Many state-of-the-art methods of recognizing human action are based on attention mechanism, which shows the importance of attention mechanism in action recognition. With the rapid development of neural networks, human action recognition has been achieved great improvement by using convolutional neural networks (C-NN) or recurrent neural networks (RNN). In this paper, we propose a model based on spatial-temporal attention weighted LSTM. This model pays attention to the key part in each video frame, and also focuses on the important frames in each video sequence, thus the most important theme for our model is how to find out the key point spatially and the key frames temporally. We show a feasible architecture which can solve those two problems effectively and achieve a satisfactory result. Our model is trained and tested on three datasets including UCF-11, UCF-101, and HMDB51. Those results demonstrate a high performance of our model in human action recognition.

# 1. Summary
This paper presents a spatio-temporal attention LSTM for action recognition, where attention decides which pixels and frames are more important for classification. ConvNet features are extracted, a first layer of attention looks at the pixel level, then a second layer is applied at the temporal level. An LSTM is used to connect frame representation through time.
Weaknesses:
* The paper do not present substantial novelty compared to previous work. In fact, it has a strong overlap with (Song et al., 2017) (see #3)
* Some modeling choices are not well motivated (see #2)
* Ablation study showing that each modeling decision are motivated from a practical perspective is missing (see #4)
* The paper fails in comparing with relevant papers (see #4)
# 2. Clarity and Motivation
* Page 1 “many new deep learning methods of action recognition would use iDT as one part of their networks to optimize their models ”: this statement is not clear, please provide references of methods that do this. To my knowledge iDTs are part of the input of a ConvNet or used as complementary feature to other networks (e.g., C3D, I3D, …).
* Page 1, “Two-stream CNN (Feichtenhofer et al., 2016b)”: The reference might not really accurate. The citation should be: Two-Stream Convolutional Networks for Action Recognition in Videos Karen Simonyan, Andrew Zisserman.
*Page 1, “The pure RNN-based models are usually used on skeleton data“: it is not clear right away why the authors discuss some paper about skeleton data since it is not an application studied in this paper.
* Page 3, Sec. 2.2, “\alpha_t is a matrix”: why is it a matrix? It seems that it is a vector of length 196.
* By reshaping the features as Fig. 2, you loose the spatial consistency between neighbour pixels. How does Eq 2 deals with this? It seems that a better approach will be to have convolutions instead of fully-connected layers in Eq. 2. Have the authors considered this option?
* In neural machine translation models, usually the weights are normalized with a softmax before the weighted average of Eq. 3 and 6. It seems that here the alphas are normalized but the betas are not before Eq. 6. Any explanation about this?
* My comment above seems that is also related with the need of the regularisation term in Eq. 8. Probably it is not really needed in case that the betas are also normalized.
* A discussion is missing why the two attention models (spatial and temporal) are different. In principle, one could adopt the same kind of attention model for both the spatial and temporal component. One reason to have different models would be to consider the spatial relations between neighbour features in a frame (which is not the case of this model, as I highlighted above)
* Page 6, “The second term is applied to force the model to pay more spatial attention on more relevant parts in the frame automatically […]. The third term is used to restrict the unlimited increasing of temporal attention“: this sentence is a bit unclear. More details and intuition about how the 2nd and 3rd term work would be appreciated.
# 3. Novelty
From a methodological point of view the paper is not novel enough. It seems that the model is a combination between of the soft attention mechanism (Xu et al., 2015) (Sharma et al., 2016) and the temporal attention mechanism (Song et al., 2017). The overlap with the latter paper is substantial. From the application point of view, there is also little novelty given that the paper is tested on action recognition using relatively-small datasets.
# 4. Experimentation
Since this paper is an application paper, and there is not much novelty about the model, one would expect a comprehensive set of experiments.
* Ablation study is missing. Looking at the model in Fig. 3, it seems that not all the components are required. Some questions should be:
** Since attention is already working on the temporal domain, why do we need an LSTM model which seems redundant?
** What is the impact of removing the first layer of attention (\alpha)? And the temporal one (\beta)?
* The selected datasets are bit small scale. It would have been nice to see some results with bigger and more challenging datasets, such as Kinetics or similar.
* The paper fails in comparing with relevant papers (table 1). The topic of action recognition is widely explored, specifically for the datasets used in this paper. References and comparison numbers can be found here, for example: http://www.actionrecognition.net/files/dsetdetail.php?did=6;  and   http://www.actionrecognition.net/files/dsetdetail.php?did=5;


BEYOND PIXEL NORM-BALLS: PARAMETRIC ADVERSARIES USING AN ANALYTICALLY DIFFERENTIABLE RENDERER
Many machine learning image classifiers are vulnerable to adversarial attacks, inputs with perturbations designed to intentionally trigger misclassification. Current adversarial methods directly alter pixel colors and evaluate against pixel norm-balls: pixel perturbations smaller than a specified magnitude, according to a measurement norm. This evaluation, however, has limited practical utility since perturbations in the pixel space do not correspond to underlying real-world phenomena of image formation that lead to them and has no security motivation attached. Pixels in natural images are measurements of light that has interacted with the geometry of a physical scene. As such, we propose a novel evaluation measure, parametric normballs, by directly perturbing physical parameters that underly image formation. One enabling contribution we present is a physically-based differentiable renderer that allows us to propagate pixel gradients to the parametric space of lighting and geometry. Our approach enables physically-based adversarial attacks, and our differentiable renderer leverages models from the interactive rendering literature to balance the performance and accuracy trade-offs necessary for a memory-efficient and scalable adversarial data augmentation workflow.

Summary:
This work presents a method to generate adversary examples capable of fooling a neural network classifier. Szegedy et al. (2013) were the first to expose the weakness of neural networks against adversarial attacks, by adding a human-imperceptible noise to images to induce misclassification. Since then, several works tackled this problem by modifying the image directly in the pixel space: the norm-balls convention. The authors argue that this leads to non-realistic attacks and that a network would not benefit from training with these adversarial images when performing in the real world. Their solution and contributions are parametric norm-balls: unlike state-of-the-art methods, they perform perturbations in the image formation space, namely the geometry and the lighting, which are indeed perturbations that could happen in real life. For that, they defined a differentiable renderer by making some assumptions to simplify its expression compared to solving a light transport equation. The main simplifications are the direct illumination to gain computation efficiency and the distant illumination and diffuse material assumptions to represent lighting in terms of spherical harmonics as in Ramamoorthi et al. (2001), which require only 9 parameters to approximate lighting. This allows them to analytically derivate their loss function according to the geometry and lighting and therefore generate their adversary examples via gradient descent. They show that their adversary images generalize to other classifiers than the one used (ResNet). They then show that injecting these images into the training set increase the robustness of WideResNet against real attacks. These real attack images were taken by the authors in a laboratory with varying illumination.
Strength:
- The proposed perturbations in the image formation space simulate the real life scenario attacks.
- The presented results show that the generated adversary images do fool the classifier (used to compute the loss) but also new classifiers (different than the one used to compute the loss). As a consequence the generated adversary images increase the robustness of the considered classifier.
- Flexibility in their cost function allows for diverse types of attacks: the same modified geometry can fool a classifier in several views, either into detecting the same object or detecting different false objects under different views.
Major comments:
- Method can only compute synthetic adversary examples, unlike state-of-the-art.
- The main contribution claimed by the author is that their perturbations are realistic and that it would help better increase the robustness of classifiers against real attacks. However, they do not give any comparison to the state-of-the-art methods as is expected.
Minor comments:
- Even if the paper is well written, they are still some typos.


Low-precision training is a promising way of decreasing the time and energy cost of training machine learning models. Previous work has analyzed low-precision training algorithms, such as low-precision stochastic gradient descent, and derived theoretical bounds on their convergence rates. These bounds tend to depend on the dimension of the model d in that the number of bits needed to achieve a particular error bound increases as d increases. This is undesirable because a motivating application for low-precision training is large-scale models, such as deep learning, where d can be huge. In this paper, we prove dimension-independent bounds for low-precision training algorithms that use fixed-point arithmetic, which lets us better understand what affects the convergence of these algorithms as parameters scale. Our methods also generalize naturally to let us prove new convergence bounds on low-precision training with other quantization schemes, such as lowprecision floating-point computation and logarithmic quantization.

