b). Using this type of anomaly detection with autoencoders assumes that the autoencoder is properly trained with clean data. Otherwise, this manifold can be used advantageously by training the autoencoder with corrupted samples that are mapped to clean samples. As a , the autoencoder will learn an underlying vector field that points in the direction of the manifold in which the clean samples lie. Thus, upon the introduction of a perturbation, the magnitude of each arrow in the vector field will indicate the direction in which the data must be moved to map the sample to its clean representation . Further detail on the autoencoder architecture and training setup for the experiments can be found in the Section A.4. Subset scanning frames the detection problem as a search over subsets of data in order to find a subset that maximizes a scoring function F (S), typically a likelihood ratio. Subset scanning exploits a property of these scoring functions that allow for efficient maximization over the exponentially large search space . In this paper, we show how subset scanning methods can enhance the anomaly detection power of autoencoders in an unsupervised manner and without a retraining step. We treat this anomaly detection approach as a search for a subset of node activations that are higher than expected. This is formally quantified as the subset with the highest score according to a non-parametric scan statistic. The contributions of our work are threefold. First, we propose a novel approach combining detection with reconstruction error and subset scanning scores to improve the anomaly score of current autoencoders without requiring any retraining. Second, we provide the ability to identify and visualize the set of anomalous nodes in the reconstruction error space that make noised samples. Third, we show that subset scanning can be used for anomaly detection in the inner layers of the autoencoder. Figure 1: Example of subset scanning score distributions across layers of an autoencoder for adversarial BIM noise = 0.01. In the top of the graph we can see subset score distributions per nodes in a layer. The distributions of subset scanning scores are shown in blue for clean images (C) (expected distribution), and in orange for noised samples A t. Higher AUCs are expected when distributions are separated from each other and lower AUCs when they overlap. The purple structure corresponds to convolutional layers at the Encoder, while the red structure corresponds to the convolution layers for the Decoder. The computed AUC for the subset score distributions can be found in Table 1. The highest mutual information exchange with the adversarial input happens on the first layers (convolutional and maxpooling). This is why the greatest divergence in both C and A t subset scores distributions is seen. In the latent space, due to properties described in Section 4, the autoencoder abstracts basic representations of the images, losing subset scanning power due to the autoencoder mapping the new sample to the expected distribution. This can be seen as an almost perfect overlap of distribution in conv 2d 7. Machine learning models are susceptible to adversarial perturbations of their input data that can cause the input to be misclassified (; ; a; a). There are a variety of methods to make neural networks more robust to adversarial noise. Some require retraining with altered loss functions so that adversarial images must have a higher perturbation in order to be successful . Our work treats the problem as anomalous pattern detection and operates in an unsupervised manner without a priori knowledge of the attack or labeled examples. We also do not rely on training data augmentation or specialized training techniques. These constraints make it a more difficult problem, but more realistic in the adversarial noise domain as new attacks are constantly being created. Before introducing our approach in the next section, we explain related work in two parts. First, we provide a quick overview of Autoencoders as anomaly detectors and second, we discuss different adversarial attacks models used in this paper. Several approaches have been used for anomaly detection with autoencoders. Since autoencoders can model training data distribution, these neural networks are an interesting option for anomaly detection. Most of the methods found in the literature require that the training data only consist of normal examples such as denoising autoencoders , but this alone is no guarantee for anomalies to have a large reconstruction error. present a robust Anomaly Detection with ITSR (Iterative Training Set Refinement) and Adversarial Autoencoders. Their work uses the capabilities of adversarial autoencoders to address the shortcoming of conventional autoencoders in the presence of anomalies samples during training. They also propose a combined criterion of reconstruction error and likelihood in the latent space, as well as a retraining method to increase the separation in both latent and image space. use deep structured energy-based models, showing that a criterion based on an energy score leads to better than the reconstruction error criterion. present an extension of denoising autoencoders