Cooperative Learning of Audio and Video Models from Self-Supervised Synchronization
There is a natural correlation between the visual and auditive elements of a video. In this work we leverage this connection to learn general and effective models for both audio and video analysis from self-supervised temporal synchronization. We demonstrate that a calibrated curriculum learning scheme, a careful choice of negative examples, and the use of a contrastive loss are critical ingredients to obtain powerful multi-sensory representations from models optimized to discern temporal synchronization of audio-video pairs. Without further finetuning, the resulting audio features achieve performance superior or comparable to the state-of-the-art on established audio classification benchmarks (DCASE2014 and ESC-50). At the same time, our visual subnet provides a very effective initialization to improve the accuracy of video-based action recognition models: compared to learning from scratch, our self-supervised pretraining yields a remarkable gain of +19.9% in action recognition accuracy on UCF101 and a boost of +17.7% on HMDB51.

The authors propose self-supervised learning of audio and video features, by means of a curriculum learning setup. In particular, a deep neural network is trained with a contrastive loss function; generating as large feature distances as possible when the video and audio fragment are out of sync, while generating as small distances as possible when they are in sync. The proposed self-supervised learning scheme gives good results for downstream processing, e.g., improving over pure supervised training from scratch.  In general, I think this work is highly interesting, since it may significantly reduce the need for manually labelled data sets, and hence may be of significant impact on video & audio processing algorithms.  I also think the work is original, although this is not very easy to determine exactly. For instance, the authors mention a very similar paper only in line 258, ref [34]. There may be a clear reason for this: [34] has been published on the Arxiv only in April 2018, so I guess the most likely scenario is that the authors found out about this parallel work very late. I would advise the authors in a revised version though, to mention this work higher up in the paper, perhaps moving the whole related work section there. Still, as the authors claim, the difference with [34] seems to lie in harder examples that are provided in a curriculum learning scheme and hence better results.  The authors make an important point that self-supervised learning in pre-training may lead to improved results (further approaching fully supervised learning results), when a bigger training set is given. Now this seems to be supported by results in Table 3, where a higher number of auxiliary samples leads to a higher performance. Still, in this case, the number of samples is not the only difference, it is also the type of dataset. It would be interesting to also see results for different numbers of examples from the same set.   There is a result, which I believe to be interesting, but which I think strictly speaking requires more evidence. In Table 3 the results of the "AVTS features" are mentioned. However, it would be good to compare it with another approach that directly applies an SVM to a hidden layer. How good does the SVM work if the activations are taken of a randomly initialized network? This could quantify how much the self-supervised learning improves the features for this task.  In summary, a very nice paper that in my eyes should be accepted. Some additional smaller remarks can be found below that aim to further improve the clarity.  -----  1. Line 138 : "but the objective was also difficult to optimize." Can you specify   what you mean with this? Did learning not converge in that case? 2. Line 141: you say that it led to better results in every quantitative aspec, also   the "feature quality". How was this quality determined, i.e., to what results are   you then referring? The SVM ones? 3. The main thing not clear to me for the neural network, is how the initial   convolution is done with the N stacked video frames. Is the 3D convolution over all   stacked frames together? Then again, the filter is described with 3x7x7, which would   suggest that it only goes 3 deep. It is probably described in [19], but I think it   would be good to clearly explain it also in this article. 4. Some of the results discussed in 202-207 do not seem to be in table 1. 5. Figure 3 is interesting, although it seems to mostly just take optic flow into   account. Still, it does not seem to be referred to, nor discussed in the text.  6. Autoencoders in my eyes also use self-supervised learning, as the supervised   targets are self-provided.   7. "in synch" -> "in sync" 8. "One may be argued" -> "One may argue"


A Practical Algorithm for Distributed Clustering and Outlier Detection *
We study the classic k-means/median clustering, which are fundamental problems in unsupervised learning, in the setting where data are partitioned across multiple sites, and where we are allowed to discard a small portion of the data by labeling them as outliers. We propose a simple approach based on constructing small summary for the original dataset. The proposed method is time and communication efficient, has good approximation guarantees, and can identify the global outliers effectively. To the best of our knowledge, this is the first practical algorithm with theoretical guarantees for distributed clustering with outliers. Our experiments on both real and synthetic data have demonstrated the clear superiority of our algorithm against all the baseline algorithms in almost all metrics.

The paper considers the problem of computing a weighted summary for the k-means problem with outliers, in order to use this summary in a distributed setting.  The algorithm is a variation of an approximation algorithm by Mettu and Plaxton (without outliers). The idea is: Iteratively, sample points, assign every point to its closest sample point, and then cut out a ball with the closest points around every sample point. The points that are "cut out" are then represented by their closest sample point and deleted. This is repeated until there are only very few points left. The adaptation considered in the paper for the outlier case is that the algorithm is stopped earlier, namely, when there are only 8*t points left (t being the number of outliers). These are then represented by themselves. The final coreset size is O(k log n + t), where the log n-term stems from the fact that in every round, log n points are sampled, and the t is from the last 8t points which are added to the summary. The algorithm is slightly improved for the case that t is much larger than k, which seems like a reasonable assumption.  The paper experimentally compares the resulting algorithm to using k-means++ to construct a summary (k-means++ sampling, used to find O(k+t) samples, can also be used to get a O(1)-summary for k-means with outliers), and to kmeans||, again a k-means algorithm run with k'=O(k+t). The summaries are then clustered by using k-means-- to obtain a final solution (for all three approaches).   Question: What does the sentence "ball-grow outperforms k-means++ and k-means|| in almost all metrics" mean? I do not find the entry where it does not outperform the others.  My evaluation of this paper is two-fold. While in my opinion there are a couple of issues with the theoretical presentation of this work, the experiments look very good. I particularly like the evaluation with respect to actual outlier recognition. Still, for me there is a question mark on how this compares to adaptations of better k-means streaming algorithms (see below). Thus, I pick my initial vote to be weak accept.  (+) The experimental results look great. The loss is smaller, but in particular, the outlier detection works much better. I like how the data set was constructed; this makes sense and gives a reasonable test case. I assume that "rand" was included to prove that there is need for a better method; rand is a really bad method for this and does indeed perform badly. But also k-means++ performs surprisingly bad.  (-) The related work section does not cover works on coresets for k-means and streaming k-means algorithms, which would set this paper's contribution into perspective. (see below). (-) Comparison with coreset-based algorithms: A coreset for k-means is a weighted summary which approximates the cost of any possible solution within a factor of epsilon. It can thus be used to compute a PTAS (for constant k or d), and also to compute O(1)-approximations. For k-means it is possible to construct a coreset of size O(k*d*eps^(-4)), see [1], the size for k-median is even lower. And coresets have one additional benefit: Since the error can be made arbitrarily small, it is possible to embedd them into a merge-and-reduce framework, which transforms them into streaming algorithms. These are then very fast and do not need random access any more!  The construction in this paper, however, needs random access. While uniform sampling is easy and requires no extra computation (compared to, e.g., the sampling in k-means++, which needs a lot of precomputation), it needs time and in particular random access to cut out the balls around all sampled points. And, since the guarantee here is only O(1), merge and reduce will not compute a very good summary.  (-) Comparison to streaming k-means algorithms: There are two types of these algorithms. First, there are coreset-inspired streaming algorithms. These are not mentioned in the paper at all. Second, there are streaming algorithms that are inspired by online facility location algorithms. Most relevant here is probably [2]. These methods are typically faster and need a size around O(k log n), but only provide a O(1) guarantee, like this paper. So for me, a natural question would be whether those methods could be extended to outliers. Again, the advantage of that would be that there is no need for random access. (-) It would be nice to have some justification for the choice of k-means--, which, as far as I can see, has no guarantee at all. Since there is the paper [3] which apparently implemented a constant factor approximation for k-means with outliers, one wonders if that would give more stable / informative information. I gather that k-means-- is probably a fair bit faster, yet it is unclear to me how high the variance of this algorithm is. For standard k-means, classical Lloyd is much more unreliable than k-means++, and I believe that k-means-- is simply a Lloyd variant for k-means with outliers?  [1] Feldman, Langberg: A Unified Framework for Approximating and Clustering Data, STOC 2011, https://arxiv.org/abs/1106.1379  [2] Shindler, Wong, Meyerson: Fast and Accurate k-means For Large Datasets, NIPS 2011, www-bcf.usc.edu/~shindler/papers/FastKMeans_nips11.pdf.  [3] Gupta, Kumar, Lu, Moseley, Vassilvitskii: Local Search Methods for k-Means with Outliers, PVLDB 2017.  Edit after author feedback: The response is convincing to me. I still think that comparing to (non-outlier) work on coresets and streaming sets this paper into perspective, but I understand the points that are risen in the feedback. I thus increase my score to 7.


