People with high-frequency hearing loss rely on hearing aids that employ frequency lowering algorithms. These algorithms shift some of the sounds from the high frequency band to the lower frequency band where the sounds become more perceptible for the people with the condition. Fricative phonemes have an important part of their content concentrated in high frequency bands. It is important that the frequency lowering algorithm is activated exactly for the duration of a fricative phoneme, and kept off at all other times. Therefore, timely (with zero delay) and accurate fricative phoneme detection is a key problem for high quality hearing aids. In this paper we present a deep learning based fricative phoneme detection algorithm that has zero detection delay and achieves state-of-the-art fricative phoneme detection accuracy on the TIMIT Speech Corpus. All reported results are reproducible and come with easy to use code that could serve as a baseline for future research.

## Updated review
I have read the rebuttal. I have some concerns about the new version of the paper: The addition of section 2.3 about the MFCCs is welcome but feels a bit out of place. The first part about the MFCC is interesting and relevant, but it could be in the introduction as a motivation. The second part about the "proprietary high-quality time-frequency filterbank" is not clear at all. Firstly, results are discussed so this part should be in the Evaluation section. Secondly, why using proprietary filterbanks and not the standard Mel filterbanks ?
Given that the rebuttal and the new version of the paper didn't address my major concerns, I am keeping my original rating.
## Original review
This paper presents an approach to detect fricative phoneme in speech with as little delay as possible, in the context of hearing aids improvement. The model is based on CNN and is trained to detect fricative given the past context. The model is evaluated in terms of recall and compared with recent published works. The results show that the proposed approach outperforms the baselines and yields state-of-the-art performance with no delay. The paper concludes with some analysis on the computational cost and draw possible future work.
This paper should be rejected for the following reasons:
- The novelty is very limited: this work applied a well-known architecture (CNN) to a common problem, phoneme recognition. This only novelty is the zero-delay constraint, which is probably not sufficient for ICLR.
- The significance is also limited given the very specialized application.
- Some references are missing (see below).
- The presented results are not very clear.
- The computational considerations section is interesting but is missing some important elements.
Detailed comments:
- The authors selected raw speech signal as input to the CNN, which is not trivial and should be motivated and discussed in the paper. For instance, using the standard features like Mel filterbanks or MFCC will introduce a delay as they are computed on an overlapping window of 25ms. Phoneme recognition using raw speech as input to a CNN has been presented before, the authors should cite [1] and [2] for instance.
- Table 4 is confusing as the first four lines are not actually evaluated on TIMIT, so I don't see the point of adding these numbers to the table, as they cannot be compared anyway. I would remove these four lines from the Table.
- In terms of previous works, phoneme recognition on TIMIT is a very popular task, and many others could be cited, such as [3-5].
- On the computation consideration, the analysis is interesting, but a discussion on the size (i.e. number of parameter) of the network is missing: one way to decrease computation time is to have a smaller network, which is in line with the application: hearing aids probably do not have gigabytes of ram available.
- Question about the network: the input segment seems to be of size 3072 samples, why ? any motivation for this particular input size ?
My review can seem to be a bit harsh, I actually enjoyed the paper, but I don't think ICLR is the right conference for it, and I would advise the authors to improve it and submit it to a speech conference.
References:
[1] Palaz, D., Magimai Doss, M. and Collobert, R.. "Estimating Phoneme Class Conditional Probabilities from Raw Speech Signal using Convolutional Neural Networks." Proceedings of Interspeech 2013.
[2] Zeghidour, N., Usunier, N., Kokkinos, I., Schaiz, T., Synnaeve, G., & Dupoux, E. "Learning filterbanks from raw speech for phone recognition". Proceedings of ICASSP 2018.
[3] Zhang, Ying, Mohammad Pezeshki, Philémon Brakel, Saizheng Zhang, Cesar Laurent, Yoshua Bengio, and Aaron Courville. "Towards end-to-end speech recognition with deep convolutional neural networks." arXiv preprint arXiv:1701.02720 (2017).
[4] Chorowski, Jan K., et al. "Attention-based models for speech recognition." Advances in neural information processing systems. 2015.
[5] Tóth, László. "Phone recognition with hierarchical convolutional deep maxout networks." EURASIP Journal on Audio, Speech, and Music Processing 2015.1 (2015): 25.


Current state-of-the-art results in multilingual natural language inference (NLI) are based on tuning XLM (a pre-trained polyglot language model) separately for each language involved, resulting in multiple models. We reach significantly higher NLI results with a single model for all languages via multilingual tuning. Furthermore, we introduce cross-lingual knowledge distillation (XD), where the same polyglot model is used both as teacher and student across languages to improve its sentence representations without using the end-task labels. When used alone, XD beats multilingual tuning for some languages and the combination of them both results in a new state-of-the-art of 79.2% on the XNLI dataset, surpassing the previous result by absolute 2.5%. The models and code for reproducing our experiments will be made publicly available after de-anonymization.

This paper proposes two improved strategies for fine-tuning XLM (a multilingual variant of BERT) for cross-lingual NLI. First of all, it shows that fine-tuning a single model on the combination of all languages (the original English data from MultiNLI and their MT translation into the rest of languages) performs better than fine-tuning a separate model for each language. Furthermore, they show that minimizing the L2 distance between the English training sentences and their MT translation into the rest of languages, which does not explicitly use any labels in the foreign languages and is presented as a way of performing cross-lingual knowledge distillation, also performs better than zero-shot transferring a regular model fine-tuned in English.
I think that the paper makes some interesting contributions and, in particular, I think that the finding that multilingual fine-tuning performs better than the standard approach of fine-tuning a separate model for each language is important. Nevertheless, I am not convinced that there is enough novelty and substance on this, I have some concerns on the evaluation, and I think that the overall presentation should also be improved:
- I am not convinced by the "knowledge distillation" approach. First, although I see the connection, I do not think that presenting this as "knowledge distillation" is consistent with the common use of this term in the literature. More importantly, I do not see what is the value of this approach considering that multilingual fine-tuning performs better, and combining them both does not bring any clear improvement. The authors motivate it as a form of performing zero-shot cross-lingual transfer as, unlike the multilingual fine-tuning, this approach does not use any label in the foreign languages. However, I am not convinced at all by this reasoning, as it still relies on the translation of the English labeled data into the other languages. So, from a practical perspective, it requires the exact same resources as the other approach, as you would always be able to use the English labels for the rest of the languages, while being more complex and worse.
- It looks like the IndT results, which is the real baseline, are taken from the original XLM paper, while the rest of the results come from the authors' own runs, who use a different implementation. I think that you should also report IndT results from your own runs to make sure that your improvements come from the actual method, and not from small implementation details.
- You are trying small variations of your method (e.g. removing a particular language from the multilingual training) to support your claims, and it is not clear if the (rather small) differences in the results are significant. It would be good if you at least run the baseline multiple times and show the variance.
- It is unfair to try so many variants of your method in the test set, and then pick the best and claim SOTA as done in Table 6. Your final system looks rather ad-hoc and arbitrary: it is doing multilingual fine-tuning in all languages but Urdu, and cross-lingual knowledge distillation in a subset of 4 languages out of 15. It might get SOTA results in this particular scenario, but what if we move to a different set of languages, a different task, or even a different test set?
- The authors claim that "Urdu (ur) is an unrelated language" and "Swahili (sw) is loosely between French and Urdu in terms of relatedness to English", which they use to justify why Urdu behaves differently in their experiments. I do not speak neither Swahili nor Urdu, but from what I know this statement looks wrong. Swahili and English belong to completely different language families, and from what I know their grammar is very different. In contrast, Urdu at least belongs to the Indoeuropean language family.
- This is not relevant at all, but I would suggest the authors to find a different acronym instead of XD, which happens to be a widely used emoticon. I assume that the authors deliberately made this choice thinking that it would be funny, but I just find it confusing to see XD all over the place in a formal paper.


Adversarial examples raise questions about whether neural network models are sensitive to the same visual features as humans. In this paper, we first detect adversarial examples or otherwise corrupted images based on a class-conditional reconstruction of the input. To specifically attack our detection mechanism, we propose the Reconstructive Attack which seeks both to cause a misclassification and a low reconstruction error. This reconstructive attack produces undetected adversarial examples but with much smaller success rate. Among all these attacks, we find that CapsNets always perform better than convolutional networks. Then, we diagnose the adversarial examples for CapsNets and find that the success of the reconstructive attack was proportional to the visual similarity between the source and target class. Additionally, the resulting perturbations can cause the input image to appear visually more like the target class and hence become nonadversarial. These suggest that CapsNets use features that are more aligned with human perception and address the central issue raised by adversarial examples.

