FLOWQA: GRASPING FLOW IN HISTORY FOR CONVERSATIONAL MACHINE COMPREHENSION
Conversational machine comprehension requires the understanding of the conversation history, such as previous question/answer pairs, the document context and the current question. To enable traditional, single-turn models to encode the history comprehensively, we introduce FLOW, a mechanism that can incorporate intermediate representations generated during the process of answering previous questions, through an alternating parallel processing structure. Compared to approaches that concatenate previous questions/answers as input, FLOW integrates the latent semantics of the conversation history more deeply. Our model, FLOWQA, shows superior performance on two recently proposed conversational challenges (+7.2% F 1 on CoQA and +4.0% on QuAC). The effectiveness of FLOW also shows in other tasks. By reducing sequential instruction understanding to conversational machine comprehension, FLOWQA outperforms the best models on all three domains in SCONE, with +1.8% to +4.4% improvement in accuracy.

The paper proposes a method to model the flow of context in multi-turn machine comprehension (MC) tasks. The proposed model achieves amazing improvements in the two recent conversational MC tasks as well as an instruction understanding task. I am very impressed by the improvements and the ablation test that actually shows the effectiveness of the FLOW mechanism they proposed.
However, this paper has a lack of clarity (especially, Section 3) which makes it difficult to follow and easy to lose the major contribution points of the work. I summarized the weaknesses as follows:
# lack of motivation and its validation
The paper should have more motivational questions at the beginning of why such flow information is necessary for the task. Authors already mentioned about some of it in Figure 1 and here: “such as phrases and facts in the context, for answering the previous questions, and hence provide additional clues on what the current conversation is revolving around”. However, the improvement of absolute scores in the Experiment section didn’t provide anything related to the motivation they mentioned. Have you actually found the real examples in the testing set that are correctly predicted by the FLOW model but not by the baseline? Are they actually referring to the “phrases and facts in the context”, “additional clues on what the current conversation is revolving around”? Another simple test authors can try is to show the attention between the context in a flow and question and see whether appropriate clues are actually activated given the question.
# unclear definition of “flow”
The term “flow” is actually little over-toned in my opinion. Initially, I thought that flow is a sequence of latent information in a dialog (i.e., question-answer) but it turns to be a sequence of the context of the passage. The term “flow” is more likely a sequence of latent and hierarchical movement of the information in my opinion. What is your exact definition of “flow” here? Do you believe that the proposed architecture (i.e., RNN sequence of context) appropriately take into account that? RNN sequence of the passage context actually means your attention over the passage given the question in turn, right? If yes, it shouldn’t be called a flow.
# Lack of clarity in Section 3
Different points of contributions are mixed together in Section 3 by themselves or with other techniques proposed by others. For example, the authors mention the computational efficiency of their alternating structure in Figure 2 compared to sequential implementation. However, none of the experiment validates its efficiency. If the computational efficiency is not your major point, Figure 2 and 3 are actually unnecessary but rather they should be briefly mentioned in the implementation details in the later section. Also, are Figure 2 and 3 really necessary?
Section 3.1 and 3.3.1 are indeed very difficult to parse: This is mainly because authors like to introduce a new concept of “flow” but actually, it’s nothing more than a thread of a context in dialog turns. This makes the whole points very hyped up and over-toned like proposing a new “concept”. Also, the section introduces so many new terms (“context integration”. “Flow”, “integration layers”, “conversational flow”, “integration-flow”) without clear definition and example. The name itself looks not intuitive to me, too. I highly recommend authors provide a high-level description of the “flow” mechanism at first and then describe why/how it works without any technical terms. If you can provide a single example where “flow” can help with, it would be nicer to follow it.
# Some questions on the experiment
The FLOW method seems to have much more computation than single-turn baselines (i.e., BiDAF). Any comparison on computational cost?
In Table 3, most of the improvements for QuAC come from the encoding N answer spans to the context embeddings (N-ans). Did you also compare with (Yatskar, 2018) with the same setting as N-ans?
I would be curious to see for each context representation (c), which of the feature(e.g., c, em, g) affect the improvement the most? Any ablation on this?
The major and the most contribution of the model is probably the RNN of the context representations and concatenation of the context and question at turn in Equation (4). For example, have you tested whether simple entity matching or coreference links over the question thread can help the task in some sense?
Lastly for the model design, which part of the proposed method could be general enough to other tasks? Is the proposed method task-specific so only applicable to conversational MC tasks or restricted sequential semantic parsing tasks?


Deep Neural Networks, being memory and computation intensive, are a challenge to deploy in smaller devices. Numerous quantization techniques have been proposed to reduce the inference latency/memory consumption. However, these techniques impose a large overhead on the training procedure or need to change the training process. We present a non-intrusive quantization technique based on re-training the full precision model, followed by directly optimizing the corresponding binary model. The quantization training process takes no longer than the original training process. We also propose a new loss function to regularize the weights, resulting in reduced quantization error. Combining both help us achieve full precision accuracy on CIFAR dataset using binary quantization. We also achieve full precision accuracy on WikiText-2 using 2 bit quantization. Comparable results are also shown for ImageNet. We also present a 1.5 bits hybrid model exceeding the performance of TWN LSTM model for WikiText-2.

The paper is a little hard to follow and some parts are poorly written. While the authors claim that they use the greedy approach (in sec 2) for quantization where both B and \alpha are learned in a greedy way, it is not clear why there is convergence difference between the two as claimed by the authors in section 3.1. Moreover, the authors claimed faster convergence of B than \alpha because fewer bit clips are observed from the left subplot of Figure 2. However, this conclusion is not quite convincing because 1) on the right subplot of Figure 2, it seems that \alpha also becomes more stable after 80k iterations; 2) the fewer bit clips may comes from using a stepwise learning rate decay scheme. Thus, the motivation for using another phase to train the \alpha is not strong.
The iterative quantization approach has limited novelty. It is similar to many quantization methods like BinaryConnect and Xnor-Net, except that the quantization step is not done immediately after the BP and model updates, but after some iterations of full-precision training. Moreover, these methods also use full-precision weights for update during training.
Clarity in the experiments section is a little better than the previous sections. However,
- The proposed method only performs comparably with TTQ, and shows significant accuracy drop on the Cifar-10 and Cifar-100 datasets (especially on Cifar-100)
- On the ImageNet dataset, there is a large accuracy drop of the proposed method compared to Zhou et al. (2018). Though the authors said that they believe their proposed model can reach a higher accuracy by using layer-by-layer quantization as in Zhou et al. (2018), it is hard to verify this claim due to lack of the corresponding results. Thus, efficacy of the proposed method on large datasets or models are hard to evaluate.


Chemical information extraction is to convert chemical knowledge in text into true chemical database, which is a text processing task heavily relying on chemical compound name identification and standardization. Once a systematic name for a chemical compound is given, it will naturally and much simply convert the name into the eventually required molecular formula. However, for many chemical substances, they have been shown in many other names besides their systematic names which poses a great challenge for this task. In this paper, we propose a framework to do the auto standardization from the non-systematic names to the corresponding systematic names by using the spelling error correction, byte pair encoding tokenization and neural sequence to sequence model. Our framework is trained end to end and is fully data-driven. Our standardization accuracy on the test dataset achieves 54.04% which has a great improvement compared to previous state-of-the-art result.

Pros: This seems like very competent and important work in an under-served area: Doing the mapping (or "entity linking") of chemical names to their standardized systematic forms. It's not my area, but I was frankly surprised when the paper said there was only one relevant prior piece of work, but having searched for a few minutes on Google Scholar, I'm at least inclined to believe that the authors are (approximately) right on that one. (This stands in stark contradistinction to the large quantity of biomedical entity recognition and linking work.) So, it's valuable to have work in this area, and the approach and application are sensible. In one sense, this gives the work significance and originality (as to domain). The paper is also clearly written, and certainly sufficiently accessible to an ML reader.
Cons: Unfortunately, though, I just don't think this qualifies for acceptance at ICLR. It's application of known techniques, and lacks any ML novelty or sufficient ML interest. It would only be appropriate for an "ML applications" track, which ICLR does not have. And while its performance is _way_ better than that of the only previous work on the topic that they know, accuracy of mapping non-systematic chemical terms (54.04%) is still low enough that this technique doesn't seem ready for prime time.
Other comments: In table 5, you show that a prior pipeline stage of spelling correction is definitely useful in your system (table 5). And yet, given the power of deep learning seq2seq transductions, and the potential to use them for spelling correction, one might wonder whether this prior step of spelling correction is really necessary. It might be interesting to explore further where it helps and whether the gains of spelling correction might be obtainable in other ways such as using data augmentation (such as spelling error insertion) in the seq2seq training data. The Golebiewski bib entry is lacking any information as to where it is published, which seems especially bad for the key citation to prior work of the whole paper. In general, the bibliography has issues: non-ASCII characters have been lost (you either need to LaTeX-escape them or to load a package like utf8, and capitalization of acronyms, etc. should be improved with curly braces.