Wasserstein Distributionally Robust Kalman Filtering
We study a distributionally robust mean square error estimation problem over a nonconvex Wasserstein ambiguity set containing only normal distributions. We show that the optimal estimator and the least favorable distribution form a Nash equilibrium. Despite the non-convex nature of the ambiguity set, we prove that the estimation problem is equivalent to a tractable convex program. We further devise a Frank-Wolfe algorithm for this convex program whose direction-searching subproblem can be solved in a quasi-closed form. Using these ingredients, we introduce a distributionally robust Kalman filter that hedges against model risk.

Update: I have read the authors' response with interest; they have addressed most of my comments well. Regarding comment (2), I do not not see why one would need a formula for the Wasserstein distance between normal and arbitrary non-normal distributions. For any distribution Q, a normal distribution that has the same first and second moments as Q must be closer than Q to the nominal distribution in Wasserstein distance, as there exists a joint Gaussian distribution with the same second moment as the joint distribution attaining the Wasserstein distance between Q and the nominal distribution. Since a normal distribution with the same first and second moments will have linear estimation error identical to that of Q, this shows we may restrict our attention to normal distributions in the uncertainty set.  ---  The authors study robust estimation with a mean squared-error objective and uncertainty set defined by the Wasserstein distance with respect to a quadratic cost function. They show how to find the robust estimator by solving a convex program, give a Frank-Wolfe method for solving the program, and prove convergence guarantees for the method. Based on these developments, the authors propose a robust variant of the Kalman filter.   In my opinion this is a very good paper that contributes substantially to our knowledge on distributionally robust optimization with Wasserstein uncertainty, in which there seems to be fairly widespread interest among the NIPS community. As such, I am strongly in favor of accepting this paper.  Below I list some comments and suggestions regarding the paper.  1) While your proposal of a robust Kalman filter is quite appealing, I do not think it merits the title "minimax", that you attribute to it in the abstract and throughout the paper. To the best of my understanding the derivation of your filter is heuristic and meant to combine your robust MSE estimation formulation with the efficient recursive structure of the classical Kalman filter. As such, there is no uncertainty set for which the proposed filter minimizes the error of the worst-case instance, and therefore it is not "minimax". Please clarify this point.  2) In Section 2 you consider minimax estimators in the set of all measurable functions of y, and a nonconvex uncertainty set consisting of a Wasserstein ball restricted to  Gaussian distributions. This seems to give exactly the same result as restricting the set of estimators to affine functions of y, and letting the uncertainty set be simply the Wasserstein ball (considering all distributions). While equivalent, I believe the latter framing is better, as it makes Theorem 2.3 immediate from standard convex-concave optimization results, and it makes the proof of Theorem 2.5 substantially simpler. At the very least, the paper should comment on this alternative formulation.  3) It would be good if you could provide some additional illustration and discussion of what the worst case covariance S^* looks like. A natural test case is Wiener filtering (y = x + n, with n, x independent) - does the worst-case covariance maintain the independent noise structure? Does it have stronger noise, different input covariance, or both? It will be interesting to compare the result to robust Wiener filters with other uncertainty measures (see comment 5 below).   4) A straightforward approach to robust Kalman filtering is to treat estimation of x_t from Y_t simply as a linear estimation problem, and solve it with exactly the same robust formulation you develop in Sections 2 and 3. While far less computationally efficient than the robust filter you propose, this approach has the advantage of actually being minimax in some clear sense. As you seem to be able to run Algorithm 2 with d in the hundreds, it will be interesting to evaluate the simple approach described for the low dimensional test case considered in Section 5.2, and compare it to the proposed method.  5) The paper is missing some references on robust MSE estimation, which has been studied for many years; see "A competitive minimax approach to robust estimation of random parameters" by Eldar and Merhav (2004) and the references therein. These works consider various uncertainty sets for the input covariance, and can therefore be viewed as distributionally robust formulations. The authors might also consider citing more of the recent literature on Wasserstein-distributionally robust optimization, such as Sinha et al. (2018) and Blanchet et al. (2016).  Addressing the issues above above will, in my opinion, turn your paper from very good to excellent.  Below are a few additional minor comments:  - In line 108, replace "efficient" with a more conservative adjective, such as "tractable".  - \bar{sigma} is only defined after Algorithm 2 is stated, which is confusing; it should instead be an input to the algorithm.  - Using MMSE for "minimax mean squared error" (Section 5.1) is confusing, since MMSE is a commonly-used acronym for "minimum mean squared error". Consider using MMMSE or M3SE instead.  - In lines 222-225, \Delta and \Delta^\star appear to be used interchangeably.  - In line 97 of the Supplementary Material, I believe it should be Theorem 3.3 rather than Theorem 2.5.


Deep Neural Networks with Box Convolutions
Box filters computed using integral images have been part of the computer vision toolset for a long time. Here, we show that a convolutional layer that computes box filter responses in a sliding manner can be used within deep architectures, whereas the dimensions and the offsets of the sliding boxes in such a layer can be learned as a part of an end-to-end loss minimization. Crucially, the training process can make the size of the boxes in such a layer arbitrarily large without incurring extra computational cost and without the need to increase the number of learnable parameters. Due to its ability to integrate information over large boxes, the new layer facilitates long-range propagation of information and leads to the efficient increase of the receptive fields of network units. By incorporating the new layer into existing architectures for semantic segmentation, we are able to achieve both the increase in segmentation accuracy as well as the decrease in the computational cost and the number of learnable parameters.

This paper present a method to compute convolutions with filters of any size with a fixed computational cost by using the integral image trick as in Viola-Jones detector [30]. This method is used to create a box convolution layer, that is a layer in which every filter is a set of boxes (one per channel) whose position and size are learnable parameters. This layer is used in a new block (Fig. 1) that is then used to replace standard dilated convolution blocks in ENet and ERFNet architectures. Due to the larger receptive field and fewer parameters of the proposed layer, the modified architectures obtain better performance than the original ones.  Pros: - The idea of using integral image for convolutions and learn the filter size and position is new in my knowledge and seems to make sense when we want to read a broad proportion of the image without relying on several convutional layers. - The reported experiments seem to show that for the specific problem this box convolution makes sense and performs better than other approaches.  Cons: - It seems that the authors did not mention (or not fully explain) certain important aspects of the approach such as:  i) the computational cost of reading a value is 4 times more than what it would be in a normal convolution due to the integral image trick (plus the time needed to pre-compute the integrals)  ii) the computational time of the full approach is then reduced because instead of using 3x3 filters, they read just average boxes and they reduce the number for channels by a factor 4 with 1x1 convolution  iii) at test time, when the computational cost is actually evaluated, the authors avoid to compute the float value of the boxes (which is needed in training for learning the parameters); thus training is expected to be computationally more expensive. - I would have liked to see the idea implemented for a full comparison with a learnable convolutional filter, i.e. instead of single boxes, learn 3x3 learnable size filters and use them as a basic convolutional block. Of course, this would incur in a much higher computational cost (compared to the standard 3x3 filter), but probably also much better results. - In the experiments the places in which some blocks have been substituted by the proposed block seem a bit ad-hoc and one might consider that it is optimized to obtain the best performance gap.   Additional comments: - l.179: it is not clear to me why the 1x1 convolution has a complexity of O(N^2) while the box convolution of only O(N). In my understanding the box convolution has N/4 inputs and N outputs, thus O(N^2) operations per spatial location. - The block in Fig.1 in my understanding is composed of a 1x1 convolution and the box convolution, which can be also considered 1x1 in the sense that there is a box for each channel (in my understanding). Thus, the complete block lack of spatial evaluations within channel (in the sense of 3x3 convolutions that can evaluate nearby pixels in the same channel). This might not be a problem for the given task, but it might be problematic for more difficult problems. This problem can also be compensated by the fact that the position of the box can be learned. Authors should consider to present this kind of reasoning about the approach and propose some experiments to better understand it.  - The symmetry of the boxes in Fig. 2 can be due to the use of the horizontal flip of the training images for data augmentation?   After rebuttal: I read the authors rebuttal and I think they managed to give an explanation to most of my concerns. In this sense I think the paper deserves publication. Still, I think it should be important to clarify that using the integral image trick makes the computation of the convolution much more expensive, but allows any size filter with the same computational cost. In this paper the proposed models are computationally cheaper because the proposed layers (based on integral image) are reduced convolutions, with spatial filters of WxHxC of 1x1x1.


Teaching Inverse Reinforcement Learners via Features and Demonstrations
Learning near-optimal behaviour from an expert's demonstrations typically relies on the assumption that the learner knows the features that the true reward function depends on. In this paper, we study the problem of learning from demonstrations in the setting where this is not the case, i.e., where there is a mismatch between the worldviews of the learner and the expert. We introduce a natural quantity, the teaching risk, which measures the potential suboptimality of policies that look optimal to the learner in this setting. We show that bounds on the teaching risk guarantee that the learner is able to find a near-optimal policy using standard algorithms based on inverse reinforcement learning. Based on these findings, we suggest a teaching scheme in which the expert can decrease the teaching risk by updating the learner's worldview, and thus ultimately enable her to find a near-optimal policy.

