summaries: This works propose a new approach to learn to sample (or generate) the parameters of a deep neural networks to solve a task. They propose a new architecture inspired by hyper networks and adversarial auto-encoders, where the parameters of the networks are generated from a low dimensional latent space. By using an ensemble of networks sampled with their approach they're able to get state of the art results on uncertainty estimation. This paper proposes a technique for learning a distribution over parameters of a neural network such that samples from the distribution correspond to performant networks. The approach effectively encourages sampled parameters to have low loss on the training set, and also uses an adversarial loss to encourage the distribution of parameters to be Gaussian distributed. This approach can improve performance slightly by using ensembling and can be useful for uncertainty estimates for out-of-distribution examples. The approach is tested on a few simple problems and is shown to work well.
abstractText: We introduce HyperGAN, a generative network that learns to generate all the weight parameters of deep neural networks. HyperGAN first transforms low dimensional noise into a latent space, which can be sampled from to obtain diverse, performant sets of parameters for a target architecture. We utilize an architecture that bears resemblance to generative adversarial networks, but we evaluate the likelihood of samples with a classification loss. This is equivalent to minimizing the KL-divergence between the generated network parameter distribution and an unknown true parameter distribution. We apply HyperGAN to classification, showing that HyperGAN can learn to generate parameters which solve the MNIST and CIFAR-10 datasets with competitive performance to fully supervised learning, while learning a rich distribution of effective parameters. We also show that HyperGAN can also provide better uncertainty than standard ensembles. This is evaluated by the ability of HyperGAN-generated ensembles to detect out of distribution data as well as adversarial examples. We see that in addition to being highly accurate on inlier data, HyperGAN can provide reasonable uncertainty estimates.
references.authors: Jimmy Ba Geoffrey E Hinton Volodymyr Mnih Joel Z Leibo Catalin Ionescu
references.title: Using fast weights to attend to the recent past
references.venue: In Advances in Neural Information Processing Systems,
references.authors: Andreas Damianou Neil Lawrence
references.title: Deep Gaussian processes
references.venue: Proceedings of the Sixteenth International Workshop on Artificial Intelligence and Statistics (AISTATS),
references.authors: Yinpeng Dong Fangzhou Liao Tianyu Pang Xiaolin Hu Jun Zhu
references.title: Discovering adversarial examples with momentum
references.venue: CoRR, abs/1710.06081,
references.authors: C.D. Freeman J. Bruna
references.title: Topology and Geometry of Half-Rectified Network Optimization
references.venue: ArXiv e-prints,
references.authors: Yarin Gal Zoubin Ghahramani
references.title: Dropout as a bayesian approximation: Representing model uncertainty in deep learning
references.venue: In international conference on machine learning,
references.authors: Ian Goodfellow Jean Pouget-Abadie Mehdi Mirza Bing Xu David Warde-Farley Sherjil Ozair Aaron Courville Yoshua Bengio
references.title: Generative adversarial nets
references.venue: Advances in Neural Information Processing Systems
references.authors: Ian Goodfellow Jonathon Shlens Christian Szegedy
references.title: Explaining and harnessing adversarial examples
references.venue: In International Conference on Learning Representations,
references.authors: José Miguel Hernández-Lobato Ryan Adams
references.title: Probabilistic backpropagation for scalable learning of bayesian neural networks
references.venue: In International Conference on Machine Learning,
references.authors: Martin Heusel Hubert Ramsauer Thomas Unterthiner Bernhard Nessler Sepp Hochreiter
references.title: Gans trained by a two time-scale update rule converge to a local nash equilibrium
references.venue: In Advances in Neural Information Processing Systems,
references.authors: Geoffrey E Hinton David C Plaut
references.title: Using fast weights to deblur old memories
references.venue: In Proceedings of the ninth annual conference of the Cognitive Science Society,
references.authors: Max Jaderberg Karen Simonyan Andrew Zisserman
references.title: Spatial transformer networks. In Advances in neural information processing
references.authors: Xu Jia Bert De Brabandere Tinne Tuytelaars Luc V Gool
references.title: Dynamic filter networks
references.venue: In Advances in Neural Information Processing Systems,
references.authors: Balaji Lakshminarayanan Alexander Pritzel Charles Blundell
references.title: Simple and scalable predictive uncertainty estimation using deep ensembles
