text:
\section{Introduction}
\input{Sections/Introduction}

\section{Agile Methodology for Designing \\ Efficient ML Systems}
\input{Sections/Efficiency}

\section{Designing Reliable ML Systems}
\input{Sections/Reliability}

\section{Securing ML Systems}
\input{Sections/Security}

\input{Sections/Conclusions}

\section*{Acknowledgment}

At ASU, this work was supported in part by NSF under Grant CCF 1723476—NSF/Intel Joint Research Center for Computer Assisted Programming for Heterogeneous Architectures (CAPA).
At TU Wien, this work has been supported in part by Intel Corporation through Gift funding for the project ``Cost-Effective Dependability for Deep Neural Networks and Spiking Neural Networks'', and by the Doctoral College Resilient Embedded Systems, which is run jointly by the TU Wien's Faculty of Informatics and the UAS Technikum Wien.
At NYUAD, different parts of these works were also supported in parts by the NYUAD Center for Interacting Urban Networks (CITIES), funded by Tamkeen under the NYUAD Research Institute Award CG001, Center for CyberSecurity (CCS), funded by Tamkeen under the NYUAD Research Institute Award G1104, and Center for Artificial Intelligence and Robotics (CAIR), funded by Tamkeen under the NYUAD Research Institute Award CG010.
At UPHF, this work has been supported in part by RESIST project funded by Région Hauts-de-France through STIMULE scheme (AR 21006614).

\bibliographystyle{IEEEtran}

\section{Conclusions}

Cutting-edge ML algorithms and applications are driving the need for more efficient, reliable, and secure ML systems, requiring a cross-layer codesign methodology. Key takeaways from the proposed methodology are:

\begin{itemize}
    \item Efficient designs for evolving ML workloads can be obtained by a design space description, which allows exploring various NPU architectures and design metrics, not just efficient designs of an NPU.
    \item Agile design flow can be enabled by full system stack automation for a wide range of NPU architectures and execution metrics.
    \item Agile design space exploration of ML systems can be enabled by reasoning about obtained costs and design decisions, e.g., with gray-box optimizations and bottleneck analysis.
    \item Reliability threats such as soft errors, process variations, permanent faults and aging can be mitigated in a cost-effective manner by exploiting intrinsic characteristics of DNNs. Moreover, a mitigation technique designed to address one threat can (to some extent) mitigate other reliability threats as well. Therefore, thorough exploration should be performed to select the best combination to collectively address all the threats. Moreover, as some of the techniques incur slight energy/power and area overheads, this exploration should be performed collectively with the search for an efficient NPU design.
    \item Security threats like adversarial attacks, fault injections and privacy attacks can be detected by runtime fault monitoring or adversarial detection techniques; the robustness can be increased by applying adversarial training at design time, or noise filters and defensive approximation at runtime.
    \item Cross-layer codesign for efficiency, reliability, and security can be enabled by integrating corresponding cost models for design exploration, training of the models, and run-time monitoring and mapping.
\end{itemize}
\subsection{NPU Design Requirements and Challenges}

\mysubsubsection{NPUs:} Examples of NPUs include Google's Tensor Processing Unit (TPU)~\cite{jouppi2017datacenter}, tensor cores in NVIDIA A100 Ampere architecture, Samsung NPU~\cite{park2021samsung}, Sambanova's RDU~\cite{emani2021accelerating}, IBM's AI Accelerator~\cite{fleischer2018scalable}, Microsoft Brainwave~\cite{chung2018serving}, Tesla's Self-Driving computer~\cite{talpes2020compute}, Facebook's ML accelerator~\cite{anderson2021first}, etc. NPU architectures can be standalone, a co-processor, or a near-data processing engine~\cite{kim2021aquabolt, gao2017tetris, song2019hypar}. Most NPUs are spatial architectures (e.g., Fig. \ref{fig:NPU-DSE}), while others like SpiNNaker and Intel Loihi~\cite{davies2021advancing} are neuromorphic processors. We present an agile, end-to-end methodology for obtaining efficient hardware/software designs of NPUs, with spatial architectures as a target example.

\mysubsubsection{NPU Design Flow Requirements:} Design space exploration (DSE) of NPUs require efficient HW/SW co-design that meets strict constraints of ML applications (Fig. \ref{fig:NPU-DSE}), i.e., within desired latency, area, power, throughput, accuracy, storage, energy budgets \cite{reddi2020mlperf}. Further, we need an agile design methodology because sustaining acceleration becomes challenging as ML workloads evolve. Besides, automatic and efficient construction of system stack is needed, as NPU architectures must adapt to new workloads by supporting specializations like sparsity or novel implementations such as mixed-precision computations~\cite{dave2021hardware}.

\mysubsubsection{Prior ADL-based Design Methods:} Prior NPU design approaches are mostly ADL-based, as in they define an \emph{architecture template}~\cite{boroumand2021google, minutoli2020soda, lai2020susy, mei2021zigzag, podobas2020template} in \textit{an architecture description language (ADL)}~\cite{chin2018architecture}, and build a system stack around it~\cite{zhang2022full}. \circledB{1} For a template, the architecture is fixed, i.e., what kind of computation and memory units are interconnected and how. The design space is limited to tuning only hyperparameters of this one architecture. It may lead to system \emph{inefficiency}, as a broad set of architectures is left unexplored. \circledB{2} Expert designers manually build tools like cost models, simulators, and compilers from scratch for the target architecture. This approach lacks flexibility. \circledB{3} Lastly, prior DSE approaches have used \emph{black-box} or \emph{NPU-agnostic optimizations} like simulated annealing or Bayesian~\cite{kao2020confuciux, nardi2019practical}, limiting the explainability and exploration agility. They cannot reason about high costs obtained or the effectiveness of potential design candidates. As a result, DSE can be costly in design time. The lack of dynamic DSE limits emerging applications such as deploying overlays for new DNN models on reconfigurable infrastructure or scheduling tasks of smart-city applications on distant, edge computing nodes, etc.

\subsection{End-to-end Agile Design Workflow}

Our methodology addresses the aforementioned challenges via \textit{design space description language and framework (DSDL)}. The key idea is to allow comprehensive exploration of arbitrary architectures (Fig. \ref{fig:DSDL-overview}a), so that much efficient designs for target ML workloads can be explored. With flow graph abstraction of architectures (Fig. \ref{fig:DSDL-overview}b), DSDL can automatically build system stack tools like cost models, simulator, and compiler for an arbitrary flow graph (Fig. \ref{fig:DSDL-overview}d). Lastly, it uses bottleneck analysis which yields explainability and agile exploration.

\begin{figure*}
\center {\includegraphics[width=\linewidth]{Images/Efficiency/agile_design_efficiency.pdf}}
\caption{Agile methodology for designing efficient NPUs with automated full-stack development.}
\vspace{-0.1cm}
\label{fig:efficiency-workflow}
\vspace{-0.15cm}
\end{figure*}

\mysubsubsection{Overview of the Framework:} Fig. \ref{fig:efficiency-workflow} illustrates our agile design methodology for efficient ML accelerator designs. Application developers define ML models in frameworks like PyTorch, Tensorflow, or MXNet. ML compilers obtain graphs of these models and optimize them before lowering them into low-level IRs like LLVM. Developers also specify execution constraints and objectives for DSE. Our methodology enables comprehensive exploration by allowing designers and architects to specify the design space, i.e., components for computation, communication, memory, and control logic. Design libraries provide implementation of these components. Designers can also define rules for legality of the designs and pruning the search space, which are enforced during exploration of flow graphs (hardware architectures). Further, DSDL enables efficient codesign exploration through bottleneck analysis, which optimizes parameters that lower target costs. The functionality of various system stack tools (e.g., latency cost or programming the architecture) are auto-constructed by parsing the flow graph and aggregating the functionality corresponding to the individual nodes and edges. Since it allows determining cost models for arbitrary NPU architectures automatically, our methodology can yield efficient model/NPU codesigns through agile exploration.

\mysubsubsection{Graph Optimizations:} Graph-level optimizations help improve computational and memory efficiency by applying various transformations. They include operator fusion, algebric simplification, strength reduction, etc.~\cite{li2020deep}. Existing ML compilers such as XLA, Glow~\cite{rotem2018glow}, TVM~\cite{chen2018tvm}, and nGraph provide such optimizations and lower graphs into intermediate representations (IRs) like LLVM IR~\cite{lattner2004llvm} or MLIR~\cite{lattner2020mlir}, which can be fed to design exploration mechanism.

\mysubsubsection{NPU Design Abstraction and Specification:} Design abstraction impacts the architectures that can be specified or explored by designers. Our methodology uses a flow graph representation~\cite{dave2022dsdl}. In an NPU's flow graph, nodes are primary components of computation, memory, control logic~\cite{pal2020transmuter, weng2020dsagen}, or even a sub graph and edges are fixed/reconfigurable interconnects. It allows modular construction of designs and modeling arbitrary hierarchy and grouping of arbitrary components. Moreover, it facilitates the support extension for novel architectures. Further, since algorithms are compiled as data flow graphs~\cite{das2018dataflow, dave2017ccf}, they can be conveniently mapped on flow graphs of NPUs. Flow graphs can be constructed through a library, which provides APIs for defining nodes and edges as well as their grouping and replication.

\mysubsubsection{Libraries and Frameworks for Modular Accelerator Construction:} They define preliminary components for computation, memory, interconnections, and control~\cite{weng2020dsagen, wu2019accelergy}. The definitions specify simulation functionality, execution costs like area, latency, or energy~\cite{wu2019accelergy}, or hardware synthesis of each component~\cite{weng2020dsagen}. Frequently used high-level components can also be defined, such as vector units, systolic array, and computation/memory tiles~\cite{venkataramani2017scaledeep}, as specified in libraries like MAGNet~\cite{venkatesan2019magnet} and AutoDNNChip~\cite{xu2020autodnnchip}. Library also integrates reliability and security costs for components and specialized components such as razor flip flops for detecting timing violations or trusted memory.

