The recently proposed BERT (Devlin et al., 2019) has shown great power on a variety of natural language understanding tasks, such as text classification, reading comprehension, etc. However, how to effectively apply BERT to neural machine translation (NMT) lacks enough exploration. While BERT is more commonly used as fine-tuning instead of contextual embedding for downstream language understanding tasks, in NMT, our preliminary exploration of using BERT as contextual embedding is better than using for fine-tuning. This motivates us to think how to better leverage BERT for NMT along this direction. We propose a new algorithm named BERT-fused model, in which we first use BERT to extract representations for an input sequence, and then the representations are fused with each layer of the encoder and decoder of the NMT model through attention mechanisms. We conduct experiments on supervised (including sentence-level and document-level translations), semi-supervised and unsupervised machine translation, and achieve state-of-the-art results on seven benchmark datasets. Our code is available at an anonymous Github page https://github.com/bert-nmt/bert-nmt.

The paper proposes an approach to incorporate BERT pretrained sentence representations within a NMT architecture.
It shows that simply pretraining the encoder of a NMT model with BERT does not necessarily provide gains (and can even be detrimental) and proposes instead to add a new attention mechanism, both in the encoder and in the decoder. The modification is relatively simple, but provides significant improvements in supervised and unsupervised MT, although it makes the model slower and computationally more expensive. The paper contains a lot of experiments, and a detailed ablation study.
===
I'm very surprised by the results in Table 1, i.e. the fact that pretraining can decrease the performance significantly. The provided explanation "Our conjecture is that the XLM model is pre-trained on news data, which is out-of-domain for IWSLT dataset mainly about spoken languages" is not satisfactory to me. The domain mismatch is also there in the majority of GLUE tasks, SQUAD, etc. and yet pretraining with BERT significantly improves the performance on these tasks. When the encoder is pretrained with a BERT/XLM model, I assume the encoder is not frozen, but finetuned?
The description of the algorithm in Section 4 could be simplified a lot I feel. Overall, the attention in the encoder is simply replaced by two attention layers: one over the previous layer like in a standard setting, and one on top of the BERT representation. Also I don't understand why the attention over the BERT sequence is also necessary in the decoder. Shouldn't this information already be captured by the encoder output?
The Drop-Net Trick is interesting. But the fact that 1.0 gives the best performance (Section 6.2) is very unintuitive to me. This means that the model will never consider the setting with two attentions at training time, although this is what it does at test time.
In Table 6, you propose experiments with 12 and 18 layers for fair comparison, because as you mention, your model with BERT-fused has more parameters. But IWSLT is a very small dataset and it would have been surprising that using 18 layers actually helps (overfitting is much more likely in that setting). Instead, I think something like an ensemble model would be a more fair comparison. In fact, the BERT-fused is essentially an ensemble model of the encoder.
Could you try the following experiment on IWSLT, where you do not pretrain the BERT model with the BERT objective, but with a NMT encoder trained in a regular supervised setting (i.e. do not reload a BERT model, but a NMT encoder that you previously trained without the fused architecture)?
Overall, I think the gains are nice, but I would really like to see the comparison I mentioned just above, and comparisons with ensemble models. The proposed model is significantly larger / slower than the baseline models considered, and I wonder if you could not achieve the same gains with ensemble models.
Something I like about the approach is that is it quite generic in the sense that you can provide any external sequence of vectors as input to your encoder. As a result, it is possible to leverage a model pretrained with a different tokenization. Tokenization is often an issue with pretraining in NLP (how do you leverage a model trained without BPE if you actually want to use BPE in your new model). The proposed approach does not has this constraint and I think this is something you should highlight more in the paper.
===
Small details in the related work section:
- I would cite "Sutskever et al, 2014" for the LSTM encoder, along with "Hochreiter & Schmidhuber", and not only "Wu et al, 2016"
- Removing the NSP task was proposed in "Lample & Conneau, 2019", not in "Liu et al, 2019"


Generative adversarial nets (GANs) have been successfully applied to the artificial generation of image data. In terms of text data, much has been done on the artificial generation of natural language from a single corpus. We consider multiple text corpora as the input data, for which there can be two applications of GANs: (1) the creation of consistent cross-corpus word embeddings given different word embeddings per corpus; (2) the generation of robust bag-of-words document embeddings for each corpora. We demonstrate our GAN models on real-world text data sets from different corpora, and show that embeddings from both models lead to improvements in supervised learning problems.

