CAMOU: LEARNING A VEHICLE CAMOUFLAGE FOR PHYSICAL ADVERSARIAL ATTACK ON OBJECT DETECTORS IN THE WILD
In this paper, we conduct an intriguing experimental study about the physical adversarial attack on object detectors in the wild. In particular, we learn a camouflage pattern to hide vehicles from being detected by state-of-the-art convolutional neural network based detectors. Our approach alternates between two threads. In the first, we train a neural approximation function to imitate how a simulator applies a camouflage to vehicles and how a vehicle detector performs given images of the camouflaged vehicles. In the second, we minimize the approximated detection score by searching for the optimal camouflage. Experiments show that the learned camouflage can not only hide a vehicle from the image-based detectors under many test cases but also generalizes to different environments, vehicles, and object detectors.

The authors investigate the problem of learning a camouflage pattern which, when applied to a simulated vehicle, will prevent an object detector from detecting it. The problem is frames as finding the camouflage pattern which minimises the expected decision scores from the detector over a distribution of possible views of this pattern applied to a vehicle (e.g. vantage point, background, etc). This expectation is approximated by sampling detector scores when applying the detector considered to images synthesised using a number of vantage points and scene contexts. In order to generate a gradient signal with respect to the camouflage applied (the simulated image rendering is non-differentiable) the approach considers learning a clone network which takes as input the camouflage pattern, the vehicle model and a given environment and outputs the vehicle detector’s devision values. The clone network and the optimal camouflage are learned alternately in order to obtain a relatively faithful approximation. The approach is evaluated in simulation using two standard object detectors (Mask R-CNN and YOLOv3) on two vehicle models over a range of transformations.
Pros:
———
- interesting challenge
- the clone network provides an interesting solution to the challenge of having a (non-differentiable) simulator in the loop.
Cons:
———
- the fact that this is done in simulation is understandable but to some degree negates the authors’ point that physicality matters because it is harder than images. How effective is a learned camouflages in reality? It would be great to get at least some evidence of this.
- if the sim-2-real gap is too big it is not clear how this approach could ever be feasibly employed in the real world. Some intuition here would add value.
- the approach presented critically hinges on the quality of the clone network. Some analysis of robustness of the approach with respect to network performance would add value.
- little is offered in terms of analysis of the camouflages generated. The three failure modes triggered and discussed are intuitive. But are there any insights available as to what aspect of the camouflages triggers these behaviours in the object detectors? This could also add significant value.
In summary, this work addresses an interesting problem but it is not clear how impactful the approach will be in real-world settings and hence how significant it it. Some of the more technically interesting aspects of the submission (e.g. the quality of the clone network, any learning derived from the camouflages generated) are not explored.
Misc comments:
- equs 1, 2 & 3: min_* should be argmin_*


Natural products (NPs, compounds derived from plants and animals) are an important source of novel disease treatments. A bottleneck in the search for new NPs is structure determination. One method is to use 2D Nuclear Magnetic Resonances (NMR) spectroscopy, which indicates bonds between nuclei in the compound, and hence is the "fingerprint" of the compound. Computing a similarity score between 2D NMR spectra for a novel compound and a compound whose structure is known helps determine the structure of the novel compound. Standard approaches to this problem do not scale to larger databases of compounds. Here we use deep convolutional Siamese networks to map NMR spectra to a cluster space, where similarity is given by the distance in the space. This approach results in an AUC score that is more than four times better than an approach using LDA.

This paper identifies structure determination of novel natural products as a bottleneck in the drug discovery pipeline. The authors address this problem by using deep siamese neural networks to learn an representation of 2D NMR spectra that facilitates the rapid comparison of spectra for novel compounds with a database containing the spectra of molecules of known structure.
The authors have laboriously collected spectra from the published literature, using a protocol that included manual processing and orientation steps, resulting in a set of 1,385 NMR spectra from 104 families after imposing a minimum requirement of 10 compounds per family. They then implement two baseline topic modeling techniques - PLSI and LDA, and compare the performance of these baselines to the deep siamese CNN that they develop.
Using the random test/val/train split, the deep siamese CNN does show improved performance over the baseline models. However, the interesting and relevant use case is that in which the data is not randomly split, but rather complete families are held out from the training set for use in testing. The authors address this task by building a split in which they hold out four families: the aphanamixoids, teuvissides, tasiamides and macrolactins.
To evaluate performance, they calculate the averaged Tanimoto score for the top five closest compound families of these probe families. Unfortunately, the authors were not able to carry out this calcuation for two of the four probe families, restricting the evaluation to the aphanamixoids and teuvissides (I am confused as to why they couldn't calculate these scores - they appear to be relying on a PubChem server?). They compare these Tanimoto scores to the similarity score of the NMR spectra generated by their NN model. The similarity score either matches (in one case) or differs (in the other case) from the Tanimoto score, and the authors make the argument that this performance is correct.
I am confused that there is no requirement or criteria for the NN to detect the presence of a new compound family, which seems to be what this tasks calls for. This evaluation is rather limited, given that TC scores could not be computed for half of the probe families. There is also no comparison to the baseline models for this task.
Overall I think that this manuscript does a good job of identifying an interesting question, and makes a start at answering the question. To improve the manuscript I would ask that the authors carry out a more comprehensive evaluation of the performance using splits in which whole families are held out from the training set. Different splits might be evaluated, and in addition the model should be required to 'call' when it believes that a new compound family is present. Furthermore, it would be interesting to compare the siamese CNN approach to other network architectures. In addition, the performance of baseline models on the hold-family-out split should be assessed.


As deep neural net architectures minimize loss, they build up information in a hierarchy of learned representations that ultimately serve their final goal. Different architectures tackle this problem in slightly different ways, but all models aim to create representational spaces that accumulate information through the depth of the network. Here we build on previous work that indicated that two very different model classes trained on two very different tasks actually build knowledge representations that have similar underlying representations. Namely, we compare word embeddings from SkipGram (trained to predict co-occurring words) to several CNN architectures (trained for image classification) in order to understand how this accumulation of knowledge behaves in CNNs. We improve upon previous work by including 5 times more ImageNet classes in our experiments, and further expand the scope of the analyses to include a network trained on CIFAR-100. We characterize network behavior in pretrained models, and also during training, misclassification, and adversarial attack. Our work illustrates the power of using one model to explore another, gives new insights for CNN models, and provides a framework for others to perform similar analyses when developing new architectures.

The authors propose a new method of measuring a knowledge within the learned CNN: the representations of CNN layers and word2vec embeddings and compared, and the similarity between them are calculate. The authors claim that the similarity score increases with learning time, and the higher layers of CNN have more similarity to word2vec embeddings than the lower layers..
CNN and word2vec use different datasets. CNN uses the vision pixels and word2vec uses the words in the sentences. A certain amount of representation patterns can be expected to be shared, but surely the extent is limited (correlation 0.9 in Fig. 1). Because of this limitation, the proposed similarity measure must not be claimed as the measure of knowledge accumulation in CNN.
In addition, the authors have to be precise in defining the measure and provide the information captured by the measure. In the literature, I can see “something” is shared by the two algorithms but do not know what is this “something.” The authors claim that “semantics” are shared, but replacing “semantics” to “something” does not make any difference in this manuscript. Further investigations and confirmations are needed to report which information is actually similar to each other.
Minor: the 1 vs. 2 accuracy measure is not defined.
In summary, the proposed measure may capture some information but the explanation about this information is unclear. The information seems to be a rough similar pattern of concept representations. Further rigorous investigation of the proposed measure is necessary to confirm which information is captured. The current version is not sufficient for acceptance.


Learning distributed representations for nodes in graphs is a crucial primitive in network analysis with a wide spectrum of applications. Linear graph embedding methods learn such representations by optimizing the likelihood of both positive and negative edges while constraining the dimension of the embedding vectors. We argue that the generalization performance of these methods is not due to the dimensionality constraint as commonly believed, but rather the small norm of embedding vectors. Both theoretical and empirical evidence are provided to support this argument: (a) we prove that the generalization error of these methods can be bounded by limiting the norm of vectors, regardless of the embedding dimension; (b) we show that the generalization performance of linear graph embedding methods is correlated with the norm of embedding vectors, which is small due to the early stopping of SGD and the vanishing gradients. We performed extensive experiments to validate our analysis and showcased the importance of proper norm regularization in practice.

