Question: Deep learning has demonstrated abilities to learn complex structures, but they can be restricted by available data. Recently, Consensus Networks (CNs) were proposed to alleviate data sparsity by utilizing features from multiple modalities, but they too have been limited by the size of labeled data. In this paper, we extend CN to Transductive Consensus Networks (TCNs), suitable for semi-supervised learning. In TCNs, different modalities of input are compressed into latent representations, which we encourage to become indistinguishable during iterative adversarial training. To understand TCNs two mechanisms, consensus and classification, we put forward its three variants in ablation studies on these mechanisms. To further investigate TCN models, we treat the latent representations as probability distributions and measure their similarities as the negative relative Jensen-Shannon divergences. We show that a consensus state beneficial for classification desires a stable but imperfect similarity between the representations. Overall, TCNs outperform or align with the best benchmark algorithms given 20 to 200 labeled samples on the Bank Marketing and the DementiaBank datasets. Deep learning has demonstrated impressive capacities to learn complicated structures from massive data sets. However, acquiring sufficient labeled data can be expensive or difficult (e.g., for specific pathological populations BID10). Transductive learning (a set of semi-supervised algorithms) uses intrinsic structures among unlabeled data to boost classifier performance. In the real world, data can spread across multiple modalities (e.g., visual, acoustic, and text) in typical tasks, although many existing transductive algorithms do not exploit the structure across these modalities. Co-training and tri-training BID23 use one classifier per modality to supervise each other, but they can only apply to two and three modalities respectively. Recently, Consensus Networks (CNs) BID24 incorporated the idea of co-training. Not limited by the number of modalities, CNs showed promising on detecting cognitive impairments from multi-modal datasets of speech. A consensus network contains several interpreters (one per modality), a discriminator, and a classifier. The interpreters try to produce low-dimensional representations of input data that are indistinguishable by the discriminator. The classifier makes predictions based on these representation vectors. Despite promising , CN is limited by the amount of available training data. This motivates our extension into semi-supervised learning with our Transductive Consensus Network (TCN).TCNs operate in two mechanisms: as consensus or classifier. The consensus mechanism urges the modality representations to resemble each other (trained on the whole dataset without using labels), and the classifier mechanism optimizes the networks to retain information useful for classification (trained on the labeled dataset). To illustrate the importance of these two mechanisms in an ablation study, we also put forward its three variants: TCN-embed, TCN-svm, and TCN-AE in §3. By this ablation study, we show that both mechanisms should function together via iterative training. To further reveal the mechanisms of TCN, we formulate in §3.5 the similarity between latent representations using negative Jensen-Shannon divergences. By monitoring their similarities, we show that a meaningful consensus state prefers representations to have suboptimal similarities. In experiments (§4), we compare TCN to its three variants, TCN's multimodal supervised learning counterpart (CN), and several other semi-supervised learning benchmark algorithms on two datasets: Bank Marketing (from the UCI repository) and DementiaBank (a dataset of pathological speech in multiple modalities). On both datasets, the F-scores of TCN align with the best benchmark models when there are more labeled data available, and outperform benchmarks (including tri-training) given as few as 20 labeled points. Transductive SVMs BID8 were an early attempt in transductive semi-supervised learning. In addition to the SVM objective, TSVMs minimize the hinge loss on unlabeled data. TSVMs have yielded good performance on our datasets, so we include them for completeness. Later, many semi-supervised learning algorithms took either autoencoding or GAN approaches. In autoencoding, a model learns a low-dimensional representation and a reconstruction for each data sample. Usually, noise is added in generating the low-dimensional representation. By trying to minimize the difference between reconstructed and original data, the model learns (i) an encoder capturing low-dimensional hidden information and (ii) a decoder, which is a generative model able to recover data. This is the approach of the denoising autoencoder BID22 BID11. An extension is Ladder network BID19, which stacks denoising autoencoders and adds layer-wise reconstruction losses. Ladder networks are often more computationally efficient than stacked denoise autoencoders. In generative adversarial networks (GANs) BID6, a generator tries to produce data that are indistinguishable from true data, given a discriminator which itself learns to tell them apart. This adversarial training procedure could proceed with few labeled data points. For example, Feature-matching GANs BID20 add generated ("synthetic") samples into the training data of the discriminator as an additional class. Another example is Categorical GANs BID21 which optimize uncertainty (measured by entropy of predictions) in the absence of labels. Noticeably, BID3 showed that a discriminator performing well on a training set might not benefit the whole dataset. CNs and TCNs, despite not containing generative components, are built with the adversarial principles inspired from GANs. The idea to make multiple components in the network agree with each other has been adopted by several previous models. For example, proposed Parallel Consensus Networks, where multiple networks classify by majority voting. Each of the networks is trained on features after a unique transform. BID13 proposed consensus optimization in GAN in which a term is added to the utility functions of both the generator and discriminator to alleviate the adversity between generator and discriminator. However, neither they nor semi-supervised learning utilized the multiple modalities. Multi-modal learning is also referred to as multi-view learning. BID18 computed multiple viewpoints from speech samples and classified cognitive impairments. By contrast, our multi-view learning is semi-supervised, and can involve non-overlapping subsets of features. In domain adaptation, some work has been applied to find a unified representation between domains, for example, by applying domain invariant training BID5 and semantic similarity loss BID15. However, our approach does not involve multiple domains -we only handle data from one domain. Here, the term'domain' refers to how the data are naturally generated, whereas the term'modality' refers to how different aspects of data are observed. In previous work, Consensus Networks BID24 was proposed for multimodal supervised learning. We extend the model to be suitable for semi-supervised learning, ing in Transductive Consensus Networks (TCNs). This section also presents three variants: TCN-embed, TCN-svm, and TCN-AE. Given labeled data, DISPLAYFORM0, and unlabeled data, {x (i) } (where x (i) ∈ X U ), we want to learn a model that reaches high accuracies in predicting labels in unlabeled data. In the semisupervised learning setting, there are many more unlabeled data points than labeled: DISPLAYFORM1 Each data point x contains feature values from multiple modalities (i.e., 'views'). If M be the total number of modalities, then DISPLAYFORM2 m is consistent throughout the dataset. E.g., there may be 200 acoustic (semantic) features for each data point. Here we briefly review the structures of CNs. In a CN model, M interpreter networks I 1,...,M each compress the corresponding modality for a data sample into a low-dimensional vector v. DISPLAYFORM0 We call these networks interpreters, because they interpret the feature spaces with representations. In TCNs, a consensus is expected to be reached given representations from multiple views of the same data sample. A discriminator network D tries to identify the originating modality of each representation vector. If we write the m th modality of the dataset as a set M m of vectors, then the discriminator function D can be expressed as: DISPLAYFORM1 To prevent the discriminator from looking at only superficial aspects for each data sample in the forward pass, Consensus Networks BID24 include an additional'noise modality' representation sampled from a normal distribution, with mean and variance determined by the'non-noise' representations: DISPLAYFORM2 The model's discrimination loss L D is therefore defined as the cross entropy loss across all modalities (plus the noise modality), averaged across both labeled and unlabeled datasets X: DISPLAYFORM3 Finally, a classifier network C predicts the probability of class assignment (y) from the combined representation vectors, given model parameters: DISPLAYFORM4 The classification loss L C is just the cross entropy loss across the labeled data: DISPLAYFORM5 The overall optimization goals for CN can therefore be described as: DISPLAYFORM6 Consensus Networks (CNs), as a supervised learning framework, are limited by the amount of labeled data. This motivates us to generalize the approach to semi-supervised scenarios. There are two mechanisms in the CN training procedures, namely the classifier mechanism and consensus mechanism. The classifier mechanism requires labeled data, but the consensus mechanism does not explicitly require these labels. We let the consensus mechanism handle both labeled and unlabeled data. This in Transductive Consensus Networks. Formally, the loss functions are rewritten as: DISPLAYFORM0 where X consists of both labeled data X L and unlabeled data X U. Overall, the optimization goal can still be written as: min DISPLAYFORM1 These goals set up a complex nonlinear optimization problem. To figure out a solution, we break down the goals into three iterative steps, similar to GAN BID6:• The'I' step encourages interpreters to produce indistinguishable representations: max DISPLAYFORM2 • The'D' step encourages discriminators to recognize modal-specific information retained in representations: min DISPLAYFORM3 • The'CI' step trains the networks to make a correct decision: min DISPLAYFORM4 The consensus