\mysubsubsection{Comprehensive NPU Design Space Formulation:} It determines NPU architectures and their designs that can be explored, and thus, overall efficiency. DSDL enables specifying vast space (Fig. \ref{fig:DSDL-overview}a), as hierarchy and organization of components are explicitly explored~\cite{dave2022dsdl}. Exploration of such broad space can lead to unseen architectures that are significantly more efficient (e.g., NPUs with no shared buffers for memory-bounded, no-reuse workloads~\cite{gao2017tetris}), unlike a specific architecture of the template. In DSDL, designers can define rules in terms of the legality of the generated designs, like what components can be interconnected or not and any relationships among their hyperparameters. In addition, there are also optimization rules for meaningful exploration in a pruned space. For instance, designers may want to explore homogeneous architectural components or a certain hierarchy of buffers. Designers also specify constraints, not just for latency, accuracy, etc., but also for reliability and security, based on such models supported by the NPU design library.

Based on the description, DSDL's iterative exploration takes place in three steps. The first is vertical exploration, which formulates a flow graph (Fig. \ref{fig:DSDL-overview}b) and ensures its compatibility with workloads. Then, horizontal exploration figures out optimized hyperparameters for the flow graph (e.g., buffer sizes). For each design, DSDL optimizes the software, e.g., mapping configurations, for it. In fact, all three steps can be jointly explored, especially through an explainable DSE.

\mysubsubsection{Automating Comprehensive Mapping Space Formulation:} Mapping space for an NPU encapsulates all schedules (aka iteration spaces in a polyhedral compiler~\cite{wolfe1989more, bondhugula2008practical}) that are possible corresponding to various loop optimizations like tiling, ordering, and unrolling, when executing a nested loop on an NPU~\cite{dave2019dmazerunner, li2020deep, dave2021hardware}. To develop a compiler for a customized NPU architecture, experts have previously formulated the mapping space manually~\cite{dave2019dmazerunner, venkatesan2019magnet, mei2021zigzag} or relied on NPU-agnostic loop optimizations~\cite{lattner2004llvm}. Then, compiler mapped operations for a schedule by software pipelining~\cite{weng2020dsagen, dave2018ramp}. In contrast, our methodology can automate formulation of the mapping space by deriving program representation for each component and for the overall flow graph~\cite{dave2022dsdl}. It helps deriving set of possible transformations for given functionality.

\mysubsubsection{Automating Accurate Execution Cost Modeling:} For a flow graph, we can obtain accurate execution costs automatically (Fig. \ref{fig:DSDL-overview}d) by parsing the graph and aggregating costs of children (Fig. \ref{fig:DSDL-overview}c) for each parent node~\cite{dave2022dsdl}. Thus, it can not only model area or energy accurately (e.g., in Accelergy~\cite{wu2019accelergy}), but also total latency. Besides, for optimizing execution on commercial hardware, cost models may be obtained through machine/deep learning~\cite{adams2019learning} or profiling~\cite{wu2019fbnet}. Alongside, our method also allows incorporating security and reliability costs for components, including for data leaking and NBTI for aging, which helps formulating overall security and reliability models for the NPU design.

\mysubsubsection{Automated Machine Code Generation and NPU Simulation:} Design library provides simulation functionality for each component (Fig. \ref{fig:DSDL-overview}c), and optionally machine instructions to program the component (e.g., a PE). The collective simulation of an NPU architecture occurs as a dataflow through its flow graph. The control triggers that are necessary for a looped execution and live-in/out data are communicated via a synthetic controller, which also simulates non-accelerator functionality~\cite{dave2022dsdl}. The machine code can be generated by issuing instructions corresponding to a schedule.

\mysubsubsection{Explainable HW/SW Codesign Exploration:}  Instead of black-box optimizations, our methodology uses bottleneck analysis for an explainable DSE~\cite{dave2022dsdl, yang2010automated}. Bottleneck analysis for flow graphs is obtained through constructing the cost graphs from cost models, indicating the costs consumed by various datapaths of the NPU architecture. It informs about factors incurring high execution costs for each candidate design explored (e.g., for inference latency, computation time is $n\times$ higher than the time for NoC communication, DMA transfers, or decoding compressed tensors~\cite{dave2020dmazerunner, dave2021hardware}) and values of the parameters that can mitigate them (e.g., number of PEs or function units). With explainability about obtained outputs, iterative DSE can yield quick convergence, enabling DSE of an NPU architecture at even run time!

\mysubsubsection{Runtime Optimizations:} They ensure sustaining desired efficiency while meeting all necessary constraints, especially in distributed, multi-tenant~\cite{ghodrati2020planaria, quraishi2021survey} environments. Such optimizations include dynamic model selection from a model zoo~\cite{lou2021dynamic} (trade off accuracy with computations or memory footprint), data layout optimizations~\cite{li2020deep}, and DVFS (dynamic voltage-frequency scaling)~\cite{tu2020evolver}. Additionally, runtime can optimize execution by offloading computations of ML models partially to the cloud during processing on resource-critical embedded systems~\cite{almeida2021dyno,  ghasemi2021energy}. It may also coordinate contributions of participating devices for efficient convergence of federated learning models~\cite{ruan2021towards, kim2021autofl}. All such runtime optimizations can be incorporated with our framework, as they are either orthogonal or they could leverage obtained cost models for various NPUs and DSE for executing a model's layers onto individual devices.

\mysubsubsection{NPU-aware NAS:} Recent techniques including~\cite{jiang2020standing, zhou2021rethinking, lin2021naas, choi2021dance, li2021flash} enable hardware-aware neural architecture search (NAS)~\cite{benmeziane2021comprehensive} of ML models. Our methodology empowers them to quickly explore efficient NPU/model codesigns, since they can leverage accurate cost models of arbitrary NPU architectures and efficient hardware/software explorations, while iterating through various ML model architectures for applications.

\subsection{Reliability Threats}

Modern nano-scale devices face various reliability issues. Fig.~\ref{fig:threats} highlights the main types of reliability threats that can significantly degrade the performance of a DNN system. The figure also highlights a scenario in which these threats can lead to severe consequences, e.g., a fatal accident. The following text provides a brief introduction to different reliability threats.

\begin{figure}[t!]
    \centering
    \includegraphics[width=\linewidth]{Images/Reliability/Figure1_v1.1.pdf}
    \caption{Reliability issues and their impact on the output of a DNN. (The stop sign image is from the COCO dataset~\cite{lin2014microsoft})}
    \label{fig:threats}
    \vspace{-0.1cm}
\end{figure}

\begin{itemize}
    \item \textbf{Soft Errors} are bit-flips induced in computing systems due to radiation events. The main sources of these errors are alpha particles emitted by traces of impurities present in packaging materials and neutrons from cosmic radiation~\cite{baumann2005radiation}. These errors are transient in nature and vanish once new data is written to the faulty locations/cells. However, when present, they can significantly degrade the accuracy of an application.

    \item \textbf{Aging} is gradual degradation of a fabricated device due to various physical phenomena like Bias Temperature Instability (BTI), Hot Carrier Injection (HCI), and Electromigration (EM). It mainly affects the hardware characteristics of circuits, for example, by increasing the threshold voltage ($V_{TH}$) of transistors~\cite{kang2008nbti} or by eroding the wires. Aging, in general, results in timing errors, which can also translate to permanent faults over time.

    \item \textbf{Process Variations and Permanent Faults} are variations in the characteristics of transistors that occur during fabrication of an integrated circuit. These variations occur due to imperfections in the manufacturing process and affect the performance of the fabricated hardware. Process variations are, in general, addressed by adding guardbands, e.g., by increasing the supply voltage or decreasing the operating frequency of the chip/subsystem to ensure correct functionality. Extreme variations result in permanent faults and significantly affect the yield of the fabrication process.
\end{itemize}

\begin{figure}[t]
    \centering
    \includegraphics[width=1\linewidth]{Images/Reliability/Fault-Aware-Retraining.pdf}
	\caption{fault-aware re-training methodology}
    \label{fig:FA_retraining}
\end{figure}

\subsection{Cost-Effective Fault Mitigation}

Conventional redundancy-based solutions result in huge run-time and/or design-time overheads. To avoid such undesirable overhead costs, different low-cost techniques have been proposed in the literature to mitigated reliability threats in DNN systems. These techniques mainly exploit the intrinsic characteristics of DNNs or work on the principle of transforming critical faults to non-critical through low-cost modifications at the hardware as well as software level. The following text highlight the key concepts proposed for addressing different types of reliability threats in DNN systems without incurring huge overheads.