The paper considers the problem of low precision stochastic gradient descent. Specifically, they study updates of the form x_{t + 1} = Q (x_t - alpha * g_t), where g_t is a stochastic gradient, and Q is a quantization function. The goal is to produce quantization functions that simultaneously increase the convergence rate as little as possible, while also requiring few bits to represent. This is motivated by the desire to perform SGD on low precision machines.
The paper shows that under a set of somewhat nonstandard assumptions, previously studied quantization functions as well as other low precision training algorithms are able to match the performance of non-quantized SGD, specifically, losing no additional dimension factors. Previous papers, to the best of my knowledge, did not prove such bounds, except under strong sparsity conditions on the gradients. I did not check their proofs line-by-line however they seem correct at a high level.
I think the main discussion about the paper should be about the assumptions made in the analysis.  As the authors point out, besides the standard smoothness and variance conditions on the functions, some additional assumptions about the function must be made for such dimension independent bounds to hold. Therefore I believe the main contribution of this paper is to identify a set of conditions under which these sorts of bounds can be proven.
Specifically, I wish to highlight Assumption 2, namely, that the ell_1 smoothness of the gradients can be controlled by the ell_2 difference between the points, and Assumption 4, which states that each individual function (not just the overall average), has gradients with bounded ell_2 and ell_1 norm at the optimal point. I believe that Assumption 2 is a natural condition to consider, although it does already pose some limitations on the applicability of the analysis. I am less sold on Assumption 4; it is unclear how natural this bound is, or how necessary it is to the analysis.
The main pros of these assumptions are that they are quite natural conditions from a theoretical perspective (at least, Assumption 2 is). For instance, as the authors point out, this gives very good results for sparse updates. Given these assumptions, I don’t think it’s surprising that such bounds can be proven, although it appears somewhat nontrivial.  The main downside is that these assumptions are somewhat limiting, and don’t seem to be able to explain why quantization works well for neural network training. If I understand Figure 4b correctly, the bound is quite loose for even logistic regression on MNIST. However, despite this, I think formalizing these assumptions is a solid contribution.
The paper is generally well-written (at least the first 8 pages) but the supplementary material has various minor issues.
Smaller comments / questions:
- While I understand it is somewhat standard in optimization, I find the term “dimension-independent“ here somewhat misleading, as in many cases in practice (for instance, vanilla SGD on deep nets), the parameters L and kappa (not to mention L_1 and kappa_1) will grow with the dimension.
- Do these assumptions hold with good constants for training neural networks? I would be somewhat surprised if they did.
- Can one get dimension independent bounds for quantized gradients under these assumptions?
- The proofs after page 22 are all italicized.
- The brackets around expectations are too small in comparison to the rest of the expressions.


Real-time speech recognition on mobile and embedded devices is an important application of neural networks. Acoustic modeling is the fundamental part of speech recognition and is usually implemented with long short-term memory (LSTM)-based recurrent neural networks (RNNs). However, the single thread execution of an LSTM RNN is extremely slow in most embedded devices because the algorithm needs to fetch a large number of parameters from the DRAM for computing each output sample. We explore a few acoustic modeling algorithms that can be executed very efficiently on embedded devices. These algorithms reduce the overhead of memory accesses using multi-timestep parallelization that computes multiple output samples at a time by reading the parameters only once from the DRAM. The algorithms considered are the quasi RNNs (QRNNs), Gated ConvNets, and diagonalized LSTMs. In addition, we explore neural networks that equip one-dimensional (1-D) convolution at each layer of these algorithms, and by which can obtain a very large performance increase in the QRNNs and Gated ConvNets. The experiments were conducted using two tasks, one is the connectionist temporal classification (CTC)-based end-to-end speech recognition on WSJ corpus and the other is the phoneme classification on TIMIT dataset. We not only significantly increase the execution speed but also obtain a much higher accuracy, compared to LSTM RNN-based modeling. Thus, this work can be applicable not only to embedded system-based implementations but also to server-based ones.

This paper discusses applications of variants of RNNs and Gated CNN to acoustic modeling in embedded speech recognition systems, and the main focus of the paper is computational (memory) efficiency when we deploy the system. The paper well describes the problem of the current LSTM, especially focusing on the recurrent connection matrix operations, which is a bottle neck in this scenario, and introduces variants of RNNs (e.g., QRNN). Also these variants may not yield enough performance compared with LSTM, but 1-D convolution and/or deep structure helps to avoid the degradation. One of the biggest issues of this paper is that they use CTC as an acoustic model, while still many real speech recognition applications and major open source (Kaldi) use hybrid HMM/DNN(TDNN, LSTM, CNN, etc.) systems. Therefore, the paper's claim on CTC is not along with the current application trends. (It may be changed near future, but still hybrid systems are dominant). For example, the WSJ WER performance listed in Table 3 is easily obtained by a simple feed-forward DNN in the hybrid system. The latest Lattice free MMI with TDNN can achieve better performance (~2.X% WER), and this decoding is quite fast compared with LSTM. The authors should consider this current situation of state-of-the-art speech recognition. Also, the techniques described in the paper are all based on existing techniques, and the paper lacks the technical novelty.
Other comments:
- in Abstract and the first part of Introduction: as I mentioned above, CTC based character-prediction modeling is not a major acoustic model.
- The paper needs some discussions about TDNN, which is a major acoustic modeling (fast and accurate) in Kaldi
- p.4 first line "and  represents element-wise multiplication": The element-wise multiplication operation was first appeared in Eq. (1), and it should be explained there.
- Section 3.2: I actually don't fully understand the claims of this experiment based on TIMIT, as it is phoneme recognition, and not directly related to the real application, which is the main target of this paper I think. My suggestion is to place these TIMIT based experiments as a preliminary experiment to investigate the variants of RNN or gated CNN before the WSJ experiments. (I did not say that Section 3.2 is useless. This analysis is actually valuable, and this suggested change about the position of this TIMIT experiment can avoid some confusion of the main target of this paper.)


Many real-world time series, such as in activity recognition, finance, or climate science, have changepoints where the system's structure or parameters change. Detecting changes is important as they may indicate critical events. However, existing methods for changepoint detection face challenges when (1) the patterns of change cannot be modeled using simple and predefined metrics, and (2) changes can occur gradually, at multiple time-scales. To address this, we show how changepoint detection can be treated as a supervised learning problem, and propose a new deep neural network architecture that can efficiently identify both abrupt and gradual changes at multiple scales. Our proposed method, pyramid recurrent neural network (PRNN), is designed to be scale-invariant, by incorporating wavelets and pyramid analysis techniques from multi-scale signal processing. Through experiments on synthetic and real-world datasets, we show that PRNN can detect abrupt and gradual changes with higher accuracy than the state of the art and can extrapolate to detect changepoints at novel timescales that have not been seen in training.

1. This papers leverages the concept of wavelet transform within a deep architecture to solve the classic problem (especially for wavelet analysis) of change point detection. The authors do a reasonably comprehensive job of demonstrating the efficacy of the proposed framework using various synthetic and real data sets with both gradual and abrupt changes
2. The concept of pyramid network idea is not really new, in the context of CNN it has been established quite well. The paper should highlight this fact by citing papers such as "Lin, Tsung-Yi, et al. "Feature Pyramid Networks for Object Detection." CVPR. Vol. 1. No. 2. 2017."
3. Involving wavelet transforms in deep nets have been done before. This paper attempts to learn wavelet transform parameters by involving them as trainable layers. But even this kind of idea is also emerging in the community. Papers such as "Fujieda, Shin, Kohei Takayama, and Toshiya Hachisuka. "Wavelet Convolutional Neural Networks." arXiv preprint arXiv:1805.08620 (2018)" need to be discussed in this context.
4. The biggest issue in my mind is that I feel "Chung et al 2016" is still a very similar framework as the proposed one. While authors argue that it uses more like CNN architecture and the proposed method may pick up the multi-scale features better, comparison with this seems to be most appropriate. This will also clearly identify the benefits of the wavelet structure to the filters and multi-resolution analysis approaches.
5. RCNN term has been used for CNN+RNN architecture. This may not be a good terminology to use since RCNN is a very popular term referring to Region based CNN for detection and localization purposes.
6. AUC metric, I believe is the - area under ROC curve, this needs to be spelled out, how it is computed? at least in the Appendix
xxxxxxxxxxxxxxxxxxx
Appreciate the authors' rebuttal, updated my score.


We propose a new approach, known as the iterative regularized dual averaging (iRDA), to improve the efficiency of convolutional neural networks (CNN) by significantly reducing the redundancy of the model without reducing its accuracy. The method has been tested for various data sets, and proven to be significantly more efficient than most existing compressing techniques in the deep learning literature. For many popular data sets such as MNIST and CIFAR-10, more than 95% of the weights can be zeroed out without losing accuracy. In particular, we are able to make ResNet18 with 95% sparsity to have an accuracy that is comparable to that of a much larger model ResNet50 with the best 60% sparsity as reported in the literature.

iRDA Method for sparse convolutional neural networks
This paper considers the problem of training a sparse neural network. The main motivation is that usually all state of the art neural network’s size or the number of weights is enormous and saving them in memory is costly. So it would be of great interest to train a sparse neural network. To do so, this paper proposed adding l1 regularizer to RDA method in order to encourage sparsity throughout training. Furthermore, they add an extra phase to  RAD algorithm where they set the stochastic gradient of zero weights to be zero. They show experimentally that the method could give up to 95% sparsity while keeping the accuracy at an acceptable level.
More detail comments:
1- In your analysis for the convergence, you totally ignored the second step. How do you show that with the second step still the method converge?
2- \bar{w} which is used in the thm 1, is not introduced.
3- In eq 5, you say g_t is subfunction. What is it?
4- When does the algorithm switch from step 1 to step 2?
5- In eq 35 what is \sigma?
6- What is the relation between eq 23 and 24? The paper says 23 is an approximation for 24 but the result of 23 is a point and 24 is a function.
7- What is MRDA in the Fig 1?


HIERARCHICAL REINFORCEMENT LEARNING VIA ADVANTAGE-WEIGHTED INFORMATION MAXIMIZATION
Real-world tasks are often highly structured. Hierarchical reinforcement learning (HRL) has attracted research interest as an approach for leveraging the hierarchical structure of a given task in reinforcement learning (RL). However, identifying the hierarchical policy structure that enhances the performance of RL is not a trivial task. In this paper, we propose an HRL method that learns a latent variable of a hierarchical policy using mutual information maximization. Our approach can be interpreted as a way to learn a discrete and latent representation of the state-action space. To learn option policies that correspond to modes of the advantage function, we introduce advantage-weighted importance sampling. In our HRL method, the gating policy learns to select option policies based on an option-value function, and these option policies are optimized based on the deterministic policy gradient method. This framework is derived by leveraging the analogy between a monolithic policy in standard RL and a hierarchical policy in HRL by using a deterministic option policy. Experimental results indicate that our HRL approach can learn a diversity of options and that it can enhance the performance of RL in continuous control tasks.

