summaries: The paper proposes a Structural-Jump-LSTM model to speed up machine reading, which is an extension of the previous speed reading models, such as LSTM-Jump, Skim-LSTM and LSTM-Shuffle. The major difference, as claimed by the authors, is that the proposed model has two agents instead of one. One agent decides whether the next input should be fed into the LSTM (skip) and the other determines whether the model should jump to the next punctuation (jump). The sentence-wise jumping makes the jumping more structural than models like LSTM-Jump, while the word-wise skipping operation has a finer skimming decision. The reinforcement learning algorithm in this paper is also different from LSTM-Jump, where LSTM-Jump uses REINFORCE, while this paper applies actor-critic approach.

summaries: The paper presents a novel model for neural speed reading. In this new model, the authors combined several existing ideas in a nice way, namely, the new reader has the ability to skip a word or to jump a sequence of words at once. The reward of the reader is mixed of the final prediction correctness and the amount of text been skipped. The problem is formulated as a reinforcement learning problem. The results compared with the existing techniques on several benchmark datasets show consistently good improvements.

abstractText: Recurrent neural networks (RNNs) can model natural language by sequentially ”reading” input tokens and outputting a distributed representation of each token. Due to the sequential nature of RNNs, inference time is linearly dependent on the input length, and all inputs are read regardless of their importance. Efforts to speed up this inference, known as ”neural speed reading”, either ignore or skim over part of the input. We present Structural-Jump-LSTM: the first neural speed reading model to both skip and jump text during inference. The model consists of a standard LSTM and two agents: one capable of skipping single words when reading, and one capable of exploiting punctuation structure (sub-sentence separators (,:), sentence end symbols (.!?), or end of text markers) to jump ahead after reading a word. A comprehensive experimental evaluation of our model against all five state-of-the-art neural reading models shows that Structural-Jump-LSTM achieves the best overall floating point operations (FLOP) reduction (hence is faster), while keeping the same accuracy or even improving it compared to a vanilla LSTM that reads the whole text.

authors:
Dzmitry Bahdanau
Kyunghyun Cho
Yoshua Bengio

title: Neural machine translation by jointly learning to align and translate

authors:
Vı́ctor Campos
Brendan Jou
Xavier Giró-i Nieto
Jordi Torres
Shih-Fu Chang

title: Skip rnn: Learning to skip state updates in recurrent neural networks

authors:
Jianpeng Cheng
Li Dong
Mirella Lapata

title: Long short-term memory-networks for machine reading

authors:
Eunsol Choi
Daniel Hewlett
Jakob Uszkoreit
Illia Polosukhin
Alexandre Lacoste
Jonathan Berant

title: Coarse-to-fine question answering for long documents

venue: In Proceedings of the 55th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers),

authors:
Junyoung Chung
Caglar Gulcehre
KyungHyun Cho
Yoshua Bengio

title: Empirical evaluation of gated recurrent neural networks on sequence modeling

venue: arXiv preprint arXiv:1412.3555,

authors:
Tsu-Jui Fu
Wei-Yun Ma

title: Speed reading: Learning to read forbackward via shuttle

venue: In Conference on Empirical Methods in Natural Language Processing (EMNLP),

authors:
Felix Hill
Antoine Bordes
Sumit Chopra
Jason Weston

title: The goldilocks principle: Reading children’s books with explicit memory representations

venue: In Proceedings of the 4th International Conference on Learning Representations (ICLR 2016),

authors:
Sepp Hochreiter
Jürgen Schmidhuber

title: Long short-term memory

venue: Neural computation,

authors:
Zhengjie Huang
Zi Ye
Shuangyin Li
Rong Pan

title: Length adaptive recurrent model for text classification

venue: In Proceedings of the 2017 ACM on Conference on Information and Knowledge Management,

authors:
Alexander Johansen
Richard Socher

title: Learning when to skim and when to read

venue: In Proceedings of the 2nd Workshop on Representation Learning for NLP,

authors:
Vijay R Konda
John N Tsitsiklis

title: Actor-critic algorithms. In Advances in neural information processing

authors:
Jens Lehmann
Robert Isele
Max Jakob
Anja Jentzsch
Dimitris Kontokostas
Pablo N Mendes
Sebastian Hellmann
Mohamed Morsey
Patrick Van Kleef
Sören Auer

title: Dbpedia–a largescale, multilingual knowledge base extracted from wikipedia

venue: Semantic Web,

authors:
Christina Lioma
CJ Keith van Rijsbergen

title: Part of speech n-grams and information retrieval

venue: French Review of applied linguistics,

authors:
Andrew L Maas
Raymond E Daly
Peter T Pham
Dan Huang
Andrew Y Ng
Christopher Potts

title: Learning word vectors for sentiment analysis. In Proceedings of the 49th annual meeting of the association for computational linguistics: Human language technologies-volume

venue: Association for Computational Linguistics,

authors:
Volodymyr Mnih
Nicolas Heess
Alex Graves

title: Recurrent models of visual attention

venue: In Advances in neural information processing systems,

authors:
Volodymyr Mnih
Adria Puigdomenech Badia
Mehdi Mirza
Alex Graves
Timothy Lillicrap
Tim Harley
David Silver
Koray Kavukcuoglu

title: Asynchronous methods for deep reinforcement learning

venue: In International conference on machine learning,

authors:
Daniel Neil
Michael Pfeiffer
Shih-Chii Liu

title: Phased lstm: Accelerating recurrent network training for long or event-based sequences

venue: In Advances in Neural Information Processing Systems,

authors:
Bo Pang
Lillian Lee

title: Seeing stars: Exploiting class relationships for sentiment categorization with respect to rating scales

venue: In Proceedings of the 43rd annual meeting on association for computational linguistics,

authors:
Jeffrey Pennington
Richard Socher
Christopher Manning

title: Glove: Global vectors for word representation

venue: In Proceedings of the 2014 conference on empirical methods in natural language processing (EMNLP),

authors:
Minjoon Seo
Sewon Min
Ali Farhadi
Hannaneh Hajishirzi

title: Neural speed reading via skimrnn

authors:
Richard Socher
Alex Perelygin
Jean Wu
Jason Chuang
Christopher D Manning
Andrew Ng
Christopher Potts

title: Recursive deep models for semantic compositionality over a sentiment treebank

venue: In Proceedings of the 2013 conference on empirical methods in natural language processing,

title: Simple statistical gradient-following algorithms for connectionist reinforcement learning

venue: Machine learning,

authors:
Adams Wei Yu
Hongrae Lee
Quoc Le

title: Learning to skim text

venue: In Annual Meeting of the Association for Computational Linguistics (ACL),

authors:
Keyi Yu
Yang Liu
Alexander G. Schwing
Jian Peng

title: Fast and accurate text classification: Skimming, rereading and early stopping, 2018