HIERARCHICAL VISUOMOTOR CONTROL OF HUMANOIDS
We aim to build complex humanoid agents that integrate perception, motor control, and memory. In this work, we partly factor this problem into low-level motor control from proprioception and high-level coordination of the low-level skills informed by vision. We develop an architecture capable of surprisingly flexible, task-directed motor control of a relatively high-DoF humanoid body by combining pre-training of low-level motor controllers with a high-level, task-focused controller that switches among low-level sub-policies. The resulting system is able to control a physically-simulated humanoid body to solve tasks that require coupling visual perception from an unstabilized egocentric RGB camera during locomotion in the environment. Supplementary video link 1

1) Summary
The authors propose an interesting hierarchical reinforcement learning method that makes use of visual inputs as well as proprioception for locomotion of humanoid agents. The low-level controllers make use of “motion capture” data and are expected to form a set of movement primitives that can be used by a higher-level controller that has vision and memory. Their method is tested on a variety of tasks and different choices of low-level controller are explored.
2) Pros
+ Combining vision, memory, and motor control
+ Allows the high-level controller to operate at a coarser time scale
+ The set of low-level movement primitives can be extended by using more mocap data
3) Cons
- No comparison to earlier work
- Highly unnatural motions even though it makes use of mocap data
- Sample inefficient: more than 1 billion time-steps to train the high-level controller
4) Comments
Showing that the agent can provide suitable solutions for these tasks using raw vision input is indeed interesting, however it is not clear what the main contribution of the paper is as the authors fail to compare their results with earlier work. It would be useful if the authors could cover the related work in more depth in order to motivate their method and contrast it with the existing solutions. As an example, DeepLoco (Peng et al. 2017) solves a similar problem in which they use an egocentric heightmap instead of direct visual input, hence a formal consideration of the trade-offs would be informative.
In addition, the appeal of using hierarchical reinforcement learning is to divide up the task into easier chunks that can be solved easier, however it is not obvious how well this method succeeds at this task, keeping in mind that the high-level controller takes in the order of 1 billion time-steps to learn most tasks (5 billion in the case of “Heterogeneous Forage”).
In the end, an ablation study could be useful since the authors make plenty of novel design decision, yet their effect on the final performance is not clear.
6) Questions
- Is is possible to entirely remove proprioception from the input to the high-level controller or at least use just a small portion of it? How do the results compare in this case?
- How robust is “cold-switching” between control fragments? Is it possible to transition between most fragments without losing balance or does the high-level controller have to be extremely careful as to which combination it should use? The former case would suggest that this method is indeed useful as a hierarchical method. However the latter case might imply that the hierarchical method is failing and the higher level controller’s task has not been made much easier than the original problem itself.
- Table 2 describes the mocap clips used to train the low-level controllers in each task. What is the effect of choosing different sets of motions? Specifically how well does the steerable controller work if walking motions were used for the “Go To Target” and “Walls” tasks rather than running motions? Presumably, this can result in a more flexible controller which allows sharper turns without loosing balance.
- The network in Figure A.1 gets the last action as an input. Why is this required? Especially since the LSTM unit can learn to remember any information related to the previous actions.
- How does the supervised pre-training described in section 2.1 effect the training of low-level controllers? Is it used as a speed-up mechanism or a way of escaping local minima?
- In section 2.1 the authors mention that the episodes are “terminated when the pose deviates too far from the trajectory”. I believe this termination criteria was not present in the earlier works (Peng et al. 2018), then what is the effect of adding such a criterion? Can this make the learned agent less robust as it will not learn to recover from larger perturbations?
7) Conclusion
The method and the results are interesting but further comparison with existing work is required.


DISCRIMINATOR REJECTION SAMPLING
We propose a rejection sampling scheme using the discriminator of a GAN to approximately correct errors in the GAN generator distribution. We show that under quite strict assumptions, this will allow us to recover the data distribution exactly. We then examine where those strict assumptions break down and design a practical algorithm-called Discriminator Rejection Sampling (DRS)-that can be used on real data-sets. Finally, we demonstrate the efficacy of DRS on a mixture of Gaussians and on the state of the art SAGAN model. On ImageNet, we train an improved baseline that increases the best published Inception Score from 52.52 to 62.36 and reduces the Fréchet Inception Distance from 18.65 to 14.79. We then use DRS to further improve on this baseline, improving the Inception Score to 76.08 and the FID to 13.75.

his paper assumes that, in a GAN, the generator is not perfect and some information is left in the discriminator, so that it can be used to 'reject' some of the 'fake' examples produced by the generator.
The introduction, problem statement and justification for rejection sampling are excellent, with a level of clarity that makes it understandable by non expert readers, and a wittiness that makes the paper fun to read. I assume this work is novel: the reviewer is more an expert in rejection than in GANs, and is aware how few publications rely on rejection.
However, the authors fail to compare their algorithm to a much simpler rejection scheme, and a revised version should discuss this issue.
Let's jump to equation (8): compared to a simple use of the dicriminator for rejection, it adds the term under the log.
The basic rejection equation would read F(x) = D*(x) - gamma and one would adjust the threshold gamma to obtain the desired operating point. I am wondering why no comparison is provided with basic rejection?
Let me try to understand the Gaussian mixture experiment, as the description is ambiguous:
- GAN setting: 10K examples are generated and reported in figure 3?
- DRS setting: 10K examples are generated, and submitted to algorithm in figure 1. For each batch, a line search sets gamma so that 95% of the examples are accepted. Thus only 9.5K are reported in figure 3.
- What about basic rejection using F(x) = D*(x) - gamma: how does it compare to DRS at the same 95% accept?
If this is my understanding, then the comparison in Figure 3 in unfair, as DRS is allowed to pick and choose.
For completeness, basic rejection should also be added.
Going back to Eq.(8), one realizes that the difference between DRS rejection and basic rejection may be negligible.
First order Taylor expansion of log(1-x) that would apply to the case where the rejection probability is small yields:
F(x) = (D*(x) - D*_M) + exp(D*(x) - D*_M)
x+ exp(x) is monotonous, so thresholding over it is the same as thresholding over x: back to basic rejection!


Recently, an adversarial example becomes a serious problem to be aware of because it can fool trained neural networks easily. To prevent the issue, many researchers have proposed several defense techniques such as adversarial training, input transformation, stochastic activation pruning, etc. In this paper, we propose a novel defense technique, Pixel Redrawn (PR) method, which redraws every pixel of training images to convert them into distorted images. The motivation for our PR method is from the observation that the adversarial attacks have redrawn some pixels of the original image with the known parameters of the trained neural network. Mimicking these attacks, our PR method redraws the image without any knowledge of the trained neural network. This method can be similar to the adversarial training method but our PR method can be used to prevent future attacks. Experimental results on several benchmark datasets indicate our PR method not only relieves the over-fitting issue when we train neural networks with a large number of epochs, but it also boosts the robustness of the neural network.

This paper presents a new adversarial defense method.  I found the paper difficult to understand, but as far as I understand, the method involves randomly perturbing the pixels of images in a dataset, and retraining the classifier to correctly classify these perturbed images as well.  The perturbations are done independently per pixel by quantizing the pixel value, and then using a perceptron model to generate the full pixel value from just this quantized value.  The perceptron is trained on randomly generated data mapping quantized pixel values to full pixel values (this random generation does not use the dataset statistics at all).  They use both partially converged perceptron models as well as fully converged perceptron models.
Pros:
	1. The defense technique does not require knowledge of the attack method
Cons:
	1. The paper is incredibly difficult to understand due to the writing.
	2. The performed experiments are insufficient to determine  whether or not their technique works because:
		a. They don't compare against any other defense techniques.  In addition to at least adversarial training, I would like to also see comparisons to feature squeezing which I would expect to have a very similar effect.
		b. They do not show the results of an attack by an adversary that is aware of their technique.  (i.e. F(PR(A(F,PR,x))))  Many alternative defense techniques will work much better if we assume the adversary does not know about the technique.
		c. Their comparison against random noise is not an apples-to-apples comparison.  Instead of perturbing uniformly within a range, they perturb according to a normal distribution.  The random noise perturbations also have a much larger L2 distance than the perturbations from their technique.  To believe that their method is actually better than training with random noise I'd like to see an apples-to-apples comparison where these values are hyperparameter tuned as they presumably did for their method.
		d. They only show results for one value of epsilon and one value of "# of colors" for their technique.  Presumably if there is a mismatch between these values then the results will be much worse (i.e. if they choose a large "# of colors"/small range per color and the attacker chooses a large epsilon).
	3. Their use of machine learning models is quite ad-hoc.  In particular they use a perceptron trained on algorithmically generated data.  And their justification for using a perceptron, instead of just using the known underlying generation algorithm is that they also use a partially converged version of the perceptron as part of their model.
	4. The authors partly deanonymize the paper through a github link
	5. The main paper is 10 pages long, and the quality of the paper does not justify the additional length.


We propose a framework for extreme learned image compression based on Generative Adversarial Networks (GANs), obtaining visually pleasing images at significantly lower bitrates than previous methods. This is made possible through our GAN formulation of learned compression combined with a generator/decoder which operates on the full-resolution image and is trained in combination with a multi-scale discriminator. Additionally, if a semantic label map of the original image is available, our method can fully synthesize unimportant regions in the decoded image such as streets and trees from the label map, therefore only requiring the storage of the preserved region and the semantic label map. A user study confirms that for low bitrates, our approach is preferred to state-of-the-art methods, even when they use more than double the bits.