The manuscript proposes a theoretical bound on the generalization performance of learning graph embeddings. The authors find that the term in the generalization bound that represents the function complexity involves the norm of the learnt coordinates, based on which they argue that it is the norm of the coordinates that determines the success of the learnt representation.
I am not very familiar with the literature on graph embeddings; however, to the extent of my understanding of the paper, I have a number of concerns:
- In a generalization bound like in Theorem 1, it is very typical of the generalization error to include a term that represents the complexity of the hypothesis function class. In the presented result, this would be the second term on the rhs, which involves the spectral norm of the adjacency matrix and the bounds on the norm of the learnt coordinates. This term captures the Rademacher complexity of the hypothesis function class. In my understanding, there is nothing really surprising about this: most of the results in learning theory would include a term directly or indirectly related to some norm on the hypothesis function class. However, it would then require a lot of further justification to conclude that the key factor determining the performance is the norm of the learnt representation based on this.
- I am not sure if the results in Figure 1 provide a really meaningful justification about the importance of norm. It is observed that the norm increases during the epochs, however, shouldn’t we be also checking the evolution of the error at the same time to draw a meaningful conclusion? In particular, the norm seems to increase rather monotonically throughout the epochs, whereas we expect the error to decrease first, reach an optimal, and then start increasing due to overfitting. So can we really say that the error is proportional to the norm?
- Similarly, in the results in Figure 5, we can observe that the regularization coefficient has an optimal value that maximizes the precision. On the other hand, the norm of the learnt coordinates is expected to decrease monotonically with increasing lambda_r. Again, it seems difficult to conclude that the norm is the key factor determining the error.
- Minor comments:
1. In page 2, in the expression of L, the node u should be in set V, I guess.
2. Please define the function sigma used in the objective functions.
3. Typo right under Section 3 title: “grpah”
4. The definition of matrix A_sigma is not clear to me. What does the “there exists y” expression mean in the first line?
- To sum up, my feeling is that the presence of the term involving the norm in Theorem 1 is rather classical in learning theory, and its importance seems to be over-emphasized in this study. Moreover, I am not fully convinced about the experimental evidence. Therefore, I cannot recommend accepting this paper.


Supervised models suffer from domain shifting where distribution mismatch across domains greatly affect model performance. Particularly, noise scattered in each domain has played a crucial role in representing such distribution, especially in various natural language processing (NLP) tasks. In addressing this issue, training data selection (TDS) has been proven to be a prospective way to train supervised models with higher performance and efficiency. Following the TDS methodology, in this paper, we propose a general data selection framework with representation learning and distribution matching simultaneously for domain adaptation on neural models. In doing so, we formulate TDS as a novel selection process based on a learned selection distribution from the input data, which is produced by a trainable selection distribution generator (SDG) that is optimized by reinforcement learning (RL). Then, the model trained by the selected data not only predicts the target domain data in a specific task, but also provides input for the value function of the RL, which exactly helps update the parameters of SDG in a policy gradient way. Experiments are conducted on three typical NLP tasks, namely, part-of-speech tagging, dependency parsing, and sentiment analysis. Results demonstrate the validity and effectiveness of our approach.

Response to author comments:
Unfortunately I am still significantly unclear on why RL is useful here.  The author response attempts to clarify that by pointing me to paragraph 2 of the intro, which states that RL has been used for data selection in other settings in the past.  What would help me (and I believe, the paper) more is a reason why greedy selection isn't sufficient for this particular problem.  Even just a single motivating example would be extremely helpful.  R3 mentioned similar concerns in their review, saying that the paper lacks explanation for why RL would win over non-RL for e.g. sentiment analysis.
Likewise, while I appreciate the authors comparing against a stronger baseline in Figure 3, I don't know how to interpret the figure.  Why is Figure 3(b) better than Figure 3(c), and why does using RL cause that difference to arise?
Original review:
Domain adaptation is an interesting task, and new methods for it would be welcome.  This paper appears to have technical depth and the experimental results are promising.  However, the presented approach is complex, and I found it very hard to understand -- both in terms of how exactly it works, and in terms of why the chosen techniques were chosen.  More detail on my questions and confusions follows.
First, I never understood the motivation for using RL here.  If minimizing the distance between selected data from the source domain and data in the target domain is the objective (equation 1), how does RL help?  The reward seems like it is immediate in each time step.  How does the *order* in which we add source examples to our collection matter?  I never understood the crucial difference that made the RL approach outperform the baselines that just select examples that minimize e.g. JS divergence.  Neither the paper's discussion of motivation nor the experimental analysis clarifies this.
The paper says in Section 2.1 that a formal description of the representations is to follow.  I didn't see this description (I do not see a formal definition of how the feature extractor works, and e.g. how it produces vectors that are *distributions* that can be used within e.g. JS divergence).
The paper also says it follows (Ruder and Plank, 2017) in using JS as a baseline, but as I understand that work the JS baseline is computed over words, not learned representations.  What is done in the submission, is the JS baseline over words in the instances, or the representations from the feature extractor?
What is the reason for partitioning the source data into disjoint "data bags"?  Why not just select the best source domain examples (from among all the source data) using RL?
The experiments are generally over enough tasks and compare against several baselines, and although the empirical wins are not that large I feel that they would be sufficient for publication if not for my other concerns.  The analysis (sec 4) did not make it clear to me why the RL approach works.  The visualization in Figure 3 only contrasts the proposed approach with a weak baseline of selecting all source data -- what we really need to see is an analysis that reveals why the learning of a policy with RL is better than simply greedily minimizing JS for each source data selection, for up to some limit of n selections.
Minor
The paper has a number of typos
The citations in the paper are mis-formatted -- seem to use shortcite where they shouldn't (e.g. "scenarios Akopyan and Khashba (2017)" should be "scenarios (Akopyan and Khashba, 2017)").
When the policy \pi_w(a | s) is introduced at the start of Sec 2.2, it uses symbols (a, s) that have not been defined, also that policy variable is not really utilized in the text so it could be deleted.


Planning is important for humans when producing complex languages, which is a missing part in current language generation models. In this work, we add a planning phase in neural machine translation to control the global sentence structure ahead of translation. Our approach learns discrete structural representations to encode syntactic information of target sentences. During translation, we can either let beam search to choose the structural codes automatically or specify the codes manually. The word generation is then conditioned on the selected discrete codes. Experiments show that the translation performance remains intact by learning the codes to capture pure structural variations. Through structural planning, we are able to control the global sentence structure by manipulating the codes. By evaluating with a proposed structural diversity metric, we found that the sentences sampled using different codes have much higher diversity scores. In qualitative analysis, we demonstrate that the sampled paraphrase translations have drastically different structures.

The authors propose modeling structural diversity of translations by conditioning the generation on both the source sentence and a latent encoding of the overall structure (captured by simplified part-of-speech tags). Specifically, they first train a conditional autoencoder to learn a latent code optimized towards reconstructing the tag sequence. They then prefix the inferred latent code to the target sentence before generation. A diversity metric which measures pairwise BLEU scores between beam items is also proposed. Experiments show that the latent codes lead to greater structural diversity as well as marginally improved translation results when combined with beam search.
Contributions
-----------------
A simple method for improving structural diversity.
The use of conditional autoencoding to capture structural ambiguity, while not in itself novel, could be interesting for other problems as well.
Experiments suggest that the method is rather effective (albeit only improving translation quality marginally)
I like the proposed discrepancy score based on pairwise BLEU scores.
Issues
---------
It is not clear if teacher forcing was used in the "tag planning" setting. If gold tag sequences were used during training there is a major train/test mismatch which would explain the dramatic drop in BLEU scores. If so, this is a major issue, since the authors claim that as the motivation for the use of discrete latent codes. To make the "tag planning" setting comparable to the latent code setting, you would need to train the tag prediction model first and then condition on predicted tags when training the translation model (potentially you would need to do jack-knifing to prevent overfitting as well).
It is unfortunate that there is no empirical comparison with the most closely related prior work, in particular Li et al. (2016) and Xu et al. (2018), which are both appropriately cited. As it stands it is not possible to tell which of these approaches is most useful in practice.
No details are provided on the tagset used and what system is used to predict it, or to what degree of accuracy.
Having a fixed number of codes regardless of sentence length seems like a major shortcoming. I would urge the authors to consider a variable coding length scheme, e.g., by generating codes autoregressively instead of with a fixed number of softmaxes. It would also be interesting to break down the numbers in table 1 with respect to sentence length.
Minor issues
-----------------
Citation for the Xavier method is missing.
Notation is somewhat hard to follow. Please add a few sentences describing it and make sure it is consistent.
There are many grammatical errors. Please make sure to proofread!
"Please note that the planning component can also be a continuous latent vector, which requires a discriminator to train the model in order that the latent cap." What does this mean?


NEAR-OPTIMAL REPRESENTATION LEARNING FOR HIERARCHICAL REINFORCEMENT LEARNING
We study the problem of representation learning in goal-conditioned hierarchical reinforcement learning. In such hierarchical structures, a higher-level controller solves tasks by iteratively communicating goals which a lower-level policy is trained to reach. Accordingly, the choice of representation -the mapping of observation space to goal space -is crucial. To study this problem, we develop a notion of sub-optimality of a representation, defined in terms of expected reward of the optimal hierarchical policy using this representation. We derive expressions which bound the sub-optimality and show how these expressions can be translated to representation learning objectives which may be optimized in practice. Results on a number of difficult continuous-control tasks show that our approach to representation learning yields qualitatively better representations as well as quantitatively better hierarchical policies, compared to existing methods.