authors:
Xiang Zhang
Junbo Zhao
Yann LeCun

title: Character-level convolutional networks for text classification

heading: 1 INTRODUCTION

text:
Recurrent neural networks (RNNs) are a popular model for processing sequential data. The Gated Recurrent Unit (GRU) (Chung et al., 2014) and Long Short Term Memory (LSTM) (Hochreiter & Schmidhuber, 1997) are RNN units developed for learning long term dependencies by reducing the problem of vanishing gradients during training. However, both GRU and LSTM incur fairly expensive computational costs, with e.g. LSTM requiring the computation of 4 fully connected layers for each input it reads, independently of the input’s importance for the overall task.
Based on the idea that not all inputs are equally important, and that relevant information can be spread throughout the input sequence, attention mechanisms were developed (Bahdanau et al., 2015) to help the network focus on important parts of the input. With soft attention, all inputs are read, but the attention mechanism is fully differentiable. In comparison, hard attention completely ignores part of the input sequence. Hard attention mechanisms have been considered in many areas, ranging from computer vision (Mnih et al., 2014; Campos et al., 2018) where the model learns what parts of the image it should focus on, to natural language processing (NLP), such as text classification and question answering (Yu et al., 2017; Campos et al., 2018; Yu et al., 2018), where the model learns which part of a document it can ignore. With hard attention, the RNN has fewer state updates, and therefore fewer floating point operations (FLOPs) are needed for inference. This is often denoted as speed reading: obtaining the same accuracy while using (far) fewer FLOPs (Yu et al., 2017; 2018; Seo et al., 2018; Huang et al., 2017; Fu & Ma, 2018). Prior work on speed reading processes text as chunks of either individual words or blocks of contiguous words. If the chunk being read is important enough, a full state update is performed; if not, the chunk is either ignored or a very limited amount of computations are done. This is followed by an action aiming to speed up the reading, e.g. skipping or jumping forward in text.
Inspired by human speed reading, we contribute an RNN speed reading model that ignores unimportant words in important sections, while also being able to jump past unimportant sections of the
text. Our model, called Structural-Jump-LSTM1, both skips and jumps over dynamically defined chunks of text as follows: (a) it can skip individual words, after reading them, but before updating the RNN state; (b) it uses the punctuation structure of the text to define dynamically spaced jumps to the next sub-sentence separator (,;), end of sentence symbol (.!?), or the end of the text.
An extensive experimental evaluation against all state-of-the-art speed reading models (Seo et al., 2018; Yu et al., 2017; 2018; Fu & Ma, 2018; Huang et al., 2017), shows that our Structural-JumpLSTM of dynamically spaced jumps and word level skipping leads to large FLOP reductions while maintaining the same or better reading accuracy than a vanilla LSTM that reads the full text.

heading: 2 RELATED WORK

text:
Prior work on speed reading can be broadly clustered into two groups: 1) jumping based models, and 2) word level skip and skim models, which we outline below.
Jump based models. The method of Yu et al. (2017) reads a fixed number of words, and then may decide to jump a varying number of words ahead (bounded by a maximum allowed amount) in the text, or to jump directly to the end. The model uses a fixed number of total allowed jumps, and the task for the network is therefore to learn how best to spend this jump budget. The decision is trained using reinforcement learning, with the REINFORCE algorithm (Williams, 1992), where the reward is defined based only on if the model predicts correctly or not. Thus, the reward does not reflect how much the model has read. The model of Fu & Ma (2018) also has a fixed number of total jumps and is very similar to the work by Yu et al. (2017), however it allows the model to jump both back and forth a varying number of words in order to allow for re-reading important parts. Yu et al. (2018) use a CNN-RNN network where a block of words is first read by a CNN and then read as a single input by the RNN. After each block is read, the network decides to either re-read the block, jump a varying number of blocks ahead, or jump to the end. The decision is trained using reinforcement learning, where both REINFORCE and actor-critic methods were tested, with the actor-critic method leading to more stable training. The reward is based on the loss for the prediction and the FLOPs used by the network to make the prediction. FLOP reduction is thereby directly tied into the reward signal. Huang et al. (2017) propose a simple early-stopping method that uses a RNN and reads on a word level, and where the network learns when to stop. This can be considered a single large jump to the end of the text.
Skip and skim based models. Seo et al. (2018) present a model with two RNNs, a “small” RNN and a “big” RNN. At each time step the model chooses either the big or the small RNN to update the state, based on the input and previous state, which can be considered as text skimming when the small RNN is chosen. This network uses a Gumbel softmax to handle the non-differentiable choice, instead of the more common REINFORCE algorithm. Campos et al. (2018) train a LSTM that may choose to ignore a state update, based on the input. This can be considered as completely skipping a word, and is in contrast to skimming a word as done by Seo et al. (2018). This network uses a straight-through estimator to handle the non-differentiable action choice. This approach is applied on image classification, but we include it in this overview for completeness.
Other speed reading models. Johansen & Socher (2017) introduce a speed reading model for sentiment classification where a simple model with low computational cost first determines if an LSTM model should be used, or a bag-of-words approach is sufficient. The method of Choi et al. (2017) performs question answering by first using a CNN-based sentence classifier to find candidate sentences, thereby making a summary of the whole document relevant for the given query, and then using the summary in an RNN.
More widely, gated units, such as GRU and LSTM, face problems with long input sequences (Neil et al., 2016). Speed reading is one way of handling this problem by reducing the input sequence. In contrast, Neil et al. (2016) handle the problem by only allowing updates to part of the LSTM at a current time point, where an oscillating function controls what part of the LSTM state can currently be updated. Cheng et al. (2016) handle this by using memory networks to store an array of states, and the state at a given point in time comes from applying an attention mechanism over the stored states, handling the issues of older states being written over.
1https://github.com/Varyn/Neural-Speed-Reading-with-Structural-Jump-LSTM
Overall, the above state-of-the-art models are either jump or skip/skim based. We present the first speed reading model that both jumps and skips. Furthermore, current jumping-based models use a variable jump size for each input, without considering the inherent structure of the text. In contrast, our model defines jumps based on the punctuation structure of the text. This combined approach of both skipping and jumping according to text structure yields notable gains in efficiency (reduced FLOPs) without loss of effectiveness (accuracy). We next present our model.

