Question: Represent the article for finding a single-sentence TLDR

Question: Universal approximation property of neural networks is one of the motivations to use these models in various real-world problems. However, this property is not the only characteristic that makes neural networks unique as there is a wide range of other approaches with similar property. Another characteristic which makes these models interesting is that they can be trained with the backpropagation algorithm which allows an efficient gradient computation and gives these universal approximators the ability to efficiently learn complex manifolds from a large amount of data in different domains. Despite their abundant use in practice, neural networks are still not well understood and a broad range of ongoing research is to study the interpretability of neural networks. On the other hand, topological data analysis (TDA) relies on strong theoretical framework of (algebraic) topology along with other mathematical tools for analyzing possibly complex datasets. In this work, we leverage a universal approximation theorem originating from algebraic topology to build a connection between TDA and common neural network training framework. We introduce the notion of automatic subdivisioning and devise a particular type of neural networks for regression tasks: Simplicial Complex Networks (SCNs). SCN's architecture is defined with a set of bias functions along with a particular policy during the forward pass which alternates the common architecture search framework in neural networks. We believe the view of SCNs can be used as a step towards building interpretable deep learning models. Finally, we verify its performance on a set of regression problems. It is well-known that under mild assumptions on the activation function, a neural network with one hidden layer and a finite number of neurons can approximate continuous functions. This characteristic of neural networks is generally referred to as the universal approximation property. There are various theoretical universal approximators. For example, a of the Stone-Weierstrass theorem; is that multivariate polynomials are dense in the space of continuous real valued functions defined over a hypercube. Another example is that the reproducing kernel Hilbert space (RKHS) associated with kernel functions with particular properties can be dense in the same space of functions. Kernel functions with this property are called universal kernels. A subsequent of this theory is that the set of functions generated by a Gaussian process regression with an appropriate kernel can approximate any continuous function over a hypercube with arbitrary precision. Although multivariate polynomials and Gaussian processes also have this approximation property, each has practical limitations that cause neural networks to be used more often in practice compared to these approaches. For instance, polynomial interpolations may a model that overfits to the data and suffers from a poor generalization, and Gaussian processes often become computationally intractable for a large number of training data Bernardo et al.. Neural networks, with an efficient structure for gradient computation using backpropagation, can be trained using gradient based optimization for large datasets in a tractable time. Moreover, in contrast to existing polynomial interpolations, neural networks generalize well in practice. Theoretical and empirical understanding of the generalization power of neural networks is an ongoing research;. Topological Data Analysis (TDA), a geometric approach for data analysis, is a growing field which provides statistical and algorithmic methods to analyze the topological structures of data often referred to as point clouds. TDA methods mainly relied on deterministic methods until recently where w l,0 w l,1...... statistical approaches were proposed for this purpose;. In general, TDA methods assume a point cloud in a metric space with an inducing distance (e.g. Euclidean, Hausdorff, or Wasserstein distance) between samples and build a topological structure upon point clouds. The topological structure is then used to extract geometric information from data. These models are not trained with gradient based approaches and they are generally limited to predetermined algorithms whose application to high dimensional spaces may be challenging. In this work, by leveraging geometrical perspective of TDA, we provide a class of restricted neural networks that preserve the universal approximation property and can be trained using a forward pass and the backpropagation algorithm. Motivated by the approximation theorem used to develop our method, Simplicial Complex Network (SCN) is chosen to refer these models. SCNs do not require an activation function and architecture search in the way that conventional neural networks do. Their hidden units are conceptually well defined, in contrast to feed-forward neural networks for which the role of a hidden unit is yet an ongoing problem. SCNs are discussed in more details in later sections. Our contribution can be summarized in building a novel class of neural networks which we believe can be used in the future for developing deep models that are interpretable, and robust to perturbations. The rest of this paper is organized as follows: Section 2 is specified for the explanation of SCNs and their training procedure. In section 3, related works are explained. Sections 4, 5, and 6 are specified to experiments, limitations, and . We first describe some necessary notation in the section 2.1. In section 2.2, we discuss the barycentric subdivision and the simplicial approximation theorem. In section 2.3, we modify the barycentric subdivision in order to develop an approach that allows us to learn a subdivision of the input space into small simplexes. We then introduce a general framework for defining an SCN for regression tasks that simultaneously learns a subdivision of the input space and a piece-wise linear mapping where the linear pieces are defined on each simplex of the subdivision. We consider a dataset D = {( Let f θ denotes a mapping from the input to the output space in which θ represents its parameters. In a regression task, we wish to minimize Similarly, we assume each y (i) also lies in the standard probability k-simplex. Simplicial approximation theorem allows the approximation of continuous functions using simplicial mappings. Before stating the theorem, we borrow a few definitions from the algebraic topology literature. Definition 1. (simplicial complex) A simplicial complex K is a set of simplexes such that: 1) Every face of a simplex of K is in K. 2) The intersection of any two simplexes in K is a face of each of them. (A simplicial complex can be informally defined as a set of simplexes glued together through their faces.) Definition 2. (simplicial mapping) A mapping between two simplicial complexes is called simplicial mapping if the images of the vertices are vertices. We also use the definition of a standard subdivisioning method which is used to break a d-simplex (or any other simplicial complex) into arbitrary small simplexes with the same dimension. Figure 2(a), (b) visualize examples of BCS for a 2-simplex, and a 3-simplex. Note that i-th BCS is the of applying BCS to each simplex in the (i − 1)-th BCS. Using these definitions, simplicial approximation theorem can be stated as follows, Theorem 1. (Simplicial Approximation Theorem) Let X and Y be two simplicial complexes and f: X → Y be a continuous function. Then for an arbitrary, there exist sufficiently large k and l and a simplicial mapping g: represent the k-th and l-th barycentric subdivision of X and Y, respectively. In the appendix A, we provide a short topological proof for this theorem. Although the theorem provides a general approximation framework, its approximation is through using BCS of the input and output spaces. Each time BCS is applied, the number of simplexes is multiplied by (d + 1)! and simplexes in higher order subdivisions become flatter and flatter. This fact limits the use of this subdivision algorithm in practice. Moreover, BCS subdivides input or output space completely independent of the data. In the next section, we modify the BCS to a data-driven approach which allows us to learn a suitable subdivision given data. Apart from BCS, in TDA, building simplicial complexes from data is often based on deterministic approaches. For instance, Vietoris-Rips complex; is the set of all simplexes which their vertices are data points that their pair distances are less than a threshold. Cech complex; , is the set of all those simplexes that completely lie in a closed ball with specific radius. While these non-parametric data driven methods can extract rich topological structures of the data using mathematical tools such as persistent homology, they are not often used as standard features in machine learning algorithms immediately;. In the next section, we modify BCS to a parametric framework that allows automation of the subdivisioning process and it can be used directly during the training of an SCN. In the Algorithm 1, we have shown the process of generating a random simplex from the set of all simplexes in BCS of a d-simplex. The algorithm gives an uncommon view for identification of a simplex in the BCS which is through a set of nested simplexes. We modify this view to a data driven approach in a way that BCS is a special case of the modified version. In the Algorithm 1, for a random permutation P, This fact is visualized in Figure 2 (c), (d). N d indicates the simplex in the BCS that corresponds to P. Knowing the nested sequence uniquely determines a simplex in the BCS. Also, we note that each N i can be obtained by replacing one of the vertices of N i−1 with a new vertex inside or on the boundary (closure) of it. Thereby, since the new vertex is in the closure of N i−1, it can be represented as a convex combination of the