Neural networks trained through stochastic gradient descent (SGD) have been around for more than 30 years, but they still escape our understanding. This paper takes an experimental approach, with a divide-and-conquer strategy in mind: we start by studying what happens in single neurons. While being the core building block of deep neural networks, the way they encode information about the inputs and how such encodings emerge is still unknown. We report experiments providing strong evidence that hidden neurons behave like binary classifiers during training and testing. During training, analysis of the gradients reveals that a neuron separates two categories of inputs, which for layers close enough to the output remain impressively constant across training. During testing, we show that the fuzzy, binary partition described above embeds the core information used by the network for its prediction. These observations bring to light some of the core internal mechanics of deep neural networks, and have the potential to guide the next theoretical and practical developments.

--------------------
Review updates:
Rating 6 -> 7
Confidence 2 -> 4
The rebuttal and update addressed a number of my concerns, cleared up confusing sections, and moved the paper materially closer to being publication-worthy, thus I’ve increased my score.
--------------------
I want to love this paper. The results seem like they may be very important. However, a few parts were poorly explained, which led to this reviewer being unable to follow some of the jumps from experimental results to their conclusions. I would like to be able to give this paper the higher score it may deserve, but some parts first need to be further explained.
Unfortunately, the largest single confusion I had is on the first, most basic set of gradient results of section 4.1. Without understanding this first result, it’s difficult to decide to what extent the rest of the paper’s results are to be believed.
Fig 1 shows “the histograms of the average sign of partial derivatives of the loss with respect to activations, as collected over training for a random neuron in five different layers.” Let’s consider the top-left subplot of Fig 1, showing a heavily bimodal distribution (modes near -1 and +1.). Is this plot made using data from a single neuron or from  multiple neurons? For now let’s assume it is for a single neuron, as the caption and text in 4.1 seem to suggest. If it is for a single neuron, then that neuron will have, for a single input example, a single scalar activation value and a single scalar gradient value. The sign of the gradient will either be +1 or -1. If we compute the sign for each input example and then AGGREGATE over all training examples seen by this neuron over the course of training (or a subset for computational reasons), this will give us a list of signs. Let’s collect these signs into a long list: [+1, +1, +1, -1, +1, +1, …]. Now what do we do with this list? As far as I can tell, we can either average it (giving, say, .85 if the list has far more +1 values than -1 values) OR we can show a histogram of the list, which would just be two bars at -1 and +1. But we can’t do both, indicating that some assumption above was incorrect. Which assumption in reading the text was incorrect?
Further in this direction, Section 4.1 claims “Zero partial derivatives are ignored to make the signal more clear.” Are these zero partial derivatives of the post-relu or pre-relu? The text (Sec 3) points to activations as being post-relu, but in this case zero-gradients should be a very small set (only occuring if all neurons on the next layer had either zero pre-relu gradients, which is common for individual neurons but, I would think, not for all at once). Or does this mean the pre-relu gradient is zero, e.g. the common case where the gradient is zeroed because the pre-activation was negative and the relu at that point has zero slope? In this case we would be excluding a large set (about half!) of the gradient values, and it didn’t seem from the context in the paper that this would be desirable.
It would be great if the above could be addressed. Below are some less important comments.
Sec 5.1: great results!
Fig 3: This figure studies “the first and last layers of each network”. Is the last layer really the last linear layer, the one followed by a softmax? In this case there is no relu and the 0 pre-activation is not meaningful (softmax is shift invariant). Or is the layer shown (e.g. “stage3layer2”) the penultimate layer? Minor: in this figure, it would be great if the plots could be labeled with which networks/datasets they are from.
Sec 5.2 states “neuron partitions the inputs in two distinct but overlapping categories of quasi equal size.” This experiment only shows that this is true in aggregate, not for specific neurons? I.e. the partition percent for each neuron could be sampled from U(45, 55) or from U(10, 90) and this experiment would not tell us which, correct? Perhaps this statement could be qualified.
Table 1: “52th percentile vs actual 53 percentile shown”.
> Table 1: The more fuzzy, the higher the percentile rank of the threshold
This is true for the CIFAR net but the opposite is true for ResNet, right?


Achieving machine intelligence requires a smooth integration of perception and reasoning, yet models developed to date tend to specialize in one or the other; sophisticated manipulation of symbols acquired from rich perceptual spaces has so far proved elusive. Consider a visual arithmetic task, where the goal is to carry out simple arithmetical algorithms on digits presented under natural conditions (e.g. hand-written, placed randomly). We propose a two-tiered architecture for tackling this problem. The lower tier consists of a heterogeneous collection of information processing modules, which can include pre-trained deep neural networks for locating and extracting characters from the image, as well as modules performing symbolic transformations on the representations extracted by perception. The higher tier consists of a controller, trained using reinforcement learning, which coordinates the modules in order to solve the high-level task. For instance, the controller may learn in what contexts to execute the perceptual networks and what symbolic transformations to apply to their outputs. The resulting model is able to solve a variety of tasks in the visual arithmetic domain, and has several advantages over standard, architecturally homogeneous feedforward networks including improved sample efficiency.

Summary: This work is a variant of previous work (Zaremba et al. 2016) that enables the use of (noisy) operators that invoke pre-trained neural networks and is trained with Actor-Critic. In this regard it lacks a bit of originality. The quality of the experimental evaluation is not great. The clarity of the paper could be improved upon but is otherwise fine. The existence of previous work (Zaremba et al. 2016) renders this work (including its contributions) not very significant. Relations to prior work are missing. But let's wait for the rebuttal phase.
Pros
-It is confirmed that noisy operators (in the form of neural networks) can be used on the visual arithmetic task
Cons
-Not very novel
-Experimental evaluation is wanting
The focus of this paper is on integrating perception and reasoning in a single system. This is done by specifying an interface that consists of a set of discrete operations (some of which involve perception) and memory slots. A parameterized policy that can make use of these these operations is trained via Actor-Critic to solve some reasoning tasks (arithmetics in this case).
The proposed system is a variant of previous work (Zaremba et al. 2016) on the concept of interfaces, and similarly learns a policy that utilizes such an interface to perform reasoning tasks, such as arithmetics. In fact, the only innovation proposed in this paper is to incorporate some actions that invoke a pre-trained neural network to “read” the symbol from an image, as opposed to parsing the symbol directly. However, there is no reason to expect that this would not function in previous work (Zaremba et al. 2016), even when the network is suboptimal (in which case the operator becomes noisy and the policy should adapt accordingly). Another notable difference is that the proposed system is trained with Actor-Critic as opposed to Q-learning, but this is not further elaborated on by the authors.
The proposed system is evaluated on a visual arithmetics task. The input consists of a 2x2 grid of extended MNIST characters. Each location in the grid then corresponds to the 28 x 28 pixel representation of the digit. Actions include shifting the “fovea” to a different entry of the grid, invoking the digit NN or the operator NN which parse the current grid entry, and some symbolic operations that operate on the memory. The fact that the input is divided into a 2x2 grid severely limits the novelty of this approach compared to previous work (Zaremba et al. 2016). Instead it would have been interesting to randomly spawn digits and operators in a 56 x 56 image and maintain 4 coordinates that specify a variable-sized grid that glimpses a part of the image. This would make the task severely more difficult, given fixed pre-trained networks. The addition of the salience network is unclear to me in the context of MNIST digits, since any pixel that is greater than 0 is salient? I presume that the LSTM uses this operator to evaluate whether the current entry contains a digit or an operator. If so, wouldn’t simply returning the glimpse be enough?
In the experiments the proposed system is compared to three CNNs on two different visual arithmetic tasks, one that includes operators as part of the input and one that incorporates operators only in the tasks description. In all cases the proposed method requires fewer samples to achieve the final performance, although given enough samples all of the CNNs will solve the tasks. This is not surprising as this comparison is rather unfair. The proposed system incorporates pre-trained modules, whose training samples are not taken into account. On the other hand the CNNs are trained from scratch and do not start with the capability to recognize digits or operators. Combined with the observation that all CNNs are able to solve the task eventually, there is little insight in the method's performance that can be gained from this comparison.
Although the visual arithmetics on a 2x2 grid is a toy task it would at least be nice to evaluate some of the policies that are learned by the LSTM (as done by Zaremba) to see if some intuition can be recovered from there. Proper evaluation on a more complex environment (or at least on that does not assume discrete grids) is much desired. When increasing the complexity (even if by just increasing the grid size) it would be good to compare to a recurrent method (Pyramid-LSTM, Pixel-RNN) as opposed to a standard CNN as it lacks memory capabilities and is clearly at a disadvantage compared to the LSTM.
Some detailed comments are:
The introduction invokes evidence from neuroscience to argue that the brain is composed of (discrete) modules, without reviewing any of the counter evidence (there may be a lot, given how bold this claim is).
From the introduction it is unclear why the visual arithmetic task is important.
Several statements including the first sentence lack citations.
The contribution section is not giving any credit to Zaremba et al. (2016) whereas this work is at best a variant of that approach.
In the experiment section the role of the saliency detector is unclear.
Experiment details are lacking and should be included.
The related work section could be more focused on the actual contribution being made.
It strikes me as odd that in the discussion the authors propose to make the entire system differentiable, since this goes against the motivation for this work.
Relation to prior work:
p 1: The authors write: "We also borrow the notion of an interface as proposed in Zaremba et al. (2016). An interface is a designed, task-specific machine that mediates the learning agent’s interaction with the external world, providing the agent with a representation (observation and action spaces) which is intended to be more conducive to learning than the raw representations. In this work we formalize an interface as a separate POMDP I with its own state, observation and action spaces."
This interface terminology for POMDPs was actually introduced in:
J.  Schmidhuber. Reinforcement learning in Markovian and non-Markovian environments. In D. S. Lippman, J. E. Moody, and D. S. Touretzky, editors, Advances in Neural Information Processing Systems 3, NIPS'3, pages 500-506. San Mateo, CA: Morgan Kaufmann, 1991.
p 4: authors write: "For the policy πθ, we employ a Long Short-Term Memory (LSTM)"
Do the authors use the (cited) original LSTM of 1997, or do they also use the forget gates (recurrent units with gates) that most people are using now, often called the vanilla LSTM, by Gers et al (2000)?
p 4: authors write: "One obvious point of comparison to the current work is recent research on deep neural networks designed to learn to carry out algorithms on sequences of discrete symbols. Some of these frameworks, including the Differen-tiable Forth Interpreter (Riedel and Rocktäschel, 2016) and TerpreT (Gaunt et al., 2016b), achieve this by explicitly generating code, while others, including the Neural Turing Machine (NTM; Graves et al., 2014), Neural Random-Access Machine (NRAM; Kurach et al., 2015), Neural Programmer (NP; Neelakan- tan et al., 2015), Neural Programmer-Interpreter (NPI; Reed and De Freitas, 2015) and work in Zaremba et al. (2016) on learning algorithms using reinforcement learning, avoid gen- erating code and generally consist of a controller network that learns to perform actions in a (sometimes differentiable) external computational medium in order to carry out an algorithm."
Here the original work should be mentioned, on differentiable neural stack machines:
G.Z. Sun and H.H. Chen and  C.L. Giles and Y.C. Lee and D. Chen. Connectionist Pushdown Automata that Learn Context-Free Grammars. IJCNN-90, Lawrence Erlbaum, Hillsdale, N.J., p 577, 1990.
Mozer, Michael C and Das, Sreerupa. A connectionist symbol manipulator that discovers the structure of context-free languages. Advances in Neural Information Processing Systems (NIPS), p 863-863, 1993.