\subsubsection{Soft Error Mitigation}

Robustness against soft errors is highly important, specifically for safety-critical applications and systems operating under harsh conditions. Studies have shown that these faults can result in significant degradation of the application-level accuracy when they occur at critical locations~\cite{hanif2018robust}\cite{chen2020ranger}. As conventional techniques result in huge overheads in DNN-based systems, specialized low-cost techniques are designed to improve the resilience of DNNs against soft errors. To address soft errors in on-chip memory, Azizimazreah et al. proposed a zero-biased SRAM cell design that has a higher probability of switching to '0' state in case an error occurs~\cite{8515692}. The design is based on the observation that 0-to-1 bit-flips in DNNs result in a higher accuracy drop compared to 1-to-0 bit-flips. To address soft errors in the computational array of DNN accelerators, Chen et al. proposed Ranger~\cite{chen2020ranger}, a range-restriction-based technique for improving the resilience of DNN systems against soft errors. It classifies all the activation values that fall out of a pre-defined range as faulty, and replaces them with a specific value from within the range. A similar technique is proposed in~\cite{Hoang2020FTClipAct} for mitigating soft errors in on-chip memory. Apart from the above-mentioned techniques, algorithm-based fault tolerance, such as checksum-based error detection and correction~\cite{Zhao2021AlgorithmBasedFaultTolerance}, and selective redundancy-based techniques, in which only the critical neurons are implemented redundantly, have also been proposed to mitigate soft errors at low cost.

\begin{figure}[t]
    \centering
    \includegraphics[width=1\linewidth]{Images/Reliability/Modified_Systolic_Array.pdf}
	\caption{(a) A systolic array designed for accelerating DNN inference. (b) Modified PE design for for mitigating permanent faults~\cite{zhang2018analyzing}. (c) Modified PE design for mitigating timing errors~\cite{zhang2018thundervolt}.}
    \label{fig:DNN_Hardware}
\end{figure}

\subsubsection{Permanent Fault Mitigation}

Manufacturing defects or process variations induced permanent faults affect the yield of the chip fabrication process. The key goal of permanent fault mitigation techniques is to be able to improve the yield without incurring huge overheads and without affecting the performance of the systems in which the fabricated chips are deployed. As permanent faults are static in nature, the most effective technique for addressing them in DNN systems is Fault-Aware Training (FAT). To address permanent faults in the computational array of DNN accelerators, Zhang et al. proposed the concept of Fault-Aware Pruning (FAP)~\cite{zhang2018analyzing}. The technique exploits the fact that DNNs are, in general, resilient to small amount of pruning. To realize FAP, they added bypass paths in the processing elements of the array, which enable bypassing faulty MAC units. To further highlight the effectiveness of FAP, they coupled it with retraining using the methodology presented in Fig.~\ref{fig:FA_retraining} to achieve close to the baseline performance even at very high fault rates. Fig.~\ref{fig:DNN_Hardware}(b) shows the modifications required in the PEs of the array shown in Fig.~\ref{fig:DNN_Hardware}(a) to realize FAP approach. To address faults in the on-chip weight memory of DNN accelerators, Kim et al. proposed MATIC~\cite{kim2018matic}. It employs a methodology similar to Fig.~\ref{fig:FA_retraining}, however using memory fault maps, to generate a fault-aware DNN. Note that although the technique has been proposed mainly for improving the energy-efficiency of DNN systems through voltage scaling of on-chip weight memories, it can directly be employed for mitigating permanent faults in the on-chip memories.

\begin{figure}[t]
    \centering
    \includegraphics[width=1\linewidth]{Images/Reliability/FAM-Example.pdf}
	\caption{An example of fault-aware mapping technique using four filter and a 4x4 systolic array.}
    \label{fig:FAM_approach}
\end{figure}

Retraining DNNs requires huge computational resources. Therefore, FAT can result in huge design-time overheads, specifically in cases where a DNN has to be tuned for multiple faulty chip and each chip can have a distinct fault pattern. Under such circumstances, FAT cannot be employed. For such cases, Hanif et al. proposed SalvageDNN~\cite{abdullah2020salvagednn}, a saliency-driven fault-aware mapping technique. It works on the principle of mapping less significant weights on the faulty units. Fig.~\ref{fig:FAM_approach} presents an example of the working of SalvageDNN.

\subsubsection{Aging Mitigation}

Aging in CMOS circuits affects the characteristics of transistors and manifests as timing errors. To detect and mitigate these errors in DNN accelerators, Zhang et al. proposed TE-Drop~\cite{zhang2018thundervolt}, a timing error recovery technique for systolic-arrays in DNN accelerators. The technique employs razor flip-flops for detecting timing errors in MAC units. Then, by exploiting the resilience of DNNs to pruning, mitigate each error by stealing a clock cycle from the corresponding downstream MAC unit and bypassing its update. Fig.~\ref{fig:DNN_Hardware}(c) presents the modifications required in the PEs of the array shown in Fig.~\ref{fig:DNN_Hardware}(a) to realize the concept. Pandey et al. proposed a similar concept, GreenTPU~\cite{8806805}, to mitigate timing errors by boosting the operating voltage of erroneous MAC units. Note that ThunderVolt and GreenTPU both have been proposed for boosting energy efficiency of a DNN system through voltage scaling. However, due to their effectiveness against timing errors, they are highly useful against aging in computational arrays of DNN accelerators as well.

To alleviate aging of on-chip SRAM-based memory cells in DNN accelerators, Hanif et al. proposed DNN-Life~\cite{abdullah2021dnn}, a framework that employs read and write transducers to achieve ideal aging mitigation. The transducers mix data with random data, while keeping track of the encoding information, to balance the duty-cycle in each cell and minimize NBTI aging.

\begin{figure}[t]
    \centering
    \includegraphics[width=\linewidth]{Images/Reliability/Methodology.pdf}
	\caption{Overall Methodology for Building Reliable ML Systems~\cite{hanif2018robust}}
    \label{fig:Overall_meth_reliable}
\end{figure}

\subsubsection{Overall Methodology for Building Reliable ML Systems}

Fig.~\ref{fig:Overall_meth_reliable} shows our overall methodology for building reliable ML systems. In the design phase, a DNN accelerator is designed and then equipped with additional circuitry to support permanent fault mitigation and timing error detection and correction. The design is then passed through a reliability-aware synthesis~\cite{6464537} step, in which vulnerable nodes are selectively hardened to improve the system's resilience against soft errors. The hardware is then fabricated and passed for post-fabrication testing to locate permanent faults. The fault maps are then employed for fault-aware mapping and (if required) fault-aware re-training of DNNs. Once the DNNs have been tuned/adjusted, at the end, range-restriction methodologies are employed to define the bounds of activation values.

\subsection{Hardware-Level Security Threats}

At hardware level, different types of vulnerabilities have been studied. When the DNN weights are stored in DRAM and SRAM memory cells, the bits can be flipped through Row-Hammer attacks~\cite{Kim2014RowHammer} or laser injection~\cite{Agoyan2010FlipBit}. While ML algorithms are relatively resilient to random bit-flips, the analysis conducted in NeuroAttack~\cite{Venceslai2020NeuroAttack} demonstrated that only 4 bit-flips in the most vulnerable weight locations are sufficient to fool DNNs and SNNs on the CIFAR10 dataset. The Bit-Flip Attack methodology~\cite{Rakin2019BitFlipAttack} uses a progressive bit search method to find the most vulnerable bits, while the work of~\cite{Bai2021FlippingWeightBits} proposed a method to generate targeted misclassification through bit-flips. More generically, fault-injection attacks~\cite{Liu2017FaultInjectionAttack} can target not only the weights, but also activation functions~\cite{Breier2018FaultAttack}. Moreover, the work of~\cite{Nagarajan2022FaultInjectionSNN} studied fault-injection threats for SNNs such as input spike corruption and SNN threshold manipulation.

The defensive techniques aiming at achieving \textbf{fault tolerance} are based on deploying hardware redundancy~\cite{Ozen2020BitErrorResilience}, or algorithm-based fault tolerance methods~\cite{Zhao2021AlgorithmBasedFaultTolerance} for detecting and correcting the errors in the convolutional layers. Concurrently, Ranger~\cite{chen2020ranger} directly rectifies the faulty output by applying a transformation that selectively restricts the value ranges in DNNs, and FT-ClipAct~\cite{Hoang2020FTClipAct} replaces the unbounded activation functions with their clipped versions, thus alleviating the impact of high-intensity faulty activation values.

Since hardware accelerator architectures are likely manufactured in off-shore fabrication facilities, they are vulnerable to \textbf{hardware trojans}, which are maliciously-introduced hardware modifications. The work of~\cite{Clements2018HWTrojanDesign} injected trojans into the computational engine to alter the behavior of DNNs' activation functions. NeuroAttack~\cite{Venceslai2020NeuroAttack} injects trojans into the weight memory which are triggered when a carefully-crafted adversarial pattern is recognized at the input of DNNs or SNNs. Since they can be detected through runtime monitoring~\cite{Khalid2018RuntimeTrojanMonitor}, a key feature for the hardware trojans to achieve stealthiness is having extremely low area and power consumption overhead, compared to the victim hardware design.

Moreover, power \textbf{side-channel attacks} can be applied to DNN hardware accelerators to recover the input image from the collected power traces, thus threatening their privacy integrity~\cite{Wei2018SideChannelAttackCNN}. The work of~\cite{Maji2021LeakyNets} studied power and time-based side-channel attacks for TinyML targeting embedded microcontrollers to recover the DNN model parameters and inputs. The state-of-the-art defensive methods against side-channel attacks are based on the Boolean masking~\cite{Dubey2021GuardingSideChannelAttacks}, in which all the hardware blocks for computing the linear and non-linear DNN operations are masked.

\subsection{Adversarial ML}

\noindent\textbf{Security for DNN-based Conventional Architectures:}
While ML applications are already in use in mainstream products and systems, they suffer from vulnerabilities to adversarial attacks that threaten their integrity and trustworthiness. In particular, adversarial examples modify an input to a ML classifier with carefully crafted perturbations chosen by a malicious actor to force the classifier to output a wrong label. If adversaries are able to manipulate the decisions of a ML classifier to their advantage, they can jeopardize the security and integrity of the system, and even threaten the safety of people it interacts with. For example, adding adversarial noise to a stop sign that leads an autonomous vehicle to wrongly classify it as a speed limit sign potentially leads to crashes and loss of life. In fact, adversarial examples have been shown effective in real-world context~~\cite{Eykholt2018PhysicalWorldAttacks, Man2020GhostImage}: that when printed out, an adversarially crafted image can fool the classifiers even under different lighting conditions and orientations. Therefore, understanding and mitigating these attacks is essential to developing safe and trustworthy intelligent systems.