vertices of N i−1. The weights of these convex combinations can be computed in a straightforward way as shown in the Algorithm 1. Note that these weights are specified to the BCS. To build a data driven approach initially we eliminate two restrictions of the Algorithm 1. First, we allow the number of repeats to be any arbitrary integer l rather fixing it to d. This number is later referred as the subdivision depth. Second, at each repeat, we let the weights to freely have any arbitrary values as long as they can be used as a convex combination weights. This removes the restriction of having deterministic weights specified for BSC. This modification allows us to learn the weights through an optimization process. A natural approach to make the subdivision process data-driven is to, instead of randomly sampling a simplex as in the Algorithm 1, sample a simplex with the probability proportion to the likelihood that it contains data and update the subdivision parameters accordingly. However, the number of all possible simplexes grows exponentially as l increases, thereby making the computation of all these probabilities intractable. Alternatively, we sample from data and identify the simplex in the subdivision that contains the sample and use that simplex in an stochastic optimization framework to update the subdivision towards a desired one. But how can we identify the simplex that contains a given sample? Our parameterization of the subdivisioning process using the nested sequence of simplexes along with the following lemma help to locate the input using a forward pass, Proof. x can be represented with the following convex combination which the lemma, Similar to the steps of Algorithm 1 and based on our view for identification of the target simplex through a nested set of simplexes, at the first step, a point is added inside the simplex using a convex combination of vertices of σ with weights w 1. Then lemma 1 can be used to locate the x in the σ and accordingly replace one of its vertices with the new vertex. This process is repeated with the new d-simplex up to l times to extract the simplex in the subdivision that contains x. Having the final simplex and a given cost function, parameters of the subdivision can be updated accordingly using the backpropagation and gradient descent framework. The procedure is formally shown in the Algorithm 2. We refer the general procedure described in Algorithm 2 to as automatic subdivision. Note that the barycentric subdivision can be a particular outcome of the automatic subdivisioning. Algorithm 1 Generating a simplex in barycentric subdivision of a d-simplex Algorithm 2 One gradient step in automatic subdivisioning of a d-simplex using one data sample Set N j+1 = N j with k-th vertex replaced with u Set w x as convex combination weights of x represented with vertices in N j+1 As theorem 2 states, any continuous function from a simplicial complex to another can be approximated with a simplicial mapping from BCSs of the input space to BCSs of the output space. In the last section we explained how we can subdivision the input space through the automatic subdivision process where BCS was a particular outcome. In this section, we develop SCNs to parameterize a class of simplicial mappings with trainable values on vertices of the input space subdivision and it is defined linearly on the d-simplexes of the subdivision using the evaluations at its vertices, ing a piece-wise linear simplicial mapping. Parameters of this simplicial mapping are then optimized for function approximation or a regression tasks. We leverage a same technique used in the previous section to parameterize the SCN output. Recalling our initial assumption that inputs lie in a d-simplex σ = [v 0, ..., v d] (v 0 representing the origin and other v i are the standard basis vectors), a given input x can be represented with the following convex combination, In the previous section, we showed that how the position of x can be found in σ through the subdivisioning process. SCN's output at x is calculated using the values of its mapping at the vertices of σ and added vertices during locating x. Simplicial mapping at the m-th added vertex is defined recursively using its preceding vertices. Assuming that the m-th added vertex represented as h m = d i=0 w m,i u i, where u i are vertices of the preceding simplex in the nested sequence of simplexes used to locate x and w m,i are its corresponding convex combination weights, the value of the simplicial mapping at h m is defined as, In other words, f (h m) is defined using a convex combination of f (u i) with the same weights, added with a bias which is a function of h m. A geometrical view of equation 2 for a 2-simplex is shown in the Appendix C. Using our proof of simplicial approximation theorem in the appendix A, it is straightforward to show that as long as we consider each b m is an arbitrary function of the h m, the simplicial mapping holds the universal approximation property. In our experiments, however, we used a primitive model for biases and defined them as constant parameters. We will empirically show that even this simple model for biases can complicated simplicial mappings and accurate approximations. All in all, an SCN is defined using the mentioned process (Figure 1 visualizes a general architecture). Parameters that should be learned are bias function parameters, and the weights that we used to subdivision the input space. All these parameters can be updated using the backpropagation algorithm. Another point that must be noted here is that, as shown in Figure 1, inputs to h 2,..., h l are not specified. Even though we described how to obtain the value of these inputs using lemma 1, the order that the vertices of the preceding simplex are combined is not specified. We refer to the policy on the ordering of the vertices used to fed to the next convex combination as the SCN's network policy. Specifying the depth, network policy, and the bias functions fully determines the architecture of an SCN. To train an SCN, the derivative of the loss function over mini-batches is taken with respect to the weights and the bias function parameters, and these parameters are updated using a gradient descent approach such as stochastic gradient descent, or. General training process for an SCN is shown in the Algorithm 3. Note that after updating weights of the network, for each hidden node, a projection of weights is used such that their summation is equal to 1. This projection can be avoided through use of logits and the Softmax function in parameterizing the weights. Algorithm 3 training procedure for a general SCN bias function, and weight params), P (network policy), Extract j and update w x using x, S, and lemma 1 project w m on the standard d-simplex end for In TDA, Persistent homology methods are commonly used to extract features that are robust to perturbations of the input;. A range of works use these features in a feed-forward architecture. For instance, in , persistence landscape, a topological summary of data, is used to develop persistent layers. These layers are used in a neural network architecture along with convolutional layers and the ing architecture is applied to the problem of music tagging , and multi-label classification. A similar approach is applied in for the time series classification. introduces TopologyNet, an architecture that uses a persistent homology method for 3D biomolecular structures to extract features suitable for convolutional layers. proposes a trainable layer to learn suitable representation from persistence diagram of the data. This layer which extracts topological signatures from the data is used along with a common neural network architecture and their approach achieved the state-of-the-art in a specific task on classification of social network graphs at the time. Although aforementioned methods try to improve the performance of neural networks through using topological scenarios, the TDA geometrical perspective vanishes as they are aligned with commonly used architectures. In addition, a specific persistent homology method is applied for a determined task. SCNs are single-model architectures that can be trained with the common forward and backward passes. In addition, no specific persistent homology is used to extract the topological geometry of the inputs, which enables its generalization to other domains. We perform regression tasks in order to evaluate the performance and the complexity of functions that SCN can learn. Mean squared error was used as the loss function in all the experiments. In some cases, an SCN with a few number of parameters can estimate a function better than a neural network with fully connected layers even with around 10 times more parameters. In the appendix B, with a straightforward derivation, we also show that how does an SCN without a hidden unit reformulates the linear regression problem. As a primary experiment, we approximate sum of three Gaussian functions with an SCN with a depth of 4 and constant parameters as the biases. The ing simplicial mapping and the learned subdivision is shown in Figure 3. We compare the performance of using an SCN in the problem of learning particular structures to the obtained by a neural network with fully-connected layers and ReLU activations. This is a more general experiment done in to learn the absolute value function. The experiment was used in to show the limitations of specific activation functions for neural networks in learning some of the basic functions. Here, we show that SCN can learn more complicated structures even with constant parameters as its bias functions. Models are trained using with learning rate 0.001, and a same mini-batch size. Figure 4 represents the comparison. More details about the experiments, and a binary classification experiment on the MNIST dataset can be found in the appendix F. here, to backpropagate through the SCN's architecture it is