This paper proposes to use GAN to address the image compression problem. It is shown to achieve superior results over the past work in two different settings (GC and SC).
Novelty:
It has been well discovered in the literature of GANs that they can resolve the problem of blurriness in generation, compared to the traditional MSE loss. This paper proposes to combine a GAN loss with MSE, together with an entropy loss. However similar approaches were used such as video prediction [1] from 2016. The paper lacks a few references like this.
Major questions:
- How do the different loss terms play against each other? The entropy term and the MSE apparently conflict with each other. And how would this affect L_gan? I would like to request some more analysis of this or ablation study on different terms.
- How well does the GAN converge? A plot of G and D loss is often presented with GAN approaches.
- Discrete latent variable is in itself an interesting problem [2]. I see the image compression as a task to discover a discrete latent variable with minimal storage. Perhaps one most important problem is how to estimate the gradient through the discrete bottleneck. But the paper doesn't provide much insights or experiments on this.
- I'm not fully convinced by the claim of the noise that this paper uses to combine the code can act as a regularizer. Adding the noise makes the decoder output stochastic, but the compression problem seems to be deterministic by nature, unlike many other generation problems.
[1] https://arxiv.org/abs/1511.05440
[2] https://arxiv.org/abs/1711.00937


SPHERICAL CNNS ON UNSTRUCTURED GRIDS
We present an efficient convolution kernel for Convolutional Neural Networks (CNNs) on unstructured grids using parameterized differential operators while focusing on spherical signals such as panorama images or planetary signals. To this end, we replace conventional convolution kernels with linear combinations of differential operators that are weighted by learnable parameters. Differential operators can be efficiently estimated on unstructured grids using one-ring neighbors, and learnable parameters can be optimized through standard back-propagation. As a result, we obtain extremely efficient neural networks that match or outperform state-of-the-art network architectures in terms of performance but with a significantly smaller number of network parameters. We evaluate our algorithm in an extensive series of experiments on a variety of computer vision and climate science tasks, including shape classification, climate pattern segmentation, and omnidirectional image semantic segmentation. Overall, we (1) present a novel CNN approach on unstructured grids using parameterized differential operators for spherical signals, and (2) show that our unique kernel parameterization allows our model to achieve the same or higher accuracy with significantly fewer network parameters.

The paper presents a new convolution-like operation for parameterized manifolds, and demonstrates its effectiveness on learning problems involving spherical signals. The basic idea is to define the MeshConvolution as a linear combination (with learnable coefficients) of differential operators (identity, gradient, and Laplacian). These operators can be efficiently approximated using the 1-hop neighbourhood of a vertex in the mesh.
In general I think this is a strong paper, because it presents a simple and intuitive idea, and shows that it works well on a range of different problems. The paper is well written and mostly easy to follow. The appendix contains a wealth of detail on network architectures and training procedures.
What is not clear to me is how exactly the differential operators are computed, and how the MeshConvolution layer is implemented. The authors write that "differential operators can be efficiently computed using Finite Element basis, or derived by Discrete Exterior Calculus", but no references or further detail is provided. The explanation of the derivative computation is:
"The first derivative can be obtained by first computing the per-face gradients, and then using area-weighted average to obtain per-vertex gradients. The dot product between the per-vertex gradient value and the corresponding x and y vector fields are then computed to acquire grad_x F and grad_y F."
What are per-face gradients and how are they computed? Is the signal sampled on vertices or on faces? What area is used for weighting? What is the exact formula? What vector fields are you referring to? (I presume these are the coordinate vector fields). In eq. 5, what are F_i and F_j? What is the intuition behind the cotangent formula (eq. 5), and where can I read more? etc.
Please provide a lot more detail here, delegating parts to an appendix if necessary. Providing code would be very helpful as well.
A second (minor) concern I have is to do with the coordinate-dependence of the method. Because the MeshConvolution is defined in terms of (lat / lon) coordinates in a non-invariant manner, and the sphere does not admit a global chart, the method will have a singularity at the poles. This is confirmed by the fact that in the MNIST experiment, digits are rotated to the equator "to prevent coordinate singularity at the poles". I think that for many applications, this is not a serious problem, but it would still be nice to be transparent and mention this as a limitation of the method when comparing to related work.
In "Steerable CNNs", Cohen & Welling also used a linear combination of basis kernels, so this could be mentioned in the related work under "Reparameterized Convolutional Kernel".
To get a feel for the differential operators, it may be helpful to show the impulse response (at different positions on the sphere if it matters).
In experiment 4.1 as well as in the introduction, it is claimed that invariant/equivariant models cannot distinguish rotated versions of the same input, such as a 6 and a 9. Although indeed an invariant model cannot, equivariant layers do preserve the ability to discriminate transformed versions of the same input, by e.g. representing a 9 as an upside-down 6. So by replacing the final invariant pooling layer and instead using a fully connected one, it should be possible to deal with this issue in such a network. This should be mentioned in the text, and could be evaluated experimentally.
In my review I have listed several areas for improvement, but as mentioned, overall I think this is a solid paper.


EFFICIENT LIFELONG LEARNING WITH A-GEM
In lifelong learning, the learner is presented with a sequence of tasks, incrementally building a data-driven prior which may be leveraged to speed up learning of a new task. In this work, we investigate the efficiency of current lifelong approaches, in terms of sample complexity, computational and memory cost. Towards this end, we first introduce a new and a more realistic evaluation protocol, whereby learners observe each example only once and hyper-parameter selection is done on a small and disjoint set of tasks, which is not used for the actual learning experience and evaluation. Second, we introduce a new metric measuring how quickly a learner acquires a new skill. Third, we propose an improved version of GEM (Lopez-Paz & Ranzato, 2017), dubbed Averaged GEM (A-GEM), which enjoys the same or even better performance as GEM, while being almost as computationally and memory efficient as EWC ) and other regularizationbased methods. Finally, we show that all algorithms including A-GEM can learn even more quickly if they are provided with task descriptors specifying the classification tasks under consideration. Our experiments on several standard lifelong learning benchmarks demonstrate that A-GEM has the best trade-off between accuracy and efficiency.

Summary of the paper:
This paper focuses on the problem of lifelong learning for multi-task
neural networks. The goal is to learn in a computationally and memory
efficient manner new tasks as they are encountered while at the same
time remembering how to solve previously seen tasks with a focus on
having only one training pass through all the training data. The paper
builds on the GEM method introduced in the paper "Gradient episodic
memory for continuum learning", NIPS 2017.
The main novelty over the original GEM paper is that A-GEM simplifies
the constraints on what constitutes a feasible update step during its
SGD training so that GEM's QP problem is replaced by a couple of
inner-products (and thus makes A-GEM much more computationally
efficient). This simplification also means that only one gradient
vector (the average gradient computed from the individual gradients of
the task loss of the previously seen tasks) has to be stored at each
update as opposed to GEM where each task specific gradient vector has
to be stored. Thus the memory requirements of A-GEM is much less than
GEM and is independent of the number of already learnt tasks.
The paper then presents experimental evidence that A-GEM does run much
faster and uses less memory and results in performance similar to the
original GEM strategy. The latter point is important as the simplified
A-GEM algorithm - which adjusts the network's parameter to improve
performance on the current task while ensuring the average performance
on the previously seen tasks should not decrease - does not guarantee
as stringently as GEM that the network does not forget how to perform
all the previous tasks.
The paper also introduces an extra performance metric is introduced
  called the "Learning Curve Area" which measures how quickly a new
  task is learnt when it is presented with new material.
Pros and Cons of the paper:
+/- The paper presents a simple intuitive extension to the original GEM
paper that is much more computationally efficient and is thus more
suited and feasible for real lifelong learning applications. And it
shows that performance exceeds other methods that have similar
computational demands. The paper can be viewed as somewhat incremental
but the increment is probably crucial for any real-world practical
application.
+ The validity of the approach is demonstrated experimentally on
  standard datasets in the field.
- Some of the presentation of the material is somewhat vague, in
  particular section 5. In this section a joint embedding model is
  described that helps facilitate zero-shot learning. However, not
  enough detail is given to fully understand or appreciate this
  contribution, see below for details.
Rationale for my evaluation:
The method is somewhat incremental, however, this increment could be
quite practically important. The presentation is lacking in some regard and would benefit
 from some re-working i.e. section 5.

Unclear in the paper:
Section 5 describing the "Joint Embedding Model Using Compositional Task descriptors" is very sparse on detail.  Here are some of the details that I feel are missing:
- In the experiments how is the matrix description (via attributes) of the different tasks $t^k$ learnt/discovered?
- The size of this attribute matrix is able to vary from one task to the next. How does the function $\psi_{\omega}$ deal with this problem?
- What functions are used in the experiments to represent $\psi_{\omega}$?
- In the second last line of paragraph 2 should $C$ be $C_k$? If it should be $C$ how is $C$ chosen?
- In equation (12) should the $c$th column of $\psi_{\omega}$ be extracted as opposed to the $k$th column?
Representative labelled samples from each task are stored in memory
and these are used when learning for a new task. The system
has a fixed memory so when a new task is added then the number of
images stored for each task has to be reduced. Then uniform sampling is
used to randomly decide which images to keep. Could this selection
process be improved upon and would any such improvement have any large
impact on performance?
Typos and minor errors spotted:
In the third paragraph of section 2 it is stated $T^{CV} \ll T$ in the
experiments performed this is not case. I don't think 3 is much less
than 10 or 20.
In figures 4 and 5 it is not entirely clear which curves correspond to
A-GEM and A-GEM-JE from the legend. In the legend the dashed line with
the triangle looks the same the non-dashed line with the triangle. I
presuming A-GEM is the non-dashed line, but only because that makes
things consistent with the previous figures.