that can work with corrupted data. During training, the network uses an anomaly regularizing penalty based on L p -norms. Most of the approaches for anomaly detection with autoencoders require the training data to consist of clean examples or use complex autoencoder architectures and special training. In this work, we propose subset scanning applied to autoencoders. This is an unsupervised anomaly detector that can be applied to any pre-trained, off-the-shelf autoencoder network. We use, as a baseline, the detection capabilities based on mean autoencoder reconstruction error distributions and One-SVM (Schölkopf et al., 2001) for the autoencoder reconstruction error space analysis. Several attack models have been used to target classifiers in this study, we focus on untargeted attacks with Basic Iterative Method (BIM) (b), Fast Gradient Signal Method (FGSM) , and DeepFool (DF) . The idea behind these attacks is to find a perturbation to be included in the original sample X, generating an adversarial sample X adv. Fast Gradient Sign Method (FGSM) FGSM was designed to be extremely fast rather than optimal. It simply uses the sign of the gradient at every pixel to determine the direction with which to change the corresponding pixel value. Given an image x and its corresponding true label y, the FGSM attack sets the perturbation δ to: Basic Iterative Method (BIM) BIM (b) is a straightforward extension of FGSM where adversarial noise is applied multiple times iteratively with small step size: The DF algorithm presented by computes the optimal adversarial perturbation to perform a misclassification. In a binary classifier, the robustness of the model f for an input X 0 is equal to the distance the input to the hyper-plane that separates both classes. So the minimal perturbation to change the classifier decision is the orthogonal projection defined as: 3 SUBSET SCANNING FOR ANOMALOUS PATTERN DETECTION Subset scanning treats the pattern detection problem as a search for the "most anomalous" subset of observations in the data. Herein, anomalousness is quantified by a scoring function, F (S) which is typically a log-likelihood ratio statistic. Therefore, the goal is to efficiently identify S * = arg max S F (S) over all relevant subsets of node activations within an autoencoder that is processing an image at runtime. The particular scoring functions F (S) used in this work are covered in the next sub-section. Heuristic alternatives to subset scanning include "top-down" and "bottom-up" methods. Topdown approaches detect globally interesting patterns and then identify sub-partitions to find smaller anomalous groups of records. These may fail to detect small-scale patterns that are not evident from global aggregate statistics. Similarly, bottom-up approaches that identify individually anomalous data points and aggregates them into clusters may fail when the pattern is only evident by evaluating a group of data points collectively . Treating the detection problem as a subset scan has desirable statistical properties. However, the exhaustive search over groups quickly becomes computationally infeasible due to the exponential number of subsets of records. Fortunately, a large class of scoring functions used in subset scanning satisfy the "Linear Time Subset Scanning" (LTSS) property that allows for exact, efficient maximization over all subsets of data without requiring an exhaustive search . The LTSS property essentially reduces the search space from 2 N to N for a dataset with N records, while guaranteeing that the highest-scoring subset of records is identified. This work uses non-parametric scan statistics (NPSS) that have been used in other pattern detection methods (; ;). Although subset scanning can use parametric scoring functions (i.e. Gaussian, Poisson), the distribution of activations within particular layers are highly skewed and in some cases bi-modal. See Figure 9. Therefore, this work uses non-parametric scan statistics that makes minimal assumptions on the underlying distribution of node activations. The intuition behind the role of non-parametric scan statistics is best explained in a simple example. Consider 100 p-values that are supposed to be uniformly distributed between 0 and 1 under the null hypothesis of no anomaly present in the data. A larger-than-expected activation at a node in a lower p-value for that node. What if we observe 30 (out of 100) p-values all under a threshold value of 0.10? Is that more or less anomalous than finding 20 (out of 100) p-values all under a threshold of 0.075? Non-parametric scan statistics quantify these situations. This same example can be used to highlight why subset scanning is appropriately paired with non-parametric scan statistics. A single p−value of 0.1 is not interesting when viewed by itself. However, if there are 29 other p−values in the same data set that are also 0.1 (or lower), then the observations are now more interesting when considered together, as a group. Subset scanning efficiently identifies the combination of p-values and thresholds in order to maximize the non-parametric scan statistic. There are three steps to appropriately use non-parametric scan statistics on neural network activation