required to store only d out of d + 1 vectors and their function evaluations, which were used to extract the last hidden node and evaluate its function value, latest convex weights for the input in the forward pass, and an array of integers with a length of l indicating the order that nodes were removed during the forward pass. Storing these values is enough for the gradient computation of the network parameters. Interestingly, it is not needed to store the weights of the network and function evaluations at the previous nodes as they all can be extracted with these information (proof in the Appendix E). This approach trades the cost of memory with an additional computational cost and can be helpful in training very deep SCNs. In some conditions, the bias function for a hidden node may outputs high norm vectors. In these conditions, output may not be close to a smooth curve. Accordingly, SCN's output not behave well in practice and potentially overfits to data. In case of using a conventional neural networks, to increase the stability of the output, one approach is to enforce Lipschitz constraints Anil et al. In some cases, input weights to a hidden node might converge to degenerate values with the value one in one position and zero elsewhere. In these cases, the corresponding layer does not change the learned subdivision and it may be assumed as a redundant layer. We refer to this phenomena as weight drifting. In situations that we have a deep SCN architecture with higher than the true required capacity, these layers with a bias value close to zero may be helpful to automatically adjust the capacity of the model and prevent SCN from overfitting. Throughout this work we assumed that inputs lie in a given d-simplex. The assumption was used just for the sake of presentation. It can be assumed that samples lie in any given simplicial complex, not a specific d-simplex. The vertices of any simplex in the simplicial complex that a sample falls in can be used as the primary nodes in the network. Choosing an appropriate network policy for SCNs may be assumed as a challenging task in different domains. In our experiments, we observed that even simple policies a proper function approximation. In fact, in one dimensional case, a direct use of the Stone-Weierstrass theorem can be used to prove that SCNs are universal approximators even with random policies and fixed weights. In our experiments, the sensitivity of SCNs to the choice of their bias function observed to be larger than the network policy. In this work, we have used techniques from topological data analysis to build a class of neural network architectures with the universal approximation property which can be trained using the common neural network training framework. Topological data analysis methods are based on the geometrical structure of the data and have strong theoretical analysis. SCNs are made using the geometrical view of TDA and we believe that they can be used as a step towards building interpretable deep learning models. Most of the experiments in the paper are synthetic. More practical applications of the paper is considered as an immediate continual work. Moreover, throughout this work, bias functions of the simplest kinds (constant parameters) were used. We mentioned earlier that a bias function may be an arbitrary function of its input to keep the universal approximation property of SCNs. A natural idea is to use common neural network architectures as the bias function. In this case, backpropagation can be continued to the bias function parameters as well. This is also considered as another continuation of this work. We provide a short topological proof of the approximation theorem we used in main text. Some mathematical precision is dropped throughout the proof. (v) is less than δ (proof is shown in figure 6). So, for each v ∈ V, there exist a w ∈ W such that St(v) ⊂ f −1 (St(w)). We define the simplicial map g such that g(v) = w. Also, note that f (St(v)) ⊂ St(w). Now we prove that g approximates f as desired. Let σ ∈ X (k) be a simplex in A. Let v 1, v 2,..., v p denote the vertices of this simplex. For any x ∈ σ and a vertex v i, i ∈ {1, 2, ..., p}, x is in the. Using the last note in the previous paragraph, we have x ∈ ∩ p i=1 St(g(v i)). This fact means that f (x) lies in the simplex that its vertices are We now extend the definition of g for all non-vertex elements of X. Let x ∈ |X| be a non-vertex element represented as a convex combination of a number of vertices of V as x = Σt i v i. We define g(x) as, Straightforward steps can be used to prove that g is a continuous simplicial mapping. Using the facts in the last two paragraphs, we conclude that for each x ∈ |X| and a simplex σ ∈ X containing x, both f (x), and g(x), lie in the simplex with vertices {g(v)} v∈σ. Due to the initial choice of l, we know that diameter of this simplex is less than, which means sup x∈X f (x) − g(x) <. In case that an SCN has no hidden node (no subdivisioning process), it can be viewed as linear regression reformulation. A real valued linear function f: Assume a data matrix X ∈ R N ×d of N samples within ∆ d, and their corresponding output in a vector y. We formulate the linear regression problem with training a weight w that minimizes ||Xw − y|| We represent the coefficients of representing samples in X as a convex combination of v 0,..., v d in a matrix C ∈ R N ×(d+1) with a rank of at most d, where i-th row indicates the corresponding coefficients for i-th sample. Then the linear regression problem can be reformulated as, where f is a (d + 1) dimensional vector representing the function value at v i as its i-th element. With a straightforward computation, One can verifies that the optimal w or f can be computed from the optimal value of the other one. Figure 7: A geometrical view of how does equation 2 evaluates the simplicial mapping at m-th added point using its preceding vertices u i. A same convex combination of u i used to generate h m is applied to the corresponding f (u i). This value added with a bias term determines f (h m). x can be represented with the following convex combination which the lemma, In contrast to; , no separation of input into blocks is needed for SCNS to extract outputs of the previous layers. Retrieving the values for previous in SCN is a of the fact that knowing all weights, all vertices except one, and the ing vector of a convex combination is enough to extract the missing vertex. Formally, let x =. Assume an SCN with a depth of l. Given the SCN's last layer weights w l, the bias functions b 1,..., b l, and its network policy P, the following algorithm shows that knowing the last d hidden nodes, their function values, and an array indicating the order of vertices that was removed during the forward pass to locate x, is enough to extract all the previous function values, hidden nodes, and also the weights. For simplicity of the algorithm, u 0,..., u l+d is used as indicators for v 0,..., v d, h 1,..., h l with the same order. Algorithm 4 Retrieving preceding layers and parameters for the backward pass of an SCN given u l+d, u l+d−1,..., u l+1, f (u l+d), f (u l+d−1),..., f (u l+1), and convex weights w x of representing the input x as the convex combination of u l+d, u l+d−1,..., u l, array a = [a 1, ..., a l−d] of integers storing the indices of u i were removed during the forward pass with the exact order. Extract w l−j as the convex combination weights of representing u l+d−j using u l+d−j−1,..., u l−j Extract w (u l+d−j−i) l−j, (∀0 ≤ i ≤ d) (element of w l−j that is assigned to u l+d−j−i) using the network policy P, and a l−d−j. Update w x to the convex combination weights of x represented using u l+d−j−1,..., u l−j, u l−j−1 j+ = 1 until j = d − 1 We provide the details of the experiments in the main text as well as of a binary classification experiment on MNIST as a primary proof of concept for practical usages of SCNs. In all the three toy experiments, the neural network consisted of two fully connected layers with 300 and 2 hidden neurons respectively. ReLU activations was used for both layers. The SCN model had a depth of 4. Accordingly, the network had 4 bias functions which all were constant parameters. A learning rate of 0.001, mini-batches of size 100 were used. The network policy was random. Thereby, preceding nodes were assigned randomly to the next convex combination weights (recall the fact that in one dimensional case, SCNs are universal approximators even with a random policy and fix convex combination weights. Thereby the optimization can be done through their biases only). In the sum of Gaussians experiment, inputs lied in a 2-simplex with vertices,, and as the way that SCNs are presented throughout the paper. Similarly, in the one dimensional case inputs lied in the interval (1-simplex). To provide an observation that SCNs can be used in practice, we did a primary experiment on the MNIST data set. The aim was the binary classification of zeros and ones. We lessened the dimensionality of the data to 20 using PCA. We compared SCN to a simple logistic regression, and a neural network with the same architecture used in our synthetic experiments. Logistic regression can be seen as an SCN without any hidden nodes followed by a Sigmoid. We used a single unit SCN where its bias function was again a single constant parameter. Models were trained using the binary cross entropy loss and a same learning rate and mini-batch size were used in training the models. The performance is shown in the Figure 8 and the test accuracy and the number of parameters are shown in the Table 1. Although the performance of the SCN with a single hidden unit is not as good as the neural network with fully connected layers, SCN could improve the accuracy of logistic regression by around 7% with adding a single hidden node to its architecture. Scaling up the SCN architecture to higher dimensional spaces is considered as a continuation of the paper.