mechanism builds a low-dimensional latent representation of each (labeled and unlabeled) data sample containing common knowledge across different modalities, and the classifier mechanism tries to make these representations meaningful. Three modifications are made to our base TCN model, ing in the following models:TCN-embed consists of the same networks as TCN but is trained slightly differently. Before the I-D-CI optimization cycle, we add a pretraining phase with I-D iterations, which emphasizes the consensus mechanism. TCN-svm removes the classifier network from TCN-embed. After the pretraining phase across the whole dataset, we extract the representations of those labeled data samples to train a supervised learning classifier (i.e., an SVM). TCN-svm discards the classifier mechanism, which in deteriorations to model performance (§5).TCN-AE provides insights from another perspective. In contrast to TCN, TCN-AE contains several additional reconstructor networks, R 1..M (one per modality). Each reconstructor network tries to recover the input modality from the corresponding low-dimensional representations (plus a small noise): DISPLAYFORM0 Defining reconstruction loss as L R = E x∈X E m |x m − x m | 2, the optimization target in TCN-AE can be expressed as: DISPLAYFORM1 L C, and max DISPLAYFORM2 and min DISPLAYFORM3 TCN-AE is inspired by denoising autoencoder BID22, where the existence of reconstructor networks encourage the latent variables to preserve realistic information. This somehow works against the consensus mechanism, which according to BID24 tries to agree on simple representations. TCN-AE therefore weakens the consensus mechanism. We will show in §5 that an inhibited consensus mechanism in inferior model performance. We want to quantitatively measure the effects of the consensus and the classification mechanisms. To evaluate the similarities of representations, we treat the hidden dimensions of each representation DISPLAYFORM0..] (after normalization) as discrete values of a probability mass function 1, which we write as p m. The M modalities for each data point are therefore approximated by M probability distributions. Now we can measure the relative JS divergences between each pair of representations v m and v n derived from the same data sample (D(p m ||p n)). To acquire the relative value, we normalize the JS divergence by the total entropy in p m and p n: DISPLAYFORM1 where DISPLAYFORM2 where v m,j and v n,j are the j th component of v m and v n respectively. In total, for each data sample with M modalities, DISPLAYFORM3 pairs of relative divergences are calculated. We average the negative of these divergences to get the similarity: DISPLAYFORM4 Note that by our definition the maximum value of the "similarity" value is 0 (where there is no JS divergence between any pair of the representation vectors), and it has no theoretical lower bound. FIG3 shows several 2D visualizations of representation vectors drawn from an arbitrary run. In Figure 5, we illustrate how the similarities between modality representations evolve during training. We compare TCN and its variants on two benchmark datasets: Bank Marketing, and DementiaBank. The full list of features, by modalities, are provided in the Supplementary Material. The Bank Marketing dataset is from the UCI machine learning repository BID4. used for predicting whether the customer will subscribe a term deposit in a bank marketing campaign via telephone BID14. There are originally 4,640 positive samples (subscribed) and 36,548 negative ones (did not subscribe). Since consensus network models do not work well on imbalanced datasets, we randomly sample 5,000 negative samples to create an (almost) balanced dataset. We also convert the categorical raw features 2 into one-hot representations. We then divide the features into three modalities: basic information, statistical data, and employment-related features. 1 There is a ReLU layer at output of each interpreter network, so the probability mass will be non-negative. 2 https://archive.ics.uci.edu/ml/datasets/bank+marketing DementiaBank 3 contains 473 spoken picture descriptions of the clinical "cookie-theft picture", containing 240 positive samples (the Dementia class) and 233 negative samples (the Control class). We extract 413 linguistic features from each speech sample and their transcriptions, including acoustic (e.g., pause durations), lexical & semantic (e.g., average cosine similarities between words in sentences) and syntactic (e.g., complexity of the syntactic parse structures) modalities. Table 1: Basic information about the datasets (after preprocessing). In the Bank Marketing dataset, the three modalities correspond to basic information, statistical data, and employment-related features. In DementiaBank, the three modalities correspond to acoustic, syntactic, and lexical&semantic features. Detailed descriptions of the features are included in supplementary materials. We evaluate TCN and its variants against several benchmarks, including:1. Multimodal semi-supervised learning benchmark: Tri-training BID23 4.2. TCN's supervised counterpart: Consensus Network (CN).3. Unimodal semi-supervised learning: TSVM BID8, ladder network BID19, CatGAN BID21. For simplicity, we use fully connected networks for all of I 1..M, D, C, and R 1.. M in this paper. To enable faster convergence, all fully connected networks have a batch normalization layer BID7. For training, the batch size is set to 10. The neural network models are implemented using PyTorch BID16, and supervised learning benchmark algorithms (SVM, MLP) use scikit-learn BID17.We use the Adam optimizer BID9 with an initial learning rate of 0.001. In training TCN, TCN-embed, and TCN-AE, optimizations are stopped when the classification loss does not change by more than 10 −5 in comparison to the previous step, or when the step count reaches 100. In the pre-training phase of TCN-embed and TCN-svm, training is stopped when the discrimination loss changes by less than 10 −5, or when pretraining step count reaches 20.Sometimes, the iterative optimization (i.e., the I-D-CI cycle for TCN / TCN-embed, and the I-D-RI-CI cycle for the TCN-AE variant) is trapped in local saddle points -the training classification loss does not change while the training classification loss is higher than log 2 ≈ 0.693. This is the expected loss of a binary classifier with zero knowledge. If the training classification loss is higher than log 2, the model is re-initialized with a new random seed and the training is restarted. Empirically, this re-initialization happens no more than once per ten runs, but the underlying cause needs to be examined further.5 Results and discussion As shown in FIG1, TCN outperforms or matches the best benchmarks. On the Bank Marketing dataset, TCN, CN, and TSVM clearly outperform the rest. On DementiaBank, Tri-train, TCN, and TSVM form the "first tier".Also, semi-supervised learning does not always outperform those supervised algorithms. For example, on the Bank Marketing dataset, CN (i.e., TCN's supervised learning counterpart) holds the second best performance. BID23 ), uni-modal semi-supervised (TSVM BID8, Ladder BID19, CatGAN BID21), and multi-modal supervised (CN BID24). As shown in FIG2, TCN aligns with or outperforms TCN-embed. Both of these approaches significantly outperform TCN-AE. On the other hand, TCN-svm produces almost trivial classifiers. There are several points worth noting.• Both the consensus and the classification mechanisms are beneficial to classifier performance. The classification mechanism can be beneficial even with as few as 20 labeled data samples.• Iterative optimization is crucial. Without classification mechanisms, the consensus mechanism by itself fails to derive good reprensentations. Without consensus mechanisms (i.e., when the reconstructors hinder the consensus mechanisms), accuracies drop significantly. To understand more about TCN, we visualize them with T-SNE BID12 in FIG3, and plot the similarity values in Figure 5.• The higher similarity values corresponds to a state where the distributions contain higher symmetry in aggregate manner.• Measured from the similarity values, TCN models reach a consensus state where the similarities are stable. TCN-svm reaches agreements quickly but are close to trivial. TCN-AE, with the autoencoder blocking the consensus mechanism, fails to reach a state of agreement.. The three colors represent three modalities. At step 2, the representations are distributed randomly. At step 110, they become mixed evenly. The most interesting embedding happens at step 30, when representations of the three modalities form three'drumstick' shapes. With the highest visual symmetry, this configuration also has the highest similarity among the three. Figure 5: Examples of similarity plots against the number of steps taken, for DementiaBank using 80 labeled samples ("DB80", blue) and Bank Marketing using 20 labeled samples ("BM20", green). The y axis are scaled to (−0.035, 0) except TCN-AE, where the relative JS divergences "explode". Note that we stop the training procedure when losses converge (as detailed in §4.3), so the trials may stop at different steps. In this paper, we present Transductive Consensus Networks (TCNs) that extend consensus networks with semi-supervised learning. We identify two mechanisms in which TCNs function, i.e., the consensus and classifier mechanisms. With three TCN variants in an ablation study, we show the importance of both mechanisms. Moreover, by treating the representations as probability distributions and defining their similarity as negative relative JS divergences, we show that although the consensus mechanism urges high similarities, a good consensus state might not need perfect similarities between modality representations. In the future, several avenues may be considered. To start with, building consensus networks using other types of neural networks may be considered. In addition, more exploration could be done to find a more explainable metric to describe the extent of agreement. Currently, we use − H1+H2, but this requires some approximations. Optimizing against the similarity metric, instead of setting up a discriminator, may be worth examining as well.

TCN for multimodal semi-supervised learning + ablation study of its mechanisms + interpretations of latent representations

We leverage deterministic autoencoders as generative models by proposing mixing functions which combine hidden states from pairs of images. These mixes are made to look realistic through an adversarial framework.