Revision: The authors addressed most of my concerns and clearly put in effort to improve the paper. The paper explains the central idea better, is more precise in terminology in general, and the additional ablation gives more insight into the relative importance of the advantage weighting. I still think that the results are a bit limited in scope but the idea is interesting and seems to work for the tasks in the paper. I adjusted my score to reflect this.
Summary:
The paper proposes an HRL system in which the mutual information of the latent (option) variable and the state-action pairs is approximately maximized. To approximate the mutual information term, samples are reweighted based on their estimated advantage. TD3 is used to optimize the modules of the system. The system is evaluated on continuous control task from OpenAI gym and rllab.
For the most part, the paper is well-written and it provides a good overview of related work and relevant terminology. The experiments seem sound even though the results are not that impressive. The extra analysis of the option space and temporal distribution is interesting.
Some parts of the theoretical justification for the method are not entirely clear to me and would benefit from some clarification. Most importantly, it is not clear to me why the policy in Equation 7 is considered to be optimal. Given some value or advantage function, the optimal policy would be the one that picks the action that maximizes it. The authors refer to earlier work in which similar equations are used, but in those papers this is typically in the context of some entropy maximizing penalty or KL constraint. A temperature parameter would also influence the exploration-exploitation trade-off in this ‘optimal’ policy. I understand that the rough intuition is to take actions with higher advantage more often while still being stochastic and exploring but the motivation could be more precise given that most of the subsequent arguments are built on top of it. However, this is not the policy that is used to generate behavior. In short, the paper is clear enough about how the method is constructed but it is not very clear to me *why* the mutual information should be optimized with respect to this 'optimal' policy instead of the actual policy one is generating trajectories from.
HRL is an interesting area of research with the potential to learn complicated behaviors. However, it is currently not clear how to evaluate the importance/usefulness of hierarchical RL systems directly and the tasks in the paper are still solvable by standard systems. That said, the occasional increase in sample efficiency over plain TD3 looks promising. It is somewhat disappointing that the number of beneficial option is generally so low. To get more insight in the methods it would have been nice to see a more systematic ablation of related methods with different mutual information pairings (action or state only) and without the advantage weighting. Could it be that the number of options has to remain limited because there is no parameter sharing between them? It would be interesting to see results on more challenging control problems where the hypothesized multi-modal advantage structure is more likely to be present.
All in all I think that this is an interesting paper but the foundations of the theoretical motivation need a bit more clarification. In addition, experiments on more challenging problems and a more systematic comparison with similar models would make this a much stronger paper.
Minor issues/typos:
- Contributions 2 and 3 have a lot of overlap.
- The ‘o’ in Equation 2 should not be bold font.
- Appendix A. Shouldn’t there be summations over ‘o’ in the entropy definitions?


There are two major paradigms of white-box adversarial attacks that attempt to impose input perturbations. The first paradigm, called the fix-perturbation attack, crafts adversarial samples within a given perturbation level. The second paradigm, called the zero-confidence attack, finds the smallest perturbation needed to cause misclassification, also known as the margin of an input feature. While the former paradigm is well-resolved, the latter is not. Existing zero-confidence attacks either introduce significant approximation errors, or are too time-consuming. We therefore propose MARGINATTACK, a zero-confidence attack framework that is able to compute the margin with improved accuracy and efficiency. Our experiments show that MARGINATTACK is able to compute a smaller margin than the state-ofthe-art zero-confidence attacks, and matches the state-of-the-art fix-perturbation attacks. In addition, it runs significantly faster than the Carlini-Wagner attack, currently the most accurate zero-confidence attack algorithm.

The authors propose a new method for constructing adversarial examples called MarginAttack. The method is inspired by Rosen's algorithm, a classical algorithm in constrained optimization. At its core, Rosen's algorithm (instantiated for adversarial examples) alternates between moving towards the set of misclassified points and moving towards the original data point (while ensuring that we do not move too far away from the set of misclassified points). The authors provide theoretical guarantees (local convergence) and a broad set of experiments. The experiments show that MarginAttack finds adversarial examples with small distortion (as good as the baselines or slightly better), and that the algorithm runs faster than the Carlini-Wagner (CW) baseline (but slower than other methods).
The authors make a distinction between "fixed perturbation" attacks and "zero confidence" attacks. The former finds the strongest attack within a given constrained set, while the latter finds the smallest perturbation that leads to a misclassification. Method such as projected gradient descent fall into the "fixed perturbation" category, while MarginAttack and CW belong to the "zero confidence" category. The authors claim that zero confidence attacks pose a harder problem and hence mainly compare their experimental results to the CW attack. Indeed, their results show that MarginAttack is 3x - 5x faster than CW and sometimes achieves smaller perturbations.
First of all, I would like to emphasize that the authors conducted a thorough experimental study on multiple datasets using multiple baseline algorithms. Unfortunately, the comparison to CW and PGD still leaves some questions in my opinion:
- The authors state that CW does an internal binary search over the Lagrangian multiplier, and that this search goes for up to 10 steps. As a result, it is not clear whether the running time benchmarks are a fair comparison since MarginAttack does not automatically tune its parameters. To the best of my knowledge, the CW implementation in Cleverhans is specifically set up so that the user does not need to tune a large number of hyperparameters (the implementation accepts a running time overhead to achieve this). Since MarginAttack also contains multiple hyperparameters (see Table 4), it would be interesting to see how the running time of MarginAttack compares to that of a tuned CW implementation without the binary search.
- The authors explicitly state that the step sizes for CW were tuned for best performance, but do not mention this for PGD. For a fair comparison, the step sizes used for PGD should also be (approximately) tuned. Moreover, it is not clear why PGD is only used for an l_inf comparison and not a l_2 comparison.
- In the introduction, the authors emphasize the distinction between fixed perturbation attacks and zero confidence attacks. However, from an optimization point of view, these two notions are clearly related and a fixed perturbation attack can be converted to a small perturbation / zero confidence attack via a binary search over the perturbation size. While one would indeed expect an overhead due to the binary search, it is not clear a priori how large this overhead needs to be to achieve a competitive zero confidence attack with PGD (especially with a tuned step size for PGD, see above).
I would be grateful if the authors could provide their view on these points. Until then, I will assign a rating of 5 since tuning the parameters of optimization algorithms is crucial for a fair comparison.
Additional comments:
- In the introduction, the authors equate white-box attacks with access to gradient information. But generally a white-box attack is understood as an attack that has arbitrary access to the target network. It may be helpful for the reader to clarify this.
- In the second paragraph of the introduction, the authors claim that fixed perturbation attacks and zero confidence attacks differ significantly. But as pointed out above, it is possible to convert a fixed perturbation attack to a zero confidence attack via a binary search. So it is not clear that there is a large gap in difficulty. Moreover, the authors state that fixed perturbation attacks often come with theoretical guarantees. But to the best of my knowledge, there is no comprehensive theory that describes when a fixed perturbation attack should be expected to succeed in attacking a commonly used neural network.
- On top of Page 2, the authors claim that zero-confidence attacks are a more realistic attack setting. Why is that?
- The authors state that JSMA (Papernot et al., 2016) is one of the earliest works that use gradient information for constructing adversarial examples. However, L-BFGS as employed by Szegedy et al., 2013 also uses gradient information. Moreover, the authors may want to cite the work of Biggio et al. from 2013 (see the survey https://arxiv.org/abs/1712.03141).
- Since all distances referred to by d(x, y) seem to be norms (and the paper relies on the existence of dual norms), it may be more clear for the reader to use the norm notation || . || from the beginning.


Deep reinforcement learning (DRL) has achieved great success in various applications, such as playing computer games and controlling robotic manipulations. However, recent studies show that machine learning models are vulnerable to adversarial examples, which are carefully crafted instances that aim to mislead these models to make arbitrarily incorrect prediction. DRL models have been attacked by adding perturbations to observations. While such observation based attack is only one aspect of potential attacks on DRL, other forms of attacks require further analysis which are more practical such as manipulating environment dynamics. Therefore, we propose to understand the vulnerabilities of DRL from various perspectives and provide a thorough taxonomy of adversarial attacks against DRL. We also conduct the first set of experiments on the unexplored parts within the taxonomy. In addition to current observation based attacks against DRL, we propose attacks based on action space and environment dynamics. Among these experiments, we introduce online sequential attack: a novel method specialized for efficiently attacking sequences of temporally consecutive frames, the first targeted attack that perturbs environment dynamics to cause an agent fail in a specific way, and a novel finite difference based black-box attack against DRL. We show empirically that our online sequential attacks can generate effective perturbations in a black-box setting in real time with a small number of queries, independent of episode length. We conduct extensive experiments to compare the effectiveness of different attacks with several baselines in various environments, including game playing, robotics control, and autonomous driving.