When attacking a DNN-based model, we can distinguish two main attack scenarios based on \textit{attacker knowledge}. A \textit{white-box setting} in which the adversary has complete knowledge of the training data of the victim model in addition to the target model's architecture and parameters. In contrast, in a \textit{Black-box setting}, the adversary has partial or no access to the victim model's architecture and parameters.  The adversary uses the results of querying the victim to reverse engineer the classifier and create a substitute model used to generate the adversarial examples.
The attacker intention is to slightly modify the source image so that it is classified incorrectly by the target model, without special preference towards any particular output which is known as \textit{untargeted attack}. However, in a \textit{targeted attack}, the attacker aims at a specified wrong target class.
Attacks could be performed on different phases of the ML flow, and accordingly can be classified into two categories: \textit{Poisoning or training attacks}, when the attacker attempts to alter the training process by poisoning the training data in order to create specific classification errors~\cite{Shafahi2018PoisoningAttacks}. \textit{Backdoor attacks}~\cite{Gu2019BadNets} are also based on providing poisoned data to the victim to train the model with. In fact, the attacker aims to create a backdoor that allows the  input instances that are created using the backdoor key to be classified as a target label.
On the other hand, \textit{Inference attacks} or specifically \textit{evasion attacks} ~\cite{Madry2018ResistentAdversarialAttacks, MoosaviDezfooli2016DeepFool} are attacks that attempt to perturb an input in a way that it seems normal for a human but is wrongly classified by ML models.\\
Researchers have devised several defenses in response to these adversarial ML attacks, some of which focus on detection~\cite{Roth2019OddsDetection, Cohen2020DetectingAdversarialSamples}, while others focus on prevention and preparation of the ML model to defend against adversarial examples such as adversarial training~\cite{Madry2018ResistentAdversarialAttacks},
input preprocessing~\cite{Khalid2019FAdeML, sit, das2017keeping},
Gradient masking based defenses~\cite{distillation_SP, nayebi2017biologically}.
These defense strategies either alter the DNN structure, tweak the training procedure, or train the model only against known adversarial threats, which limits the defense scope to known vulnerabilities.
Another set of defense techniques are inspired by hardware-efficiency techniques such quantization~\cite{Lin2019DefensiveQuantization, Khalid2019QuSecNets}. Authors in~\cite{Guesmi2021DefensiveApproximation} proposed Defensive approximation (DA), which leverages approximate computing (AC) to build robust models.
DA tackles the problem of robustness to adversarial attacks from a new perspective, i.e., approximation in the underlying hardware and targets both robustness and energy/resource challenges. In fact, DA exploits the inherent fault tolerance of deep learning systems~\cite{Neggaz2018ReliabilityCNN} to provide resilience while also obtaining by-product gains of AC in terms of energy and resources. The AC-induced perturbations tend to help the classifier generalize and enhances its confidence and consequently enhance the classifier's robustness.\\

\noindent\textbf{Security for SNN-based Neuromorphic Architectures:}
On neuromorphic architectures, the adversarial attacks and defenses can take advantage on different properties. For SNNs based on discrete data, white-box attacks~\cite{Bagheri2018AdvTrainingSNN} and black-box attacks~\cite{Marchisio2020IsSpikingSecure, Paudel2021SNNBlackboxAttacks} are generated and deployed. After generating the adversarial examples in the DNN domain, the work of~\cite{Sharmin2019ACA} demonstrated that the SNN generated through CNN-to-SNN conversion can be fooled by the same adversarial examples generated in the DNN domain. Moreover, the work of~\cite{Liang2020ExploringAttacksSNNGradient} proposed an attack algorithm based on the SNN gradient estimation both in the spatial and temporal domain.

Besides the conventional defense methodologies, recent work have demonstrated that it is possible to fine-tune the SNN structural parameters to improve its robustness. The work of~\cite{Sharmin2020SNNRobustness} studied the impact of discrete input encoding and non-linear activations, i.e., the leak factor in Leaky-Integrate-and-Fire (LIF) neurons, on the SNN's adversarial robustness. The work of~\cite{ElAllami2021SecuringSNNs} analyzed the SNNs robustness to adversarial attacks with different values of the LIF neuron's firing voltage thresholds and time window boundaries. Using these methods, the SNN robustness results up to $85\%$ higher than its equivalent DNN.

Since event-based sensing with dynamic vision sensors (DVS) is suitable for being deployed with high efficiency on low-power neuromorphic hardware, recent works demonstrated their applicability in safety-critical applications, such as autonomous driving, recognition and tracking~\cite{Viale_2021IJCNN_CarSNN, Massa2020EfficientSNN, Jiao2021EventCameraBasedSLAM}. Therefore, it is key to analyze the security aspects for event-based data. Towards this, the work of~\cite{Buchel2021AdversarialAttacksEventBased} modified the adversarial example generation algorithms of PGD, SparseFool, and Adversarial patches to be applied on event series. The work of~\cite{Lee2021AdversarialAttackEventBased} generated event-based adversarial examples on 3D point clouds. Moreover, the DVS-Attacks~\cite{Marchisio2021DVSAttacks} collect a set of stealthy yet efficient adversarial attack methodologies. The Sparse DVS-Attack injects sparse events in time, while the Frame, Corner, and Dash DVS-Attacks inject events in the whole time duration of the event sequences, injecting events in a frame around the sample, in a corner of the image, or in forms of dashed lines, respectively. Moreover, the Mask Filter-Aware Dash DVS-Attack is a modification of the Dash DVS-Attack, which limits the time duration of the perturbations.

While the noise filters for neuromorphic sensors~\cite{LinaresBarranco2019FilterDVS} have been originally designed for protecting against thermal noise and junction leakage fluctuation, their application to the input of neuromorphic computing engines serves as a defense mechanism against adversarial attacks~\cite{Marchisio2021RSNN} (see \Cref{fig:DVS_Attacks_Filter}). Among these \textbf{DVS-noise filters}, the background-activity filter (BAF) maintains only the events which have spatio-temporal correlation, thus filtering out the spurious events. The mask filter (MF) is designed to filter out the noise activity in pixels which have low temporal contrast. While the BAF makes the neuromorphic system robust against Sparse Attacks, the MF is resistant to Frame, Corner, and Dash Attacks. However, if the attacker has knowledge of the noise filter that is employed to protect the neuromorphic system, the MF-Aware Dash DVS-Attack~\cite{Marchisio2021DVSAttacks} can potentially break such defense.

\begin{figure}[t!]
    \centering
    \includegraphics[width=\linewidth]{Images/Security/DVS_Attacks_Filter.pdf}
    \caption{Example showing event-based adversarial attacks applied to gesture recognition systems implemented on neuromorphic hardware, in which the DVS-noise filter is applied to improve the SNN robustness~\cite{Marchisio2021RSNN}.}
    \label{fig:DVS_Attacks_Filter}
\end{figure}

\subsection{Privacy}

ML algorithms are vulnerable to privacy threats, which are critical when data confidentiality is an issue, e.g., when revealing the identity of the patients in clinical records. Membership Inference Attacks~\cite{Shokri2017MembershipInferenceAttack} aim at determining whether a data sample belongs to the training dataset. More generically, Property Inference Attacks~\cite{Ganju2018PropertyInferenceAttacks} infer certain properties that hold only for a fraction of the training data, and are independent from the features that the DNN model aims to learn. On the other hand, Model Stealing methods~\cite{Tramer2016ModelStealing} aim at duplicating the functionality of the ML model and extract its parameters, and Model Inversion Attacks~\cite{Fredrikson2015ModelInversionAttack} aim to infer sensitive features of the training data.

Towards avoiding these leakages of confidential information, several privacy-preserving techniques can be employed. \textbf{Homomorphic Encryption (HE)} ensures that the data remains confidential, since the attacker does not have access to the decryption keys. CryptoNets~\cite{GiladBachrach2016CryptoNets} apply HE to perform DNN inference on encrypted data, and the work of~\cite{Nandakumar2019TrainingEncryptedData} extends the encryption to the complete training process. Another state-of-the-art technique is \textbf{Differential Privacy}, which can be guaranteed through the injection of noise to the stochastic gradient descent process (Noisy SGD)~\cite{Abadi2016DifferentialPrivacy}, or through Private Aggregation of Teacher Ensembles (PATE)~\cite{Papernot2018PATE}, in which the knowledge learned by an ensemble of ``teacher" models is transferred to a ``student" model. Several frameworks based on \textbf{Multiparty Secure Computation} have been designed, including SecureML~\cite{Mohassel2017SecureML}, Gazelle~\cite{Juvekar2018Gazelle}, and SecureNN~\cite{Wagh2019SecureNN}. Concurrently, Privacy-Preserving Domain Adaptation techniques~\cite{Kim2020PrivacyPreservingDomainAdaptation} preserve the privacy by transferring the knowledge from a labeled source domain to an unlabeled target domain. Moreover, in the PrivateSNN methodology~\cite{Kim2021PrivateSNN} the DNN-to-SNN conversion is followed by weight encryption with spike-based training on synthetic data for privacy-preserving SNNs.

redpajama_set_name: RedPajamaArXiv


text:
\section{Acknowledgements}
The authors would like to thank Baidu for soliciting Chinese annotators, all the annotators for their effort in the data collection, Eric Macedo Esparza for reviewing the Spanish dataset, and the anonymous reviewers for their valuable comments. We also would like to thanks all the middle eastern universities, mainly in Egypt,  who contributed to collecting the Arabic version.