references.venue: In Advances in Neural Information Processing Systems,
references.authors: Jonathan Lorraine David Duvenaud
references.title: Stochastic hyperparameter optimization through hypernetworks
references.venue: CoRR, abs/1802.09419,
references.authors: Christos Louizos Max Welling
references.title: Multiplicative normalizing flows for variational bayesian neural networks
references.venue: CoRR, abs/1605.09673,
references.authors: Richard Maclin David W. Opitz
references.title: Popular ensemble methods: An empirical study
references.venue: CoRR, abs/1106.0257,
references.authors: A. Madry A. Makelov L. Schmidt D. Tsipras A. Vladu
references.title: Towards Deep Learning Models Resistant to Adversarial Attacks
references.authors: Nick Pawlowski Andrew Brock Matthew CH Lee Martin Rajchl Ben Glocker
references.title: Implicit weight uncertainty in neural networks
references.venue: arXiv preprint arXiv:1711.01297,
references.authors: Tim Salimans Ian Goodfellow Wojciech Zaremba Vicki Cheung Alec Radford Xi Chen
references.title: Improved techniques for training gans
references.venue: In Advances in Neural Information Processing Systems,
references.authors: Cédric Villani
references.title: Optimal transport: old and new, volume 338
references.venue: Springer Science & Business Media,
sections.text: We introduce HyperGAN, a generative network that learns to generate all the weight parameters of deep neural networks. HyperGAN first transforms low dimensional noise into a latent space, which can be sampled from to obtain diverse, performant sets of parameters for a target architecture. We utilize an architecture that bears resemblance to generative adversarial networks, but we evaluate the likelihood of samples with a classification loss. This is equivalent to minimizing the KL-divergence between the generated network parameter distribution and an unknown true parameter distribution. We apply HyperGAN to classification, showing that HyperGAN can learn to generate parameters which solve the MNIST and CIFAR-10 datasets with competitive performance to fully supervised learning, while learning a rich distribution of effective parameters. We also show that HyperGAN can also provide better uncertainty than standard ensembles. This is evaluated by the ability of HyperGAN-generated ensembles to detect out of distribution data as well as adversarial examples. We see that in addition to being highly accurate on inlier data, HyperGAN can provide reasonable uncertainty estimates.
sections.heading: 1 INTRODUCTION
sections.text: Since the inception of deep neural networks, it has been found that it is possible to train from different random initializations and obtain networks that, albeit having quite different parameters, achieve quite similar accuracy (Freeman & Bruna, 2016). It has further been found that ensembles of deep networks that are trained in such a way have significant performance advantages over single models (Maclin & Opitz, 2011), similar to the classical bagging approach in statistics. Ensemble models also have other benefits, such as being robust to outliers and being able to provide variance or uncertainty estimates over their inputs (Lakshminarayanan et al., 2017).
  In Bayesian deep learning, there is a significant interest in having a probabilistic interpretation of network parameters and modeling a distribution over them. Earlier approaches mostly utilize dropout as a Bayesian approximation, by randomly setting different parameters to zero and thus integrating over many possible networks. (Gal & Ghahramani, 2016) showed that networks with dropout following each layer are equivalent to a deep Gaussian process (Damianou & Lawrence, 2013) marginalized over its covariance functions. They proposed MCdropout as a simple way to estimate model uncertainty. These approximations are not well aligned with current training patterns of neural networks. Applying dropout to every layer results in over-regularization and underfitting of the target function. Moreover, dropout does not integrate over the full variation of possible models, only those which may be reached from one (random) initialization.
  As another interesting direction, hypernetworks (Ha et al., 2016) are neural networks which output parameters for a target neural network. The hypernetwork and the target network together form a single model which is trained jointly. The original hypernetwork produced the target weights as a deterministic function of its own weights, but Bayesian Hypernetworks (BHNs) (Krueger et al., 2017), and Multiplicative Normalizing Flows (MNF) (Louizos & Welling, 2016) generate model parameters by sampling a Gaussian prior. However, these approaches use normalizing flows to transform a simple prior into a sample of the more complicated posterior, which are composed of only bijective, invertible functions. This limits their scalability and the variety of learnable functions.