This submission sets out to taxonomize evasion-time attacks against deep RL and introduce several new attacks, including two heuristics for efficient evasion-time attacks and attacks that target the environment dynamics and RL system’s actions. The main limitation of this paper is probably its broad scope, which unfortunately prevents it in its current form from addressing each of the goals stated in the introduction systematically to draw conclusive takeaways.
Taxonomizing the space of adversaries targeting deep RL at test time is a valuable contribution. While the existing taxonomy is a good start, it would be useful if you can clarify the following points in your rebuttal. Why were the “further categorization” items separated from adversarial capabilities? Being constrained to real-time or physical perturbations appears to be another way to describe the adversary’s capabilities. In addition, is there a finer-grained way to characterize the adversary’s knowledge beyond white-box vs. black-box? This binary perspective is common but not very informative. One way to move forward would be for instance to think about the different components of a RL system, and identify those that are relevant to have knowledge of when adversaries are mounting attacks. It would also be helpful to position prior work in the taxonomy. Finally, the taxonomy currently stated in the submissions is more a taxonomy of attacks (or adversaries) than a taxonomy of vulnerabilities, so the title of Section 3 could perhaps be updated accordingly.
Section 4.1 gives a good overview of different attack strategies against RL based on modifying the observations analyzed by the agent. Many of these attacks are applications of known attack strategies and will be familiar to readers with adversarial ML background (albeit some of these strategies were previously introduced and evaluated against “supervised” classifiers only). One point was unclear however: why is the imitation learning based black-box attack not a transferability-based attack? As far as I could understand, the strategy described corresponds exactly to the commonly adopted strategy of transferring adversarial examples found on a substitute model (see for instance “Intriguing properties of neural networks” by Szegedy et al. and “Practical Black-Box Attacks against Machine Learning” by Papernot et al.). In other words, Section 4.1 could be rescoped to put emphasis on the attack strategies that have not been explored previously in the context of reinforcement learning: e.g., the finite difference approach with adaptive sampling or the universal attack with optimal selection of initial frames. It is unfortunate that the treatment of these two attacks is currently deferred to the appendix as they make the paper more informative. Similarly, Sections 4.2 and 4.3 would benefit from being extended to put forward the new attack threat model considered in these two sections.
While the introduction claimed to make a systematic evaluation of attacks against RL, the presentation of the experimental section can be improved to ensure the analysis points out the relevant takeaways. For instance, it is unclear what the differences are between results on TORCS and other tasks included in the Appendix. Specifically, results on Enduro do not seem as conclusive as those presented on TORCS. Do you have some intuition as to why that is the case? In Figure 7, it appears that a large number of frames need to be manipulated before a drop on cumulative reward is noticeable. Previous efforts manipulated single frames only, could you stress why the setting is different here? Throughout the section, many Figures are small and it is difficult to infer whether the difference between the white-box and black-box variants of an attack is significant or not. Could you analyze this in more details in the text? In Table 2, how should the L2 distance be interpreted? In other words, when is the adversary successful?
If you can clarify any of the points made above in your rebuttal, I am of course open to revise my review.
Editorial details:
Figures are not readable when printed.
Figure 5 is improperly referenced in the main body of the paper.
Figure 7: label is incorrect for Torcs and Hopper (top of figure)


A MEAN FIELD THEORY OF BATCH NORMALIZATION
We develop a mean field theory for batch normalization in fully-connected feedforward neural networks. In so doing, we provide a precise characterization of signal propagation and gradient backpropagation in wide batch-normalized networks at initialization. Our theory shows that gradient signals grow exponentially in depth and that these exploding gradients cannot be eliminated by tuning the initial weight variances or by adjusting the nonlinear activation function. Indeed, batch normalization itself is the cause of gradient explosion. As a result, vanilla batch-normalized networks without skip connections are not trainable at large depths for common initialization schemes, a prediction that we verify with a variety of empirical simulations. While gradient explosion cannot be eliminated, it can be reduced by tuning the network close to the linear regime, which improves the trainability of deep batch-normalized networks without residual connections. Finally, we investigate the learning dynamics of batch-normalized networks and observe that after a single step of optimization the networks achieve a relatively stable equilibrium in which gradients have dramatically smaller dynamic range. Our theory leverages Laplace, Fourier, and Gegenbauer transforms and we derive new identities that may be of independent interest.

This paper develops a mean field theory for batch normalization (BN) in fully-connected networks with randomly initialized weights. There are a number of interesting predictions made in this paper on the basis of this analysis. The main technical results of the paper are Theorems 5-8 which compute the statistics of the covariance of the activations and the gradients.
Comments:
1. The observation that gradients explode in spite of BN is quite counter-intuitive. Can you give an intuitive explanation of why this occurs?
2. In a similar vein, there a number of highly technical results in the paper and it would be great if the authors provide an intuitive explanation of their theorems.
3. Can the statistics of activations be controlled using activation functions or operations which break the symmetry? For instance, are BSB1 fixed points good for training neural networks?
4. Mean field analysis, although it lends an insight into the statistics of the activations, needs to connected with empirical observations. For instance, when the authors observe that the structure of the fixed point is such that activations are of identical norm equally spread apart in terms of angle, this is quite far from practice. It would be good to mention this in the introduction or the conclusions.


Neural machine translation, which achieves near human-level performance in some languages, strongly relies on the availability of large amounts of parallel sentences, which hinders its applicability to low-resource language pairs. Recent works explore the possibility of unsupervised machine translation with monolingual data only, leading to much lower accuracy compared with the supervised one. Observing that weakly paired bilingual documents are much easier to collect than bilingual sentences, e.g., from Wikipedia, news websites or books, in this paper, we investigate the training of translation models with weakly paired bilingual documents. Our approach contains two components/steps. First, we provide a simple approach to mine implicitly bilingual sentence pairs from document pairs which can then be used as supervised signals for training. Second, we leverage the topic consistency of two weakly paired documents and learn the sentence-to-sentence translation by constraining the word distribution-level alignments. We evaluate our proposed method on weakly paired documents from Wikipedia on four tasks, the widely used WMT16 German↔English and WMT13 Spanish↔English tasks, and obtain 24.1/30.3 and 28.1/27.6 BLEU points separately, outperforming stateof-the-art unsupervised results by more than 5 BLEU points and reducing the gap between unsupervised translation and supervised translation up to 50%.

This paper proposes a method to train a machine translation system using weakly paired bilingual documents from Wikipedia. A pair of sentences from a weak document pair are used as training data if their cosine similarity exceeds c1, and the similarity between this sentence pair is c2 greater than any other pair in the documents, under sentence representations formed from word embeddings trained with MUSE. The neural translation model learns to translate from language X to Y, and from Y to X using the same encoder and decoder parameters, but the decoder is aware of the intended target language given an embedding of the intended language. The model is also trained to minimise the KL divergence between the distribution of terms in the target language document and the distribution of terms in the current model output. The model also uses the denoising autoencoding and reconstruction objectives of Lample et al. (2017). The results show improvements over the Lample et al. (2017) and that performance is heavily dependent on the number of sentences extracted from the weakly aligned documents.
Positives
- Large improvement over previous attempts at unsupervised MT for the En-De language pair.
- Informative ablation study in Section 4.4 of the relative contribution of each part of the overall objective function (Eq 9).
Negatives
- The introduction gave the impression that this method would be applied to low-resource language pairs but it was applied to two high-resource language pairs. Because you have not evaluated on a low-resource language pair, it's not clear how your proposed method would generalise to a low-resource setting.
Questions
- Can you give some intuition for why you remove the first principal component from the word embeddings in Equations 1 - 3?
- Are the Supervised results in Table 2 actually a fair reflection of a reasonable NMT model trained with sub-word representations and back translated data?
- What is the total number of sentences in the weakly paired documents in Table 1? It would be useful to know the proportion of sentences you managed to extract to train your models.
Comments
- Koehn et al. (2003) is not an example of any kind of neural network architecture.


Convolution is an efficient technique to obtain abstract feature representations using hierarchical layers in deep networks. Although performing convolution in Euclidean geometries is fairly straightforward, its extension to other topological spaces-such as a sphere (S 2 ) or a unit ball (B 3 )-entails unique challenges. In this work, we propose a novel 'volumetric convolution' operation that can effectively convolve arbitrary functions in B 3 . We develop a theoretical framework for volumetric convolution based on Zernike polynomials and efficiently implement it as a differentiable and an easily pluggable layer for deep networks. Furthermore, our formulation leads to derivation of a novel formula to measure the symmetry of a function in B 3 around an arbitrary axis, that is useful in 3D shape analysis tasks. We demonstrate the efficacy of proposed volumetric convolution operation on a possible use-case i.e., 3D object recognition task.