In Chinese societies, superstition is of paramount importance, and vehicle license plates with desirable numbers can fetch very high prices in auctions. Unlike other valuable items, license plates are not allocated an estimated price before auction. I propose that the task of predicting plate prices can be viewed as a natural language processing (NLP) task, as the value depends on the meaning of each individual character on the plate and its semantics. I construct a deep recurrent neural network (RNN) to predict the prices of vehicle license plates in Hong Kong, based on the characters on a plate. I demonstrate the importance of having a deep network and of retraining. Evaluated on 13 years of historical auction prices, the deep RNN's predictions can explain over 80 percent of price variations, outperforming previous models by a significant margin. I also demonstrate how the model can be extended to become a search engine for plates and to provide estimates of the expected price distribution.

Summary: The authors take two pages to describe the data they eventually analyze - Chinese license plates (sections 1,2), with the aim of predicting auction price based on the "luckiness" of the license plate number.  The authors mentions other papers that use NN's to predict prices, contrasting them with the proposed model by saying they are usually shallow not deep, and only focus on numerical data not strings. Then the paper goes on to present the model which is just a vanilla RNN, with standard practices like batch normalization and dropout.  The proposed pipeline converts each character to an embedding with the only sentence of description being "Each character is converted by a lookup table to a vector representation, known as character embedding."   Specifics of the data,  RNN training, and the results as well as the stability of the network to hyperparameters is also examined. Finally they find a "a feature vector for each plate by summing up the output of the last recurrent layer overtime." and the use knn on these features to find other plates that are grouped together to try to explain how the RNN predicts the prices of the plates. In section 7,  the RNN is combined with a handcrafted feature model he criticized in a earlier section for being too simple to create an ensemble model that predicts the prices marginally better.
Specific Comments on Sections:
Comments: Sec 1,2
In these sections the author has somewhat odd references to specific economists that seem a little off topic, and spends a little too much time in my opinion setting up this specific data.
Sec 3
The author does not mention the following reference: "Deep learning for stock prediction using numerical and textual information" by Akita et al. that does incorporate non-numerical info to predict stock prices with deep networks.
Sec 4
What are the characters embedded with? This is important to specify. Is it Word2vec or something else? What does the lookup table consist of? References should be added to the relevant methods.
Sec 5
I feel like there are many regression models that could have been tried here with word2vec embeddings that would have been an interesting comparison. LSTMs as well could have been a point of comparison.
Sec 6
 Nothing too insightful is said about the RNN Model.
Sec 7
The ensembling was a strange extension especially with the Woo model given that the other MLP architecture gave way better results in their table.
Overall: This is a unique NLP problem, and it seems to make a lot of sense to apply an RNN here, considering that word2vec is an RNN. However comparisons are lacking and the paper is not presented very scientifically.  The lack of comparisons made it feel like the author cherry picked the RNN to outperform other approaches that obviously would not do well.


Published as a conference paper at ICLR 2018 SPARSE PERSISTENT RNNS: SQUEEZING LARGE RECURRENT NETWORKS ON- CHIP
Recurrent Neural Networks (RNNs) are powerful tools for solving sequence-based problems, but their efficacy and execution time are dependent on the size of the network. Following recent work in simplifying these networks with model pruning and a novel mapping of work onto GPUs, we design an efficient implementation for sparse RNNs. We investigate several optimizations and tradeoffs: Lamport timestamps, wide memory loads, and a bank-aware weight layout. With these optimizations, we achieve speedups of over 6× over the next best algorithm for a hidden layer of size 2304, batch size of 4, and a density of 30%. Further, our technique allows for models of over 5× the size to fit on a GPU for a speedup of 2×, enabling larger networks to help advance the state-of-the-art. We perform case studies on NMT and speech recognition tasks in the appendix, accelerating their recurrent layers by up to 3×.

This paper introduces sparse persistent RNNs, a mechanism to add pruning to the existing work of stashing RNN weights on a chip. The paper describes the use additional mechanisms for synchronization and memory loading.
The evaluation in the main paper is largely on synthetic workloads (i.e. large layers with artificial sparsity).  With evaluation largely over layers instead of applications, I was left wondering whether there is an actual benefit on real workloads. Furthermore, the benefit over dense persistent RNNs for OpenNMT application (of absolute 0.3-0.5s over dense persistent rnns?) did not appear significant unless you can convince me otherwise.
Storing weights persistent on chip should give a sharp benefit when all weights fit on the chip. One suggestion I have to strengthen the paper is to claim that due to pruning, now you can support a larger number of methods or method configurations and to provide examples of those.
To summarize, the paper adds the ability to support pruning over persistent RNNs. However, Narang et. al., 2017 already explore this idea, although briefly. Furthermore, the gains from the sparsity appear rather limited over real applications. I would encourage the authors to put the NMT evaluation in the main paper (and perhaps add other workloads). Furthermore, a host of techniques are discussed (Lamport timestamps, memory layouts) and implementing them on GPUs is not trivial. However, these are well known and the novelty or even the experience of implementing these on GPUs should be emphasized.


DEFENSE-GAN: PROTECTING CLASSIFIERS AGAINST ADVERSARIAL ATTACKS USING GENERATIVE MODELS
In recent years, deep neural network approaches have been widely adopted for machine learning tasks, including classification. However, they were shown to be vulnerable to adversarial perturbations: carefully crafted small perturbations can cause misclassification of legitimate images. We propose Defense-GAN, a new framework leveraging the expressive capability of generative models to defend deep neural networks against such attacks. Defense-GAN is trained to model the distribution of unperturbed images. At inference time, it finds a close output to a given image which does not contain the adversarial changes. This output is then fed to the classifier. Our proposed method can be used with any classification model and does not modify the classifier structure or training procedure. It can also be used as a defense against any attack as it does not assume knowledge of the process for generating the adversarial examples. We empirically show that Defense-GAN is consistently effective against different attack methods and improves on existing defense strategies.

The authors describe a new defense mechanism against adversarial attacks on classifiers (e.g., FGSM). They propose utilizing Generative Adversarial Networks (GAN), which are usually used for training generative models for an unknown distribution, but have a natural adversarial interpretation. In particular, a GAN consists of a generator NN G which maps a random vector z to an example x, and a discriminator NN D which seeks to discriminate between an examples produced by G and examples drawn from the true distribution. The GAN is trained to minimize the max min loss of D on this discrimination task, thereby producing a G (in the limit) whose outputs are indistinguishable from the true distribution by the best discriminator.
Utilizing a trained GAN, the authors propose the following defense at inference time. Given a sample x (which has been adversarially perturbed), first project x onto the range of G by solving the minimization problem z* = argmin_z ||G(z) - x||_2. This is done by SGD. Then apply any classifier trained on the true distribution on the resulting x* = G(z*).
In the case of existing black-box attacks, the authors argue (convincingly) that the method is both flexible and empirically effective. In particular, the defense can be applied in conjunction with any classifier (including already hardened classifiers), and does not assume any specific attack model. Nevertheless, it appears to be effective against FGSM attacks, and competitive with adversarial training specifically to defend against FGSM.
The authors provide less-convincing evidence that the defense is effective against white-box attacks. In particular, the method is shown to be robust against FGSM, RAND+FGSM, and CW white-box attacks. However, it is not clear to me that the method is invulnerable to novel white-box attacks. In particular, it seems that the attacker can design an x which projects onto some desired x* (using some other method entirely), which then fools the classifier downstream.
Nevertheless, the method is shown to be an effective tool for hardening any classifier against existing black-box attacks
(which is arguably of great practical value). It is novel and should generate further research with respect to understanding its vulnerabilities more completely.
Minor Comments:
The sentence starting “Unless otherwise specified…” at the top of page 7 is confusing given the actual contents of Tables 1 and 2, which are clarified only by looking at Table 5 in the appendix. This should be fixed.