  In this paper we explore an approach which focuses on generating all the parameters of a neural network, without assuming any fixed noise models on parameters. To keep our method scalable, we avoid utilizing invertible functions as in normalizing flow approaches, and instead utilize the ideas from generative adversarial networks (GANs). We especially observe recent Wasserstein Autoencoder (Tolstikhin et al., 2017) approaches. These approaches have demonstrated an impressive capability to model complicated, multimodal distributions. In our approach, a random noise vector is first encoded to a number of different random vectors, then each random vector is used to generate all parameters within one layer of a deep network. The generator is then trained with conventional maximum likelihood (classification/regression) on the parameters it generates, and an adversarial regularization keeps it from collapsing onto only one mode. In this way, it is possible to generate much larger networks than the dimensionality of the latent code, making our approach capable of generating all the parameters of a deep network with a single GPU. As an example, in our experiments on CIFAR-10 we start from a 256-dimensional latent vector and generate all 50, 000+ parameters in one pass, consuming only 4GB GPU memory. This shows that deep networks may indeed span a low-dimensional manifold, and could spur further thoughts and research.
sections.heading: 1.1 SUMMARY OF CONTRIBUTIONS
sections.text: We propose HyperGAN, a novel approach for generating all the parameters for a target network architecture using a modified GAN, and we do so starting from a small Gaussian noise vector which scales well with the size of the output. Our approach is different from strict Bayesian approaches since we do not attempt to model the entire posterior, i.e., from an observed network we cannot compute its probability of it being generated. Moreover, we use deterministic generators, our only source of stochasticity is the initial prior sample. After our GAN is trained, one can directly generate many diverse, well-trained deep models without needing to further train or fine-tune them. The diversity of the models we can generate is beyond just adding dropout or scaling factors, which is shown by the superior performance of ensembles of the generated networks.
  We believe HyperGAN is widely applicable to a variety of tasks. One area where populations of diverse networks show promise is in uncertainty estimation and anomaly detection. We show through a variety of experiments that populations of networks sampled from HyperGAN are able to approximate the data distribution such that it can detect out of distribution samples. We show that we can provide a reasonable measure of uncertainty by calculating the entropy within the predictive distribution of sampled networks. Our method is straightforward, as well as easy to train and sample from. We hope that we can inspire future work in estimation of the manifold of neural networks.
sections.heading: 2 RELATED WORK
sections.text: Generating parameters for neural networks has been framed in contexts other than the Bayesian approaches described above. The hypernetwork framework (Ha et al., 2016) has come to describe models where one network directly supervises the weight updates of another network. (Pawlowski et al., 2017) uses hypernetworks to generate layer-wise weights for a target architecture given some auxiliary noise as input. The auxiliary noise is noted to be independent between layers, while we impose structure in our inputs to create diversity in our generated samples.
  Computer vision methods often use data driven approaches as seen in methods such as Spatial Transformer networks (Jaderberg et al., 2015), or Dynamic Filter networks (Jia et al., 2016). In these methods the filter parameters of the main network are conditioned on the input data, receiving contextual scale and shift updates from an auxiliary network. Our method, however, generates parameters for the whole network. Furthermore our predicted parameters are highly nonlinear functions of the input, instead of simple affine transformations based on the input examples.
  Recently, (Lakshminarayanan et al., 2017) proposed Deep Ensembles, where adversarial training was applied to standard ensembles to smooth the predictive variance. However, adversarial training is an expensive training process. Adversarial examples are generated for each batch of data seen. We seek a method to learn a distribution over parameters which does not require adversarial training.
  Meta learning approaches use different kinds of weights in order to increase the generalization ability of neural networks. The first proposed method is fast weights (Hinton & Plaut, 1987) which uses an auxiliary (slow) network to produce weight changes in the target (fast) network, acting as a
  short term memory store. Meta Networks (Munkhdalai & Yu, 2017) build on this approach by using an external neural memory store in addition to multiple sets of fast and slow weights. (Ba et al., 2016) augment recurrent networks with fast weights as a more biologically plausible memory system than Neural Turing Machines. Unfortunately, the generation of each predicting network requires querying the base (slow) learner many times. Many of the methods presented there, along with hyperparameter learning (Lorraine & Duvenaud, 2018), and the original hypernetwork, propose learning target weights which are deterministic functions of the training data. Our method instead captures a distribution over parameters, and provides a cheap way to directly sample full networks from a learned distribution.
sections.heading: 3 HYPERGAN
sections.text: Taking note from the original hypernetwork framework for generating neural networks (Ha et al., 2016), we coin our approach HyperGAN. Standard GAN training dictates that we train a generator G to model the target distribution, aided by a discriminator network D. This entails acquiring a large dataset of trained neural network parameters, and providing samples to D to judge the output of the generator. However, a large collection of neural networks would be extremely costly to build. Instead, our data distribution is built online by evaluating the performance of our generated parameters at each step.