The paper proposes to use Generative Adversarial Networks (GANs) in the context of natural language processing and introduces two models for generating document embeddings. The first model, weGAN, aggregates multiple sets of single-corpus word2vec embeddings into one set of cross-corpus word representations; document embeddings are a function of these updated word embeddings. The second model, deGAN, side-steps word-level embeddings and directly generates document-level representations. For both models, the real examples come from word2vec and tf-idf, while the artificial examples are the ones generated by the network. The authors show that their document embeddings are better than the word2vec/tf-idf baseline at clustering documents according to the corpus they originate from.
While the context in which GANs are used is novel and creative, the reasons for rejection outweigh the positives. The main reason is the fact that the paper is outdated by two/three years. There is no mention of the shift towards contextual embeddings that has been happening in the last few years (InferSent, ELMo, BERT) and that became ubiquitous in NLP.  Instead, all comparisons are against word2vec (published in 2013) that is no longer a relevant baseline, even for non-contextual word embeddings. In fact, the newest cited papers are from 2017. The Github link in the paper was last updated on 23rd December 2017. My objection is not that this work was started a long time ago, but that it has not been updated in years. In the lack of proper comparison against more novel techniques, it is hard to estimate whether the reported gains over word2vec are meaningful.
Another argument for rejection is the fact that the experimental section does not make a convincing case that the positive results matter beyond the very specific datasets and tasks selected.
Before commenting in more detail on the selection of datasets, tasks and metrics, I want to document my understanding of the experimental setup; I found it non-trivial to understand what constitutes a "single corpus" in the experiments. My mental model is the following: the paper operates on four datasets (CNN, TIME, 20 Newsgroups, and Reuters-21578). These are four different experiments, and the four datasets never interact. The cross-corpus property of the model is exercised within each of these datasets, which have a natural grouping of topics; for instance, CNN is divided into "US", "world", and "politics". In other words, a cross-corpus CNN model is trained on three corpora: US, world, and politics. With this mental model of the experimental setup, the experiments raise a series of questions:
1) Do the selected datasets / classification tasks matter in the grad scheme of NLP?
The end-task is to classify the corpus of origin for each document (for instance, for the CNN experiment, the model has to decide between US, world, and politics). If I understand correctly, the weGAN model jointly trained its word embeddings with this objective. As a final step, the classifier was additionally fine-tuned on this task. So it is not very surprising that weGAN is better at clustering documents than word2vec, since it was explicitly trained to do so. It would have been more informative to see weGAN performing better on a task that was solely fine-tuned on (e.g. some sentiment classification task that was not part of the training objective when embeddings were trained). In that case, one could argue that the enhanced embeddings can be used as an out-of-the box tool for a lot of different tasks. Another option would be evaluating on the same document membership task, but on datasets that were not seen during training.
Additionally, the fact that the authors evaluated on *new* datasets with a *new* task distances them even further from any potential comparisons against prior work. Even for the two already-existing datasets with results included in the appendix, there are no references to previous SoTA.
2) Are the reported positive results meaningful?
Another problem with not showing results from previous work is that it is hard to understand whether the gains over the word2vec baseline are meaningful. For instance, the classification accuracy for the CNN corpus is increased from 92.05% (word2vec) to 92.29% (deGAN) and 92.36% (weGAN). The authors show that this is *statistically significant*, but is it meaningful? Is a 0.24% or 0.31% increase in accuracy worth the increased complexity of the model? For reference, what ratio of gains/computational cost would BERT incur?
3) What is the message of qualitative evaluation?
The authors offer qualitative analysis of their model. For instance, Table 2 shows the top 10 synonyms for words "Obama", "Trump" and "US", as produced by word2vec and weGAN. The lists of synonyms are extremely similar and don't seem to convey much more information besides the fact that weGAN makes minimal changes. I find the particular examples that the authors choose to underline the superiority of their algorithm unconvincing. For instance, the fact that, in the list of synonyms for US, the word British (selected by word2vec as the 9th closest word) is turned into American (on the same 9th position) loses its significance when you also consider the fact that weGAN did not derank any of the arguably less similar terms from higher positions (e.g. Turkish remains the 6th most similar term to US).
Other nit-picks:
- Formatting issues: In Sections 3.1 and 3.2, the numerical references to equations are broken. Figures 3 and 4 cover the text above. Tables 2, 4, 6, 7 are hard to read. It almost feels like the paper was updated from one conference format to another, without the necessary Latex adjustments.
- The paper has no "Conclusion" section
- Improper use of singular / plural of "corpus" / "corpora"
To end on a more positive note, here are some reasons why I did appreciate the paper:
- The usage of GANs in this context is very creative; the models do not generate *raw* text, but rather intermediate representations; this might be a promising direction for using GANs in NLP.
- The description of the models in sections 3.1 and 3.2 is rigorous, with useful explanations that break down the reasoning behind the loss function choices.