data. The first is to form a distribution of "expected" activations at each node. This is done by letting the autoencoder process images that are known to be clean from anomalies (sometimes referred to as "" images) and recording the activations at each node. The second step involves a test image that may be clean or noised and needs to be scored. We record the activations induced by the test image and compare it to the baseline activations created in the first step. This comparison in a p-value at each node. The third step is to quantify the anomalousness of the ing p-values by finding the subset of nodes that maximize the non-parametric scan statistic. We now formalize these three steps. Let there be M images X z included in D H0. A test image X i is now converted to a vector of p-values p ij of length J = |O|, the number of nodes in the network under consideration. Intuitively, if a test image is "natural" (its activations are drawn from the same distribution as the baseline images) then few of the p-values will be extreme. The key assumption is that under the alternative hypothesis of an anomaly present in the activation data, then at least some subset of the activations S O ⊆ O will systematically appear extreme. We now turn to non-parametric scan statistics to identify and quantify this set of p-values. The general form of the NPSS score function is where N (S) represents the number of empirical p-values contained in subset S and N α (S) is the number of p-values less than (significance level) α contained in subset S. Moreover, it has been shown that for a subset S consisting of ). We assume an anomalous process will create some S where the observed significance is higher than the expected, N α (S) > N (S)α, for some α. There are well-known goodness-of-fit statistics that can be utilized in NPSS, the most popular is the Kolmogorov-Smirnov test . Another option is Higher-Criticism . In this work we use the Berk-Jones test statistic : 1−y between the observed and expected proportions of significant p-values. Berk-Jones can be interpreted as the log-likelihood ratio for testing whether the p-values are uniformly distributed on as compared to following a piece-wise constant alternative distribution, and has been shown to fulfill several optimality properties and has greater power than any weighted Kolmogorov statistic. Although NPSS provides a means to evaluate the anomalousness of a subset of node activations S O discovering which of the 2 J possible subsets provides the most evidence of an anomalous pattern is computationally infeasible for moderately sized data sets. However, NPSS has been shown to satisfy the linear-time subset scanning (LTSS) property , which allows for an efficient and exact maximization over subsets of data. The LTSS property uses a priority function G(O j) to rank nodes and then proves that the highestscoring subset consists of the "top-k" priority nodes for some k in 1... J. The priority of a node for NPSS is the proportion of p-values that are less than α. However, because we are scoring a single image and there is only one p-value at each node, the priority of a node is either 1 (when the p-value is less than α) or 0 (otherwise). Therefore, for a fixed, given α threshold, the most anomalous subset is all and only nodes with p-values less than alpha. In order to maximize the scoring function over α we first sort the O j nodes by their p-values. Let S (k) be the subset containing the k nodes with with the smallest p-values. Let α k be the largest pvalue among these k nodes. The LTSS property guarantees that the highest-scoring subset (over all α thresholds) will be one of these J subsets S, S,... S (J) with their corresponding α k threshold. Any subset of nodes that does not take this form (or uses an alternate α k) is provably sub-optimal and not considered. Critically, this drastically reduced search space still guarantees identifying the highest-scoring subset of nodes for a test image under evaluation. Figure 2 shows how the optimal α threshold (and subset size) can vary for different test images under consideration. The leftmost panel shows the distributions of the size of the most anomalous subset of nodes in both clean and noised images. We note that noised images tend to return a larger subset of nodes than clean images. The middle panel shows the optimal α threshold value that maximized the non-parametric scan statistic for clean and noised images. We note that noised images tend to have lower thresholds than clean images. When an image induces a larger number of smaller p-values, the ing score of the image is higher. This is demonstrated in the right-most panel where noised test images have higher scores than clean test images. A conventional autoencoder learns the underlying manifold of the training data, which is used to reconstruct the input (x) as the output (x). The general architecture of any autoencoder involves an encoder and a decoder. The encoder (e : X → Z) is composed of one or more layers that perform nonlinear dimensionality reduction from the high dimensional input space into a low-dimensional latent representation (z = e(x)), while the decoder (d : Z → X) reconstructs the original sample from