  We begin with assuming that a neural network F(x; θ) with input x and parameters θ consisting of a given architecture withN layers, and a training setM with inputs and targets (X,Y ) = {xi, yi}Mi=1. The standard training regime consists of computing a loss function L(F(x; θ), y) and updating the parameters θ with backpropagation untilL is minimized. This works if we only want a point estimate of θ. However, if we want to generate more than one non-trivial network, some diversity is needed. Our approach to creating diversity is similar to a regular GAN architecture in that we start by drawing a random sample s ∼ S = N (0, Ij), where 0 is an all-zero vector and Ij is a j × j identity matrix, and generate parameters using a generator from s.
  Figure 1 shows the HyperGAN architecture. Distinct from the standard GAN, we use parallel, untied generators to form the parameters of each layer. In order for that to work, we observe that parameters between network layers are not independent, but are strongly correlated. The parameters of each layer depend on the output and the parameters of the preceding layers. Therefore, the generated parameters must be correlated to produce well-performing neural networks. We propose to add a Mixer Q which maps s ∼ S to the mixed latent space Z ∈ RNd, d < j. An Nd-dimensional Q(s) is then partitioned into N layer embeddings [q1, . . . , qN ], each being a d-dimensional vector. Finally, we use N parallel generators G = {G1(q1) . . . GN (qn)} to generate the parameters θG for all layers in F . After generation, we can evaluate the new modelF(x, θG) on the training set. We define an objective which minimizes the error of generated parameters with respect to a task loss L:
  inf G,Q
  Es∼SE(x,y)∼(X,Y ) [L(F(x;G(Q(s))), y)] (1)
  At each training step we generate a different network G(Q(s)) from a random s ∼ S, and then evaluate the loss function on a mini-batch from the training set. The resulting loss is backpropagated through the generators until θG minimizes the target loss L. The formulation in (1) presents a problem: the codes sampled from Q(s) will certainly collapse to the maximum likelihood (ML) estimate (when L is a log-likelihood). This means that the generators will learn a very narrow approximation of Θ, and indeed we see this happen in tables 3 and 4. To assure that the parameters are well distributed, we added an adversarial constraint on the mixed latent spaceD(Q(s)) so that it should not deviate too much from a Gaussian prior P . This constraint makes it closer to the generated parameters and ensures that Q(s) itself does not collapse to always outputting the same latent code. With this we arrive at the HyperGAN objective:
  inf G,Q
  Es∼SE(x,y)∼(X,Y ) [L(F(x;G(Q(s))), y)]− βD(Q(s),P) (2)
  Where β is a hyperparameter, andD is the regularization term which penalizes the distance between the prior and the distribution of latent codes. In practice D could be any distance function between two distributions. We choose to parameterize D as a discriminator network D that output probabilities, and use the adversarial loss (Goodfellow et al., 2014) to approximate D(Q(s),P). Note that while P and S are both multivariate Gaussians, they are distinct distributions as seen in figure 1.
  D := − N∑ i=1 (logD(pi) + log(1−D(qi))) (3)
  Note that we find it difficult to learn a discriminator in the output (parameter) space because the dimensionality is high and there is no structure in those parameters to be utilized as in images (where CNNs can be trained). Our experiments show that regularizing in the latent space works well. We hypothesize this is because of overparametrization in θ. The latent space initializes with random projections, which have a restricted isometry property according to the Johnson-Lindenstrauss lemma, hence if the mixed latent factor q is Gaussian, a random projection from it preserves the distance and diversity from q to θ. If θ is indeed severely overparametrized, and it is possible to generate diverse parameters by maximizing the likelihood, then the generators would not collapse to a single θ, since that would require breaking the restricted isometry from the initialization.
  This framework is general and can be adapted to a variety of tasks and losses. In this work, we show that HyperGAN can operate in both classification and regression settings. For multi-class classification, the generators and mixer are trained with the cross entropy loss function:
  LH = M−1 M∑ i=1 yi log ( F(xi; θ) ) where θ = {G1(q1), . . . , Gn(qn)} (4)
  For regression tasks we replace the cross entropy term with the mean squared error function:
  Lmse = M−1 M∑ i=1 (yi −F(xi; θ))2 where θ = {G1(q1), . . . , Gn(qn)} (5)
sections.heading: 3.1 LEARNING WITHOUT AN EXPLICIT TARGET DISTRIBUTION
sections.text: In implicit generative models such as GAN or WAE (Tolstikhin et al., 2017), it is always necessary to have a collection of inlier data points to train with. Inlier samples come from the distribution that is being estimated, and learning without them is difficult. HyperGAN does not have a given set of inlier points to train with. Instead, HyperGAN uses the error on the target loss to estimate the distance between the generated samples θG ∈ ΘG and the target samples θ ∈ Θ. We note that θG represents the maximum likelihood estimate of F(x; θ). (6) shows that by minimizing the error of the ML estimate on the log-likelihood, we are in fact minimizing the KL divergence between the target distribution Θ and the generated samples θG ∈ ΘG.