After response:  The authors' response helped clarify the computability of the risk metric for me. More experiments and discussion would improve the paper but after reading the response and other reviews I am raising my score.  *****************************  This paper introduces the problem of feature mismatch between a learner and teacher in the inverse RL problem (IRL). The problem is that if the learner and teacher represent the reward with different features than the learner may not be able to learn the teacher's reward function and thus perform suboptimally if it attempts to learn by matching feature counts. The paper quantifies this problem by defining the "teaching risk" and demonstrates that minimizing this quantity can improve learner performance. An algorithm is introduced that uses this quantity to select new features for the learner to use and it is shown to empirically lead to the learner being able to learn with less features than other baselines.  This paper presents an interesting problem that is likely to happen in real world applications of IRL. Furthermore, quantifying this problem in a way that corresponds to performance loss is interesting and is shown to be useful (though I have some questions about computability). To the best of my knowledge, this paper is the first to study this problem in the IRL setting and opens up an interesting direction for future research. My main concern with the paper is that it lacks clarity in some places (see below) and has little discussion of results or future work. Overall, I lean towards not accepting this paper but think it could be a stronger submission with appropriate revision.  My main technical concern is the computability of the teaching risk. Is the teaching risk computable in practice or is it just theoretically interesting? IRL is usually motivated by situations where w* is unknown but computing \rho seems to require w*. If w* is unknown, how can we compute the teaching risk in practice?  In terms of clarity, the paper relies on figures to make several of its key points. However, the description of the figures is only contained in the main text. The figures should have a complete description of their content (preferably in the caption). Right now the description is interspersed with remarks on what they demonstrate. It should be clear what is being shown before the reader is asked to accept conclusions about what they show.  In my opinion, figures 1, 2, and 3 don't illustrate much. It would be helpful for Figure 3 if the figure was described instead of simply saying, "Figure 3 shows why proposition 1 is true."  Where possible, it would help to see intuition before equations. For example, in "Basic Teaching Strategy" (lines 123-128) it would be useful to have the description of (1) before (1).   The paper lacks any discussion of future work and has only limited discussion of the empirical results. Since the paper is proposing a new problem, it would be good to have the paper also outline what the next steps are in addressing the problem.  Minor comments: 18: an reinforcement -> a reinforcement 62: recently been recently 67: have -> has if using citation number instead of names. Citations: Using numbers in place of names means the reader has to constantly turn to the references section. Saying "Name et al." is easier on the reader. 172: is vanishes -> vanishes 179 (and elsewhere): garantee -> guarantee 187 (and elsewhere): the use of "resp." is sometimes hard to parse what is being referred to. 283: better a -> better than a 273: optiaml -> optimal Supplementary material: It would be useful to have some section headers bolded. Line 140: policies pi_0, pi_1 have not been introduced at this point. Line 148: Is something missing in the definition of ker A^L


Gaussian Process Prior Variational Autoencoders
Variational autoencoders (VAE) are a powerful and widely-used class of models to learn complex data distributions in an unsupervised fashion. One important limitation of VAEs is the prior assumption that latent sample representations are independent and identically distributed. However, for many important datasets, such as time-series of images, this assumption is too strong: accounting for covariances between samples, such as those in time, can yield to a more appropriate model specification and improve performance in downstream tasks. In this work, we introduce a new model, the Gaussian Process (GP) Prior Variational Autoencoder (GPPVAE), to specifically address this issue. The GPPVAE aims to combine the power of VAEs with the ability to model correlations afforded by GP priors. To achieve efficient inference in this new class of models, we leverage structure in the covariance matrix, and introduce a new stochastic backpropagation strategy that allows for computing stochastic gradients in a distributed and low-memory fashion. We show that our method outperforms conditional VAEs (CVAEs) and an adaptation of standard VAEs in two image data applications.
image sequences from multiple patients. Therefore, the VAE prior should be able to capture multiple levels of correlations at once, including time, object identities, etc. A natural solution to this problem is to replace the VAE iid prior over the latent space with a Gaussian Process (GP) prior (Rasmussen, 2004), which enables the specification of sample correlations through a kernel function (Durrande et al., 2011;Gönen and Alpaydın, 2011;Wilson and Adams, 2013;Wilson et al., 2016;Rakitsch et al., 2013;Bonilla et al., 2007). GPs are often amenable to exact inference, and a large body of work in making computationally challenging GP-based models tractable can be leveraged (GPs naively scale cubically in the number of samples) (Gal et al., 2014;Bauer et al., 2016;Hensman et al., 2013;Csató and Opper, 2002;Quiñonero-Candela and Rasmussen, 2005;Titsias, 2009).
In this work, we introduce the Gaussian Process Prior Variational Autoencoder (GPPVAE), an extension of the VAE latent variable model where correlation between samples is modeled through a GP prior on the latent encodings. The introduction of the GP prior, however, introduces two main computational challenges. First, naive computations with the GP prior have cubic complexity in the number of samples, which is impractical in most applications. To mitigate this problem one can leverage several tactics commonly used in the GP literature, including the use of pseudo-inputs (Csató and Opper, 2002;Gal et al., 2014;Hensman et al., 2013;Quiñonero-Candela and Rasmussen, 2005;Titsias, 2009), Kronecker-factorized covariances (Casale et al., 2017;Stegle et al., 2011;Rakitsch et al., 2013), and low rank structures (Casale et al., 2015;Lawrence, 2005). Specifically, in the instantiations of GPPVAE considered in this paper, we focus on low-rank factorizations of the covariance matrix. A second challenge is that the iid assumption which guarantees unbiasedness of mini-batch gradient estimates (used to train standard VAEs) no longer holds due to the GP prior. Thus mini-batch GD is no longer applicable. However, for the applications we are interested in, comprising sequences of large-scale images, it is critical from a practical standpoint to avoid processing all samples simultaneously; we require a procedure that is both low in memory use and yields fast inference. Thus, we propose a new scheme for gradient descent that enables Monte Carlo gradient estimates in a distributable and memory-efficient fashion. This is achieved by exploiting the fact that sample correlations are only modeled in the latent (low-dimensional) space, whereas high-dimensional representations are independent when conditioning on the latent ones.
In the next sections we (i) discuss our model in the context of related work, (ii) formally develop the model and the associated inference procedure, (iii) compare GPPVAE with alternative models in empirical settings, demonstrating the advantages of our approach.

In this manuscript the authors propose a method for introducing auxiliary information regarding object 'view' (i.e., information ancillary to the class 'label') into the method of (Bayesian) variational autoencoders for object classification.  The challenge here, of course, is not simply writing down an additional layer in the hierarchical structure but in devising an efficient computational implementation, which the authors do achieve (via a low rank GP approximation, Taylor series expansion and sensible memory management).  Overall I find this to be a strong contribution, although I would accept that with respect to the guidelines for authors this could be argued to be more of an 'incremental' extension of an exisiting method rather than a new paradigm in itself.  A minor concern I have regards the presentation of the method: it seems to me that the strength and applicability of this method is more in terms of allowing the introduction of auxiliary information from well-understood transformations of the base objects in a dataset with relatively complete transformation instances for most objects; rather than for more general regularisation such as for potentially heterogeneous datasets including the autonomous driving and perhaps even the medical imaging applications suggested in the introduction.  The reason I say this is because choosing an appropriate kernel over the auxiliary data + object class space requires a degree of 'supervised' understanding of the problem and controlling/learning the low rank representation will be challenging when the data 'design' is sparse.  Likewise, for the range of applications for which a separable kernel is appropriate.  (Related: I do not understand the kernel description in eqn 9: is the x^T x term correct?  I was expecting something more like a distance than a vector length.)  After author feedback: Yes, I understand now to see that these are feature vectors and hence taking the inner product in the feature space for the kernel. Thanks


Attacks Meet Interpretability: Attribute-steered Detection of Adversarial Samples
Adversarial sample attacks perturb benign inputs to induce DNN misbehaviors. Recent research has demonstrated the widespread presence and the devastating consequences of such attacks. Existing defense techniques either assume prior knowledge of specific attacks or may not work well on complex models due to their underlying assumptions. We argue that adversarial sample attacks are deeply entangled with interpretability of DNN models: while classification results on benign inputs can be reasoned based on the human perceptible features/attributes, results on adversarial samples can hardly be explained. Therefore, we propose a novel adversarial sample detection technique for face recognition models, based on interpretability. It features a novel bi-directional correspondence inference between attributes and internal neurons to identify neurons critical for individual attributes.
The activation values of critical neurons are enhanced to amplify the reasoning part of the computation and the values of other neurons are weakened to suppress the uninterpretable part. The classification results after such transformation are compared with those of the original model to detect adversaries. Results show that our technique can achieve 94% detection accuracy for 7 different kinds of attacks with 9.91% false positives on benign inputs. In contrast, a state-of-the-art feature squeezing technique can only achieve 55% accuracy with 23.3% false positives.