This paper studies the problem of detecting and generating adversarial images using class-conditional capsule networks. Specifically, this paper first introduced a novel method that detects adversarial examples by class-conditional image reconstruction. Motivated by this defense method, this paper further proposed a novel reconstructive attack that minimizes both classification and reconstruction loss. Experimental evaluations are conducted on MNIST, FashionMNIST, SVHN, and CIFAR-10 dataset. Results demonstrate the effectiveness of the proposed defense and the novel reconstructive attack method.
Overall, this paper is well-motivated and presentation is clear. It proposed a smart way of using the class-conditional generative model to improve the adversarial robustness. Please address the following questions.
(1) Reviewer’s major concern is that this method is not very scalable to large-scale real-world datasets such as ImageNet and SUN database. First, training a class-conditional generative model on MNIST is relatively easy compared to ImageNet. The generative model could potentially create image artifacts on higher resolution images.
-- SUN Database: Large-scale Scene Recognition from Abbey to Zoo. Xiao et al. In CVPR 2010.
Second, the proposed proxy based on l_2 image distance might not be effective at all for higher-resolution images.
-- A note on the evaluation of generative models, Theis et al. In ICLR 2016.
-- The Unreasonable Effectiveness of Deep Features as a Perceptual Metric, Zhang et al. In CVPR 2018.
(2) Reviewer is not fully convinced by the argument that features learned by CapsNets are superior to features learned by CNN baselines. To draw such conclusion, it is necessary to conduct systematic experiments with different CapsNets and CNNs architectures (e.g., number of layers) and other hyper-parameters related to the adversarial optimization.
(3) It looks like the proposed method is not specific to generative models use class labels as condition. reviewer is curious whether the method generalizes to other conditions (e.g., image-to-image translation) as well.
-- Learning Structured Output Representation using Deep Conditional Generative Models, Sohn et al. In NIPS 2015.
-- Image-to-Image Translation with Conditional Adversarial Nets, Isola et al. In CVPR 2017.
-- Unpaired Image-to-Image Translation using Cycle-Consistent Adversarial Networks, Zhu et al. In ICCV 2017.
-- Semantic Image Synthesis with Spatially-Adaptive Normalization, Park et al. In CVPR 2019.
(4) Can you possibly comment on the attack transferability compared to other existing attacks evaluated in this paper?
(5) Detection threshold: Can you possibly draw the AOC curve or report the Area Under Curve (AOC) score?


Despite their successes, deep neural networks still make unreliable predictions when faced with test data drawn from a distribution different to that of the training data, constituting a major problem for AI safety. While this motivated a recent surge in interest in developing methods to detect such out-of-distribution (OoD) inputs, a robust solution is still lacking. We propose a new probabilistic, unsupervised approach to this problem based on a Bayesian variational autoencoder model, which estimates a full posterior distribution over the decoder parameters using stochastic gradient Markov chain Monte Carlo, instead of fitting a point estimate. We describe how information-theoretic measures based on this posterior can then be used to detect OoD data both in input space as well as in the model's latent space. The effectiveness of our approach is empirically demonstrated.

This paper studies the problem of out-of-distribution data detection, which is an important problem in machine learning. The authors propose to use Bayesian variational autoencoder which applies SGHMC to get samples of the weights of the encoder and the decoder. The proposed method is tested on two benchmarks to demonstrate effectiveness.
The proposed Bayesian variational autoencoder appears to be technically sound. When applying it to OoD detection, effective sample size is used to quantify how much the posterior changes given the new data. The authors claim that ESS will be large when the data is in-distribution since all samples explain the data equally well. First, I’m not sure this is true that all samples from the posterior should explain the data equally well even if it is in-distribution. Second, if the data is out of distribution, it is likely that all samples explain the data equally bad which also results in high ESS. In practice, it is very likely that p(x*|theta) are low for all the theta when x* is out-of-distribution. Am I missing something here?
How to determine whether a data is out-of-distribution or not based on ESS? Is the threshold of ESS a hyperparameter to tune?
For the experiments, I wonder why the authors put Gamma hyper priors for BVAE which was not used in the previous work that use SGHMC. Is there any reason for doing this? Again, it is unclear to me how the authors decide whether a data is out-of-distribution or not based on ESS.
It seems like simply applying SGHMC for the decoder parameters is sufficient, as the other treatments only improve the results incrementally but adding large computational and storage cost. I’m not familiar with the literature enough to tell whether the results of previous methods are reasonable or not. By looking at the table, it seems that the proposed method achieves some gain over the previous methods.
In the experiments, BVAE only keeps the most recent 10 samples. Aren’t the samples very similar? Since the thinning interval is only 1 epoch.
It would make the paper stronger if the authors are able to demonstrate the usefulness of detecting OoD in latent space through experiments.


When communicating, humans rely on internally-consistent language representations. That is, as speakers, we expect listeners to behave the same way we do when we listen. This work proposes several methods for encouraging such internalconsistency in dialog agents in an emergent communication setting: shared embeddings, symmetric encoding/decoding, and self-play. We consider two hypotheses about the effect of internal-consistency constraints: 1) that they improve agents' ability to refer to unseen referents, and 2) that they improve agents' ability to generalize across communicative roles (e.g. performing as a speaker despite only being trained as a listener). While we do not find evidence in favor of the former, our results show significant support for the latter. In particular, we show that, when self-consistency is enforced via self-play, agents are able to perform in novel roles as well as if they were trained with direct supervision in those roles.

The paper analyzes if enforcing internal-consistency for speaker-listener setup can (i) improve the ability of the agents to refer to unseen referents (ii) generalize for different communicative roles. The paper evaluates a transformer and arecurrent model modified with various sharing strategies on a single-turn reference game. Finally, the paper claims that results with self-play suggest that internal consistency doesn’t help (i) but improves cross-role performance for (ii).
As a reader, the paper doesn’t provide me a concrete finding which can help in designing future multi-agent systems. Most of the results for the experiments (except self-play) don’t have a uniform signal across the board to deduce whether the internal-consistency works in all of the cases. Most of the speaker-listener scenarios emerge in dialog based settings which are multi-turn and require agents to act both as speaker and listener. Though paper advocates through some of its results that self-play is helpful in generalization across roles via internal-consistency, without multi-step experiments, qualitative and quantitative analysis of what is happening and why there is so much variation, the paper is weak in its current form. Therefore, I recommend weak reject as my rating. Below I discuss some of the concerns in detail:
Without multi-step evaluation, it is hard to gauge the extent to which self-play for internal consistency help in generalization of the roles. For e.g., task from Das et. al. (2017) [1] provides a clear signal on how well the agents are able to communicate through dialog evaluation. So in 5.2.1, the setup which requires training in both roles can provide better signal overall if it was trained to do multi-step conversation.
Paper is missing any kind of quantitative or qualitative analysis. What are the differences between the embeddings of the agent that learned via self-play and the one which learned directly. It also be interesting to see how the shared embeddings and symmetric encoding and decoding affect these embedding and might help explain the drop and randomness. In Table 4., the results on symmetric encoding suggest that the claim of generalization through internal consistency might not hold everywhere. For Shared Embedding results, on RNN shapes, it is surprising that training in one role improves performance through internal consistency while in both roles it drops. These require further analysis to solidify the claim. Given the flaky results, to boost the claim, have authors tried other settings to test internal-consistency like Predator-Prey?
Things that didn’t affect the score:
Related work section is missing the relevant discussion on continuous communication work and discussion on why internal consistency wasn’t tested on those settings as well. (See Singh et.al [2]., Sukhbaatar et.al. [3], Das et.al. [4] etc)
The number of pages are above eight, you should reduce the redundancy between table descriptions and text and maybe squeeze Section 2, decrease setup explanation.
The setup for training and test sets explained at the end of page 7 isn’t very clear to me and needs to be rephrased.
[1] Das, Abhishek, Satwik Kottur, José MF Moura, Stefan Lee, and Dhruv Batra. "Learning cooperative visual dialog agents with deep reinforcement learning." In Proceedings of the IEEE International Conference on Computer Vision, pp. 2951-2960. 2017.
[2] Sukhbaatar, Sainbayar, and Rob Fergus. "Learning multiagent communication with backpropagation." In Advances in Neural Information Processing Systems, pp. 2244-2252. 2016.
[3] Singh, Amanpreet, Tushar Jain, and Sainbayar Sukhbaatar. "Learning when to communicate at scale in multiagent cooperative and competitive tasks." arXiv preprint arXiv:1812.09755 (2018).
[4] Das, Abhishek, Théophile Gervet, Joshua Romoff, Dhruv Batra, Devi Parikh, Michael Rabbat, and Joelle Pineau. "Tarmac: Targeted multi-agent communication." arXiv preprint arXiv:1810.11187 (2018).
=========
Post-rebuttal Comments
=========
Thanks for updating the manuscript to resolve my and R2's concerns. The new analysis section does provide good insights into what exactly is happening.
When I was talking about actionable insights, I was talking about both negative and positive insights. Currently, the only take-away is that self-play helps in generalizing to listener roles as well. For the other negative insight that internal consistency doesn't help with generalization, as R2 suggested, it is unclear why that would be case in the first place (I read the pscyhology arguments, but I am not still not convinced). I still believe that without multi-step communication, the work is as useful as it can be in current form. In real world, no meaningful conversation is usually one step.
For Predator-Prey setup, I was talking about OpenAI https://github.com/openai/multiagent-particle-envs in which multiple tasks can be setup. For e.g. if prey thinks of what action predator might take, does internal consistency help prey to perform better?
I think most of what you got is correct for multi-step, see second para for more details in this response.
Thanks for bringing the manuscript under 8 pages. [3] is still missing from references.
Final comments: I would like to see multi-step experiments due to the reasons I explained above. The scheme of internal-consistency should be applicable beyond conversation to Predator-Prey setups also, thus, I feel experiments are not enough (only on 1 setting) to claim generalization of the hypothesis. Beyond these comments, I feel this is still a step in right direction and I would like to update my rating to weak accept while hoping that authors try to address these issues in camera-ready version if paper gets accepted.