Question: Represent the article for finding a single-sentence TLDR

Question: Several first order stochastic optimization methods commonly used in the Euclidean domain such as stochastic gradient descent (SGD), accelerated gradient descent or variance reduced methods have already been adapted to certain Riemannian settings. However, some of the most popular of these optimization tools - namely Adam, Adagrad and the more recent Amsgrad - remain to be generalized to Riemannian manifolds. We discuss the difficulty of generalizing such adaptive schemes to the most agnostic Riemannian setting, and then provide algorithms and convergence proofs for geodesically convex objectives in the particular case of a product of Riemannian manifolds, in which adaptivity is implemented across manifolds in the cartesian product. Our generalization is tight in the sense that choosing the Euclidean space as Riemannian manifold yields the same algorithms and regret bounds as those that were already known for the standard algorithms. Experimentally, we show faster convergence and to a lower train loss value for Riemannian adaptive methods over their corresponding baselines on the realistic task of embedding the WordNet taxonomy in the Poincare ball. Developing powerful stochastic gradient-based optimization algorithms is of major importance for a variety of application domains. In particular, for computational efficiency, it is common to opt for a first order method, when the number of parameters to be optimized is great enough. Such cases have recently become ubiquitous in engineering and computational sciences, from the optimization of deep neural networks to learning embeddings over large vocabularies. This new need ed in the development of empirically very successful first order methods such as ADAGRAD BID5, ADADELTA BID29, ADAM BID9 or its recent update AMSGRAD BID18.Note that these algorithms are designed to optimize parameters living in a Euclidean space R n, which has often been considered as the default geometry to be used for continuous variables. However, a recent line of work has been concerned with the optimization of parameters lying on a Riemannian manifold, a more general setting allowing non-Euclidean geometries. This family of algorithms has already found numerous applications, including for instance solving Lyapunov equations BID27, matrix factorization BID23, geometric programming BID22, dictionary learning BID2 or hyperbolic taxonomy embedding BID15 BID6 BID4 BID14.A few first order stochastic methods have already been generalized to this setting (see section 6), the seminal one being Riemannian stochastic gradient descent (RSGD) BID1, along with new methods for their convergence analysis in the geodesically convex case. However, the above mentioned empirically successful adaptive methods, together with their convergence analysis, remain to find their respective Riemannian counterparts. Indeed, the adaptivity of these algorithms can be thought of as assigning one learning rate per coordinate of the parameter vector. However, on a Riemannian manifold, one is generally not given an intrinsic coordinate system, rendering meaningless the notions sparsity or coordinate-wise update. Our contributions. In this work we (i) explain why generalizing these adaptive schemes to the most agnostic Riemannian setting in an intrinsic manner is compromised, and (ii) propose generalizations of the algorithms together with their convergence analysis in the particular case of a product of manifolds where each manifold represents one "coordinate" of the adaptive scheme. Finally, we (iii) empirically support our claims on the realistic task of hyperbolic taxonomy embedding. Our initial motivation. The particular application that motivated us in developing Riemannian versions of ADAGRAD and ADAM was the learning of symbolic embeddings in non-Euclidean spaces. As an example, the GloVe algorithm BID17 ) − an unsupervised method for learning Euclidean word embeddings capturing semantic/syntactic relationships − benefits significantly from optimizing with ADAGRAD compared to using SGD, presumably because different words are sampled at different frequencies. Hence the absence of Riemannian adaptive algorithms could constitute a significant obstacle to the development of competitive optimization-based Riemannian embedding methods. In particular, we believe that the recent rise of embedding methods in hyperbolic spaces could benefit from such developments BID15 BID6 b; BID4 BID28. We recall here some elementary notions of differential geometry. For more in-depth expositions, we refer the interested reader to BID21 and BID19.Manifold, tangent space, Riemannian metric. A manifold M of dimension n is a space that can locally be approximated by a Euclidean space R n, and which can be understood as a generalization to higher dimensions of the notion of surface. For instance, the sphere S:= {x ∈ R n | x 2 = 1} embedded in R n is an (n − 1)-dimensional manifold. In particular, R n is a very simple n-dimensional manifold, with zero curvature. At each point x ∈ M, one can define the tangent space T x M, which is an n-dimensional vector space and can be seen as a first order local approximation of M around x. A Riemannian metric ρ is a collection ρ:= (ρ x) x∈M of inner-products ρ x (·, ·): T x M × T x M → R on T x M, varying smoothly with x. It defines the geometry locally on M. For x ∈ M and u ∈ T x M, we also write u x:= ρ x (u, u). A Riemannian manifold is a pair (M, ρ).Induced distance function, geodesics. Notice how a choice of a Riemannian metric ρ induces a natural global distance function on M. Indeed, for x, y ∈ M, we can set d(x, y) to be equal to the infimum of the lengths of smooth paths between x and y in M, where the length (c) of a path c is given by integrating the size of its speed vectorċ(t) ∈ T c(t) M, in the corresponding tangent space:(c):= Consider performing an SGD update of the form DISPLAYFORM0 where g t denotes the gradient of objective f t 1 and α > 0 is the step-size. In a Riemannian manifold (M, ρ), for smooth f: M → R, BID1 defines Riemannian SGD by the following update: DISPLAYFORM1 where g t ∈ T xt M denotes the Riemannian gradient of f t at x t. Note that when (M, ρ) is the Euclidean space (R n, I n), these two match, since we then have exp x (v) = x + v. Intuitively, applying the exponential map enables to perform an update along the shortest path in the relevant direction in unit time, while remaining in the manifold. In practice, when exp x (v) is not known in closed-form, it is common to replace it by a retraction map R x (v), most often chosen as R x (v) = x + v, which is a first-order approximation of exp x (v). Let's recall here the main algorithms that we are taking interest in. ADAGRAD. Introduced by BID5, the standard form of its update step is defined as DISPLAYFORM0 Such updates rescaled coordinate-wise depending on the size of past gradients can yield huge improvements when gradients are sparse, or in deep networks where the size of a good update may depend on the layer. However, the accumulation of all past gradients can also slow down learning. ADAM. Proposed by BID9, the ADAM update rule is given by DISPLAYFORM1 where m t = β 1 m t−1 + (1−β 1)g t can be seen as a momentum term and DISPLAYFORM2 2 is an adaptivity term. When β 1 = 0, one essentially recovers the unpublished method RMSPROP BID24, the only difference to ADAGRAD being that the sum is replaced by an exponential moving average, hence past gradients are forgotten over time in the adaptivity term v t. This circumvents the issue of ADAGRAD that learning could stop too early when the sum of accumulated squared gradients is too significant. Let us also mention that the momentum term introduced by ADAM for β 1 = 0 has been observed to often yield huge empirical improvements. AMSGRAD. More recently, BID18 identified a mistake in the convergence proof of ADAM. To fix it, they proposed to either modify the ADAM algorithm with DISPLAYFORM3 which they coin AMSGRAD, or to choose an increasing schedule for β 2, making it time dependent, which they call ADAMNC (for non-constant). Intrinsic updates. It is easily understandable that writing any coordinate-wise update requires the choice of a coordinate system. However, on a Riemannian manifold (M, ρ), one is generally not 1 to be interpreted as the objective with the same parameters, evaluated at the minibatch taken at time t. 2 a small ε = 10 −8 is often added in the square-root for numerical stability, omitted here for simplicity. 3 with mt and vt defined by the same equations as in ADAM (see above paragraph).provided with a canonical coordinate system. The formalism only allows to work with certain local coordinate systems, also called charts, and several different charts can be defined around each point x ∈ M. One usually says that a quantity defined using a chart is intrinsic to M if its definition does not depend on which chart was used. For instance, it is known that the Riemannian gradient gradf of a smooth function f: M → R can be defined intrinsically to (M, ρ), but its Hessian is only intrinsically defined at critical points 4. It is easily seen that the RSGD update of Eq. FORMULA1 is intrinsic, since it only involves exp and grad, which are objects intrinsic to (M, ρ). However, it is unclear whether it is possible at all to express either of Eqs. in a coordinate-free or intrinsic manner. A tempting solution. Note that since an update is defined in a tangent space, one could be tempted to fix a canonical coordinate system e:= (e,..., e (n) ) in the tangent space T x0 M R d at the initialization x 0 ∈ M, and parallel-transport e along the optimization trajectory, adapting Eq. FORMULA2 to: DISPLAYFORM0 where and (·) 2 denote coordinate-wise division and square respectively, these operations being taken relatively to coordinate system e t. In the Euclidean space, parallel transport between two points x and y does not depend on the path it is taken along because the space has no curvature. However, in a general Riemannian manifold, not only does it depend on the chosen path but curvature will also give to parallel transport a rotational component 5, which will almost surely break the sparsity of the gradients and hence the benefit of adaptivity. Besides, the interpretation of adaptivity as optimizing different features (i.e. gradient coordinates) at different speeds is also completely lost here, since the coordinate system used to represent gradients depends on the optimization path. Finally, note that the techniques we used to prove our theorems would not apply to updates defined in the vein of Eq.. From now on, we assume additional structure on (M, ρ), namely that