heading: 3 STRUCTURAL-JUMP-LSTM MODEL

text:
Our Structural-Jump-LSTM model consists of an ordinary RNN with LSTM units and two agents: the skip agent and the jump agent. Each of these agents compute a corresponding action distribution, where the skip and jump actions are sampled from. The skip agent chooses to either skip a single word, thereby not updating the LSTM, or let the LSTM read the word leading to an update of the LSTM. The jump agent is responsible for jumping forward in the text based on punctuation structure (henceforth referred to as structural jumps). A structural jump is a jump to the next word, or the next sub-sentence separator symbol (,;), or the next end of sentence symbol (.!?), or to the end of the text (which is also an instance of end of sentence). The purpose of using two agents is that the skip agent can ignore unimportant words with very little computational overhead, while the jump agent can jump past an unimportant part of the text. As both the skip and jump agent contribute to a reduction in FLOPs (by avoiding LSTM state updates), the Structural-Jump-LSTM is faster at inference than a vanilla LSTM.
Figure 1 shows an overview of our model: The input in each time step is the previous actions of the skip agent (S), of the jump agent (J), and of the current input. The output from the previous LSTM is used in combination with the input to make a skip decision – if the word is skipped, the last LSTM state will not be changed. From this we use a standard LSTM cell where the output is fed to the jump agent, and a jump decision is made. Both agents make their choice using a fully connected layer, with a size that is significantly smaller than the LSTM cell size, to reduce the number of FLOPs by making the overhead of the agents as small as possible.
Section 3.1 details how inference is done in this model, and Section 3.2 presents how the network is trained.

heading: 3.1 INFERENCE

text:
At a given time step t, Structural-Jump-LSTM reads input xi ∈ Rd , and the LSTM has a previous output ot−1 ∈ Rm and state st−1 ∈ Rm. At time step t − 1 the skip agent first takes action askipt−1 sampled from the skip-action distribution pskipt−1 and the jump agent takes action a jump t−1 sampled from the jump-action distribution pjumpt−1 . If a skip t−1 is to skip the word, then the jump agent takes no action, i.e. no jump is made. At time step t the network first needs to sample askipt from p skip t , which is computed in each time step as:
pskipt = softmax(dLIN(state skip t )) (1)
stateskipt = dReLU(xt ot−1 onehot(a skip t−1) onehot(a jump t−1 )) (2)
where dactivation is a fully connected layer with the given activation, ReLU is the Rectified Linear Unit, LIN is the linear activation, and denotes concatenation of vectors. At inference time the action can either be sampled from the distribution, or chosen greedily, by always choosing the most probable action.
If the action askipt = 0, we skip the word and set ot = ot−1 and st = st−1, and the network will move to the next word at position i + 1. If askipt = 1, the word is read via the LSTM. The output and new state of the RNN is calculated and produces ot and st for the next step. The probability distribution pjumpt from which action a jump t is sampled from is computed as:
pjumpt = softmax(dLIN(state jump t )) (3) statejumpt = dReLU(ot) (4)
If the sampled action ajumpt corresponds to e.g. a jump to the next sentence, then the current LSTM output and state will be kept, and all following inputs will be ignored until a new sentence begins. When there are no more inputs the output of the RNN is used to make a final prediction. If the action is to jump to the end of the text, then the final prediction will be made immediately based on the current output.

heading: 3.2 TRAINING

text:
During training, Structural-Jump-LSTM is optimized with regards to two different objectives: 1) Producing an output that can be used for classification, and 2) learning when to skip and jump based on the inputs and their context, such that the minimum number of read inputs gives the maximum accuracy.
For objective 1, the output of the RNN can be used for classification, and the loss is computed as the cross entropy Lclass against the target.
For objective 2, the agents are non-differentiable due to the discrete sampling of the actions. Thus we choose to reformulate the problem as a reinforcement learning problem, where we define a reward function to maximize. In essence, the reward is given based on the amount read and whether or not the prediction is correct. We denote R as the total reward associated with a sampled sequence of actions, e.g. askip1 , a skip 2 a jump 2 , ..., a skip T , a jump T , and Rt as the sum of reward from time t. Note that if the network chooses to skip a word, the sequence will not have a jump at that time step. We use an advantage actor-critic approach (Konda & Tsitsiklis, 2000) to train the agents in order to reduce the variance. The loss for the skip agent is given as:
Lactor = − T∑
t=0
log(pskipt (a skip t |state skip t )) · (Rt − V skip t ) (5)
V skipt = dLIN(state skip t ) (6)
where V skipt is a value estimate of the given state, which is produced by a fully connected layer with output size 1. For the jump agent we do exactly the same as the skip agent, and the sum of the two actor losses is denoted Lactors. The value estimate of a state corresponds to how much reward is
collected when acting from this state, such that the estimated value is a smoothed function of how much reward the network expects to collect later. Using advantage instead of reward is beneficial as the sign of the loss then depends on whether the achieved reward is higher or lower than the expected reward in a given state. This loss for the agent corresponds to the loss in the popular A3C algorithm (Mnih et al., 2016) in the case of tmax being large enough to always reach a terminal condition. This is not a problem in our setting as documents are of finite length. The value estimate is trained together with both agents using the squared difference with the targets being the observed values for each state, (we denote this Lcritics). Lastly, to provoke exploration in the network we add an entropy loss, where both agents’ distributions are targeting a uniform distribution over the actions, (we denote this loss Lentropies). The total loss for the network is then:
Ltotal = αLclass + βLactors + γLcritics + δLentropies (7)
where α, β, γ, and δ control the trade-offs between the components.
For each action a reward is given; the reward for a skip action at time t is:
rskipt =
{ − 1|doc| if a skip t is a read action
− cskip|doc| if a skip t is a skip action
(8)
where |doc| is the number of words in the document such that the reward for skipping a word scales with the document length. The reward is negative for both cases as there is a cost associated with reading a word. The jump action gives no reward, as the reward is implicit by the network collecting less negative reward. At the end an additional reward is given based on whether the network makes a correct prediction, such that the summed reward from time t is given by:
Rt =
{ 1 + wrolling ∑T t′=t r skip t′ if ypred = ytarget
p(ytarget) + wrolling ∑T t′=t r skip t′ if ypred 6= ytrue
(9)
ypred is the prediction by the network, ytrue is the target, and p(ytarget) is the probability the network gives for the target class. wrolling controls the trade-off between the rolling reward and the reward based on model performance. The final reward is designed such that a large reward is given in the case of a correct prediction, while the agents are still rewarded for increasing the probability for the correct class, even if they did not predict correctly.

heading: 4 EXPERIMENTAL EVALUATION

text: We present the experimental evaluation of our method.