There is a great amount of interest in extending the notion of equivariance in neural networks from
just translations to other groups. In particular, in the past year a sequence of papers have appeared
starting with (Cohen, Geiger et al.) on "spherical CNNs" that achieve equivariance to rotations for images
painted on the surface of the unit sphere.
The present paper extends these ideas to volumetric data in the unit ball (rather than just the sphere)
by the use of Zernike polynomials. Since Zernike polynomials can be expressed as the product of spherical
harmonics with a radial function, this is essentially the same as adding a radial component to a spherical
CNN.
The main result of the paper appears to be Theorem 1, which shows that what the authors define as
volumetric convolution is equivariant to rotations. This is split across Sections 4.2 and 4.3.. However,
apart from the radial component, this result is bascally the same as the SO3-equivariance of spherical CNNs,
as discussed in three very recent spherical CNN papers: (Cohen, Geiger et al.) (Esteves Allen-Blanchette et al)
and (Kondor, Lin and Trivedi). However, the somewhat more abstract, representation theoretic approach
of some of these works allows a more compact derivation than the one in the present paper.
The authors also fail to cite recent work on SE(2) and SE(3) equivariant neural networks. SE(3) comprises
all rotations and translations of R^3, so the latter, in particular, encapuslates SO(3) equivariance as
a special case. In particular, part of the construction in (Weiler, Hamprecht and Storath, CVPR 2018)
is to add  Gaussian radial functions to SO(2) equivariant filters, which is just the 2D analog of
what is happening in the present paper. Then in (Weiler, Geiger, et al., 2018) the same is done in 3D,
except of course they go further by also adding translation equivariance. Admittedly, these papers are
very new, so the authors might not have known about them.
I also find some of the mathematical details a little puzzling:
1. As explained in the spherical CNN papers, taking the cross correlation of two functions on the sphere
(by extension, in the unit ball) naturally results in a function that lives on the rotation group SO(3), i.e.
the cross-correlation (or convolution) is parametrized by three Euler angles. I don't understand why the
authors restrict themselves to considering just two angles, forcing their filters to be polar, as
derived in Section 5. This seems like an artificial restriction that will limit the power of their approach.
2. The paper mentions that Zernike polynomials are "orthogonal and complete in B^3". I think what they mean
is that they are an ortogonal and complete basis for an appropriate space of functions on B^3, and that
space of functions is L_2(B^3). However, this is still not enough. For (3) to hold, one also needs the
basis to be orthonormal. Please be more precise.
3. In the same vein, at one point in the proof, the authors mention that "rotations are unitary operators
in a Hilbert space". This is not true of Hilbert spaces in general. It requires the above orthonormality etc..
4. Exactly as a consequence of orthonorlamity, Equation 5 is essentially just a generalized Fourier transform
on B^3, hence, in principle, it can be inverted analytically. I understand that the fact that the input
image is rasterized complicates things and in a practical implementation it might be expedient to invert (5)
by using the pseudo-inverse. However, this is a one-time operations and is really just a hack. It seems strange
that the authors use a special iterative method just to invert a close to unitary matrix.
The mathematical shortcomings of the paper could be compensated by amazingly good experimental results.
The actual results are good, but still not best-in-class, possibly because at the end of the day the network
is still only rotationally equivariant and does not take into account translations.
The spherical CNN and SE(n) equivariance papers generally apply the group equivariant operations consistently
across multiple layers. In contrast, the present paper only applies it in the first layer, and then uses a
combination of tricks like multiple viewpoints and bilinear pooling to boost performance. Unfortunately, the
benefits of this additional conceptual complexity are not entirely borne out in the experimental results.


Imitation Learning is the task of mimicking the behavior of an expert player in a Reinforcement Learning (RL) Environment to enhance the training of a fresh agent (called novice) beginning from scratch. Most of the Reinforcement Learning environments are stochastic in nature, i.e., the state sequences that an agent may encounter usually follow a Markov Decision Process (MDP). This makes the task of mimicking difficult as it is very unlikely that a new agent may encounter same or similar state sequences as an expert. Prior research in Imitation Learning proposes various ways to learn a mapping between the states encountered and the respective actions taken by the expert while mostly being agnostic to the order in which these were performed. Most of these methods need considerable number of states-action pairs to achieve good results. We propose a simple alternative to Imitation Learning by appending the novice's action space with the frequent short action sequences that the expert has taken. This simple modification, surprisingly improves the exploration and significantly outperforms alternative approaches like Dataset Aggregation. We experiment with several popular Atari games and show significant and consistent growth in the score that the new agents achieve using just a few expert action sequences.

[Summary]
This paper presents an interesting idea that to append the agent's action space with the expert's most frequent action pairs, by which the agent can perform better exploration as to achieve the same performance in a shorter time. The authors show performance gain by comparing their method with two baselines - Dagger and InfoGAIL.
[Stengths]
The proposed method is simple yet effective, and I really like the analogy to mini-moves in sports as per the motivation section.
[Concerns]
- How to choose the number and length of the action sequences?
The authors empirically add the same number of expert's action sequences as the basic ones and select the length k as 2. However, no ablation studies are performed to demonstrate the sensitivity of the selected hyperparameters. Although the authors claim that "we limit the size of meta-actions k to 2 because large action spaces may lead to poor convergence", a more systematic evaluation is needed. How will the performance change if we add more and longer action sequences? When will the performance reach a plateau? How does it vary between different environments?
- Analysis of the selected action sequences.
It might be better to add more analysis of the selected action sequences. What are the most frequent action pairs? How does it differ from game to game? What if the action pairs are selected in a random fashion?
- Justification of the motivation
The major motivation of the method is to release the burden of memory overheads. However, no quantitative evaluations are provided as to justify the claim. Considering that the input images are resized to 84x84, storing them should not be particularly expensive.
- The choice of baseline.
InfoGAIL (Li et al., 2017) is proposed to identify the latent structures in the expert's demonstration, hence it is not clear to me how it suits the tasks in the paper. The paper also lacks details describing how they implemented the baselines, e.g. beta in Dagger and the length of the latent vector in InfoGAIL.
- The authors only show experiments in Atari games, where the action space is discrete. It would be interesting to see if the idea can generalize to continuous action space. Is it possible to cluster the expert action sequences and form some basis for the agent to select?
- Typos
{LRR, RLR/RRL} --> {LRR, RLR, RRL}
sclability --> scalability
we don't need train a ... --> we don't need to train a ...
Atmost --> At most
[Recommendation]
The idea presents in the paper is simple yet seemingly effective. However, the paper lacks a proper evaluation of the proposed method, and I don't think this paper is ready with the current set of experiments. I will decide my final rating based on the authors' response to the above concerns.


RESIDUAL NON-LOCAL ATTENTION NETWORKS FOR IMAGE RESTORATION
In this paper, we propose a residual non-local attention network for high-quality image restoration. Without considering the uneven distribution of information in the corrupted images, previous methods are restricted by local convolutional operation and equal treatment of spatial-and channel-wise features. To address this issue, we design local and non-local attention blocks to extract features that capture the long-range dependencies between pixels and pay more attention to the challenging parts. Specifically, we design trunk branch and (non-)local mask branch in each (non-)local attention block. The trunk branch is used to extract hierarchical features. Local and non-local mask branches aim to adaptively rescale these hierarchical features with mixed attentions. The local mask branch concentrates on more local structures with convolutional operations, while non-local attention considers more about long-range dependencies in the whole feature map. Furthermore, we propose residual local and non-local attention learning to train the very deep network, which further enhance the representation ability of the network. Our proposed method can be generalized for various image restoration applications, such as image denoising, demosaicing, compression artifacts reduction, and super-resolution. Experiments demonstrate that our method obtains comparable or better results compared with recently leading methods quantitatively and visually.

The paper proposes a convolutional neural network architecture that includes blocks for local and non-local attention mechanisms, which are claimed to be responsible for achieving excellent results in four image restoration applications.
# Results
The strongest point of the paper is that the quantitative and qualitative image restoration results appear to be very good, although they seem almost a bit too good.
# Novelty
I'm not sure about the novelty of the paper, but I suspect it to be rather incremental. The paper says "To the best of our knowledge, this is the first time to consider residual non-local attention for image restoration problems." Does that mean non-local attention (in a very similar way) has already been used, just not in a residual fashion? If so, that would not constitute much novelty. I have to admit that I'm not familiar with the related work on attention, but I did not understand *why* the results of the proposed method are supposed to be much better than that of previous work.
# Clarity
I think the paper is not self-contained enough, since it seems to implicitly assume substantial background knowledge on attention mechanisms in CNNs.
Furthermore, the introduction of the paper identifies three problems with existing CNNs that I don't necessarily fully agree with. None of these supposed problems are backed up by (experimental) evidence.
I don't think it is sufficient to just show superior results than previous methods. It is also important to disentangle why the results are better. However, the presented ablation experiments are not very illuminating to me.
The attempts at explaining what the novel attention blocks do and why they lead to superior results are very vague to me. Maybe they are understandable in the context of related work, but I found many statements, such as the following, devoid of meaning:
- "Without considering the uneven distribution of information in the corrupted images, [...]"
- "However, in this paper, we mainly focus on learning non-local attention to better guide feature extraction in trunk branch."
- "We only incorporate residual non-local attention block in low-level and high-level feature space. This is mainly because a few non-local modules can well offer non-local ability to the network for image restoration."
- "The key point in mask branch is how to grasp information of larger scope, namely larger receptive field size, so that it’s possible to obtain more sophisticated attention map."
# Experiments
- The experimental results are the best part of the paper. However, it would've been nice to include some qualitative results in the main paper.
- The proposed RNAN model is trained on a big dataset (800 images with ~2 million pixels each). Are the competing methods trained on datasets of similar size? If not, this could be a major reason for improved performance of RNAN over competing methods. At least in the appendix, RNAN and FFDNet are compared more fairly since they are trained with the same/similar data.
- The qualitative examples in the appendix mostly show close-ups/details of very structured regions (mostly stripy patterns). Please also show some other regions without self-similar structures.
# Misc
- Residual non-local attention learning (section 3.3) was not clear to me.
- The word "trunk" is used without definition or explanation.
- Fig. 2 caption is too short, please expand.
# Update (2018-11-29)
Given the substantial author feedback, I'm willing to raise my score.


We consider the problem of aligning continuous word representations, learned in multiple languages, to a common space. It was recently shown that, in the case of two languages, it is possible to learn such a mapping without supervision. This paper extends this line of work to the problem of aligning multiple languages to a common space. A solution is to independently map all languages to a pivot language. Unfortunately, this degrades the quality of indirect word translation. We thus propose a novel formulation that ensures composable mappings, leading to better alignments. We evaluate our method by jointly aligning word vectors in eleven languages, showing consistent improvement with indirect mappings while maintaining competitive performance on direct word translation.