A novel method for supervised learning through subdivisioning the input space along with function approximation.

Represent the short summary for finding the corresponding scientific article (long)

In this paper, a new method we call Centered Initial Attack (CIA) is provided. It insures by construction the maximum perturbation to be smaller than a threshold fixed beforehand, without the clipping process.


Question: Represent the text to find a very short summary (1-2 sentences max)

Question: The goal of network representation learning is to learn low-dimensional node embeddings that capture the graph structure and are useful for solving downstream tasks. However, despite the proliferation of such methods there is currently no study of their robustness to adversarial attacks. We provide the first adversarial vulnerability analysis on the widely used family of methods based on random walks. We derive efficient adversarial perturbations that poison the network structure and have a negative effect on both the quality of the embeddings and the downstream tasks. We further show that our attacks are transferable since they generalize to many models, and are successful even when the attacker is restricted. Unsupervised node embedding (network representation learning) approaches are becoming increasingly popular and achieve state-of-the-art performance on many network learning tasks BID5. The goal is to embed each node in a low-dimensional feature space such that the graph's structure is captured. The learned embeddings are subsequently used for downstream tasks such as link prediction, node classification, community detection, and visualization. Among the variety of proposed approaches, techniques based on random walks (RWs) (Perozzi et al.; Grover & Leskovec) are highly successful since they incorporate higher-order relational information. Given the increasing popularity of these method, there is a strong need for an analysis of their robustness. In particular, we aim to study the existence and effects of adversarial perturbations. A large body of research shows that traditional (deep) learning methods can easily be fooled/attacked: even slight deliberate data perturbations can lead to wrong BID17 BID28 BID6 BID12 BID26 BID10.So far, however, the question of adversarial perturbations for node embeddings has not been addressed. This is highly critical, since especially in domains where graph embeddings are used (e.g. the web) adversaries are common and false data is easy to inject: e.g. spammers might create fake followers on social media or fraudsters might manipulate friendship relations in social networks. Can node embedding approaches be easily fooled? The answer to this question is not immediately obvious. On one hand, the relational (non-i.i.d.) nature of the data might improve robustness since the embeddings are computed for all nodes jointly rather than for individual nodes in isolation. On the other hand, the propagation of information might also lead to cascading effects, where perturbations in one part of the graph might affect many other nodes in another part of the graph. Compared to the existing works on adversarial attacks our work significantly differs in various aspects. First, by operating on plain graph data, we do not perturb the features of individual instances but rather their interaction/dependency structure. Manipulating the structure (the graph) is a highly realistic scenario. For example, one can easily add or remove fake friendship relations on a social network, or write fake reviews to influence graph-based recommendation engines. Second, the node embedding works are typically trained in an unsupervised and transductive fashion. This means that we cannot rely on a single end-task that our attack might exploit to find appropriate perturbations, and we have to handle a challenging poisoning attack where the model is learned after the attack. That is, the model cannot be assumed to be static as in most other adversarial attack works. Lastly, since graphs are discrete classical gradient-based approaches BID28 for finding adversarial perturbations that were designed for continuous data are not well suited. Particularly for RW-based methods, the gradient computation is not directly possible since they are based on a non-differentiable sampling procedure. How to design efficient algorithms that are able to find adversarial perturbations in such a challenging -discrete and combinatorial -graph domain?We propose a principled strategy for adversarial attacks on unsupervised node embeddings. Exploiting from eigenvalue perturbation theory BID35 we are able to efficiently solve a challenging bi-level optimization problem associated with the poisoning attack. We assume an attacker with full knowledge about the data and the model, thus, ensuring reliable vulnerability analysis in the worst case. Nonetheless, our experiments on transferability demonstrate that our strategy generalizes -attacks learned based on one model successfully fool other models as well. Overall, we shed light on an important problem that has not been studied so far. We show that node embeddings are sensitive to adversarial attacks. Relatively few changes are needed to significantly damage the quality of the embeddings even in the scenario where the attacker is restricted. Furthermore, our work highlights that more work is needed to make node embeddings robust to adversarial perturbations and thus readily applicable in production systems. We focus on adversarial attacks on unsupervised node embedding approaches based on random walks (RWs), and further show how one can easily apply a similar analysis to attack other node embeddings based on factorization. For a recent extensive survey, also of other non-RW based approaches, we refer to BID5. Moreover, while many (semi-)supervised learning methods BID22 BID15 have been introduced, we focus on unsupervised methods since they are often used in practice due to their flexibility in solving various downstream tasks. Adversarial attacks. Attacking machine learning models has a long history, with seminal works on SVMs and logistic regression BID4 BID28. Deep neural networks were also shown to be highly sensitive to small adversarial perturbations to the input BID36 BID17. While most works focus on image classification, recent works have shown the existence of adversarial examples also in other domains BID18.Different taxonomies exist characterizing the attacks/adversaries based on their goals, knowledge, and capabilities BID30. The two dominant attacks types are poisoning attacks that target the training data (the model is trained after the attack) and evasion attacks that target the test data/application phase (the learned model is assumed fixed). Compared to evasion attacks, poisoning attacks are far less studied BID23 BID30 BID28 BID10 since they require solving a challenging bi-level optimization problem. Attacks on semi-supervised graph models. The robustness of semi-supervised graph classification methods to adversarial attacks has recently been analyzed (Zügner et al., 2018; BID13 . The first work, introduced by Zügner et al., linearizes a graph convolutional network (GCN) BID22 to derive a closed-form expression for the change in class probabilities for a given edge/feature perturbation. They calculate a score for each possible edge flip based on the classification margin and greedily pick the top edge flips with highest scores. Later, BID13 proposed a reinforcement (Q-)learning formulation where they decompose the selection of relevant edge flips into selecting the two end-points. Both approaches focus on targeted attacks (misclassify a given node) for the semi-supervised graph classification task. In contrast, our work focuses on general attacks (decrease the overall quality) on unsupervised node embeddings. Manipulating graphs. In the context of graph clustering, BID11 measure the changes in the when injecting noise to a bi-partite graph of DNS queries, but do not focus on automatically generating attacks. There is an extensive literature on works that optimize the graph structure to manipulate e.g. information spread in a network (Chen et al.; Khalil et al.), user opinions BID1 BID8, shortest paths (Phillips; Israeli & Wood), page rank scores and other metrics (Avrachenkov & Litvak; Chan et al.). Remotely related are poisoning attacks on multi-task relationship learning . While they exploit the relations between different tasks, they still deal with the classical scenario of i.i.d. instances within each task. Robustness and adversarial training. The robustification of machine learning models has also been studied -known as adversarial machine learning or robust machine learning. Such approaches are out of scope for this paper and we do not discuss them. The goal of adversarial training (e.g. via GANs BID14) is to improve the embeddings, while our goal is to damage the embeddings produced by existing models by perturbing the graph structure. Here we explore poisoning attacks on the graph structure -the attacker is capable of adding or removing (flipping) edges in the original graph within a given budget. We focus mainly on approaches based on random walks and extend the analysis to spectral approaches (Sec. 6.2 in the appendix). Let G = (V, E) be an undirected unweighted graph where V is the set of nodes, E is the set of edges, and A ∈ {0, 1} |V |×|V | is the adjacency matrix. The goal of network representation learning is to find a low-dimensional embedding z v ∈ R K for each node with K |V |. This dense lowdimensional representation should preserve information about the network structure -nodes similar in the original network should be close in the embedding space. DeepWalk (Perozzi et al.) and node2vec (Grover & Leskovec) learn an embedding based on RWs by extending and adapting the skip-gram architecture BID29 for learning word embeddings. They sample finite (biased) RWs and use the co-occurrence of node-context pairs in a given window in each RW as a measure of similarity. To learn z v they maximize the probability of observing v's neighborhood. We denote withÂ the adjacency matrix of the graph obtained after the attacker has modified certain entries in A. We assume the attacker has a given, fixed budget and is only capable of modifying f entries, i.e. ||Â − A|| 0 = 2f (we have 2f since G is undirected). The goal of the attacker is to damage the quality of the learned embeddings, which in turn harms subsequent learning tasks such as node classification or link prediction that use the embeddings as features. We consider both a general attack that aims to degrade the embeddings of the network as a whole, as well as a targeted attack that aims to damage the embedding regarding a specific target or specific task. The quality of the embeddings is measured by the loss L(A, Z) of the model under attack, with lower loss corresponding to higher quality, where Z ∈ R N ×K is the matrix containing the embeddings of all nodes. Thus, the goal of the attacker is to maximize the loss. We can formalize this as the following bi-level optimization problem: DISPLAYFORM0 Here, Z * is always the'optimal' embedding ing from the (to be optimized) graphÂ, i.e. it minimizes the loss, while the attacker tries to maximize the loss. Solving such a problem is highly challenging given its discrete and combinatorial nature, thus we derive efficient approximations. Since the first step in the embedding approaches is to generate a set of random walks that serve as a training corpus for the skip-gram model, the bi-level optimization problem is even more complicated. We have DISPLAYFORM0 where RW l is an intermediate stochastic procedure that generates RWs of length l given the graphÂ which we are optimizing. By flipping (even a few) edges in the original graph, the attacker necessarily changes the set of possible RWs, thus changing