Most of the existing Graph Neural Networks (GNNs) are the mere extension of the Convolutional Neural Networks (CNNs) to graphs. Generally, they consist of several steps of message passing between the nodes followed by a global indiscriminate feature pooling function. In many data-sets, however, the nodes are unlabeled or their labels provide no information about the similarity between the nodes and the locations of the nodes in the graph. Accordingly, message passing may not propagate helpful information throughout the graph. We show that this conventional approach can fail to learn to perform even simple graph classification tasks. We alleviate this serious shortcoming of the GNNs by making them a two step method. In the first of the proposed approach, a graph embedding algorithm is utilized to obtain a continuous feature vector for each node of the graph. The embedding algorithm represents the graph as a point-cloud in the embedding space. In the second step, the GNN is applied to the point-cloud representation of the graph provided by the embedding method. The GNN learns to perform the given task by inferring the topological structure of the graph encoded in the spatial distribution of the embedded vectors. In addition, we extend the proposed approach to the graph clustering problem and an architecture for graph clustering is presented. Moreover, the spatial representation of the graph is utilized to design a new graph pooling algorithm. We turn the problem of graph down-sampling into a column sampling problem, i.e., the sampling algorithm selects a subset of the nodes whose feature vectors preserve the spatial distribution of all the feature vectors. We apply the proposed approach to several popular benchmark data-sets and it is shown that the proposed geometrical approach strongly improves the state-of-the-art result for several data-sets. For instance, for the PTC data-set, the state-of-the-art result is improved for more than 22 %.

The authors argue that graph neural networks based on the message passing frameworks are not able to infer the topological structure of graphs. Therefore, they propose to use the node embedding features from DeepWalk as (additional) input for the graph convolution. Moreover, a graph pooling operator is proposed, which clusters node pairs in a greedy fashion based on the l2-distances between feature vectors. The proposed methods are evaluated on seven common benchmark datasets and achieve better or comparable results to existing methods. Moreover, the method is evaluated using synthetic toy examples, showing that the proposed extensions help to infer topological structures.
A main point of criticism is that the authors claim that graph convolution is not able to infer the topological structure of a graph when no labels are present. In fact the graph convolution operator is closely related to the Weisfeiler-Lehman heuristic for graph isomorphism testing and can distinguish most graphs in many practical application. Therefore, it is not clear why DeepWalk features would increase the expressive power of graph convolution. It should be stated clearly which structural properties can be distinguished using DeepWalk features, but no with mere graph convolution.
The example on page 4 provides only a weak motivation for the approach: The nodes v_1 and v_2 should be indistinguishable since they are generated using the same generator. Thus, the problem is the mean/max pooling, and not the graph convolution. When using the sum-aggregation and global add pooling, graphs with two clusters and graphs with three clusters are distinguishable again. Further insights how DeepWalk helps to learn more "meaningful" topological features are required to justify its use.
Clustering nodes that are close in feature space for pooling is a reasonable idea. However, this contradicts the intuition of clustering neighboring nodes in the graph. A short discussion of this phenomenon would strengthen the paper in my opinion.
There are several other questions that not been answered adequately in the article.
* The 10-fold cross validation is usually performed using an additional validation set. What kind of stopping criteria has bee use? * It would be helpful to provide standard deviations on these small datasets (although a lot of papers sadly dismiss them).
* I really like the use of synthetic data to show superior expressive power, but I am unsure whether this can be contributed to DeepWalk or the use of the proposed pooling operator (or both). Please divide the results for these toy experiments in "GEO-DEEP" and "GEO-deep no pooling". As far as I understand, node features in different clusters should be indistinguishable from each other (even when using DeepWalk), so I contribute this success to the proposed pooling operator.
* A visualization of the graphs obtained by the proposed pooling operator would be helpful. How do the coarsened graphs look like? Given that any nodes can end up in the same cluster, and the neighborhood is defined to be the union of the neighboring nodes of the node pairs, I guess coarsened graphs are quite dense.
* DiffPool (NIPS 2018, Ying et al.) learns assignment matrices based on a simple GCN model (and thus infers topological structure from message passing). How is the proposed pooling approach related to DiffPool (except that its non-differentiable)? How does it perform when using only the features generated by a GCN? How does it compare to other pooling approaches commonly used, e.g., Graclus? At the moment, it is quite hard to judge the benefits of the proposed pooling operator in comparison to others.
In summary, the paper presents promising experimental results, but lacks a theoretical justification or convincing intuition for the proposed approach. Therefore, at this point I cannot recommend its acceptance.
Minor remarks:
* p2: The definition of "neighbour set" is needless in its current form.
* p2: The discussion of graph kernels neglects the fact that many graph kernels compute feature vectors that can be used with linear SVMs.
-----------
Update:
The comment of the authors clarified some misunderstandings. I now agree that the combination of DeepWalk features and GNNs can encode more/different topological information. I still think that the paper does not make this very clear and does not provide convincing examples. I have update my score accordingly.


As deep neural networks have become the state of the art for solving complex reinforcement learning tasks, susceptibility to perceptual adversarial examples have become a concern. The transferability of adversarial examples is known to enable attacks capable of tricking the agent into bad states. In this work we demonstrate a simple poisoning attack able to keep deep RL from learning, and into fooling it when trained with defense methods commonly used for classification tasks. We then propose an algorithm called DadQN, based on deep Q-networks, which enables the use of stronger defenses, including defenses enabling the first ever on-line robustness certification of a deep RL agent.

The goal of this paper is to train deep RL agents that perform well both in the presence and absence of adversarial attacks at training and test time. To achieve this, this paper proposes using policy distillation. The approach, Distilled Agent DQN (DaDQN), consists of: (1) a "teacher" neural network trained in the same way as DQN, and (2) a "student" network trained with supervised learning to match the teacher’s outputs. Adversarial defenses are only applied to the student network, so as to not impact the learning of Q-values by the teacher network. At test time, the student network is deployed.
This idea of separating the learning of Q-values from the incorporation of adversarial defenses is promising. One adversarial defense considered in the paper is adversarial training -- applying small FGSM perturbations to inputs before they are given to the network. In a sense, the proposed approach is the correct way of doing adversarial training in deep RL. Unlike in supervised learning, there is no ground truth for the correct action to take. But by treating the teacher's output (for an unperturbed input) as ground truth, the student network can more easily learn the correct Q-values for the corresponding perturbed input.
The experimental results support the claim that applying adversarial training to DaDQN leads to agents that perform well at test time, both in the presence and absence of adversarial attacks. Without this teacher-student separation, incorporating adversarial training severely impairs learning (Table 2, DQN Def column). This separation also enables training the student network with provably robust training.
However, I have a few significant concerns regarding this paper. The first is regarding the white-box poisoning attack that this paper proposes, called Untargeted Q-Poisoning (UQP). This is not a true poisoning attack, since it attacks not just at training time, but also at test time. Also, the choice of adding the *negative* of the FGSM perturbation during training time is not clearly justified. Why not just use FGSM perturbations? The reason given in the paper is that this reinforces the choice of the best action w.r.t. the learned Q-values, to give the illusion of successful training -- but why is this illusion important, and is this illusion actually observed during training time? What are the scores obtained at the end of training? Table 1 only reports test-time scores.
In addition, although most of the paper is written clearly, the experiment section is confusing. I have the following major questions:
- What is the attack Atk (Section 4.3) -- is it exactly the same as the defense Def, except the perturbations are now stored in the replay buffer? Are attack and defense perturbations applied at every timestep?
- In Section 4.2, when UQP is applied, is it attacking both at training and at test time? Given the definition of UQP (Section 2.4), the answer would be yes. If that’s the case, then the "none" row in Table 1 is misleading, since there actually is a test time attack.
The experiments could also be more thorough. For instance, is the adversarial training defense still effective when the FGSM \epsilon used in test time attacks is smaller or larger? Also, how important is it that the student network chooses actions during training time, rather than the teacher network? An ablation study would be helpful here.
Overall, although the algorithmic novelty is promising, it is relatively minor. Due to this, and the weaknesses mentioned above, I don't think this paper is ready for publication.
Minor comments / questions:
- Tables 1 and 2 should report 95% confidence intervals or the standard error.
- It’s strange to apply the attack to the entire 4-stack of consecutive frames used (i.e., the observations from the last four timesteps); it would make more sense if the attack only affected the current frame.
- For adversarial training, what probability p (Section 3.2) is used in the experiments?
- In Section 4.2, what does “weighted by number of frames” mean?
- In which experiments (if any) is NoisyNet used? Section 4.1 mentions it is disabled, and \epsilon-greedy exploration is used instead. But I assume it’s used somewhere, because it’s described when explaining the DaDQN approach (Section 3.1).


We introduce a novel geometric perspective and unsupervised model augmentation framework for transforming traditional deep (convolutional) neural networks into adversarially robust classifiers. Class-conditional probability densities based on Bayesian nonparametric mixtures of factor analyzers (BNP-MFA) over the input space are used to design soft decision labels for feature to label isometry. Classconditional distributions over features are also learned using BNP-MFA to develop plug-in maximum a posterior (MAP) classifiers to replace the traditional multinomial logistic softmax classification layers. This novel unsupervised augmented framework, which we call geometrically robust networks (GRN), is applied to CIFAR-10, CIFAR-100, and to Radio-ML (a time series dataset for radio modulation recognition). We demonstrate the robustness of GRN models to adversarial attacks from fast gradient sign method, Carlini-Wagner, and projected gradient descent.