This paper is concerned with the idea of inducing multilingual word embeddings (i.e., word vector spaces where words from more than two languages are represented) in an unsupervised way using a mapping-based approach. The main novelty of the work is a method, inspired by recent work of Nakashole and Flauger, and building on the unsupervised bilingual framework of Grave et al., which aims at bypassing the straightforward idea of independently mapping N-1 vector spaces to the N-th pivot space by adding constraints to ensure that the learned mappings can be composed (btw., it is not clear from the abstract what this means exactly).
In summary, this is an interesting paper, but my impression is that it needs more work to distinguish itself from prior work and stress the contribution more clearly.

Although 11 languages are used in evaluation, the authors still limit the evaluation only to (arguably) very similar languages (all languages are Indo-European and there are no outliers, distant languages or languages from other families at all, not even the usual suspects like Finnish and Hungarian). Given the observed instability of GAN-based unsupervised bilingual embedding learning, dissected in Sogaard et al.'s paper (ACL 2018) and also touched upon in the work of Artetxe et al. (ACL 2018), one of the critical questions for this work should also be: is the proposed method stable? What are the (in)stability criteria? When does the method fail and can it lead to sub-optimal solutions? What is the decrease in performance when moving to a more distant language like Finnish, Hungarian, or Turkish? Is the method more robust than GAN-based models? All this has to be at least discussed in the paper.
Another question is: do we really want to go 'fully unsupervised' given that even a light and cheap source of supervision (e.g., shared numerals, cognates) can already result in more robust solutions? See the work of Artetxe et al. (ACL 2017, ACL 2018), Vulic and Korhonen (ACL 2016) or Sogaard et al. (ACL 2018) for some analyses on how the amount of bilingual supervision can yield more (or less) robust models? Is the proposed framework also applicable in weakly-supervised settings? Can such settings with weak supervision guarantee increased robustness (and maybe even better performance)? I have to be convinced more strongly: why do we need fully unsupervised multilingual models, especially when evaluation is conducted only with resource-rich languages?
Another straightforward question is: can the proposed framework handle cases where there exists supervision for some language pairs while other pairs lack supervision? How would the proposed framework adapt to such scenarios? This might be an interesting point to discuss further in Section 5.
Style and terminology: it is not immediately clear what is meant by (triplet) constraints (which is one of the central terms in the whole work). It is also not immediately clear what is meant by composed mappings, hyper-alignment (before Section 4), etc. There is also some confusion regarding the term alignment as it can define mappings between monolingual word embedding spaces as well as word-level links/alignments. Perhaps, using mapping instead of alignment might make the description more clear. In either case, I suggest to clearly define the key concepts for the paper. Also, the paper would contribute immensely from some running examples illustrating the main ideas (and maybe an illustrative figure similar to the ones presented in, e.g., Conneau et al.'s work or Lample et al.'s work). The paper concerns word translation and cross-lingual word embeddings, and there isn't a single example that serves to clarify the main intuition and lead the reader through the paper. The paper is perhaps too much focused on the technical execution of the idea to my own liking, forgetting to motivate the bigger picture.
Other: the part on "Language tree" prior to "Conclusion" is not useful at all and does not contribute to the overall discussion. This could be safely removed and the space in the paper should be used to additional comparisons with more baselines (see above for some baselines).
The authors mention that their approach is "relatively hard to scale" only in their conclusion, while algorithmic complexity remains one of the key questions related to this work. I would like to see some quantitative (time) measurements related to the scaling problem, and a more thorough explanation why the method is hard to scale. The complexity and non-scalability of the method was one of my main concerns while reading the paper and I am puzzled to see some remarks on this aspect only at the very end of the paper. Going back to algorithmic complexity, I think that this is a very important aspect of the method to discuss explicitly. The authors should provide, e.g., O-notation complexity for the three variant models from Figure 2 and help the reader understand pros and cons of each design also when it comes to their design complexity. Is the only reason to move from the star model to the HUG model computational complexity? This argument has to be stressed more strongly in the paper.
Two very relevant papers have not be cited nor compared against. The work of Artetxe et al. (ACL 2018) is an unsupervised bilingual word embedding model similar to the MUSE model of Conneau et al. (ICLR 2018) which seems more robust when applied on distant languages. Again, going back to my previous comment, I would like to see how well HUG fares in such more challenging settings. Further, a recent work of Chen and Cardie (EMNLP 2018) is a multilingual extension of the bilingual GAN-based model of Conneau et al. Given that the main goal of this work and Chen and Cardie's work is the same: obtaining multilingual word embeddings, I wonder how the two approHowaches compare to each other. Another, more general comment concerns the actual evaluation task: as prior work, it seems that the authors optimise and evaluate their embeddings solely on the (intrinsic) word translation task, but if the main goal of this research is to boost downstream tasks in low-resource languages, I would expect additional evaluation tasks beyond word translation to make the paper more complete and convincing.
The method relies on a wide spectrum of hyper-parameters. How are these hyper-parameters set? How sensitive is the method to different hparams configurations? For instance, why is the Gromov-Wasserstein approach applied only to the first 2k vectors? How are the learning rate and the batch size determined?
Minor:
What is W in line 5 of Algorithm 1?
Given the large number of symbols used in the paper, maybe a table of symbols put somewhere at the beginning of the paper would make the paper easier and more pleasant to read.
I would also compare the work to another relevant supervised baseline: the work from Smith et al. (ICLR 2017). This comparison might further strengthen the main claim of the paper that indirect translations can also be found without degrading performance in multilingual embedding spaces.


Canonical Correlation Analysis (CCA) is a ubiquitous technique that shows promising performance in multi-view learning problems. Due to the conjugacy of the prior and the likelihood, probabilistic CCA (PCCA) presents the posterior with an analytic solution, which provides probabilistic interpretation for classic linear CCA. As the multi-view data are usually complex in practice, nonlinear mappings are adopted to capture nonlinear dependency among the views. However, the interpretation provided in PCCA cannot be generalized to this nonlinear setting, as the distribution assumptions on the prior and the likelihood makes it restrictive to capture nonlinear dependency. To overcome this bottleneck, in this paper, we provide a novel perspective for CCA based on implicit distributions. Specifically, we present minimum Conditional Mutual Information (CMI) as a new criteria to capture nonlinear dependency for multi-view learning problem. To eliminate the explicit distribution requirement in direct estimation of CMI, we derive an objective whose minimization implicitly leads to the proposed criteria. Based on this objective, we present an implicit probabilistic formulation for CCA, named Implicit CCA (ICCA), which provides a flexible framework to design CCA extensions with implicit distributions. As an instantiation, we present adversarial CCA (ACCA), a nonlinear CCA variant which benefits from consistent encoding achieved by adversarial learning. Quantitative correlation analysis and superior performance on cross-view generation task demonstrate the superiority of the proposed ACCA.

I don't quite see how the proposed approach addresses non-linear canonical correlation analysis. In particular:
1) The main motivation is the minimization of the conditional mutual information I(X;Y|Z), where X and Y correspond to the two views and Z is latent. First of all, what uncertainty does this expression has when X and Y are observations and Z is given? My understanding is that the main objective of any CCA problem should be to find some transformations, say f(X) and g(Y), with some (to be defined) desirable properties. For example, these would correspond to linear transformations, say Ax and By, for classical CCA. Therefore, should not one be interested in minimizing something like I(f(X);g(Y)|Z)?
2) Assuming that the minimization of the conditional mutual information I(X;Y|Z) would be the goal, I don't quite see why the formulation in equation (6) would actually be equivalent (or be some reasonable approximation)?
3) It is well known that differential entropy can be negative (e.g., Cover and Thomas, 2006). Why would the conditional mutual information in equation (4) be non-negative? Alternatively, what would negative values of I(X;Y|Z) mean in the CCA context? My understanding is that one should be interested in minimizing I(X;Y|Z), or its variants with transformations, in *absolute value* to ensure some closeness to conditional independence.
4) Expressions in equation (5)-(6) are general and hold with no assumptions whatsoever for any random variables X, Y, Z (given the expectations/integrals exist). It is therefore not clear what are the variables of this minimization problem? (parameters? but what is the parametric model?)
5) Assuming solving (6) is the goal, this formulation as mentioned by the authors is actually is quite a challenging problem involving latent variables. Some form of this approach explanation would
I can not quite see how the proposed adversarial version would correct or supplement any of these questions.
Other comments:
1) It would be appropriate to cite the probabilistic CCA paper by Bach and Jordan (2005); a better citation for classical CCA would be Hotelling (1936).
2) I find the multiple mentioning of the *non-linear* (in-)dependence confusing. Is this in statistical sense? And how exactly is this related to CCA? Does it have anything to do with the fact that the third and higher order cumulants are zero only for independent variables unless they are Gaussian? Moreover, does this linear independence have any connection with the non-linearity of the proposed CCA approach?
3) What exactly is the *linear correlation criterion* and how does it enter the classical CCA or PCCA formulation (Introduction; bullet point 2)?
4) It would be helpful to introduce the original CCA problem emphasizing that each view, X and Y, are *different* linear transformation of *the same* latent codes z. Moreover, the full description of the models (classical CCA/ PCCA) wouldn't take more than one-two paragraphs and would help the readers to avoid any misunderstanding.
5) Are any assumptions necessary to ensure existence?