This work was supported by King Abdullah University of Science and Technology (KAUST), under Award No. BAS/1/1685-01-01.

\section{Introduction}
\label{sec:intro}

Figure~\ref{fig:teaser} compares and contrasts annotations on WikiArt across language/culture.
We believe these differences are interesting and important, and far from random.
One might suggest using machine translation to translate English captions to many other languages,
but we believe that doing so would miss much of the opportunity.
Building human-compatible AI that is more aware of our emotional being is important for increasing the social acceptance of AI. ArtEmis \cite{achlioptas2021artemis} is an important step in this direction, introducing a collection of 0.45M emotion labels and affective language explanations in \emph{English} on more than 80,000 artworks from WikiArt. However, by design, ArtEmis is limited to
English, lacking coverage of other cultures and languages.

Cultural differences are a major source of diversity~\cite{meyer_2014}. The customs, social values, lifestyles, and history of different countries and cultures greatly influence human behavior.  Emotional experiences are no exception; people from different countries respond differently to similar scenarios. For example,
a person born and raised in a Nordic country would be more comfortable in a lush forest than in a desert,
but a Bedouin may be more comfortable in a desert than in a forest.

Consider Figure~\ref{fig:teaser}c,
where an Arabic annotator assigned the image the label \textbf{contentment},
but the other two annotators used the label: \textbf{sadness}.
Captions are useful for diving deeper into these differences.
The \textbf{sadness} annotations mention \textit{death}\footnote{ \begin{CJK*}{UTF8}{gbsn}冬天下雪后到处白雪皑皑,枯树显得很萧条。 \end{CJK*} (snow everywhere and dying trees is depressing)} and disasters,\footnote{\textit{no me gusta el ambiente, lo primero que me vino a la mente fué un desastre natural con destrucción a su paso} (mentions a natural disaster)}
in contrast with the  \textbf{contentment} annotation that ends
with: \textit{feeling of satisfaction}.

There can be interesting differences between languages/cultures even
when annotators use the same label.
Consider Figure~\ref{fig:teaser}b, where
all three labels are \textbf{contentment}.  Although the three captions agree
on the label, two of the captions imply that some/all of the girls are sisters,
but there is no such implication in the English caption.

We believe deep nets will be viewed as more culturally aware,
if they can
capture linguistic/cultural patterns such as these.
Emotions are based on past experience, and play an integral role in determining human behavior. Not only they reflect our internal state but also directly effect how we perceive, interpret external stimuli~\cite{izard2009emotion}, and how to act based on them~\cite{lerner2015emotion}. Hence, studying emotions is essential to exploring a confounding aspect of human intelligence.

In summary, our \textbf{contributions} are:
\begin{enumerate}
  \setlength{\itemsep}{0pt}
  \setlength{\parskip}{0pt}
 \setlength{\parsep}{0pt}
    \item 0.79M annotations (labels + captions) in Arabic and Chinese, plus 4.8k in Spanish,
    \item a benchmark with standard splits, and
    \item baseline models for two tasks: (1) label prediction and (2) affective caption generation.
\end{enumerate}

The rest of the paper is organized as follows: related work is discussed in \S\ref{sec:related},
followed by our main motivation in \S\ref{sec:motivation}, and data collection in \S\ref{sec:artemis}.  \S{\ref{sec:analysis}} provides qualitative and quantitative analyses of ArtELingo{}.  Baseline models for emotion label prediction and caption generation are presented in \S\ref{sec:emo-cls} and \S\ref{sec:neural-speakers}, respectively.
\section{Related Work}
\label{sec:related}

\subsection{Captions with Emotions}
\label{sub_sec:art_cap_emo}

Work on captioning is moving beyond factual captions in early benchmarks such as
COCO \cite{lin2014microsoft}.
Figure~\ref{fig:family} shows two images of families, one from
ArtEmis and the other from COCO.
Both captions capture the facts, but ArtEmis enhances the facts with emotion/commentary.

Table~\ref{tab:benchmarks} compares three benchmarks: COCO \cite{lin2014microsoft}, ArtEmis and ArtELingo{}.
Art\underline{E}mis encourages work on emotions by replacing COCO photos with WikiArt,\footnote{\url{https://www.wikiart.org/}}
and by introducing 9 emotion classes, 4 positive,\footnote{Positive: \textbf{Contentment}, {\textbf{Awe}}, {\textbf{Amusement}}, {\textbf{Excitement}}}
4 negative\footnote{Negative:
{\textbf{Sadness}}, {\textbf{Fear}}, {\textbf{Disgust}}, {\textbf{Anger}}} and {{Other}}.
ArtELingo{} encourages researchers to work on visually grounded multilinguality by providing affective annotations
in three languages (henceforth, ACE/ACES): Arabic, Chinese and English. In addition, we provide a small set of Spanish (S).
Figure~\ref{fig:box9} shows that positive emotions are more frequent than negative emotions,
especially in Arabic.

  \begin{figure}[ht]
    \includegraphics[width=\linewidth]{figures/kwc_figures/bar9.pdf}
    \caption{In general, positive emotions are more frequent than negative emotions.
    The 9 plots are sorted by probability.  The log scale on y-axis highlights relative probabilities.
    A (Arabic) is relatively high for some classes (\textbf{awe}), and low for others (\textbf{sadness}).}
    \label{fig:box9}
\end{figure}

\subsection{Related Work in Other Fields}

There is a considerable literature on emotions, especially in Psychology \cite{russell1999core}.
One can find quite a few benchmarks on emotion in HuggingFace:
\cite{saravia-etal-2018-carer,demszky-etal-2020-goemotions,xiao2018mes}.\footnote{\label{hug_face}\url{https://huggingface.co/datasets?sort=downloads&search=emotion}}
There are a number of papers in computational linguistics on emotion and Chinese \cite{chen-etal-2020-end,quan-ren-2009-construction,wang-etal-2016-bilingual,lee-etal-2010-emotion},
and on emotion and Arabic \cite{abdullah-shaikh-2018-teamuncc}.
There is also considerable work on emotion in other fields such as vision \cite{Mittal_2021_CVPR}.

Many datasets have been collected to study
emotional responses to modalities such as:

\begin{itemize}
  \setlength{\itemsep}{0pt}
  \setlength{\parskip}{0pt}
 \setlength{\parsep}{0pt}
    \item Text

    \cite{strapparava-mihalcea-2007-semeval,demszky-etal-2020-goemotions,mohammad-etal-2018-semeval,liu2019dens},\footnote{\url{https://data.world/crowdflower/sentiment-analysis-in-text}}

    \item Image~\cite{mohammad2018wikiart,Kosti_2017_CVPR_Workshops}, and
    \item Audio~\cite{cowen2019mapping,cowen2020music}.
\end{itemize}

Bias is the flip side of inclusiveness.
There
has been considerable discussion recently about biases \cite{bender2021dangers,NIPS2016_a486cd07,buolamwini2018gender,10.1145/3457607, liu2021visually}.
Some of this work is more relevant to our interest in Chinese \cite{jiao-luo-2021-gender,liang-etal-2020-monolingual},
and Arabic \cite{abid2021persistent}.
Many machine learning methods will, at best, learn what is in the training data.
There have been some attempts to remove biases in corpora,
but it might also be constructive to create more inclusive benchmarks such as ArtELingo{}.

Awareness of different cultures is becoming increasingly important. Gone are the days when it was sufficient for datasets to focus on a single culture. Recently, the Vision \& Language community has been producing more multicultural multilingual datasets \cite{bugliarello2022iglue, srinivasan2021wit, armitage2020mlm}. ArtELingo{} contributes cultural diversity over emotional experiences. The effect of culture on psychology has been studied in separate studies \cite{henrich2010weirdest, abu1990romance, norenzayan2005psychological}. ArtELingo{} provides empirical evidence that might motivate cultural psychology studies.

\section{Opportunities for Improvement}
\label{sec:motivation}

Many of the resources mentioned above have advanced our understanding of the relationship between emotion and various stimuli, through there are
always opportunities for improvement.  We are particularly interested in three such opportunities:
scale, multimodality and multilinguality/muli-culturalism.
As for scale, demand for  larger training sets is expected to continue to increase,
given  the rise of large scale foundation models~\cite{bommasani2021opportunities}.

As for multimodality, although most benchmarks mentioned above focus on a single modality,
there are a few multimodal exceptions such as IEMOCAP \cite{busso2008iemocap}, COCO and ArtEmis.
IEMOCAP collected speech and facial and hand movements of 10 actors.  Unfortunately, this approach may be  expensive to scale up.

The use of Amazon Mechanical Turk in ArtEmis is easier for scaling, however,
ArtEmis is limited to English.   ArtELingo{} addresses
multilinguality/multi-culturalism by adding Arabic and Chinese annotations.
We use languages as a proxy to reflect different cultures.
English is a representative sample of the West, and Chinese is a representative sample of the East,
and Arabic is a representative sample of the Middle East.