The paper is working on a robust classifier that consists of two stages. The first stage performs unsupervised conditional kernel density estimates (KDE) of the covariate vectors, and the second stage is feature extractions and classification. I appreciate the authors' efforts to clarify the intuition, but more technical details and experiments can be provided to support their arguments. My questions and comments are below.
1. Page 2. "this means the stochastic gradient descent training algorithm minimizing..." Is the problem because of SGD or the structure of NN? I think the reason might be the latter, consider logistic regression, which can be seen as a single-layer NN, does not suffer such a problem.
2. I know the KDE part is from an existing paper, but more technical details can make the paper clearer and some statements are questionable. Specifically, what basis vectors are used for (3)? Is it really speedy and scalable (Page 4, Section 3.1) for BNP-MFA if using Gibbs sampling? Is it the reason why the experiments in Table 1 is incomplete?
3. For Eqn (7), how do you calculate \beta's to "scale the correct class label higher than incorrect classes for the cases...?"
4. Is the proposed model robust to all kinds of attacks, like gradient based noise, and outliers which locates far away from the corresponding cluster?
5. Can you provide some experiments to show the advantage over other approaches?[1]
I highly encourage the use of BNP KDE which has many advantages as stated in the paper. But the authors may have to solve the problem of scalability and show advantages over other approaches.
[1]Uličný, Matej, Jens Lundström, and Stefan Byttner. "Robustness of deep convolutional neural networks for image recognition." International Symposium on Intelligent Computing Systems. Springer, Cham, 2016.


This paper puts forward a broad-spectrum improvement for reinforcement learning algorithms, which combines the policies using original rewards and inverse (negative) rewards. The policies using inverse rewards are competitive with the original policies, and help the original policies correct their mis-actions. We have proved the convergence of the inverse policies. The experiments for some games in OpenAI gym show that the hybrid polices based on deep Q-learning, double Q-learning, and on-policy actor-critic obtain the rewards up to 63.8%, 97.8%, and 54.7% more than the original algorithms. The improved polices are more stable than the original policies as well.

This paper proposes that, in addition to learning the normal action values, an RL agent should also learn the action values for an alternate “inverse” problem consisting of the same transitions as the original MDP and the negative of the original rewards. The intuitive argument is that the values for the inverse problem clearly identify what actions should not be taken. Results are presented on OpenAI Gym problems in which the new method performed better than conventional methods.
The paper is not yet ready for publication for many reasons. First, the idea is not presented clearly, and it is not clear why it ever could be sensible. The inverse problem has a different solution than the base problem. Its solution would appear to have an arbitrary relationship to the base problem’s solution. The two optimal policies may choose different actions, as suggested in the text, but this is not necessarily true; in some states the two policies may choose the same action. I don’t see how anything can be said in general, and no significant theoretical results are presented. (They do prove a form of convergence on the inverse problem, but this is not a new result; the inverse problem is just another problem and needs no new result.)
The new hybrid method is never fully explained (e.g., the reader has to guess at what Q^H is). But by combining the solutions to the base and inverse problems in some way, it seems inevitable that the final optimal policy would be changed. Suppose the function approximation is completely successful and the correct values are exactly found. Then those for the base problem would give the optimal policy. Any alteration of them by the correct action-value function for the inverse problem could only make them worse and could only cause them to produce worse (or the same) behavior. There is no room for improvement and so this technique could only make things worse asymptotically if the function approximation is completely successful. This is the only thing that I see that can be clearly said about the new technique, and of course it is not a good thing.
There are results presented, but they are not well done; they provide no significant evidence for any conclusion. The methods are not completely presented, and the results seem to be for a single run, in which case any relative ordering of the methods could be obtained.
Generally, the paper is unfortunately poorly written. The grammar is not good. The notation is unnecessarily complex and confusing. The citations are made in an unusual, poor way.


The committor function is a central object of study in understanding transitions between metastable states in complex systems. However, computing the committor function for realistic systems at low temperatures is a challenging task, due to the curse of dimensionality and the scarcity of transition data. In this paper, we introduce a computational approach that overcomes these issues and achieves good performance on complex benchmark problems with rough energy landscapes. The new approach combines deep learning, importance sampling and feature engineering techniques. This establishes an alternative practical method for studying rare transition events among metastable states of complex, high dimensional systems.

In response to the authors' rebuttal, I have increased my ratings accordingly. I strongly encourage the authors to include those ablative study results in the work. I also strongly recommend an ablative study on importance sampling so as to provide more quantitative results, in addition to Fig. 4. Finally, I hope the authors can consider more advanced importance sampling techniques and explore whether it helps you get better results in even higher dimensions.
=================================
This paper proposes several enhancements to a neural network method for computing committor functions so that it can perform better on rare events in high-dimensional space. The basic idea is using a variational formulation with Dirichlet-like boundary conditions to learn a neural committor function. The authors claim to improve a previous neural network based method by i) using a clever parameterization of the neural committor function so that it approximately satisfy the boundary condition; ii) bypassing the difficulty of rare events using importance sampling; and iii) using collective variables as feature engineering.
Generally I feel this paper is well written and easy to understand, without requiring too much background in physics and chemistry. The application is new to most people in the machine learning community. However,
the main contributions of this paper are empirical, and I found the experiments not very convincing. Here are my main concerns:
1. There is almost no ablation study. The parameterization of committor function satisfies the Dirichlet boundary condition, which is aesthetically pleasing. However, it's unclear how much this improves the regularization used in the previous method. Similarly, without importance sampling, will the results actually become worse? What changes if the collective variables are removed? There is even no comparison with the previous neural network based method on computing committor functions, though the authors cited it.
2. In the experiment on extended Mueller potentials, authors use the FEM results as the ground truth. However, it is not clear how accurate those FEM solutions are. Without this being clarified, it is unclear to me that the RMSE and MAE results in Table 1 are meaningful. Maybe try some simpler problem where the committor functions can be computed exactly?
3. In experiments the authors often argue that results will improve when networks become deeper. However, all network architectures used in the paper are narrow and shallow when viewed from the perspective of modern deep learning. If the authors want to stress this point, I would expect to see more experimental results on neural network architectures, where you vary the depth of the network and report the change of results.
4. "Then we use the result as the initial network to compute the committor function at T = 300K" => Did you first train a neural committor on samples of T = 800K and use its weights as initialization to the neural committor for T = 300K? Please clarify this more.
5. Finally, I think the importance sampling technique proposed in this paper can be improved by other methods, such as annealed importance sampling. The largest dimension tested in this paper is only 66, which is still fairly small in machine learning, and I don't expect the vanilla importance sampling can work in higher dimensions.


CAVEATS FOR INFORMATION BOTTLENECK IN DETERMINISTIC SCENARIOS
Information bottleneck (IB) is a method for extracting information from one random variable X that is relevant for predicting another random variable Y . To do so, IB identifies an intermediate "bottleneck" variable T that has low mutual information I(X; T ) and high mutual information I(Y ; T ). The IB curve characterizes the set of bottleneck variables that achieve maximal I(Y ; T ) for a given I(X; T ), and is typically explored by maximizing the IB Lagrangian, I(Y ; T ) − βI(X; T ). In some cases, Y is a deterministic function of X, including many classification problems in supervised learning where the output class Y is a deterministic function of the input X. We demonstrate three caveats when using IB in any situation where Y is a deterministic function of X: (1) the IB curve cannot be recovered by maximizing the IB Lagrangian for different values of β; (2) there are "uninteresting" trivial solutions at all points of the IB curve; and (3) for multi-layer classifiers that achieve low prediction error, different layers cannot exhibit a strict trade-off between compression and prediction, contrary to a recent proposal. We also show that when Y is a small perturbation away from being a deterministic function of X, these three caveats arise in an approximate way. To address problem (1), we propose a functional that, unlike the IB Lagrangian, can recover the IB curve in all cases. We demonstrate the three caveats on the MNIST dataset.