In this paper the authors examine the intuition that interpretability to be the workhorse in detecting adversarial examples of different kinds. That is, if the humanly interpretable attributes are all the same for two images, then the prediction result should only be different if some non-interpretable neurons behave differently. Other than adversarial examples, this work is also highly related to interpretability and explainability questions for DNNs.  The basis of their detection mechanism (AmI) lies in determining the sets of neurons (they call attribute witnesses) that are correspond (one-to-one) to a humanly interpretable attributes (like eyeglasses). That means, if the attribute does not change, the neuron should not give a different output, and the other way around if the feature changes, the neuron should change. Previously, given a neuron, people looked at a region with triggers the neuron the most (i.e. the latter). Authors argue that the former is also important and show that sets of neurons that can be identified uniquely (a subset of the set which satisfies one of the two) give a lower false positive rate. If only the latter criterion is satisfied, the neurons in question could in fact be spuriously correlated with the actual attribute (e.g. a stronger beard may change the color of that region and thus the neurons associated with the latter while it does not carry information about the characteristics of a beard).  After detecting the attribute witnesses, the original trained prediction model is modified to form a new model, in which these attribute witness neurons are strenghtened, the rest is weakened. If a new input receives different predictions from original and new model, it is labeled as adversarial. The rationale behind this detection mechanism is that if the neurons for human interpretable attributes were activated in the original, then after strengthening these attributes and weakening the rest, the prediction result should not change and vice versa.  In experiments on standard face datasets, they show that for binary attribute detection using activations of the attribute-witness neurons (for which an extra binary classifier is trained), their detection accuracy is much higher than just taking the last fully connected layer. This suggests these neurons do indeed carry information about the specific attribute. For adversarial sample detection, the true positive rate is much higher and the false discovery rate is much lower than "feature squeezing", a state-of-the-art technique.  -----------------------------  Comments  The paper is well-written. The aim, setup and contribution are clear. It is a unifying framework to detect adversarial attacks of various kinds. Some of the ideas such as checking consistency, receptive fields of a neuron had already been used by other works before which the authors cite, but the performance gain of identifying sets of "bi-directionally causal" sets of neurons with attributes has not been studied experimentally before. Their idea to use  sounds intuitive and reasonable.   One drawback/weakness of the empirical studies that I see is as follows: The attributes you labeled are just eyes, nose mouth which are locally separated. What would happen if e.g. eyeglasses and beard were to be included (just some more attributes from the CelebA dataset), which overlap? The rationale that adversarial attacks correspond to neurons that cannot be perceived by humans, the number of attributes should include locally-non separated ones. I can see that it would be hard to determine attribute witnesses for this (requiring substitutions and labeling by hand), which is what I would consider a major weakness of the method.    Additionally of course the entire process of finding attribute witness requires very careful design as well as human labor (although it seems a rather small fraction of the dataset was needed for this stage, 10 if I understand correctly) and will highly depend on the domain if the technique were to be used in for other datasets. So another open question is: how do we determine the relevant (human interpretable) attributes for which we need to find the corresponding witnesses so that adversarial attacks can be detected?   Furthermore, it would be nice if the authors could make the code publicly available.  Minor comments:  The minimal overlap between the attribute witnesses suggested by table 3 in the appendix is very interesting. Does that mean there really are neurons responding one attribute? Can you give some details about how the pairwise overlap is? It would also be nice to see attribute detection accuracy for the different AS, AP sets in table 2.  I would avoid the word causality when talking about bi-directionality. I understand what you mean, but some people working in that field might not take it well. It is more of a unique mapping or correspondence between a set of neurons and an attribute. But there is no inherent causality between an input and a neuron in the statistical sense.  ----------------------------  Details:  non-relevant neurons are weakened to "suppress gut feeling" -why is this called gut feeling? The non-human interpretable feature probably will not trigger any "gut" either. For me "gut" is more related to intuition and interpretability than ... Might consider using a slightly different expression.  Why does only strengthening witnesses not work at all for patch and glass attacks? I understand why AS and AP combined will give a lower false positive rate. But for strengthening vs. weakening shouldn't it somewhat "normalize" and only the ratio between witnesses and non-witnesses matter? I'm not quite sure where the asymmetry between weakening and strengthening effects come from.


Probabilistic Model-Agnostic Meta-Learning
Meta-learning for few-shot learning entails acquiring a prior over previous tasks and experiences, such that new tasks be learned from small amounts of data. However, a critical challenge in few-shot learning is task ambiguity: even when a powerful prior can be meta-learned from a large number of prior tasks, a small dataset for a new task can simply be too ambiguous to acquire a single model (e.g., a classifier) for that task that is accurate. In this paper, we propose a probabilistic meta-learning algorithm that can sample models for a new task from a model distribution. Our approach extends model-agnostic meta-learning, which adapts to new tasks via gradient descent, to incorporate a parameter distribution that is trained via a variational lower bound. At meta-test time, our algorithm adapts via a simple procedure that injects noise into gradient descent, and at meta-training time, the model is trained such that this stochastic adaptation procedure produces samples from the approximate model posterior. Our experimental results show that our method can sample plausible classifiers and regressors in ambiguous few-shot learning problems. We also show how reasoning about ambiguity can also be used for downstream active learning problems.

This paper presents an extension to the popular metalearning algorithm MAML, in which it is re-cast as inference in a graphical model.  This framing allows samples to be drawn from a model posterior, enabling reasoning about uncertainty and capturing multiple modes of ambiguous data, while MAML can only make a single point estimate of model parameters at test time.  This is shown in several experiments to better capture the characteristic of ambiguous, noisy data than MAML.  Strengths:  + The paper makes a strong point that few shot learning is often too ambiguous to confine to a single-model metalearning paradigm.  Especially with the high level of recent interest in topics such as safe learning, risk-aware learning, and active learning, this is a relevant area of work.  + The graphical model formulation logically follows from the stated goals of the paper, and the inference methods are built on a solid foundation of well-understood recent advances in variational inference and stochastic optimization and appear to be sound.  + The paper is well-written on the whole and easy to follow.  + The experiments do a nice job at showing intuitively various ways that ProMAML can represent uncertainty -- that it reduces uncertainty as more data is seen, that is can accurately predict uncertainty in a single-shot learning case, and that it captures multiple modes in ambiguous situations.   Weaknesses:  - The primary weakness of the paper is that the benefits of being able to represent and reason about model uncertainty are never shown or explored experimentally.  The experiments do a nice job of showing that uncertainty *can* be represented with some degree of fidelity, but it is never used directly for anything.  The paper hints at applications in active learning, risk-aware learning, etc., but never show any of these experimentally.  Not only would a concrete example make the paper more compelling, but having a more objective downstream success metric would make it much easier to interpret the results in the paper -- for example, in the final experiment, is coverage of 2.62 and accuracy of ~68% good enough?  It depends on the downstream use of the results of ProMAML to answer that question.  The authors' response addressed several of my concerns with the new experiments that were shown, particularly my concerns about a "downstream task" that utilizes the uncertainty measure.


Gen-Oja: A Simple and Efficient Algorithm for Streaming Generalized Eigenvector Computation
In this paper, we study the problems of principal Generalized Eigenvector computation and Canonical Correlation Analysis in the stochastic setting. We propose a simple and efficient algorithm, Gen-Oja, for these problems. We prove the global convergence of our algorithm, borrowing ideas from the theory of fastmixing Markov chains and two-time-scale stochastic approximation, showing that it achieves the optimal rate of convergence. In the process, we develop tools for understanding stochastic processes with Markovian noise which might be of independent interest.

Gen-Oja: A Simple and Efficient Algorithm for Streaming Generalized Eigenvector Computation  Principal Generalized Eigenvector computation and Canonical Correlation Analysis in the stochastic setting.  Propose a simple and efficient algorithm for these problems. Overall the approach appears to be reasonable and is scientific sound. The experimental part is however quite limited - the paper is widely a theoretical proposal and it remains unclear if it is really effective in a practical setting.  The paper is also closely linked to streaming PCA and in parts it is not so clear if there is some strong novelty in this proposal or just a lot of  mathematical wrapping.  comments: - how critical is the i.i.d. condition after Eq. 5 - in my view it is a bit   unlikely to assume that a data stream can be sampled in this way under realistic   conditions - so one may only 'hope' that it holds, or it can be applied only    in some scenaria - as the experiments are very limited the i.i.d. assumption is a key problem and   it is not shown in the experiments that this assumption is not a particular problem - related work is discussed but not much addressed in the experimental part   as outlined in the paper there is a lot related work - but not in your experiments - although the theory looks convincing it would be good to show the effectiveness   also in a number of practical application. Numerical problems are common for such   type of 'approximations' and behind theory the practical results may be different - it may also not harm to add some discussions to practical results (--> in the supplementary material) - I have not checked in detail the supplementary material    --> journal submission?  Comments - to author feedback: - thanks for addressing the comments - some points are clarified - I (now) understand that the authors are focusing on a theoretical improvement   -- I think it would be good to adapt the wording in the paper and maybe also in th title to make this more explicit


3D Steerable CNNs: Learning Rotationally Equivariant Features in Volumetric Data
We present a convolutional network that is equivariant to rigid body motions. The model uses scalar-, vector-, and tensor fields over 3D Euclidean space to represent data, and equivariant convolutions to map between such representations. These SE(3)-equivariant convolutions utilize kernels which are parameterized as a linear combination of a complete steerable kernel basis, which is derived analytically in this paper. We prove that equivariant convolutions are the most general equivariant linear maps between fields over R 3 . Our experimental results confirm the effectiveness of 3D Steerable CNNs for the problem of amino acid propensity prediction and protein structure classification, both of which have inherent SE(3) symmetry.