\subsection{Representation of Regions in WikiArt}
\label{sec:representation}

\begin{table}
    \centering{
        \begin{tabular}{l | r  r}
            Region     &   \#Artworks & \%  \\
            \hline
            West (Non English) &142.8k&57.1\%\\
            West (English) & 54.0k & 21.6\% \\
            Other & 38.0k & 15.2\% \\
            Middle East (Non Arabic) & 12.2k & 4.8\% \\
            Middle East (Arabic) & 1.6k & 0.6\% \\

            East (Chinese) &1.4k & 0.5\% \\
            \hline \hline
            Total & 250.0k & 100\% \\

        \end{tabular}

    \caption{WikiArt is more representative of the West}
    \label{tab:wikiArt_diversity}}
\end{table}

ArtELingo{} assumes that WikiArt is a representative sample of the cultures of interest.
While WikiArt is remarkably comprehensive, Table~\ref{tab:wikiArt_diversity} suggests
the WikiArt collection has better coverage of the West than other regions of the world.
This table is based on WikiArt's assignment of artworks to nationalities.\footnote{\url{https://www.wikiart.org/en/artists-by-nation}}
We assigned each nationality to West (English\footnote{West (English):\textit{ Americans, Australians, British} and \textit{Canadians}}
and Non English\footnote{West (Non English): \textit{Albanians, Armenians, Austrians, Azerbaijanis, Belarusians, Belgians, Bosnians, Bulgarians, Croatians, Czechs, Dutch, Estonians, Finnish, French, Georgians, Germans, Greeks, Hungarians, Icelandic, Irishes, Indigenous North Americans, Italians, Kazahstani, Latvians, Lithuanians, Luxembourgers, Maltese, Montenegrins, Polish, Portuguese, Romanians, Scottish, Slovaks, Serbians, Slovenians, Spanish, Swiss, Swedish, Ukrainians, Uruguayans, Uzbek} and \textit{Venezuelans}}), Middle East (Arabic\footnote{Middle East (Arabic): \textit{Algerians, Bahraini, Egyptians, Emiratis, Moroccans, Libyans, Lebanese, Iraqi, Palestinians, Qatari, Saudis, Syrians} and \textit{Tunisians}}
and Non Arabic\footnote{Middle East (Non Arabic): \textit{Kenyans, Jewish, Israeli, Iranians} and \textit{Turkish}}), East (Chinese) and Other.

\section{ArtELingo{}}
\label{sec:artemis}

Following ArtEmis, we employ Amazon Mechanical Turk (AMT) platform to collect our data using interfaces ( see Figures ~\ref{fig:ar_interface},~\ref{fig:ch_interface},~\ref{fig:sp_interface} in the appendix). We faced a lack of Arabic and Chinese speaking annotators on AMT which led us to devise different strategies to recruit annotators. Arabic speakers were recruited by advertising the task in middle eastern universities encouraging students and their families to join our data collection efforts. Whereas Chinese speakers were recruited through Baidu who we'd like to thank.

Annotators are asked to carefully examine each artwork before selecting the dominant emotion induced by it from a list of four positive, four negative emotions, and \emph{Other} to indicate a different emotion. Annotators are then asked to write captions that reflects the content of the artwork and explains their choice of emotion. Similar to ArtEmis, we collect annotations from five annotators for each artwork.

For a better cultural representation in ArtELingo{}, we restrict the collection of different languages annotations to countries with large numbers
of native speakers. Chinese data is collected from China. For Arabic, we collect our data mainly from Saudi Arabia and Egypt. Finally, Spanish is collected from Latin America and Spain.
Figure~\ref{fig:workers} shows that most of the annotations are from a long tail of workers who
annotated less than 1000 artworks ensuring a diverse representation of cultures.
\begin{figure}
    \centering
    \includegraphics[width=0.8\linewidth]{figures/workers_2.png}
    \caption{Most ($>$60\%) annotations are from long tail (workers who annotated less than 1K artworks).}
    \label{fig:workers}
\end{figure}

\noindent \textbf{Quality Control.} Annotations were rejected if they are too short, or if they are too similar to captions for other artworks.
In addition,
a manual review was conducted by multiple reviewers, ensuring captions reflect the selected emotion label and the details of the artwork.
Table~\ref{tab:stats} reports some statistics on annotations that passed this review process.

\begin{table}
\centering
\begin{tabular}{lrrrr}
  & \textbf{E} & \textbf{C} & \textbf{A} &\textbf{S} \\ \hline
\#Annotators    & 6377  & 745   & 656   & 31\\
\#Annotations   & 429k  & 426k  & 369k  & 4.8K\\
\#Work Hours    & 10k   & 13k   & 9.0k  & 178\\ \hline
\end{tabular}
\caption{\label{tab:stats} Size of the annotation effort by language.
}
\end{table}
\section{Dataset Analysis}
\label{sec:analysis}

\subsection{Qualitative}

There are some interesting similarities and differences between language and culture, as discussed in Figure~\ref{fig:teaser}.
There is a considerable inter-annotator agreement (IAA) in the dataset, and there are
also some interesting disagreements.   There is agreement in Figure~\ref{fig:familya} that a mother's love is universally warm and pleasant. It is an instinct for mothers to be loving, caring and protective of their children.\footnote{\label{footnote:family_caption}
    English caption for Figure~\ref{fig:familya} highlights the cat, whereas
    the Arabic and Chinese focus on the family and do not mention the cat:
    \begin{RLtext} \<أم تجلس مع طفلة صغيرة تنظر إلى طفل يمسك بيدها وتتحدث وتتبادل الحب والمودة.>\end{RLtext}
    \begin{CJK*}{UTF8}{gbsn}女人看着自己的孩子,让人觉得很开心。\end{CJK*}}
On the other hand, there is a difference in  Figure~\ref{fig:teaser}a.
All three annotators agree to observe a waterfall though
some mention energy and growth, while others saw horses and wedding veils.

\label{sec:analysis-qualitative}

\subsection{Quantitative}
\label{sec:analysis-quantitative}

Table~\ref{tab:genre} reports multicultural agreement over the 9 emotions\footnote{The 9 emotion classes are: Amusement, Awe,
Contentment, Excitement, Anger, Disgust, Fear, Sadness, and Other} in each genre.

WikiArt classifies artworks into 10 genres,\footnote{The 10 genres are: portrait,
landscape,
genre painting (misc),
religious painting,
abstract painting,
cityscape,
sketch and study,
still life,
nude painting and
illustration.
} as well as 27 styles\footnote{The art styles are:
Abstract Expressionism,
Action painting,
Analytical Cubism,
Art Nouveau Modern,
Baroque,
Color Field Painting,
Contemporary Realism,
Cubism,
Early Renaissance,
Expressionism,
Fauvism,
High Renaissance,
Impressionism,
Mannerism Late Renaissance,
Minimalism,
Naive Art Primitivism,
New Realism,
Northern Renaissance,
Pointillism,
Pop Art,
Post Impressionism,
Realism,
Rococo,
Romanticism,
Symbolism,
Synthetic Cubism and
Ukiyo\_e
}.
Agreement is computed as a log likelihood agreement score, $A = log_2 (Pr(G|D)/Pr(G|U))$,
where $G$ is one of the 10 genres, and $U$ and $D$ are two sets of artworks.
Let $Pr(G|U)$ be the fraction of artworks in $U$ with genre $G$,
and $Pr(G|D)$ be the fraction of artworks in $D$ with genre $G$.

\begin{figure}[t]
    \centering
    \includegraphics[scale=0.15]{artwork/big_fig_2.pdf}
    \caption{8 artworks with genre. Green indicates high agreement in Table~\ref{tab:genre};  red indicates high disagreement.}
    \label{fig:genres}

\end{figure}

Let $U$ be the universal set
of artworks.  That is, $U$ contains all artworks in ArtELingo{} with 5 annotations in each of the 3 languages.
$D$ is a disagreement
set of 2000 artworks.  $D$ was selected by computing Cohen Kappa scores \cite{kappa}\footnote{\url{https://scikit-learn.org/stable/modules/generated/sklearn.metrics.cohen_kappa_score.html}}
for artworks in $U$.  Let $D$ be the 2000 artworks with the most disagreement (based on Kappa).

\begin{table}[t]
\centering
\scalebox{0.9}{
\begin{tabular}{ r | c c | c}
Genre ($G$)& $Pr(G|U)$ &  $Pr(G|D)$ &  $A$ \\ \hline
landscape & 0.206 & 0.097 & -1.08\\
cityscape & 0.071 & 0.036 & -0.98\\
still life & 0.043 & 0.042 & -0.03\\
illustration & 0.029 & 0.029 & -0.01\\
misc & 0.167 & 0.177 & 0.08\\
portrait & 0.217 & 0.233 & 0.10\\
nude & 0.030 & 0.032 & 0.11\\
religious & 0.101 & 0.133 & 0.40\\
abstract & 0.076 & 0.112 & 0.55\\
sketch & 0.061 & 0.109 & 0.85\\
\hline
\end{tabular}
}
\caption{\label{tab:genre} Genre sorted by agreement ($A$).
Most agreement: landscapes; Most disagreement: sketches.
}
\end{table}

\begin{figure}[t]
    \centering
    \includegraphics[width=0.38\textwidth]{figures/cohen_kappa.png}
    \caption{Cohen's Kappa for inter-annotator and cross-annotator agreement. Higher value means more agreement.}
    \label{fig:cohens}
    \vspace{-0.2cm}
\end{figure}

Table~\ref{tab:genre} shows that there is more agreement for some genres (landscapes), and more disagreement
for other genres (sketches).  When the agreement score is near 0, then
the genre is about equally likely in $U$ and $D$.  This is to be expected for genres near the middle of the list such as misc.  Figure~\ref{fig:genres} shows 8 artworks in genres with high agreement and high disagreement. Figure \ref{fig:cohens} reports the Cohen's Kappa score of annotations from language pairs. Annotators belonging to the same language have higher agreement.

We created $D$ for zero-shot experiments to be reported in
\S\ref{sec:emo-cls}.
The 4.8k Spanish annotations in Table~\ref{tab:stats} are
on the set of $D$ artworks with low IAA (inter-annotator agreement) in ACE (Arabic, Chinese and English).