  inf θG DKL(P (x|θ)||P (x|θG)) = inf θG EP (x|θG) [logP (x|θ)− logP (x|θG)]
  = inf θG EP (x|θG) [− logP (x|θG)] (6)
  Where the term logP (x|θ) is the entropy of the target distribution and does not contribute to the optimization problem. The derived likelihood function is flexible and used widely across different domains. In our work it is represented by the cross entropy and MSE losses that we study.
  Its useful to note here how HyperGAN is distinct from other density estimators such as GAN and WAE. These methods use a likelihood function, such as MSE, to estimate the quality of the samples (in GANs the likelihood function is learned via the discriminator). The likelihood is given as the distance from generated samples, to given samples of the target distribution. HyperGAN instead estimates both the target and the approximation. We assume the target distribution exists, and update our approximation ΘG to better match Θ. If we have samples of the target distribution, we can reduce HyperGAN to a GAN (by moving the discriminator to the output space).We thoroughly explore the connections and differences to GANs and WAE in A.5. HyperGAN is different from fully probabilistic approaches such as MNF (Louizos & Welling, 2016) since one cannot compute the probability of the generated θ, nor can one encode a generated θ back to the latent spaces.
sections.heading: 4 EXPERIMENTS
sections.heading: 4.1 HIGH LEVEL DESCRIPTION AND EXPERIMENTAL SETUP
sections.text: We conduct a variety of experiments to show HyperGAN’s ability to achieve both high accuracy and obtain accurate uncertainty estimates. First we show classification performance on both MNIST and CIFAR-10 datasets. Next we examine HyperGAN’s ability to learn the variance of a simple 1D dataset. We perform experiments on anomaly detection: testing HyperGAN on notMNIST, and 5 classes of CIFAR-10 which are hidden during training. We also examine adversarial examples as extreme cases of off-manifold data, and test our robustness to them. In our experiments we compare with (Louizos & Welling, 2016) (MNF) as well as standard ensembles.
  In all experiments we report results with two HyperGANs, one trained on MNIST and another on CIFAR-10. Both of our models take a 256 dimensional sample of S as input, but have different sized mixed latent spaces. The HyperGAN for the MNIST experiments consists of three weight generators, each using a 128 dimensional latent point as input. The target network for the MNIST experiments is a small two layer convolutional network, using leaky ReLU activations and 2x2 max pooling after each convolutional layer. Our HyperGAN trained on CIFAR-10 used 5 weight generators and latent points with dimensonality 256. The target architecture for CIFAR-10 tests consists of three convolutional layers, each followed by leaky ReLU and 2x2 max pooling. The exact architectures we used for the target networks is given in A.4. In our experiments we used the same network architecture across different methods. Note that our architecture is different from the LeNet-5 used in MNF, yet we see similar results as reported in (Louizos & Welling, 2016).
sections.heading: HYPERGAN DETAILS
sections.text: The mixing network, generators, and discriminator are each parameterized by 2 layer MLPs with 512 units each and ReLU nonlinearities. We found in a pilot study that larger networks offered little performance benefit, and ultimately hurt scalability. In all experiments, we pretrain the mixer so that the mean and covariance ofQ(q|s) are close to P . It should be noted that the architecture is flexible. The number and width of layers may be varied without harming HyperGANs ability to model the target distribution. We trained our HyperGAN on MNIST using less than 1.5GB of memory on a single GPU, while CIFAR-10 used just 4GB, making HyperGAN surprisingly scalable.