Understanding the asymptotic behavior of wide networks is of considerable interest. In this work, we present a general method for analyzing this large width behavior. The method is an adaptation of Feynman diagrams, a standard tool for computing multivariate Gaussian integrals. We apply our method to study training dynamics, improving existing bounds and deriving new results on wide network evolution during stochastic gradient descent. Going beyond the strict large width limit, we present closed-form expressions for higher-order terms governing wide network training, and test these predictions empirically.

This is a positive review. Feel free to skip to the feedback.
SUMMARY OF PAPER
This paper explains how to use cluster graphs to easily compute the asymptotic behaviour of any given correlation function (Definition 1) for deep linear networks. By "asymptotic behaviour" I mean that it upper-bounds correlation functions by c·n^s, where s is a nonnegative integer given by the particular cluster graph, and c a "constant" (which I think depends on the particular input, x, to correlation function, among other things).
The authors then conjecture (Conjecture 1) that these bounds transfer to deep nonlinear networks, and that they are tight:
- Appendix C proves that these upper bounds also hold for deep ReLU networks, and 1-hidden-layer networks with smooth nonlinearity. This is also mentioned in page 3.
- Section 2.3 empirically shows that these bounds are pretty tight. (in terms of the exponent, none of the theory here gives a value for the constant c)
The tool provided above is the main result. The authors then use it to provide some results about wide networks
- They give a different proof that for large width, the Neural Tangent Kernel stays constant during training. This is because its derivative wrt. time as a function of width n is O(n^-1), and thus 0 for n->infinity.
- Using the ease of calculation from the tool, they approximate the change in the NTK over training time for any network. They do this using its value at initialization + a term that depends on n^-1. These results are numerically verified in Figure 1.
- They present numerical evidence for the accuracy of this approximation to the change in NTK over time.
The authors spend the last 2 pages explaining how cluster graphs derive from Feynman diagrams (FDs), and why these help compute asymptotics.
WHY I AM ACCEPTING THIS PAPER
The paper adapts FDs and cluster graphs, which is a potentially very useful tool for other wide-network researchers, and could accelerate research in this whole sub-field. It also shows their power by providing a surprisingly large amount of novel theoretical results.
FEEDBACK
At a very high level, there is only one thing that I think isn't made quite clear by the presentation, and it should be. If I understand correctly, Feynman diagrams (or cluster graphs) are only used here to calculate correlation functions for deep *linear* networks. Then, other results establish that the width-dependent asymptotic behaviour for linear networks holds as-is for nonlinear networks, and these results with FDs constitute Conjecture 1. There are proofs for ReLU and 1-layer smooth networks, mentioned in pg. 3; and the experiments in the paper support it for common nonlinear deep networks as well. I think that asymptotics for linear networks transfer to nonlinear ones is an interesting result, which doesn't depend on FDs.
What follows are details.
It is unclear to me whether cluster graphs are as "powerful" as FDs, i.e. whether the bound at the end of the Proof in page 8 is always saturated. Are there some cases in which you need to use FDs to get a tighter upper bound?
In Table 1 you should say that the values under "lin. ReLU tanh" are the fitted exponent s_C. This is not explained. Perhaps you  can mark the only 2 cases (in the 5th row) where the bound is not tight. It would be nice to know how much error remains between the fitted c·n^(s_C) and the empirical values.
Please explain x1 <-> x2 in eq. 8
In figure 1b, consider adding the finite-width limit prediction for the training dynamics. You have already done so for the prediction of the NTK during training in figure 5c, you could indicate it in the same way in 5b.
Typos:
Figure 2 caption: feynman -> Feynman
pg 8. anlytic evicence -> analytic


There is growing interest in automating designing good neural network architectures. The NAS methods proposed recently have significantly reduced architecture search cost by sharing parameters, but there is still a challenging problem of designing search space. We consider search space is typically defined with its shape and a set of operations and propose a channel-level architecture search (CNAS) method using only a fixed type of operation. The resulting architecture is sparse in terms of channel and has different topology at different cell. The experimental results for CIFAR-10 and ImageNet show that a fine-granular and sparse model searched by CNAS achieves very competitive performance with dense models searched by the existing methods.

This paper aims to search a sparse but competitive architecture with using a single fixed type of operation by proposing a channel-level neural architecture search (CNAS). Different from most previous NAS works, this paper conducts NAS process on channel-level such that different cell has different topology. CNAS provides a heuristic algorithm to calculate the saliency vector and zero out the channels iteratively until satisfying a given sparsity. This paper performs CNAS on Cifar-10 and ImageNet, and analyzes the topological properties of the final model. The results of experiment demonstrate CNAS can reach a competitive model with dense models searched by baselines.
This paper provides us with a novel insight that searching neural architecture on the channel level instead of operation and connection level. However, it just combines NAS and pruning parts together, which lacks of novelty in the algorithm level.
I lean to reject this paper because: (1) it lacks of novelty, (2) the experiment result is not convincing, (3) some related works are missed, (4) the expression of the paper is not clear.
Main argument
CNAS is a straightforward combination of NAS and pruning. As the author said in the section 2.1, CNAS method can be seen as two separate processes: training a supernet like one-shot NAS methods and then conducting pruning on the found supernet using Taylor expansion criteria. Both parts are the same as previous works almost and there is no innovation and improvements.
Many related works are missed in the paper. One important step in CNAS is pruning, which uses Taylor expansion technic as previous work. However, it only introduces NAS in introduction section and related works section, ignoring the pruning process. From my view, the pruning part is more important than NAS part.
From the results of the experiment, the improvement of CNAS is not convincing. I think the main focus of the paper is the sparsity, but in Table 2, the number of parameters of model is still larger (4.6*10^6) compared with some baselines like DARTS (2.9*10^6). Besides that, much space in the experiment section is devoted to the relationship between supernet and the final model, which is not so important. Because in other methods, supernet is just an intermedia. Therefore, The comparison between them is not so meaningful.
The paper is hard to understand because of unclear writing. For example, in algorithm part, the author doesn't make DimensionReduction function and its inputs clear. The author mentions the first input in the paragraph but how to combine with the second input? Also, the representation in Figure 1(b) is confused. It's hard to figure out "the thick edges", "the solid thick ones" and "the dotted solid thick ones".
Questions
1. As we all known, operation set is important to the search space. Have you tried more types of operations? From my view, using only one fixed operation is unfair for CNAS compared with other methods.
2. One of your focus is sparsity of the model. Can you explain the reason that you set the number of parameters to a large value (4.6*10^6)? Have you tried to use a larger sparsity value? What's the performance of CNAS when the model is sparser?

3. In Table 2, there are some different tricks (cutout, autoaugmented) applied on some methods. Can you explain how you guarantee the fair comparison between different methods? If we just compare CNAS-R or CNAS-W, they are not better than baselines.


We present a learning-based approach to detect and fix a broad range of bugs in Javascript programs. We frame the problem in terms of learning a sequence of graph transformations: given a buggy program modeled by a graph structure, our model makes a sequence of predictions including the position of bug nodes and corresponding graph edits to produce a fix. Unlike previous works that use deep neural networks, our approach targets bugs that are more complex and semantic in nature (i.e. bugs that require adding or deleting statements to fix). We have realized our approach in a tool called HOPPITY. By training on 290,715 Javascript code change commits on Github, HOPPITY correctly detects and fixes bugs in 9,490 out of 36,361 programs in an end-to-end fashion. Given the bug location and type of the fix, HOPPITY also outperforms the baseline approach by a wide margin.

This paper proposes a graph tranformation-based code repair tool. By representing source code as a graph a network is asked to take a series of simple graph edit operations to edit the code. The authors show that their method better predicts edits from existing code.
Overall, I find the problem interesting and the neural approach of the authors reasonable, principled and interesting. However, the evaluation is either badly written or the authors have not understood the related literature they are comparing to. It is thus unclear how this model compares to alternatives. I believe that this is good work that needs to eventually be published, but it's not ready at this time.
* In 3.2.1 "Value" paragraph "Instead of predicting the replacement value using a language generative model (Chen et al 2018, Allamanis et al 2018), we let the model to choose from either the values appearing in the current file."