This paper proposes a convolutional network architecture where filters are defined as a linear combination of steerable kernel basis functions, such that the network is equivariant to rigid body motions.  The paper's strength lie in the novelty of the proposed method for constructing equivariant filter banks from radial basis functions, as well as a novel equivariant nonlinearity.  Unfortunately, the paper has a number of weaknesses that must be addressed for it to be acceptable for publication. First, the related work section should be expanded, since, although the paper cites many papers in the beginning, the section does not sufficiently explain the state of the field, contributions of prior works, and how the proposed method fits in and contributes upon them. Additionally, I suggest the authors reword their sentence on line 45 regarding the timing of a concurrent work, since it should not be a focus of this section.  Secondly, I feel that section 3, which contains the main contributions of this paper, needs significant editing in order to be more clear, concise, and accessible to readers. I feel that certain more obvious preliminaries have been presented in an overly complicated way, introducing terminology that's inconsistent with previous works, or elaborating on the obvious while hurrying over the more complex material. For example, subsections 3.1 and 3.2 especially could be much shorter and to the point since they present very basic and well known fundamentals, whereas 3.3.1 and 3.4 could be explained with more detail and organization. In addition to this issue, while the authors explain properties of fields, transformations, equivariance, or how SO(3) can be decomposed, they do not do enough to tell the story of why these points are important to their overall problem. I would suggest that the authors try to write these sections so that readers can clearly understand the motivations that lead to each next step in the paper, and in such a way that the material is well grounded and more intuitively linked to their problem application.  The authors also often explain particular choices, such as their novel equivariant nonlinearity, or precomputation details, without sufficiently explaining the alternatives or justifying the underlying reason for their decision. Sure, the proposed nonlinearity satisfies their desired criteria, but the authors should explain why and how they arrived at that nonlinearity among the many possible solutions. And what are it's advantages or disadvantages? Did the authors try alternative nonlinearities, which did not perform well in practice? This would be good to know, and similar questions would hold for other implementation details in the paper.  Third, and most importantly, the experimental section of this paper is severely lacking. The first two experiments presented in 4.1 and 4.2 are not extensive or even analyzed in much detail, one experiment showing 100% accuracy on a toy dataset compared to a baseline which by construction will not perform well, and the other showing a modest improvement from 56% to 58% accuracy over a previous method. The authors themselves downplay the importance of these two experiments (e.g. line 268 - 269). This would be fine if followed by a stronger section, but for their third experiment they present an entrirely new dataset (the proposal and design of a new dataset could be an entire section in of itself with more rigorous presentation of the data properties and statistics) and compare against a single baseline and no other methods. The authors show that their method has heigher test accuracy on the new dataset than the baseline with much fewer parameters, but it's not obvious to me that fewer parameters is actually a disadvantage for this new dataset. It's very possible that the baseline is overly expressive for the amount of data available, and even simpler baselines might be more convincing. Most importantly though, the authors should have experiments that compare with contemporary methods to show the proposed methods strengths and weaknesses, as well as more extensive experiments showing the performance of their method under different implementation details.  Overall, the authors presented an interesting new SE(3) equivariant convolutional network, but they need to first strengthen and focus their experimental section, and second work on the presentation and clarity of their method in section 3. Finally, I encourage the authors to elaborate on how their method relates to other recent works, and clearly emphasize the broader significance of their contributions.  -------------------------------------------------------------------- After reading the rebuttal, I would first like to thank the authors for their efforts to address all of the concerns raised in the initial review.  In particular, the described changes and additions to the experimental section have addressed my primary concerns with the original manuscript. The addition of arbitrary rotations to the Tetris experiment, the ShapeNet/Shrec17 experiment, clarifications of other experimental details, and the promised availability of code and dataset tools greatly strengthen the submission. I also appreciate the additional figure illustrating the effect of the number of parameters on performance. It demonstrates the authors' claims are substantiated by thorough experiments,  and also shows interesting details, i.e. the rough order of magnitude of parameters at which the 3D CNN achieves diminishing returns in performance is around 10^5 vs 10^7, which otherwise would not have been known to the reader.  Aside from the experimental section, I thank the authors for expanding their related works section and for their considerations in making the presentation of their method more accessible, and detailing their design decisions. I still think that the authors should take special care to choose accessible terminology, to not invoke complexity for its own sake, and to give appropriate attention to their various preliminaries. I understand that the authors' terminology is consistent with prior works [4] and [6], however I would still argue that the terminology used, even in those works, is not accessible to a broad audience.  For example, readers familiar with spatial transformer networks, capsules, or problems of 2D and 3D point correspondence more generally, may already have a good intuition for transformations of vector fields, but would find terms like "fiber" unfamiliar and unnecessary. Please consider that [4] and [6] are only a sample of the field, and that related works such as Tensor Field Networks [24] use different terminology and cite other related bodies of work, such as PointNet. So, if the authors truly wish to address a broader audience, I would recommend that they consider readers from such perspectives.   Overall, I feel that the authors have addressed many of the concerns raised with the paper's presentation and accessibility. Most importantly, they have strengthened their experimental section significantly, and based on these changes I would now vote for accepting this submission.  Updated Score: 7


Low-rank Interaction with Sparse Additive Effects Model for Large Data Frames
Many applications of machine learning involve the analysis of large data framesmatrices collecting heterogeneous measurements (binary, numerical, counts, etc.) across samples -with missing values. Low-rank models, as studied by Udell  et al. [27], are popular in this framework for tasks such as visualization, clustering and missing value imputation. Yet, available methods with statistical guarantees and efficient optimization do not allow explicit modeling of main additive effects such as row and column, or covariate effects. In this paper, we introduce a lowrank interaction and sparse additive effects (LORIS) model which combines matrix regression on a dictionary and low-rank design, to estimate main effects and interactions simultaneously. We provide statistical guarantees in the form of upper bounds on the estimation error of both components. Then, we introduce a mixed coordinate gradient descent (MCGD) method which provably converges sub-linearly to an optimal solution and is computationally efficient for large scale data sets. We show on simulated and survey data that the method has a clear advantage over current practices.

Summary ------- This paper introduces a new statistical model for matrices of heterogeneous data (data frames) based on the exponential family. The features of this model are: i) modeling additive effects in a sparse way, ii) modeling low-rank interactions. The parameters of this model are then estimated by maximizing the likelihood with sparse and low-rank regularizations. In addition, this work comes with statistical guarantees and optimization convergence guarantees of the proposed algorithm. Numerical experiments concludes the manuscript.  Quality ------- This paper is mathematically rigorous and technically sound. Overall, this is a complete piece of work with theoretical guarantees (concerning the statistical aspect and the convergence of the proposed algorithm) and practical concerns (the estimation procedure is designed for large datasets). These two parts involve complex tools from statistics and optimization that seem completely understood by the authors.  In the problem formulation (Section 2), the Gaussian case assumes known (observed) variance. Isn't that limited? Moreover, there are many hypotheses needed for the statistical guarantees. Is it common? Is it really necessary?  The last section of the paper addresses two numerical experiments. The first one, on a synthetic dataset, honestly shows that the proposed method performs equally to a basic two-step procedure concerning estimating the low-rank parameter, but is beyond concerning the sparse parameter and the computational time (for large datasets). The second numerical experiment compares two versions of the proposed method (mixed effect versus Gaussian) about imputation error on a survey dataset.  In both cases, I find the numerical evaluation quite basic and limited. What about more advanced methods? Previous works? As for me, this is a flaw of this paper (detailed below): the link with the related work is unclear.  Clarity ------- This submission is a readable paper about a subject I am not familiar with. I find it very clear and polished (the only typos I saw is "match" L. 230 and \lambda_1 L. 157).  The authors made a noticeable effort to explain the implications of hypotheses (Section 2). But what about their concrete meaning? For instance, how restrictive is the last part of H1? What about positive definiteness of G in H3? Which distributions satisfy H4?  More importantly, I do not understand the aim of H5 since, by the model, Y_ij are assumed distributed according to an exponential family.  Moreover, Theorem 1 is not very clear to me: does it prove consistency? When \pi goes to 1, one expects the estimators to be consistent, but it is not clear with the proposed bounds.  Some references are missing L. 162 and 213.  Originality ----------- This work is a novel and smart combination of well-known techniques, concerning both statistics and optimization. However, it is not clear how it differs from previous studies. In particular, a section concerning related work is missing (the optimization part is briefly linked to prior work P. 6 but this effort is missing for the statistical part). I agree that the page limitation makes the thing difficult for the authors, yet the link to prior work is needed to assess the paper.  For instance, this submission seems quite supported by [23], but how it is related? Concretely, what is new in the statistical model (3)? This remark also holds for the (statistics and optimization) proofs: are they minor modifications of existing content or original work?  In addition, this lack also holds for the numerical section, where the proposed approach is only compared to either a basic procedure or itself.  Significance ------------ As for me, the work described in this submission is a significant contribution to the field of data frame analysis, both by its statistical and optimization aspects. It deserves publication as soon as the link to the prior work is made clearer and the numerical evaluation is strengthened by competitive advanced methods.  Rebuttal ----------- I have read the rebuttal and I thank the authors for their clear response. The authors agreed to add a "Related work" section, clarifying the link to prior work and originality of the proposed study. They also answered convincingly the reviewers' questions. Consequently, I have upgraded the overall score.