Neural architecture search (NAS), the task of finding neural architectures automatically, has recently emerged as a promising approach for discovering better models than ones designed by humans alone. However, most success stories are for vision tasks and have been quite limited for text, except for a small language modeling datasets. In this paper, we explore NAS for text sequences at scale, by first focusing on the task of language translation and later extending to reading comprehension. We conduct extensive searches over the recurrent cells and attention similarity functions for standard sequence-to-sequence models across two translation tasks, IWSLT English-Vietnamese and WMT German-English. We report challenges in performing cell searches as well as demonstrate initial success on attention searches with translation improvements over strong baselines. In addition, we show that results on attention searches are transferable to reading comprehension on the SQuAD dataset.

This paper proposes a method to find an effective structure of RNNs and attention mechanisms by searching programs over the stack-oriented execution engine.
Although the new point in this paper looks only the representation paradigm of each program: (possibly variable length) list of the function applications, that could be a flexible framework to find a function without any prior structures like Fig.1-left.
However, the design of the execution engine looks not well-designed. E.g., authors described that the engine ignores the binary operations that could not be executed at the time. But in my thought, such operations should not be included in the set of candidate operations, i.e., the set of candidates should be constrained directly by the state of the stack.
Also, including repeating "identity" operations (in the candidates of attention operations) seems that some unnecessary redundancy is introduced into the search space. The same expressiveness could be achieved by predicting a special token only once at the end of the sequence (namely, "end-of-sequence" token as just same as usual auto-regressive RNN-based decoder models).
Comparison in experiments looks meaningless. Score improvement is slight nevertheless authors paid much computation cost for searching accurate network structures. The conventional method (Zoph&Le,17) in row 3 of Table 1 looks not comparable with proposed methods because it is trained by an out-of-domain task (LM) using conventional (tree-based) search space. Authors should at least show the result by applying the conventional search space to the tasks of this paper.
In Table 2, the "our baseline" looks cheap because the dot product is the least attention model in those proposed in past studies.
The catastrophic score drop in the rows 5 and 7 in Table 1 looks interesting, but the paper does not show enough comprehension about this phenomenon, which makes the proposed method hard to apply other tasks.
The same problem exists in the setting of the hyperparameters in the reward functions. According to the footnote, there are largely different settings about the value of \beta, which suggest a sensitivity by changing this parameter. Authors should provide some criterion to choose these hyperparameters.


In the adversarial-perturbation problem of neural networks, an adversary starts with a neural network model F and a point x that F classifies correctly, and applies a small perturbation to x to produce another point x that F classifies incorrectly. In this paper, we propose taking into account the inherent confidence information produced by models when studying adversarial perturbations, where a natural measure of "confidence" is F (x) ∞ (i.e. how confident F is about its prediction?). Motivated by a thought experiment based on the manifold assumption, we propose a "goodness property" of models which states that confident regions of a good model should be well separated. We give formalizations of this property and examine existing robust training objectives in view of them. Interestingly, we find that a recent objective by Madry et al. encourages training a model that satisfies well our formal version of the goodness property, but has a weak control of points that are wrong but with low confidence. However, if Madry et al.'s model is indeed a good solution to their objective, then good and bad points are now distinguishable and we can try to embed uncertain points back to the closest confident region to get (hopefully) correct predictions. We thus propose embedding objectives and algorithms, and perform an empirical study using this method. Our experimental results are encouraging: Madry et al.'s model wrapped with our embedding procedure achieves almost perfect success rate in defending against attacks that the base model fails on, while retaining good generalization behavior.

The authors argue that "good" classifiers naturally represent the classes in a classification as well-separated manifolds, and that adversarial examples are low-confidence examples lying near to one of these manifolds. The authors suggest "fixing" adversarial examples by projecting them back to the manifold, essentially by finding a point near the adversarial example that has high confidence.
There are numerous issues here, which taken together, make the whole story pretty unconvincing.
The term "manifold" is used very sloppily. To be fair, this is unfortunately common in modern machine learning. An actual manifold is a specific mathematical structure with specific properties. In ML, what is generally hypothesized is that the data (often per class) lives "near" to some "low-dimensional" structure. In this paper, even the low-dimensionality isn't used --- the "manifold assumption" is used as a stand-in for "the regions associated with different classes are well-separated." (This is partially discussed in Section 6, where the authors point out correctly that the same defense as used here could be used with a 1-nn model.) This is fine as far as it goes, but the paper refs Basri & Jacobs 2016 multiple times as if it says anything relevant about this paper: Basri & Jacobs is specifically about the ability of deep nets to fit data that falls on (actual, mathematical) manifolds. This reference doesn't add much to the present story.
The essential argument of the paper rests on the "Postulate: (A good model) F is confident on natural points drawn from the manifolds, but has low confidence on points outside of the manifolds."
This postulate is sloppy and speculative. For instance, taken in its strong form, if believe the postulate, then a good model:
1. Can classify all "natural points" from all classes with 100% accuracy.
2. Can detect adversarial points with 100% accuracy because all high-confidence points are correct classifications and all low-confidence points are adversarial.
3. All adversarial examples will be low-confidence.
Point 1 makes it clear that no good model F fully satisfying the postulate exists --- models never achieve 100% accuracy on difficult real-world distributions. But the method for dealing with adversarial examples seems to require Points 2 and 3 being true.
To be fair, the paper more-or-less admits that how true these points are is not known and is important. Nevertheless, I think this paper comes pretty close to arguing something that I *think* is not true, and doesn't do much to back up its argument. Because of the quality of the writing (generally sloppy), it's hard to tell, but I believe the authors are basically arguing that:
a. You can generally easily detect adversarial points because they are low confidence.
b. If you go through a procedure to find a point near your adversarial point that is high-confidence, you'll get the "correct" (or perhaps "original") class back.
I think b follows from a, but a is extremely suspect. I do not personally work in adversarial examples, and briefly looking at the literature, it seems that most authors *do* focus on how something is classified and not its confidence, but I don't think it's *that* hard to generate high-confidence adversarial examples. Early work by Goodfellow et al. ("Explaining and Harnessing Adversarial Examples", Figure 1, shows an example where the incorrect classification has very high confidence. The present paper only uses Carlini-Wagner attacks. From a read of Carlini-Wagner, it seems they are heavily concerned with finding *minimal* perturbations to achieve a given misclassification; this will of course produce low-confidence adversaries, but I see no reason why this is a general property of all adversarial examples.
The experiments are weak. I applaud the authors for mentioning the experiments are very preliminary, but that doesn't make them any less weak.
What are we to make of the one image discussed at the end of Section 5 and shown in Figure 1? The authors note that the original image gives low-confidence for the correct class. (Does this mean that the classifier isn't "good"? Is it evidence against some kind of manifold assumption?) The authors note the adversarial category has significantly higher confidence, and say "in this case, it seems that it is the vagueness of the signals/data that lead to a natural difficulty." But the signals and data are ALWAYS vague. If they weren't, machine learning would be easy. This paper proposes something, looks at a tiny number of examples, and already finds a counterexample to the theory. What's the evidence *for* the theory?
A lot of writing is given over to how this method is "semantic", and I just don't buy it. The connection to manifolds is weak. The basic argument here is really "(1) If our classifiers produce smooth well-separated high-confidence regions, (2) then we can detect adversaries because they're low-confidence, and (3) we can correct adversaries by projecting them back to high-confidence." (1) seems vastly unlikely to me based on all my experience: neural nets often get things wrong, they often get things wrong with high confidence, and when they're right, the confidence is at least sometimes low. The authors use a sloppy postulate about good models and so could perhaps argue I've never seen a good model, but the methods of this paper require a good model. (2) seems to follow logically from (1). (3) is also suspect --- perturbations which are *minimal* can be corrected as this paper does (and Carlini-Wagner attacks are minimal by design), but there's no reason to expect general perturbations to be minimal.
The writing is poor throughout. It's generally readable, but the wordings are often odd, and sometimes so odd it's hard to tell what was meant. For instance, I spent awhile trying to decide whether the authors assumed common classifiers are "good" (according to the postulate) or whether this paper was about a way to *make* classifiers good (I eventually decided the former).


Published as a conference paper at ICLR 2018 LEARN TO PAY ATTENTION
We propose an end-to-end-trainable attention module for convolutional neural network (CNN) architectures built for image classification. The module takes as input the 2D feature vector maps which form the intermediate representations of the input image at different stages in the CNN pipeline, and outputs a 2D matrix of scores for each map. Standard CNN architectures are modified through the incorporation of this module, and trained under the constraint that a convex combination of the intermediate 2D feature vectors, as parameterised by the score matrices, must alone be used for classification. Incentivised to amplify the relevant and suppress the irrelevant or misleading, the scores thus assume the role of attention values. Our experimental observations provide clear evidence to this effect: the learned attention maps neatly highlight the regions of interest while suppressing background clutter. Consequently, the proposed function is able to bootstrap standard CNN architectures for the task of image classification, demonstrating superior generalisation over 6 unseen benchmark datasets. When binarised, our attention maps outperform other CNN-based attention maps, traditional saliency maps, and top object proposals for weakly supervised segmentation as demonstrated on the Object Discovery dataset. We also demonstrate improved robustness against the fast gradient sign method of adversarial attack.