\section{Emotion Label Prediction}
\label{sec:emo-cls}

Baseline models for two tasks, emotion label prediction and caption generation, will be discussed
in this section and the following section.  These discussions assume
familiarity with deep nets including fine-tuning BERT \cite{devlin2018bert} and
cross language models XLM \cite{conneau2019unsupervised}, as well as HuggingFace \cite{wolf2019huggingface}.

\begin{figure*}[t]
    \centering
    \includegraphics[width=\linewidth]{figures/final_monster2.png}
    \caption{\textbf{Confusion Matrices} The heatmaps show confusion matrices comparing predictions    from the 3-Headed Transformer with ground truth.
    }
    \label{fig:monster_map}
\end{figure*}

\noindent \textbf{Emotion Classification.} Given an input caption, $c$,
we wish to predict an output emotion label, $\hat{e}$, where $\hat{e}$ is one of the 9 emotions.  The model
starts with a pretrained language model, $LM$, and a tokenizer.
The tokenizer converts $c$ into a sequence of $L$ tokens $x$.
The language model converts $x$ into more useful representation, $LM(x) \in R^{L \times d}$, where
$d$ is the number of hidden dimensions (a property of the LM). Finally, we feed $LM(x)$ into a linear layer to predict the  emotion label, $\hat{e}$.

\noindent \textbf{Majority Baseline.} We use the majority emotion label for each artwork as the predicted emotion for all captions belonging to that artwork. Concretely, each artwork, $I$, has a set of caption-emotion pairs, $S$. The majority classifier outputs the most frequent emotion, $\hat{e}$, in the set $S$ for all of the captions in the set, $c \in S$,

\noindent \textbf{Language Models.} We finetune 3 models based on BERT (BERT-E, BERT-A and BERT-C),
where BERT-E is tuned for English, and BERT-A is tuned for Arabic and BERT-C is tuned for Chinese. Section \ref{sec:bert} discusses more pretraining and finetuning details.
We also finetune 4 models based on cross language models, XLM-roBERTa \cite{conneau2019unsupervised}, where
XLM-E, XLM-A and XLM-C correspond to English, Arabic, and Chinese  languages, as before.  In addition, we create XLM-ACE by training
on the combination of all 3 languages.

\begin{table}[t]
    \centering
    \scalebox{0.85}{
        \begin{tabular}{l|llll|l}
                        & \multicolumn{5}{c}{Test Set}  \\ \hline
        \small{Backbone}    &   E &   A  &   C &   ACE     &   S \tiny{(0-Shot)}    \\ \hline
        \small{Majority}    &   0.474   &       0.491   &   0.604       &   0.525       &   -       \\ \hline
        \small{BERT-E}     &   0.644   &       -   &   -       &   -       &   -       \\
        \small{BERT-A}     &   -       &   0.558   &   -       &   -       &   -       \\
        \small{BERT-C}     &   -       &       -   &   0.922   &   -       &   -       \\ \hline
        \small{XLM-E}      &   0.662   &   0.345   &   0.781   &   0.606   &   0.513   \\
        \small{XLM-A}      &   0.446   &   0.556   &   0.695   &   0.569   &   0.437   \\
        \small{XLM-C}      &   0.482   &   0.349   &   0.926   &   0.599   &   0.415   \\
        \small{XLM-ACE}     &   \textbf{0.663}   &   \textbf{0.558}   &   \textbf{0.927}   &   \textbf{0.724}   &   0.519   \\
        \hline
        \small{3-Headed-E}    &   0.660   &   0.478   &   0.914   &   0.694   & \textbf{0.529} \\
        \small{3-Headed-A}    &   0.597   &   0.542   &   0.854   &   0.672   & 0.501 \\
        \small{3-Headed-C}    &   0.630   &   0.474   &   0.924   &   0.687   & 0.495 \\
        \small{3-Headed-M}    &   0.653   &   0.498   &   0.917   &   0.700   & 0.525 \\
        \end{tabular}
        }

    \caption{\textbf{Emotion Label Classification Baselines.}
Majority baseline output the most frequent emotion for each artwork.
Models are fine-tuned on BERT and XLM backbones.  Accuracy is best for XLM-ACE.  ``ACE'' combines Arabic (A),  Chinese (C), and English (E). ``M'' stands for mode where the majority vote between the 3 heads is used. For Spanish we evaluate the models without any finetuning (Zero-Shot prediction).}
    \label{tab:emo_cls}
\end{table}

\noindent \textbf{3-Headed Transformer.} Finally, we create a model with XLM-R backbone but replace the single classifier head with 3 classifier heads, one for each of the 3 languages.
While training, we feed the captions from each language to the shared backbone and then use the corresponding head to predict an emotion that would ultimately reflect the culture of that language. \citet{geva2021s} analyzed similar multi-headed transformers and showed how the non-target heads can be used to interpret the results of the target head. Similarly, our 3-headed transformer can be used to predict 3 different emotions each one reflecting the culture norms represented in each language. We can then use these predictions to better understand the similarities and differences between cultures.

\noindent \textbf{Experimental Setup.} We use the base versions of both the BERT and XLM-R models with their default tokenizers from  HuggingFace. We use the standard finetuning procedure where we use the ADAM optimizer to finetune the model for 5 epochs on batches of size 32 with learning rate of $2 \times 10^{-5}$. We use cross entropy as the loss function for updating the full model parameters, including the transformer backbone. We follow the standard ArtEmis \cite{achlioptas2021artemis} splits introduced in \cite{youssef2022artemis2} and adopt them for both Arabic and Chinese datasets.  The same training and testing images are used in all cases. For BERT models, we only evaluate on the same language as the training set because BERT tokenizers are language specific.

\noindent \textbf{Baseline Results.} Table~\ref{tab:emo_cls} reports accuracy for several BERT/XLM models.
There are 4 test sets,  one for each language, plus ACE (a combination of 3 languages).
XLM models perform better than BERT,
because there is no data like more data, as well as the cross language setup used during pretraining.
Interestingly, scores on the Chinese test set are higher than for English and Arabic, suggesting that Chinese captions are easier to classify.
Finally, notice that XLM-ACE (XLM trained on 3 languages) outperforms other conditions,
showcasing benefits of multiple languages.
Note that XLM-ACE even outperforms matching conditions, where training language = test language.

\noindent \textbf{3-Headed Transformer Analysis.} Although the 3-Headed transformer did not improve accuracy, the 3 classification heads are useful for error analysis.  We feed the entire ArtELingo{} dataset to the model and predict 3 $\hat{e}$ values, one for each head/language.  Confusion matrices are reported in Figure~\ref{fig:monster_map}. There is more agreement on negative emotions,
and less agreement on  positive emotions.

We are interested in large off-diagonal values in Figure~\ref{fig:monster_map},
especially between positive and negative emotions.
For example, Arabic \textbf{disgust} is often confused with English \textbf{amusement}.

Upon further investigation, we found nude paintings contributed ${\sim}15\%$ of these confusions.
Explicit content and alcohol are frowned upon in some Arabic speaking communities, as
illustrated by the second and third rows of Table~\ref{tab:emo_cls_samples}, where the label is positive in English and Chinese,
but not in Arabic.

Religious symbols are also associated with large off-diagonal values in confusion matrices.
The first row in Table~\ref{tab:emo_cls_samples} mentions Jesus and how a beautiful girl holds his cross and stomps on the devil.
The annotation is positive (\textbf{awe}) in English and Arabic, but negative (\textbf{fear}) in Chinese.
In China, the cross holds less meaning, and stomping on the devil is more scary than reassuring.
Many symbols are associated with religion, holidays and legends that mean more in some places
than others.\footnote{Dragons are positive in East, but negative in West.}

While there are a few off-diagonal cells with large values, most of the large values in the confusion matrices
are on the main diagonal.  That is, the similarities across languages tend to dominate the differences.
Consider the last row in Table~\ref{tab:emo_cls_samples}, which
receives a positive label (\textbf{contentment}) in all 3 languages.  Babies make people feel happy (nearly) everywhere.
In this case, all 3 heads of our 3-headed transformer predict positive labels for this caption.
For training models across multiple languages, similarities across languages may be more
useful than differences.

\begin{table}[!t]
    \centering
    \scalebox{0.8}{
        \begin{tabular}{p{0.65\linewidth}|ccc}

                        &   \multicolumn{3}{c}{Transformer Head} \\

            Input Caption (Gloss)     &   E      &   A      &   C  \\
            \hline
            [A] A beautiful girl holding a Jesus cross stomping on the devil   &   Awe &   Awe &   Fear \\
            \hline
            [E] The woman on the ground isn't wearing any clothes   &   Amu. &   Dis. &   Amu. \\
            \hline
            [E] The man looks like he's drunk since his expression is so wired out   &   Amu. &   Sad  &   Exc. \\
            \hline
            [C] Countless babies have descended into the world, giving life to the world and making people feel happy.   &   Cont. &   Cont. &   Cont.
        \end{tabular}
    }
    \caption{  \label{tab:emo_cls_samples} \textbf{Predictions from 3-Headed Transformer}: The input is a caption in Arabic (A), Chinese (C) or English (E).  The first column shows the language and a gloss.  The last three columns
    show predictions for each head (with interesting differences across heads).}

\end{table}

\paragraph{Zero-Shot Evaluation.} We use Spanish annotations in ArtELingo{} to evaluate
models mentioned above in a zero-shot setting.  The last column in Table~\ref{tab:emo_cls} reveals two interesting relations:
\begin{enumerate}
 \setlength{\itemsep}{0pt}
    \setlength{\parskip}{0pt}
    \setlength{\parsep}{0pt}
    \item 3-Headed-E $>$ XLM-ACE
    \item 3-Headed-E $>$ 3-Headed-A $>$ 3-Headed-C
\end{enumerate}
The first relation suggests that 3-Heads may not perform as well as XLM when there is plenty of data,
but 3-Heads may have advantages in low-resource and zero-shot settings.  3-Heads
are better for capturing interactions between languages.