The problem setting considered in this paper is that of the recent wave of "goal-conditioned" formulations for hierarchical control in Reinforcement Learning. In this problem, a low-level controller is incentivized to reach a goal state designated by a higher-level controller. This goal is represented in an abstract (embedding) multi-dimensional vector space. Establishing "closeness to goal" entails the existence of some distance metric (assumed to be given an fixed) and a function $f$ which can project states to their corresponding goal representation. The "representation learning" problem referred to by the authors pertains to this function. The paper is built around the question: how does the choice of $f$ affects the expressivity of the class of policies induced in the lower level controller, which in turn affects the optimality of the overall system. The authors answer this question by first providing a bound on the loss of optimality due to the potential mismatch between the distribution over next states under the choice of primitive actions produced by a locally optimal low-level controller. The structure of the argument mimics that of model compression methods based on bisimulation metrics. The model compression here is with respect to the actions (or behaviors) rather than states (as in aggregation/bismulation methods). In that sense, this paper is a valuable contribution to the more general problem of understanding the nature of the interaction between state abstraction and temporal abstraction and where the two may blend (as discussed by Dietterich and MAXQ or Konidaris for example). Using the proposed bounds as an objective, the authors then derive a gradient-based algorithm for learning a better $f$. While restricted to a specific kind of temporal abstraction model, this paper offers the first (to my knowledge) clear formulation  of "goal-conditioned" (which I believe is an expression proposed by the authors) HRL fleshed out of architectural and algorithmic considerations. The template of analysis is also novel and may even be useful in the more general SMDP/options perspective. I recommend this paper for acceptance mostly based on this: I believe that these two aspects will be lasting contributions (much more than the specifics of the proposed algorithms).
# Comments and Questions
It's certainly good to pitch the paper as a "representation learning" paper at a Representation Learning conference, but I would be careful in using this expression too broadly. The term "representation" can mean different things depending on what part of the system is considered. Representation learning of the policies, value functions etc. I don't have specific recommendations for how to phrase things differently, but please make sure to define upfront which represention you are referring to.
Representation learning in the sense of let's say Baxter (1995) or Minsky (1961) is more about "ease of learning" (computation, number of samples etc) than "accuracy". In the same way, one could argue that options are more about learning more easily (faster) than for getting more reward (primitive options achieve the optimal). Rather than quantifying the loss of optimality, it would be interesting to also understand how much one gains in terms of convergence speed for a given $f$ versus another. I would like to see (it's up to you) this question being discussed in your paper. In other words, I think that you need to provide some more motivation as to why think the representation learning of $f$ should be equated with the problem of maximizing the return. One reason why I think that is stems from the model formulation in the first place: the low-level controller is a local one and maximizes its own pseudo-reward (vs one that knows about other goals and what the higher level controller may do). It's both a feature, and limitation of this model formulation; the "full information" counterpart also has its drawbacks.
A limitation of this work is also that the analysis for the temporally extended version of the low-level controller is restricted to open-loop policies. The extension to closed-loop policies is important. There is also some arbitrariness in the choice of distance function which would be important to study.
Relevant work (it's up to you to include or not):
- Philip Thomas and Andrew Barto in "Motor Primitive Discovery" (2012) also talk about options-like abstraction in terms of compression of action. You may want to have a look.
- Still and Precup (2011) in "An information-theoretic approach to curiosity-driven reinforcement learning" also talk about viewing actions as "summary of the state" (in their own words). In particular, they look at minimizing the mutual information between state-action pairs.
- More generally, I think that the idea of finding "lossless" subgoal representations is also related to ideas of "empowerment" (the line of work of Polani).


Current machine learning algorithms can be easily fooled by adversarial examples. One possible solution path is to make models that use confidence thresholding to avoid making mistakes. Such models refuse to make a prediction when they are not confident of their answer. We propose to evaluate such models in terms of tradeoff curves with the goal of high success rate on clean examples and low failure rate on adversarial examples. Existing untargeted attacks developed for models that do not use confidence thresholding tend to underestimate such models' vulnerability. We propose the MaxConfidence family of attacks, which are optimal in a variety of theoretical settings, including one realistic setting: attacks against linear models. Experiments show the attack attains good results in practice. We show that simple defenses are able to perform well on MNIST but not on CIFAR, contributing further to previous calls that MNIST should be retired as a benchmarking dataset for adversarial robustness research. We release code for these evaluations as part of the cleverhans (Papernot et al., 2018) library 1 .
(Left) A success-fail curve. The horizontal axis shows the failure rate (fraction of examples for which the model returns a response and the response is incorrect) on adversarial examples. The vertical axis shows the success rate (fraction of examples for which the model returns a response and the response is correct) on clean examples. Each point on the curve corresponds to using a different confidence threshold. Dashed lines indicate estimates of upper and lower bounds (section 6.1) for thresholds t < 1 2 where our attack is not provably optimal. The upper and lower bounds are nearly equal so the two bounds are not separately visible at most points. (Right) We compare our new MaxConfidence attack to a traditional attack that maximizes the loss . The traditional attack is designed to cause a high loss, not a high failure rate in the presence of confidence thresholding. Our MaxConfidence attack performs better or equal at every point on the curve, with the most pronounced differences in the parts of the curve where confidence thresholding is the most effective. The staircase pattern for the undefended model results because few examples lie near the middle of the curve, and when drawing the plot we connect consecutive points in a staircase pattern in order to show the maximum possible failure rate. A curve formed with linear connections between points may false imply that some (success, failure) points are feasible even though they were not reached in the experiment. (Right) Success-fail curves for the same MNIST models on semantic adversarial examples. Surprisingly, adversarial training now performs worse than the undefended baseline. The regularized model performs slightly better than the undefended baselines. This illustrates some of the advantages of generic regularization combined with confidence thresholding: models that are generally skeptical of a wide variety of unusual data can avoid being fooled in settings that the designer did not need to explicitly specify ahead of time.
Adversarial examples "are inputs to machine learning models that an attacker has intentionally designed to cause the model to make a mistake" (Goodfellow et al., 2017). All currently known models are highly vulnerable to most known kinds of adversarial examples. See Goodfellow (2018) for one summary of important open problems and research directions.
One popular approach to defending against adversarial examples is to refuse to classify adversarial examples while still providing predictions for clean examples. The evaluation methodology for such defenses has been of limited quality. In this work, we present both metrics and attack methods for security evaluation of models that use confidence thresholding to refuse to classify some examples.
Models based on confidence thresholding have the potential to solve many open problems in adversarial robustness:
• The current state of the art in adversarial robustness , and with some caveats, Kannan et al. (2018)) is based on adversarial training (Szegedy et al., 2013;Goodfellow et al., 2014b;Warde-Farley & Goodfellow, 2016;Kurakin et al., 2016). So far adversarial training tends to result in robustness to the attack used during training but does not result in robustness to other kinds of attacks (e.g. Sharma & Chen (2017) showed that adversarially trained models designed to be robust to small perturbations as measured by the L ∞ norm do not also become robust to small perturbations as measured by the L 1 norm). It seems unlikely that adversarial training will scale to make the model give the right answer everywhere in the model's input domain, but maybe models based on confidence thresholding can learn to assign low confidence almost everywhere in the input domain, and thereby resist a very wide range of potential attacks. Confidence thresholding thus seems like a viable candidate to solve harder problems involving adversarial examples with fewer restrictions .
• Adversarial training has high computational cost, but maybe models with appropriate confidence can be trained at lower cost. We show that this is feasible on MNIST, and our evaluation methods pave the way to test future models on more difficult datasets.
• Confidence thresholding offers a simple, flexible way to trade performance on clean data for robustness to adversarial examples, simply by adjusting the threshold t. Our proposed evaluation methods can automatically produce entire tradeoff curves after running our proposed attack only once per example. Choosing the right point on the tradeoff curve does not require retraining the model or re-running the evaluation for each hypothetical threshold.
• Adversarial training often causes a reduction in accuracy on naturally occurring data (Su et al., 2018). Models that use confidence thresholding can actually achieve higher accuracy than undefended models, albeit with reduced coverage. When a model reduces coverage, it reduces the total volume of input space for which it can have an error. Other methods run the risk of moving errors into locations not measured by the current benchmark.
Many proposed defenses have been based on detecting adversarial examples and then refusing to classify them. Many of these proposed defenses have been broken (Carlini & Wagner, 2017). We observe that confidence thresholding is different from detection in a subtle but important way. In the case of confidence thresholding, refusing to return a response does not imply that the input is necessarily an "adversarial example". The classifier is free to shut off for a wide variety of inputs, so long as they do not appear often in the naturally occuring data. This makes the confidence thresholding defense much less likely to overfit to a specific conception of what an adversarial example looks like.
Despite this potential, it has not yet been clear how to evaluate models based on confidence thresholding. In this work, we advocate analyzing models in terms of a tradeoff curve: models should have high success rate on naturally occurring data and low failure rate on adversarial data, defined in section 3. Models that use confidence thresholding must also be benchmarked appropriately, against attacks that are aware the defender will use confidence thresholding. We propose a new family of attacks called MaxConfidence that is optimal in a variety of theoretical settings, and optimal in practice against linear models.