We propose a unified framework for building unsupervised representations of entities and their compositions, by viewing each entity as a histogram (or distribution) over its contexts. This enables us to take advantage of optimal transport and construct representations that effectively harness the geometry of the underlying space containing the contexts. Our method captures uncertainty via modelling the entities as distributions and simultaneously provides interpretability with the optimal transport map, hence giving a novel perspective for building rich and powerful feature representations. As a guiding example, we formulate unsupervised representations for text, and demonstrate it on tasks such as sentence similarity and word entailment detection. Empirical results show strong advantages gained through the proposed framework. This approach can potentially be used for any unsupervised or supervised problem (on text or other modalities) with a co-occurrence structure, such as any sequence data. The key tools at the core of this framework are Wasserstein distances and Wasserstein barycenters, hence raising the question from our title.

Pros:
I also study some related tasks and suspect that Wasserstein is helpful for measuring co-occurrence-based similarity. It is nice to see the effort in this direction.
Cons:
The methods are either not very novel or not very well-motivated. The experiment results are interesting but mixed. If the doubts about the experiments are clarified and the methods are motivated better (or the strengths/weaknesses are better analyzed), I will vote for acceptance.
Related work:
In addition to the work in the related work section, some other work also studied the NLP applications of Wasserstein, especially the ones (such as [1,2,3]) which are related to similarity measurement. The authors should include them in the related work section.
Question about experiments:
1. Why are the SIF scores reported in Table 1 much lower than the results reported in Arora et al., 2017 and in [4]?
2. If we compare CMD with DIVE + C * delta S, the proposed method wins in EVALution and Weeds, loses in Baroni, Kotlerman, BLESS, and Levy. If you compare DIVE + delta S (Chang et al. 2017) with DIVE + C * delta S, delta S also wins in EVALution and Weeds, loses in Baroni, BLESS, Kotlerman, and Levy (although CMD seems to be better than DIVE + delta S).
Based on the fact that your method has a high correlation with DIVE + delta S (Chang et al. 2017), I guess that CMD does not work very well when the dataset contains random negative samples, but work well when all the negative samples are similar to the target words. If my guess is right, the performance should be improved on average if you multiply the scores from CMD with the word similarity measurement.
3. To make it efficient, CMD seems to sacrifice some resolutions by using the K representative context. Does this step hurt the performance? Could you provide some performance comparison with different numbers of K to let readers know whether there is a tradeoff between accuracy and efficiency?
4. Since the results are mixed, I suppose readers would like to know when this method will perform better and the reasons for having worse results sometimes.
Writing and presentation suggestions/questions:
1. If the proposed method is a breakthrough, I am fine with the title but I think the experiment results tell us that Wasserstein is not all you need. I understand that everyone wants to have an eye-catching title for their paper. The title of this paper indeed serves this purpose. Since the strategy is effective, more and more people might start to write papers with a title like this. However, having lots of paper called "XXX is all you need?" or "Is XXX all you need?" is definitely not good for the whole community. Please use a more specific title such as Context Mover Distance or something like that.
2. The last point in the contribution is not supported by experiments. I suggest that the authors move this point to the future work section.
3. It is good to see some negative results like Baroni in Table 2. Results on other datasets should not be put into Table 4 in Appendix.
4. Using Wasserstein barycenter to measure sentence similarity seems to be novel, but the motivation is not very clear. Based on A.6, we could see that for each sentence, authors basically find the representative word which is most likely to co-occur with every word in the sentence (has the highest average relatedness rather than similarity) and measure the Wasserstein distance between the co-occurrence probability distribution. I suppose sometimes relatedness is a better metric when measuring sentence similarity, but I think authors should provide some motivative sentence pairs to explain when that is the case.
Using Wasserstein to detect hypernym seems to also be novel, but the motivation is also not clear. Again, a good example would be very helpful.
This point is also related to the last question for experiments.
Minor writing suggestions:
1. In section 3, present the full name of CITE
2. If you put some important equations to the appendix (e.g., the definition of SPPMI_{alpha,gamma}), remember to point readers to the appendix.
3. In the second paragraph of section 7, Nickel & Kiela, 2017 is a method supervised by a hierarchical structure like WordNet rather than a count-based or word embedding based methods.
4. In Chang et al., the training dataset is not Wikipedia dump from 2015. This difference of evaluation setup should be mentioned somewhere (e.g., in the caption of Table 2).
5. The reference section is not very organized. For example, the first name of Benotto is missing for the PhD thesis "Distributional Models for Semantic Relations: A Study on Hyponymy and Antonymy". The arXiv papers are cited using different formats. Only some papers have URL. The venue's names are sometimes not capitalized. Gaussian embedding is cited twice, etc.
[1] Kusner, M., Sun, Y., Kolkin, N., & Weinberger, K. (2015). From word embeddings to document distances. In International Conference on Machine Learning (pp. 957-966).
[2] Xu, H., Wang, W., Liu, W., & Carin, L. (2018). Distilled Wasserstein Learning for Word Embedding and Topic Modeling. NIPS
[3] Rolet, A., Cuturi, M., & Peyré, G. (2016, May). Fast dictionary learning with a smoothed wasserstein loss. In Artificial Intelligence and Statistics (pp. 630-638).
[4] Perone, C. S., Silveira, R., & Paula, T. S. (2018). Evaluation of sentence embeddings in downstream and linguistic probing tasks. arXiv preprint arXiv:1806.06259.


We propose an adversarial learning approach to the generation of multi-turn dialogue responses. Our proposed framework, hredGAN, is based on conditional generative adversarial networks (GANs). The GAN's generator is a modified hierarchical recurrent encoder-decoder network (HRED) and the discriminator is a word-level bidirectional RNN that shares context and word embedding with the generator. During inference, noise samples conditioned on the dialogue history are used to perturb the generator's latent space to generate several possible responses. The final response is the one ranked best by the discriminator. The hredGAN shows major advantages over existing methods: (1) it generalizes better than networks trained using only the log-likelihood criterion, and (2) it generates longer, more informative and more diverse responses with high utterance and topic relevance even with limited training data. This superiority is demonstrated on the Movie triples and Ubuntu dialogue datasets with both the automatic and human evaluations.

The paper applies conditional GAN to the HRED model [Serban et al., 2016] for dialogue response generation, showing improvements in terms of informativeness and diversity compared to HRED and VHRED [Serban et al., 2017].
The paper is technically solid and relatively easy to follow and the results are good, but comparisons with previous work (descriptive and experimental) are rather weak.
- Related work is incomplete: The paper specifically argues for the use of GAN to improve diversity in dialogue response generation, but this is not the first paper to do so. [Xu et al., 2017] presents a GAN-like setup that targets exactly the same goal, but that work is not cited in the paper. Same for [Zhang et al., 2018], but the latter work is rather recent (it still should probably be cited).
- Evaluation: There is no evaluation against Xu et al., which targets the same goal. The authors didn’t even compare their methods against baselines used in other GAN works for diverse response generation (e.g., MMI [Xu et al.; Zhang et al.], Li et al.’s GAN approach [Xu et al.]), which makes it difficult to draw comparisons between these related methods. As opposed to these other works, the paper doesn’t offer any human evaluation.
- It would have been nice to include an LSTM or GRU baseline, as these models are still often used in practice and the VHRED paper suggests [Serban et al., 2016; Table 1] that LSTM holds up quite well against HRED (if we extrapolate the results of VHRED vs. LSTM and VHRED vs. HRED). The ablation of GAN and HRED would help us understand which of the two is more important.
In sum, the work is relatively solid, but considering how much has already been done on generating diverse responses (including 3 other papers also using GAN), I don’t think this paper is too influential. Its main weakness is the evaluation (particularly the lack of human evaluation.)
Minor comments:
- Introduction: “diversity promoting training objective but their model is for single turn conversations”.
If these were “single turns”, they wouldn’t really be called conversations; that objective has been used with 3+ turn conversations. It can actually be applied to multi-turn dialogue as with any autoegressive generative models. For example, it has been exploited that way as a baseline for multi-turn dialogue [Li et al. 2016](“Deep Reinforcement Learning for Dialogue Generation“). Note it is not a “training objective”, but only an objective function at inference time, which is a more valid reason to criticize that paper.
- “We use greedy decoding (MLE) on the first part of the objective.” Doesn’t that hurt diversity because of MLE? what about using sampling instead (maybe with temperature)?
- Algorithm 1: the P_theta_G don’t seem to match the text of section 2. h_i is in sometimes written in bold and sometimes not (see also Eq 12 for comparison.)
- End of section 2.1: There are multiple Li et al.; specify which one.
- End of section 2.2 and 2.4: extra closing parenthesis after N(0, …))
- Figures are too small to read the subscripts.
[Xu et al. 2017]: Zhen Xu, Bingquan Liu, Baoxun Wang, Sun Chengjie, Xiaolong Wang, Zhuoran Wang, and Chao Qi. Neural response generation via gan with an approximate embedding layer. EMNLP 2017.
[Zhang et al. 2018]: Zhang, Yizhe & Galley, Michel & Gao, Jianfeng & Gan, Zhe & Li, Xiujun & Brockett, Chris & Dolan, Bill. (2018). Generating Informative and Diverse Conversational Responses via Adversarial Information Maximization.


In one-class-learning tasks, only the normal case can be modeled with data, whereas the variation of all possible anomalies is too large to be described sufficiently by samples. Thus, due to the lack of representative data, the wide-spread discriminative approaches cannot cover such learning tasks, and rather generative models, which attempt to learn the input density of the normal cases, are used. However, generative models suffer from a large input dimensionality (as in images) and are typically inefficient learners. We propose to learn the data distribution more efficiently with a multi-hypotheses autoencoder. Moreover, the model is criticized by a discriminator, which prevents artificial data modes not supported by data, and which enforces diversity across hypotheses. This consistency-based anomaly detection (ConAD) framework allows the reliable identification of outof-distribution samples. For anomaly detection on CIFAR-10, it yields up to 3.9% points improvement over previously reported results. On a real anomaly detection task, the approach reduces the error of the baseline models from 6.8% to 1.5%.