heading: 4.1 EXPERIMENTAL SETUP AND TRAINING

text:
We use the same tasks and datasets used by the state-of-the-art in speed reading (displayed in Table 1), and evaluate against all 5 state-of-the-art models (Seo et al., 2018; Yu et al., 2017; 2018; Fu & Ma, 2018; Huang et al., 2017) in addition to a vanilla LSTM full reading baseline.
For the sentiment and topic classification datasets we apply a fully connected layer on the LSTM output followed by a traditional softmax prediction, where the fully connected layer has the same size as the cell size. On the Question Answering datasets we follow Yu et al. (2017) by choosing the candidate answer with the index that maximizes softmax(CWo) ∈ R10, where C ∈ R10×d is the word embedding matrix of the candidate answers, d is the embedding size, W ∈ Rd×cell size is a
trained weight matrix, and o is the output state of the LSTM. This transforms the answering task into a classification problem with 10 classes. In addition, we read the query followed by the document, to condition reading of the document by the query as done by Yu et al. (2017). On all datasets we initialize the word embedding with GloVe embeddings (Pennington et al., 2014), and use those as the input to the skip agent and LSTM.
We use the predefined train, validation, and testing splits for IMDB, SST, CBT-CN, and CBT-NE, and use 15% of the training data in the rest as validation. For Rotten Tomatoes there is no predefined split, so we set aside 10% for testing as done by Yu et al. (2017). For training the model we use RMSprop with a learning rate chosen from the set {0.001, 0.0005}, with optimal of 0.001 on question answering datasets (CBT-CN and CBT-NE) and 0.0005 on the topic and sentiment datasets. We use a batch size of 32 on AG news, Rotten Tomatoes, and SST and a batch size of 100 for the remaining. Similarly to Yu et al. (2017), we employ dropout to reduce overfitting, with 0.1 on the embedding and 0.1 on the output of the LSTM. For RNN we use an LSTM cell with a size of 128, and apply gradient clipping with a tresholded value of 0.1. For both agents, their small fully connected layer is fixed to 25 neurons.
On all datasets we train by first maximizing the full read accuracy on the validation set, and the agents are then activated afterwards. While training we include the entropy loss in the total loss to predispose the speed reading to start with a full read behaviour, where the action distributions are initialized to only reading and never skipping or jumping. While maximizing full read accuracy the word embedding is fixed for the Question Answering datasets and trainable on the rest, while being fixed for all datasets during speed read training. As described in Equation 9, wrolling controls the trade-off between correct prediction and speed reading, and was chosen via cross validation from the set {0.05, 0.1, 0.15}, where most datasets performed best with 0.1. For simplicity we fix the cost of skipping cskip in Equation 8 to 0.5, such that skipping a word costs half of reading a word, which was done to promote jumping behaviour.
For the speed reading phase the total loss, as seen in Equation 7, is a combination of the prediction loss, actor loss, critic loss, and entropy loss, where the actor loss is scaled by a factor of 10 to make it comparable in size to the other losses. The entropy loss controls the amount of exploration and is chosen via cross validation from the set {0.01, 0.05, 0.1, 0.15}, where most datasets performed best with 0.1. We also cross validate choosing the actions greedily or via sampling from the action distributions, where for QA sampling was optimal and greedy was optimal for the others. Lastly, all non-QA datasets use uniform action target distributions for increased exploration, however CBT-CB and CBT-CN are trained with distribution with 95% probability mass on the ”read” choice of both agents to lower skipping and jumping exploration, which was necessary to stabilize the training.

heading: 4.2 EVALUATION METRICS

text:
The objective of speed reading consists of two opposing forces, as the accuracy of the model should be maximized while reading as few words as possible. We consider two different ways the model can skip a word: i) One or more words can be jumped over, e.g. as done in our model, LSTM-Jump (Yu et al., 2017), Yu-LSTM (Yu et al., 2018) and Adaptive-LSTM (Huang et al., 2017), where the latter implements a jump as early stopping. ii) A word can be skipped or skimmed, where the model is aware of the word (in contrast to jumping), but chooses to do a very limited amount of computations based on it, e.g. as done as skipping in our model or as skimming in Skim-LSTM (Seo et al., 2018). In order to capture both of these speed reading aspects, we report the percentage of words jumped over, and the total reading percentage (when excluding skipped and jumped words).
We calculate the total FLOPs used by the models as done by Seo et al. (2018) and Yu et al. (2018), reported as a FLOP reduction (FLOP-r) between the full read and speed read model. This is done to avoid runtime dependencies on optimized implementations, hardware setups, and whether the model is evaluated on CPU or GPU.

heading: 4.3 RESULTS

text: We now present the results of our evaluation.

heading: 4.3.1 STRUCTURAL-JUMP-LSTM VERSUS FULL READING

text:
Table 2 displays the accuracy, the percentage of text being jumped over, and the total reading percentage (when excluding jumped and skipped words), of our approach versus a full reading baseline. Our approach obtains similar accuracies compared to vanilla LSTM, while in some cases reducing the reading percentage to below 20% (IMDB and DBPedia), and with the worst speed reading resulting in a reading percentage of 68.6% (Yelp). The speed reading behaviour varies across the datasets with no skipping on CBT-CN, CBT-NE, and Yelp, no jumping on Rotten Tomatoes, and a mix of skipping and jumping on the remaining datasets.
In 7 out of 8 datasets Structural-Jump-LSTM improves accuracy and in 1 the accuracy is the same (IMDB). At all times, our model reads significantly less text than the full reading baseline, namely 17.5% - 68.8% of the text. Overall this indicates that the jumps/skips of our model are meaningful (if important text was skipped or jumped over, accuracy would drop significantly). An example of this speed reading behaviour (from DBPedia) can be seen in Figure 2. Generally, the model learns to skip some uninformative words, read those it deems important for predicting the target (Mean of transportation), and once it is certain of the prediction it starts jumping to the end of the sentences. Interestingly, in this setting it does not learn to just jump to the end, but rather to inspect the first two words of the last sentence.

heading: 4.3.2 STRUCTURAL-JUMP-LSTM VERSUS STATE-OF-THE-ART SPEED READING

text:
Table 3 displays the scores of our approach against all five state-of-the-art speed reading models. We report the values from the original papers, which all report the speed reading result with the highest accuracy. We list the reported FLOP reductions when available. If FLOP reductions are not reported in the original paper, we report the speed increase, which should be considered a lower bound on the FLOP reduction. Note that the state-of-the-art models use different network configurations of the RNN network and training schemes, resulting in different full read and speed read accuracies for the same dataset. To allow a consistent comparison of the effect of each speed reading model, we report the accuracy difference between each paper’s reported full read (vanilla LSTM) and speed read accuracies.
On all datasets our approach provides either the best or shared best FLOP reduction, except on CBTCN where LSTM-Jump provides a speed increase of 6.1x (compared to 3.9x for our approach). The second best method with regards to FLOP reduction is Skim-LSTM, and the worst is the AdaptiveLSTM model that implements early stopping when the model is certain of its prediction. SkimLSTM has an evaluation advantage in this FLOP reduction setting, since the FLOP reduction is directly tied to the difference between the small and large LSTM used by the model, such that an unnecessarily large LSTM will lead to very attractive reductions. Skim-LSTM uses a LSTM size of 200 for Question Answering tasks and a default size of 100 for the rest, whereas the small is tested between 5 to 20. In the case of large skimming percentage, it could be argued that the size of the large LSTM could be reduced without affecting the performance. In contrast, jumping based models are less prone to this evaluation flaw because they cannot carry over information from skipped or jumped words.
Most models perform at least as well as a vanilla LSTM. LSTM-Shuttle provides consistent accuracy improvements, but does so at a noticeable FLOP reduction cost compared to Skim-LSTM and our
approach. This can be explained by its ability to make backwards jumps in the text in order to reread important parts, which is similar to the idea of Yu-LSTM. The largest accuracy improvements appear on CBT-CN and CBT-NE with LSTM-Jump. The performance obtained by reading just the query has been reported to be very similar to using both the query and the 20 sentences (Hill et al., 2016), which could indicate a certain noise level in the data that speed reading models are able to identify and reduce the number of read words between the high information section of the text and the final prediction. LSTM-Jump and LSTM-Shuttle are optimized via maximizing a jumping budget, where only a certain specified number of jumps are allowed to be made, which provides an edge in comparison to the other methods in this setting because prior knowledge about the high information level of the query can be encoded in the budget (cf. Yu et al. (2017) where the best accuracy is obtained using 1 jump for CBT-CN and 5 for CBT-NE). In the setting of speed reading the query is read first to condition the jumping based on the query – this makes the model very likely to prefer jumping shortly after the query is read, to not degrade the LSTM state obtained after reading the query. Overall, budgets can be beneficial if prior information about the document is available, but this is most often not the case for a large set of real world datasets. However, methods based on budgets are in general significantly more rigid, as every document in a collection has the same budget, but the required budget for each document is not necessarily the same.