the latent representation. Both functions compute x = d(e(x)). The autoencoder is optimized by minimizing the reconstruction error L(x, x). Anomalous pattern detection can be performed on a trained autoencoder, by looking at the distributions of mean reconstruction error L(w, d(e(w))) when w ∈ X clean and L(w, d(e(w))) when w ∈ X adv. Due to the inherent properties of the autoencoder for anomaly detection, we propose two experiments or applications of subset scanning. First, we are interested in subset scanning scores distributions along the layers of the encoder. During the untangling phase (z = e(x)) of information reduction from the input space to the latent representation (z), we want to observe until which layer we're able to discriminate the input (clean and noised) to the distribution learnt by the autoencoder. Second, we apply subset scanning methods on the reconstruction error space, to understand if reconstruction error criterion suffices for detection in training autoencoder based anomaly detectors. The connection between the number of nodes in a subset, α value that maximizes the non-parametric scan statistic, and the ing subset score. These are for Fashion-MNIST examples with activations coming from the first layer of the autoencoder. Under the presence of BIM adversarial noise, we observe a larger number of nodes that have smaller p-values. This combination in a higher subset score than the clean images. Critically, the LTSS property allows α to be efficiently chosen to maximize the score for each individual image. The subset size is all nodes with p-values less than the α threshold. We enforce a α max = 0.5 constraint on the search. In this section, we describe the baselines methods used as comparison, as well as the datasets, evaluation metric, adversarial noise generation and autoencoder architecture we used. For generating the attacks a standard CNN model was trained for both datasets. The test accuracies for these models are 0.992 for MNIST and 0.921 for Fashion-MNIST. We trained an autoencoder network on MNIST and Fashion-MNIST (detailed in Section 5.1). The architecture of the autoencoder is depicted in Figure 8, and further details on the training setup can be found in Appendix A.4. The test reconstruction error of the model was 0.284 for Fashion-MNIST and 0.095 for MNIST. In real-world applications, clean training datasets cannot always be guaranteed due to factors such as human annotation errors , and poisoning techniques (b). Consequently, we trained the autoencoder with different levels of data poisoning. We trained autoencoders with 100% of clean samples, 1% of adversarial samples, and 9% of adversarial samples. For this experiment, we used BIM as the attack and Fashion-MNIST as the dataset. We evaluated subset scanning over two experiments. First, we applied our subset scanning method on the reconstruction error calculated over the input data and the last layer of the autoencoder (conv2d 7). This layer has 1 filter containing 784 nodes. For more information, refer to Section 4. Second, we studied subset scanning patterns across adversarial attacks and datasets, to see if we have some common subset scanning behaviors. For this, we applied subset scanning across all layers of the autoencoder (convolutional, max pooling and up-sampling) and analyzed the detection power in each case. For our adversarial experiments, we took M = |D H0 | = 7000 of the 10000 validation images and used them to generate the activation distribution (D H0) at each of the 784 nodes (28×28) for the reconstruction error space and the activations nodes per each inner layer. These 7000 images were not used again. These images form our expectation of "normal" activation behavior for the network. The remaining 3000 images were used to form a "Clean" (C = 1500) sample and an "Adversarial" (A t = 1500) noised sample. For the experiments we only kept the successful attacks for DF, FGSM and BIM, so we only preserve noised samples that were incorrectly classified by the model. We evaluated anomaly detection with subset scanning on the classical MNIST dataset and more complex dataset Fashion-MNIST . We present a quick overview of both datasets: • MNIST : The training set has 60000 images and the test set has 10000 images of handwritten digits. Each digit has been normalized and centered to 28 × 28. • Fashion-MNIST : a relatively new dataset comprising 28 × 28 grayscale images of 70.000 fashion products from 10 categories, with 7000 images per category. The training set has 60000 images and the test set has 10000 images. As an alternative to MNIST, it has the same image size, data format and validation splits, with the digits from MNIST replaced with 10 products of clothes and accessories. Several adversarial attacks for the subset scanning experiments were implemented, briefly introduced in Section 2.2. Specifically, we describe in this section the hyperparameter selection for Basic Iterative Method (BIM) adversarial attack (b), Fast Gradient Signal Method (FGSM) and DeepFool (DF) . BIM and FGSM have an parameter which controls how far a pixel is allowed to change from its original value when noise is added to the image. We used a value of = 0.01 in the scaled