This paper proposes a network with the standard soft-attention mechanism for classification tasks, where the global feature is used to attend on multiple feature maps of local features at different intermediate layers of CNN. The attended features at different feature maps are then used to predict the final classes by either concatenating features or ensembling results from individual attended features. The paper shows that the proposed model outperforms the baseline models in classification and weakly supervised segmentation.
Strength:
- It is interesting idea to use the global feature as a query in the attention mechanism while classification tasks do not naturally involve a query unlike other tasks such as visual question answering and image captioning.
- The proposed model shows superior performances over GAP in multiple tasks.
Weakness:
- There are a lot of missing references. There have been a bunch of works using the soft-attention mechanism in many different applications including visual question answering [A-C], attribute prediction [D], image captioning [E,F] and image segmentation [G]. Only two previous works using the soft-attention (Bahdanau et al., 2014; Xu et al., 2015) are mentioned in Introduction but they are not discussed while other types of attention models (Mnih et al., 2014; Jaderberg et al., 2015) are discussed more.
- Section 2 lacks discussions about related work but is more dedicated to emphasizing the contribution of the paper.
- The global feature is used as the query vector for the attention calculation. Thus, if the global feature contains information for a wrong class, the attention quality should be poor too. Justification on this issue can improve the paper.
- [H] reports the performance on the fine-grained bird classification using different type of attention mechanism. Comparison and justification with this method can improve the paper. The performance in [H] is almost 10 % point higher accuracy than the proposed model.
- In the segmentation experiments, the models are trained on extremely small images, which is unnatural in segmentation scenarios. Experiments on realistic settings should be included. Moreover, [G] introduces a method of using an attention model for segmentation, while the paper does not contain any discussion about it.
Overall, I am concerned that the proposed model is not well discussed with important previous works. I believe that the comparisons and discussions with these works can greatly improve the paper.
I also have some questions about the experiments:
- Is there any reasoning why we have to simplify the concatenation into an addition in Section 3.2? They are not equivalent.
- When generating the fooling images of VGG-att, is the attention module involved, or do you use the same fooling images for both VGG and VGG-att?
Minor comments:
- Fig. 1 -> Fig. 2 in Section 3.1. If not, Fig. 2 is never referred.
References
[A] Huijuan Xu and Kate Saenko. Ask, attend and answer: Exploring question-guided spatial attention for visual question answering. In ECCV, 2016.
[B] Zichao Yang, Xiaodong He, Jianfeng Gao, Li Deng, and Alex Smola. Stacked attention networks for image question answering. In CVPR, 2016.
[C] Jacob Andreas, Marcus Rohrbach, Trevor Darrell, and Dan Klein. Deep compositional question answering with neural module networks. In CVPR, 2016.
[D] Paul Hongsuck Seo, Zhe Lin, Scott Cohen, Xiaohui Shen, and Bohyung Han. Hierarchical attention networks. arXiv preprint arXiv:1606.02393, 2016.
[E] Quanzeng You, Hailin Jin, Zhaowen Wang, Chen Fang, and Jiebo Luo. Image captioning with semantic attention. In CVPR, 2016.
[F] Jonghwan Mun, Minsu Cho, and Bohyung Han. Text-Guided Attention Model for Image Captioning. AAAI, 2017.
[G] Seunghoon Hong, Junhyuk Oh, Honglak Lee and Bohyung Han, Learning Transferrable Knowledge for Semantic Segmentation with Deep Convolutional Neural Network, In CVPR, 2016.
[H] Max Jaderberg, Karen Simonyan, Andrew Zisserman, Koray Kavukcuoglu, Spatial Transformer Networks, NIPS, 2015


The paper proposes and demonstrates a Deep Convolutional Neural Network (DCNN) architecture to identify users with disguised face attempting a fraudulent ATM transaction. The recent introduction of Disguised Face Identification (DFI) framework Singh et al. (2017) proves the applicability of deep neural networks for this very problem. All the ATMs nowadays incorporate a hidden camera in them and capture the footage of their users. However, it is impossible for the police to track down the impersonators with disguised faces from the ATM footage. The proposed deep convolutional neural network is trained to identify, in real time, whether the user in the captured image is trying to cloak his identity or not. The output of the DCNN is then reported to the ATM to take appropriate steps and prevent the swindler from completing the transaction. The network is trained using a dataset of images captured in similar situations as of an ATM. The comparatively low background clutter in the images enables the network to demonstrate high accuracy in feature extraction and classification for all the different disguises.

As one can see by the title, the originality (application of DCNN) and significance (limited to ATM domain) is very limited. If this is still enough for ICLR, the paper could be okay. However, even so one can clearly see that the architecture, the depth, the regularization techniques, and the evaluation are clearly behind the state of the art. Especially for this problem domain, drop-out and data augmentation should be investigated.
Only one dataset is used for the evaluation and it seems to be very limited and small. Moreover, it seems that the same subjects (even if it is other pictures) may appear in the training set and test set as they were randomly selected. Looking into the referece (to get the details of the dataset -  from a workshop of the IEEE International Conference on Computer Vision Workshops (ICCVW) 2017) reveals, that it has only 25 subjects and 10 disguises. This makes it even likely that the same subject with the same disguise appears in the training and test set.
A very bad manner, which unfortunately is often performed by deep learning researchers with limited pattern recognition background, is that the accuracy on the test set is measured for every timestamp and finally the highest accuracy is reported. As such you perform an optimization of the paramerter #iterations on the test set, making it a validation set and not an independent test set.
Minor issues:
make sure that the capitalization in the references is correct (ATM should be capital, e.g., by putting {ATM} - and many more things).


APPRENTICE: USING KNOWLEDGE DISTILLATION TECHNIQUES TO IMPROVE LOW-PRECISION NET- WORK ACCURACY
Deep learning networks have achieved state-of-the-art accuracies on computer vision workloads like image classification and object detection. The performant systems, however, typically involve big models with numerous parameters. Once trained, a challenging aspect for such top performing models is deployment on resource constrained inference systems -the models (often deep networks or wide networks or both) are compute and memory intensive. Low-precision numerics and model compression using knowledge distillation are popular techniques to lower both the compute requirements and memory footprint of these deployed models. In this paper, we study combination of these two techniques and show that the performance of low-precision networks can be significantly improved by using knowledge distillation techniques. Our approach, Apprentice, achieves state-of-the-art accuracies using ternary precision and 4-bit precision for variants of ResNet architecture on ImageNet dataset. We present three schemes using which one can apply knowledge distillation techniques to various stages of the train-and-deploy pipeline.

The authors investigate knowledge distillation as a way to learn low precision networks. They propose three training schemes to train a low precision student network from a teacher network. They conduct experiments on ImageNet-1k with variants of ResNets and multiple low precision regimes and compare performance with previous works
Pros:
(+) The paper is well written, the schemes are well explained
(+) Ablations are thorough and comparisons are fair
Cons:
(-) The gap with full precision models is still large
(-) Transferability of the learned low precision models to other tasks is not discussed
The authors tackle a very important problem, the one of learning low precision models without comprosiming performance. For scheme-A, the authors show the performance of the student network under many low precision regimes and different depths of teacher networks. One observation not discussed by the authors is that the performance of the student network under each low precision regime doesn't improve with deeper teacher networks (see Table 1, 2 & 3). As a matter of fact, under some scenarios performance even decreases.
The authors do not discuss the gains of their best low-precision regime in terms of computation and memory.
Finally, the true applications for models with a low memory footprint are not necessarily related to image classification models (e.g. ImageNet-1k). How good are the low-precision models trained by the authors at transferring to other tasks? Is it possible to transfer student-teacher training practices to other tasks?


CRITICAL POINTS OF LINEAR NEURAL NETWORKS: ANALYTICAL FORMS AND LANDSCAPE PROPERTIES
Due to the success of deep learning to solving a variety of challenging machine learning tasks, there is a rising interest in understanding loss functions for training neural networks from a theoretical aspect. Particularly, the properties of critical points and the landscape around them are of importance to determine the convergence performance of optimization algorithms. In this paper, we provide a necessary and sufficient characterization of the analytical forms for the critical points (as well as global minimizers) of the square loss functions for linear neural networks. We show that the analytical forms of the critical points characterize the values of the corresponding loss functions as well as the necessary and sufficient conditions to achieve global minimum. Furthermore, we exploit the analytical forms of the critical points to characterize the landscape properties for the loss functions of linear neural networks and shallow ReLU networks. One particular conclusion is that: While the loss function of linear networks has no spurious local minimum, the loss function of one-hidden-layer nonlinear networks with ReLU activation function does have local minimum that is not global minimum.

This paper studies the critical points of shallow and deep linear networks. The authors give a (necessary and sufficient) characterization of the form of critical points and use this to derive necessary and sufficient conditions for which critical points are global optima. Essentially this paper revisits a classic paper by Baldi and Hornik (1989) and relaxes a few requires assumptions on the matrices. I have not checked the proofs in detail but the general strategy seems sound. While the exposition of the paper can be improved in my view this is a neat and concise result and merits publication in ICLR. The authors also study the analytic form of critical points of a single-hidden layer ReLU network. However, given the form of the necessary and sufficient conditions the usefulness of of these results is less clear.
Detailed comments:
- I think in the title/abstract/intro the use of Neural nets is somewhat misleading as neural nets are typically nonlinear. This paper is mostly about linear networks. While a result has been stated for single-hidden ReLU networks. In my view this particular result is an immediate corollary of the result for linear networks. As I explain further below given the combinatorial form of the result, the usefulness of this particular extension to ReLU network is not very clear. I would suggest rewording title/abstract/intro
- Theorem 1 is neat, well done!
- Page 4 p_i’s in proposition 1
From my understanding the p_i have been introduced in Theorem 1 but given their prominent role in this proposition they merit a separate definition (and ideally in terms of the A_i directly).
- Theorems 1, prop 1, prop 2, prop 3, Theorem 3, prop 4 and 5
	Are these characterizations computable i.e. given X and Y can one run an algorithm to find all the critical points or at least the parameters used in the characterization p_i, V_i etc?
- Theorems 1, prop 1, prop 2, prop 3, Theorem 3, prop 4 and 5
	Would recommend a better exposition why these theorems are useful. What insights do you gain by knowing these theorems etc. Are less sufficient conditions that is more intuitive or useful. (an insightful sufficient condition in some cases is much more valuable than an unintuitive necessary and sufficient one).
- Page 5 Theorem 2
	Does this theorem have any computational implications? Does it imply that the global optima can be found efficiently, e.g. are saddles strict with a quantifiable bound?
- Page 7 proposition 6 seems like an immediate consequence of Theorem 1 however given the combinatorial nature of the K_{I,J} it is not clear why this theorem is useful. e.g . back to my earlier comment w.r.t. Linear networks given Y and X can you find the parameters of this characterization with a computationally efficient algorithm?