Distances are pervasive in machine learning. They serve as similarity measures, loss functions, and learning targets; it is said that a good distance measure solves a task. When defining distances, the triangle inequality has proven to be a useful constraint, both theoretically-to prove convergence and optimality guaranteesand empirically-as an inductive bias. Deep metric learning architectures that respect the triangle inequality rely, almost exclusively, on Euclidean distance in the latent space. Though effective, this fails to model two broad classes of subadditive distances, common in graphs and reinforcement learning: asymmetric metrics, and metrics that cannot be embedded into Euclidean space. To address these problems, we introduce novel architectures that are guaranteed to satisfy the triangle inequality. We prove our architectures universally approximate norm-induced metrics on R n , and present a similar result for modified Input Convex Neural Networks. We show that our architectures outperform existing metric approaches when modeling graph distances and have a better inductive bias than non-metric approaches when training data is limited in the multi-goal reinforcement learning setting.

This paper is about learning and utilizing distance metrics in neural nets, particularly focusing on metrics that obey the triangle inequality. The paper's core contributions are three approaches to doing this (Deep Norms, Wide Norms, Neural Metrics), along with theoretical and empirical grounding for the metrics.
The hypothesis is clearly on the bottom of page 1 - "Is it possible to impose the triangle inequality architecturally, without the downsides of Euclidean distance?" The downsides are previously listed as 1) not being able to represent asymmetric distances and 2) that the Euclidean space is known to not be able to precisely model some metric spaces with an embedding.
The approach given is quite well motivated. At large, this paper is quite clear and does a good job of delineating why it is taking each step. That starts with a preliminary discussion of metric spaces and norms and what we get when we have the given properties in different combinations.
After describing the motivations and the differences between the three algorithms, the paper then goes on to show results on a couple of toy tasks (metric nearness, graph distances) and then a more challenging one in learning a UVFA. The most striking of the results is the UVFA one where all of the metrics do much better than the Euclidian norm on the asymmetric case, which is the usual one. If these results held in over bigger environments and/or much more data, that would be really intriguing.
I do feel as if this paper is missing a glaring experiment. It talks a lot at the beginning about Siamese Networks being a motivation. It then doesn't do anything with Siamese Networks. They are very common and, if the Euclidean Metric was really deficient relative to this one, we would see it in those results given how important is the relative differences of the embeddings in Siamese Networks.
We also don't see an example where the Euclidean metric fails to come even close to the other metrics in efficacy (as appealed to in the second downside for the Euclidean metric). I don't think that the UVFA results are this because they are cut quite short - it could just be an artifact of the learning process being slow a la how SGD is frequently shown to be just as good as more complex optimizers given the right tuning.
Finally, while I do work on some areas of representation learning, this is not my forte and so I'm not too familiar with most results in this domain. That being said, I am not entirely convinced that this result is of huge consequence unless the empirical analysis is strengthened a lot. Examples of that would include the two I described above.
In its current form, I do not think that this passes the ICLR bar, however I do think its close and, if the experiments I prescribed continued the trend, I would suggest its inclusion.