the training corpus. Therefore, this RW generation process precludes any gradient-based methods. To tackle this challenge we leverage recent that show that (given certain assumptions) RW based node embedding approaches are implicitly factorizing the Pointwise Mutual Information (PMI) matrix (; BID34 . We study DeepWalk as an RW-based representative approach since it's one of the most popular methods and has many extensions. Specifically, we use the from BID34 to sidestep the RW stochasticity. Lemma 1 BID34). DeepWalk is equivalent to factorizingM = log(max(M, 1)) with DISPLAYFORM1 where the embedding Z * is obtained by the Singular Value Decomposition ofM = U ΣV T using the top-K largest singular values / vectors, i.e. DISPLAYFORM2 Here, D is the diagonal degree matrix with D ii = j A ij, T is the window size, b is the number of negative samples and vol(A) = i,j A ij is the volume. Since M is sparse and has many zero entries the matrix log(M) where the log is elementwise is ill-defined and dense. To cope with this, similar to the Shifted Positive PMI (PPMI) approach the elementwise maximum is introduced to formM. Using this insight, we see that DeepWalk is equivalent to optimizing minM DISPLAYFORM3 F wherẽ M K is the best rank-K approximation toM. This in turn means that the loss for DeepWalk when using the optimal embedding Z * for a given graph A is L DW1 (A, Z *) = |V | p=K+1 σ 2 p where σ p are the singular values ofM (A) ordered decreasingly σ 1 ≥ σ 2 · · · ≥ σ |V |. This shows that we do not need to construct random walks, nor do we have to (explicitly) learn the embedding Z * -it is implicitly considered via the singular values ofM (A). Accordingly, we have transformed the bi-level problem into a single-level optimization problem. However, maximizing L DW1 is still challenging due to the singular value decomposition and the discrete nature of the problem. Gradient based approach. Maximizing L DW1 with a gradient-based approach is not straightforward since we cannot easily backpropagate through the SVD. To tackle this challenge we exploit ideas from eigenvalue perturbation theory BID35 ) to approximate L DW1 (A) in closed-form without needing to recompute the SVD. This enables us to efficiently calculate the gradient. Theorem 1. Let A be the initial adjacency matrix andM (A) be the respective co-occurrence matrix. Let u p be the p-th eigenvector corresponding to the p-th largest eigenvalue ofM. Given a perturbed matrix A, with A = A + ∆A, and the respective change ∆M. We can approximately compute the loss: DISPLAYFORM4 The proof is given in the appendix. For a small ∆A and thus small ∆M we obtain a very good approximation, and if ∆A = ∆M = 0 then the loss is exact. Intuitively, we can think of using eigenvalue perturbation as analogous to taking the gradient of the loss w.r.t. M (A). Now, gradient-based optimization is efficient since ∇ A L DW2 (A) avoids recomputing the eigenvalue decomposition. The gradient provides useful information for a small change, however, here we are considering discrete flips, i.e. = ±1 so its usefulness is limited. Furthermore, using gradient-based optimization requires a dense instantiation of the adjacency matrix, which has complexity O(N 2) in both runtime and memory (infeasible for large graphs). This motivates the need for our more advanced approach. Sparse closed-form approach. Our goal is to efficiently compute the change in the loss L DW1 (A) given a set of flipped edges. To do so we will analyze the change in the spectrum of some of the intermediate matrices and then derivate a bound on the change in the spectrum of the co-occurrence matrix, which in turn will give an estimate of the loss. First, we need some . Lemma 2. The matrix S in Eq. 2 is equal to S = U (T r=1 Λ r)U T where the matrices U and Λ contain the eigenvectors and eigenvalues solving the generalized eigen-problem Au = λDu. The proof is given in the appendix. We see that the spectrum of S (and, thus, the one of M by taking scalars into account) is obtainable from the generalized spectrum of A. The difference to BID34's derivation where a factorization of S using A norm:= D −1/2 AD −1/2 is important. As we will show, our formulation using the generalized spectrum of A is key for an efficient approximation. Let A = A + ∆A be the adjacency matrix after the attacker performed some edge flips. As above, by computing the generalized spectrum of A, we can estimate the spectrum of the ing S and M. However, recomputing the eigenvalues λ of A for every possible set of edge flips is still not efficient for large graphs, preventing an effective application. Thus, we derive our first main : an efficient approximation bounding the change in the singular values of M for any edge flip. Theorem 2. Let ∆A be a matrix with only 2 non-zero elements, namely ∆A ij = ∆A ji = 1 − 2A ij corresponding to a single edge flip (i, j), and ∆D the respective change in the degree matrix, i.e. A = A + ∆A and D = D + ∆D. Let u y be the y-th generalized eigenvector of A with generalized eigenvalue λ y. Then the generalized eigenvalue λ y of A solving λ y A = λ y D u y is approximately: DISPLAYFORM5 where u yi is the i-th entry of the vector u y, and ∆w ij = (1 − 2A ij) indicates the edge flip, i.e ±1.The proof is provided in the appendix. By working with the generalized eigenvalue problem in Theorem 2 we were able to express A and D after flipping an edge as additive changes to A and D, this in turn enabled us to leverage from eigenvalue perturbation theory to efficiently approximate the change in the spectrum. If we used A norm instead, the change to A norm would be multiplicative preventing efficient approximations. Using Eq. 3, instead of recomputing λ we only need to compute ∆λ, significantly reducing the complexity when evaluating different edge flips (i, j). Using this , we can now efficiently bound the change in the singular values of S. Lemma 3. Let A be defined as before and S be the ing matrix. The singular values of S are bounded: DISPLAYFORM6 r where π is a permutation simply ensuring that the finalσ p (i, j) are sorted decreasingly, where d min is the smallest degree in A.We provide the proof in the appendix. Using this , we can efficiently compute the loss for a rank-K approximation/factorization of M, which we would obtain when performing the edge flip DISPLAYFORM7 based on the matrixM = log(max(M, 1)), there are unfortunately currently no tools available to analyze the spectrum ofM given the spectrum of M. Therefore, we use L DW3 as a surrogate loss for L DW1 (Yang et al. similarly exclude the element-wise logarithm). As our experimental analysis shows, the surrogate loss is effective and we are able to successfully attack the node embeddings that factorize the actual co-occurrence matrixM, as well as the original skip-gram model. Similarly, methods based on spectral embedding, factorize the graph Laplacian and have a strong connection to the RW based approaches. We provide a similar detailed analysis in the appendix (Sec. 6.2).The overall algorithm. Our goal is to maximize L DW3 by performing f edge flips. While Eq. 3 enables us to efficiently compute the loss for a single edge, there are still O(n 2) possible flips. To reduce the complexity when adding edges (see Sec. 4.2 for removing) we instead form a candidate set by randomly sampling C candidate flips. This introduces a further approximation that nonetheless works well in practice. For every candidate we compute its impact on the loss via L DW3 and greedily choose the top f flips.1 The runtime complexity of our overall approach is: O(N ·|E|+C ·N log N). First, we can compute the generalized eigenvectors of A in a sparse fashion in O(N · |E|). Then we sample C candidate edges, and for each we can compute the approximate eigenvalues in constant time (Theorem 2). To obtain the final loss, we sort the values leading to the overall complexity. The approach is easily parallelizable since every candidate edge flip can be evaluated in parallel. If the goal of the attacker is to attack a specific node t ∈ V, called the target, or a specific downstream task, it is suboptimal to maximize the overall loss via L DW *. Rather, we should define some other target specific loss that depends on t's embedding -replacing the loss function of the outer optimization in Eq. 1 by another one operating on t's embedding. Thus, for any edge flip (i, j) we now need the change in t's embedding -meaning changes in the eigenvectors -which is inherently more difficult to compute compared to changes in eigen/singular-values. We study two cases: misclassifying a target node and manipulating the similarity of node pairs (i.e. link prediction task).Surrogate embeddings. To efficiently compute the change in eigenvectors, we define surrogate embeddingsZ *. Specifically, instead of performing an SVD decomposition on M (or equivalently S with upscaling) and using the from Lemma 2 we defineZ DISPLAYFORM0 Experimentally, usingZ * instead of Z * as the embedding showed no significant change in the performance on downstream tasks (even on the clean graph; suggesting its general use since it is more efficient to compute). Now, we can approximate the generalized eigenvectors, and thusZ * (A), in closed-form: Theorem 3. Let ∆A, ∆D and ∆w ij be defined as before, and ∆λ y be the change in the y-th generalized eigenvalue λ y as derived in Theorem 2. Then, the y-th generalized eigenvector u y of A after performing the edge flip (i, j) can be approximated with: DISPLAYFORM1 where E i (x) returns a vector of zeros except at position i where the value is x, d is a vector of the node degrees, • is the Hadamard product, and (·) + is the pseudo inverse. We provide the proof in the appendix. Computing Eq. 4 seems expensive at first due to the pseudo inverse term. However, note that this term does not depend on the particular edge flip we perform. Thus, we can pre-compute it once and furthermore, parallelize the computation for each y. Similarly, we can pre-compute u y d, while the rest of the terms are all computable in O. For any edge flip we can now efficiently compute the optimal embeddingZ * (A) using Eqs. 3 and 4. The t-th row of Z * (A) is the desired embedding for a target node t after the attack. Targeting node classification. The goal is to enforce misclassification of the target t for the downstream task of node classification (i.e. node labels are partially given). To fully specify the targeted attack we need to define the candidate flips and the target-specific loss responsible for scoring the candidates. As candidates we use {(v, t)|v = t}. For the loss, we first pre-train a classifier C on the clean embeddingZ *. Then we predict the class probabilities p t of the target t using the compromisedZ * t,· and we calculate the classification margin m(t) = p t,c(t) − max c =c(t) p t,c, where c(t) is the ground-truth class for t. That is, our loss is the difference between the probability of the ground truth and the next most probable class after the attack. Finally, we select the top f flips with smallest margin m (note when m(t) < 0 node t is misclassified). In practice, we average over 10 randomly trained classifiers. Another (future work) approach is to treat this as a tri-level optimization problem. Targeting link prediction. The goal of the attack is: given a set of target node pairs T ⊂ V × V, decrease the similarity between the nodes that have an edge, and increase the similarity between nodes that do not have an edge, by modifying other parts of the graph -i.e. it is not allowed to directly flip pairs in T. For example, in an e-commerce graph representing users and items, the goal might be to increase the similarity between a certain item and user, by adding/removing connections between other users/items. To achieve this, we first train the initial clean embedding without the target edges. Then, for a candidate set of flips, we