Prior work on speech and audio processing has demonstrated the ability to obtain excellent performance when learning directly from raw audio waveforms using convolutional neural networks (CNNs). However, the exact inner workings of a CNN remain unclear, which hinders further developments and improvements into this direction. In this paper, we theoretically analyze and explain how deep CNNs learn from raw audio waveforms and identify potential limitations of existing network structures. Based on this analysis, we further propose a new network architecture (called SimpleNet), which offers a very simple but concise structure and high model interpretability.

The paper proposes a CNN-based based approach for speech processing using raw waveforms as input. An analysis of convolution and pooling layers applied on waveforms is first presented. An architecture called SimpleNet is then presented and evaluated on two speech tasks: emotion recognition and gender classification.
This paper propose a theoretical analysis of convolution and pooling layers to motivate the SimpleNet architecture. To my understanding, the analysis is flawed (see comments below). The SimpleNet approach is interesting but not sufficiently backed with experimental results. The network analysis is minimal and provides almost no insights. I therefore recommend to reject the paper.
Detailed comments:
Section 1:
* “Therefore, it remains unknown what actual features CNNs learn from waveform”. This is not true, several works on speech recognition have shown that a convolution layer taking raw speech as input can be seen as a bank of learned filters. For instance in the context of speech recognition, [9] showed that the filters learn phoneme-specific responses, [10] showed that the learned filters are close to Mel filter banks and [7] showed that the learned filters are related to MRASTA features and Gabor filters. The authors should discuss these previous works in the paper.
Section 2:
* Section 2.1 seems unnecessary, I think it’s safe to assume that the Shannon-Nyquist theorem and the definition of convolution are known by the reader.
* Section 2.2.2 & 2.2.3: I don't follow the justification that stacking convolutions are not needed: the example provided is correct if two convolutions are directly stacked without non-linearity, but the conclusion does not hold with a non-linearity and/or a pooling layer between the convolutions: two stacked convolutions with non-linearities are not equivalent to a single convolution. To my understanding, the same problem is present for the pooling layer: the presented conclusion that pooling introduces aliasing is only valid for two directly stacked pooling layers and is not correct for stacked blocks of convolution/pooling/non-linearity.
* Section 2.2.5: The ReLU can be seen as a half-wave rectifier if it is applied directly to the waveform. However, it is usually not the case as it is applied on the output of the convolution and/or pooling layers. Therefore I don’t see the point of this section.
* Section 2.2.6: In this section, the authors discuss the differences between spectrogram-based and waveforms-based approaches, assuming that spectrogram-based approach have fixed filters. But spectrogram can also be used as input to CNNs (i.e. using learned filters) for instance in speech recognition [1] or emotion recognition [11]. Thus the comparison could be more interesting if it was between spectrogram-based and raw waveform-based approaches when the filters are learned in both cases.
Section 3:
* Figure 4 is very interesting, and is in my opinion a stronger motivation for SimpleNet that the analysis presented in Section 2.
* Using known filterbanks such as Mel or Gammatone filters as initialization point for the convolution layer is not novel and has been already investigated in [7,8,10] in the context of speech recognition.
Section 4:
* On emotion recognition, the results show that the proposed approach is slightly better, but there is some issues: the average recall metric is usually used for this task due to class imbalance (see [1] for instance). Could the authors provide results with this metric ? Also IEMOCAP is a well-used corpus for this task, could the authors provide some baselines performance for comparison (e.g. [11]) ?
* For gender classification, there is no gain from SimpleNet compared to the baselines. The authors also mention that some utterances have overlapping speech. These utterances are easy to find from the annotations provided with the corpus, so it should be easy to remove them for the train and test set. Overall, in the current form, the results are not convincing.
* Section 4.3: The analysis is minimal: it shows that filters changed after training (as already presented in Figure 4). I don't follow completely the argument that the filters should focus on low frequency. It is more informative, but one could expect that the filters will specialized, thus some of them will focus on high frequencies, to model the high frequency events such as consonants or unvoiced event.
It could be very interesting to relate the learned filters to the labels: are some filters learned to model specific emotions ? For gender classification, are some filters focusing on the average pitch frequency of male and female speaker ?
* Finally, it would be nice to see if the claims in Section 2 about the fact that only one convolution layer is needed and that stacking pooling layers can hurt the performance are verified experimentally: for instance, experiments with more than one pair of convolution/pooling could be presented.
Minor comments:
* More references for raw waveforms-based approach for speech recognition should be added [3,4,6,7,8,9] in the introduction.
* I don’t understand the first sentence of the paper: “In the field of speech and audio processing, due to the lack of tools to directly process high dimensional data …”. Is this also true for any pattern recognition fields ?
* For the MFCCs reference in 2.2.2, the authors should cite [12].
* Figure 6: Only half of the spectrum should be presented.
References:
[1] H. Lee, P. Pham, Y. Largman, and A. Y. Ng. Unsupervised feature learning for audio classification using convolutional deep belief networks. In Advances in Neural Information Processing Systems 22, pages 1096–1104, 2009.
[2] Schuller, Björn, Stefan Steidl, and Anton Batliner. "The interspeech 2009 emotion challenge." Tenth Annual Conference of the International Speech Communication Association. 2009.
[3] N. Jaitly, G. Hinton, Learning a better representation of speech sound waves using restricted Boltzmann machines, in: Proceedings of the IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), 2011, pp. 5884–5887.
[4] D. Palaz, R. Collobert, and M. Magimai.-Doss. Estimating Phoneme Class Conditional Probabilities from Raw Speech Signal using Convolutional Neural Networks, INTERSPEECH 2013, pages 1766–1770.
[5] Van den Oord, Aaron, Sander Dieleman, and Benjamin Schrauwen. "Deep content-based music recommendation." Advances in neural information processing systems. 2013.
[6] Z.Tuske, P.Golik, R.Schluter, H.Ney, Acoustic Modeling with Deep Neural Networks Using Raw Time Signal for LVCSR,
in: Proceedings of the Annual Conference of the International Speech Communication Association (INTERSPEECH), Singapore, 2014, pp. 890–894.
[7] P. Golik, Z. Tuske, R. Schlu ̈ter, H. Ney, Convolutional Neural Networks for Acoustic Modeling of Raw Time Signal in LVCSR, in: Proceedings of the Annual Conference of the International Speech Communication Association (INTERSPEECH), 2015, pp. 26–30.
[8] Yedid Hoshen and Ron Weiss and Kevin W Wilson, Speech Acoustic Modeling from Raw Multichannel Waveforms, International Conference on Acoustics, Speech, and Signal Processing, 2015.
[9] D. Palaz, M. Magimai-Doss, and R. Collobert. Analysis of CNN-based Speech Recognition System using Raw Speech as Input, INTERSPEECH 2015, pages 11–15.
[10] T. N. Sainath, R. J. Weiss, A. Senior, K. W. Wilson, and O. Vinyals. Learning the Speech Front-end With Raw Waveform CLDNNs. Proceedings of the Annual Conference of the International Speech Communication Association (INTERSPEECH), 2015.
[11] Satt, Aharon & Rozenberg, Shai & Hoory, Ron. (2017). Efficient Emotion Recognition from Speech Using Deep Learning on Spectrograms. 1089-1093. Interspeech 2017.
[12] S. Davis and P. Mermelstein. Comparison of parametric representations for monosyllabic word recognition in continuously spoken sentences. IEEE Transactions on Acoustics, Speech and Signal Processing, 28(4):357–366, 1980.


Deep neural networks are able to solve tasks across a variety of domains and modalities of data. Despite many empirical successes, we lack the ability to clearly understand and interpret the learned mechanisms that contribute to such effective behaviors and more critically, failure modes. In this work, we present a general method for visualizing an arbitrary neural network's inner mechanisms and their power and limitations. Our dataset-centric method produces visualizations of how a trained network attends to components of its inputs. The computed "attention masks" support improved interpretability by highlighting which input attributes are critical in determining output. We demonstrate the effectiveness of our framework on a variety of deep neural network architectures in domains from computer vision and natural language processing. The primary contribution of our approach is an interpretable visualization of attention that provides unique insights into the network's underlying decision-making process irrespective of the data modality.