This paper is about issues that arise when applying Information Bottleneck (IB) concepts to machine learning, more precisely in deterministic supervised learning such as classification (deterministic in the sense that the target function to estimate is deterministic: it associates each example to one true label only, and not to a distribution over labels).
Namely:
(1) the "Information Bottleneck curve" cannot be computed with the Information Bottleneck Lagrangian approach (because of optimization landscape issues: optimization of such a piecewise-linear function with a linear penalty will always yield the same optimum whatever the slope of the penalty is [same story as L1 vs. L0]);
(2) there are many solutions to the optimization of the IB Lagrangian for any given compression/performance ratio (i.e. for any given beta in the IB Lagrangian method: I(Y,T)/I(X,T)) and some of them are provably trivial; thus optimizing just the IB Lagrangian does not imply that the solution will be interesting, and better (or complementary) criteria are needed.
Another point discussed also is about the successive layers of perfect classifiers (neural networks), in which I(Y,T) remains constant while I(X,T) decreases.
Pros:
- the paper is well written, mostly self-contained, and easy to read (for someone familiar with information theory);
- all mathematical points are detailed and well explained, with sufficient introduction;
- the writing is compact, the paper is dense, and given the page limit this is a good information/compression compromise;)
- information bottleneck is a topic of prime interest in the community these days;
- the two first problems described ((1) and (2)) are original, interesting contributions to the field, of particular interest for people interested in applying information bottleneck concepts to supervised learning;
- the solution brought to the IB Lagrangian issues is simplistic though efficient (squaring I(X,T) so that it's not linear in I(X,T) anymore).
Cons:
- not much.
Remarks:
- there exist recent papers tackling the information bottleneck concept for neural networks from a variational perspective, which enables them to compute exactly the mutual informations (such as "Compressing Neural Networks using the Variational Information Bottleneck" by Dai & al., ICML 2018); I have not seen these papers cited in the article, nor discussed (nor used); I feel it would be appropriate, either in the general literature section, either for discussing how to compute in practice the mutual informations (exact values vs. estimates or lower bounds as here).
- at first reading, I had found the tone of the beginning of the paper (first section) a bit aggressive, though this feeling disappeared later. Maybe rephrase some expressions that might be wrongly perceived?
- About multilabel classification (end of section 2): multilabel classification can still be seen as with deterministic expected outputs, if considered as a task from X to P(Y) (power set of Y, i.e. set of all possible subsets of labels).
- As in practice T is constrained to belong to a particular space of functions (neural network layer with predefined architecture): how does this impact the study? For instance the T_alpha in equation (5) are not reachable anymore; the optimization space for the IB Lagrangian is different; etc. Which properties/conclusions can be kept, and which ones cannot?
- What about sampling on the other part of the IB curve, the horizontal one (same I(Y,T) for various I(X,T))? Would it bring any insight, and how to do it?
- A side remark about applying IB to neural networks: What about neural networks that are not a "linear" chain of layers (i.e. most networks now)? i.e. Inception, ResNet, U-nets, etc., where computational flows are parallel, sometimes keeping full information till the end. For instance in a U-net, meant for image processing, features computed at the beginning at a full pixelic resolution are communicated to the last layer. This is not an image classification task though, as predictions are made for each pixel; still, given an input image X, there is only one correct output Y, so, still in the deterministic supervised classification problem.


BENCHMARKING NEURAL NETWORK ROBUSTNESS TO COMMON CORRUPTIONS AND PERTURBATIONS
In this paper we establish rigorous benchmarks for image classifier robustness. Our first benchmark, IMAGENET-C, standardizes and expands the corruption robustness topic, while showing which classifiers are preferable in safety-critical applications. Then we propose a new dataset called IMAGENET-P which enables researchers to benchmark a classifier's robustness to common perturbations. Unlike recent robustness research, this benchmark evaluates performance on common corruptions and perturbations not worst-case adversarial perturbations. We find that there are negligible changes in relative corruption robustness from AlexNet classifiers to ResNet classifiers. Afterward we discover ways to enhance corruption and perturbation robustness. We even find that a bypassed adversarial defense provides substantial common perturbation robustness. Together our benchmarks may aid future work toward networks that robustly generalize.

This paper introduces new benchmarks for measuring the robustness of computer vision models to various image corruptions. In contrast with the popular notion of “adversarial robustness”, instead of measuring robustness to small, worst-case perturbations this benchmark measures robustness in the average case, where the corruptions are larger and more likely to be encountered at deployment time. The first benchmark “Imagenet-C” consists of 15 commonly occurring image corruptions, ranging from additive noise, simulated weather corruptions, to digital corruptions arising from compression artifacts. Each corruption type has several levels of severity and overall corruption score is measured by improved robustness over a baseline model (in this case AlexNet). The second benchmark “Imagenet-P” measures the consistency of model predictions in a sequence of slightly perturbed image frames. These image sequences are produced by gradually varying an image corruption (e.g. gradually blurring an image). The stability of model predictions is measured by changes in the order of the top-5 predictions of the model. More stable models should not change their prediction to minute distortions in the image. Extensive experiments are run to benchmark recent architecture developments on this new benchmark. It’s found that more recent architectures are more robust on this benchmark, although this gained robustness is largely due to the architectures being more accurate overall. Some techniques for increasing model robustness are explored, including a recent adversarial defense “Adversarial Logit Pairing”, this method was shown to greatly increase robustness on the proposed benchmark. The authors recommend future work benchmark performance on this suite of common corruptions without training on this corruptions directly, and cite prior work which has found that training on one corruption type typically does not generalize to other corruption types. Thus the benchmark is a method for measuring model performance to “unknown” corruptions which should be expected during test time.
In my opinion this is an important contribution which could change how we measure the robustness of our models. Adversarial robustness is a closely related and popular metric but it is extremely difficult to measure and reported values of adversarial robustness are continuously being falsified [1,2,3]. In contrast, this benchmark provides a standardized and computationally tractable benchmark for measuring the robustness of neural networks to image corruptions. The proposed image corruptions are also more realistic, and better model the types of corruptions computer vision models are likely to encounter during deployment. I hope that future papers will consider this benchmark when measuring and improving neural network robustness. It remains to be seen how difficult the proposed benchmark will be, but the authors perform experiments on a number of baselines and show that it is non-trivial and interesting. At a minimum, solving this benchmark is a necessary step towards robust vision classifiers.
Although I agree with the author’s recommendation that future works not train on all of the Imagenet-C corruptions, I think it might be more realistic to allow training on a subset of the corruptions. The reason why I mention this is it’s unclear whether or not adversarial training should be considered as performing data augmentation on some of these corruptions, it certainly is doing some form of data augmentation. Concurrent work [4] has run experiments on a resnet-50 for Imagenet and found that Gaussian data augmentation with large enough sigma (e.g. sigma = .4 when image pixels are on a [0,1] scale) does improve robustness to pepper noise and Gaussian blurring, with improvements comparable to that of adversarial training. Have the authors tried Gaussian data augmentation to see if it improves robustness to the other corruptions? I think this is an important baseline to compare with adversarial training or ALP.
Few specific comments/typos:
Page 2 “l infinity perturbations on small images”
The (Stone, 1982) reference is interesting, but it’s not clear to me that their main result has implications for adversarial robustness. Can the authors clarify how to map the L_p norm in function space of ||T_n - T(theta) || to the traditional notion of adversarial robustness?
1. https://arxiv.org/pdf/1705.07263.pdf
2. https://arxiv.org/pdf/1802.00420.pdf
3. https://arxiv.org/pdf/1607.04311.pdf
4. https://openreview.net/forum?id=S1xoy3CcYX&noteId=BklKxJBF57


Memorization of data in deep neural networks has become a subject of significant research interest. In this paper, we link memorization of images in deep convolutional autoencoders to downsampling through strided convolution. To analyze this mechanism in a simpler setting, we train linear convolutional autoencoders and show that linear combinations of training data are stored as eigenvectors in the linear operator corresponding to the network when downsampling is used. On the other hand, networks without downsampling do not memorize training data. We provide further evidence that the same effect happens in nonlinear networks. Moreover, downsampling in nonlinear networks causes the model to not only memorize just linear combinations of images, but individual training images. Since convolutional autoencoder components are building blocks of deep convolutional networks, we envision that our findings will shed light on the important phenomenon of memorization in over-parameterized deep networks.

Summary:-
The authors investigates downsampling as one method by which autoencoding CNNs may memorize data. The theoretical motivation provided concentrates on linear CNNs. They show that downsampling linear CNNs tent to learn a point-map of the training data, even though (under certain initializations) they are capable of learning identity maps. However, non-downsampling linear CNNs learn identity maps. Given enough data however, the authors claim that the downsampling CNN will learn the identity map.
Strengths:-
+ Authors present a good exploration of how linear CNNs memorize data when they do downsampling.
+ A theoretical prediction of the amount of training data needed to counteract data memorization for downsampling linear CNNs is provided, "Our conjecture also implies that when training a linear downsampling CNN on images of size 3 · 224 · 224, which corresponds to the input image size for VGG and ResNet (He et al. (2016), Simonyan & Zisserman (2015)), the number of linearly independent training examples needs to be at least 3 · 224 · 224 = 153, 228 before the network can learn the identity function."
Weaknesses:-
+ Not enough theoretical proof is provided to support the hypothesis. Which would be fine but some key experiments are missing to make the paper empirically rigorous.
++ Would be good to see experiments that illustrate the predication that a certain amount of data would allow for learning identity maps, both for linear and non-linear CNNs.
++ In the non-linear CNN setting, I'd like to see the same early-stopping experiment done for linear CNNs whose results are in Fig. 3. I don't see any obvious theoretical reason why that result form Fig. 3 must extend to the non-linear setting.
+ Initializations are pointed to as effecting the type of function the network learns. The authors give an example of a hand-designed initialization that allows a downsampling linear CNN to learn the identity map but they don't explain how they arrived at this initialization, or its properties that make it a good initialization. In general however, I think it's alright to assign exploration of effect of initialization to future work, since it seems like a non-trivial task.
+ It is mentioned that "the results are not observed for linear networks when using Kaiming initialization," which I read to mean the downsampling linear CNNs with Kaiming initialization learn the identity map, not point-map. If this is true, it seems like a vital point and should be included in discussions of future work.
Recommendation:  I think this could be a better short paper. There are some interesting contributions, but maybe not enough for a full length paper. For a full length paper, some further exploration of _why_ downsampling leads to (if indeed there is a causality) data memorization is needed.
Minor stuff:-
Citation "Gunasekar et al." is missing year (conclusions section)


We show that if the usual training loss is augmented by a Lipschitz regularization term, then the networks generalize. We prove generalization by first establishing a stronger convergence result, along with a rate of convergence. A second result resolves a question posed in Zhang et al. (2016): how can a model distinguish between the case of clean labels, and randomized labels? Our answer is that Lipschitz regularization using the Lipschitz constant of the clean data makes this distinction. In this case, the model learns a different function which we hypothesize correctly fails to learn the dirty labels.