estimateZ * using Eqs. 3 and 4 and use them to calculate the average precision score (AP score) on the target set T, withZ * DISPLAYFORM2 T as a similarity measure. Finally, we pick the top f flips with lowest AP scores and use them to poison the network. Since this is the first work considering adversarial attacks on node embeddings there are no known baselines. Similar to works that optimize the graph structure (Chen et al.) we compare with several strong baselines. B rnd randomly flips edges (we report averages over ten seeds), B eig removes edges based on their eigencentrality in the line graph L(A), and B deg removes edges based on their degree centrality in L(A) -or equivalently sum of degrees in the original graph. When adding edges we use the same baselines as above, now calculated on the complement graph, except for B eig since it is infeasible to compute even for medium size graphs. A DW2 denotes our gradient based attack, A DW3 our closed-form attack, A link our link prediction attack, A class our node classification attack. The size of the sampled candidate set for adding edges is 20K (for removing edges see Sec. 4.2).We aim to answer the following questions: (Q1) how good are our approximations of the loss; (Q2) how much damage is caused to the embedding quality by our attacks/baselines; (Q3) can we still perform a successful attack when restricted; FORMULA10 FORMULA2 ). In all experiments, after choosing the top f flips we retrain the embeddings and report the final performance since this is a poisoning attack. Note, for the general attack, the downstream node classification task is only a proxy for estimating the quality of the embeddings after the attack, it is not our goal to damage this task, but rather to attack the unsupervised embeddings in general. To estimate the approximation quality we randomly select a subset of 20K candidate flips and compute the correlation between the actual loss and our approximation as measured by Pearson's R score. For example, for K = 32 we have R(L DW2, L DW1) = 0.11 and R(L DW3, L DW1) = 0.90, clearly showing that our closed-form strategy approximates the loss significantly better compared to the gradient-based one. Similarly, L DW 3 is a better approximation than L DW2 for K = 16, 64, 128. To obtain a better understanding we investigate the effect of removing and adding edges separately. Since real graphs are usually sparse, for removing we set the candidate set to be the set of all edges, with one edge set aside for each node to ensure we do not have singleton nodes. To obtain candidate edges for adding we randomly sample a set of edges. We then simply select the top f edges from the candidate set according to our scoring function. For adding edges, we also implemented an alternative add-by-remove strategy denoted as A abr. Here, we first add cf -many edges randomly sampled from the candidate set to the graph and subsequently remove (c − 1)f -many of them. This strategy performed better empirically. Since the graph is undirected, for each (i, j) we also flip (j, i).. Removed/added edges are denoted on the x-axis with negative/positive values respectively. On FIG2 we see that our strategies achieve a significantly higher loss compared to the baselines when removing edges. To analyze the change in the embedding quality we consider the node classification task (i.e. using it as a proxy to evaluate quality; this is not our targeted attack). Interestingly, B deg is the strongest baseline w.r.t. to the loss, but this is not true for the downstream task. As shown in FIG2, our strategies significantly outperform the baselines. As expected, A DW3 and A abr perform better than A DW2. On Cora our attack can cause up to around 5% more damage compared to the strongest baseline. On PolBlogs, by adding only 6% edges we can decrease the classification performance by more than 23%, while being more robust to removing edges. Restricted attacks. In the real world, attackers cannot attack any node, but rather only specific nodes under their control, which translates to restricting the candidate set. To evaluate the restricted scenario, we first initialize the candidate sets as before, then we randomly choose a given percentage p r of nodes as restricted and discard every candidate that includes them. As expected, the in FIG2 show that for increasingly restrictive sets with p r = 10%, 25%, 50%, our attack is able to do less damage. However, we always outperform the baselines (not plotted), and even in the case when half of the nodes are restricted (p r = 50%) we are still able to damage the embeddings. With this we are can answer question (Q3) affirmatively -the attacks are successful even when restricted. Analysis of selected adversarial edges. In Fig. 2a we analyze the top 1K edges on Cora-ML. For each edge we consider its source node degree (destination node, resp.) and plot it on the x-axis (yaxis). The heatmap shows adversarial edge counts divided by total edge counts for each bin. We see that low, medium and high degree nodes are all represented. In Fig. 2b we plot the edge centrality distribution for the top 1K adversarial edges and compare it with the distribution of the remaining edges. There is no clear distinction. The findings highlight the need for a principled method such as ours since using intuitive heuristics such as degree/edge centrality cannot identify adversarial edges. To obtain a better understanding of the performance we study the margin m(t) before and after the attack considering every node t as a potential target. We allow only (d t + 3) flips for attacking each node ensuring the degrees stay similar. Each dot in Fig. 4 represents one node grouped by its degree in the clean graph (logarithmic bins). We see that low-degree nodes are easier to misclassify (m(t) < 0), and that high degree nodes are more robust in general -the baselines have 0% success. Our method, however, can successfully attack even high degree nodes. In general, our attack is significantly more effective across all bins -as shown by the numbers on top of each box -with 77.89% nodes successfully misclassified on average compared to e.g. only 33.64% for B rnd. For the link prediction task (Fig. 3) we are similarly able to cause significant damage -e.g. A link achieves almost 10% decrease in performance by flipping around 12.5% of edges on Cora, significantly better than all other baselines. Here again, compared to adding edges, removing has a stronger effect. Overall, answering (Q5), both experiments confirm that our attacks hinder the downstream tasks. The question of transferability -do attacks learned for one model generalize to other models -is important since in practice the attacker might not know the model used by the system under attack. However, if transferability holds, such knowledge is not required. To obtain the perturbed graph, we remove the top f adversarial edges with the A DW3 attack. The same perturbed graph is then used to learn node embeddings using several other state-of-the-art approaches. TAB0 shows the change in node classification performance compared to the embeddings learned on the clean graph for each method respectively. We tune the key hyperparameters for each method (e.g. p and q for node2vec). Answering (Q6), the show that our attack generalizes: the adversarial edges have a noticeable impact on other models as well. We can damage DeepWalk trained with the skip-gram objective with negative sampling (SGNS) showing that the factorization analysis is successful. We can even damage the performance of semi-supervised approaches such as GCN and Label Propagation. Compared to the transferability of the baselines (Sec. 6.3) our attack causes significantly more damage. We demonstrate that node embeddings are vulnerable to adversarial attacks which can be efficiently computed and have a significant negative effect on node classification and link prediction. Furthermore, successfully poisoning the system is possible with relatively small perturbations and under restriction. More importantly, our attacks generalize -the adversarial edges are transferable across different models. Future work includes modeling the knowledge of the attacker, attacking other network representation learning methods, and developing effective defenses against such attacks. Attacking spectral embedding. Finding the spectral embedding is equivalent to the following trace minimization problem: DISPLAYFORM0 subject to orthogonality constraints, where L xy is the graph Laplacian. The solution is obtained via the eigen-decomposition of L, with Z * = U K where U K are the K-first eigen-vectors corresponding to the K-smallest eigenvalues λ i. The Laplacian is typically defined in three different ways: the unnormalized Laplacian L = D − A, the normalized random walk Laplacian From Lemma 5 we see that we can attack both normalized versions of the graph Laplacian with a single attack strategy since they have the same eigenvalues. It also helps us to do that efficiently similar to our previous analysis (Theorem. 3). DISPLAYFORM1 Theorem 4. Let L rw (or equivalently L sym) be the initial graph Laplacian before performing a flip and λ y and u y be any eigenvalue and eigenvector of L rw. The eigenvalue λ y of L rw obtained after flipping a single edge (i, j) is DISPLAYFORM2 where u yi is the i-th entry of the vector u y.Proof. From Lemma 5 we can estimate the change in L rw (or equivalently L sym) by estimating the eigenvalues solving the generalized eigen-problem Lu = λDu. Let ∆L = L − L be the change in the unnormalized graph Laplacian after performing a single edge flip (i, j) and ∆D be the corresponding change in the degree matrix. Let e i be defined as before. Then ∆L = (1 − 2A ij)(e i − e j)(e i − e j) T and ∆D = (1 − 2A ij)(e i e T i + e j e T j). Based on the theory of eigenvalue perturbation we have λ y ≈ λ y + u T y (∆L − λ y ∆D)u y. Substituting ∆L and ∆D are re-arranging we get the above . Using now Theorem 4 and Eq. 5 we finally estimate the loss of the spectral embedding after flipping an edge L SC (L rw, Z) ≈ K p=1 λ p. Note that here we are summing over the K-first smallest eigenvalues. We see that spectral embedding and the random walk based approaches are indeed very similar. We provide similar analysis for the the unnormalized Laplacian:Theorem 5. Let L be the initial unnormalized graph Laplacian before performing a flip and λ y and u y be any eigenvalue and eigenvector of L. The eigenvalue λ y of L obtained after flipping a single edge (i, j) can be approximated by: DISPLAYFORM3 Proof. Let ∆A = A − A be the change in the adjacency matrix after performing a single edge flip (i, j) and ∆D be the corresponding change in the degree matrix. Let e i be defined as before. Then Upper bound on singular values. From Lemma 3 we have that L DW 3 is an upper bound on L DW 1 (excluding the elementwise logarithm) so maximizing L DW 3 is principled. To gain a better understanding of the tightness of the bound we visualize the singular values of S and their respective upper-bound for all datasets. As we can see in FIG6, the gap is different for different datasets and relatively small. Furthermore we can notice that the gap tends to increase for larger singular values. Transferability of the baselines. To further support the transferability of our proposed attack we also examine the transferability of the baseline attacks. Specifically, we examine the transferability of B eig since it is the strongest baseline when removing edges as shown in FIG2. We use the same experimental setup as in Sec. 4.4 and show the in TAB1. We can see that compared to our proposed attack the baseline can do a significantly smaller amount of damage (compare to in TAB0). Interestingly, it can do significant damage to GCN when removing 250 edges on Cora, but not when removing 500 edges. We plan on exploring this counterintuitive finding in future work.