Sanity Checks for Saliency Maps
Saliency methods have emerged as a popular tool to highlight features in an input deemed relevant for the prediction of a learned model. Several saliency methods have been proposed, often guided by visual appeal on image data. In this work, we propose an actionable methodology to evaluate what kinds of explanations a given method can and cannot provide. We find that reliance, solely, on visual assessment can be misleading. Through extensive experiments we show that some existing saliency methods are independent both of the model and of the data generating process. Consequently, methods that fail the proposed tests are inadequate for tasks that are sensitive to either data or model, such as, finding outliers in the data, explaining the relationship between inputs and outputs that the model learned, and debugging the model. We interpret our findings through an analogy with edge detection in images, a technique that requires neither training data nor model. Theory in the case of a linear model and a single-layer convolutional neural network supports our experimental findings 2 .

Summary ---  This paper introduces a new set of criteria for evaluating saliency/heatmap visual explanations of neural net predictions. It evaluates some existing explanation approaches and shows that some of them do not pass these simple tests.  The first test compares explanations of a base model to explanations of the same model with its weights randomly re-initialized. If the same visualization results from both sets of weights then it does not reflect anything the neural net has learned. Similarly, the second test compares a base model to the same model trained with randomly permuted labels. In this case the weights are not randomly initialized, but still cannot contain much information specific to the task (image classification) because the labels were meaningless.  For both tests pairs of visualizations are compared by manual inspection and by computing rank correlation between the two visualizations. Layers are re-initialized starting from the output and moving toward the input, generating an explanation for each additional layer. Techniques including Integrated Gradients, Guided BackProp, and Guided GradCAM produce very similar explanations whether all parameters are random or not. Other techniques (Gradient and GradCAM) drastically change the explanations produced after the first layer is randomized and continue to produce these different and appropriately noisy explanations as more layers are randomized.  The surprising conclusion this work offers is that some methods which attempt to explain neural nets do not significantly change their explanations for some significantly different neural nets. To explain this phenomena it analyzes explanations of a linear model and of a single conv layer, claiming that the conv layer is similar to an edge detector. It also acknowledges that architectural priors play a significant role in the performance of conv nets and that random features are not trivial.  Strengths ---  I buy the basic idea behind the approach. I think this is a good principle to use for evaluating saliency style visual explanations, although it doesn't act as an ultimate form of quality, just potentially useful initial sanity checks. The criteria has clarity that other approaches to saliency evaluation lack.  Overall, the set of experiments is fairly large.  Weaknesses ---       None of these weaknesses stand out as major and they are not ordered by importance.  * Role of and relation to human judgement: Visual explanations are useless if humans do not interpret them correctly (see framework in [1]). This point is largely ignored by other saliency papers, but I would like to see it addressed (at least in brief) more often. What conclusions are humans supposed to make using these explanations? How can we be confident that users will draw correct conclusions and not incorrect ones? Do the proposed sanity checks help identify explanation methods which are more human friendly? Even if the answer to the last question is no, it would be useful to discuss.  * Role of architectures: Section 5.3 addresses the concern that architectural priors could lead to meaningful explanations. I suggest toning down some of the bolder claims in the rest of the paper to allude to this section (e.g. "properties of the model" -> "model parameters"; l103). Hint at the nature of the independence when it is first introduced.  Incomplete or incorrect claims:  * l84: The explanation of GBP seems incorrect. Gradients are set to 0, not activations. Was the implementation correct?  * l86-87: GradCAM uses the gradient of classification output w.r.t. feature map, not gradient of feature map w.r.t. input. Furthermore, the Guided GradCAM maps in figure 1 and throughout the paper appear incorrect. They look exactly (pixel for pixel) equivalent to the GBP maps directly to their left. This should not be the case (e.g., in the first column of figure 2 the GradCAM map assigns 0 weight to the top left corner, but somehow that corner is still non-0 for Guided GradCAM). The GradCAM maps look like they're correct.  l194-196: These methods are only equivalent gradient * input in the case of piecewise linear activations.  l125: Which rank correlation is used?  Theoretical analysis and similarity to edge detector:  * l33-34: The explanations are only somewhat similar to an edge detector, and differences could reflect model differences. Even if the same, they might result from a model which is more complex than an edge detector. This presentation should be a bit more careful.  * The analysis of a conv layer is rather hand wavy. It is not clear to me that edges should appear in the produced saliency mask as claimed at l241. The evidence in figure 6 helps, but it is not completely convincing and the visualizations do not (strictly speaking) immitate an edge detector (e.g., look at the vegitation in front of the lighthouse). It would be useful to include a conv layer initialized with sobel filter and a canny edge detector in figure 6. Also, quantitative experimental results comparing an edge detector to the other visual explanations would help. Figure 14 makes me doubt this analysis more because many non-edge parts of the bird are included in the explanations.  Although this work already provides a fairly large set of experiments there are some highly relevant experiments which weren't considered:  * How much does this result rely on the particular (re)intialization method? Which initialization method was used? If it was different than the one used to train the model then what justifies the choice?  * How do these explanations change with hyperparameters like choice of activation function (e.g., for non piecewise linear choices). How do LRP/DeepLIFT (for non piecewise linear activations) perform?  * What if the layers are randomized in the other direction (from input to output)? Is it still the classifier layer that matters most?  * The difference between gradient * input in Fig3C/Fig2 and Fig3A/E is striking. Point that out.  * A figure and/or quantitative results for section 3.2 would be helpful. Just how similar are the results?   Quality ---  There are a lot of weaknesses above and some of them apply to the scientific quality of the work but I do not think any of them fundamentally undercut the main result.  Clarity ---  The paper was clear enough, though I point out some minor problems below.  Minor presentation details:  * l17: Incomplete citation: "[cite several saliency methods]"  * l122/126: At first it says only the weights of a specific layer are randomized, next it says that weights from input to specific layer are randomized, and finally (from the figures and their captions) it says reinitialization occurs between logits and the indicated layer.  * Are GBP and IG hiding under the input * gradient curve in Fig3A/E?  * The presentation would be better if it presented the proposed approach as one metric (e.g., with a name), something other papers could cite and optimize for.  * GradCAM is removed from some figures in the supplement and Gradient-VG is added without explanation.   Originality ---  A number of papers evaluate visual explanations but none have used this approach to my knowledge.  Significance ---  This paper could lead to better visual explanations. It's a good metric, but it only provides sanity checks and can't identify really good explanations, only bad ones. Optimizing for this metric would not get the community a lot farther than it is today, though it would probably help.  In summary, this paper is a 7 because of novelty and potential impact. I wouldn't argue too strongly against rejection because of the experimental and presentation flaws pointed out above. If those were fixed I would argue strongly against rejection.  [1]: Doshi-Velez, Finale and Been Kim. “A Roadmap for a Rigorous Science of Interpretability.” CoRR abs/1702.08608 (2017): n. pag.


Breaking the Curse of Horizon: Infinite-Horizon Off-Policy Estimation
We consider off-policy estimation of the expected reward of a target policy using samples collected by a different behavior policy. Importance sampling (IS) has been a key technique for deriving (nearly) unbiased estimators, but is known to suffer from an excessively high variance in long-horizon problems. In the extreme case of infinite-horizon problems, the variance of an IS-based estimator may even be unbounded. In this paper, we propose a new off-policy estimator that applies IS directly on the stationary state-visitation distributions to avoid the exploding variance faced by existing methods. Our key contribution is a novel approach to estimating the density ratio of two stationary state distributions, with trajectories sampled from only the behavior distribution. We develop a mini-max loss function for the estimation problem, and derive a closed-form solution for the case of RKHS. We support our method with both theoretical and empirical analyses.