   -The Chen et al. (2018) paper is indeed a translation-style model, but thanks to the copying mechanism, the model can also choose from values appearing in the current input.
   - The Allamanis et al. (2018) is *not* a generative model and it can only select a misused variable for those that exist on within the scope (for the Variable Misuse Task)
* The authors compare to the VARNAMING (Section 6.2) task of Allamanis et al. (2018). This is odd, since to my understanding, this task is about alpha-renaming, i.e. semantics preserving renaming of all identifiers of a variable. This is not comparable with the REP_VAL action which simply replaces the value of a single leaf node from the value table. The VARMISUSE objective (picking one variable directly from the value table) is the closest analogue, although it performs no localization.
Thus, it is not surprising that a char-level language model cannot predict the names of the elements in the value table. So, I don't think that we learn anything from the current comparison.
* It's unclear to me why the REP_TYPE action is relevant to VARMISUSE task of Allamanis et al. (2018). This seems to simply be a classification task (among all known/valid types of the tree) given an existing position.
* Given the above two points, it's unclear what the comparison with the baseline (Table 3) means and what one can deduce from the evaluation: The Allamanis et al. (2018) work tries to find the correct variable at a given location; this work tries to pick a location and find a different value from current one. The Allamanis et al. (2018) and Cvitkovic et al. (2018) uses additional semantic information (as edges), importantly data flow and control flow. This work uses none of those. I am not sure that I can see how the comparison here can work.
* In 3.1 "Unlike previous approaches, we additionally add value nodes that store the actual content of the leaf nodes [...]. The purpose of introducing this additional set of nodes is to provide a name-independent strategy for code representation and modification". I am not sure what's unlike previous approaches. For example, the Allamanis et al. (2018) and the Cvitkovic et al. (2018) work, connect the same variables with various ways (e.g. data-flow edges) in a way that provides a name-independent strategy for code representation. I would fing it surprising that a principled comparison between Allamanis et al. (2018)/ Cvitkovic et al. (2018) and this work will yield any improvements: all papers use the same model (variations of a graph neural network) and this work uses strictly fewer information (no data flow, control flow edges). A comparison would simply compare how the two graph-extraction methods compare, but nothing valuable otherwise.
* The authors of this work frequently refer to Chen et al. (2018), but never compare with it. I would expect that this model beats the Chen et al. (2018) work, but this needs to be shown. In my opinion this is a much more relevant baseline, compared to the comparison with Allamanis et al. (2018). If the authors insist on comparing with that work, then a "fair" comparison needs to be made. Comparing between REP_VAL and VARMISUSE given the location of the node-to-be-repaired, is probably the only reasonable option. Comparing with Vasic et al. (2019) for the REP_VAL/REP_TYPE would also be reasonable.
* The correctness of the NO_OP predictions are never evaluated. Does the model "know" when to terminate or does it keep editing? It's unclear what is the overall accuracy (for a full edit).
Other questions:
* The "ADD" operation predicts two locations: one for the parent and one for the left sibling of the node. Does this mean that for a given node the "ADD" operation will never be able to add a left-most child (since it has no left sibling)?
* It has been recently found that code corpora collected by scraping GitHub may contain a disproportionate amount of duplicates (Lopes et al. 2017, Allamanis 2018). It is unclear if the authors have taken any steps to detect and remove duplicates that would affect their results.
* In Table 2: Does "Beam-3" mean "accuracy in the top 3" or does it mean "accuracy of the top prediction when the beam size is 3"? The difference between "Beam-1" and "Beam-3" is surprisingly large. Can you explain why?
* In the TAJS comparison, it is unclear if any negative examples are added: it's unclear what's the false positive ratio of HOPPITY vs TAJS.
Minor:
* Abstract: "Github" -> "GitHub"
* 3.2 REP_VAL: "Tthe"-> "The"
* Sec 7: "Vasic et al. (2019) present a pointer network..." It is unclear if this work outperforms the Allamanis et al. (2018) work as the comparison is only partial. Another ICLR submission https://openreview.net/forum?id=B1lnbRNtwr suggests that this is not the case.
* The citation of Chen et al. (2018) should be capitalized correctly "Sequencer"->"SequenceR"
## References
Allamanis, Miltiadis. "The Adverse Effects of Code Duplication in Machine Learning Models of Code." arXiv preprint arXiv:1812.06469 (2018).
Cvitkovic, Milan, Badal Singh, and Anima Anandkumar. "Open Vocabulary Learning on Source Code with a Graph-Structured Cache." arXiv preprint arXiv:1810.08305 (2018).
Lopes, Cristina V., et al. "DéjàVu: a map of code duplicates on GitHub." Proceedings of the ACM on Programming Languages 1.OOPSLA (2017): 84.


This paper studies structured sparse training of CNNs with a gradual pruning technique that leads to fixed, sparse weight matrices after a set number of epochs. We simplify the structure of the enforced sparsity so that it reduces overhead caused by regularization. The proposed training methodology explores several options for structured sparsity.
We study various tradeoffs with respect to pruning duration, learning-rate configuration, and the total length of training. We show that our method creates a sparse version of ResNet50 and ResNet50v1.5 on full ImageNet while remaining within a negligible <1% margin of accuracy loss. To ensure that this type of sparse training does not harm the robustness of the network, we also demonstrate how the network behaves in the presence of adversarial attacks. Our results show that with 70% target sparsity, over 75% top-1 accuracy is achievable.

SUMMARY
-------
This paper explores a series of incremental variations of existing pruning techniques for compressing Resnet-50 for ImageNet. Specifically, it proposes concentrating all pruning during an early "era" of training (the first 20-50 epochs out of 100 total). It also explores hybrids between sparse pruning and structured pruning. Finally, it considers the adversarial robustness of the resulting networks to the FGSM attack.
This paper makes no novel proposals and experiments are minimal. There are no clear takeaways from the results of these experiments. The goals of the paper are unclear, and it is difficult to compare this paper to existing work.
This paper has no clear motivation and makes no tangible contributions to the literature and, therefore, I recommend a rejection.
CONTRIBUTIONS
-------------
1) A study of the appropriate window ("pruning era") for pruning Resnet-50 on ImageNet and TinyImageNet
2) A study of the tradeoffs between various forms of structured and unstructured pruning.
3) An analysis of the adversarial robustness of the pruned networks.
DETAILED COMMENTS
------
PROBLEMS ADDRESSED
It was challenging to discern the specific problems that this paper sought to address and, relatedly, the goals that the paper sought to achieve. The introduction of the paper lists a wide variety of problems in the existing literature:
1) Paragraph 3: Structured sparsity introduces "regularization and computational overhead."
2) Paragraph 3: "Coarse-grained sparsity" cannot eliminate enough parameters to perform well on "edge devices."
3) Paragraph 4: Dynamic sparsity techniques require more training epochs.
4) Paragraph 4: Dynamic sparsity techniques do not preserve network accuracy (1-2 percentage point drop at 80% sparsity).
5) Paragraph 4: Dynamic sparsity requires reconfiguring the sparsity pattern frequently, which is computationally expensive.
The paper does not justify the fact that any of these are actually problems, nor does it make any attempt to quantify the extent of these problems. Moreover, the proposed techniques do not resolve any of these problems. Corresponding to the numbers above:
1) The paper never measures this overhead nor justifies that it is a problem in practice. Meanwhile, the techniques proposed in the paper introduce substantial overhad of their own, including training for an extra ten epochs. It is possible that the techniques proposed in this paper have worse overhead than the techniques that are criticized in the introduction. Since the paper provides on numbers either way, it is impossible to tell. In short, computational cost is a key part of the author's argument despite the fact that there is no empirical support for any of these claims.
2) I believe the paper means that, in order to get to sufficient levels of sparsity to work on "edge devices," accuracy drops unacceptably far. What does the paper mean by "edge devices," what are sufficient levels of sparsity, and what does it mean for accuracy to drop unacceptably far? The paper has numbers for the proposed methods, so it should be possible to make this comparison if such baselines are explicit.
3) The proposed techniques also require the same number of additional training epochs, so this complaint is unaddressed.
4) The proposed techniques show a 2-3 percentage point drop at 80% sparsity (Table 1), which is actually worse than the technique that the authors criticize.
5) The proposed techniques require pruning after every single training step during the "pruning era." This is likely to be more computationally expensive than any of the other gradual pruning and dynamic sparsity techniques listed, which prune at intervals of hundreds or thousands of iterations. In addition, the authors never justify why changing the sparsity pattern frequently throughout training will affect performance. On GPUs with modern frameworks, I see no reason why this should matter so long as the sparsity pattern does not change too frequently (although that is exactly what this paper proposes to do during the "pruning era").
GOALS
It was also challenging to discern the goals of the paper. Was it:
1) To produce the smallest possible trained networks with the highest possible accuracy?
2) To reduce the cost of obtaining a pruned network for inference-time? (Or to reduce the cost of obtaining a sufficiently efficient pruned network for inference-time?)
3) To reduce the cost of training neural networks in general by pruning them during training?
In the introduction and the related work section, these goals go unstated, making it difficult to determine how this paper compares to existing work. The comparisons provided in the paper focus on specific aspects of each related work rather than the entire picture. For example, in comparison to Mao et al., the authors claim better accuracy at one sparsity level, implying goal 1. However, for to Lym et al., the paper focuses on the computational costs of training the network, implying goal 3.
UNJUSTIFIED CLAIMS ABOUT NEURAL NETWORK COMPUTATION
Throughout the paper, there are a number of unjustified claims about which neural network configurations will perform better on contemporary hardware. Considering computational efficiency appears to be a key element of the paper's argument, these claims require citations or - particularly when various configurations are compared to one another - empirical support. Some examples:
* Section 1, Paragraph 3: "The regularization term [of structured sparsity] modifies the original training and can be expensive in hardware."
* Section 1, Paragraph 3: "The final network [from Lym et al. 2019] contains an insufficient degree of sparsity for deployment on edge devices."
* Section 1, Paragraph 4: "Continuous reconfiguration of the sparsity pattern is expensive as it does not allow for compression of weights during training"
* Section 1, Paragraph 5: "having a fixed sparse multiply-accumulate pattern allows weight compression during training and can save compute and energy in hardware"
* Section 5, Paragraph 2: "A strict parameter allows the hardware mapping to plan for a fixed number of multiply-accumulate operations."
* Section 5, Paragraph 2: "Regularization, although useful in forcing the network to learn prunable weights, adds more irregularity to computation flow."
PRUNING TECHNIQUES
* Recomputing the pruning mask at every training step seems gratuitously inefficient.
* Sorting the weights in the entire network shouldn't be particularly inefficient if it isn't done on every single iteration. (Section 2.1 paragraph 1)
* Why do you maintain the same number of weights in each convolutional filter with window pruning? (Presumably for performance reasons, but you never say that.)
* None of the pruning methods are novel. They're simply various permutations of structured and unstructured magnitude pruning as proposed by many others in the literature.
EXPERIMENTS
* Section 3.1 Paragraph 2: It appears that you are exploring the best "pruning era." If you are to do so, you will have to sweep over (1) the length of the pruning era (2) the starting epoch of the pruning era, and (3) the shape of the function used to determine sparsity. Instead, it sounds like you tried two arbitrary pruning eras (0-30 and 30-50). Likewise, in Paragraph 3, you test only a small number of possible scenarios.
* Section 3.1 is generally hard to parse. It is unclear what you are studying. The ideal pruning era? The relative performance of the pruning methods introduced in section 2?
* How many times did you replicate each experiment? You should ideally include at least 3 (and preferrably 5) replicates with mean and stddev reported.
* What baselines are you including? You should include a random pruning baseline and you should ideally replicate any methods that you compare to.
RESULTS
* Section 4.1: The data you refer to is in an appendix even though it is crucial to the main body of the paper. The appendices should contain material that is nonessential for making sense of the paper.
* Section 4.2 Paragraph 1: Are these numbers good? A standard sparse pruning technique (Gale et al. 2019, https://arxiv.org/pdf/1902.09574.pdf) achieve 70% sparsity without any change in accuracy. Please include baselines comparing to other methods in the literature.
* Table 2: It is difficult to compare the results in these papers. PruneTrain aims to reduce the cost of training and measures cost reductions in FLOPS. If you intend to compare against this paper, you should quantify the cost of training using your method against that of PruneTrain. Merely presenting sparsity and accuracy numbers is insufficient. Likewise for the dynamic sparsity experiments. What is your goal in showing this comparison, and did Mostafa and Wang share that goal when they justified their technique?
* You do not describe the hyperparameters for Intraepoch pruning (the balance between window and CK - last paragraph of 2.1.1)
ADVERSARIAL ROBUSTNESS
Considering the fact that this paper focuses on proposing new variations of existing pruning techniques, any discussion of adversarial robustness seems to be (1) out of place and (2) an afterthought. If the authors delete a half-page of content (one phrase from the abstract, a paragraph and bullet from the introduction, and a paragraph each from sections 3 and 4), this content could be removed with minimal impact to the paper's main contributions. The content on adversarial robustness is cursory, uses a weak and out-of-date attack (FGSM), and does not compare to any other pruning methods. In fact, the one comparison is to the results in a paper (Wang et al, 2018) that looks at both FGSM and PGD (a stronger attack) on completely different networks and tasks (MNIST and CIFAR10). The paper would be stronger if content on adversarial robustness was removed entirely.
OTHER MINOR COMMENTS
* The title includes the word "starfire," but it never appears again in the paper. The paper proposes no specific technique, so there isn't anything to name.
* Use the \ begin{appendix} command before you create the appendices and the \ end{appendix} command when you are done. You can then use \section normally and each section so-created will appear with a letter rather than a number.
* Figure 4 is very hard to read.