This paper introduces a family of attack on confidence thresholding algortihms. Such algorithms are allowed to refuse to make predictions when their confidence is below a certain threshold.
There are certainly interesting links between such models and KWIK [1] algorithms (which are also supposed to be able to respond 'null' to queries), however they are not mentioned in this paper, which focuses mainly on evaluation methodologies.
The definition of the metric is certainly natural: you would expect some trade-off between performance in the normal versus the adversarial regime. I am not certain why the authors don't simply measure the success rate on both natural and adversarial conditions, so as to have the performance metric uniform. Unfortunately the paper's notationleaves something to be desired, as it fails to concretely define the metric.
Let me do so instead, and consider the classification accuracy of a classification rule $P_t$ using a threshold $t$ under a (possibly adaptive) distribution $Q$ to be $U(P,Q)$. Then, we can consider $Q_N, Q_A$ as the normal and adversarial distribution and measure the corresponding accuracies.
Even if we do this, however, the authors do not clarify how they propose to select the classification rule. Should they employ something like a convex combination:
\[
V(P_t) := \alpha U(P_t, Q_N) + (1 - \alpha) U(P_t, Q_A)
\]
or maybe take a nimimax approach
\[
V(P_t) := \min \{U(P_t, Q) | Q = Q_A, Q_N\}
\]
In addition, the authors simply plot curves for various choices of $t$, however it is necessary to take into account the fact that measuring performance in this way and selecting $t$ aftewards amounts to a hyperparameter selection [2]. Thus, the thresholding should be chosen on an independent validation set in order to optimise the chosen performance measure, and then the choice should evaluated on a new test set with respect to the same measure $V$
The MaxConfidence attack is not very well described, in my opinion. However, it seems it simply wishes to find to find a single point $x \in \mathbb{S}$ that maximises the probability of misclassification. It is not clear to me why performance against an attack of this type is interesting to measure.
The main contribution of the paper seems to be the generalisation of the attack by Goodfellow et al to softmax regression. The proof of this statement is in a rather obscure place in the paper.
I am not sure I follow the idea for the proof, or what they are trying to prove. The authors should follow a standard Theorem/Proof organisation, clearing stating assumptions and what the theorem is showing us. It seems that they want to prove that if a solution to (1) exists, then MaxConfidence() finds it. But the only definition of MaxConfidence is (1). Hence I think that their theorem is vacuous. There are quite a few details that are also unclear such as what the authors mean by 'clean example' etc.
However the authors do not explain their attack very well, their definition of the performance metric is not sufficiently formal, and their evaluation methodology is weak. Since evaluation methodology is the central point of the paper, this is a serious weaknes. Finally, there doesn't seem to be a lot of connection with the conference's topic.
[1] Li, Lihong, Michael L. Littman, and Thomas J. Walsh. "Knows what it knows: a framework for self-aware learning." Proceedings of the 25th international conference on Machine learning. ACM, 2008.
[2] Bengio, Samy, Johnny Mariéthoz, and Mikaela Keller. "The expected performance curve." International Conference on Machine Learning, ICML, Workshop on ROC Analysis in Machine Learning. No. EPFL-CONF-83266. 2005.


INTEGER NETWORKS FOR DATA COMPRESSION WITH LATENT-VARIABLE MODELS
We consider the problem of using variational latent-variable models for data compression. For such models to produce a compressed binary sequence, which is the universal data representation in a digital world, the latent representation needs to be subjected to entropy coding. Range coding as an entropy coding technique is optimal, but it can fail catastrophically if the computation of the prior differs even slightly between the sending and the receiving side. Unfortunately, this is a common scenario when floating point math is used and the sender and receiver operate on different hardware or software platforms, as numerical round-off is often platform dependent. We propose using integer networks as a universal solution to this problem, and demonstrate that they enable reliable cross-platform encoding and decoding of images using variational models.

The paper presents a very important problem of utilizing a model on different platforms with own numerical round-offs. As a result, a model run on a different hardware or software than the one on which it was trained could completely fail due to numerical rounding-off issues. This problem has been considered in various papers, however, the classification task was mainly discussed. In this paper, on the other hand, the authors present how the numerical rounding-off issue could be solved in Latent-Variable Models (LVM).
In order to cope with the numerical rouding-off issue, the authors propose to use integer networks. They consider either quantized ReLU (QReLU) or quantized Tanh (Qtanh). Further, in order to properly train the integer NN, they utilize a bunch of techniques proposed in the past, mainly (Balle, 2018) and (Balle et al., 2018). However, as pointed out in the paper, some methods prevent training instabilities (e.g., Eqs. 18 and 19). All together, the paper tackles very important problem and proposes very interesting solution by bringing different techniques proposed for quantized NNs together .
Pros:
+ The paper is well-written.
+ The considered problem is of great importance and it is rather neglected in the literature.
+ The experiments are properly carried out.
+ The obtained results are impressive.
Cons:
- A natural question is whether the problem could be prevented by post-factum quantization of a neural network. As pointed out in the Discussion section, such procedure failed. However, it would be beneficiary to see an empirical evidence for that.
- It would be also interesting to see how a training process of an integer NN looks like. Since the NN is quantized, instabilities during training might occur. Additionally, its training process may take longer (more epochs) than a training of a standard (float) NN. An exemplary plot presenting a comparison between an integer NN training process and a standard NN training process would be highly appreciated.
- (Minor remark). The paper is well-written, however, it would be helpful to set the final learning algorithm. This would drastically help in reproducibility of the paper.
--REVISION--
After reading the authors response and looking at the new version of the paper I decided to increase my score. The paper tackles very important problem and I strongly believe it should be presented during the conference.


With the increasing demand to deploy convolutional neural networks (CNNs) on mobile platforms, the sparse kernel approach was proposed, which could save more parameters than the standard convolution while maintaining accuracy. However, despite the great potential, no prior research has pointed out how to craft an sparse kernel design with such potential (i.e., effective design), and all prior works just adopt simple combinations of existing sparse kernels such as group convolution. Meanwhile due to the large design space it is also impossible to try all combinations of existing sparse kernels. In this paper, we are the first in the field to consider how to craft an effective sparse kernel design by eliminating the large design space. Specifically, we present a sparse kernel scheme to illustrate how to reduce the space from three aspects. First, in terms of composition we remove designs composed of repeated layers. Second, to remove designs with large accuracy degradation, we find an unified property named information field behind various sparse kernel designs, which could directly indicate the final accuracy. Last, we remove designs in two cases where a better parameter efficiency could be achieved. Additionally, we provide detailed efficiency analysis on the final 4 designs in our scheme. Experimental results validate the idea of our scheme by showing that our scheme is able to find designs which are more efficient in using parameters and computation with similar or higher accuracy.

Standard dense 2D convolution (dense in space and channels) may waste parameters. This paper points out the many ways that sparser convolutional operators (“kernels”) may be combined into a single combined operator that may be used in place of dense convolution.
The paper waxes grandiose about the exponentially many ways that operations may be combined but then defines and tries only four. While trying four alternatives may be quite interesting, the paper could have avoided grandiose language by just stating: “We tried four things. If you restrict yourself to kernels with 3x3 receptive field and no repeated operations <and probably other assumptions>, there are only four unique combinations to be tried.” Perhaps a page of text could have been saved.
The paper also defines “information field” as the product of the operator’s (spatial) receptive field and the number of channels that each unit can see. Authors proceed to make broad claims about how information field is an important concept that predicts performance. While this may indeed turn out to be an important concept, it is not shown as such by the paper.
Claims:
“…we identify a easily measurable quantity named information field behind various sparse kernel designs, which is closely related to the model accuracy.”
“During the process to reduce the design space, we find an unified property named information field behind various designs, which could directly indicate the final accuracy.”
But the paper does not substantiate these claims.
Since information field is defined as the product of the receptive field and the number of channels seen, it would seem necessary to show, say, at least some experiments with varying receptive field sizes and number of channels. Then it might be shown, for example, that across a wide array of network sizes, widths, depths, holding all but information field constant, information field is predictive of performance. But these experiments are not done.
Receptive fields: the paper *only ever tries 3x3 receptive fields* (Table 2, 3, 4). So absolutely no support is given for the relevance of two out of the three components (i size, j size) comprising information field!
Number of channels: as far as I can tell, Table 2 and 3 contain the only results in this direction. Reading off of Table 2: for networks of the same depth (98), info size 256 works a bit better than 128*, and 512 works a bit better than 256.
* (see also Table 3 lines 4 vs 5 show the same 256 vs 128 effect.)
Cool. But *two comparisons* are not even close to enough to support the statement “we find an unified property named information field behind various designs”. It is enough to support the statement “for this single network we tried and using 3x3 receptive fields, we found that letting units see more channels seemed to help.” Unfortunately, this conclusion on its own is not a publishable result.
To make this paper great, you will have to close the gap between what you believe and what you have shown.
(1) You believe that information field is predictive of accuracy. So show it is predictive of accuracy across sufficiently many well-controlled experiments.
(2) It may also be that the PWGConv+DW+PWGConv combination is a winning one; in this case, show that swapping it in for standard convolution helps in a variety of networks (not just ResNet) and tasks (not just ImageNet).
Other minor notes:
 - Equations are critical in some parts of some papers, but e.g. triple nested sums probably aren’t the easiest way of describing group convolution.
 - The part about regexes seemed unnecessary. If 1000 different designs were tried in a large automated study where architectures were generated and pruned automatically, this detail might be important (but put it in SI). But if only four are tried this detail isn’t needed: we can see all four are different.
 - Figure 1 is a great diagram!
 - How efficient are these kernels to compute on the GPU? Include computation time.
 - “Efficiency given the total amount of parameters.” These equations and scaling properties seemed to miss the point. For example, “It can be easily verified that given the total number of parameters the greatest width is reached when the best efficiency is achieved.” This is just saying that standard convolution scales poorly as F -> infinity. This doesn’t seem like the most useful definition of efficiency. A better one might be “How many params do you need to get to x% accuracy on ImageNet?” Then show curves (# of params vs accuracy) for variants of a few popular model architectures (like ResNet or Xception with varying width and depth).
 - 3.3.2: define M and N


We propose a new architecture and training methodology for generative adversarial networks. Current approaches attempt to learn the transformation from a noise sample to a generated data sample in one shot. Our proposed generator architecture, called ChainGAN, uses a two-step process. It first attempts to transform a noise vector into a crude sample, similar to a traditional generator. Next, a chain of networks, called editors, attempt to sequentially enhance this sample. We train each of these units independently, instead of with end-to-end backpropagation on the entire chain. Our model is robust, efficient, and flexible as we can apply it to various network architectures. We provide rationale for our choices and experimentally evaluate our model, achieving competitive results on several datasets.