Summary
-------
The paper proposes a technique to make generative models more robust by making them consistent with the local density. It is hypothesized that robust model will be able to detect out-of-distribution samples better and improve anomaly detection.
Main comments
-------------
1. The proposed technique adds additional regularizers to the GAN loss that, in effect, state that the best hypothesis under a WTA strategy should have a high likelihood under the discriminator 'D'. This is an interesting idea and certainly a reasonable thing to try. As stated in the abstract, the generative models are inefficient; it is likely that additional structure enforced by the regularizer helps in improving the efficiency.
2. The objective in GANs is to infer the underlying distribution correctly and so far it has been found that their accuracy is heavily dependent on both the architecture as well as the computational complexity (they may improve with more training, but maybe not consistently). Therefore, it becomes hard to compare the three architectures in Figure 2 since they are all different. A more rigorous comparison would try to keep as many pieces of the architecture the same as possible so that ConAD can be compared with 'all other things being same'. Some experiments seem to follow this idea such as 'MDN+ConAD-{2, 4, 8, 16}' in Table 2. But in these experiments the addition of ConAD offers a mild improvement and even degrades for the maximum number of hypothesis (i.e., 16).
3. Page 2, para 2, last two lines: "For simplicity, imagine an ... the real distribution."
The argument is not clear. It seems too trivial and almost like a straw man argument.
4. Page 4: "In anomaly detection, this is difficult since there is no anomalous data point contained in the training dataset."
This is not true in real-world applications where most data is contaminated with anomalies. This is part of the challenge in anomaly detection.
The above also applies to the following on page 6: "During model training, only data from the normal data class is used..."
5. Page 5: "...D minimizes Eq. 3": Should be 'maximizes' since the reference is to the log likelihood of real data (or, add a negative sign).
6. Eq. 4: The last component should be negative since we trying to maximize the likelihood of the best hypothesis under WTA (right?).
7. Table 1: The datasets are not real anomaly detection datasets (too high proportion of 'anomalies') Moreover, the number of datasets is insufficient for rigor.
8. Section 5.4: "With our framework ConAD, anomaly detection performance remains competitive or better even with an increasing number of hypotheses available."
Section 6: "... and alleviates performance breakdown when the number of hypotheses is increased."
This is not entirely supported by the results in Tables 2, 3, and also 4 and 5 of supplement. The results for ConAD - {2, 4, 8, 16} are not consistently increasing.
Since experiments are very few (and not real-world for anomaly detection task) because of which the observations cannot be generalized.
9. Page 4 (minor) in two places: "one-to-mapping" -> "one-to-many mapping"
10. Page 5 (minor): "chap. 3" -> "section 3"


Existing attention mechanisms, are mostly item-based in that a model is trained to attend to individual items in a collection (the memory) where each item has a predefined, fixed granularity, e.g., a character or a word. Intuitively, an area in the memory consisting of multiple items can be worth attending to as a whole. We propose area attention: a way to attend to an area of the memory, where each area contains a group of items that are either spatially adjacent when the memory has a 2-dimensional structure, such as images, or temporally adjacent for 1-dimensional memory, such as natural language sentences. Importantly, the size of an area, i.e., the number of items in an area or the level of aggregation, is dynamically determined via learning, which can vary depending on the learned coherence of the adjacent items. By giving the model the option to attend to an area of items, instead of only individual items, a model can attend to information with varying granularity. Area attention can work along multi-head attention for attending to multiple areas in the memory. We evaluate area attention on two tasks: neural machine translation (both character and token-level) and image captioning, and improve upon strong (state-of-the-art) baselines in all the cases. These improvements are obtainable with a basic form of area attention that is parameter free. In addition to proposing the novel concept of area attention, we contribute an efficient way for computing it by leveraging the technique of summed area tables.

I have several concerns about this paper.
[originality]
Some important related studies are missing.
# Related studies about the perspective of “area”.
The consecutive position in sequence is often referred to as “span” in NLP filed, which is identical to what the authors call “area” in this paper.
Then, the idea of utilizing spans currently becomes a very popular in NLP field. We can find several papers,
e.g.,
Wenhui Wang, Baobao Chang, “Graph-based dependency parsing with bidirectional lstm”, ACL-2016.
Mitchell Stern, Jacob Andreas, Dan Klein, “A Minimal Span-Based Neural Constituency Parser”, ACL-2017.
Kenton Lee, Luheng He, Mike Lewis, Luke Zettlemoyer, “End-to-end Neural Coreference Resolution”, EMNLP-2017.
Nikita Kitaev, Dan Klein, “Constituency Parsing with a Self-Attentive Encoder”, ACL-2018.
Similarly, there are several related studies in image processing field,
e,g.,
Marco Pedersoli, Thomas Lucas, Cordelia Schmid, Jakob Verbeek, “Areas of Attention for image captioning”, ICCV-2017
Quanzeng You, Hailin Jin, Zhaowen Wang, Chen Fang, and Jiebo Luo, “Image Captioning with Semantic Attention”, CVPR-2016.
# Related studies about the perspective of “structured attention”.
Several papers about structured attention have already been proposed,
e.g.,
Yoon Kim, Carl Denton, Luong Hoang, Alexander M. Rush. “Structured Attention Networks”, ICLR-2017.
Vlad Niculae, Mathieu Blondel. “A Regularized Framework for Sparse and Structured Neural Attention”, NIPS-2017.
I think the authors should explain the relations between their method and the methods proposed in the above listed papers.
[significance]
# Concern about experimental settings
The experimental setting for NMT looks unnormal in the community.
Currently, most of papers use sentences split in subword units rather than character units. I cannot find a reason to select the character units. I think the authors should report the effectiveness of the proposed method on the widely-used settings.
# computational cost
The authors should report the actual calculation speed by comparing with the baseline method and the proposed method.
In Sec. 2.2, the authors provided the computational cost.
I feel that the cost of O(|M|A) is still enough large and that can unacceptably damage the actual calculation speed of the proposed method.
Overall, the proposed method itself seems to be novel and interesting.
However, in my opinion, writing and organization of this paper should be much improved as a conference paper. I feel like the current status of this paper is still ongoing to write.
Thus, it is a bit hard for me to strongly recommend this paper to be accepted.


Learning discrete representations of data and then generating data from the discovered representations have been increasingly studied because the obtained discrete representations can benefit unsupervised learning. However, the performance of learning discrete representations of textual data with deep generative models has not been widely explored. In addition, although generative adversarial networks(GAN) have shown impressing results in many areas such as image generation, for text generation, it is notorious for extremely difficult to train. In this work, we propose TopicGAN, a two-step text generative model, which is able to solve those two important problems simultaneously. In the first step, it discovers the latent topics and produced bag-of-words according to the latent topics. In the second step, it generates text from the produced bag-of-words. In our experiments, we show our model can discover meaningful discrete latent topics of texts in an unsupervised fashion and generate high quality natural language from the discovered latent topics.

This paper proposes TopicGAN, a generative adversarial approach to topic modeling and text generation. The model basically combines two steps: first to generate words (bag-of-words) for a topic, then second to generate the sequence of the words.
While the idea is interesting, there are several important limitations. First, the paper is difficult to understand, and some of the explanations are not convincing. For example, in section 4.1.1, it says "... our method assumes that the documents are produced from a single topic ... Our assumption aligns well with human intuition that most documents are generated from a single main topic." This goes very much against the common assumption of a generative topic model, such as LDA, which the model compares against. I don't mean to argue either way, but if the paper presents a viewpoint which is quite different from the commonly accepted viewpoint (within the specific research field), then there needs to be a much deeper explanation, ideally with concrete evidence to support it. Another sentence from the same paragraph states that their "model outperforms LDA because LDA is a statistical model, while our generator is a deep generative model." This argument also seems flawed and without concrete evidence. There are other parts in the paper where the logic seems strange and without evidence, and they make it difficult to understand and accept the major claims of the paper.
Second, the model does not offer much novelty. It seems that the two-stage model simply puts the two pieces, a GAN-style generator and an LSTM sequence model together. Perhaps I am not understanding the model, but the model description was also not clear nor easy to understand with respect to its novelty.
Third, the evaluation is somewhat weak. There are two main evaluations tasks: text classification and text generation. For the first task, classification is not the main purpose of topic models, and while text classification _is_ used in many topic modeling papers, it is almost always accompanied by other evaluation metrics such as held-out perplexity and topic coherence. This is because the main purpose of topic modeling is to actually infer the topics (per-topic word distribution and per-document topic distribution) and model the corpus. Thus I feel it is not a fair evaluation to just compare the models using text classification tasks. The second evaluation task of text generation is not explained enough. For the human evaluation, who were the annotators, and how were they trained? How many people annotated each output, and what was the inter-rater agreement? How many sentences were evaluated, and how were they chosen? Without these details, it is difficult to judge whether this evaluation was valid.
Lastly, the results are mediocre. Besides the classification task, the others do not show significant improvements over the baseline models. Perplexity (table 3) shows similar results for DBPedia and worse results (than WGAN-gp) for Gigaword. Table 4 shows slightly better results for "Preference" for TopicGAN with joint training, but "Accuracy" is measured only for the proposed model and not the baseline model.