heading: 5 CONCLUSION

text:
We presented Structural-Jump-LSTM, a recurrent neural network for speed reading. StructuralJump-LSTM is inspired by human speed reading, and can skip irrelevant words in important sections, while also jumping past unimportant parts of a text. It uses the dynamically spaced punctuation structure of text to determine whether to jump to the next word, the next sub-sentence separator (,;), next end of sentence (.!?), or to the end of the text. In addition, it allows skipping a word after observing it without updating the state of the RNN. Through an extensive experimental evaluation against all five state-of-the-art baselines, Structural-Jump-LSTM obtains the overall largest reduction in floating point operations, while maintaining the same accuracy or even improving it over a vanilla LSTM model that reads the full text. We contribute the first ever neural speed reading model
that both skips and jumps over dynamically defined chunks of text without loss of effectiveness and with notable gains in efficiency. Future work includes investigating other reward functions, where most of the reward is not awarded in the end, and whether this would improve agent training by having a stronger signal spread throughout the text.


summaries: The authors propose a new defense against adversarial examples based on radial basis features. Prior work has suggested that the linearity of standard convolutional networks may be a factor contributing to their vulnerability against adversarial examples, and that radial basis functions may help alleviate this weakness. The current paper builds on this idea and proposes a concrete way to add radial basis features to existing convnet architectures.

summaries: The proposed method is too simplistic, the model being succinctly described in less than one page with many errors in the given math expressions. Only the model is given. The optimization problem, as given in (1) is not explained. the authors need to stud the optimization problem, to derive its resolution, and to describe the obtained algorithm.

abstractText: The linear and non-flexible nature of deep convolutional models makes them vulnerable to carefully crafted adversarial perturbations. To tackle this problem, in this paper, we propose a nonlinear radial basis convolutional feature transformation by learning the Mahalanobis distance function that maps the input convolutional features from the same class into tight clusters. In such a space, the clusters become compact and well-separated, which prevent small adversarial perturbations from forcing a sample to cross the decision boundary. We test the proposed method on three publicly available image classification and segmentation data-sets namely, MNIST, ISBI ISIC skin lesion, and NIH ChestX-ray14. We evaluate the robustness of our method to different gradient (targeted and untargeted) and nongradient based attacks and compare it to several non-gradient masking defense strategies. Our results demonstrate that the proposed method can boost the performance of deep convolutional neural networks against adversarial perturbations without accuracy drop on clean data.

authors:
Anish Athalye
Nicholas Carlini
David Wagner

title: Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples

venue: arXiv preprint arXiv:1802.00420,

authors:
Jacob Buckman
Aurko Roy
Colin Raffel
Ian Goodfellow

title: Thermometer encoding: One hot way to resist

authors:
Tadeusz Caliński
Jerzy Harabasz

title: A dendrite method for cluster analysis

venue: Communications in Statistics-theory and Methods,

authors:
Nicholas Carlini
David Wagner

title: Towards evaluating the robustness of neural networks

venue: IEEE Symposium on Security and Privacy (SP),

authors:
Noel CF Codella
David Gutman
M Emre Celebi
Brian Helba
Michael A Marchetti
Stephen W Dusza
Aadi Kalloo
Konstantinos Liopyris
Nabin Mishra
Harald Kittler

title: Skin lesion analysis toward melanoma detection: A challenge at the 2017 International Symposium on Biomedical Imaging (ISBI), hosted by the International Skin Imaging Collaboration (ISIC)

venue: arXiv preprint arXiv:1710.05006,

authors:
Guneet S Dhillon
Kamyar Azizzadenesheli
Zachary C Lipton
Jeremy Bernstein
Jean Kossaifi
Aran Khanna
Anima Anandkumar

title: Stochastic activation pruning for robust adversarial defense

venue: arXiv preprint arXiv:1803.01442,

authors:
Yinpeng Dong
Fangzhou Liao
Tianyu Pang
Hang Su
Jun Zhu
Xiaolin Hu
Jianguo Li

title: Boosting adversarial attacks with momentum

authors:
Alhussein Fawzi
Omar Fawzi
Pascal Frossard

title: Fundamental limits on adversarial robustness

venue: In Proc. ICML, Workshop on Deep Learning,

title: Analysis of classifiers robustness to adversarial perturbations

venue: Machine Learning,

authors:
Joachim Folz
Sebastian Palacio
Joern Hees
Damian Borth
Andreas Dengel

title: Adversarial defense based on structure-to-signal autoencoders

venue: arXiv preprint arXiv:1803.07994,

authors:
Ian J Goodfellow
Jonathon Shlens
Christian Szegedy

title: Explaining and harnessing adversarial examples (2015)

venue: arXiv preprint arXiv:1412.6572,

authors:
Chuan Guo
Mayank Rana
Moustapha Cisse
Laurens van der Maaten

title: Countering adversarial images using input transformations

venue: arXiv preprint arXiv:1711.00117,

authors:
Dan Hendrycks
Kevin Gimpel

title: Early methods for detecting adversarial images

venue: arXiv preprint arXiv:1608.00530,

authors:
J Zico Kolter
Eric Wong

title: Provable defenses against adversarial examples via the convex outer adversarial polytope

venue: arXiv preprint arXiv:1711.00851,

authors:
Alexey Kurakin
Ian Goodfellow
Samy Bengio

title: Adversarial examples in the physical world

venue: arXiv preprint arXiv:1607.02533,

authors:
Xingjun Ma
Bo Li
Yisen Wang
Sarah M Erfani
Sudanthi Wijewickrema
Michael E Houle
Grant Schoenebeck
Dawn Song
James Bailey

title: Characterizing adversarial subspaces using local intrinsic dimensionality

venue: arXiv preprint arXiv:1801.02613,

authors:
Aleksander Madry
Aleksandar Makelov
Ludwig Schmidt
Dimitris Tsipras
Adrian Vladu