Among multiple ways of interpreting a machine learning model, measuring the importance of a set of features tied to a prediction is probably one of the most intuitive way to explain a model. In this paper, we establish the link between a set of features to a prediction with a new evaluation criterion, robustness analysis, which measures the minimum distortion distance of adversarial perturbation. By measuring the tolerance level for an adversarial attack, we can extract a set of features that provides the most robust support for a current prediction, and also can extract a set of features that contrasts the current prediction to a target class by setting a targeted adversarial attack. By applying this methodology to various prediction tasks across multiple domains, we observe the derived explanations are indeed capturing the significant feature set qualitatively and quantitatively.

The manuscript proposes a method for model explanation and two metrics for the evaluation of methods for model explanation based on robustness analysis. More specifically, two complementary, yet very related, criteria are proposed: i) robustness to perturbations on irrelevant features and ii) robustness to perturbations in relevant features. Moreover, different from existing works which defined the perturbation values following different somewhat-fixed procedures, the proposed method aims at allowing perturbations in any directions.
A greedy algorithm optimizing these criteria is proposed in order to produce a method able to highlight important features of the input and justify/explain model predictions.
In addition, the proposed robustness criteria are used as metrics to assess the performance of methods for model explanation.
Experiments on models addressing image classification and text classification, shows the performance of the proposed method w.r.t. existing work.
The manuscript has a good flow, and its content is easy to follow. The proposed method is sound, well motivated, and very well founded. The formal presentation of the proposed method is good. I appreciate the fact that evaluation covers different modalities of data, i.e. text and images.
My main criticism over the manuscript is the following:
In Sec. 3.3, when describing the first criterion, it is stated that the size |S_r|, i.e, the amount of anchors, could be defined by the used. In my opinion, this may not be applicable since in theory the amount of relevant/irrelevant features is unknown before hand. In that case the proposed AUC-based method seems more adequate. Could you comment on this?
In  Sec. 3, a pre-defined size K is introduced. Later in Sec. 3.1 it is stated that the greedy algorithm uses this size as a stopping criterion for the optimization of the proposed robustness criteria. Could you indicate how this size K is defined in practice? Is there a principled way to define it? What is the effect of this parameter on the performance of the proposed method? An ablation study focused on this parameter would provide further insights into the inner workings of the proposed method and would improve the manuscript.
In Sec.4 it is stated that only 50 random examples are considered when reporting results. When comparing the performance across the different methods, are these random 50 examples fixed or always re-sampled? Also, given the size of the considered datasets, where the number of images in their test sets is in the order of the thousands, it is hard to grasp how representative are the reported results?
In the same paragraph discussed above, it is mentioned that the GRAD method performs competitively on the proposed criteria. It might be interesting to further positioning the proposed method w.r.t. GRAD. Given the comparable performance achieved by GRAD and its relative simplicity, it would be hard to motivate why not choose GRAD instead of the proposed method? Could you provide some discussion on this?
In Sec.4 (pag. 6) it is stated the the proposed regression-greedy method outperforms other methods in these criteria. In my opinion this trend shouldn't be surprising given the fact that the proposed method is specifically optimized on such criteria as it is clearly stated by the title of Sec.3.
Fig.3 and Fig.4 display binary images indicating the top-n features selected by different methods. Perhaps it would be more informative to have a heatmap highlighting/grading the entire input space. This may throw more light on the performance of the compared methods.
In Adebayo et al., NIPS'18 (and very related efforts), there are presented a set of sanity checks to be applied to explanation methods to ensure their predictions are relate to the class and model being predicted. Could you provide any indication on whether the proposed method passes these checks?
In Sec.4 (visualization) it is stated that the proposed method effectively highlights crucial positive pixels as well as pertinent negative pixels. A similar capability has also being reported earlier in Samek et al., Trans NNLS'16 and Oramas et al. ICLR'19. Since the visualization analysis (discussed in pag.6) focuses exclusively on this capability. There should be a comparison between the proposed method and the two mentioned works.