The authors of this paper proposed a data-driven black-box visualization scheme. The paper primarily focuses on neural network models in the experiment section. The proposed method iteratively optimize learnable masks for each training example to find the most relevant content in the input that was "attended" by the neural network.  The authors empirically demonstrated their method on image and text classification tasks.
Strength:
           - The paper is well-written and easy to follow.
           - The qualitative analysis of the experimental results nicely illustrated how the learnt latent attention masks match with our intuition about how neural networks make its classification predictions.
        Weakness:
           - Most of the experiments in the paper are performed on small neural networks and simple datesets. I found the method will be more compiling if the authors can show visualization results on ImageNet models. Besides simple object recognition tasks, other more interesting tasks to test out the proposed visualization method are object detection models like end-to-end fast R-CNN, video classification models, and image-captioning models. Overall, the current set of experiments are limited to showcase the effectiveness of the proposed method.
           - It is unclear how the hyperparameter is chosen for the proposed method. How does the \beta affect the visualization quality? It would be great to show a range of samples from high to low beta values. Does it require tuning for different visualization samples? Does it vary over different datasets?


Published as a conference paper at ICLR 2018 GENERATIVE NETWORKS AS INVERSE PROBLEMS WITH SCATTERING TRANSFORMS
Generative Adversarial Nets (GANs) and Variational Auto-Encoders (VAEs) provide impressive image generations from Gaussian white noise, but the underlying mathematics are not well understood. We compute deep convolutional network generators by inverting a fixed embedding operator. Therefore, they do not require to be optimized with a discriminator or an encoder. The embedding is Lipschitz continuous to deformations so that generators transform linear interpolations between input white noise vectors into deformations between output images. This embedding is computed with a wavelet Scattering transform. Numerical experiments demonstrate that the resulting Scattering generators have similar properties as GANs or VAEs, without learning a discriminative network or an encoder.

The paper proposes a generative model for images that does no require to learn a discriminator (as in GAN’s) or learned embedding. The proposed generator is obtained by learning an inverse operator for a scattering transform.
The paper is well written and clear. The main contribution of the work is to show that one can design an embedding with some desirable properties and recover, to a good degree, most of the interesting aspects of generative models. However, the model doesn’t seem to be able to produce high quality samples. In my view, having a learned pseudo-inverse for scattering coefficients is interesting on its own right. The authors should show more clearly the generalization capabilities to test samples. Is the network able to invert images that follow the train distribution but are not in the training set?
As the authors point out, the representation is non-invertible. It seems that using an L2 loss in pixel space for training the generator would necessarily lead to blurred reconstructions (and samples) (as it produces a point estimate). Unless the generator overfits the training data, but then it would not generalize. The reason being that many images would lie in the level set for a given feature vector, and the generator cannot deterministically disambiguate which one to match.
The sampling method described in Section 3.2 does not suffer from this problem, although as the authors point out, a good initialization is required. Would it make sense to combine the two? Use the generator network to produce a good initial condition and then refine it with the iterative procedure.
This property is exploited in the conditional generation setting in:
Bruna, J. et al "Super-resolution with deep convolutional sufficient statistics." arXiv preprint arXiv:1511.05666 (2015).
The samples produced by the model are of poorer quality than those obtained with GAN’s. Clearly the model is assigning mass to regions of the space where there are not valid images.  (similar effect that suffer models train with MLE). Could you please comment on this point?
The title is a bit misleading in my view. “Analyzing GANs” suggests analyzing the model in general, this is, its architecture and training method (e.g. loss functions etc). However the analysis concentrates in the structure of the generator and the particular case of inverting scattering coefficients.
However, I do find very interesting the analysis provided in Section 3.2. The idea of using meaningful intermediate (and stable) targets for the first two layers seems like a very good idea. Are there any practical differences in terms of quality of the results? This might show in more complex datasets.
Could you please provide details on what is the dimensionality of the scattering representation at different scales? Say, how many coefficients are in S_5?
In Figure 3, it would be good to show some interpolation results for test images as well, to have a visual reference.
The authors mention that considering the network as a memory storage would allow to better recover known faces from unknown faces. It seems that it would be known from unknown images. Meaning, it is not clear why this method would generalize to novel image from the same individuals. Also, the memory would be quite rigid, as adding a new image would require adapting the generator.
Other minor points:
Last paragraph of page 1, “Th inverse \Phi…” is missing the ‘e’.
Some references (to figures or citations) seem to be missing, e.g. at the end of page 4, at the beginning of page 5, before equation (6).
Also, some citations should be corrected, for instance, at the end of the first paragraph of Section 3.1:
“… wavelet filters Malat (2016).”
Sould be:
“... wavelet filters (Malat, 2016).”
First paragraph of Section 3.3. The word generator is repeated.


This work introduces a simple network for producing character aware word embeddings. Position agnostic and position aware character embeddings are combined to produce an embedding vector for each word. The learned word representations are shown to be very sparse and facilitate improved results on language modeling tasks, despite using markedly fewer parameters, and without the need to apply dropout. A final experiment suggests that weight sharing contributes to sparsity, increases performance, and prevents overfitting.

This paper presents a new model for composing representations of characters into word embeddings. The starting point of their argument is to include position-specific embeddings of characters rather than just position-independent characters. By adding together position-specific vectors, reasonable results are obtained.
This is an interesting result, but I have a few recommendations to improve the paper.
1) It is a bit hard to assess since it is not evaluated on a standard datasets. There are a number standard datasets for open vocabulary language modeling. E.g., the MWC corpus (http://k-kawakami.com/research/mwc), or even the Penn Treebank (although it is conventionally modeled in closed vocabulary form).
2) There are many existing models for composing characters into words. In addition to those cited in the paper, see the citations listed below. Comparison with those is crucial in a paper like this.
3) Since the predictions are done at the word type level, it is unclear how vocabulary set of the corpus is determined, and what is done with OOV word types at test time (while it is possible to condition on them using the technique in the paper, it is not possible to use this technique for generation).
4) The analysis is interesting, but a more intuitive explanation would be to show nearest neighbor plots.
Some missing citations:
Composing characters into words:
dos Santos and Zadrozny. (2014 ICML) http://proceedings.mlr.press/v32/santos14.pdf
Ling et al. (2015 EMNLP) Finding Function in Form. https://arxiv.org/abs/1508.02096
Additionally, using explicit positional features in modeling language has been used:
Vaswani et al. (2017) Attention is all you need https://arxiv.org/abs/1706.03762
and a variety of other sources.


We study the problem of multiset prediction. The goal of multiset prediction is to train a predictor that maps an input to a multiset consisting of multiple items. Unlike existing problems in supervised learning, such as classification, ranking and sequence generation, there is no known order among items in a target multiset, and each item in the multiset may appear more than once, making this problem extremely challenging. In this paper, we propose a novel multiset loss function by viewing this problem from the perspective of sequential decision making. The proposed multiset loss function is empirically evaluated on two families of datasets, one synthetic and the other real, with varying levels of difficulty, against various baseline loss functions including reinforcement learning, sequence, and aggregated distribution matching loss functions. The experiments reveal the effectiveness of the proposed loss function over the others.

Summary:
The paper considers the prediction problem where labels are given as multisets. The authors give a definition of a loss function for multisets and show experimental results. The results show that the proposed methods optimizing the loss function perform better than other alternatives.
Comments:
The problem of predicting multisets looks challenging and interesting. The experimental results look nice. On the other hand, I have several concerns about writing and technical discussions.
First of all, the goal of the problem is not exactly stated. After I read the experimental section, I realized that the goal is to optimize the exact match score (EM) or F1 measure w.r.t. the ground truth multisets. This goal should be explicitly stated in the paper. Now then, the approach of the paper is to design surrogate loss functions to optimize these criteria.
The technical discussions for defining the proposed loss function seems not reliable for the reasons below. Therefore, I do not understand the rationale of the definition of the proposed loss function.:
- An exact definition of the term multiset is not given. If I understand it correctly, a multiset is a “set” of instances allowing duplicated ones.
- There is no definition of Prec or Rec (which look like Precision and Recall) in Remark 1. The definitions appear in Appendix, which might not be well-defined. For example, let y, Y be mutisets , y=[a, a, a] and Y = [a, b]. Then, by definition, Prec(y,Y)=3/3 =1. Is this what you meant? (Maybe, the ill-definedness  comes from the lack of definition of inclusion in a mutiset.)
- I cannot follow the proof of Remark 1 since it does not seem to take account of the randomness by the distribution \pi^*.
- I do not understand the definition of the oracle policy exactly. It seems to me that, the oracle policy knows the correct label (multi-set) \calY for each instance x and use it to construct \calY_t. But, this implicit assumption is not explicitly mentioned.
- In (1), (2) and Definition 3, what defines \calY_t? If \calY_t is determined by some “optimal” oracle, you cannot define the loss function in Def. 3 since it is not known a priori. Or, if the learner determines \calY_t, I don’t understand why the oracle policy is optimal since it depends on the learner’s choices.
Also, I expect an investigation of theoretical properties of the proposed loss function, e.g., relationship to EM or F1 or other loss functions. Without understanding the theoretical properties and the rationale, I cannot judge the goodness of the experimental results (look good though). In other words, I cannot judge the paper in a qualitative perspective, not in a quantitative view.
As a summary, I think the technical contribution of the paper is marginal because of the lack of reliable mathematical discussion or investigation.


EFFICIENT SPARSE-WINOGRAD CONVOLUTIONAL NEURAL NETWORKS
Convolutional Neural Networks (CNNs) are computationally intensive, which limits their application on mobile devices. Their energy is dominated by the number of multiplies needed to perform the convolutions. Winograd's minimal filtering algorithm (Lavin, 2015) and network pruning (Han et al., 2015) can reduce the operation count, but these two methods cannot be directly combined -applying the Winograd transform fills in the sparsity in both the weights and the activations. We propose two modifications to Winograd-based CNNs to enable these methods to exploit sparsity. First, we move the ReLU operation into the Winograd domain to increase the sparsity of the transformed activations. Second, we prune the weights in the Winograd domain to exploit static weight sparsity. For models on CIFAR-10, CIFAR-100 and ImageNet datasets, our method reduces the number of multiplications by 10.4×, 6.8× and 10.8× respectively with loss of accuracy less than 0.1%, outperforming previous baselines by 2.0×-3.0×. We also show that moving ReLU to the Winograd domain allows more aggressive pruning.