Many tasks in modern machine learning can be formulated as finding equilibria in sequential games. In particular, two-player zero-sum sequential games, also known as minimax optimization, have received growing interest. It is tempting to apply gradient descent to solve minimax optimization given its popularity and success in supervised learning. However, it has been noted that naive application of gradient descent fails to find some local minimax and can converge to nonlocal-minimax points. In this paper, we propose Follow-the-Ridge (FR), a novel algorithm that provably converges to and only converges to local minimax. We show theoretically that the algorithm addresses the notorious rotational behaviour of gradient dynamics, and is compatible with preconditioning and positive momentum. Empirically, FR solves toy minimax problems and improves the convergence of GAN training compared to the recent minimax optimization algorithms. 2 +4xy−y 2 , our algorithm moves closer to the ridge every iteration and it moves along the ridge once it hits the ridge. Without the FR correction term, gradient dynamics can drift away from the ridge.

Summary: This paper designs a set of dynamics for learning in games called follow-the-ridge with the goal of finding local stackelberg equilibria. The main theoretical results show that the only stable attractors of the dynamics are stackelberg equilibria. Moreover, the authors give a deterministic convergence rate for the vanilla algorithm and a convergence rate using momentum. Empirical results show the learning dynamics cancel out rotational components and drive the vector field to zero rapidly, while reaching good performance on simple GAN examples.
Review: This paper focus on sequential games, which is the common formulation of GANs and a number of games in machine learning applications. From this perspective, it is natural to look at Stackelberg equilibria. In my opinion, the objective of the paper is important and relevant. The theoretical and empirical results are reasonably convincing. However, I do have some rather serious concerns about the general-sum game results and several questions regarding the relation to related work and the experiment details that need to be addressed.
1. The FR dynamics in algorithm 1 are closely related to the dynamics in [1]. In particular, the Jacobian of the FR dynamics is a similarity transform of the Jacobian of the dynamics in [1]. As a result, each algorithm has the same set of stable attractors. This should probably be mentioned in the paper. Given this relation, it is not clear what the advantage of the FR dynamics are over the dynamics in [1]. Could you please discuss this?
2. The gradient penalty regularization connection does not make sense in section 4.1. The optimization problem presented has an issue because the dimensions do not align in the constraint. The quantity \nabla_x f(x, y)^T H_yy^{-1}\nabla_x f(x, y) would not be defined if the dimensions of the players are not equal.
3. In the related work it is claimed that two time-scale GDA converges only to local minimax and [2] is cited. I would avoid using this claim with respect to that paper since the statement following the main result in the paper is not right (see proposition 11 of [3] for proof). It is not clear what is meant when it is claimed that [1] can converge to non-local Stackelberg points. The dynamics in [1] only converge to local minimax points in the special case of zero-sum games.
4. Since the dynamics in the paper are the closest to those in [1], it seems that the paper would be stronger by comparing with that set of dynamics.
5. I found it to be quite impressive that the vector field is driven to zero in the GAN examples. Just to clear, for each algorithm when the ‘gradient norm’ is shown, does this mean the norm of the update for each norm or does it mean the individual derivative for each player. For example in FR, would it be the norm of the derivative with respect to the follower variable of the function or the norm of the update including the second order information?
6. The path angle plot was interesting to see for the GAN example. The authors claim that the eigenvalues of the second order equilibria condition are non-negative. It would be nice if the authors could show the eigenvalues in the appendix and discuss how they were computed since it may be non-trivial to compute depending on the network size.
7. The damping method to stabilize training is not quite clear. Could you provide more details about how this was done?
My primary concerns have to do with the portion of the paper considering general-sum games. I do not understand where proposition 7 and 8 come from. I am not convinced the definitions provided are necessary and sufficient conditions for Stackelberg equilibria. In [1], a differential Stackelberg equilibrium is defined. The definition in this paper does not appear to agree with the definition in [1]. The final positive definite condition in proposition 7 and 8 does not appear to be taking the total derivative 2 times when I evaluate the derivatives, so I am not sure what the quantity is. If this is not a proper set of conditions for the equilibria, then it would also mean that the dynamics do not only converge to equilibria in general-sum games. It is important that the authors clear up this concern since I do not believe Theorem 3 holds as a consequence of problems with propositions 7 and 8.
[1] Fiez et al.,  "Convergence of Learning Dynamics in Stackelberg Games",  2019.
[2] Heusel et al., "GANs trained by a two time-scale update rule converge to a local Nash equilibrium", 2017.
[3] Mazumdar et al.,  "On Finding Local Nash Equilibria (and only Local Nash Equilibria) in Zero-Sum Games", 2019.
Post Author Response: Thanks to the authors for the effort in discussing the paper with me. The authors made several changes to the paper in response to my comments including removing section 4.1, fixing comments about related work, including details on the damping procedure, showing experimental comparisons to [1] along with an explanation of why the dynamics in this paper may be preferred for training GANs, providing details on propositions 7 and 8 and including reference to [1], adding further assumptions on the functions, and attempting to make theorem 3 more clear. Overall, I think this paper proposes an interesting set of dynamics, several meaningful theoretical guarantees, and impressive empirical results. I would be curious to see how it performs on even more large-scale GAN problems in the future. As a result, I have changed my original score from a weak reject to a weak accept. My primary concerns with the paper regarded the general-sum convergence results and I appreciated the explanations from the authors. I am still of the opinion that theorem 3 could be stated more rigorously in the sense that the neighborhood on which the local convergence holds should be more explicit. It seems to me that the convergence result may only hold in a ball around an equilibrium in which the implicit function is well-defined and the FR dynamics will be attracted to r(x) and that this space could be arbitrarily small for some problems. Nonetheless, this result is only in the appendix, and the paper includes enough contributions beyond this to warrant acceptance.


Deep generative models can learn to generate realistic-looking images, but many of the most effective methods are adversarial and involve a saddlepoint optimization, which require careful balancing of training between a generator network and a critic network. Maximum mean discrepancy networks (MMD-nets) avoid this issue by using kernel as a fixed adversary, but unfortunately they have not on their own been able to match the generative quality of adversarial training. In this work, we take their insight of using kernels as fixed adversaries further and present a novel method for training deep generative models that does not involve saddlepoint optimization. We call our method generative ratio matching or GRAM for short. In GRAM, the generator and the critic networks do not play a zero-sum game against each other, instead they do so against a fixed kernel. Thus GRAM networks are not only stable to train like MMD-nets but they also match and beat the generative quality of adversarially trained generative networks.