In medicine, both ethical and monetary costs of incorrect predictions can be significant, and the complexity of the problems often necessitates increasingly complex models. Recent work has shown that changing just the random seed is enough for otherwise well-tuned deep neural networks to vary in their individual predicted probabilities. In light of this, we investigate the role of model uncertainty methods in the medical domain. Using recurrent neural network (RNN) ensembles and various Bayesian RNNs, we show that population-level metrics, such as AUC-PR, AUC-ROC, log-likelihood, and calibration error, do not capture model uncertainty. Meanwhile, the presence of significant variability in patient-specific predictions and optimal decisions motivates the need for capturing model uncertainty. Understanding the uncertainty for individual patients is an area with clear clinical impact, such as determining when a model decision is likely to be brittle. We further show that RNNs with only Bayesian embeddings can be a more efficient way to capture model uncertainty compared to ensembles, and we analyze how model uncertainty is impacted across individual input features and patient subgroups.

Thank you for an interesting read.
This paper is an experimental paper which argues the importance of epistemic/model uncertainty in applications for electronic health records (EHR). The main arguments are the following:
1. current metrics on dataset level cannot reveal uncertainty in prediction on personal level;
2. when evaluated on personal level, deterministic NNs with different random initialisations can produce very different predictions (thus require consideration of model uncertainty)
I am not exactly sure if ICLR is the best venue for this submission, as there is quite little innovation in modelling methodology, and the empirical analysis is domain specific. I feel this paper is more suitable to e.g. MLHC or MICCAI which focus on data analysis/machine learning methods applied to healthcare science.
Still I think the set of experiments in the paper is overall supportive to the main argument that the authors is trying to make. Possible improvements:
1. The histograms in Figure 3 & 4 clearly show that, deterministic NNs trained with different initialisations produces diverse predictions on individual patients. I commend the authors for presenting these visualisations, and I think it would be more useful to quantify this phenomenon on dataset level, e.g. compute the mean and variance of this variation of individual predictions.
2. I would expect to see an improvement of ECE for the Bayesian/deep ensemble models. The Table A.3 so marginal improvements, and I wonder how would this result support the author's claim? Also how do the ECE/ACE metrics look like when computed on sub-groups?
Apart from section 3.3, in general I think the paper writing is clear to me. The loss sensitive optimal decision method is interesting, but a lot of details are missing:
1. The presentation in section 3.3 is unclear, e.g. minimising eq. (4) w.r.t. what? What's the definition of decision region? Also what exactly is the mathematical form of the associated cost used in the experiments?
2. If I understand it correctly, in experiments the optimal thresholding method has only been applied to individual networks in the ensemble. If so what is the intention of discussing eq. (5) in the first place? Also it is unclear to me how this method performs in the deep ensemble/Bayesian RNN case. See e.g. https://arxiv.org/pdf/1805.03901.pdf for a relevant approach.


This paper addresses the problem of incremental domain adaptation (IDA) in natural language processing (NLP). We assume each domain comes one after another, and that we could only access data in the current domain. The goal of IDA is to build a unified model performing well on all the domains that we have encountered. We adopt the recurrent neural network (RNN) widely used in NLP, but augment it with a directly parameterized memory bank, which is retrieved by an attention mechanism at each step of RNN transition. The memory bank provides a natural way of IDA: when adapting our model to a new domain, we progressively add new slots to the memory bank, which increases the number of parameters, and thus the model capacity. We learn the new memory slots and fine-tune existing parameters by back-propagation. Experimental results show that our approach achieves significantly better performance than fine-tuning alone. Compared with expanding hidden states, our approach is more robust for old domains, shown by both empirical and theoretical results. Our model also outperforms previous work of IDA including elastic weight consolidation and progressive neural networks in the experiments.