  In Table 1 we show some statistics of the networks generated by HyperGAN on MNIST. We note that HyperGAN can generate very diverse networks, as the variance of network parameters generated by the HyperGAN is significantly higher than standard training from different random initializations.
sections.heading: 4.2 CLASSIFICATION
sections.text: First we evaluate the classification accuracy of HyperGAN on MNIST and CIFAR-10. Classification serves as an entrance exam into our other experiments, as the distribution we want to learn is over parameters which can effectively solve the classification task. We test with both single network samples, and ensembles. For our ensembles we average predictions from N sampled models with
  the scoring rule p(y|x) = 1N
  ∑N
  n=1 pn(y |x, θn). It should be noted that we did not perform fine tuning, or any additional training on the sampled networks. The results are shown in Table 2. We generate ensembles of different sizes and compare against both Bayesian (Louizos & Welling, 2016) (Krueger et al., 2017) and non-Bayesian (Lakshminarayanan et al., 2017) methods, as well as MC dropout (Gal & Ghahramani, 2016). We outperform all other methods by using a 100 network ensemble, across all datasets. For all other methods, we report the mean of 100 trials.
sections.heading: 4.3 1-D TOY REGRESSION TASK
sections.text: We next evaluate the ability of HyperGAN to fit a simple 1D function from noisy samples. This dataset was first proposed by (Hernández-Lobato & Adams, 2015), and consists of a training set of 20 points drawn uniformly from the interval [−4, 4]. The targets are given by y = x3 + where ∼ N (0, 32). We used the same target architecture as in (Hernández-Lobato & Adams, 2015) Lakshminarayanan et al. (2017) and (Louizos & Welling, 2016): a one layer neural network with 100 hidden units and ReLU nonlinearity. For HyperGAN we use two layer generators, and 128 hidden units across all networks. Because this is a small task, we use only a 64 dimensional latent space. MSE loss is used as our target loss function to train HyperGAN.
  Results in figure 2 show that HyperGAN clearly learns the target function and captures the variation in the data well. In addition, it can be seen that sampling more networks to compose a larger ensemble improves predictive uncertainty as we sample farther from the mean of the training data.
sections.heading: 4.4 ANOMALY DETECTION
sections.text: To test our uncertainty measurements, we perform the same experiments as (Louizos & Welling, 2016) (MNF), (Lakshminarayanan et al., 2017); we measure the total entropy in predictions from HyperGAN-generated networks. We compare our uncertainty measurements with those of MNF and standard ensembles. For MNIST experiments we train a HyperGAN on the MNIST dataset, and test on the notMNIST dataset, which consists of 28x28 binary images of alphabetic letters. In this setting, we want the softmax probabilities on inlier MNIST examples to have maximum entropy - a single large activation close to 1. On off-manifold data we want to have equal probability across predictions. We test our CIFAR-10 model by training on the first 5 classes, and we use the latter
  5 classes as out of distribution examples. To build an estimate of the predictive entropy we sample multiple networks from HyperGAN per example, and measure their predictive entropy..
  In Fig. 3 we show that HyperGAN can separate CIFAR-10 inlier and outlier samples much better than MNF or standard ensembles. HyperGAN is less certain about data it does not recognize, as the probability of a low entropy prediction is overall lower on outliers. On notMNIST we also show separation, though HyperGAN is also overall less confidant about inliers then MNF. Conventionally trained ensembles without the HyperGAN, referred to as L2 networks in the figure, are highly overconfident on outliers and cannot provide a notion of uncertainty.
sections.heading: 4.5 ADVERSARIAL DETECTION
sections.text: We employ the same experimental setup to the detection of adversarial examples, an extreme sort of off-manifold data. Adversarial examples are often optimized to lie within a small neighborhood of a classifier’s decision boundaries. They are created by adding perturbations in the direction of the greatest loss with respect to the model’s parameters. Because HyperGAN learns a distribution over parameters, it should be more robust to attacks. We generate adversarial examples using the Fast Gradient Sign method (FGSM) (Goodfellow et al., 2015) and Projected Gradient Descent (PGD) (Madry et al., 2017). FGSM adds a small perturbation to the target image in the direction of greatest loss. FGSM is known to underfit to the target model, hence it may transfer well across many similar models. In contrast, PGD takes many steps in the direction of greatest loss, producing a stronger adversarial example, at the risk of overfitting to a single set of parameters. This poses the following challenge: to detect attacks by FGSM and PGD, HyperGAN will need to generate diverse parameters to avoid both attacks. To detect adversarial examples, we first hypothesize that a single adversarial example will not fool the entire space of parameters learned by HyperGAN. If we then evaluate adversarial examples against many generated networks, then we should see a high entropy among predictions (softmax probabilities) for any individual class.