The proposed approach amounts to a non-adversarial way to update the parameters theta of a kernel K_theta(x, y) = k(f_theta(x), f_theta(y)) in an MMD-net, rather than adversarially as in MMD-GANs. Avoiding the saddle point problem clearly gives a more stable optimization problem, as shown in Section 3.4, which is very nice.
Theory/motivation:
The motivation based on density ratio estimation, however, very much assumes that these densities exist. As convincingly argued by Arjovsky and Bottou (ICLR 17, "Towards principled methods for training generative adversarial networks"), the densities p_x, q_x of (4) typically do not exist (w.r.t. Lebesgue measure), and moreover the support of the distributions are typically almost disjoint. Algorithmically, this doesn't seem to be a major issue for your approach: the estimator (8) corresponds to some kind of smoothing by the kernel. But it would be nice from a motivation point of view to have a better understanding of:
- What assumptions exactly does (8) make about the existence of densities? For example, in the case of a Gaussian kernel, does it correspond to the distance between distributions convolved with Gaussian noises with a smaller Gaussian kernel? Does the algorithm "make sense" when distributions don't exist?
- Can we say something about when a density exists for the dimensionality-reduced data f_theta(x) even when it doesn't exist for the data x?
- Relatedly, the dimension-reduced Pearson divergence is clearly somehow different from the plain Pearson divergence. Can we understand a little bit more how it's different? How does the choice of architecture of f_theta affect the distance metric?
- Is it the case, as in Arjovsky et al. (2017) or in Arbel et al. (NeurIPS 2018, "On gradient regularizers for MMD GANs"), that the overall loss function with an optimal f_theta is continuous with respect to the GAN distribution?
Certainly not all of these theoretical questions require answers for an initial ICLR paper, but they would be illuminating for understanding the method.
Motivating experiments:
- In Figure 2, it seems that except in the first image (h=2) the mapping f_theta becomes essentially the identity. Is this expected to be generally true in your 2d cases, because the density ratio can already be well-represented there? A more interesting example for this aspect of the model might involve higher-dimensional distributions with some low-dimensional manifold structure; would f_theta pick up some reasonable representation of the manifold in those cases?
- Can you plot the density ratio estimate in a simple 2d example like this? How does it look visually? Is a good estimate necessary for good performance of your generative model?
Experiments:
- As shown by Binkowski et al., it's extremely important to specify the sample size for FID scores, which you don't do.
- That said, the FID scores of the MMD GAN models of Binkowski et al using DCGAN discriminators (which replace the FSR and AE penalties of Li et al. with a single gradient penalty) found substantially smaller penalties for performance of MMD-GANs with using a smaller discriminator (1/4 as many hidden units rather than 1/2 as you use) than you did. They also reported substantially better numbers on CelebA than you did. If not too difficult code-wise, it might be worth trying either their code or that of the followup Arbel et al. (citation above) to compare to your approach.
- The results of, for example, Mescheder et al. (ICML-18, "Which Training Methods for GANs do actually Converge?") and Arbel et al. (NeurIPS-18, "On gradient regularizers for MMD GANs") seem to be much better visually with comparably-sized models than the results of Figure 8 (and of course StyleGAN/etc are *far* better but with drastically larger models). It would be good to compare empirically to some more recent models than original MMD GANs (whose empirical results were substantially improved with only minor tweaks by Binkowski et al. mere months later) or DCGAN, which are fairly old approaches in this space.
- Two more extremely relevant methods it would be worth comparing to or at least mentioning:
   - Ravuri et al. (ICML 2018, "Learning Implicit Generative Models with the Method of Learned Moments") can be interpreted as learning f_theta for an MMD-net as you do by taking the gradients of an auxiliary classification network. Although it is still somewhat "adversarial," they need to update the kernel function extremely rarely (every 2,000 generator update steps) and the optimization seems overall much more stable.
   - dos Santos et al. (https://arxiv.org/abs/1904.02762 "Learning Implicit Generative Models by Matching Perceptual Features") effectively use an MMD-net (with some slight tweaks) with a *fixed* kernel. Though results aren't quite as good, it's worth at least mentioning.
Minor typos/etc:
- Top of page 3: it is sufficient to choose F a unit ball in an RKHS with a _characteristic_ kernel.
- Page 4: "this issue in next."
- Figure 1 caption: (both) should probably be (bottom).
Overall initial thoughts:
This seems like a nice alternative to adversarial methods, but it does not compare to more recent (last 2 years) models in this space or very thoroughly establish the applicability of its motivation. I think it's worthy of a weak accept as is, but could be much more convinced with some additional work.


Uncertainty is a very important feature of the intelligence and helps the brain become a flexible, creative and powerful intelligent system. The crossbar-based neuromorphic computing chips, in which the computing is mainly performed by analog circuits, have the uncertainty and can be used to imitate the brain. However, most of the current deep neural networks have not taken the uncertainty of the neuromorphic computing chip into consideration. Therefore, their performances on the neuromorphic computing chips are not as good as on the original platforms (CPUs/GPUs). In this work, we proposed the uncertainty adaptation training scheme (UATS) that tells the uncertainty to the neural network in the training process. The experimental results show that the neural networks can achieve comparable inference performances on the uncertain neuromorphic computing chip compared to the results on the original platforms, and much better than the performances without this training scheme.

This paper proposes a way of training neural nets on analog-circuit based chips, which are cursed with uncertainties. Such uncertainties are deeply rooted in the way neural nets are implemented on such chips. Take [c = a x b] as an example. In order to perform this operation, one can set the electric potential to a and the conductance to b and c will be the output current. The problem here is that we cannot set the conductance precisely, which often encodes the weights of a neural net. This implies we cannot precisely program a neural net into these chips. This paper proposes to train a neural net with the presence of such noise, by treating weight as a random variable during training. The experimental results based on simulation suggest this is a much better strategy than programming a neural net into chips imprecisely.
Overall, this paper touches upon an important research problem towards running neural nets on neuromorphic computing chips, which is how to deal with the underlying uncertainties. The proposed algorithm is reasonable and the experimental results look encouraging. However, I would like to ask a few clarification questions. Given authors’ response, I will be willing to adjust my score.
(1) For the baseline, have you tried randomly jittering the network weights after every training iteration in a way that is “blind” to the source of the uncertainties (i.e. conductance)? I would like to understand in what degree modeling the noise helps. If this works out, it implies, (1) we do not have to pay much cost in sampling; (2) there is a simpler way to train neural nets that behave robust when deploying onto neuromorphic computing chips despite the uncertainties.
(2) Is there any intuition behind replacing every weight after every k epochs with new samples (Sec. 2.3)?
(3) The paper does not mention the overhead of estimating the loss with n feed-forward passes dramatically slows the training process. I assume it will slow down training by n times?
(4) There is a comparison between retraining and fine-tuning. Despite being less accurate, is fine-tuning faster to train in terms of the actual training time?
(5) Here I quote the paper “The UATS performs better when the neural network has more layers” (Sec. 3.2). I cannot find an empirical comparison that supports this claim.


Learning from limited exemplars (few-shot learning) is a fundamental, unsolved problem that has been laboriously explored in the machine learning community. However, current few-shot learners are mostly supervised and rely heavily on a large amount of labeled examples. Unsupervised learning is a more natural procedure for cognitive mammals and has produced promising results in many machine learning tasks. In the current study, we develop a method to learn an unsupervised few-shot learner via self-supervised training (UFLST), which can effectively generalize to novel but related classes. The proposed model consists of two alternate processes, progressive clustering and episodic training. The former generates pseudo-labeled training examples for constructing episodic tasks; and the later trains the few-shot learner using the generated episodic tasks which further optimizes the feature representations of data. The two processes facilitate with each other, and eventually produce a high quality few-shot learner. Using the benchmark dataset Omniglot, we show that our model outperforms other unsupervised few-shot learning methods to a large extend and approaches to the performances of supervised methods. Using the benchmark dataset Market1501, we further demonstrate the feasibility of our model to a real-world application on person reidentification.