Summary:
The authors present a straightforward method to improve generative quality of GANs that can allow for fewer parameters by separating the task into a basic-generation followed by a chain of multiple edits to the base generation with different editor networks. The fact that separating the task allows for smaller networks is key to the reduction in parameters.  Each editor is trained separately in alternance, with its associated critic. Authors test their approach mostly on CIFAR10, as well as CelebA and MNIST.
Pros:
- The proposed method is simple and makes intuitive sense. Having editor generators acting like highly-conditioned GANs should make their job easier to produce better samples.
- Empirical results show that when removing editors for evaluation, some well-known architecture (DCGAN - WGAN+GP) can be outperformed with less parameters when comparing IS scores.
- Interesting leads and negative results are discussed in Section 5.
Cons :
- Comparisons with end-to-end training seems inadequate. The authors invalidate the end-to-end approach with two arguments; (1) that it doesn’t allow for the removal of superfluous editors once the training is done (Section 3.3), and (2) that IS scores are significantly lower (Section 4.2, Table1). It seems that both these statements are true simply because end-to-end learning is performed with a single score outputted by a single critic at the end of the chain, while it would be entirely possible and simple to keep all discriminators and associated losses and train end-to-end. This would still push all editors to produce good samples, thus allowing removal of editors at test-time, and would probably yield better results than those reported in Table 1. It could also invalidate the results shown in Figure 4 (left). For me this is an important missing comparison, as it might even yield better results than the proposed approach and invalidates one of the proposed advantage of the method.
- I think this idea of sequential generation has been explored before, (e.g. StackGAN [1, 2] or LAPGAN [3] and others?), in which unconditional image generation is performed on relatively complicated datasets with a somewhat more principled way of actually simplifying the task of the base generator. Therefore, I think important citations and valid comparisons are missing.
- The only reported metric is the Inception Score (IS), while most of the recent literature agrees that the Fréchet Inception Distance is a better metric. I think FID should be presented as well to be better aligned with recent literature, even in cases where comparison with previously reported performance is impossible (if previous works only presented IS). If you want to be compared to in future work, I think this is necessary.
- It would be a good addition to have FID/IS scores for each editor output, as we could see the quantitative increase in performance at each editing step.
- In Section 4.2, you specify that all experiments are done using the WGAN-GP training formulation. Looking at Table 1 this is unclear, as you specify this training scheme only for model 6 and model 9. If all models use the same training scheme, this information should be absent from the Table.
- CelebA results. Experiments are reported in the main text, without any results, which are only in the Appendix. These results don’t show any quantitative metrics and are visually disappointing. It is hard to see if the editors actually improve the generation.
- Some of the main results or discussions are based on Section 7, which is not the main article even though it is used as another Section instead of an Appendix. I think Section 7 should be separated into Appendices A, B, etc. Maybe some important aspects of the research presented could fit into the main text, given some removal of repetitions, and some compression of the intro to GANs, which should be vastly known by the ICLR community by now.
- Wrong citation format at the end of Section 2.1.
- Section 3.3 : “train the critic more than the generator in each iteration”. This could be clarified by stating exactly what you do (training the critic for k steps for each generator steps).
- It’s not always clear what the boldface represents throughout tables.
- The discussion in Section 5 about promising techniques explored is somewhat disappointing as efforts to investigate why training failed are not apparent.
- Every result shown from the proposed method is performed with ‘small’ or ‘tiny’ versions of existing architectures. This method could have additional value if it could boost performance on the same architecture, even if there are added editors and trainable parameters. The fact that such results are absent makes me suspicious of such a behavior.
Overall I think this paper presents a relevant and interesting idea. However I think this idea has been explored before with more convincing results and with a more principled approach. There are some important flaws in the comparisons made to assess the advantages of the method, and the overall results fail to convince of any important benefit. Based on the pros/cons stated above, I think this paper does not reach the required quality for acceptance in ICLR.
[1] StackGAN: Text to Photo-realistic Image Synthesis with Stacked Generative Adversarial Networks (Zhang et al. 2017)
[2] StackGAN++: Realistic Image Synthesis with Stacked Generative Adversarial Networks (Zhang et al. 2017)
[3] Deep Generative Image Models using a Laplacian Pyramid of Adversarial Networks (Denton et al. 2015)


UNSUPERVISED LEARNING VIA META-LEARNING
A central goal of unsupervised learning is to acquire representations from unlabeled data or experience that can be used for more effective learning of downstream tasks from modest amounts of labeled data. Many prior unsupervised learning works aim to do so by developing proxy objectives based on reconstruction, disentanglement, prediction, and other metrics. Instead, we develop an unsupervised meta-learning method that explicitly optimizes for the ability to learn a variety of tasks from small amounts of data. To do so, we construct tasks from unlabeled data in an automatic way and run meta-learning over the constructed tasks. Surprisingly, we find that, when integrated with meta-learning, relatively simple task construction mechanisms, such as clustering embeddings, lead to good performance on a variety of downstream, human-specified tasks. Our experiments across four image datasets indicate that our unsupervised meta-learning approach acquires a learning algorithm without any labeled data that is applicable to a wide range of downstream classification tasks, improving upon the embedding learned by four prior unsupervised learning methods.

In this paper, the task of performing meta-learning based on the unsupervised dataset is considered. The high-level idea is to generate 'pseudo-labels' via clustering of the given dataset using existing unsupervised learning techniques. Then the meta-learning algorithm is trained to easily discriminate between such labels. This paper seems to be tackling an important problem that has not been addressed yet to my knowledge. While the proposed method/contribution is quite simple, it possesses great potential for future applications and deeper exploration. The empirical results look strong and tried to address important aspects of the algorithm. The writing was clear and easy to follow. I especially liked how the authors tried to exploit possible pitfalls of their experimental design.
Minor comments and questions:
- Although the problem of interest is non-trivial and important, the proposed algorithm can be seen as just a naive combination of clustering and meta-learning. It would have been great to see some clustering algorithm that was specifically designed for this type of problem. Especially, the proposed CACTUs algorithm relies on sampling without replacement from the clustered dataset in order to enforce "balance" of the labels among the generated task. This might be leading to suboptimal results since the popularity of each cluster (i.e., how much it represents the whole dataset) is not considered.
- CACTUs seems to be relying on having random scaling of the k-means algorithm in order to induce diversity on the set of partitions being generated. I am a bit skeptical about the effectiveness of such a method for diversity. If this holds, it would be interesting to see the visualization of such a concept.
- Although only MAML was considered as the meta-learning algorithm, it would have been nice to consider one or more candidates to show that the proposed framework is generalizable. Still, I think the experiment is persuasive enough to expect that the algorithm would work well at practice.
- Would there be a trivial generalization of the algorithm to semi-supervised learning?
-------
I am satisfied with the author's response and changes they made to the text. I still think the paper brings significant contributions to the area, by showing that even generating the pseudo-tasks via unsupervised clustering method allows the meta-learning to happen.


LEARNING TWO-LAYER NEURAL NETWORKS WITH SYMMETRIC INPUTS
We give a new algorithm for learning a two-layer neural network under a general class of input distributions. Assuming there is a ground-truth two-layer network
where A, W are weight matrices, ξ represents noise, and the number of neurons in the hidden layer is no larger than the input or output, our algorithm is guaranteed to recover the parameters A, W of the ground-truth network. The only requirement on the input x is that it is symmetric, which still allows highly complicated and structured input. Our algorithm is based on the method-of-moments framework and extends several results in tensor decompositions. We use spectral algorithms to avoid the complicated non-convex optimization in learning neural networks. Experiments show that our algorithm can robustly learn the ground-truth neural network with a small number of samples for many symmetric input distributions.