Summary:
The paper presents a modification of the Winograd convolution algorithm that enables a reduction of multiplications in a forward pass of 10.8x almost without loss of accuracy.
This modification combines the reduction of multiplications achieved by the Winograd convolution algorithm with weight pruning in the following way:
- weights are pruned after the Winograd transformation, to prevent the transformation from filling in zeros, thus preserving weight sparsity
- the ReLU activation function associated with the previous layer is applied to the Winograd transform of the input activations, not directly to the spatial-domain activations, also yielding sparse activations
This way sparse multiplication can be performed. Because this yields a network, which is not mathematically equivalent to a vanilla or Winograd CNN, the method goes through three stages: dense training, pruning and retraining. The authors highlight that a dimension increase in weights and ReLU activations provide a more powerful representation and that stable dynamic activation densities over layer depths benefit the representational power of ReLU layers.
Review:
The paper shows good results using the proposed method and the description is easy to follow. I particularly like Figure 1.
I only have a couple of questions/comments:
1) I’m not familiar with the term m-specific (“Matrices B, G and A are m-specific.”) and didn’t find anything that seemed related in a very quick google search. Maybe it would make sense to add at least an informal description.
2) Although small filters are the norm, you could add a note, describing up to what filter sizes this method is applicable. Or is it almost exactly the same as for general Winograd CNNs?
3) I think it would make sense to mention weight and activation quantization in the intro as well (even if you leave a combination with quantization for future work), e.g. Rastegari et al. (2016), Courbariaux et al. (2015) and Lin et al. (2015)
4) Figure 5 caption has a typo: “acrruacy”
References:
Courbariaux, Matthieu, Yoshua Bengio, and Jean-Pierre David. "Binaryconnect: Training deep neural networks with binary weights during propagations." In Advances in Neural Information Processing Systems, pp. 3123-3131. 2015.
Lin, Zhouhan, Matthieu Courbariaux, Roland Memisevic, and Yoshua Bengio. "Neural networks with few multiplications." arXiv preprint arXiv:1510.03009 (2015).
Rastegari, Mohammad, Vicente Ordonez, Joseph Redmon, and Ali Farhadi. "Xnor-net: Imagenet classification using binary convolutional neural networks." In European Conference on Computer Vision, pp. 525-542. Springer International Publishing, 2016.


Generative Adversarial Networks (GANs) have been proposed as an approach to learning generative models. While GANs have demonstrated promising performance on multiple vision tasks, their learning dynamics are not yet well understood, neither in theory nor in practice. In particular, the work in this domain has been focused so far only on understanding the properties of the stationary solutions that this dynamics might converge to, and of the behavior of that dynamics in this solutions' immediate neighborhood. To address this issue, in this work we take a first step towards a principled study of the GAN dynamics itself. To this end, we propose a model that, on one hand, exhibits several of the common problematic convergence behaviors (e.g., vanishing gradient, mode collapse, diverging or oscillatory behavior), but on the other hand, is sufficiently simple to enable rigorous convergence analysis. This methodology enables us to exhibit an interesting phenomena: a GAN with an optimal discriminator provably converges, while guiding the GAN training using only a first order approximation of the discriminator leads to unstable GAN dynamics and mode collapse. This suggests that such usage of the first order approximation of the discriminator, which is a de-facto standard in all the existing GAN dynamics, might be one of the factors that makes GAN training so challenging in practice. Additionally, our convergence result constitutes the first rigorous analysis of a dynamics of a concrete parametric GAN.

The authors proposes to study the impact of GANS in two different settings:
1. at each iteration, train the discriminator to convergence and do a (or a few) gradient steps for updating the generator
2. just do a few gradient steps for the discriminator and the generator
This is done in a very toy example: a one dimensional equally weighted mixture of two Gaussian distributions.
Clarity: the text is reasonably well written, but with some redundancy (e.g. see section 2.1) , and quite a few grammatical and mathematical typos here and there. (e.g. Lemma 4.2., $f$ should be $g$, p7 Rect(0) is actually the empty set, etc..)
Gaining insights into the mechanics of training GANs is indeed important. The authors main finding is that, in this very particular setting, it seems that training the discriminator to convergence leads to convergence. Indeed, in real settings, people have tried such strategies for WGAN for examples. For standard GANs, if one adds a little bit of noise to the labels for example, people have also reported good result for such a strategy (although, without label smoothing, this will indeed leads to problems).
Although I have not checked all the mathematical fine details, the approach/proof looks sound (although it is not at all clear too me why the choice of gradient step-sizes does not play a more important roles the the stated results). My biggest complain is that the situation analyzed is so simple (although the convergence proof is far from trivial) that I am not at all convinced that this sheds much light on more realistic examples. Since this is the main meat of the paper (i.e. no methodological innovations), I feel that this is too little an innovation for deserving publication in ICLR2018.


PIXELDEFEND: LEVERAGING GENERATIVE MODELS TO UNDERSTAND AND DEFEND AGAINST ADVERSARIAL EXAMPLES
Adversarial perturbations of normal images are usually imperceptible to humans, but they can seriously confuse state-of-the-art machine learning models. What makes them so special in the eyes of image classifiers? In this paper, we show empirically that adversarial examples mainly lie in the low probability regions of the training distribution, regardless of attack types and targeted models. Using statistical hypothesis testing, we find that modern neural density models are surprisingly good at detecting imperceptible image perturbations. Based on this discovery, we devised PixelDefend, a new approach that purifies a maliciously perturbed image by moving it back towards the distribution seen in the training data. The purified image is then run through an unmodified classifier, making our method agnostic to both the classifier and the attacking method. As a result, PixelDefend can be used to protect already deployed models and be combined with other model-specific defenses. Experiments show that our method greatly improves resilience across a wide variety of state-of-the-art attacking methods, increasing accuracy on the strongest attack from 63% to 84% for Fashion MNIST and from 32% to 70% for CIFAR-10.

The authors propose to use a generative model of images to detect and defend against adverarial examples. White-box attacks against standard models for image recognition (Resnet and VGG) are considered, and a generative model (a PixelCNN) is trained on the same data as the classifiers. The authors first show that adversarial examples created by the white-box attacks correspond to low likelihood region (according to the pixelCNN), which first gives a classification rule for detecting adversarial examples.
Then, to turn the genrative model into a defensive algorithm, the authors propose to preprocess test images by approximately maximizing the likelihood under similar constraints as the attacker of images, to "project" adversarial examples back to high-density regions (as estimated by the generative model). As a heuristic method, the authors propose to greedily maximize the likelihood of the incoming images pixel-by-pixel, which is possible because of the specific form of the PixelCNN likelihood in the context of l-infty attacks. An "adaptive" version of the algorithm, in which the preprocessing is used only when the likelihood of an example is below a certain threshold, is also proposed.
Experiments are carried out on Fashion MNIST and CIFAR-10. At a high level, the message is that projecting the image into a high density region is sufficient to correct for a significant portions of the mistakes made on adversarial examples. The main result is that this approach based on generative models seems to work even on against the strongest attacks.
Overall, the idea proposed in the paper, using a generative model to detect and filter out spurious patterns that can appear in adversarial examples, is rather intuitive. The experimental result that adversarial examples can somehow be corrected by a generative model is also interesting. The design choice of PixelCNN, which allows for a greedy optimization seems reasonable in that setting.
Whereas the paper is an interesting step forward, the paper still doesn't provide definitive arguments in favor of using such approaches in practice. There is a significant loss in accuracy on clean examples (2% on CIFAR-10 for a resnet), and more generally against weaker opponents such as the fast gradient sign. Thus, in reality, the experiments show that the pipeline generative model + classifier is robust against the strongest white box methods for this classifier, but on the other hand these methods do not transfer well to new models. This somewhat weakens the result, since robustness against these methods that do not transfer well is achieved by changing the model.


GANs provide a framework for training generative models which mimic a data distribution. However, in many cases we wish to train a generative model to optimize some auxiliary objective function within the data it generates, such as making more aesthetically pleasing images. In some cases, these objective functions are difficult to evaluate, e.g. they may require human interaction. Here, we develop a system for efficiently training a GAN to increase a generic rate of positive user interactions, for example aesthetic ratings. To do this, we build a model of human behavior in the targeted domain from a relatively small set of interactions, and then use this behavioral model as an auxiliary loss function to improve the generative model. As a proof of concept, we demonstrate that this system is successful at improving positive interaction rates simulated from a variety of objectives, and characterize some factors that affect its performance.