Represent the TLDR for finding the corresponding scientific article

Adversarial attacks on unsupervised node embeddings based on eigenvalue perturbation theory.

Represent this text to find a much much longer article about it with say hundreds-thousands of words

This paper identifies classes of problems for which adversarial examples are inescapable, and derives fundamental bounds on the susceptibility of any classifier to adversarial examples.


Question: Represent the article for finding a single-sentence TLDR

Question: Hierarchical reinforcement learning methods offer a powerful means of planning flexible behavior in complicated domains. However, learning an appropriate hierarchical decomposition of a domain into subtasks remains a substantial challenge. We present a novel algorithm for subtask discovery, based on the recently introduced multitask linearly-solvable Markov decision process (MLMDP) framework. The MLMDP can perform never-before-seen tasks by representing them as a linear combination of a previously learned basis set of tasks. In this setting, the subtask discovery problem can naturally be posed as finding an optimal low-rank approximation of the set of tasks the agent will face in a domain. We use non-negative matrix factorization to discover this minimal basis set of tasks, and show that the technique learns intuitive decompositions in a variety of domains. Our method has several qualitatively desirable features: it is not limited to learning subtasks with single goal states, instead learning distributed patterns of preferred states; it learns qualitatively different hierarchical decompositions in the same domain depending on the ensemble of tasks the agent will face; and it may be straightforwardly iterated to obtain deeper hierarchical decompositions. Hierarchical reinforcement learning methods hold the promise of faster learning in complex state spaces and better transfer across tasks, by exploiting planning at multiple levels of detail BID0. A taxi driver, for instance, ultimately must execute a policy in the space of torques and forces applied to the steering wheel and pedals, but planning directly at this low level is beset by the curse of dimensionality. Algorithms like HAMS, MAXQ, and the options framework permit powerful forms of hierarchical abstraction, such that the taxi driver can plan at a higher level, perhaps choosing which passengers to pick up or a sequence of locations to navigate to BID19 BID3 BID13. While these algorithms can overcome the curse of dimensionality, they require the designer to specify the set of higher level actions or subtasks available to the agent. Choosing the right subtask structure can speed up learning and improve transfer across tasks, but choosing the wrong structure can slow learning BID17 BID1. The choice of hierarchical subtasks is thus critical, and a variety of work has sought algorithms that can automatically discover appropriate subtasks. One line of work has derived subtasks from properties of the agent's state space, attempting to identify states that the agent passes through frequently BID18. Subtasks are then created to reach these bottleneck states (van ; BID17 BID4 . In a domain of rooms, this style of analysis would typically identify doorways as the critical access points that individual skills should aim to reach (Şimşek &). This technique can rely only on passive exploration of the agent, yielding subtasks that do not depend on the set of tasks to be performed, or it can be applied to an agent as it learns about a particular ensemble of tasks, thereby suiting the learned options to a particular task set. Another line of work converts the target MDP into a state transition graph. Graph clustering techniques can then identify connected regions, and subtasks can be placed at the borders between connected regions BID11. In a rooms domain, these connected regions might correspond to rooms, with their borders again picking out doorways. Alternately, subtask states can be identified by their betweenness, counting the number of shortest paths that pass through each specific node (Şimşek & ; BID17 . Other recent work utilizes the eigenvectors of the graph laplacian to specify dense rewards for option policies that are defined over the full state space BID10 . Finally, other methods have grounded subtask discovery in the information each state reveals about the eventual goal (van). Most of these approaches aim to learn options with a single or low number of termination states, can require high computational expense BID17, and have not been widely used to generate multiple levels of hierarchy (but see BID24 ; BID12).Here we describe a novel subtask discovery algorithm based on the recently introduced Multitask linearly-solvable Markov decision process (MLMDP) framework BID14, which learns a basis set of tasks that may be linearly combined to solve tasks that lie in the span of the basis BID21. We show that an appropriate basis can naturally be found through non-negative matrix factorization BID8 BID3, yielding intuitive decompositions in a variety of domains. Moreover, we show how the technique may be iterated to learn deeper hierarchies of subtasks. In line with a number of prior methods, BID17 BID12 our method operates in the batch off-line setting; with immediate application to probabilistic planning. The subtask discovery method introduced in BID10, which also utilizes matrix factorization techniques to discover subtasks albeit from a very different theoretical foundation, is notable for its ability to operate in the online RL setting, although it is not immediately clear how the approach taken therein might achieve a deeper hierarchical architecture, or enable immediate generalization to novel tasks. In the multitask framework of BID14, the agent faces a set of tasks where each task has an identical transition structure, but different terminal rewards, modeling the setting where an agent pursues different goals in the same fixed environment. Each task is modeled as a finite-exit LMDP BID21. The LMDP is an alternative formulation of the standard MDP that carefully structures the problem formulation such that the Bellman optimality equation becomes linear in the exponentiated cost-to-go. As a of this linearity, optimal policies compose naturally: solutions for rewards corresponding to linear combinations of two optimal policies are simply the linear combination of their respective exponentiated cost-to-go functions BID22. This special property of LMDPs is exploited by BID14 to develop a multitask reinforcement learning method that uses a library of basis tasks, defined by their boundary rewards, to perform a potentially infinite variety of other tasks-any tasks that lie in the subspace spanned by the basis can be performed optimally. Briefly, the LMDP BID21 is defined by a three-tuple L = S, P, R, where S is a set of states, P is a passive transition probability distribution P: S × S →, and R is an expected instantaneous reward function R: S → R. The'action' chosen by the agent is a full transition probability distribution over next states, a(·|s). A control cost is associated with this choice such that a preference for energy-efficient actions is inherently specified: actions corresponding to distributions over next states that are very different from the passive transition probability distribution are expensive, while those that are similar are cheap. In this way the problem is regularized by the passive transition structure. Finally, the LMDP has rewards r i (s) for each interior state, and r b (s) for each boundary state in the finite exit formulation. The LMDP can be solved by finding the desirability function z(s) = e V (s)/λ which is the exponentiated cost-to-go function for a specific state s. Here λ is a temperature-like parameter related to the stochasticity of the solution. Given z(s), the optimal control can be computed in closed form (see BID20 for details). Despite the restrictions inherent in the formulation, the LMDP is generally applicable; see the supplementary material in BID14 for examples of how the LMDP can be applied to non-navigational, and conceptual tasks. A primary difficulty in translating standard MDPs into LMDPs is the construction of the action-free passive dynamics P (although a general way of approximating MDPs using LMDPs is given in BID20); however, in many cases, this can simply be taken as the ing Markov chain under a uniformly random policy. In this instance the problem is said to be'entropy regularized'. A similar problem set-up appears in a number of recent works BID15 BID6.The Multitask LMDP (MLDMP) BID14 operates by learning a set of N t tasks, defined by LMDPs L t = S, P, q i, q t b, t = 1, · · ·, N t with identical state space, passive dynamics, and internal rewards, but different instantaneous exponentiated boundary reward structures q for the multitask module. With this machinery in place, if a new task with boundary reward q can be expressed as a linear combination of previously learned tasks, q = Qw. Then the same weighting can be applied to derive the corresponding optimal desirability function, z = Zw, due to the compositionality of the LMDP. More generally, if the new task cannot be exactly expressed as a linear combination of previously learned tasks, a significant jump-start in learning may nevertheless be gained by finding an approximate representation. The multitask module can be stacked to form deep hierarchies BID14 by iteratively constructing higher order MLMDPs in which higher levels select the instantaneous reward structure that defines the current task for lower levels in a feudal-like architecture. This recursive procedure is carried out by firstly augmenting the layer l state spaceS l = S l ∪S l t with a set of N t terminal boundary states S l t called subtask states. Transitioning into a subtask state corresponds to a decision by the layer l MLMDP to access the next level of the hierarchy, and is equivalent to entering a state of the higher layer. These subtask transitions are governed by a new N ] are then suitably defined BID14. Solving the higher layer MLMDP will yield an optimal action a(·|s) making some transitions more likely than they would be under the passive dynamic, indicating that they are more desirable for the current task. Similarly, some transitions will be less likely than they would be under the passive dynamic, indicating that they should be avoided for the current task. The instantaneous rewards for the lower layer are therefore set to be proportional to the difference between the controlled and passive dynamic, r DISPLAYFORM0 Return control to lower layer to execute g) Figure 1: Execution model for the hierarchical MLMDP BID14. a) Beginning at some start state, the agent will make a transition underP 1. This transition may be to an interior, boundary, or subtask state. b) Transitioning into a subtask state is equivalent to entering a state of the higher layer MLMDP. No'real' time passes during this transition. c) The higher layer MLMDP is then solved and a next higher layer state is drawn. d) Knowing the next state at the higher layer allows us to specify the reward structure defining the current task at the lower layer. Control is then passed back to the lower layer to achieve this new task. Notice that the details of how this task should be solved are left to the lower layer (one possible trajectory being shown). e) At some point in the future the agent may again elect to transition into a subtask state -in this instance the transition is into a different subtask corresponding to a different state in the higher layer. f) The higher layer MLMDP is solved, and a next state drawn. This specifies the reward structure for a new task at the lower layer. g) Control is again passed back to the lower layer, which attempts to solve the new task. This process continues until the agent transitions into a boundary state. Prior work has assumed that the task basis Q is given a priori by the designer. Here we address the question of how a suitable basis may be learned. A natural starting point is to find a basis that retains as much information as possible about the ensemble of tasks to be performed, analogously to how principal component analysis yields a basis that maximally preserves information about an ensemble of vectors. In particular, to perform new tasks well, the desirability function for a new task must be representable as a (positive) linear combination of the desirability basis matrix Z. This naturally suggests decomposing Z using PCA (i.e., the SVD) to obtain a low-rank approximation that retains as much variance as possible in Z. However, there is one important caveat: the desirability function is the exponentiated cost-to-go, such that Z = exp(V /λ). Therefore Z must be non-negative, otherwise it does not correspond to a well-defined cost-to-go function. Our approach to subtask discovery is thus to uncover a low-rank representation through non-negative matrix factorization, to realize this positivity constraint BID8 BID3. We seek a decomposition of Z into a data matrix D ∈ R (m×k) and a weight matrix W ∈ R (k×n) as: DISPLAYFORM0 where d ij, w ij ≥ 0. The value of k in the decomposition must be chosen by a designer to yield the desired degree of abstraction, and is referred to as the decomposition factor. A small value of k corresponds to a high degree of abstraction since the variance in the desirability space Z must be captured in a k dimensional subspace spanned by the vectors in the data matrix D. Conversely, a large value of k corresponds to a low degree of abstraction. Since Z is strictly positive, the non-negative decomposition is not unique for any value of k BID5. Formally then, we seek a decomposition which minimizes the cost function DISPLAYFORM1 where d denotes the β-divergence, a subclass of the more familiar Bregman Divergences BID7, between the true basis Z and the approximate basis D. The β-divergence collapses to the better known statistical distances for β ∈ {1, 2}, corresponding to the Kullback-Leibler and Euclidean distances respectively BID2.Crucially, since Z depends on the