This paper studies the problem of learning the parameters of a two-layer (or one-hidden layer) ReLU network $y=A\sigma(Wx)$, under the assumption that the distribution of $x$ is symmetric. The main technique here is the "pure neuron detector", which is a high-order moment function of a vector. It can be proved that the pure neuron detector is zero if and only if the vector is equal to the row vector of A^{-1}. Hence, we can "purify" the two layer neural network into independent one layer neural networks, and solve the problem easily.
This paper proposes interesting ideas, supported by mathematical proofs. This paper contains analysis of the algorithm itself, analysis of finding z_i's from span(z_i z_i^T), and analysis of the noisy case.
This paper is reasonably well-written in the sense that the main technical ideas are easy to follow, but there are several grammatical errors, some of which I list below. I list my major comments below:
1) [strong assumptions] The result critically depends on the fact that $x$ is symmetric around the origin and the requirement that activation function is a ReLU. Lemma 1, 2, 3 and Lemma 6 in the appendix are based on these two assumptions. For example, the algorithm fails if $x$ is symmetric around a number other than zero or there is a bias term (i.e. $y=A \sigma(Wx+b) + b'$ ). This strong assumptions significantly weaken the general message of this paper. Add a discussion on how to generalize the idea to more general cases, at least when the bias term is present.
2) [sample efficiency] Tensor decomposition methods tend to suffer in sample efficiency, requiring a large number of samples. In the proposed algorithm (Algorithm 2), estimation of $E[y \otimes x^{\otimes 3}]$ and $E[y \otimes y \otimes (x \otimes x)]$ are needed. How is the sample complexity with respect to the dimension? The theory in this paper suggests a poly(d, 1/\epsilon) sample efficiency, but the exponent of the poly is not known. In Section 4.1, the authors talk about the sample efficiency and claim that the sample efficiency is 5x the number of parameters, but this does not match the result in Figure 2. In the left of Figure 2, when d=10, we need no more than 500 samples to get error of W and A very small, but in the right, when d=32, 10000 samples can not give very small error of W and A. I suspect that the required number of samples to achieve small error scales quadratically in the number of parameters in the neural network. Some theoretical or experimental investigation to identify the exponent of the polynomial on d is in order. Also, perhaps plotting in log-y is better for Figure 2.
3) The idea of "purifying" the neurons has a potential to provide new techniques to analyze deeper neural networks. Explain how one might use the "purification" idea for deeper neural networks and what the main challenges are.
Minor comments:
"Why can we efficiently learn a neural network even if we assume one exists?" -> "The question of whether we can efficiently learn a neural network still remains generally open, even when the data is drawn from a neural network."
"with simple input distribution" -> "with a simple input distribution"


MARGINALIZED AVERAGE ATTENTIONAL NETWORK FOR WEAKLY-SUPERVISED LEARNING
In weakly-supervised temporal action localization, previous works have failed to locate dense and integral regions for each entire action due to the overestimation of the most salient regions. To alleviate this issue, we propose a marginalized average attentional network (MAAN) to suppress the dominant response of the most salient regions in a principled manner. The MAAN employs a novel marginalized average aggregation (MAA) module and learns a set of latent discriminative probabilities in an end-to-end fashion. MAA samples multiple subsets from the video snippet features according to a set of latent discriminative probabilities and takes the expectation over all the averaged subset features. Theoretically, we prove that the MAA module with learned latent discriminative probabilities successfully reduces the difference in responses between the most salient regions and the others. Therefore, MAAN is able to generate better class activation sequences and identify dense and integral action regions in the videos. Moreover, we propose a fast algorithm to reduce the complexity of constructing MAA from O(2 T ) to O(T 2 ). Extensive experiments on two large-scale video datasets show that our MAAN achieves a superior performance on weakly-supervised temporal action localization.

In this paper the authors focus on the problem of weakly-supervised action localization. The authors state that a problem with weakly-supervised attention based methods is that they tend to focus on only the most salient regions and propose a solution to this which reduces the difference between the responses for the most salient regions and other regions. They do this by employing marginalized average aggregation to averaging a sample a subset of features in relation to their latent discriminative probability then calculating the expectation over all possible subsets to produce a final aggregation.
The problem is interesting, especially noting that current attention methods suffer from paying attention to the most salient regions therefore missing many action segments in action localization. The authors build upon an existing weakly-supervised action localization framework, having identified a weakness of it and propose a solution. The work also pays attention to the algorithm's speed which is practically useful. The experiments also compare to several other potential feature aggregators.
However, there are several weakness of the current version of the paper:
- In parts the paper feels overly complicated, particularly in the method (section 2). It would be good to see more intuitive explanations of the concepts introduce here. For instance, the author's state that c_i captures the contextual information from other video snippets, it would be good to see a figure with an example video and the behaviour of p_i and c_i as opposed to lamba_i. I found it difficult to map p_i, c_i to z and lambda used elsewhere.
- The experimental evidence does not show where the improvement comes from. The authors manage to acheieve a 4-5% improvement over STPN through their re-implemenation of the algorithm, however only have a ~2% improve with their marginalized average attention on THUMOS. I would like to know the cause in the increase over the original STPN results: is it a case of not being able to replicate the results of STPN or do the different parameter choices, such as use of leakly RELU, 20 snippets instead of 400 and only rejecting classes whose video-level probabilities are below 0.01 instead of 0.1, cause this big of an increase in results? There is also little evidence that the actual proposal (contextual information) is the reason for the reported improvement.
- There seems to be several gaps in the review of current literature. Firstly, the authors refer to Wei et al. 2017 and Zhang et al. 2018b as works which erase the most salient regions to be able to explore regions other than the most salient. The authors state that the problem with these methods is that they are not end-to-end trainable, however Li et al. 2018 'Tell Me Where to Look': Guided Attention Inference Network' proposes a method which erases regions which is trainable end-to-end. Secondly, the authors do not mention the recent work W-TALC which performs weakly-supervised action localization and outperforms STPN. It would be good to have a baseline against this method.
- The qualitative results in this paper are confusing and not convincing. It is true that the MAAN's activation sequence shows peaks which correspond to groundtruth and are not present in other methods. However, the MAAN activation sequence also shows several extra peaks not present in other methods and also not present in the groundtruth, therefore it looks like it is keener to predict the presence of the action causing more true positives, but also more false positives. It would be good to see some discussion of these failure cases and/or more qualitative results. The current figure could be easily compressed by only showing one instance of the ground-truth instead of one next to each method.
I like the idea of the paper however I am currently unconvinced by the results that this is the correct method to solve the problem.


THE RELATIVISTIC DISCRIMINATOR: A KEY ELEMENT MISSING FROM STANDARD GAN
In standard generative adversarial network (SGAN), the discriminator D estimates the probability that the input data is real. The generator G is trained to increase the probability that fake data is real. We argue that it should also simultaneously decrease the probability that real data is real because 1) this would account for a priori knowledge that half of the data in the mini-batch is fake, 2) this would be observed with divergence minimization, and 3) SGAN would be more similar to integral probability metric (IPM) GANs. We show that this property can be induced by using a "relativistic discriminator" which estimate the probability that the given real data is more realistic than a randomly sampled fake data. We also present a variant in which the discriminator estimate the probability that the given real data is more realistic than fake data, on average. We generalize both approaches to non-standard GAN loss functions and we refer to them respectively as Relativistic GANs (RGANs) and Relativistic average GANs (RaGANs). We show that IPM-based GANs are a subset of RGANs which use the identity function. Empirically, we observe that 1) RGANs and RaGANs are significantly more stable and generate higher quality data samples than their non-relativistic counterparts, 2) Standard RaGAN with gradient penalty generate data of better quality than WGAN-GP while only requiring a single discriminator update per generator update (reducing the time taken for reaching the state-of-the-art by 400%), and 3) RaGANs are able to generate plausible high resolutions images (256x256) from a very small sample (N=2011), while GAN and LSGAN cannot; these images are of significantly better quality than the ones generated by WGAN-GP and SGAN with spectral normalization. The code is freely available on https://github.com/AlexiaJM/RelativisticGAN.

The paper describes an interesting tweak of the standard GAN model (inspired by IPM based GANs) where both the generator and the discriminator optimize relative realness (and fakeness) of the (real, fake) image pairs. The authors give some intuition for this tweak and ran experiments with CIFAR10 and CAT datasets. Different variants of the standard GAN and the new tweak were compared under the FID metric. The experimental setup and details are provided; and the code is made publicly available.
The results are good and their tweak seems to help in most of the cases. The paper, however, is not very well written and is not of publication quality.  All the insights given in Section 3 are wrong, incomplete and unsatisfying. For example, in Section 3.4, the authors suggest that gradient dynamics of the tweaked model (with some unrealistic and infeasible assumptions) is same as that of an IPM-GAN and contribute to stability. This is wrong. Similar dynamics (even under the unrealistic assumption), does not imply similar performance. In fact, if one is trying to move towards IPM dynamics, then one should try to tweak an IPM model directly. Section 3.2 also seems wrong from my understanding of GAN training. Section 3.3 could also be improved. In fact, any explanations based on minimizing JS divergence is incomplete without answering as to why JS divergence minimizing is the best thing to do.
The author should have provided more comparison images to rule out the fact that the tweak is not overfitting for the FID metric. The benchmarks are also weak and more experiments need to be done (Eg, CelebA).