it is the cartesian product of n Riemannian manifolds (M i, ρ i), where ρ is the induced product metric: DISPLAYFORM0 Product notations. The induced distance function d on M is known to be given by DISPLAYFORM1 Similarly, the exponential, log map and the parallel transport in M are the concatenations of those in each M i.Riemannian ADAGRAD. We just saw in the above discussion that designing meaningful adaptive schemes − intuitively corresponding to one learning rate per coordinate − in a general Riemannian manifold was difficult, because of the absence of intrinsic coordinates. Here, we propose to see each component x i ∈ M i of x as a "coordinate", yielding a simple adaptation of Eq. as DISPLAYFORM2 On the adaptivity term. Note that we take (squared) Riemannian norms g DISPLAYFORM3 in the adaptivity term rescaling the gradient. In the Euclidean setting, this quantity is simply a scalar (g DISPLAYFORM4 In section 2, we briefly presented ADAGRAD, ADAM and AMSGRAD. Intuitively, ADAM can be described as a combination of ADAGRAD with a momentum (of parameter β 1), with the slight modification that the sum of the past squared-gradients is replaced with an exponential moving average, for an exponent β 2. Let's also recall that AMSGRAD implements a slight modification of ADAM, allowing to correct its convergence proof. Finally, ADAMNC is simply ADAM, but with a particular non-constant schedule for β 1 and β 2. On the other hand, what is interesting to note is that the schedule initially proposed by BID18 for β 2 in ADAMNC, namely β 2t:= 1 − 1/t, lets v t recover the sum of squared-gradients of ADAGRAD. Hence, ADAMNC without momentum (i.e. β 1t = 0) yields ADAGRAD.Assumptions and notations. For 1 ≤ i ≤ n, we assume (M i, ρ i) is a geodesically complete Riemannian manifold with sectional curvature lower bounded by κ i ≤ 0. As written in Eq. FORMULA7, let (M, ρ) be the product manifold of the (M i, ρ i)'s. For each i, let X i ⊂ M i be a compact, geodesically convex set and define X:= X 1 × · · · × X n, the set of feasible parameters. Define Π Xi: M i → X i to be the projection operator, i.e. Π Xi (x) is the unique y ∈ X i minimizing d i (y, x). Denote by P i, exp i and log i the parallel transport, exponential and log maps in DISPLAYFORM0 and by g i ∈ T x i M i the corresponding components of x and g. In the sequel, let (f t) be a family of differentiable, geodesically convex functions from M to R. Assume that each X i ⊂ M i has a diameter bounded by D ∞ and that for all 1 ≤ i ≤ n, t ∈ [T] and x ∈ X, (gradf t (x)) i xi ≤ G ∞. Finally, our convergence guarantees will bound the regret, defined at the end of T rounds as DISPLAYFORM1 Following the discussion in section 3.2 and especially Eq., we present Riemannian AMSGRAD in FIG1. For comparison, we show next to it the standard AMSGRAD algorithm in FIG1.Require: DISPLAYFORM2 Require: DISPLAYFORM3 DISPLAYFORM4 From these algorithms, RADAM and ADAM are obtained simply by removing the max operations, i.e. replacingv i t = max{v DISPLAYFORM5 The convergence guarantee that we obtain for RAMSGRAD is presented in Theorem 1, where the quantity ζ is defined by as DISPLAYFORM6 For comparison, we also show the convergence guarantee of the original AMSGRAD in appendix C. Note that when (M i, ρ i) = R for all i, convergence guarantees between RAMSGRAD and AMSGRAD coincide as well. Indeed, the curvature dependent quantity (ζ(κ i, D ∞) + 1)/2 in the Riemannian case then becomes equal to 1, recovering the convergence theorem of AMSGRAD. It is also interesting to understand at which speed does the regret bound worsen when the curvature is small but non-zero: by a multiplicative factor of approximately 1 + D ∞ |κ|/6 (see Eq. FORMULA18). Similar remarks hold for RADAMNC, whose convergence guarantee is shown in Theorem 2. Finally, notice that β 1:= 0 in Theorem 2 yields a convergence proof for RADAGRAD, whose update rule we defined in Eq..Theorem 1 (Convergence of RAMSGRAD). Let (x t) and (v t) be the sequences obtained from Algorithm 1a, α t = α/ √ t, β 1 = β 11, β 1t ≤ β 1 for all t ∈ [T] and γ = β 1 / √ β 2 < 1. We then have: DISPLAYFORM7 Proof. See appendix A.Theorem 2 (Convergence of RADAMNC). Let (x t) and (v t) be the sequences obtained from RADAMNC, α t = α/ √ t, β 1 = β 11, β 1t = β 1 λ t−1, λ < 1, β 2t = 1 − 1/t. We then have: DISPLAYFORM8 Proof. See appendix B.The role of convexity. Note how the notion of convexity in Theorem 5 got replaced by the notion of geodesic convexity in Theorem 1. Let us compare the two definitions: the differentiable functions f: R n → R and g: M → R are respectively convex and geodesically convex if for all x, y ∈ R n, u, v ∈ M: DISPLAYFORM9 But how does this come at play in the proofs? Regret bounds for convex objectives are usually obtained by bounding T t=1 f t (x t) − f t (x *) using Eq. FORMULA0 for any x * ∈ X, which boils down to bounding each g t, x t − x *. In the Riemannian case, this term becomes ρ xt (g t, − log xt (x *)).The role of the cosine law. How does one obtain a bound on g t, x t − x *? For simplicity, let us look at the particular case of an SGD update, from Eq.. Using a cosine law, this yields DISPLAYFORM10 One now has two terms to bound: (i) when summing over t, the first one simplifies as a telescopic summation; (ii) the second term T t=1 α t g t 2 will require a well chosen decreasing schedule for α. In Riemannian manifolds, this step is generalized using the analogue lemma 6 introduced by, valid in all Alexandrov spaces, which includes our setting of geodesically convex subsets of Riemannian manifolds with lower bounded sectional curvature. The curvature dependent quantity ζ of Eq. appears from this lemma, letting us bound ρ DISPLAYFORM11 The benefit of adaptivity. Let us also mention that the above bounds significantly improve for sparse (per-manifold) gradients. In practice, this could happen for instance for algorithms embedding each word i (or node of a graph) in a manifold M i and when just a few words are updated at a time. On the choice of ϕ i. The fact that our convergence theorems (see lemma 3) do not require specifying ϕ i suggests that the regret bounds could be improved by exploiting momentum/acceleration in the proofs for a particular ϕ i. Note that this remark also applies to AMSGRAD BID18. We empirically assess the quality of the proposed algorithms: RADAM, RAMSGRAD and RADAGRAD compared to the non-adaptive RSGD method (Eq. 2). For this, we follow BID15 and embed the transitive closure of the WordNet noun hierarchy BID12 in the n-dimensional Poincaré model D n of hyperbolic geometry which is well-known to be better suited to embed tree-like graphs than the Euclidean space BID8 BID4. In this case, each word is embedded in the same space of constant curvature −1, thus M i = D n, ∀i. Note that it would also be interesting to explore the benefit of our optimization tools for algorithms proposed in BID14 BID4 BID6. The choice of the Poincaré model is justified by the access to closed form expressions for all the quantities used in Alg. 1a: DISPLAYFORM0 n, where λ x = 2 1− x 2 is the conformal factor.• Riemannian gradients are rescaled Euclidean gradients: DISPLAYFORM1 • Distance function and geodesics, BID15 BID26 BID7 ).• Exponential and logarithmic maps: DISPLAYFORM2, where ⊕ is the generalized Mobius addition BID26 BID7 ).• Parallel transport along the unique geodesic from x to y: P x→y (v) = λx λy · gyr[y, −x]v. This formula was derived from BID26 BID7, gyr being given in closed form in (, Eq. (1.27) ).Dataset & Model. The transitive closure of the WordNet taxonomy graph consists of 82,115 nouns and 743,241 hypernymy Is-A relations (directed edges E). These words are embedded in D n such that the distance between words connected by an edge is minimized, while being maximized otherwise. We minimize the same loss function as BID15 which is similar with log-likelihood, but approximating the partition function using sampling of negative word pairs (non-edges), fixed to 10 in our case. Note that this loss does not use the direction of the edges in the graph DISPLAYFORM3 Metrics. We report both the loss value and the mean average precision (MAP) BID15: for each directed edge (u, v), we rank its distance d(u, v) among the full set of ground truth negative examples {d(u, v)|(u, v) / ∈ E}. We use the same two settings as BID15, namely: reconstruction (measuring representation capacity) and link prediction (measuring generalization). For link prediction we sample a validation set of 2% edges from the set of transitive closure edges that contain no leaf node or root. We only focused on 5-dimensional hyperbolic spaces. Training details. For all methods we use the same "burn-in phase" described in BID15 for 20 epochs, with a fixed learning rate of 0.03 and using RSGD with retraction as explained in Sec. 2.2. Solely during this phase, we sampled negative words based on their graph degree raised at power 0.75. This strategy improves all metrics. After that, when different optimization methods start, we sample negatives uniformly. We use n = 5, following BID15.Optimization methods. Experimentally we obtained slightly better for RADAM over RAMS-GRAD, so we will mostly report the former. Moreover, we unexpectedly observed convergence to lower loss values when replacing the true exponential map with its first order approximation − i.e. the retraction R x (v) = x + v − in both RSGD and in our adaptive methods from Alg. 1a. One possible explanation is that retraction methods need fewer steps and smaller gradients to "escape" points sub-optimally collapsed on the ball border of D n compared to fully Riemannian methods. As a consequence, we report "retraction"-based methods in a separate setting as they are not directly comparable to their fully Riemannian analogues. Results. We show in FIG2 for "exponential" based and "retraction" based methods. We ran all our methods with different learning rates from the set {0.001, 0.003, 0.01, 0.03, 0.1, 0.3, 1.0, 3.0}. For the RSGD baseline we show in orange the best learning rate setting, but we also show the previous lower (slower convergence, in blue) and the next higher (faster overfitting, in green) learning rates. For RADAM and RAMSGRAD we only show the best settings. We always use β 1 = 0.9 and β 2 = 0.999 for these methods as these achieved the lowest training loss. RADAGRAD was consistently worse, so we do not report it. As can be seen, RADAM always achieves the lowest training loss. On the MAP metric for both reconstruction and link prediction settings, the same method also outperforms all the other methods for the full Riemannian setting (i.e. Tab. 2). Interestingly, in the "retraction" setting, RADAM reaches the lowest training loss value and is on par