This paper considers the problem of learning an image representation for few-shot learning without using image labels during training. This is a well-motivated problem since (as the paper points out) learning such a representation using "episodes" of low-shot learning problems as examples may require a large amount of annotated data. The paper proposes an iterative algorithm which alternates between clustering the images using the current model and updating the model using the clusters as "pseudo-labels". This approach is not particularly elegant as there is no clear objective being optimized, but it may nevertheless be effective. One main claim of the paper is that the iterative nature of this process is key to the success of the algorithm. The choice of model is a multi-layer conv-net which is trained using SGD (Adam). The paper investigates both triplet (with and without hard negatives) and "prototype" losses for learning the model parameters. To find clusters, the paper adopts the DBSCAN algorithm using the Jaccard similarity of the k-reciprocal neighbour sets.
I am not aware of other papers that use self-supervised learning to obtain a representation which is specifically suitable for few-shot learning via nearest-neighbour classification. As is noted in the paper, the absence of supervision during training more closely resembles the scenario of few-shot learning in biological systems.
The design decisions are well motivated throughout the paper.
The appendices are high quality and make the paper much more complete. In particular: the method for choosing epsilon, the empirical study of the effect of epsilon and the discussion of the behaviour of the cluster sizes as training proceeds.
Principal concerns:
(1.1) The proposed approach is particularly similar to DeepCluster (Caron et al.). Besides the use of a different clustering algorithm, it seems that the main high-level difference is the use of "episodic training", in which the algorithm is trained to compare examples to a query example, rather than to classify single examples. I would have preferred to see a comparison to non-episodic training. (It might be necessary to train a linear classifier on top of the final feature representation rather than simply build a nearest-neighbour classifier, but still this is convex, cheap and even closed-form in the case of least-squares regression.)
(1.2) While the algorithm has been demonstrated on real images in the Market1501 dataset, it would have been much more convincing to see it demonstrated on a more widely-used dataset for few-shot learning such as Mini-ImageNet.
(1.3) There are several recent papers on unsupervised feature learning using self supervision, especially as an alternative to ImageNet-classification pre-training. There is no discussion of these approaches, yet they might perform better than the proposed algorithm, especially for tasks with real images. Some examples of such papers are:
- "Discriminative Unsupervised Feature Learning with Exemplar Convolutional Neural Networks"
- "Representation Learning with Contrastive Predictive Coding"
- "Unsupervised representation learning by predicting image rotations"
The literature on using auto-encoders to learn feature representations is also relevant.
Issues with details in the paper:
(2.1) The DeepCluster paper observed that non-negligible accuracy could be achieved using a randomly-initialized conv-net (12% when chance is 0.1%). This enabled the use of clusters as pseudo-labels. Is a similar effect observed with your datasets and random initialization?
(2.2) For large datasets, the clustering algorithm might be prohibitively expensive? It would be useful to discuss the complexity of this algorithm.
(2.3) It would be interesting to see the effect of varying the frequency of the clustering during training (i.e. how many gradient steps are taken before updating the clustering).
(2.4) It is concerning that the accuracy drops sharply as \rho increases [6, 7, 8]*10^-5 in Table 4.
(2.5) It is stated that batch-normalization at the network output helps prevent over-fitting. Why? My intuition is that it would be more helpful for avoiding regions of the loss function which have a small gradient magnitude. What happens if you remove it?
(2.6) What is the test time procedure? Do you use the mean feature when there are k > 1 shots (even for the network trained with the hinge loss)? Do you L2-normalize the representation vectors?
(2.7) It seems potentially brittle to use hard negatives in the triplet loss with pseudo-labels? If the labels were wrong, then the hard negatives might not really be negatives. Nevertheless, this does not seem to be an issue, at least with these datasets.
(2.8) There are no error-bars anywhere in the paper.
Minor comments:
(3.1) Tables 3 and 4 would be easier to interpret if plotted on an axis.
(3.2) The word "concurrently" suggests that the clustering and the training are performed simultaneously. I would prefer "alternating".
(3.3) A grammatical review of the paper is required. For example in the abstract: "to a large extent (extend) and approaches the performance of (to the performances of) supervised methods".
(3.4) Remember to use \log and \max in latex to improve the appearance.


The Hamiltonian formalism plays a central role in classical and quantum physics. Hamiltonians are the main tool for modelling the continuous time evolution of systems with conserved quantities, and they come equipped with many useful properties, like time reversibility and smooth interpolation in time. These properties are important for many machine learning problems -from sequence prediction to reinforcement learning and density modelling -but are not typically provided out of the box by standard tools such as recurrent neural networks. In this paper, we introduce the Hamiltonian Generative Network (HGN), the first approach capable of consistently learning Hamiltonian dynamics from high-dimensional observations (such as images) without restrictive domain assumptions. Once trained, we can use HGN to sample new trajectories, perform rollouts both forward and backward in time and even speed up or slow down the learned dynamics.
1 We demonstrate how a simple modification of the network architecture turns HGN into a powerful normalising flow model, called Neural Hamiltonian Flow (NHF), that uses Hamiltonian dynamics to model expressive densities. We hope that our work serves as a first practical demonstration of the value that the Hamiltonian formalism can bring to deep learning.

The paper proposes two ideas: 1) Hamiltonian Generative Networks (HGN) and 2) Neural Hamiltonian Flow (NHF).
Hamiltonian Generative Networks are generative models of high-dimensional timeseries which use hamiltonian differential equations to evolve latent variables (~position and ~momentum vectors) through time (using any differentiable integration scheme). Given the ~position vector a decoder network generate predictions. The initial latent variables are inferred using a VAE style inference network that takes a sequence of images as the input. The decoder, inference network and crucially the hamiltonian energy function is learned by minimizing a VAE style ELBO on observed sequences. The model induces a strong hamiltonian physics prior and is quite elegant all in all. The model is evaluated on 4 simulated physics tasks, and beats the only baseline the Hamiltonian Neural Network (HNN).
Neural Hamiltonian Flow notes that hamiltonian dynamics are invertible and volume preserving, which is the properties you need for neural flow models. As such it propose to use a series of hamiltonian update steps with multiple learned energy functions as a flexible density estimator. The resulting density estimator is subjectively evaluated on three 2d toy density estimation tasks.
I propose a weak accept as I think the paper is interesting and well written, but could be much better. The paper explains how both HGN and NHF work, but not much more. The HGN is only compared to a single other method (the closely related HNN), on four toy benchmarks. The NHF is barely evaluated, and not compared to anything.
Does the authors actually care about modelling physics and think their method is superior at this? If so, they should compare and contrast to some of the many, many papers on modelling physics, e.g. [1,2,3,4] and references herein. If not, what do they care about? Where do they think this model can be useful? Why should anyone use this model over some of the many, many other models one could use?
Similarly for the NHF, if I only read this paper I have no idea whether it's better than any of the other flow based models. Is it faster (to sample? to eval likelihood?) is it a better estimator? Why should I use it?
I think the paper would benefit from being split into two papers, each thoroughly examining one idea.
A few questions and minor comments
 - While the hamiltonian dynamics expect position and momentum vectors, the neural network is free to use those however it sees fit. Actually, if I understand correctly, the position vector must also encode the color of the objects for the 2 and 3 body problem. Is that correct? It would be interesting if you could examine how predictive the q and p vectors were of the true position and momentum vectors.
 - Successful experiments with n-body problems with n randomly sampled during training and unseen n used in testing would be very powerful in showing generalization. I'm afraid that the current setup doesn't generalize well.
 - I'm surprised that the generated images start showing artifacts after some time, e.g. pendulum sample 4 and 6 in https://docs.google.com/presentation/d/e/2PACX-1vRD2FnKgymgR2lU8lE6-XM8Cz-UWLTI6n_Uht3v6Gu4hIyMHmOcNL5D-0eG6Z4WHDAWS4qFosU-lxXP/pub?start=false&loop=false&delayms=3000&slide=id.g61bbdf339d_0_426. How can those appear if the hamiltonian dynamics preserve energy?
 - Equation 3 is given as self evident. It's not clear to me why 1) det(I+dt*A) = 1+dt*Tr(A)+O(dt^2). Can the authors give a reference? Also, doesn't the O(dt^2) term accumulate over multiple timesteps or longer rollouts? if so, how can the multiple steps proposed be said to be volume preserving?
[1] - Battaglia, Peter, et al. "Interaction networks for learning about objects, relations and physics." Advances in neural information processing systems. 2016.
[2] - de Avila Belbute-Peres, Filipe, et al. "End-to-end differentiable physics for learning and control." Advances in Neural Information Processing Systems. 2018.
[3] - Santoro, Adam, et al. "A simple neural network module for relational reasoning." Advances in neural information processing systems. 2017.
[4] - Fraccaro, Marco, et al. "A disentangled recognition and nonlinear dynamics model for unsupervised learning." Advances in Neural Information Processing Systems. 2017.


Voice Conversion (VC) is a task of converting perceived speaker identity from a source speaker to a particular target speaker. The earlier approaches in the literature primarily find a mapping between the given source-target speaker-pairs. Developing mapping techniques for many-to-many VC using non-parallel data, including zero-shot learning, remains less explored areas in VC. Most of the many-to-many VC architectures require training data from all the target speakers for whom we want to convert the voices. In this paper, we propose a novel style transfer architecture, which can also be extended to generate voices even for target speakers whose data were not used in training (i.e., case of zero-shot learning). In particular, we propose Adaptive Generative Adversarial Network (AdaGAN), new architectural training procedure that helps in learning normalized speaker-independent latent representation, which will be used to generate speech with different speaking styles in the context of VC. We compare our results with the state-of-the-art StarGAN-VC architecture. In particular, the Ada-GAN achieves 31.73%, and 10.37% relative improvement compared to the Star-GAN in MOS tests for speech quality and speaker similarity, respectively. The key strength of the proposed architectures is that it yields these results with less computational complexity. AdaGAN is 88.6% less complex than StarGAN-VC in terms of FLoating Operation Per Second (FLOPS), and 85.46% less complex in terms of trainable parameters.