Neural networks can converge faster with help from a smarter batch selection strategy. In this regard, we propose Ada-Boundary, a novel adaptive-batch selection algorithm that constructs an effective mini-batch according to the learning progress of the model. Our key idea is to present confusing samples what the true label is. Thus, the samples near the current decision boundary are considered as the most effective to expedite convergence. Taking advantage of our design, Ada-Boundary maintains its dominance in various degrees of training difficulty. We demonstrate the advantage of Ada-Boundary by extensive experiments using two convolutional neural networks for three benchmark data sets. The experiment results show that Ada-Boundary improves the training time by up to 31.7% compared with the state-of-the-art strategy and by up to 33.5% compared with the baseline strategy.

The paper describes a sampling distribution construction over examples from which to draw mini-batches to train multi-classification models. A distance function on examples is described wherein an example's current (softmax) label probabilities and correctness are taken into account. The bounded distance function supports quantization of example distances and then subsequent sampling from an exponentially decaying probability mass function defined over the binned examples. Results from experiments implementing the proposed method and some baselines on three image classification datasets are provided.
Clearly, any generic improvement to training DNN's has the potential for far-reaching impact. I thought the exposition was fairly clear and appreciated how the introductory sections provided an intuitive understanding of e.g., the differences between the proposed method and the method of Loshchilov and Hutter (2016). The relative conceptual simplicity of the proposed method is a clear positive. The experimental methodology and results are my biggest issues with the paper. The experimental evaluation suggests the proposed method was run 3 times, one for each value of the selection pressure parameter. Then, the best run was selected for comparison. This suggests the proposal is not practical. For results, the benefit of the proposed method is only clearly apparent in one of the three experiments (Fashion MNIST). In the MNIST case, the proposed method does not seem to improve upon the online batch method. For CIFAR-10, where a good case for the proposed method could have been made since the architecture is more complex and potentially more difficult to train, the improvement seems slight. Moreover, it isn't clear whether a relevant baseline was included (see second question below). Also, at least some discussion of computational cost incurred by the method should have been provided. Even better would be to include results wrt/ wall clock training time.
Questions/Comments:
Why not set \gamma = 1? Having a larger value seems to run counter to making training faster. Technically, to use the proposed method, all of the examples need to be processed only once before the distance-based sampling distribution can be utilized.
Does the random method of the paper denote uniformly at random from the entire dataset per batch or sequential batches from a pre-shuffled dataset per epoch? The distinction is important as Loshchilov and Hutter (2016) report that the latter method performs better than their online batch method on CIFAR-10.
ADA-easy seems to be an irrelevant baseline given the context of the paper.
The phrase "learner's level" is used multiple times, but not defined.
The average is reported in the convergence curves, but shouldn't the variance be reported as well?
Perhaps the selection pressure parameter can be annealed as performed in Loshchilov and Hutter (2016)?


This paper proposes a neural network for classification and regression, without the need to learn layout structures in the output space. Standard solutions such as softmax cross-entropy and mean squared error are effective but parametric, meaning that known inductive structures such as maximum margin separation and simplicity (Occam's Razor) need to be learned for the task at hand. Instead, we propose polar prototype networks, a class of networks that explicitly states the structure, i.e., the layout, of the output. The structure is defined by polar prototypes, points on the hypersphere of the output space. For classification, each class is described by a single polar prototype and they are a priori distributed with maximal separation and equal shares on the hypersphere. Classes are assigned to prototypes randomly or based on semantic priors and training becomes a matter of minimizing angular distances between examples and their class prototypes. For regression, we show that training can be performed as a polar interpolation between two prototypes, arriving at a regression with higher-dimensional outputs. From empirical analysis, we find that polar prototype networks benefit from large margin separation and semantic class structure, while only requiring a minimal amount of output dimensions. While the structure is simple, the performance is on par with (classification) or better than (regression) standard network methods. Moreover, we show that we gain the ability to perform regression and classification jointly in the same space, which is disentangled and interpretable by design.

This paper unifies both classification and regression task based on the polar prototype network. For classification, the prototypes for all classes are chosen in advance based on a max-margin principle, while the embedding of all instances is then optimized to have small cosine distance to assigned prototypes. For the regression, the output value is interpolated between the two prototypes. Experiments on classification, regression, and combined tasks show the method can achieve good results.
The idea of using the prototype and the polar system is interesting, and the whole paper is well-written. However, there are still some problems and questions about this paper.
1. There are two problems with using the max-margin prototypes. First, to maximize the smallest distance between two prototypes, the authors use MC or evolutionary algorithms to do the optimization, which may be time-consuming, and it may be extremely difficult when the prototype space is high dimension. Second, the previous approach indeed obtains discriminative prototypes, but we lose the **class correlation**. In the extreme case, it is equal distance between all prototypes, but some similar classes will have a smaller prototype distance than others. For example, the prototype distance between "cat" and "dog" should not be the same as that between "car1" and "car2". The semantic consideration in the paper can solve this problem to some extent, but there needs more evidence.
Using the pre-defined prototype is also considered in the paper "M. Perrot et al. Regressive Virtual Metric Learning. NIPS15".
2. For the unified output space
One main contribution is that based on the polar system, the method unifies both classification and regression tasks in the same space. We can also do this in basic embedding algorithms. In the embedding space, a method can do both classification and regression with the nearest neighbor rule (based on majority voting and average respectively). The authors should compare with such kinds of methods in the experiments.
3. Experiments
From the experiments, using semantic cannot improve a lot for the classification task. The authors can try more datasets to validate is this the common scenario. The reviewer strongly suggests the authors should compare with more methods. For example, in some papers the prototypes are learned simultaneously (Snell et al. Prototypical networks for few-shot learning. NIPS17; Wen et al. A discriminative feature learning approach
for deep face recognition. ECCV16); while in other cases, there are no prototypes as we optimize the triplet/contrastive loss directly. First, the authors can compare classification performance with these approaches; besides, some visualization results can also show the used prototypes or embeddings.
The main advantage of the method is not stressed clearly in the experiments part. The authors can clarify it in later versions.
The final rating depends on the authors' response.


Reinforcement learning (RL) is a metaheuristic aiming at teaching an agent to interact with an environment and maximizing the reward in a complex task. RL algorithms often encounter the difficulty in defining a reward function in a sparse solution space. Imitation learning (IL) deals with this issue by providing a few expert demonstrations, and then either mimicking the expert's behavior (behavioral cloning, BC) or recovering the reward function by assuming the optimality of the expert (inverse reinforcement learning, IRL). Conventional IL approaches formulate the agent policy by mapping one single state to a distribution over actions, which did not consider sequential information. This strategy can be less accurate especially in IL, a weakly supervised learning environment, especially when the number of expert demonstrations is limited. This paper presents an effective approach named Sequential IMItation LEarning (SIMILE). The core idea is to introduce sequential information, so that an agent can refer to both the current state and past state-action pairs to make a decision. We formulate our approach into a recurrent model, and instantiate it using LSTM so as to fuse both long-term and short-term information. SIMILE is a generalized IL framework which is easily applied to BL and IRL, two major types of IL algorithms. Experiments are performed on several robot controlling tasks in OpenAI Gym. SIMILE not only achieves performance gain over the baseline approaches, but also enjoys the benefit of faster convergence and better stability of testing performance. These advantages verify a higher learning efficiency of SIM-ILE, and implies its potential applications in real-world scenarios, i.e., when the agent-environment interaction is more difficult and/or expensive.

The paper proposes to integrate sequential information into imitation learning techniques.  The assumption is that mostly all the IL techniques are learning a policy which depends on state at time t, while the information contained in this state may be not sufficient to choose the right action (actually, this is the POMDP setting, the notion of POMDP not appearing in the paper....). The authors thus propose to use a recurrent neural network to encode the state by aggregating past information, instead of just using the features of the state at time t. They thus instantiate this idea on different methods and show that, on some problems, this approach can increase the quality of the final policy.
Actually, the contribution of the paper is a simple extension of existing methods: using a RNN instead of a simple NN in imitation learning models. First of all, when dealing with classical environments such as Atari, many papers propose to use the last N frames as a state encoding (instead of the last frame), following the same intuition. The studied setting thus corresponds to the PO-MDP case and using a RNN in POMDP is for example what is done in  [Merel etal. 2017]. Moreover, the problem of imitation learning (and particularly inverse RL) in POMDP has been of the interest of many papers like [Choi et al. 2008] for instance and many more, and it is unclear what is the positioning of this paper w.r.t existing works. Since the paper proposes just to encode history with a RNN, the proposed solution lacks of originality, and the contribution of the paper in term of model is quite low.  But the authors explain how this can be instantiated in three different settings (IRL, GAIL and BC) -- note that the section concerning the use of Adaboost is not clear and could be better described -- which can be of the interest of the community.
Concerning the experiments, I don't understand what is the split between training and testing data. Is it pairs of state-action coming from the experts ? or trajectories ? Moreover, I don't understand why these environments correspond to POMDP cases and the authors have to give details on that. For instance, mountain-car is clearly not a POMDP problem in its classical shape, nor Acrobot. As if, it makes the experiments very difficult to reproduce. The interest of using the RNN to encode history does not seem clear for each of the cases since it often degrades the final performance, so I don't know exactly what insights I can extract from the paper.
Pro:
* The approach is proposed for IRL, GAIL and BC
Cons:
* Lack of positionning w.r.t POMDP litterature
* Lack of details in the experiments, and lack of good experimental results
* Low contribution in term of model
[Merel et al. 2017]  Learning human behaviors from motion capture
by adversarial imitation
[Choi et al.] Inverse Reinforcement Learning in Partially Observable
Environments