  Adversarial examples have been shown to successfully fool ensembles (Dong et al., 2017), but with HyperGAN one can always generate significantly more models that can be added to the ensemble for the cost of one forward pass, making it hard to attack against. In Fig. 4 we test HyperGAN against adversarial examples generated to fool one network. It is shown that while those examples can fool 50%− 70% of the networks generated by HyperGAN, they usually do not fool all of them. We compare the performance of HyperGAN with ensembles of N ∈ {5, 10} models trained on MNIST with normal supervised training. We fuse their logits (unnormalized log probabilities) together as l(x) = ∑N n=1 wnln(x) where wn is the nth model weighting, and ln is the logits of the nth model. In all experiments we consider uniformly weighted ensembles. For HyperGAN we simply sample the generators to create as many models as we need, then we fuse their logits together. Specifically we test ensembles with N ∈ {5, 10, 100, 1000} members each. Adversarial examples are generated by attacking the ensemble directly until the generated image completely fools the ensemble. For HyperGAN, we attack the ensemble, but test with a new ensemble of equal size. For MNF we follow their experimental setup and do not form an ensemble. Rather we attack sampled networks and measure the entropy of their predictions.
  For the purposes of detection, we compute the entropy within the predictive distribution of each of the ensemble members to score the example on the likelihood that it was drawn from the training distribution. Figure 5 shows that HyperGAN clearly identifies adversarial examples as being out-ofdistribution, performing better than MNF as well as standard ensembles. HyperGAN is especially suited to this task as adversarial examples are optimized against parameters - parameters which HyperGAN can change. We find that we can successfully detect over 97% of adversarial examples, with a low false positive rate for both attacks just by thresholding the entropy.
sections.heading: 5 DISCUSSION AND FUTURE DIRECTIONS
sections.text: We have proposed a generative model for parameter selection which performs strongly on detecting out-of-distribution samples as well as classification. Training a GAN to learn a probability distribution over parameters allows us to non-deterministically sample diverse, performant networks which we can use to form ensembles that can give good uncertainty estimates. Our method is ultimately scalable to any number of networks in the predicting ensemble, requiring just one forward pass to generate a new set of parameters and a low GPU memory footprint. We showed that we can generate models with significant variation over the learned distribution and thus provide uncertainty estimates on outlier data. There is still much room for exploration, we believe that HyperGAN may be useful in a variety of domains including meta learning and reinforcement learning.
sections.heading: A APPENDIX
sections.heading: A.1 GENERATED FILTER EXAMPLES
sections.text: We show the first filter in 25 different networks generated by the HyperGAN to illustrate their difference in Fig. 7. It can be seen that qualitatively HyperGAN learns to generate classifiers with a variety of filters.
sections.heading: A.2 OUTLIER EXAMPLES
sections.text: In Figure 7 we show images of examples which do not behave like most of their respective distribution. On top are MNIST images which HyperGAN networks predict to have high entropy. We can see that they are generally ambiguous and do not fit with the rest of the training data. The bottom
  row shows notMNIST examples which score with low entropy according to HyperGAN. It can be seen that these examples look like they could come from the MNIST training distribution, making HyperGAN’s predictions reasonable
sections.heading: A.3 DIVERSITY WITHOUT MIXER OR DISCRIMINATOR
sections.text: We run experiments on both MNIST and CIFAR-10 where we remove both the mixer and the discriminator. Tables 3 and 4 show statistics of the networks generated by HyperGAN using only independent Gaussian samples to the generators. In this setting, HyperGAN learns to generate only a very small distribution of parameters.
sections.heading: A.4 HYPERGAN NETWORK DETAILS
sections.text: In tables 5 and 6 we show how the latent points are transformed through the generators to become a full layer of parameters. For a MNIST based HyperGAN we generate layers from small latent points
  of dimensionality 128. For CIFAR-10 based HyperGANs we use a larger dimensionality of 256 for the latent points.
  Table 6: CIFAR-10 HyperGAN Target Size
  Layer Latent Size Output Layer Size
  Conv 1 256 x 1 16 x 3 x 3 x 3 Conv 2 256 x 1 32 x 16 x 3 x 3 Conv 3 256 x 1 32 x 64 x 3 x 3 Linear 1 256 x 1 256 x 128 Linear 2 256 x 1 128 x 10
sections.heading: A.5 CONNECTIONS TO GANS AND WASSERSTEIN AUTO-ENCODERS
sections.text: Despite being largely applied to the same task of learning probability distributions, implicit generative models such as Generative Adversarial Networks (GAN) and Wasserstein Auto-encoders (WAE) are presented under different frameworks. GANs are a likelihood free density estimator, specifying only a generator, and do not have any notion of reconstruction. WAEs find an optimal transport map between target and model distributions by first encoding samples to a latent space and reconstructing the original data samples using a generator. Even with these differences, many combinations of these models have been proposed. Creating composite models and loss functions from the GAN and WAE building blocks is commonplace.