The second relation
suggests that language transfer may be more effective across some language pairs than others.
Historically, Spanish and English are both relatively close Indo-European languages,\footnote{\url{http://www.sssscomic.com/comicpages/196.jpg}}
compared to Semitic languages such as Arabic.
There has been much less contact \cite{thomason2001language}
between those languages and Chinese.

\section{Affective Caption Generation}
\label{sec:neural-speakers}

The previous section described baseline models for the first task: label prediction.
This section will describe baseline models for the second task: affective caption generation.

To this end, we follow \citet{achlioptas2021artemis} and train two affective captioning models: Show, Attend, and Tell (SAT)~\cite{xu2015show} and Meshed Memory Transformer ($M^2$)~\cite{cornia2020meshed}. We use \emph{Affective Captioning Models} to refer to captioning models that generate affective captions.  These captions connect the dots between input paintings and emotions.

SAT is a LSTM \cite{hochreiter1997long} based captioning model with an attention module, it consists of a visual encoder and a text decoder. The visual encoder extracts visual features from an input image. The decoder then uses a stack of an attention module and LSTM recurrent unit to generate a caption autoregressively.
$M^2$ is a transformer based model \cite{vaswani2017attention} which utilizes a pretrained Faster-RCNN \cite{ren2015faster} object detector to extract visual region features. These features are used as an input sequence to a multi-layer attention based encoder. $M^2$ differs from basic transformers by feeding the encoded features from all encoder layers to the cross attention module in each decoder's layer. In order to include Emotion and Language grounding, we use a simple embedding layer to convert the emotion and language labels into feature vectors and then concatenate them to the visual features.

\paragraph{Experimental Setup.} For both models, we use the default parameters proposed in \cite{achlioptas2021artemis}. We train four different versions of each model, three versions are trained on English, Arabic, and Chinese only datasets, while the fourth version is trained on the three languages combined. We then test all the models on all the languages. In order to allow the models to work on an arbitrary languages during testing, we create our custom tokenizer which is based on xlm-roberta-base tokenizer from HuggingFace.  The available tokenizer has a vocabulary of size 200K tokens which makes the training inefficient. To mitigate this, we use the same \emph{xlm-roberta-base}\footnote{https://huggingface.co/xlm-roberta-base} tokenizer training strategy to create a tokenizer with 60K vocabulary size on ArtELingo{}

\begin{table}[t]
    \centering
    \scalebox{0.71}{
        \begin{tabular}{ll|llll|llll}
            \multicolumn{2}{c}{} & \multicolumn{4}{|c|}{SAT} & \multicolumn{4}{c}{$M^2$} \\
            \multicolumn{2}{c|}{Test Set} & E & A & C & ACE & E & A & C & ACE \\ \hline
            \multirow{4}{*}{E} &$B_4$ & 6.2 & 0 & 0 & 6.9  & \textbf{8.7} & 0 & 0 & 8.1     \\
                                & $M$ & 13.9 & 0 & 0 & \textbf{14.2}  & 12.9 & 0 & 0 & 12.4     \\
                                & $R$ & 26.5 & 0 & 0 & 26.5  & \textbf{28.0} & 0 & 0 & 27.4     \\
                                & $C$ & 6.4 & 0 & 0 & 6.3  & 9.2 & 0 & 0 & \textbf{9.4}     \\  \hline
            \multirow{4}{*}{A} &$B_4$ & 0 & 3.1 & 0 & 3.2  & 0 & 3.5 & 0 & \textbf{3.7}     \\
                                & $M$ & 0 & 30.2 & 0 & 30  & 0 & \textbf{30.9} & 0 & 30.7     \\
                                & $R$ & 0 & 15.4 & 0 & 15.4  & 0 & 15.1 & 0 & \textbf{15.5}     \\
                                & $C$ & 0 & 7.7 & 0 & 7.7  & 0 & 7.8 & 0 & \textbf{8.0}     \\  \hline
            \multirow{4}{*}{C} &$B_4$ & 0 & 0 & \textbf{11.9}  & 10.9  & 0 & 0 & 8.3 & 8.7     \\
                                & $M$ & 0 & 0 & \textbf{16.1}  & 15.8  & 0 & 0 & 15.1 & 14.6     \\
                                & $R$ & 0 & 0 & \textbf{34.3}  & 33.6  & 0 & 0 & 31.1 & 31.1     \\
                                & $C$ & 0 & 0 & \textbf{9.5}  & 8.5  & 0 & 0 & 8.9 & 7.8     \\  \hline

\multirow{4}{*}{\rotatebox[origin=c]{90}{ACE}}&$B_4$ & 6.0 & 0  & 11.3  & 9.6 & 8.9 & 3.9 & 8.3 & \textbf{27.4}     \\
                                & $M$ & 13.5 & 0.42  & 15.2  & 10.5  & 11.8 & \textbf{30.8} & 14.8 & 21.2     \\
                                & $R$ & 28.9 & \textbf{94.8}  & 33.3  & 51.8  & 27.6 & 45.1 & 30.5 & 32.1     \\
                                & $C$ & 2.4 & 0.06  & 3.0  & 2.0  & 3.1 & \textbf{14.6} & 3.1 & 5.6     \\  \hline
        \end{tabular}
    }

    \caption{\textbf{Affective Captioning Baseline.} SAT and $M^2$ are trained on English (E), Arabic (A), Chinese (C), and all languages (ACE). The trained models are evaluated on a test set from each language as well as a combined test set. For metrics, we use BLEU-4 ($B_4$), METEOR (M), ROUGE (R), and CIDEr ($C$). Each row corresponds to a test set in a particular language. Meanwhile, columns correspond to model trained on a given language.}
    \label{tab:caption_baseline}
    \vspace{2mm}
\end{table}

\paragraph{Results.} We report the results of our baseline models in Table~\ref{tab:caption_baseline}. Models trained using all the languages perform very similarly to their language specific counterparts on every metric except for the Chinese language. This provides additional evidence that English and Arabic speaking cultures are more closely related to one another than either is to Chinese ones. In other words, English captioning models do not lose much performance when Arabic data is added to the training set and vice versa. On the other hand, Chinese models suffer when such data is added. Moreover, we also observe that for models trained on single languages, the scores on the combined test set is proportional to the language specific test sets.
\section{Conclusion}
\label{sec:conclusion}

This paper introduced ArtELingo{},
a multilingual dataset and benchmark on WikiArt images with more than 1.2M captions and emotion labels. The benchmark has diverse emotional experiences constructed over different cultures, and  communicated in four languages (English, Chinese, Arabic, and Spanish).  We found more agreement for some genres
such as landscapes and more disagreement for other genres such as sketches.
These differences are interesting and important, and far from random.
Annotations for trees in Figure~\ref{fig:teaser}c are labeled as sadness in English and Chinese
but contentment in Arabic.  People are likely to feel more comfortable
with what they know.  People raised in countries with lush forests are likely to prefer
that, whereas people brought up in less humid environments are likely to prefer that.

Towards building more socially and multi-culturally aware AI,  we created baseline models for two tasks on ArtELingo{}: (1) emotion label prediction and (2) affective caption generation. For emotion label prediction, our best baseline model trained XLM on a combination of training data from all three languages (XLM-ACE).  We also created 3-headed transformers,  training three heads for three languages (Arabic, Chinese, and English) at the same time.
The performance of this model is close to XML-ACE, but generalizes better in a zero-shot
experiment on Spanish. For the caption generation task, we trained two models on ArtELingo{}, SAT and $M^2$.  For English and Arabic,
models on all three languages have a similar performance to language specific models, but for Chinese, it is best to train
without the other languages since the performance drop is significant.

We hope our benchmark and baselines will help ease future research in visually-grounded language models that can communicate affectively with us. In addition, ArtELingo{} can provide empirical examples of cross-cultural similarities and differences. Sociologists and Cultural Psychologists may formulate hypotheses and conduct field studies based on ArtELingo{}.
Data, code, and models are publicly available at \url{www.artelingo.org/}.

\section{Limitations}
\label{sec:limitations}
ArtELingo{}'s artworks are extracted from WikiArt. Although ArtELingo{} is diverse in language and culture, it inherits WikiArt's bias toward western artworks as discussed in Table~\ref{tab:wikiArt_diversity} in \S\ref{sec:representation}.  There is room to improve
the representation of certain regions of the world.
Due to globalisation, people tend to follow similar trends around the world, causing others to follow their lead (for better and for worse).

Many cultures, such as Arabic, do not have a rich heritage of oil paintings. Instead, they have other forms of Art like poetry and calligraphy. Such art forms are interesting to study on their own, but mixing them with paintings is not obvious. Based on the original ArtEmis dataset, we chose WikiArt with the intent to be a continuation of their work. Also, artworks are more accessible and can be interpreted easier by different cultures compared to poetry and other art forms.

The addition of affective captions for Arabic,  Chinese, as well as a small set of Spanish is a step
toward cultural diversity. However, more than four regions and  languages are indeed needed to cover the world. Scalability can be a challenge. However, we hope that progress can be accelerating by developing affective vision and language models that can learn with limited data for each additional language by distilling knowledge from language-only models as in \cite{chen2022visualgpt,alayrac2022flamingo}.

ArtELingo{} was also collected through AMT's online platform\footnote{Chinese data collection was done on AMT as a tool with help from Baidu who helped recruit the human participants from China}. This suggests that the workers are familiar with technology and social media, imposing an influence on the data.
Social media influences many concepts such as: trending news, and standards, which may lead to the presence of similarities between cultures. There have been, of course, other concerns about the use of AMT and the so-called ``gig'' economy and workers' rights.