set of tasks that the agent will perform in the environment, the representation is defined by the tasks taken against it, and is not simply a factorization of the domain structure. To keep the focus on the decomposition strategy, we assume, here and throughout, that Z ∈ R n×n is given. The basis set of tasks can be a tiny fraction of the set of possible tasks in the space. As an example, suppose we consider tasks with boundary rewards at any of two separate locations in an n-dimensional world such that there are n-choose-2 possible tasks (corresponding to tasks like 'navigate to point A or B'). We require only an n-dimensional Z matrix containing tasks to navigate to each point individually. The ing subtasks we uncover will aid in solving all of these n-choose-2 tasks. More generally we might consider tasks in which boundary rewards are placed at three or more locations, etc. To know Z therefore means to know an optimal policy to achieve n of ∼ 2 n tasks in a space. An online version of this method would estimate Z from data, either directly or by learning a transition model (see BID10 for some possibilities). Nested roomHairpin maze DISPLAYFORM0 Desirability functions for subtasksFigure 2: Intuitive decompositions in structured domains. All colour-plots correspond to the desirability functions for subtasks overlaid onto the base domains shown in panels a) and e). b,c,d) Subtasks correspond to'regions', distributed patterns over preferred states, rather than single states. Where the decomposition factor is chosen to match the structure of the domain (here k = 16 for example), subtasks correspond to an intuitive semantic -"go to room X". f,g,h) Again, subtasks correspond to regions rather than single states. Collectively the subtasks form an approximate cover for the space. To demonstrate that the proposed scheme recovers an intuitive decomposition, we consider the ing low-rank approximation to the desirability basis in two domains, for a few hand-picked decomposition factors. All presented in this section correspond to solutions to Eqn. for β = 1 so that the cost function is taken to be the KL-divergence (although the method does not appear to be overly sensitive to β ∈). Note that in the same way that the columns of Z represent the exponentiated cost-to-go for the single-states tasks in the basis, so the columns in D represent the exponentiated cost-to-go for the discovered subtasks. In Fig. 2, we compute the data matrix D ∈ R m×k for k = {4, 9, 16} for both the nested rooms domain, and the hairpin domain. The desirability functions for each of the subtasks is then plotted over the base domain. All of the decompositions share a number of properties intrinsic to the proposed scheme. Most notably, the subtasks themselves do not correspond to single states (like bottle-neck states), but rather to complex distributions over preferred states. By way of example, semantically, a single subtask in Fig. 2-d corresponds to the task'Go to Room', where any state in the room is suitable as a terminal state for the subtask. Also, since Z is taken to be the full basis matrix in this example, the distributed patterns of the subtasks collectively form an approximate cover for the full space. This is true regardless of the decomposition factor chosen. It is worthwhile noting that the decompositions discovered are refactored for larger values of k. That is to say that the decomposition for k = 5 is not the same as the decomposition for k = 4 just with the addition of an extra subtask. Instead all five of the subtasks in the decomposition are adjusted allowing for maximum expressiveness in the representation. It follows that there is no intrinsic ordering of the subtasks. It only matters that they collectively form a good representation of the task space Z. While we have shown only spatial decomposition thus far, our scheme is applicable to tasks more general than simple navigation-like tasks. To make this point clear, we consider the scheme's application to the standard TAXI domain BID3 with one passenger and four pickup/drop-off locations. The 5 × 5 TAXI domain considered is depicted in FIG2. Here the agent operates in the product space of the base domain (5 × 5 = 25), and the possible passenger locations (5-choose-1 = 5) for a complete state-space of 125 states. We consider a decomposition with factor k = 5. FIG2 is a depiction of the subtask structure we uncover. Each column of FIG2 is one of the subtasks we discover. Each of these is a policy over the full state space. For visual clarity, these are then divided into the five copies of the base domain, each being defined by the passenger's location. The color-map corresponds to the desirability function for each subtask. To help interpret the semantic nature of the subtasks discovered, consider the first column of FIG2. This subtask has almost all of its desirability function mass focused at states in which the passenger is in the Taxi. This task is thus a general pick-up action. By a similar analysis, column two of FIG2 depicts a subtask whose desirability function is essentially uniform over all states where the passenger is at location A. Semantically this subtask seeks to enter states with the passenger at location A regardless of taxi position. This subtask thus corresponds to the drop-off action at location A. Also note the slight probability leakage into the'in taxi' state for the drop off point -the precondition for the passenger to be dropped off. Considered as a whole, the subtask basis represents policies for getting the passenger to each of the pick-up/drop-off locations, and for having the passenger in the taxi. The proposed scheme discovers a set of subtasks by finding a low-rank approximation to the desirability basis matrix Z. By leveraging the stacking mechanism defined in BID14, this approximation procedure can simply be reapplied to find an approximate desirability basis for each subsequent layer of the hierarchy, by factoring the desirability matrix Z l+1 at each layer. However, As a demonstration of the recursive and multiscale nature of the scheme, we consider a spacial domain inspired by the multiscale nature of cities, see FIG3. At the highest level we consider a city which is comprised of three major communities, each of which is comprised of five houses. Each house is further comprised of four rooms, each of which is comprised of sixteen base states in a 4 × 4 grid. We consider a decomposition in line with the natural scales of the domain and take k l = {3 × 5 × 4 = 60, 3 × 5 = 15, 3} respectively for l = 2, 3, 4. As expected, the scheme discovers subtasks corresponding to the multiscale nature of the domain with the highest layer subtasks intuitively corresponding to whole communities, etc. Of course the semantic clarity of the subtasks is due to the specific decomposition factors chosen, but any decomposition factors would work to solve tasks in the domain. At this point the scheme has automated the discovery of the subtasks themselves, and the transitions into these subtasks. What remains is for a designer to specify the decomposition factors k l at each layer. In an analogy to neural network architectures, the scheme has defined the network connectivity but not the number of neurons at each layer. While this is a typical hyperparameter, by leveraging the unique construction in Eqn., a good value for this parameter may be estimated from data. By increasing the decomposition factor k l the approximation error, given by Eqn. FORMULA2, is monotonically decreased. For some domains there is an obvious inflection point at which increasing the decomposition factor only slightly improves the approximation. Let us denote the dependence of d β (·) on the decomposition factor simply as f (k). Then we may somewhat naively take the smallest value that demonstrates diminishing incremental returns as a good value for k. In this instance the (LEFT) By projecting the state at each layer back into the base domain, it becomes apparent that subtasks correspond to distributed patterns of preferred states, rather than single goal states. In this way hierarchical subtasks are ever more abstracted in space and time, as higher layers are accessed. Tangibly, where the states at the lowest layer correspond to individual locations, higher layer states correspond to entire rooms, houses, and communities correspondingly. (RIGHT) An abstract representation of'subtasks' as states of a higher layer MLMDP. A key contribution of this paper is to define an autonomous way of uncovering the contents of higher layer states, and the transition structures into these states. approximation error, Eqn. FORMULA2, is said to exhibit elbow-joint behaviour: DISPLAYFORM0 In practice, when the task ensemble is drawn uniformly from the domain, the observed elbow-joint behaviour is an encoding of the high-level domain structure. Choosing the right set of subtasks is known to speed up learning and improve transfer between tasks. However, choosing the wrong subtasks can actually slow learning. While in general it is not possible to assess a priori whether a set of subtasks is'good' or'bad', the new approach taken here provides a natural measure of the quality of a set of subtasks, by evaluating the quality of the approximation in Eqn.. It follows immediately that different sets of subtasks can be compared simply by evaluating Eqn. for each set individually. This leads naturally to the notion of subtask equivalence. Suppose some standard metric is defined on the space of matrices as m(A, B). Then a formal pseudoequivalence relation may be defined on the set of subtasks, encoded as the columns of the data matrix D, by assigning subtasks that provide similar approximations to the desirability basis to the same classes. Explicitly, for DISPLAYFORM0 The pseudo-equivalence class follows as: DISPLAYFORM1 A full equivalence relation here fails since transitivity does not hold. As noted above, our scheme typically uncovers subtasks as complex distributions over preferred states, rather than individual states themselves. As in Fig., we uncover regions such as'rooms', whereas other methods typically uncover single states such as'doorways'. There is a natural duality between these abstractions, which we consider below. A weight vector can be assigned to each state by solving Eqn. for a specific z: DISPLAYFORM0 This weight vector can be thought of as the representation of s in D. To each state we then assign a real-valued measure of stability, by considering how much this representation changes under state-transition. Explicitly, we consider the stability function g: S → R: DISPLAYFORM1 which is a measure of how the representations of neighbour states differ from the current state, weighted by the probability of transitioning to those neighbours. States for which g(s) takes a high value are considered to be unstable, whereas states for which g(s) takes a small value are considered to be stable. Unstable states are those which fall on the boundary between subtask'regions'. A cursory analysis of Fig. immediately identifies doorways as being those unstable states. Figure 6: A natural duality exists between the subtasks uncovered by our scheme, and those typically uncovered by other methods. a) A filter-stack of four subtasks corresponding to the layer one decomposition. Here k 1 = 4 and we present the full set of subtasks. Each of the four subtasks corresponds to one of the four rooms in the domain. b) A hand picked example path through the domain, chosen to illustrate the changing representation for different domain states in terms of the higher layer states. This path and does not correspond to a real agent trajectory. c) For each state along the example path we compute the desirability function z s and approximate it using a linear blend of our subtasks according to Eqn.. The task weights are plotted as a function of steps, revealing the change in representation for different states along the example path. d) Agnostic to any particular path, we compute the stability function g(s) for each state in the domain. It is immediately clear that unstable states, those for which the representation in D l changes starkly, correspond to'doorways'. We present a novel subtask discovery mechanism based on the low rank approximation of the desirability basis afforded by the LMDP framework. The new scheme reliably uncovers intuitive decompositions in a variety of sample domains. Unlike methods based on pure state abstraction, the proposed scheme is fundamentally dependent on the task ensemble, recovering different subtask representations for different task ensembles. Moreover, by leveraging the stacking procedure for hierarchical MLMDPs, the subtask discovery mechanism may be straightforwardly iterated to yield powerful hierarchical abstractions. Finally, the unusual construction allows us to analytically probe a number of natural questions inaccessible to other methods; we consider specifically a measure of the quality of a set of subtasks, and the equivalence of different sets of subtasks. A current drawback of the approach is its reliance on a discrete, tabular, state space. Scaling to high dimensional problems will require applying state function approximation schemes, as well as online estimation of Z directly from experience. These are avenues of current work. More abstractly, the method might be extended by allowing for some concept of nonlinear regularized composition allowing more complex behaviours to be expressed by the hierarchy. AMS thanks the Swartz Program in Theoretical Neuroscience at Harvard University for support.

Represent this text to find a much much longer article about it with say hundreds-thousands of words

We present a novel algorithm for hierarchical subtask discovery which leverages the multitask linear Markov decision process framework.

represent the tldr for finding the corresponding scientific article:

first posing and solving the sample efficiency optimization problem in the non-parameterized policy space, and then solving a supervised regression problem to find a parameterized policy that is near the optimal non-parameterized policy.