pixel space. We also allowed the method to reach its final noised state over 100 steps with each of size 0.002. Smaller values of make the pattern subtler and harder to detect, but also less likely for the attacks to succeed in changing the class label to the target. For DeepFool, we used standard = 1e − 06 and 100 iterations. Example of generated adversarial samples for both datasets are depicted in Figure 7. All untargeted attacks were generated with the Adversarial Robustness Toolbox 1. The set A t only contains images that were successfully noised by each type of adversarial attack. This means that those samples were misclassified from an original predicted label. The 1500 images in group C are natural and have all class labels represented equally. We adopted the following metric to measure the effectiveness of subset scanning over an autoencoder to distinguishing different types of adversarial attacks images under the activation and reconstruction error space. The Detection Power is measured by AUROC, the Area Under the Receiver Operating Characteristic curve, which is also a threshold independent metric . The ROC curve depicts the relationship between true positive rate (TPR) and false positive rate (FPR). Results shown in Figure 6 for reconstruction error and activations space in the first convolutional layer for Figure 3. Table 1: Detection power for individual subset scanning over all layers (convolutional, max pooling and up-sampling) for both datasets under three different adversarial attacks. The noised columns refer to the autoencoder being trained with 1% and 9% BIM noised samples. Under different datasets and attacks, the same initial layers hold the highest detection power. In Table 1, we can observe that across different datasets, noise attacks models, and two proportion of noised samples during training, the first layers (conv 2d 1 and max pooling 2d 1) maintain a high performance regarding detection power (between 0.96 to 1.0 depending on dataset and noise attack). The ROC curves and subset scores distribution for the BIM and FGSM attacks under Fashion-MNIST for the layer conv 2d 1 are shown in Figure 3. Furthermore, Table 1 shows that in the cases where 1% and 9% of the samples are noised during training stage of the autoencoder, the detection power of subset scanning still performs correctly, above 0.82. Table 2 shows the behavior of subset scanning over the reconstruction error space and the detection power in detail for both datasets and different adversarial attacks. We can observe a difference of performance of our method over the Fashion-MNIST dataset. One hypothesis would be that this is due to the autoencoder performance (Loss for Fashion-MNIST 0.284 and MNIST 0.095). To test this idea, we performed preliminary experiments that show a relationship between the decrease in the loss of the trained autoencoder and the increase in the detection power of subset scanning methods under the reconstruction error space. A poorly-trained autoencoder will have a higher loss, while a well-trained autoencoder will have a lower loss. If an autoencoder's loss is high, it is more difficult to separate between clean and noised samples in the reconstruction space. Nonetheless, subset scanning has higher detection power than Mean Reconstruction Error distributions under clean and noise samples (see Figure 4) and Unsupervised outlier detection methods such as One-SVM (Schölkopf et al., 2001). Furthermore, subset scanning under the reconstruction error space is an interesting technique to explore and introspect what nodes or portions of the input image look anomalous. With this information we can not only point out which image looks anomalous, but also indicate which nodes make the input a noised sample, an example of this is depicted in Figure 5. Table 2: Detection power for individual subset scanning over reconstruction error space for both dataset under three different adversarial attacks, two baselines for reconstruction error over AE and One-SVM over reconstruction error of the AE (Schölkopf et al., 2001). In this work, we proposed a novel unsupervised method for adversarial noise detection with off-theshelf autoencoders and subset scanning. We have successfully demonstrated how subset scanning can be used to gain detection strength against multiple adversarial attacks on images across several datasets, without requiring any retraining or complex deep autoencoder network structures. Furthermore, we tested subset scanning over the reconstruction error space and observed significant variations depending on the dataset, autoencoder architecture, and training setup. We performed Figure 5: Anomalous nodes visualization. Overlap of anomalous nodes (white) and reconstruction error (darker blue) per sample. (a) Noised samples with BIM. We can observe that nodes outside the contour will make the sample be classified as noised. (b) Whereas clean we expect the anomalous nodes will be along the contour of the figure. preliminary experiments that yielded a relation between a decrease in the loss of the trained autoencoder and an increase in the detection power of subset scanning under the reconstruction error space. Nonetheless, applying our method under