This paper introduces off-policy techniques for estimating average rewards. The technique relies on the fact that average reward has a reformulation based on stationary state distribution. Therefore, instead of computing the importance sampling ratio of the trajectory, which has exponentially exploding variance with the horizon, it suffices to compute the importance sampling ratio of the stationary state distribution. Theoretical and empirical results support the technique.  I find the work quite interesting. The paper is well written. The work is original with a significant contribution, that is, avoiding multiplicative ratios in one case of multi-step off-policy learning. There are some limitations which might be corrected without drastic changes. On the other hand, the scope of the work is more limited than it appeared initially. Authors' response to these concerns will be highly appreciated and useful.  The scope of the technique proposed seems to be limited only to the case of average reward. Much of the work in off-policy learning revolves around what the authors referred to as value-function learning. If this limitation is not clarified up front, the work may leave an impression that it offers to break the curse of the horizon for value-function learning. However, it does not. How this technique applies to value-function learning is not clear. On the other hand, the reformulation of average reward based on stationary state distribution is a known result. In that sense, the overall estimator based on density ratio is quite obvious. Hence, more of the contribution goes here in the particular way the density ratio is estimated here. However, for that, an analysis of computational complexity and providing a pseudo code of the overall technique would have been useful.  Can the authors offer some insight into how value-function learning can benefit from this technique? Alternatively, can you shed some light on the possibility of replacing off-policy value-function learning with off-policy average-reward learning altogether?  *** After author rebuttal ***  Thanks for the clarification that you indeed noted that the paper is about the average reward case. I am not sure the title, which is more general than the contribution, is doing justice to the work. On the other hand, if the extension to the value function learning case is that straightforward, it would have made more sense to start with that first. If the extension is not really that straightforward, it is okay to mention that, which would give more credence to why it was not tried first.  For computational complexity, it would also be useful to know what would be the cost for getting w(s) through (11) in the first place.  Thanks for the rebuttal and well done!


Informative Features for Model Comparison
Given two candidate models, and a set of target observations, we address the problem of measuring the relative goodness of fit of the two models. We propose two new statistical tests which are nonparametric, computationally efficient (runtime complexity is linear in the sample size), and interpretable. As a unique advantage, our tests can produce a set of examples (informative features) indicating the regions in the data domain where one model fits significantly better than the other. In a real-world problem of comparing GAN models, the test power of our new test matches that of the state-of-the-art test of relative goodness of fit, while being one order of magnitude faster.

I have read the author response, and in particular, the authors have clarified my confusion regarding Figure 2. While I maintain my overall evaluation, I do feel that the contributions of this paper would be strengthened if either more theoretical results are provided for the proposed tests, or if the experiment results could be more convincing (as noted by another reviewer).  ----------  The paper proposes two nonparametric statistical tests of relative goodness-of-fit that run in near-linear time, based on the unnormalized mean embeddings (UME) statistic and the finite-set Stein discrepancy (FSSD). By optimizing test locations to maximize test power, the proposed tests also yield informative features for distinguishing regions of the data domain in which one model fits significantly better than another. Experiments are conducted on toy problems and in comparing GAN models.  Overall, the paper is fairly clearly written and easy to follow. While nonparametric goodness-of-fit testing has received much attention recently, few works investigate the topic of relative goodness-of-fit testing, which could be important for model comparison in practice, since “all models are wrong, but some are useful.” In this sense, I feel that this work is a nice addition to the existing literature.   On the other hand, in terms of novelty, most of the techniques utilized in this work were developed in existing works: the definition of the UME and FSSD statistics as well as the idea of optimizing test locations to maximize test power in order to obtain informative features and reduce the computational complexity to near-linear time were all pioneered by Chwialkowski et al. and Jitkrittum et al., and the procedure to adjust the test threshold is similar to that in Bounliphone et al. The proofs of Theorems 1 and 2 are also fairly standard. I feel that the contributions of this paper would be strengthened if more theoretical results could be provided for the proposed Rel-UME, REl-FSSD tests in addition to deriving the asymptotic null distribution, such as an analysis of (asymptotic) test power which has been done for both the original UME and FSSD tests as well as MMD.  Regarding the experiments, they seem fairly extensive and well-executed, although the presentation of the results (in particular the figures and table) could be improved. In particular, I found the “Rejection rate” label on the y-axes in the figures confusing at times, and it would be clearer to explicitly specify “Type I” or “Type II” error depending on the circumstance. Figure 4(a) is not vey informative, and it would be more interesting to zoom into the smaller sample-size region. Figure 2 (b) and (c) seem to be have been flipped (at least according to the description in the text); I also don’t get why Figure 2(b) is dominated by cat images with only a few airplane images---shouldn’t it consist mostly of airplane images since these are which the distribution does not fit well? The results presented in Table 1 also indicates that the current GAN comparison task might be too easy and it is hard to distinguish the performance difference of the various methods; perhaps it would be more informative to mimic Experiment 1 and consider setting the distribution R to be a mix of S and N images with varying proportions as well.


Modeling Dynamic Missingness of Implicit Feedback for Recommendation
Implicit feedback is widely used in collaborative filtering methods for recommendation. It is well known that implicit feedback contains a large number of values that are missing not at random (MNAR); and the missing data is a mixture of negative and unknown feedback, making it difficult to learn users' negative preferences. Recent studies modeled exposure, a latent missingness variable which indicates whether an item is exposed to a user, to give each missing entry a confidence of being negative feedback. However, these studies use static models and ignore the information in temporal dependencies among items, which seems to be an essential underlying factor to subsequent missingness. To model and exploit the dynamics of missingness, we propose a latent variable named "user intent" to govern the temporal changes of item missingness, and a hidden Markov model to represent such a process. The resulting framework captures the dynamic item missingness and incorporate it into matrix factorization (MF) for recommendation. We also explore two types of constraints to achieve a more compact and interpretable representation of user intents. Experiments on real-world datasets demonstrate the superiority of our method against state-of-the-art recommender systems.

This paper presents H4MF model (HMM + MF for dynamic Missingness) for implicit feedback data. With implicit data, we only observe positive feedback and the missing entries (zeros) in the data can indicate either negative feedback or users are not exposed of the items. H4MF is based on the previous work on modeling user latent exposure (ExpoMF, Liang et al., Modeling user exposure in recommendation, 2016) — the basic idea is that for each user-item pair, there is a latent binary variable to represent exposure; if it’s 1, it means this user is exposed to the item thus 0 feedback mean true negative, while if it’s 0, it means this user have not yet been exposed to this item yet. The difference in H4MF is that H4MF uses a hidden Markov model to capture the temporal dynamics in the user exposure (user intent in this paper). The basic idea is that whether or not a user is exposed to something can be dependent on some other items he/she has been exposed before. The inference is relatively straightforward with some tweaks to overcome the potential redundancy in the learned user latent intents. Empirical results show that H4MF outperforms other similarly-designed baselines.   Overall, the paper is clearly written. However, there are a few aspects that I feel this paper falls a little bit short.   1. The idea of adding temporal dynamics in the latent user intent is fairly natural given the flexible model setup in ExpoMF. I like the motivation example about the purchasing phone and phone case (buying a phone will change the exposure to phone case, but conversely buying a phone case will change the exposure to phone in the opposite direction). However, it is not clear to me how the model can achieve this asymmetric reasoning with H4MF — it might be able to achieve it “by accident” but I cannot see how the model “by design” is able to achieve this. I was expecting a qualitative study on real-world data to convince me this but am quite disappointed to not see it. This is also related to the “causality-based recommendation” aspect mentioned in the paper. In the original ExpoMF paper, a major challenge it faces is how to “explain” exposure — there is an example about some user who listens to a lot of music from a certain band but did not listen to one of their songs — we can come up with two equally plausible explanations to this: either the user is not aware of this song, or clearly he knows this song but does not like it, but without the support of additional data, there is no way we can differentiable these two possibilities and establish the link. I don’t see how H4MF can differ from ExpoMF on this front.   ########## UPDATED AFTER AUTHOR RESPONSE ##########  I want to clarify what I meant by “by accident” as there seems to be some misunderstanding from the author responese. I agree that the temporal HMM model is able to capture the asymmetric relation, my point is more about the model does not have the incentive to capture the motivating example of phone v.s. phone case, which is OK. But in any case, I would be very interested to see a qualitative example demonstrating how H4MF can capture the dynamic missingness in real-world data, similar to the music listening example in ExpoMF.    ###################################################  2. Given a temporal user intent model, it seems only natural to also adopt a temporal user preference model — not necessarily deep, but something along the line of dynamic Poisson factorization (Charlin et al., Dynamic Poisson factorization, 2015) or time SVD++ (Koren, Collaborative Filtering with Temporal Dynamics, 2009) is worth trying. I understand the inference with a static MF model is much simpler, but the reason presented in the paper about the preference being more static is not very convincing.   3. The computational cost is quite high and this significantly limits the usability of H4MF — ExpoMF itself is already not computationally friendly, yet H4MF adds a lot more complexity on top of that. The datasets used in the empirically studies are relatively small sized and yet it still takes hours to train the model. I think stochastic algorithm is a promising avenue to overcome this issue.  ########## UPDATED AFTER AUTHOR RESPONSE ##########  “We implemented ExpoMF in C++ with openMP and it achieved a 30X speedup, compared to the Python implementation.”  Please make it publicly available upon publication of this paper.   ###################################################   Minor comments:  1. Line 8: a essential -> an essential  2. Around Line 40: The phrasing can be improved a little here: is the “missingness probability” referring to non-exposed or true negative? I can roughly infer what the authors mean here from the context, but it would be better to precisely define the term for understanding at first read.  3. Section 4: How is this different from or related to learning the beta prior through empirical Bayes? Updating Beta prior normally mounts to adding the “pseudo-counts” and I don’t think the proposed procedure is clear enough.   4. For implicit feedback data, PMF (Mnih & Salakhutdinov) is not a suitable baseline (as its very subpar results indicate).  5. Maybe time SVD++ or dynamic Poisson factorization is a more suitable baseline than FPMC?  6. Error bars in Table 1?  7. Line 241: Figure 3 -> Figure 2