title: Towards deep learning models resistant to adversarial attacks

venue: arXiv preprint arXiv:1706.06083,

authors:
Dongyu Meng
Hao Chen

title: Magnet: a two-pronged defense against adversarial examples

venue: In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security,

authors:
Fausto Milletari
Nassir Navab
Seyed-Ahmad Ahmadi

title: V-net: Fully convolutional neural networks for volumetric medical image segmentation

venue: In 3D Vision (3DV),

authors:
Nicolas Papernot
Patrick McDaniel
Xi Wu
Somesh Jha
Ananthram Swami

title: Distillation as a defense to adversarial perturbations against deep neural networks

venue: arXiv preprint arXiv:1511.04508,

authors:
Nicolas Papernot
Patrick McDaniel
Ian Goodfellow
Somesh Jha
Z Berkay Celik
Ananthram Swami

title: Practical black-box attacks against machine learning

venue: In Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security,

authors:
Jonas Rauber
Wieland Brendel
Matthias Bethge

title: Foolbox: A python toolbox to benchmark the robustness of machine learning models

venue: arXiv preprint arXiv:1707.04131,

authors:
Olaf Ronneberger
Philipp Fischer
Thomas Brox

title: U-net: Convolutional networks for biomedical image segmentation

venue: In International Conference on Medical image computing and computerassisted intervention,

authors:
Andrew Rosenberg
Julia Hirschberg

title: V-measure: A conditional entropy-based external cluster evaluation measure. In Proceedings of the 2007 joint conference on empirical methods in natural language processing and computational natural language learning (EMNLP-CoNLL)

title: Silhouettes: a graphical aid to the interpretation and validation of cluster analysis

venue: Journal of computational and applied mathematics,

authors:
Pouya Samangouei
Maya Kabkab
Rama Chellappa

title: Defense-gan: Protecting classifiers against adversarial attacks using generative models

venue: arXiv preprint arXiv:1805.06605,

authors:
Uri Shaham
James Garritano
Yutaro Yamada
Ethan Weinberger
Alex Cloninger
Xiuyuan Cheng
Kelly Stanton
Yuval Kluger

title: Defending against adversarial images using basis functions transformations

venue: arXiv preprint arXiv:1803.10840,

authors:
Yang Song
Taesup Kim
Sebastian Nowozin
Stefano Ermon
Nate Kushman

title: Pixeldefend: Leveraging generative models to understand and defend against adversarial examples

venue: arXiv preprint arXiv:1710.10766,

authors:
Christian Szegedy
Wojciech Zaremba
Ilya Sutskever
Joan Bruna
Dumitru Erhan
Ian Goodfellow
Rob Fergus

title: Intriguing properties of neural networks

venue: arXiv preprint arXiv:1312.6199,

authors:
Saeid Asgari Taghanaki
Arkadeep Das
Ghassan Hamarneh

title: Vulnerability analysis of chest x-ray image classification against adversarial attacks

venue: arXiv preprint arXiv:1807.02905,

authors:
Thomas Tanay
Lewis Griffin

title: A boundary tilting persepective on the phenomenon of adversarial examples

venue: arXiv preprint arXiv:1608.07690,

authors:
Alexander Toshev
Christian Szegedy

title: Deeppose: Human pose estimation via deep neural networks

venue: In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition,

authors:
Florian Tramèr
Alexey Kurakin
Nicolas Papernot
Ian Goodfellow
Dan Boneh
Patrick McDaniel

title: Ensemble adversarial training: Attacks and defenses

venue: arXiv preprint arXiv:1705.07204,

authors:
Dimitris Tsipras
Shibani Santurkar
Logan Engstrom
Alexander Turner
Aleksander Madry

title: There is no free lunch in adversarial robustness (but there are unexpected benefits)

venue: arXiv preprint arXiv:1805.12152,

authors:
Nguyen Xuan Vinh
Julien Epps
James Bailey

title: Information theoretic measures for clusterings comparison: Variants, properties, normalization and correction for chance

venue: Journal of Machine Learning Research,

authors:
Xiaosong Wang
Yifan Peng
Le Lu
Zhiyong Lu
Mohammadhadi Bagheri
Ronald M Summers

title: Chestx-ray8: Hospital-scale chest x-ray database and benchmarks on weakly-supervised classification and localization of common thorax diseases

venue: In Computer Vision and Pattern Recognition (CVPR),

authors:
Yue Wu
Hui Wang
Biaobiao Zhang
K-L Du

title: Using radial basis function networks for function approximation and classification