OPTIMAL CONTROL VIA NEURAL NETWORKS: A CONVEX APPROACH
Control of complex systems involves both system identification and controller design. Deep neural networks have proven to be successful in many identification tasks, however, from model-based control perspective, these networks are difficult to work with because they are typically nonlinear and nonconvex. Therefore many systems are still identified and controlled based on simple linear models despite their poor representation capability. In this paper we bridge the gap between model accuracy and control tractability faced by neural networks, by explicitly constructing networks that are convex with respect to their inputs. We show that these input convex networks can be trained to obtain accurate models of complex physical systems. In particular, we design input convex recurrent neural networks to capture temporal behavior of dynamical systems. Then optimal controllers can be achieved via solving a convex model predictive control problem. Experiment results demonstrate the good potential of the proposed input convex neural network based approach in a variety of control applications. In particular we show that in the MuJoCo locomotion tasks, we could achieve over 10% higher performance using 5× less time compared with state-of-the-art model-based reinforcement learning method; and in the building HVAC control example, our method achieved up to 20% energy reduction compared with classic linear models.

This is a well-motived paper that considers bridging the gap
in discrete-time continuous-state/action optimal control
by approximating the system dynamics with a convex model class.
The convex model class has more representational power than
linear model classes while likely being more tractable and
stable than non-convex model classes.
They show empirical results in Mujoco continuous-control
environments and in an HVAC example.
I think this setup is a promising direction but I have
significant concerns with some of the details and claims
in this work:
1. Proposition 2 is wrong and the proposed input-convex recurrent
   neural network architecture not input-convex.
   To fix this, the D1 parameters should also be non-negative.
   To show why the proposition is wrong, consider the convexity of y2
   with respect to x1, using g to denote the activation function:
       z1 = g(U x1 + ...)
       y2 = g(D1 z1 + ...)
   Thus making
       y2 = g(D1 g(U x1 + ...) + ...)
   y2 is *not* necessarily convex with respect to x1 because D1 takes
   an unrestricted weighted sum of the convex functions g(U x1 + ...)
   With the ICRNN architecture as described in the paper not being
   input-convex, I do not know how to interpret the empirical findings
   in Section 4.2 that use this architecture.
2. I think a stronger and more formal argument should be used to show
   that Equation (5) is a convex optimization problem as claimed.
   It has arbitrary convex functions on the equality constraints that
   are composed with each other and then used in the objective.
   Even with parts of the objective being convex and non-decreasing
   as the text mentions, it's not clear that this is sufficient when
   combined with the composed functions in the constraints.
3. I have similar concerns with the convexity of Equation (6).
   Consider the convexity of x3 with respect to u1, where g is
   now an input-convex neural network (that is not recurrent):
       x3 = g(g(x1, u1), u2)

   This composes two convex functions that do *not* have non-decreasing
   properties and therefore introduces an equality constraint that
   is not necessarily even convex, almost certainly making the domain
   of this problem non-convex. I think a similar argument can be
   used to show why Equation (5) is not convex.
In addition to these significant concerns, I have a few other
minor comments.
1. Figure 1 hides too much information. It would be useful to know,
   for example, that the ICNN portion at the bottom right
   is solving a control optimization problem with an ICNN as
   part of the constraints.
2. The theoretical results in Section 3 seem slightly out-of-place within
   the broader context of this paper but are perhaps of standalone interest.
   Due to my concerns above I did not go into the details in this portion.
3. I think more information should be added to the last paragraph of
   Section 1 as it's claimed that the representational power of
   ICNNs and "a nice mathematical property" help improve the
   computational time of the method, but it's not clear why
   this is and this connection is not made anywhere else in the paper.
4. What method are you using to solve the control problems in
   Eq (5) and (6)?
5. The empirical setup and tasks seems identical to [Nagabandi et al.].
   Figure 3 directly compares to the K=100 case of their method.
   Why does Fig 6 of [Nagabandi et al.] have significantly higher rewards
   for their method, even in the K=5 case?
6. In Figure 5, f_NN seems surprisingly bad in the red region of the
   data on the left side. Is this because the model is not using
   many parameters? What are the sizes of the networks used?


DETERMINISTIC VARIATIONAL INFERENCE FOR ROBUST BAYESIAN NEURAL NETWORKS
Bayesian neural networks (BNNs) hold great promise as a flexible and principled solution to deal with uncertainty when learning from finite data. Among approaches to realize probabilistic inference in deep neural networks, variational Bayes (VB) is theoretically grounded, generally applicable, and computationally efficient. With wide recognition of potential advantages, why is it that variational Bayes has seen very limited practical use for BNNs in real applications? We argue that variational inference in neural networks is fragile: successful implementations require careful initialization and tuning of prior variances, as well as controlling the variance of Monte Carlo gradient estimates. We provide two innovations that aim to turn VB into a robust inference tool for Bayesian neural networks: first, we introduce a novel deterministic method to approximate moments in neural networks, eliminating gradient variance; second, we introduce a hierarchical prior for parameters and a novel Empirical Bayes procedure for automatically selecting prior variances. Combining these two innovations, the resulting method is highly efficient and robust. On the application of heteroscedastic regression we demonstrate good predictive performance over alternative approaches.

Summary:
This work is tackling two difficulties in current VB applied to DNNs ("Bayes by backprop"). First, MC approximations of intractable expectations are replaced by deterministic approximations. While this has been done before, the solution here is new and very interesting. Second, a Gaussian prior with length scales is learned by VB empirical Bayes alongside the normal training, which is also very useful.
The term "fixing VB" and some of the intro is not really supported by the rather weak experiments, done on small datasets and networks, where much older work like Barber&Bishop would apply without any problems. While interesting and potentially very useful novelties are presented, and the writing is excellent, both experiments and motivation can be improved.
- Quality: Extremely well written paper, I learned a lot from it. Approximations are
   tested, great figures to explain things. And the major technical novelty, the
   expression for <h_j h_l>, is really interesting and useful.
- Clarity: Excellent writing until it comes to the experiments. Here, important
   details are just missing, for example what q(w) is (fully factorized Gaussian?).
   Very nice literature review, also historical.
- Originality: The idea of matching Gaussian moments along the network graph is
   previously done in PBP (Lobato, Adams), as acknowledged here. Porting this from
   ADF to VB gives dDVI. PBP also has the property that a DL system gives you the
   gradients. Having said that, I think dDVI may be more useful than PBP.
   While Barber&BIshop 98 is cited, they miss the expression for <h_j h_l> in
   there. Now, what is done here, is more elegant, does not need 1D quadrature.
- Significance: Judging from the existing experiments, the significance may be
   rather small, *if one only looks at test log likelihood*. I'd still give this the
   benefit of the doubt, as in particular dDVI could be really interesting at large
   scale as well. But the authors may tone down their language a bit.
   To increase significance, I recommend to comment beyond just test log
   likelihood scores. For example:
   - Does the optimization become simpler, less tuning required, more automatic?
      Would one not expect so, given you make a big point out of reducing variance?
      Does it converge faster?
   - Can you do something with your posterior that normal DNN methods cannot
      do? Better decisions (bandits, active learning, HPO)? Continual learning?
      In the end, who really cares about test log likelihood?
Experiments:
- What is the q(w) family being used here? Fully factorized Gaussian? I
   suppose so for dDVI. But for DVI? Not said anywhere, in main paper or
   Appendix
- A bit disappointing. Why not evaluate at least dDVI with diagonal q(w) on
   some much larger models and datasets? Why not quote numbers on speed
   and robustness of learning, etc? Show what you really gain by reducing the
   variance.
- Experiments are OK, but on pretty small datasets, and for single hidden
   layer NNs. On such data and models, the Barber&Bishop 98 method could
   be run as well
- Was MCVI run with re-parameterization? This is really important. If not,
   this would be an important missing comparison. Please be clear in the main
   text
- Advantages over MCVI are not very large. At least, dDVI should be faster to
   converge than MCVI.
   Can you say something about robustness of training? Is it easier to train
   dDVI than MCVI?
- Why not show the PBP-1 results, comparing to dDVI, in the main text? Are they
   obtained with the same model? dDVI is doing better.
Other points:
- Please acknowledge the <h_j h_l> expression in Barber&Bishop 98. Yours is
   more elegant and faster (does not need 1D quadrature)
- Relation to PBP: Note that dDVI has an advantage in practice. With PBP, I need
   to compute gradients for every datapoint. In dDVI, I can do mini-batch
   updates.
- I just *love* the header "Wild approximations". I tend to refer to this kind of work
   as "weak analogies". Why do you not also compare against this, and show it really
   does not work?