with RSGD on the MAP evaluation for both reconstruction and link prediction settings. However, RAMSGRAD is faster to converge in terms of MAP for the link prediction task, suggesting that this method has a better generalization capability. After Riemannian SGD was introduced by BID1, a pletora of other first order Riemannian methods arose, such as Riemannian SVRG, Riemannian Stein variational gradient descent BID10, Riemannian accelerated gradient descent BID31 or averaged RSGD BID25, along with new methods for their convergence analysis in the geodesically convex case. Stochastic gradient Langevin dynamics was generalized as well, to improve optimization on the probability simplex BID16.Let us also mention that BID20 proposed Riemannian counterparts of SGD with momentum and RMSprop, suggesting to transport the momentum term using parallel translation, which is an idea that we preserved. However (i) no convergence guarantee is provided and (ii) their algorithm performs the coordinate-wise adaptive operations (squaring and division) w.r.t. a coordinate system in the tangent space, which, as we discussed in section 3.1, compromises the possibility of obtaining convergence guarantees. Finally, another version of Riemannian ADAM for the Grassmann manifold G(1, n) was previously introduced by BID3, also transporting the momentum term using parallel translation. However, their algorithm completely removes the adaptive component, since the adaptivity term v t becomes a scalar. No adaptivity across manifolds is discussed, which is the main point of our discussion. Moreover, no convergence analysis is provided either. Driven by recent work in learning non-Euclidean embeddings for symbolic data, we propose to generalize popular adaptive optimization tools (e.g. ADAM, AMSGRAD, ADAGRAD) to Cartesian products of Riemannian manifolds in a principled and intrinsic manner. We derive convergence rates that are similar to the Euclidean corresponding models. Experimentally we show that our methods outperform popular non-adaptive methods such as RSGD on the realistic task of hyperbolic word taxonomy embedding. DISPLAYFORM0 i *. Combining the following formula 8: DISPLAYFORM1 with the following inequality (given by lemma 6): DISPLAYFORM2 yields DISPLAYFORM3 where the use the notation ·, · x i for ρ DISPLAYFORM4 Now applying Cauchy-Schwarz' and Young's inequalities to the last term yields DISPLAYFORM5 From the geodesic convexity of f t for 1 ≤ t ≤ T, we have DISPLAYFORM6 Let's look at the first term. Using β 1t ≤ β 1 and with a change of indices, we have DISPLAYFORM7 where the last equality comes from a standard telescopic summation. We now need the following lemma. Lemma 3. DISPLAYFORM8 Proof. Let's start by separating the last term, and removing the hat on v. Using that β 1k ≤ β 1 for all k ∈ [T], (1 − β 1j)β DISPLAYFORM9 Finally, (1 − β 1j) ≤ 1 and The following lemma is a user-friendly inequality developed by in order to prove convergence of gradient-based optimization algorithms, for geodesically convex functions, in Alexandrov spaces. Lemma 6 (Cosine inequality in Alexandrov spaces). If a, b, c, are the sides (i.e., side lengths) of a geodesic triangle in an Alexandrov space with curvature lower bounded by κ, and A is the angle between sides b and c, then DISPLAYFORM0 Proof. See section 3.1, lemma 6 of.Lemma 7 (An analogue of Cauchy-Schwarz). For all p, k ∈ N *, u 1,..., u k ∈ R p, a 1,..., a k ∈ R +, we have Proof. The proof consists in applying Cauchy-Schwarz' inequality two times: DISPLAYFORM1 DISPLAYFORM2 Finally, this last lemma is used by BID18 in their convergence proof for ADAMNC. We need it too, in an analogue lemma. Lemma 8 (BID0). For any non-negative real numbers y 1,..., y t, the following holds: DISPLAYFORM3

Represent this text to find a much much longer article about it with say hundreds-thousands of words

Adapting Adam, Amsgrad, Adagrad to Riemannian manifolds.

Represent the short summary for finding the corresponding scientific article (long)

We show shortcut connections should be placed in patterns that minimize between-layer distances during backpropagation, and design networks that achieve log L distances using L log(L) connections.


Question: Represent the scientific article to find a short TLDR

Question: We study the problem of defending deep neural network approaches for image classification from physically realizable attacks. First, we demonstrate that the two most scalable and effective methods for learning robust models, adversarial training with PGD attacks and randomized smoothing, exhibit very limited effectiveness against three of the highest profile physical attacks. Next, we propose a new abstract adversarial model, rectangular occlusion attacks, in which an adversary places a small adversarially crafted rectangle in an image, and develop two approaches for efficiently computing the ing adversarial examples. Finally, we demonstrate that adversarial training using our new attack yields image classification models that exhibit high robustness against the physically realizable attacks we study, offering the first effective generic defense against such attacks. State-of-the-art effectiveness of deep neural networks has made it the technique of choice in a variety of fields, including computer vision , natural language processing , and speech recognition . However, there have been a myriad of demonstrations showing that deep neural networks can be easily fooled by carefully perturbing pixels in an image through what have become known as adversarial example attacks (; ; b;). In response, a large literature has emerged on defending deep neural networks against adversarial examples, typically either proposing techniques for learning more robust neural network models (; ; b; ;), or by detecting adversarial inputs . Particularly concerning, however, have been a number of demonstrations that implement adversarial perturbations directly in physical objects that are subsequently captured by a camera, and then fed through the deep neural network classifier (; ; b;). Among the most significant of such physical attacks on deep neural networks are three that we specifically consider here: 1) the attack which fools face recognition by using adversarially designed eyeglass frames , 2) the attack which fools stop sign classification by adding adversarially crafted stickers , and 3) the universal adversarial patch attack, which causes targeted misclassification of any object with the adversarially designed sticker (patch) . Oddly, while considerable attention has been devoted to defending against adversarial perturbation attacks in the digital space, there are no effective methods specifically to defend against such physical attacks. Our first contribution is an empirical evaluation of the effectiveness of conventional approaches to robust ML against two physically realizable attacks: the eyeglass frame attack on face recognition and the sticker attack on stop signs . Specifically, we study the performance on adversarial training and randomized smoothing against these attacks, and show that both have limited effectiveness in this context (quite ineffective in some settings, and somewhat more effective, but still not highly robust, in others), despite showing moderate effectiveness against l ∞ and l 2 attacks, respectively. Our second contribution is a novel abstract attack model which more directly captures the nature of common physically realizable attacks than the conventional l p -based models. Specifically, we consider a simple class of rectangular occlusion attacks in which the attacker places a rectangular sticker onto an image, with both the location and the content of the sticker adversarially chosen. We develop several algorithms for computing such adversarial occlusions, and use adversarial training to obtain neural network models that are robust to these. We then experimentally demonstrate that our proposed approach is significantly more robust against physical attacks on deep neural networks than adversarial training and randomized smoothing methods that leverage l p -based attack models. Related Work While many approaches for defending deep learning in vision applications have been proposed, robust learning methods have been particularly promising, since alternatives are often defeated soon after being proposed (; a; ;). The standard solution approach for this problem is an adaptation of Stochastic Gradient Descent (SGD) where gradients are either with respect to the loss at the optimal adversarial perturbation for each i (or approximation thereof, such as using heuristic local search or a convex over-approximation (b;) ), or with respect to the dual of the convex relaxation of the attacker maximization problem (a; ;). Despite these advances, adversarial training a la remains the most practically effective method for hardening neural networks against adversarial examples with l ∞ -norm perturbation constraints. Recently, randomized smoothing emerged as another class of techniques for obtaining robustness , with the strongest in the context of l 2 -norm attacks. In addition to training neural networks that are robust by construction, a number of methods study the problem of detecting adversarial examples , with mixed (a). Of particular interest is recent work on detecting physical adversarial examples . However, detection is inherently weaker than robustness, which is our goal, as even perfect detection does not resolve the question of how to make decisions on adversarial examples. Finally, our work is in the spirit of other recent efforts that characterize robustness of neural networks to physically realistic perturbations, such as translations, rotations, blurring, and contrast . Adversarial examples involve modifications of input images that are either invisible to humans, or unsuspicious, and that cause systematic misclassification by state-of-the-art neural networks (; ;). Commonly, approaches for generating adversarial examples aim to solve an optimization problem of the following form: arg max where x is the original input image, δ is the adversarial perturbation, L(·) is the adversary's utility function (for example, the adversary may wish to maximize the cross-entropy loss), and · p is some l p norm. While a host of such digital attacks have been proposed, two have come to be viewed as state of the art: the attack developed by Carlini & Wagner (2017b), and the projected gradient descent attack (PGD) by. While most of the work to date has been on attacks which modify the digital image directly, we focus on a class of physical attacks which entail modifying the actual object being photographed in order to fool the neural network that subsequently takes its