  HyperGAN is also an implicit generative model, in that there is no explicit data distribution from which to sample from. HyperGAN learns to estimate from the data distribution not from real samples, but from the error of its estimates. We believe that HyperGAN is not just a combination of existing generative models. To show this we give an overview of both GANs and WAE, and contrast HyperGAN to them.
sections.heading: GENERATIVE ADVERSARIAL NETWORKS
sections.text: GANs in the original formulation (Goodfellow et al., 2014) play a minimax game between two neural networks. A generator G : Z → X samples a prior distribution PZ on the latent space Z and attempts to produce outputs from the data distribution X . A discriminator D evaluates samples from X and from G(Z) and outputs a score between [0, 1]. This score given by the discriminator corresponds to how likely the input is to have come from X , according to D. This creates the following minimax game between the generator and the discriminator:
  min G max D Ex∼X [logD(x)] + Ez∼PZ [log 1−D(G(z))] (7)
  The goal of the generator is to learn to transform noise samples into samples which fool the discriminator, thus minimizing the loss on G. While the discriminator tries to maximize its ability to tell real images from fake samples from the generator.
  In contrast, HyperGAN is not a likelihood free model like a GAN. While GANs do not specify an explicit evaluation criterion, HyperGAN minimizes the negative likelihood of the generated parameters with an explicit criterion: the loss on the target task. HyperGAN then has the benefit of a principled quantitative evaluation of its samples, and does not need to rely on metrics like the Inception (Salimans et al., 2016) or FID scores (Heusel et al., 2017) commonly used with GANs.
sections.heading: WASSERSTEIN AUTO-ENCODERS
sections.text: Wasserstein Auto-encoders (WAE) (Tolstikhin et al., 2017) use a similar formulation under the optimal transport framework (Villani, 2008) to minimize the difference between generative model PG and the data distribution PX , where X ∈ X in this case are images. In the WAE, A latent space Z and prior distribution PZ on Z are defined as sample spaces. In general, there is an optimal transport map between PX and PG if the data distribution PX is well distributed according to a prior distribution (in this case PZ). The problem is that the data distribution PX is not a well defined distribution, and so computation of an OT mapping is intractable. To remedy this, an encoder Q : X → Z is used to project points from the data distribution to the latent space. WAE considers the marginal
  distribution Z ∼ Q(Z|X). The conditional Q(Z|X) represents the aggregated posterior QZ : the space of Z which we can optimize over with an encoder. The authors argue that this allows WAE to not have to search over all possible maps PX → PG, but only those originating from the better behaved QZ . The encoder’s aggregated posterior QZ still needs to be distributed according to prior PZ , so a penalty is imposed onQZ to match the mean and covariance of PZ . In principle the penalty term DZ(PZ , QZ) could be any distance between probability distributions. WAE uses either MMD or a discriminator trained with an adversarial loss.
  inf G inf Q(Z|X)∈Q EPXEQ(Z|X) [c(X,G(Z))] + λDZ(PZ , QZ) (8)
  Where c is any measurable cost function measuring the error between the data X and reconstruction G(Z), and λ is a hyperparameter.
  While HyperGAN and WAE use a similar architecture, HyperGAN is not an auto-encoder. As such, HyperGAN replaces the WAE reconstruction cost function c(X,G(Z)) with a term that does not depend on X . Instead, X is hidden, and HyperGAN minimizes the KL divergence between estimates θG ∈ ΘG and the true parameter distribution Θ. Because the Wasserstein distance does not reduce to the KL divergence, we can not exactly compute the optimal transport map:
  inf G inf Q(Z|S)∈Q c[S,G(Z)] (9)
  because we cannot compute the reconstruction cost c. To compute cwe need samples from the target distribution. Instead, we can only approximate the optimal map by minimizing
  inf G inf Q(Z|S)∈Q
  L(F(X;G(Z), Y )). (10)
  Which nonetheless gives us well-behaved samples from a learned distribution of parameters.