This paper presents a voice conversion approach using GANs based on adaptive instance normalization (AdaIN).  The authors give the mathematical formulation of the problem and provide the implementation of the so-called AdaGAN. Experiments are carried out on VCTK and the proposed AdaGAN is compared with StarGAN.  The idea is ok and the concept of using AdaIN for efficient voice conversion is also good.  But the paper has a lot of issues both technically and grammatically, which makes the paper hard to follow.
1. On writing
There are glaring grammar errors in numerous places. e.g.
  -- "Although, there are few GAN-based systems that produced state-of-the-art results for non-parallel VC. Among these algorithms, even fewer can be applied for many-to-many VC task. At last, there is the only system available for zero-shot VC proposed by Qian et al. (2019)."   This is hard to parse.
 -- "helps generator to make ..."  -> "helps the generator make ..."
 --  "let assume" -> "Let's assume"
 --  "We know that the idea of transitivity as a way to regularize structured data has a long history."   what does it mean?
 --  "the generator of AdaGAN is consists of Encoder and Decoder."  -> "consist of"
 -- "After training of AdaGAN for large number of iteration of $\tau$ , where theoretically $\tau \rightarrow \infty$." where is the second half of the sentence?
2.  On math notation
 The math notation is messy and there are lots of inaccuracies.  e.g.
  --  $X_{i} \in p_{X}(\cdot|Z_{i},U_{i})$ should be $X_{i} \sim p_{X}(\cdot|Z_{i},U_{i})$
  --  "generate the distribution denoted by $\hat{X}_{Z_{1}\rightarrow Z_{2}}$"  -> why  $\hat{X}_{Z_{1}\rightarrow Z_{2}}$ becomes a distribution?
  --  "$p_{N}(\cdot|Z_{1},U_{1})$, $p_{N}(\cdot|Z_{2},U_{1})$" in Eq.14,  $N$ should be replaced by the random variable.
  --  $S'_{X}$ and $S'_{Y}$ should be $S_{X'}$ and $S_{Y'}$ in line 15 in the algorithm
3. On technical details:
 -- In Fig.1 (b), why is there only one input to the discriminator?  How do you inject the adversarial samples and how do you generate adversarial samples?
-- In section 4.4, "in encoder and decoder all layers are Linear layers".  Are you referring to fully-connected layers? Linear layers are usually referred to those with linear activation functions.
-- The experiments are claimed to be zero-shot, but 3-5s of speech is required.  can you explain?
Although the samples sound OK, given its current form, the paper needs significant re-work.
P.S. rebuttal read.   I will stay with my score.


Recent work in adversarial machine learning started to focus on the visual perception in autonomous driving and studied Adversarial Examples (AEs) for object detection models. However, in such visual perception pipeline the detected objects must also be tracked, in a process called Multiple Object Tracking (MOT), to build the moving trajectories of surrounding obstacles. Since MOT is designed to be robust against errors in object detection, it poses a general challenge to existing attack techniques that blindly target objection detection: we find that a success rate of over 98% is needed for them to actually affect the tracking results, a requirement that no existing attack technique can satisfy. In this paper, we are the first to study adversarial machine learning attacks against the complete visual perception pipeline in autonomous driving, and discover a novel attack technique, tracker hijacking, that can effectively fool MOT using AEs on object detection. Using our technique, successful AEs on as few as one single frame can move an existing object in to or out of the headway of an autonomous vehicle to cause potential safety hazards. We perform evaluation using the Berkeley Deep Drive dataset and find that on average when 3 frames are attacked, our attack can have a nearly 100% success rate while attacks that blindly target object detection only have up to 25%.

This paper is about conducting evasion attacks against Multiple Object Tracking (MOT) techniques. Compared to existing work on adversarial examples against object detection, to attack MOT techniques, the adversary needs to successfully fool multiple frames, and the authors show that by naively using existing attack approaches, the adversary needs to achieve 98% single-frame attack success rate to fool the tracking system, which is too hard for existing attack algorithms.  Therefore, this paper proposes a smart way of attacking MOT techniques by leveraging the properties of the tracking algorithm. In particular, they generate adversarial perturbations to remove the original bounding box while adding a fake bounding box that has some overlap with the original bounding box, so that the system will compute the movement of the object in a wrong way. They evaluate on videos in Berkeley Deep Drive dataset, and show that by attacking 2~3 frames, they can achieve nearly 100% attack success rate, while the attack success rate is only 25% if the tracking algorithm is not considered when crafting the attacks.
There has been a long line of work studying adversarial attacks against autonomous driving systems, which aims at revealing the security threat of such attacks in the real world. While the community has made promising progress, to my best knowledge, this paper is the first work considering attacking MOT techniques, and they suggest the importance of this attack scenario by demonstrating that attacking objection detection alone is not sufficient in terms of fooling the tracking technique. Meanwhile, the proposed attack method is interesting and effective, even if the perturbation is only bounded in a patch located at a reasonable place in the frame, e.g., the target car to attack.  Therefore, I lean towards accepting this paper, as it contributes to a new perspective of adversarial attacks.
However, I have some questions about evaluation.
1. To generate adversarial frames for the trajectory of the same car, is the adversarial patch inserted since the first frame and always stays the same, or different patches are needed to attack different frames of the same trajectory? I feel that if the adversarial patch needs to change a lot in the entire trajectory, then the practicality of the attack would be compromised.
2. How large does the adversarial patch need to be in order to successfully launch the attacks? And does the position of the patch affect the attack performance?
3. I wonder if the same adversarial patch may work beyond a single context, i.e., with the same patch, the same car can fool the tracking technique with different background scenes. I am not familiar with the details of the dataset in their evaluation, but it would be helpful to show relevant results if it is easy to simulate using their dataset.
------------
Post-rebuttal comments
I thank the authors for their response, and I keep my original assessment.
------------


While deep neural networks have achieved impressive performance on a range of NLP tasks, these data-hungry models heavily rely on labeled data. To make the most of each example, previous work has introduced natural language (NL) explanations to serve as supplements to mere labels. Such NL explanations can provide sufficient domain knowledge for generating more labeled data over new instances, while the annotation time only doubles. However, directly applying the NL explanations for augmenting model learning encounters two challenges. First, NL explanations are unstructured and inherently compositional, which asks for a modularized model to represent their semantics. Second, NL explanations often have large numbers of linguistic variants, resulting in low recall and limited generalization ability when applied to unlabeled data. In this paper, we propose a novel Neural Modular Execution Tree (NMET) framework for augmenting sequence classification with NL explanations. First, we transform NL explanations into executable logical forms using a semantic parser. NMET then employs a neural module network architecture to generalize the different types of actions (specified by the logical forms) for labeling data instances and accumulates the results with soft logic, which substantially increases the coverage of each NL explanation. Experiments on two NLP tasks, relation extraction, and sentiment analysis, demonstrate its superiority over baseline methods by leveraging NL explanation. Its extension to multi-hop question answering achieves performance gain with light annotation effort. Also, NMET achieves much better performance compared to traditional label-only supervised models in the same annotation time.

One recent work that comes to mind from ACL 2019: Leveraging Language Models for Commonsense Reasoning (Rajani et al 2019). In that work, they also have human annotators provide explanations (extending the CommonsenseQA dataset), and they show that by training with these explanations, inference is improved even without them. They also train a language model to generate the explanations, and they show that the language model generated explanations improve performance further at inference time. Seems like a reasonable reference to contrast the more structured approach to using explanations like Srivasta et al (2017), Hancock et al (2018), and this work.
I find the method summary beginning with "Human explanations are first converted to machine-actionable logical forms by a semantic parser" until the end of that paragraph to be unnecessary. Actually, as I read it, I find myself asking a lot of questions that get answered below. So I would prefer scrapping that method summary and just getting straight into the Explanation Parsing.
"indicates the the logical form matches" redundant 'the'
I can't find a definition for LF(E) anywhere, and yet LF(E) is present in many tables. I see that E is mentioned to be the explanations, but this is only in the caption of Table 2 even though the symbol is first used in the first paragraph of Section 4.1. I'm assuming LF logical forms applied directly to explanations, but this should be stated explicitly. Can you elaborate on why it is so dominant on precision In Table 6 and 7 of the Appendix, but low on recall, rather than just saying this is expected in Section 4.1?
"For keyword query q, we directly encode it into vector z_q by bi-LSTM and attention." Can you elaborate on how z_q is constructed? Is it the final state of a forward LSTM concatenated with the final state of a backward LSTM?
Why is it so essential that you study the setting in which explanations are low-resource? I'm curious to see what would happen with more explanations.
I am surprised that none of the modules or compared methods include any architecture that use a Transformer or a form of contextualized word vectors (McCann et al 2017, Peters et al 2017, Devlin et al 2018). Is there an explanation for this?
I would prefer to see a larger suite of tested tasks given that each of these datasets is quite small. Would any other tasks from benchmarks like GLUE or SuperGLUE be amenable to your approach? The tasks you've chosen limit the scope of this work and leaves the question of whether it would generally improve across a greater variety of tasks, especially tasks that have seen significant improvement using new methods. Your claim would be much stronger if the explanations were shown to be helpful even to pretrained models like BERT when fine-tuned for a specific task. In particular, it would be interesting to see how the benefits of explanations vary for different kinds of tasks and for different training set sizes.
"In the real world, a more realistic problem is that, with limited human-power, should we just annotate more labels or spend time explaining existing annotations."" I think that you mean "should we" makes it sound like this is a question, but there is no question mark, and it makes more sense as a statement. I propose "...human-power, there is a question of whether it is more valuable to ..."
"Explanations prove to be an very efficient form for data annotation." should be "a very" not "an very".
" a vital rule" should be "a vital role"
I find the first paragraph of Section 4.3 quite abstruse and bare in its explanation of the method used.