venue: ISRN Applied Mathematics,

authors:
Cihang Xie
Jianyu Wang
Zhishuai Zhang
Zhou Ren
Alan Yuille

title: Mitigating adversarial effects through randomization

venue: arXiv preprint arXiv:1711.01991,

authors:
Cihang Xie
Jianyu Wang
Zhishuai Zhang
Yuyin Zhou
Lingxi Xie
Alan Yuille

title: Adversarial examples for semantic segmentation and object detection

authors:
Weilin Xu
David Evans
Yanjun Qi

title: Feature squeezing: Detecting adversarial examples in deep neural networks

venue: arXiv preprint arXiv:1704.01155,

authors:
Xiaoyong Yuan
Pan He
Qile Zhu
Rajendra Rana Bhat
Xiaolin Li

title: Adversarial examples: Attacks and defenses for deep learning

venue: arXiv preprint arXiv:1712.07107,

authors:
Valentina Zantedeschi
Maria-Irina Nicolae
Ambrish Rawat

title: Efficient defenses against adversarial attacks

venue: In Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security,

heading: 1 INTRODUCTION

text:
It has been shown that deep convolutional neural networks (CNNs) can be highly vulnerable to adversarial perturbations Szegedy et al. (2013); Goodfellow et al. (2015) produced by two main groups of attack mechanisms: white- and back-box, which refer to having access to the victim model parameters and architecture or not, respectively. In order to mitigate the effect of adversarial attacks, two main categories of defense techniques have been proposed: data-level and algorithmic-level. Data-level methods include adversarial training Szegedy et al. (2013); Goodfellow et al. (2015), pre-/post-processing methods (e.g. feature squeezing) Xu et al. (2017), pre-processing using basis functions Shaham et al. (2018), and noise removal Hendrycks & Gimpel (2016); Meng & Chen (2017). Algorithmic-level methods Kolter & Wong (2017); Samangouei et al. (2018); Folz et al. (2018); Samangouei et al. (2018) modify the deep model or training procedure by reducing the magnitude of gradients Papernot et al. (2015) or blocking/masking gradients Buckman et al. (2018); Guo et al. (2017); Song et al. (2017). However, these approaches are not completely effective against several different white- and black-box attacks Samangouei et al. (2018); Tramèr et al. (2017); Meng & Chen (2017) and pre-processing based methods might deteriorate an un-attacked model performance. Generally, most of these defense strategies cause a drop in standard accuracy on clean data Tsipras et al. (2018). For more details on adversarial attacks and defenses, we refer readers to Yuan et al. (2018).
Gradient masking has shown sub-optimal performance against different types of adversarial attacks Papernot et al. (2017); Tramèr et al. (2017). Athalye et al. (2018) identified obfuscated gradients, a special case of gradient masking that leads to a false sense of security in defenses against adversarial perturbations. They showed that 7 out of 9 recent white-box defenses relying on this phenomenon (Buckman et al. (2018); Ma et al. (2018); Guo et al. (2017); Dhillon et al. (2018); Xie et al. (2017a); Song et al. (2017); Samangouei et al. (2018)) are vulnerable to single step or nongradient based attacks. They finally suggested several symptoms of defenses that rely on obfuscated gradients.
As explored in the literature, adversarial examples can be mainly the results of models being too linear Goodfellow et al. (2015) in high dimensional manifolds when the decision boundary is close to the manifold of the training data Tanay & Griffin (2016) and/or because of the models’ low flexi-
bility Fawzi et al. (2015). To boost the non-linearity of a model, Goodfellow et al. (2015) explored a variety of methods involving utilizing quadratic units and including shallow and deep radial basis function (RBF) networks. They achieved reasonably good performance against adversarial perturbations with shallow RBF networks, however, they found it difficult to train deep RBF models, leading to a high training error using stochastic gradient decent. Fawzi et al. (2018) showed that support vector machines with RBF kernels can effectively resist adversarial attacks.
Typically, a single RBF network layer takes a vector of x ∈ Rn as input and output a scalar function of the input vector f(x) : Rn → R computed as f (x) = ∑N i=1 wie
−βiD(x,ci), where N is the number of neurons in the hidden layer, ci is the center vector for neuron i, D(x, ci) measures the distance between x and ci, and wi weights the output of neuron i. The Gaussian basis functions, commonly used in RBF networks, are local to the center vectors, i.e. lim‖x‖→∞D(x, ci) = 0, which in turn implies that changing the parameters of a neuron has an increasing smaller effect on the output as the sample input x is farther from center of that neuron (i.e. x is a sample that the RBF network does not ‘understand’ Goodfellow et al. (2015)). When such a distant sample is in the response domain of an RBF, the change in the response caused by a perturbation added to the sample is negligible. Traditional RBF networks are normally trained in two sequential steps. First, an unsupervised method, e.g. k-means clustering, is applied to find RBF centers Wu et al. (2012) and, second, a linear model with coefficients wi is fit to the desired outputs.
To tackle the linearity issue of the current models (i.e. stacking several linear units), particularly deep CNNs, which results in vulnerability to adversarial perturbations, we arm CNNs with radial basis feature transformation. Further, to add more flexibility to the models, radial basis functions with Euclidean distance might not be effective as the activation of each neuron depends on the Euclidean distance between a pattern and the neuron center. However, since the activation function is constrained to be symmetrical, all attributes are considered equally relevant. This limitation can be addressed by applying non-symmetrical quadratic distance functions, such as a Mahalanobis distance, in the activation function in order to take into account the variability of the attributes and their correlations. However, computed this distance directly from the variance-covariance matrix of training data is sensitive to outliers and does not consider the accuracy of the learning algorithm.
In this paper, we propose a non-linear radial basis convolutional feature transformation method based on Mahalanobis distance. In contrast to traditional Mahalanobis formulation, in which a constant, pre-defined covariance matrix is adopted, we propose to learn such ”transformation” matrix T ∈ Rn×n. To enforce T ’s positive semi-definiteness, using the eigenvalue decomposition, it can be decomposed into T ′T . All other RBF parameters, i.e. centers C = {c1, c2, · · · , cN} and βi (width of Gaussian), along with all CNN parameters Ω, are also learned end-to-end using back-propagation. This approach causes the local RBF centers to be adjusted optimally as they are updated based on the whole network parameters. Therefore, we define a loss function L encoding the classification error in the transformed space and seek T ∗, β∗, C∗, and Ω∗ that minimize L:
T ∗, C∗, β∗,Ω∗ = argminP,C,β,ΩL (P,C, β,Ω) . (1)

heading: 2 RADIAL BASIS FEATURE TRANSFORMATION

text:
Given a convolutional feature map F of size n ×m × k the goal is to map the features onto a new space G of size n×m×o where classes are dense (tightly clustered) and well separated. To achieve this, we leverage a RBF projector that takes as input feature vectors of Fi,j,k and transforms them to a new space by learning a transformation matrix under Mahalanobis distance formulation as follows:
φk = e −βD(Fi,j,K ,ck) (2)
where i = 1 : n, j = 1 : m, φk is kth activation function, ck is kth learnable center, trained β controls the width of the Gaussian function and D(.) refers to Mahalanobis distance between a convolutional feature vector and a center computed as:
D (Fi,j,K , ck) = √ (Fi,j,K − ck)T P (Fi,j,K − ck) (3)
where P refers to learnable transformation matrix of size n×m and its size varies for different size inputs in each layer. Finally, the projected feature vector G(Fi,j,k) is computed as:
G (Fi,j,K) = k∑ i=1 (wk · φk) + bk (4)
The detailed diagram of the transformation step is shown in Figure 2. Finally, in each layer l of network, output feature maps of each convolutional block are concatenated with projected feature maps (Figure 1).

heading: 3 DATA

text: We conduct two sets of experiments: image (i) classification and (ii) segmentation. (i) For the image classification experiments, we use MNIST and ChestX-ray14 dataset (Wang et al. (2017)), which comprises 112,120 gray-scale images with 14 disease labels and one ‘no (clinical) finding’ label. We treat all the disease classes as positive and formulate a binary classification task. We randomly selected 90,000 images for training, 45,000 images with “positive” label and the remaining 45,000 with “negative” label. The validation set comprised 13,332 images with 6,666 images of each label. We randomly picked 200 unseen images as the test set, with 93 images with positive and 107 having negative labels. These clean (test) images are used for carrying out different adversarial attacks and the models trained on clean images are evaluated against them. (ii) For the image segmentation task experiments, we used the 2D RGB skin lesion dataset from the 2017 IEEE ISBI International Skin Imaging Collaboration (ISIC) Challenge Codella et al. (2017). We trained on a set of 2,000 images and tested on an unseen set of 150 images.

heading: 4 EXPERIMENTS AND RESULTS

text: In this section, we report the results of several experiments for two tasks of classification and segmentation. We first start with MNIST as it has commonly been used for evaluating adversarial attacks and defences. Next we show how the proposed method is scalable to another classification dataset and segmentation task.