The paper gives convergence guarantees to the true neural network classifier for the networks that are explicitly regularizing the (exact) Lipschitz constant of the network. The bound stated decays as ( log(n)/n )^{1/m}, where n is the number of training points and m is the dimension of the data manifold. Thus the decay rate is pretty slow when the data lies on a high-dimensional manifold. I believe it should also depend on the volume of the data manifold.
Computing the exact Lipschitz constant of the network is intractable. All the theorems apply to minimization problem defined in (1) with the exact Lip(u,X) being regularized, and not to the minimization problem of the lower bound (2). I believe there are also no convergence guarantees how quickly this lower bound on the Lipschitz constant approaches Lip(u,X), unless some assumptions are made on the smoothness of the data manifold (comments and insights would be appreciated). Thus in my opinion the current results have little practical importance. Nevertheless, it’s still interesting to see some ideal-setting guarantees being established.
Theorem 2.7: Is m == m_0 (the dimension of the data manifold)? Shouldn’t the bound be 2*C*L_0….? (assuming lemma 2.9 is correct)
Cor 2.8: Where does the volume Vol(M) of the manifold disappear? Is C in equation (6) the same C as in Theorem 2.7? Also, it looks like the bound should bound should have C^2 (assuming theorem 2.7 is correct, and the C’s are the same).
Introduction: I assume u(x,w) is not the last layer map, but a map from the input space to the labels (i.e., the whole neural network function and not just the map from the last hidden layer to the labels). If I am correct, it’s misleading to refer to u(x,w) as the last layer map. And if it is the last layer map, please justify why it is enough to consider the Lipschitz constant of the last layer.
The term “clean data” is never defined. My guess is that “clean data” refers to the realizable  setting, and “noisy” to agnostic, where the hypothesis space consist of neural networks of arbitrary size.
“Our analysis can avoid the dependence on the weights because we make the assumption that there are enough parameters so that u can perfectly fit the training data. The assumption is justified by Zhang et al. (2016).”
Note, that the network used in practice achieve zero classification error, as demonstrated by Zhang et al, but I doubt the cross entropy loss (that is usually being minimized) is exactly zero.
Remark 1.4 “will result in an expected loss..”  (there is also a typo here) should specify that you are talking about empirical error (0-1 loss), since I don’t think the loss function is fixed anywhere earlier in the text.
Remark 2.2 : Just wanted to note, that it is more common to call L(u,\rho) risk. The gap between L(u,\rho) and the empirical risk L(u,\rho_n) is usually called the generalization error (and only in the case of zero empirical risk, L(u,\rho) is equal to the generalization error). I did check the reference in Goodfellow et al. book, and I see that it is consistent with your definition.
Just below Remark 2.2:
“We would also expect the sequence of generalization losses L[u_n ; \rho] to converge to zero in the case of perfect generalization.”
Once again, this is true only in the realizable setting.
Could the authors comment on the connection to Cranko et al. 2018 work?
Typos:
In the abstract, no which: “..corrupted labels which we prove convergence to...”
“...a candidate measure for the Rademacher complexity, which a measure of generalization...”.
“1-Lipschitz networks with are also important for Wasserstein-GANs”
Section 2.1 “is it clear that u0, is a solution of “, should be “it is”
---------
[UPDATE]
Regarding the comment "Our paper resolves the question posed in ICLR Best paper 2017 "Understanding deep learning requires rethinking generalization"", I don't think that analyzing networks with explicit regularization resolves the questions stated in Zhang et al paper. As other reviewers mentioned, there are a number of other papers that formally define quantities that correlate with the generalization error, and are larger for random vs true labels. There are also other papers showing that one can tune some parameters of the optimization algorithm to avoid overfitting on random labels (while it is a modification to the algorithm, it is still similar to explicitly regularizing the Lipschitz constant of the network) (see e.g., Dziugaite et al work on SGLD).
Therefore, the claim in the abstract "A second result resolves a question posed in Zhang et al. (2016): how can a model distinguish between the case of clean labels, and randomized labels?" needs to be toned down a bit.
In my opinion, the work presented in this paper is a valuable contribution to learning theory. The new version of the paper is easy to read. Therefore, I recommend acceptance if the authors change the claim about resolving  the questions posed by Zhang et al.
Another typo:
 - for convergence, we require that the network also grow(s),


Empirical evidence suggests that neural networks with ReLU activations generalize better with over-parameterization. However, there is currently no theoretical analysis that explains this observation. In this work, we study a simplified learning task with over-parameterized convolutional networks that empirically exhibits the same qualitative phenomenon. For this setting, we provide a theoretical analysis of the optimization and generalization performance of gradient descent. Specifically, we prove data-dependent sample complexity bounds which show that overparameterization improves the generalization performance of gradient descent.

The paper studies a particular task (the XOR detection problem) in a particular setup (see below), and proves mathematically that in that case, the training performs better when the number of features grows.
The task is the following one:
- consider a set of pairs of binary values (-1 or +1);
- detect whether at least one of these pairs is (+1, +1) or (-1, -1).
The design of the predictor is:
- for each pair, compute 2k features (of the form ReLu(linear combination of the values, without bias));
- compute the max over all pairs of these features (thus obtaining 2k values);
- return the k first values minus the k last ones.
The training set consists only of examples having the following property [named 'diversity']:
- if the example (which is a set of pairs) is negative (i.e. doesn't contain (+1,+1) nor (-1,-1)), then it contains both (-1,1) and (1,-1);
- if the example is positive, it contains all possible pairs.
The paper proves that, under this setup, training with a number of features k > 120 will perform better than with k = 2 only (while k = 2 is theoretically sufficient to solve the problem). While tackling an interesting problem (impact of over-parameterization), the proof is specific to this particular, unusual architecture, with a "max - max" over features independently computed for each pair that the example contains; it relies heavily on the fact that the input are binary, and that the number of possible input pairs is small (4), which implies that the features can take only 4 values. Note also that the probabilities in some theorems are not really probabilities of convergence/performance of the training algorithm per se (as one would expect in such PAC-looking bounds), but actually probabilities of the batch of examples to all satisfy some property (the diversity).
Thus it is difficult to get from this study any insight about the over-parameterization / training ability phenomenon, for more general tasks, datasets or architectures.
Though clearly an impressive amount of work has been done in this proof, I do not see how it can be generalized (there is no explanation in the paper in that regard either, while it would have been welcomed), and consequently be of interest for the vast majority of the ICLR community, which is why I call for rejection.


ACCELERATING NONCONVEX LEARNING VIA REPLICA EXCHANGE LANGEVIN DIFFUSION
Langevin diffusion is a powerful method for nonconvex optimization, which enables the escape from local minima by injecting noise into the gradient. In particular, the temperature parameter controlling the noise level gives rise to a tradeoff between "global exploration" and "local exploitation", which correspond to high and low temperatures. To attain the advantages of both regimes, we propose to use replica exchange, which swaps between two Langevin diffusions with different temperatures. We theoretically analyze the acceleration effect of replica exchange from two perspectives: (i) the convergence in χ 2 -divergence, and (ii) the large deviation principle. Such an acceleration effect allows us to faster approach the global minima. Furthermore, by discretizing the replica exchange Langevin diffusion, we obtain a discrete-time algorithm. For such an algorithm, we quantify its discretization error in theory and demonstrate its acceleration effect in practice.

PROS:
- The text is very well written, with a good balance between mathematical details and intuitions.
- I really like the high-level description of the algorithms and proof techniques
CONS:
to be completely honest, I am not sure I have learnt anything new from the paper.
1) the proof techniques are very standard
2) although there must be some small innovations, I thought that all the results had more or less been proven by Dupuis and co-authors:
a. large deviation principles
b. the larger the swapping rate, the better (which motivated Dupuis & al to consider the infinite swapping limit.)
and
c. Bakri & al methodology to prove convergence relying on the carre du champ is by now very standard and the proofs of the paper are only minor adaptations.
I must probably be missing something, and I encourage the authors to clarify what the main novelties are when compared to the several papers by Dupuis & al.
REMARKS:
1) I do not really understand the emphasis on optimisation while all the proofs are related to the convergence to the stationary distributions.


We introduce an analytic distance function for moderately sized point sets of known cardinality that is shown to have very desirable properties, both as a loss function as well as a regularizer for machine learning applications. We compare our novel construction to other point set distance functions and show proof of concept experiments for training neural networks end-to-end on point set prediction tasks such as object detection.