This paper proposes a technique to improve the output of GANs by maximising a separate score that aims to mimic human interactions.
Summary:
The goal of the technique to involve human interaction in generative processes is interesting. The proposed addition of a new loss function for this purpose is an obvious choice, not particularly involved. It is unclear to me whether the paper has value in its current form, that is without experimental results for the task it achieves. It feels to premature for publication.
More comments:
The main problem with this paper is that the proposed systems is designed for a human interaction setting but no such experiment is done or presented. The title is misleading, this may be the direction where the authors of the submission want to go, but the title  “.. with human interactions” is clearly misleading. “Model of human interactions” may be more appropriate.
The technical idea of this paper is to introduce a separate score in the GAN training process. This modifies the generator objective.  Besides “fooling” the discriminator, the generator objective is to maximise user interaction with the generated batch of images. This is an interesting objective but since no interactive experiments presented in this paper, the rest of the experiments hinges on the definition of “PIR” (positive interaction rate)using a model of human interaction. Instead of real interactions, the submission proposes to maximise the activations of hidden units in a separate neural network. By choosing the hierarchy level and type of filter the results of the GAN differ.
I could not appreciate the results in Figure 2 since I was missing the definition of PIR, how it is drawn in the training setup. Further I found it not surprising that the PIR changes when a highly parameterised model is trained for this task. The PIR value comes from a separate network not directly accessible during training time, nonetheless I would have been surprised to not see an increase. Please comment in the rebuttal and I would appreciate if the details of the synthetic PIR values on the training set could be explained.
- Technically it was a bit unclear to me how the objective is defined. There is a PIR per level and filter (as defined in C4) but in the setup the L_{PIR} was mentioned to be a scalar function, how are the values then summarized? There is a PIR per level and feature defined in C4.
- What does the PIR with the model in Section 3 stand for? Shouldn’t be something like “uniqueness”, that is how unique is an image in a batch of images be a better indicator? Besides, the intent of what possibly interesting PIR examples will be was unclear.
E.g., the statement at the end of 2.1 is unclear at that point in the document. How is the PIR drawn exactly? What does it represent? Is there a PIR per image? It becomes clear later, but I suggest to revisit this description in a new version.
- Also I suggest to move more details from Section C4 into the main text in Section 3. The high level description in Section 3.


Imitation learning from demonstrations usually relies on learning a policy from trajectories of optimal states and actions. However, in real life expert demonstrations, often the action information is missing and only state trajectories are available. We present a model-based imitation learning method that can learn environment-specific optimal actions only from expert state trajectories. Our proposed method starts with a model-free reinforcement learning algorithm with a heuristic reward signal to sample environment dynamics, which is then used to train the state-transition probability. Subsequently, we learn the optimal actions from expert state trajectories by supervised learning, while back-propagating the error gradients through the modeled environment dynamics. Experimental evaluations show that our proposed method successfully achieves performance similar to (state, action) trajectory-based traditional imitation learning methods even in the absence of action information, with much fewer iterations compared to conventional model-free reinforcement learning methods. We also demonstrate that our method can learn to act from only video demonstrations of expert agent for simple games and can learn to achieve desired performance in less number of iterations.

Model-Based Imitation Learning from State Trajectories
SIGNIFICANCE AND ORIGINALITY:
The authors propose a model-based method for accelerating the learning of a policy
by observing only the state transitions of an expert trace.
This is an important problem in many fields such as robotics where
finding a feasible policy is hard using pure RL methods.
The authors propose a unique two step method to find a high-quality model-based policy.
First: To create the environment model for the model-based learner,
 they need a source of state transitions with actions ( St, At,xa St+1 ).
To generate these samples, they first employ a model-free algorithm.
The model-free algorithm is trained to try to duplicate the expert state at each trajectory.
In continuous domains, the state is not unique … so they build a soft next state predictor
that gives a probability over next states favoring those demonstrated by the expert.
Since the transitions were generated by the agent acting in the environment,
these transitions have both states and actions ( St, At, St+1 ).
These are added to a pool.
The authors argue that the policy found by this model-free learner is
not highly accurate or guaranteed to converge, but presumably is good at
generating transitions relevant to the expert’s policy.
(Perhaps slowly reducing the \sigma in the reward would improve accuracy?)
I guess if expert trace data is sparse, the model-free learner can generate a lot
of transitions which enable it to create accurate dynamics models which in turn
allow it to extract more information out of sparse expert traces?
Second: They then train a model based agent using the collected transitions ( St, At, St+1 ).
They formulate the problem as a maximum likelihood problem with two terms:
an action dynamics model which is learned from local exploration using the learner’s own actions and outcomes
and expert policy model in terms of the actions learned above
that maximizes the probability of the observed expert’s trajectory.
This is a nice clean formulation that integrates the two processes.
I thought the comparison to an encoder - decoder network was interesting.
The authors do a good job of positioning the work in the context of recent work in IML.
It looks like the authors extract position information from flappy bird frames,
so the algorithm is only using images for obstacle reasoning?
QUALITY
The propose model is described fairly completely and evaluated on
a “reaching" problem and the "flappy bird” game domain.
The evaluation framework is described in enough detail to replicate the results.
Interestingly, the assisted method starts off much higher in the “reacher” task.
Presumably this task is easy to observe the correct actions.
The flappy bird test shows off the difference between unassisted learning (DQN),
model free learning with the heuristic reward (DQN+reward prediction)
and model based learning.
Interestingly, DQN + heuristic reward approaches expert performance
while behavioral cloning never achieves expert performance level even though it has actions.
Why does the model-based method only run to 600 steps and stopped before convergence??
Does it not converge to expert level?? If so, this would be useful to know.
There are minor grammatical mistakes that can be corrected.
After equation 5, the authors suggest categorical loss for discrete problems,
but cross-entropy loss might work better. Maybe this is what they meant.
CLARITY
The overall approach and algorithms are described fairly clearly. Some minor typos here and there.
Algorithm 1 does not make clear the relationship between the model learned in step 2 and the algorithms in steps 4 to 6.
I would reverse the order of a few things to align with a right to left ordering principle.
In Figure 1, put the model free transition generator on the left and the model-based sample consumer on the right.
In Figure 3, put the “reacher” test on the left and the “flappy bird” on the right.
PROS AND CONS
Interesting idea for learning quickly from small numbers of samples of expert state trajectories.
Not clear that method converges on all problems.
Not clear that the method is able to extract the state from video — authors had to extract position manually
(this point is more about their deep architecture than the imitation framework they describe -
though perhaps a key argument for the authors is the ability to work with small numbers of
expert samples and still be able to train deep methods ) ??
POST REVIEW SUBMISSION:
The authors make a number of clarifying comments to improve the text and add the reference suggested by another reviewer.


Deep learning is becoming more widespread in its application due to its power in solving complex classification problems. However, deep learning models often require large memory and energy consumption, which may prevent them from being deployed effectively on embedded platforms, limiting their applications. This work addresses the problem by proposing methods Weight Reduction Quantisation for compressing the memory footprint of the models, including reducing the number of weights and the number of bits to store each weight. Beside, applying with sparsity-inducing regularization, our work focuses on speeding up stochastic variance reduced gradients (SVRG) optimization on non-convex problem. Our method that minibatch SVRG with 1 regularization on non-convex problem has faster and smoother convergence rates than SGD by using adaptive learning rates. Experimental evaluation of our approach uses MNIST and CIFAR-10 datasets on LeNet-300-100 and LeNet-5 models, showing our approach can reduce the memory requirements both in the convolutional and fully connected layers by up to 60× without affecting their test accuracy.

The authors present an l-1 regularized SVRG based training algorithm that is able to force many weights of the network to be 0, hence leading to good compression of the model.  The motivation for l-1 regularization is clear as it promotes sparse models, which lead to lower storage overheads during inference. The use of SVRG is motivated by the fact that it can, in some cases, provide faster convergence than SGD.
Unfortunately, the authors do not compare with some key literature. For example there has been several techniques that use sparsity, and group sparsity [1,2,3], that lead to the same conclusion as the paper here: models can be significantly sparsified while not affecting the test accuracy of the trained model.
Then, the novelty of the technique presented is also unclear, as essentially the algorithm is simply SVRG with l1 regularization and then some quantization. The experimental evaluation does not strongly support the thesis that the presented algorithm is much better than SGD with l1 regularization. In the presented experiments, the gap between the performance of SGD and SVRG is small (especially in terms of test error), and overall the savings in terms of the number of weights is similar to Deep compression. Hence, it is unclear how the use of SVRG over SGD improves things. Eg in figure 2 the differences in top-1 error of SGD and SVRG, for the same number of weights is very similar (it’s unclear also why Fig 2a uses top-1 and Fig 2b uses top-5 error). I also want to note that all experiments were run on LeNet, and not on state of the art models (eg ResNets).
Finally, the paper is riddled with typos. I attach below some of the ones I found in pages 1 and 2
Overall, although the topic is very interesting, the contribution of this paper is limited, and it is unclear how it compares with other similar techniques that use group sparsity regularization, and whether SVRG offers any significant advantages over l1-SGD.
typos:
“ This work addresses the problem by proposing methods Weight Reduction Quantisation”
-> This work addresses the problem by proposing a Weight Reduction Quantisation method
“Beside, applying with sparsity-inducing regularization”
-> Beside, applying sparsity-inducing regularization
“Our method that minibatch SVRG with l-1 regularization on non-convex problem”
-> Our minibatch SVRG with l-1 regularization method on non-convex problem
“As well as providing,l1 regularization is a powerful compression techniques to penalize some weights to be zero”
-> “l1 regularization is a powerful compression technique that forces some weights to be zero”
 The problem 1 can
->  The problem in Eq.(1) can
“it inefficiently encourages weight”
-> “it inefficiently encourages weights”
————
[1] Learning Structured Sparsity in Deep Neural Networks
http://papers.nips.cc/paper/6504-learning-structured-sparsity-in-deep-neural-networks.pdf
[2] Fast ConvNets Using Group-wise Brain Damage
https://arxiv.org/pdf/1506.02515.pdf
[3] Sparse Convolutional Neural Networks
https://www.cv-foundation.org/openaccess/content_cvpr_2015/papers/Liu_Sparse_Convolutional_Neural_2015_CVPR_paper.pdf