digital representation as input. The attacks we will focus on will have three characteristics: 1. The attack can be implemented in the physical space (e.g., modifying the stop sign); 2. the attack has low suspiciousness; this is operationalized by modifying only a small part of the object, with the modification similar to common "noise" that obtains in the real world; for example, stickers on a stop sign would appear to most people as vandalism, but covering the stop sign with a printed poster would look highly suspicious; and 3. the attack causes misclassification by state-of-the-art deep neural network. Since our ultimate purpose is defense, we will not concern ourselves with the issue of actually implementing the physical attacks. Instead, we will consider the digital representation of these attacks, ignoring other important issues, such as robustness to many viewpoints and printability. For example, in the case where the attack involves posting stickers on a stop sign, we will only be concerned with simulating such stickers on digital images of stop signs. For this reason, we refer to such attacks physically realizable attacks, to allude to the fact that it is possible to realize them in practice. It is evident that physically realizable attacks represent a somewhat stronger adversarial model than their actual implementation in the physical space. Henceforth, for simplicity, we will use the terms physical attacks and physically realizable attacks interchangeably. We consider three physically realizable attacks. The first is the attack on face recognition by , in which the attacker adds adversarial noise inside printed eyeglass frames that can subsequently be put on to fool the deep neural network (Figure 1a). The second attack posts adversarially crafted stickers on a stop sign to cause it to be misclassified as another road sign, such as the speed limit sign (Figure 1b) . The third, adversarial patch, attack designs a patch (a sticker) with adversarial noise that can be placed onto an arbitrary object, causing that object to be misclassified by a deep neural network . While numerous approaches have been proposed for making deep learning robust, many are heuristic and have soon after been defeated by more sophisticated attacks (b; ; a; a). Consequently, we focus on principled approaches for defense that have not been broken. These fall broadly into two categories: robust learning and randomized smoothing. We focus on a state-of-the-art representative from each class. Robust Learning The goal of robust learning is to minimize a robust loss, defined as follows: where D denotes the training data set. In itself this is a highly intractable problem. Several techniques have been developed to obtain approximate solutions. Among the most effective in practice is the adversarial training approach by , who use the PGD attack as an approximation to the inner optimization problem, and then take gradient descent steps with respect to the associated adversarial inputs. In addition, we consider a modified version of this approach termed curriculum adversarial training . Our implementation of this approach proceeds as follows: first, apply adversarial training for a small, then increase and repeat adversarial training, and so on, increasing until we reach the desired level of adversarial noise we wish to be robust to. The second class of techniques we consider works by adding noise to inputs at both training and prediction time. The key idea is to construct a smoothed classifier g(·) from a base classifier f (·) by perturbing the input x with isotropic Gaussian noise with variance σ. The prediction is then made by choosing a class with the highest probability measure with respect to the induced distribution of f (·) decisions: To achieve provably robust classification in this manner one typically trains the classifier f (·) by adding Gaussian noise to inputs at training time . Most of the approaches for endowing deep learning with adversarial robustness focus on adversarial models in which the attacker introduces l p -bounded adversarial perturbations over the entire input. Earlier we described two representative approaches in this vein: adversarial training, commonly focused on robustness against l ∞ attacks, and randomized smoothing, which is most effective against l 2 attacks (although certification bounds can be extended to other l p norms as well). We call these methods conventional robust ML. In this section, we ask the following question: Are conventional robust ML methods robust against physically realizable attacks? This is similar to the question was asked in the context of malware classifier evasion by , who found that l p -based robust ML methods can indeed be successful in achieving robustness against realizable evasion attacks. Ours is the first investigation of this issue in computer vision applications and for deep neural networks, where attacks involve adversarial masking of objects. We study this issue experimentally by considering two state-of-the-art approaches for robust ML: adversarial training a-la-, along with its curriculum learning variation , and randomized smoothing, using the implementation by. These approaches are applied to defend against two physically realizable attacks described in Section 2.1: an attack on face recognition which adds adversarial eyeglass frames to faces , and an attack on stop sign classification which adds adversarial stickers to a stop sign to cause misclassification . We consider several variations of adversarial training, as a function of the l ∞ bound,, imposed on the adversary. Just as , adversarial instances in adversarial training were generated using PGD. We consider attacks with ∈ {4, 8} (adversarial training failed to make progress when we used = 16). For curriculum adversarial training, we first performed adversarial training with = 4, then doubled to 8 and repeated adversarial training with the model robust to = 4, then doubled again, and so on. In the end, we learned models for ∈ {4, 8, 16, 32}. For all versions of adversarial training, we consider 7 and 50 iterations of the PGD attack. We used the learning rate of /4 for the former and 1 for the latter. In all cases, pixels are in 0 ∼ 255 range and retraining was performed for 30 epochs using the ADAM optimizer. For randomized smoothing, we consider noise levels σ ∈ {0.25, 0.5, 1} as in , and take 1000 Monte Carlo samples at test time. We applied white-box dodging (untargeted) attacks on the face recognition systems (FRS) from. We used both the VGGFace data and transferred VGGFace CNN model for the face recognition task, subselecting 10 individuals, with 300-500 face images for each. Further details about the dataset, CNN architecture, and training procedure are in Appendix A. For the attack, we used identical frames as in occupying 6.5% of the pixels. Just as , we compute attacks (that is, adversarial perturbations inside the eyeglass frame area) by using the learning rate 20 as well as momentum value 0.4, and vary the number of attack iterations between 0 (no attack) and 300. eyeglass frame attack. First, it is clear that none of the variations of adversarial training are particularly effective once the number of physical attack iterations is above 20. The best performance in terms of adversarial robustness is achieved by adversarial training with = 8, for approaches using either 7 or 50 PGD iterations (the difference between these appears negligible). However, non-adversarial accuracy for these models is below 70%, a ∼20% drop in accuracy compared to the original model. Moreover, adversarial accuracy is under 40% for sufficiently strong physical attacks. Curriculum adversarial training generally achieves significantly higher non-adversarial accuracy, but is far less robust, even when trained with PGD attacks that use = 32. Figure 2 (right) shows the performance of randomized smoothing when faced with the eyeglass frames attack. It is readily apparent that randomized smoothing is ineffective at deflecting this physical attack: even as we vary the amount of noise we add, accuracy after attacks is below 20% even for relatively weak attacks, and often drops to nearly 0 for sufficiently strong attacks. , we use the LISA traffic sign dataset for our experiments, and 40 stop signs from this dataset as our test data and perform untargeted attacks (this is in contrast to the original work, which is focused on targeted attacks). For the detailed description of the data and the CNN used for traffic sign prediction, see Appendix A. We apply the same settings as in the original attacks and use ADAM optimizer with the same parameters. Since we observed few differences in performance between running PGD for 7 vs. 50 iterations, adversarial training methods in this section all use 7 iterations of PGD. Again, we begin by considering adversarial training (Figure 3, left and middle). In this case, both the original and curriculum versions of adversarial training with PGD are ineffective when = 32 (error rates on clean data are above 90%); these are consequently omitted from the plots. Curriculum adversarial training with = 16 has the best performance on adversarial data, and works well on clean data. Surprisingly, most variants of adversarial training perform at best marginally better than the original model against the stop sign attack. Even the best variant has relatively poor performance, with robust accuracy under 50% for stronger attacks. Figure 3 (right) presents the for randomized smoothing. In this set of experiments, we found that randomized smoothing performs inconsistently. To address this, we used 5 random seeds to repeat the experiments, and use the ing mean values in the final . Here, the best variant uses σ = 0.25, and, unlike experiments with the eyeglass frame attack, significantly outperforms adversarial training, reaching accuracy slightly above 60% even for the stronger attacks. Neverthe-less, even randomized smoothing in significant degradation of effectiveness on adversarial instances (nearly 40%, compared to clean data). There are two possible reasons why conventional robust ML perform poorly against physical attacks: 1) adversarial models involving l p -bounded perturbations are too hard to enable effective robust learning, and 2) the conventional attack model is too much of a mismatch for realistic physical attacks. In Appendix B, we present evidence supporting the latter. Specifically, we find that conventional robust ML models exhibit much higher robustness when faced with the l p -bounded attacks they are trained to be robust to. As we observed in Section 3, conventional models for making deep learning robust to attack can perform quite poorly when confronted