this space provides introspection capabilities that allow us to identify the nodes or portions of the input image look anomalous. Consequently, we are able to not only point out which image looks anomalous but also characterize the nodes that make the input a noised sample. We also evaluated the performance of applying subset scanning over the autoencoder's activations. We observed a consistent and high detection power across noise attacks, datasets, autoencoders architectures and different noised training levels in the initial layers (Convolutional and MaxPooling layers). Due to versatile properties of subset scanning under neural network activation analysis it may be used for several other studies, including unsupervised classification in the latent space of an autoencoder. We would expect that same class images will identify as a subset of inputs (images) that have higher-than-expected activations (i.e. large number of low empirical p−values) at a subset of nodes. Subset scanning applied to autoencoders activations is a novel, unsupervised anomaly detector that can be applied to any pre-trained, off-the-shelf neural network, previously only used in classifier neural networks such as CNNs and ResNet . A.1 ALGORITHM FOR SUBSET SCANNING OVER AUTOENCODER ACTIVATIONS input: Background set of images: X z ∈ D H0, evaluation image: X i, α max. output: S * E Score for the evaluation image AE ← TrainNetwork (training dataset); AE y ← Some flattened layer of AE; *, α *, and F (S *) Algorithm 1: Pseudo-code for subset scanning over autoencoder activations. In Figure 6, we can observe the distribution of subset scores for test sets of images over reconstruction error. Test sets containing all natural images had lower scores than test sets containing noised images (FGSM and BIM generated samples). Higher proportion of noised images ed in higher scores. Figure 6 also shows the ROC curves for each of the noised cases as compared to the scores from test sets containing all natural images., each with relu activations, and a maxpooling layer with a pool size of two after every convolutional layer. The decoder comprises four convolutional layers with 8, 8, 16, 1 filters respectively, a kernel size of three, each with relu activations except the final layer which uses a sigmoid. Each consecutive pair of convolutional layer is interspersed with an upsampling layer with a size of two. We train the autoencoder by minimizing the binary cross-entropy of the decoder output and the original input image using an adadelta optimizer (citep) for 100 epochs taking 128 records per batch. Although subset scanning can use parametric scoring functions (i.e. Gaussian, Poisson), the distribution of activations within particular layers are highly skewed and in some cases bi-modal. See Figure 9. Therefore, this work uses non-parametric scan statistics that makes minimal assumptions on the underlying distribution of node activations. Furthermore we only consider 1-tailed p-values (in the greater direction). This is due to nuances of the ReLu activation function. Alternative activation functions such as tanh and signmoid would allow an "extreme" activation to be considered as either larger or smaller than expected with a pvalue coming from a 2-tailed calculation. A.6 NON-PARAMETRIC SCAN STATISTICS NPSS can be viewed as a second-order test statistic that operate on (by aggregating information across) p-values (i.e., the first order test statistics) to evaluate the the evidence for violations of H 0 in a given subset S. NPSS is operationalized with a given score (test) function; each test is powered for different alternatives, and therefore, NPSS's detection power is linked to preferences of the selected score function. This work used the Berk-Jones scoring function . Where KL is the Kullback-Liebler divergence KL(x, y) = x log to following a piece-wise constant alternative distribution, and has been shown to fulfill several optimality properties. A more commonly known scoring function that also satisfies the LTSS property is the KolmogoorvSmirnov test statistic which is known to be more sensitive to deviations in the center of a distribution. https://www. jstor.org/stable/2958837 and http://www.jstor.org/stable/2958836. Another test is: which can be interpreted as the test statistic of a Wald test for the amount of significant p-values given that N α is binomially distributed with parameters N α and α. Because Higher-Criticism normalizes by the standard-deviation of N α, it tends to be more sensitive to small subsets with very extreme p-values. Most values are accumulated around 0 due to ReLu activations. The large skew and sometimes bi-modal distribution of activations motivated the use of non-parametric scan statistics to quantify what it means for an activation to be larger-than-expected.

Unsupervised method to detect adversarial samples in autoencoder's activations and reconstruction error space

Represent the TLDR for finding the corresponding scientific article

We introduce a type of neural network that is structurally resistant to adversarial attacks, even when trained on unaugmented training sets.  The resistance is due to the stability of network units wrt input perturbations.