This paper proposes a new loss for points registration (aligning two point sets) with preferable permutation invariant property. For a 2D point set, the idea is to define a complex polynomial with the points (interpreted as complex numbers) as roots. To compare two point sets, the loss eventually boils down to evaluating the complex polynomial at all target points. The loss can be extended to high-dimensional point sets without the same theoretical framework. It is a sum over each target point the product of the distance of between the target point and all points of the source set. The claimed advantage of the proposed distance is it is more efficient compare to other metric such as Hausdorff distance or the sum of squared distance between matched point pairs (SMD). Experiments show that the proposed loss can be used in training.
The idea is interesting and new. However, the paper has a lot of room to improve. Here are a few specific issues that can be addressed in future version:
1) It is unclear what the advantage of the new idea is. I agree it leads to strong gradients compared to Hausdorff distance. However, this way of pulling all points to all points may also be very inefficient, as each point can get pulled toward all target points. These forces can easily cancel each other.
2) As already hinted in the paper, the gradient can be extremely unstable numerically. There is not any solution to address this issue.
3) Experimental results do not show the proposed method has any advantage over others. Also important loss such as the Wasserstein distance should be considered and compared with.


OVERCOMING THE DISENTANGLEMENT VS RECON- STRUCTION TRADE-OFF VIA JACOBIAN SUPERVISION
A major challenge in learning image representations is the disentangling of the factors of variation underlying the image formation. This is typically achieved with an autoencoder architecture where a subset of the latent variables is constrained to correspond to specific factors, and the rest of them are considered nuisance variables. This approach has an important drawback: as the dimension of the nuisance variables is increased, image reconstruction is improved, but the decoder has the flexibility to ignore the specified factors, thus losing the ability to condition the output on them. In this work, we propose to overcome this trade-off by progressively growing the dimension of the latent code, while constraining the Jacobian of the output image with respect to the disentangled variables to remain the same. As a result, the obtained models are effective at both disentangling and reconstruction. We demonstrate the applicability of this method in both unsupervised and supervised scenarios for learning disentangled representations. In a facial attribute manipulation task, we obtain high quality image generation while smoothly controlling dozens of attributes with a single model. This is an order of magnitude more disentangled factors than state-of-the-art methods, while obtaining visually similar or superior results, and avoiding adversarial training 1 .

Summary: The paper proposes a method to tackle the disentanglement-reconstruction tradeoff problem in many disentangling approaches. This is achieved by first training the teacher autoencoder (unsupervised or supervised) that learns to disentangle the factors of variation at the cost of poor reconstruction, and then distills these learned representations into a student model with extra latent dimensions, where these extra latents can be used to improve the reconstructions of the student autoencoder compared to the teacher autoencoder. The distillation of the learned representation is encouraged via a novel Jacobian loss term that encourages the change in reconstructions of the teacher and student to be similar when the latent representation changes. There is one experiment for progressive unsupervised disentangling (disentangling factor by factor) on MNIST data, and one experiment for semi-supervised disentangling on CelebA-HQ.
Pros:
- I think the idea of progressively capturing factors of variation one by one is neat, and this appears to be one of the first successful attempts at this problem.
- The distillation appears to work well on the MNIST data, and does indeed decrease the reconstruction loss of the student compared to the teacher.
- The qualitative results on CelebA-HQ look strong (especially apparent in the video), with the clear advantage over Fader Networks being that the proposed model is a single model that can manipulate the 40 different attributes, whereas Fader Nets can only deal with at most 3 attributes per model.
Cons:
- There are not enough quantitative results supporting the claim that the model is “effective at both disentangling and reconstruction.” The degree of disentanglement in the representations is only shown qualitatively via latent interpolation, and only for a single model. Such qualitative results are generally prone to cherry-picking and it is difficult to reliably compare different disentangling methods in this manner. This calls for quantitative measures of disentanglement. Had you used a dataset where you know the ground truth factors of variation (e.g. dSprites/2D Shapes data) for the unsupervised disentangling method, then the level of disentanglement in the learned representations could be quantified, and thus your method could be compared against unsupervised disentangling baselines. For the semi-supervised disentanglement example on CelebA, you could for example quantify how well the encoder predicts the different attributes (because there is ground truth here) e.g. report RMSE of the y_i’s on a held out test set with ground truth. A quantitative comparison with Fader Networks in this manner appears necessary. The qualitative comparison on a single face in Figure 5 is nowhere near sufficient.
- There is quantitative evidence that the reconstruction loss decreases when training the student, but here it’s not clear whether this quantitative difference makes a qualitative difference in the reconstructions. Getting higher fidelity images is one of the motivations behind improving reconstructions, so It would be informative to compare the reconstructions of the teacher and the student on the same image.
- In the CelebA experiments, the benefit of student training is not visible in the results. In Figure 5 you already show that the teacher model gives decent reconstructions, yet you don’t show the reconstruction for the student model (quantitatively you show that it improves in Figure 3b, but again it is worth checking if it makes a difference visually). Also it’s not clear whether Figure 4 are results from the student model or the teacher model. I’m guessing that they are from the student model.
- These quantitative results could form the basis of doing ablation studies for each of the different losses in the additive loss (for both unsupervised & semi-supervised tasks). Because there are many components in the loss, with a hyperparameter for each, it would be helpful to know what losses the results are sensitive to for the sake of tuning hyperparameters. This would be especially useful should I wish to apply the proposed method to a different dataset.
- I think the derivation of the Jacobian loss requires some more justification. The higher order terms in the Taylor expansion in (2) and (3) can only be ignored when ||y_2 - y_1|| is small compared to the coefficients, but there is no validation/justification regarding this.
Other Qs/comments:
- On page 5 in the last paragraph of section 3, you say that “After training of the student with d=1 is finished, we consider it as the new teacher”. Here do you append z to y when you form the new teacher?
- On page 6 in the paragraph for prediction loss, you say “This allows the decoder to naturally …. of the attributes”. I guess you mean this allows the model to give realistic interpolations between y=-1 and 1?
- bottom of page 6: “Here we could have used any random values in lieu of y_2” <- not sure I understand this?
- typo: conditionnning -> conditioning
- I would be inclined to boost the score up to 7 if the authors include some quantitative results along with more thorough comparisons to Fader Networks
************ Revision ***********
The authors' updates include further quantitative comparisons to Fader Networks and ablation studies for the different types of losses, addressing the concerns I had in the review. Hence I have boosted up my score to 7.


THERE ARE MANY CONSISTENT EXPLANATIONS OF UNLABELED DATA: WHY YOU SHOULD AVERAGE
Presently the most successful approaches to semi-supervised learning are based on consistency regularization, whereby a model is trained to be robust to small perturbations of its inputs and parameters. To understand consistency regularization, we conceptually explore how loss geometry interacts with training procedures. The consistency loss dramatically improves generalization performance over supervisedonly training; however, we show that SGD struggles to converge on the consistency loss and continues to make large steps that lead to changes in predictions on the test data. Motivated by these observations, we propose to train consistencybased methods with Stochastic Weight Averaging (SWA), a recent approach which averages weights along the trajectory of SGD with a modified learning rate schedule. We also propose fast-SWA, which further accelerates convergence by averaging multiple points within each cycle of a cyclical learning rate schedule. With weight averaging, we achieve the best known semi-supervised results on CIFAR-10 and CIFAR-100, over many different quantities of labeled training data. For example, we achieve 5.0% error on CIFAR-10 with only 4000 labels, compared to the previous best result in the literature of 6.3%.

This paper proposes to apply Stochastic Weight Averaging to the semi-supervised learning context. It makes an interesting argument that the semi-supervised MT/Pi models are especially amenable to SWA since they are empirically observed to traverse a large flat region of the weight space during the later stages of training. To speed up training, the authors propose fast-SWA.
Secition 3.2 is a little confusing.
- If a random direction is, with high probability, not penalized, then why is it so flat along a random direction? Or is this simply an argument for why it is not guaranteed to be penalized, and therefore adversarial rays exist? I think the claim needs to be more precise (though it remains unclear how accurate the claim would be).
- I also think that there is maybe something special about measuring the SGD-SGD ray at epochs 170/180. It coincides with the regime of training where the signal is dominated by the consistency loss. Is it possible this somehow induces a near-linear path in the parameter space? I would be interested in seeing projections of other epoch’s SGD-SGD (e.g. 170/17x) vectors onto the 170/180 SGD-SGD ray and the extend to which they are co-linear.
- It is also striking that traversing the SGD-SGD ray causes an error rate so similar to the adversarial ray for the supervised model; can the authors explain this phenomenon?
- All this being said, I find the diversity argument compelling---though what would happen if we train the model even longer? Does it keep exploring?
- Overall, I am not sure how comfortable we should be with interpreting the SGD-SGD ray results. It is important that the authors provide a convincing argument for the interpretability of the SGD-SGD ray results, as this appears to be the key to the “large flat region” claim.
I think Mandt’s paper should be cited in-text, since this is what motivates Figure 2d.
Is the benefit of Fast-SWA’s fast convergence (to a competitive/better solution than SWA) unique to semi-supervised learning? Or can it be demonstrated by fully-supervised learning too? Given the focus on the semi-supervised regime, I would prefer if what the authors are proposing is, in some sense, special to the semi-supervised regime.
Table 1 is confusing to read. I just want to see a comparison between with and without using fast-SWA, *with all else kept equal*. Is the intention to compare “Previous Best CNN” and “Ours CNN”? Is this a fair comparison?
Pros:
+ Interesting story
+ Good empirical performance
Cons:
- Unclear whether the story is entirely correct
If the authors can provide a convincing case for the interpretability of the SGD-SGD results, I am happy to raise my score.