with physically realizable attacks. In other words, the evidence strongly suggests that the conventional models of attacks in which attackers can make l p -bounded perturbations to input images are not particularly useful if one is concerned with the main physical threats that are likely to be faced in practice. However, given the diversity of possible physical attacks one may perpetrate, is it even possible to have a meaningful approach for ensuring robustness against a broad range of physical attacks? For example, the two attacks we considered so far couldn't be more dissimilar: in one, we engineer eyeglass frames; in another, stickers on a stop sign. We observe that the key common element in these attacks, and many other physical attacks we may expect to encounter, is that they involve the introduction of adversarial occlusions to a part of the input. The common constraint faced in such attacks is to avoid being suspicious, which effectively limits the size of the adversarial occlusion, but not necessarily its shape or location. Next, we introduce a simple abstract model of occlusion attacks, and then discuss how such attacks can be computed and how we can make classifiers robust to them. We propose the following simple abstract model of adversarial occlusions of input images. The attacker introduces a fixed-dimension rectangle. This rectangle can be placed by the adversary anywhere in the image, and the attacker can furthermore introduce l ∞ noise inside the rectangle with an exogenously specified high bound (for example, = 255, which effectively allows addition of arbitrary adversarial noise). This model bears some similarity to l 0 attacks, but the rectangle imposes a contiguity constraint, which reflects common physical limitations. The model is clearly abstract: in practice, for example, adversarial occlusions need not be rectangular or have fixed dimensions (for example, the eyeglass frame attack is clearly not rectangular), but at the same time cannot usually be arbitrarily superimposed on an image, as they are implemented in the physical environment. Nevertheless, the model reflects some of the most important aspects common to many physical attacks, such as stickers placed on an adversarially chosen portion of the object we wish to identify. We call our attack model a rectangular occlusion attack (ROA). An important feature of this attack is that it is untargeted: since our ultimate goal is to defend against physical attacks whatever their target, considering untargeted attacks obviates the need to have precise knowledge about the attacker's goals. For illustrations of the ROA attack, see Appendix C. The computation of ROA attacks involves 1) identifying a region to place the rectangle in the image, and 2) generating fine-grained adversarial perturbations restricted to this region. The former task can be done by an exhaustive search: consider all possible locations for the upper left-hand corner of the rectangle, compute adversarial noise inside the rectangle using PGD for each of these, and choose the worst-case attack (i.e., the attack which maximizes loss computed on the ing image). However, this approach would be quite slow, since we need to perform PGD inside the rectangle for every possible position. Our approach, consequently, decouples these two tasks. Specifically, we first perform an exhaustive search using a grey rectangle to find a position for it that maximizes loss, and then fix the position and apply PGD inside the rectangle. An important limitation of the exhaustive search approach for ROA location is that it necessitates computations of the loss function for every possible location, which itself requires full forward propagation each time. Thus, the search itself is still relatively slow. To speed the process up further, we use the gradient of the input image to identify candidate locations. Specifically, we select a subset of C locations for the sticker with the highest magnitude of the gradient, and only exhaustively search among these C locations. C is exogenously specified to be small relative to the number of pixels in the image, which significantly limits the number of loss function evaluations. Full details of our algorithms for computing ROA are provided in Appendix D. Once we are able to compute the ROA attack, we apply the standard adversarial training approach for defense. We term the ing classifiers robust to our abstract adversarial occlusion attacks Defense against Occlusion Attacks (DOA), and propose these as an alternative to conventional robust ML for defending against physical attacks. As we will see presently, this defense against ROA is quite adequate for our purposes. We now evaluate the effectiveness of DOA-that is, adversarial training using the ROA threat model we introduced-against physically realizable attacks (see Appendix G for some examples that defeat conventional methods but not DOA). Recall that we consider only digital representations of the corresponding physical attacks. Consequently, we can view our in this section as a lower bound on robustness to actual physical attacks, which have to deal with additional practical constraints, such as being robust to multiple viewpoints. In addition to the two physical attacks we previously considered, we also evaluate DOA against the adversarial patch attack, implemented on both face recognition and traffic sign data. We consider two rectangle dimensions ing in comparable area: 100 × 50 and 70 × 70, both in pixels. Thus, the rectangles occupy approximately 10% of the 224 × 224 face images. We used {30, 50} iterations of PGD with = 255/2 to generate adversarial noise inside the rectangle, and with learning rate α = {8, 4} correspondingly. For the gradient version of ROA, we choose C = 30. DOA adversarial training is performed for 5 epochs with a learning rate of 0.0001. Figure 4: Performance of DOA (using the 100 × 50 rectangle) against the eyeglass frame attack in comparison with conventional methods. Left: comparison between DOA, adversarial training, and randomized smoothing (using the most robust variants of these). Middle/Right: Comparing DOA performance for different rectangle dimensions and numbers of PGD iterations inside the rectangle. Middle: using exhaustive search for ROA; right: using the gradient-based heuristic for ROA. Figure 4 (left) presents the comparing the effectiveness of DOA against the eyeglass frame attack on face recognition to adversarial training and randomized smoothing (we took the most robust variants of both of these). We can see that DOA yields significantly more robust classifiers for this domain. The gradient-based heuristic does come at some cost, with performance slightly worse than when we use exhaustive search, but this performance drop is relatively small, and the is still far better than conventional robust ML approaches. Figure 4 (middle and right) compares the performance of DOA between two rectangle variants with different dimensions. The key observation is that as long as we use enough iterations of PGD inside the rectangle, changing its dimensions (keeping the area roughly constant) appears to have minimal impact. We now repeat the evaluation with the traffic sign data and the stop sign attack. In this case, we used 10 × 5 and 7 × 7 rectangles covering ∼5 % of the 32 × 32 images. We set C = 10 for the gradientbased ROA. Implementation of DOA is otherwise identical as in the face recognition experiments above. We present our using the square rectangle, which in this case was significantly more effective; the for the 10 × 5 rectangle DOA attacks are in Appendix F. Figure 5 (left) compares the effectiveness of DOA against the stop sign attack on traffic sign data with the best variants of adversarial training and randomized smoothing. Our here are for 30 iterations of PGD; in Appendix F, we study the impact of varying the number of PGD iterations. We can observe that DOA is again significantly more robust, with robust accuracy over 90% for the exhaustive search variant, and ∼85% for the gradient-based variant, even for stronger attacks. Moreover, DOA remains 100% effective at classifying stop signs on clean data, and exhibits ∼95% accuracy on the full traffic sign classification task. Finally, we evaluate DOA against the adversarial patch attacks. In these attacks, an adversarial patch (e.g., sticker) is designed to be placed on an object with the goal of inducing a target prediction. We study this in both face recognition and traffic sign classification tasks. Here, we present the for face recognition; further detailed on both datasets are provided in Appendix F. As we can see from Figure 5 (right), adversarial patch attacks are quite effective once the attack region (fraction of the image) is 10% or higher, with adversarial training and randomized smoothing both performing rather poorly. In contrast, DOA remains highly robust even when the adversarial patch covers 20% of the image. As we have shown, conventional methods for making deep learning approaches for image classification robust to physically realizable attacks tend to be relatively ineffective. In contrast, a new threat model we proposed, rectangular occlusion attacks (ROA), coupled with adversarial training, achieves high robustness against several prominent examples of physical attacks. While we explored a number of variations of ROA attacks as a means to achieve robustness against physical attacks, numerous questions remain. For example, can we develop effective methods to certify robustness against ROA, and are the ing approaches as effective in practice as our method based on a combination of heuristically computed attacks and adversarial training? Are there other types of occlusions that are more effective? Answers to these and related questions may prove a promising path towards practical robustness of deep learning when deployed for downstream applications of computer vision such as autonomous driving and face recognition. is a benchmark for face recognition, containing 2622 subjusts with 2.6 million images in total. We chose ten subjects: A. J. Buckley, A. R. Rahman, Aamir Khan, Aaron Staton, Aaron Tveit, Aaron Yoo, Abbie Cornish, Abel Ferrara, Abigail Breslin, and Abigail Spencer, and subselected face images pertaining only to these individuals. Since approximately half of the images cannot be downloaded, our final dataset contains 300-500 images for each subject. We used the standard corp-and-resize method to process the data to be 224 × 224 pixels, and split the dataset into training, validation, and test according to a 7:2:1 ratio for each subject. In total, the data set has 3178 images in the training set, 922 images in the validation set, and 470 images in the test set. We use the VGGFace convolutional neural network model, a variant of the VGG16 model containing 5 convolutional layer blocks and 3 fully connected layers. We make use of standard transfer learning as we only classify 10 subjects, keeping the convolutional layers as same as VGGFace structure, 3 but changing the fully connected layer to be 1024 → 1024 →10 instead of 4096 → 4096 →2622. Specifically, in our Pytorch implementation, we convert the images from RGB to BGR channel orders and subtract the mean value [129.1863, 104.7624, 93 .5940] in order to use the pretrained weights from VGG-Face on convolutional layers. We set the batch size to be 64 and use Pytorch built-in Adam Optimizer with an initial learning rate of 10 −4 and default parameters in Pytorch. 