heading: 4.1 EVALUATION ON CLASSIFICATION TASK

text:
In this section, we analyze the proposed method on two different classifications datasets MNIST and of X-chest14. In Table 1, we report the results of the proposed method on MNIST dataset when attacked by different targeted and un-targeted attacks i.e. fast gradient sign method (FGSM) Kurakin et al. (2016a), basic iterative method (BIM) Kurakin et al. (2016b), projected gradient descent (PGD) Madry et al. (2017), Carlini & Wagner method (C&W) Carlini & Wagner (2017), momentum iterative method (MIM) Dong et al. (2018) winner of NIPS 2017 adversarial attacks competition. The proposed method (i.e. PROP) successfully resists all the attacks for which the 3-layers CNN (i.e. ORIG) network almost completely fails e.g. for the strongest attack (i.e. MIM) the proposed method achieves 64.25% accuracy while the original CNN network obtains almost zero (0.58%) accuracy. Further, we test the proposed method with a non-gradient based attack i.e. Gaussian additive noise (GN) Rauber et al. (2017) to show that the robustness of the method is not because of gradient masking.
To ensure that the proposed method robustness is not due to masked/obfuscated gradient, as suggested by Athalye et al. (2018), we test the proposed feature transformation method based on several characteristic behaviors of defenses which cause obfuscated gradients to occur. a) As reported in Table 1, one-step attacks (e.g. FGSM) did not perform better than iterative attacks (e.g. BIM, MIM); b) According to Tables 4 and 5, black-box attacks did not perform better than white-box ones; c) as shown in Figure 3 (left and middle), larger distortion factors monotonically increase the attack success rate. The right plot in Figure 3 also indicates that the robustness of the proposed method is not because of numerical instability of gradients.
Next, to quantify the compactness and separability of different clusters/classes, we evaluate the features produced ORIG and PROP methods with clustering evaluation techniques such as mutual information based score Vinh et al. (2010), homogeneity and completeness Rosenberg & Hirschberg (2007), Silhouette coefficient Rousseeuw (1987), and Calinski-Harabaz index Caliński & Harabasz (1974).
Both Silhouette coefficient and Calinski-Harabaz index quantify how well clusters are separated from each other and how compact they are without taking into account the ground truth labels, while mutual information based score, homogeneity, and completeness scores evaluate clusters based on labels. As reported in Table 2, when the original CNN network applies radial basis feature transformation it achieves considerably higher scores (the higher values for all the metrics the better). As both original and the proposed method achieved high classification test accuracy i.e. ∼ 99%, the difference in scores for ground truth label based metrics, i.e. mutual information based, homogeneity, and completeness, scores are small.
In Figure 4, we illustrate feature spaces of each layer in a simple 3-layer CNN network using tSNE and PCA methods by reducing the high dimensional feature space into two dimensions. As can be seen, the proposed radial basis feature transformation helps reduce intra-class and increase inter-class distances.
t-SNE 1st layer t-SNE 2nd layer t-SNE 3rd layer PCA 3rd layer
To test the robustness of the proposed method on the X-chest14 dataset we follow the strategy of Taghanaki et al. (2018). We select Inception-ResNet-v2 and modify it by the proposed radial basis function blocks. According to the study done by Taghanaki et al. (2018), we focus on the most effective attacks in term of imperceptibility and power i.e. gradient-based attacks (basic iterative method Kurakin et al. (2016a): BIM and L1-BIM). We also compare the proposed method with two defense strategies: Gaussian data augmentation (GDA) Zantedeschi et al. (2017) and feature squeezing (FSM) Xu et al. (2017). GDA is a data augmentation technique that augments a dataset with copies of the original samples to which Gaussian noise has been added. FSM method reduces the precision of the components of the original input by encoding them on a smaller number of bits. In Table 3, we report the classification accuracy of different attacks and defences (including PROP) on X-chest14 dataset.

heading: 4.2 EVALUATION ON SEGMENTATION TASK

text:
To assess segmentation vulnerability to adversarial attacks, we apply the recently introduced dense adversary generation (DAG) method proposed by Xie et al. (2017b) to two state-of-the-art segmentation networks i.e. U-Net Ronneberger et al. (2015) and V-Net Milletari et al. (2016) under both white- and black-box conditions. We compare the proposed feature transformation method to other defence strategies e.g. Gaussian and median feature squeezing Xu et al. (2017) (FSG and FSM,
respectively) and adversarial training Goodfellow et al. (2015) (ADVT). As reported in Table 4, the percentage accuracy (Dice score) drop for the proposed radial basis transformation method is only 1.60% and 6.39% after 10 and 30 iterations of the attack with γ = 0.03 for U-Net and 8.50% and 13.95% for V-Net, respectively. Applying feature transformation, improved the segmentation accuracy on clean (non-attacked) images from 0.7743 to 0.7780 and 0.8070 to 0.8213 for U-Net and V-Net, respectively.
As reported in Table 5, under black-box attack, the proposed method is the best performing method across all 12 experiments except for one in which the accuracy of the best method was just 0.0022 higher (i.e. 0.7284 ± 0.2682 vs 0.7262 ± 0.2621), however note that the standard deviation of the winner is larger than the proposed method.
Next, we analyze the usefulness of learning the transformation matrix T and width of the Gaussian (β) in Mahalanobis distance calculation. As can be seen in Table 6, in all the cases, i.e. testing with clean and 10 and 30 iterations of attack, our method with learned transformation matrix and β archived higher performance.

heading: 5 IMPLEMENTATION DETAILS

text: Segmentation experiments. For both U-Net and V-Net we used batch size of 16, Adadelta optimizer with learning rate of 1.0, rho=0.95, and decay=0.0. We tested DAG method with 10 and 30 iterations and perturbation factor γ = 0.03. For FSM and FSG defences we applied window size of 3× 3 and standard deviation of 1.0, respectively. Classification experiments. MNIST experiments: for both the original 3-layers CNN (i.e. ORIG) and the proposed method (i.e. PROP = ORIG + feature transformation) we used batch size of 128 and Adam optimizer with learning rate of 0.001. X-chest14 experiments: Inception-ResNet-v2 network was trained from scratch having a batch size of 4 with RMSProp optimizer Toshev & Szegedy (2014) with a decay of 0.9 and = 1 and an initial learning rate of 0.045, decayed every 2 epochs using an exponential rate of 0.94. For all the gradient based attacks applied in the classification part, we used CleverHans library Nicolas et al. (2018) and for the Gaussian additive noise attack we used FoolBox Rauber et al. (2017).

heading: 6 CONCLUSION

text: We proposed a nonlinear radial basis feature transformation method to map convolutional features of each layer in a network into a new space, in which it becomes harder for an attack to find effective gradient directions to perturb the input to fool a model. We evaluated the model under white- and black-box attacks for two different tasks of image classification and segmentation and compared our method to other non-gradient based defenses. We also performed several tests to ensure that the robustness of the proposed method is neither because of numerical instability of gradients nor because of gradient masking. In contrast to previous methods, our proposed feature mapping improved the classification and segmentation accuracy on both clean and perturbed