Exponentially Weighted Imitation Learning for Batched Historical Data
We consider deep policy learning with only batched historical trajectories. The main challenge of this problem is that the learner no longer has a simulator or "environment oracle" as in most reinforcement learning settings. To solve this problem, we propose a monotonic advantage reweighted imitation learning strategy that is applicable to problems with complex nonlinear function approximation and works well with hybrid (discrete and continuous) action space. The method does not rely on the knowledge of the behavior policy, thus can be used to learn from data generated by an unknown policy. Under mild conditions, our algorithm, though surprisingly simple, has a policy improvement bound and outperforms most competing methods empirically. Thorough numerical results are also provided to demonstrate the efficacy of the proposed methodology.

Summary: The paper considers imitation learning with only batched historical trajectories and without any further access to any simulators or environment models. The proposed imitation learning is reward-aware, in a sense that it weights the expert's action based on advantage of the expert policy A^{\pi}. The paper also analyze the proposed algorithm and show a policy improvement over the expert policy.    Strengths: The setting considered in the paper is challenging: the learning algorithm only has access to batched trajectories from the expert but further access to the simulator or model. Hence most of previous imitation learning works (e.g., Dagger ,GAIL) won't apply in this setting. Simply Behavior cloning will work in this setting, but the paper shows that by leveraging the advantage of the expert, it can outperform Behavior cloning.    Main comments below:  1. The definition and the use of KL divergence between two policies, i.e., D_{KL}(\pi'||pi) is not clear. Specifically, the definition in Eq (1) is different from the definition of KL below line 56. Which definition did you use in the rest of the paper, say, in Eq (3)?   2. Regarding the state distribution rho(s), I assume it is always referring to the state distribution of the behavior policy pi. However, below line 146, when you say that it is imitating a new hypothetic policy \tilde{\pi}, shouldn't the state distribution becomes the state-distribution resulting from \tilde{\pi}? The state distribution of tilde{\pi} and \pi could be different.   3. Line 147: Why C(s) could be emitted? It is state-dependent. Ignoring C(s) could affect the solution of the optimization. Could the authors elaborate on why it is ok to ignore C(s)?   4. Even assume that we have a rich enough policy space such that we can drive D_{KL}(\tilde{\pi} || \pi_{\theta}) to zero. How does this guarantee that \pi_{\theta} is also as good as, or even better than pi? Note that D_{KL}(\tilde{\pi}|| \pi) = 0 does not imply that \tilde{\pi} and \pi are the same under every state: it depends on whether or not state distribution rho(s) has non-zero probability on every state (consider the case where. a behavior policy can only cover a small part of the large state space). Also no matter how deeper the network is, we can never ever make D_{KL}(\tilde{\pi}|| \pi_{\theta}) reach zero, simply because we do not have infinitely many data. Assuming, for instance, D_{KL}(\tilde{\pi} || pi_{\theta}) <= epsilon for some small epsilon, is reasonable, but then we need to analyze how epsilon affect the performance of the learned \pi_{\theta}.  5. Notations in Eq (7) - (10) are not well-defined. Could you point the readers to the places where, for instance, E_{\pi} \log \pi_{\theta} is defined? What does it even mean by log(\pi_{\theta}), as pi_{\theta} is a function? Also the KL used in (7) and (10) are not consistent. Following the definition in (7), shouldn't the expectation in (10) be defined with respect to \tilde{\pi}?     After rebuttal:   Thanks a lot for the rebuttal. I read all reviews and the rebuttal. Unfortunately I'm not going to raise my score.   Regarding the theory section, essentially the paper is trying to imitate an ideal policy (\tilde{\pi} in Eq 4) using function approximations (\pi_{\theta}). The paper claims the algorithm 1 essentially is minimizing D_{KL}(\tilde{\pi} || \pi_{theta}), but I'm not sure if it's a good idea. Again, the state distribution problem plays important role here. Note that in Alg 1, it is using states from the behavior policy, which is neither \tilde{\pi} nor \pi_{\theta}!. (Existing analysis of Behavior cloning assumes we generate state-action pairs from the policy that we are going to imitate! However here we do not have data from \tilde{\pi}---the policy that we are supposed to imitate).  To behavior clone this ideal policy, one should minimize KL under the state-distribution resulting from the ideal policy \tilde{\pi}. This is extremely important for the discussion in section 5.2. While it's not hard to see \tilde{\pi} is a uniformly better policy than the behavior policy \pi, it is definitely not clear to me that the learned policy pi_{\theta} would be better than or at least as good as \pi, considering that the state-distribution for measuring KL-divergence between \tilde{\pi} and \pi_{\theta} is the state-distribution of the behavior policy \pi.   Overall, I might be wrong but I personally think that the paper somehow implicitly kept using max_{s} KL(\pi(. | s) || \pi'(. | s) ) as the default-to-go definition of KL-divergence between two policies, at least throughout the analysis (if we can drive this kl-divergence to zero or small number epsilon, then pi and pi' will be close to each other for any states, hence in analysis we do not need to worry about the state-action distribution). But in reality, we can only measure KL under the state-distribution of behavior policy (i.e., max_{s} is impossible to evaluate in large state space). Theoretical guarantees of imitation learning where state-action distribution induced neither from the expert policy, i.e., \tilde{\pi} (classic Behavior cloning analysis considers this setting), nor from the learned policy, i.e. \pi_{\theta} (method like DAgger considers this setting) seem not trivial and need more careful analysis.


Robust Detection of Adversarial Attacks by Modeling the Intrinsic Properties of Deep Neural Networks
It has been shown that deep neural network (DNN) based classifiers are vulnerable to human-imperceptive adversarial perturbations which can cause DNN classifiers to output wrong predictions with high confidence. We propose an unsupervised learning approach to detect adversarial inputs without any knowledge of attackers. Our approach tries to capture the intrinsic properties of a DNN classifier and uses them to detect adversarial inputs. The intrinsic properties used in this study are the output distributions of the hidden neurons in a DNN classifier presented with natural images. Our approach can be easily applied to any DNN classifiers or combined with other defense strategies to improve robustness. Experimental results show that our approach demonstrates state-of-the-art robustness in defending black-box and gray-box attacks.

The paper presents an unsupervised learning approach to the problem of adversarial attack detection in the context of deep neural networks.  The authors  model the intrinsic properties of the networks to detect adversarial inputs.  To do so, they employ a Gaussian Mixture Model (GMM) to approximate the hidden state distribution, in practice the state of the fully connected hidden layers, and detect adversarial samples by simply checking that their likelihood is lower than a given threshold. Exhaustive experimental results in different show that the proposed method achieves state-of-the-art performance compared to unsupervised methods while generalizing better than supervised approaches.   The paper reads well and is technically sound. The method is very simple but seems to work well. The experiments are rather convincing. I don’t have any major concern but I think that it would be interesting to see how the methods work with more complex networks (e.g. with more than 10 classes) and with other models than GMMs.  I have a couple of comments/questions: - For the sake of repeatability, it would be good to have more details about the EM procedure (number of iterations?) - In section 3/table 6, it is indicated that the likelihood threshold is set to keep 95 and 99% of training data. How is the threshold selected for the other experiments (section 4.1)?  minor comments: - Figure 2: “The OC curves”- “The ROC curves” - Figure 3 is not mentioned in the text - Line 154: “even the perturbations”-> “even if the perturbations” - Line 166” “outperform”->”outperforms” - Line 173: “same on the training”->”on the same training”