4 We drop the learning rate by 0.1 every 10 epochs. Additionally, we used validation set accuracy to keep track of model performance and choose a model in case of overfitting. After 30 epochs of training, the model successfully obtains 98.94 % on test data. To be consistent with , we select the subset of LISA which contains 47 different U.S. traffic signs (Møgelmose et al., 2012). To alleviate the problem of imbalance and extremely blurry data, we picked 16 best quality signs with 3509 training and 1148 validation data points. From the validation data, we obtain the test data that includes only 40 stop signs to evaluate performance with respect to the stop sign attack, as done by. In the main body of the paper, we present only on this test data to evaluate robustness to stop sign attacks. In the appendix below, we also include performance on the full validation set without adversarial manipulation. All the data was processed by standard crop-and-resize to 32 × 32 pixels. We use the LISA-CNN architecture defined in , and construct a convolutional neural network containing three convolutional layers and one fully connected layer. We use the Adam Optimizer with initial learning rate of 10 −1 and default parameters 4, dropping the learning rate by 0.1 every 10 epochs. We set the batch size to be 128. After 30 epochs, we achieve the 98.69 % accuracy on the validation set, and 100% accuracy in identifying the stop signs in our test data. AND l 2 ATTACKS In this appendix, we show that adversarial training and randomized smoothing degrade more gracefully when faced with attacks that they are designed for. In particular, we consider here variants of projected gradient descent (PGD) for both the l ∞ and l 2 attacks. In particular, the form of PGD for the l ∞ attack is where Proj is a projection operator which clips the to be feasible, x t the adversarial example in iteration t, α the learning rate, and L(·) the loss function. In the case of an l 2 attack, PGD becomes where the projection operator normalizes the perturbation δ = x t+1 − x t to have δ 2 ≤ if it doesn't already. The experiments were done on the face recognition and traffic sign datasets, but unlike physical attacks on stop signs, we now consider adversarial perturbations to all sign images. We begin with our on the face recognition dataset. Tables 1 and 2 present for (curriculum) adversarial training for varying of the l ∞ attacks, separately for training and evaluation. As we can see, curriculum adversarial training with = 16 is generally the most robust, and remains reasonably effective for relatively large perturbations. However, we do observe a clear tradeoff between accuracy on non-adversarial data and robustness, as one would expect. Table 3 presents the of using randomized smoothing on face recognition data, when facing the l 2 attacks. Again, we observe a high level of robustness and, in most cases, relatively limited drop in performance, with σ = 0.5 perhaps striking the best balance. Tables 4 and 5 present evaluation on traffic sign data for curriculum adversarial training against the l ∞ attack for varying. As with face recognition data, we can observe that the approaches tend to be relatively robust, and effective on non-adversarial data for adversarial training methods using < 32. The of randomized smoothing on traffic sign data are given in Table 6. Since images are smaller here than in VGGFace, lower values of for the l 2 attacks are meaningful, and for ≤ 1 we generally see robust performance on randomized smoothing, with σ = 0.5 providing a good balance between non-adversarial accuracy and robustness, just as before. Our basic algorithm for computing rectangular occlusion attacks (ROA) proceeds through the following two steps: 1. Iterate through possible positions for the rectangle's upper left-hand corner point in the image. Find the position for a grey rectangle (RGB value =[127.5, 127.5, 127.5] ) in the image that maximizes loss. 2. Generate high-l ∞ noise inside the rectangle at the position computed in step 1. Algorithm 1 presents the full algorithm for identifying the ROA position, which amounts to exhaustive search through the image pixel region. This algorithm has several parameters. First, we assume that images are squares with dimensions N 2. Second, we introduce a stride parameter S. The purpose of this parameter is to make location computation faster by only considering every other Sth pixel during the search (in other words, we skip S pixels each time). For our implementation of ROA attacks, we choose the stride parameter S = 5 for face recognition and S = 2 for traffic sign classification. Once we've found the place for the rectangle, our next step is to introduce adversarial noise inside it. For this, we use the l ∞ version of the PGD attack, restricting perturbations to the rectangle. We used {7, 20, 30, 50} iterations of PGD to generate adversarial noise inside the rectangle, and with learning rate α = {32, 16, 8, 4} correspondingly. Grad. plot Grad. searching Exh. searching Physically realizable attacks that we study have a common feature: first, they specify a mask, which is typically precomputed, and subsequently introduce adversarial noise inside the mask area. Let M denote the mask matrix constraining the area of the perturbation δ; M has the same dimensions as the input image and contains 0s where no perturbation is allowed, and 1s in the area which can be perturbed. The physically realizable attacks we consider then solve an optimization problem of the following form: arg max Next, we describe the details of the three physical attacks we consider in the main paper. , we first initialized the eyeglass frame with 5 different colors, and chose the best starting color by calculating the cross-entropy loss. For each update step, we divided the gradient value by its maximum value before multiplying by the learning rate which is 20. Then we only kept the gradient value of eyeglass frame area. Finally, we clipped and rounded the pixel value to keep it in the valid range. , we initialized the stickers on the stop signs with random noise. For each update step, we used the Adam optimizer with 0.1 learning rate and with default parameters. Just as for other attacks, adversarial perturbations were restricted to the mask area exogenously specified; in our case, we used the same mask as -a collection of small rectangles. We used gradient ascent to maximize the log probability of the targeted class P [y target |x], as in the original paper . When implementing the adversarial patch, we used a square patch rather than the circular patch in the original paper; we don't anticipate this choice to be practically consequential. We randomly chose the position and direction of the patch, used the learning rate of 5, and fixed the number of attack iterations to 100 for each image. We varied the attack region (mask) R ∈ {0%, 5%, 10%, 15%, 20%, 25%}. For the face recognition dataset, we used 27 images (9 classes (without targeted class) × 3 images in each class) to design the patch, and then ran the attack over 20 epochs. For the smaller traffic sign dataset, we used 15 images (15 classes (without targeted class) × 1 image in each class) to design the patch, and then ran the attack over 5 epochs. Note that when evaluating the adversarial patch, we used the validation set without the targeted class images. Figure 11: Examples of the eyeglass attack on face recognition. From left to right: 1) the original input image, 2) image with adversarial eyeglass frames, 3) face predicted by a model generated through adversarial training, 4) face predicted by a model generated through randomized smoothing, 5) face predicted (correctly) by a model generated through DOA. Each row is a separate example. Figure 12: Examples of the stop sign attack. From left to right: 1) the original input image, 2) image with adversarial eyeglass frames, 3) face predicted by a model generated through adversarial training, 4) face predicted by a model generated through randomized smoothing, 5) face predicted (correctly) by a model generated through DOA. Each row is a separate example. H EFFECTIVENESS OF DOA METHODS AGAINST l ∞ ATTACKS For completeness, this section includes evaluation of DOA in the context of l ∞ -bounded attacks implemented using PGD, though these are outside the scope of our threat model. Table 23 presents of several variants of DOA in the context of PGD attacks in the context of face recognition, while Table 24 considers these in traffic sign classification. The are quite consistent with intuition: DOA is largely unhelpful against these attacks. The reason is that DOA fundamentally assumes that the attacker only modifies a relatively small proportion (∼5%) of the scene (and the ing image), as otherwise the physical attack would be highly suspicious. l ∞ bounded attacks, on the other hand, modify all pixels. To further illustrate the ability of DOA to generalize, we evaluate its effectiveness in the context of three additional occlusion patterns: a union of triangles and circle, a single larger triangle, and a heart pattern. As the in Figures 13 and 14 suggest, DOA is able to generalize successfully to a variety of physical attack patterns. It is particularly noteworthy that the larger patterns (large triangle-middle of the figure, and large heart-right of the figure) are actually quite suspicious (particularly the heart pattern), as they occupy a significant fraction of the image (the heart mask, for example, accounts for 8% of the face). Mask2 Mask3 Abbie Cornish Abbie Cornish Abbie Cornish

Defending Against Physically Realizable Attacks on Image Classification

Represent the TLDR for finding the corresponding scientific article

We introduce a statistical approach to assessing neural network robustness that provides an informative notion of how robust a network is, rather than just the conventional binary assertion of whether or not of property is violated.