###Summary###
This paper introduces incremental domain adaptation for natural language processing, assuming that each domain comes one after another and only the current domain can be accessed in the application scenario.  The basic framework of this paper is based on RNN but augmented with the directly parameterized memory bank.
The memory bank of this paper is a set of distributed, real-valued vectors capturing domain knowledge. When the model is adapted to the new domain, the model progressively increases the slots in the memory bank.
The paper evaluates the proposed approach on an NLP classification task, i.e. multi-genre natural language inference (MultiNLI). The dataset used in this paper includes 5 genres: Slate, Fiction, Telephone, Government and Travel.
In the experiments, the paper performs the dynamics of the progressive memory network for IDA as well as compares the proposed method with variants and previous work in the multi-domain setting.
### Novelty ###
This paper proposes incremental domain adaptation, which is inspired by Li & Hoiem's work. The setting assumes that each domain comes one after another and only one domain can get accessed. This setting is interesting as we will encounter this setting in the real application scenarios, i.e., the domain knowledge in the real domain is unpredictable. Thus, the problem setting provides some novelty. However, I am not sure whether assuming that we can only get access to one domain is reasonable as we can always save the data for the domain we have already seen.
From the perspective of the method, this paper incorporates the memory bank to the RNN, which is not new in the machine learning research area, but heuristic enough for the transfer learning community.
###Clarity###
Overall, the paper is well organized and logically clear. The proposed claims are well supported by the experiments and analysis. The images are well-presented and well-explained by the captions and the text.
###Pros###
1) The paper proposes an incremental domain adaptation scenario where one domain appears another and only the data from the current domain can be accessed, which is interesting and heuristic to the domain adaptation research community.
2) The paper is applicable to many practical scenarios since the data from the real-world application is typically from multiple domains and the data is from one domain at a time.
3) The paper is overall well-organized and well-written. The claims of the paper are verified by the experimental results.
###Cons###
1) The paper has a good motivation for the setting, however, one of the critical drawbacks of this paper is that the papers fail to compare with the state-of-the-art baselines. I understand that this paper has a new setting, but since the authors also compare the proposed method with the "multi-task" learning, it will be helpful to compare with state-of-the-art multi-task or multi-source baselines.
2) The experimental results provided in this paper are weak. In Table 4, we found that sometimes, the IDA method performs worse than the multi-task baselines.
3) The paper presents no ablation study or analysis of the experimental results. The effectiveness of the memory bank, fine-tuning/freezing learning parameters is unclear.
It will be also interesting to see how does the proposed method performs on large-scale visual datasets.
Based on the summary, cons, and pros, the current rating I am giving now is weak reject. I would like to discuss the final rating with other reviewers, ACs.
I am willing to improve my rating if the authors can address my following concerns. To improve the rating, the author should explain the following questions:
1). Why assuming that we can only get access to the data from one domain is a reasonable setting, since we can always save the data (or at least the statistics about the data) form the domains we have already observed.
2). Can the proposed approach generalize to visual domain adaptation, i.e. on the visual task instead of NLP task?
3). The drawbacks I mentioned in the paper Cons section.
#################### Updated Review  ###########
The authors have addressed most of my concerns I proposed in the initial review, thus I raise my score to 6 weak accept.
1) In the response to the review, the authors claim that from the data privacy's perspective, it's reasonable to assume that we can only get access to one dataset at one time, which makes sense.
2) I would be really interested in how the similar idea works on vision data, which could be a future work for this paper.


Machine learning models, especially deep neural networks (DNNs), have been shown to be vulnerable against adversarial examples which are carefully crafted samples with a small magnitude of the perturbation. Such adversarial perturbations are usually restricted by bounding their L p norm such that they are imperceptible, and thus many current defenses can exploit this property to reduce their adversarial impact. In this paper, we instead introduce "unrestricted" perturbations that manipulate semantically meaningful image-based visual descriptors -color and texture -in order to generate effective and photorealistic adversarial examples. We show that these semantically aware perturbations are effective against JPEG compression, feature squeezing and adversarially trained model. We also show that the proposed methods can effectively be applied to both image classification and image captioning tasks on complex datasets such as ImageNet and MSCOCO. In addition, we conduct comprehensive user studies to show that our generated semantic adversarial examples are photorealistic to humans despite large magnitude perturbations when compared to other attacks.

The paper proposes cAdv and sAdv, two new unrestricted adversarial attack methods that manipulates either color or texture of an image. To these end, the paper employes another parametrized colorization techniques (and texture transfer method) and proposes optimization objectives for finding adversarial examples with respect to each semantic technique. Experimental results show that the proposed methods are more robust on existing defense methods and more transferrable accross models. The paper also performs a user study to show that the generated examples are fairly imperceptible like the C&W attack.
In overall, I agree that seeking a new way of attack is important, and the methods are clearly presented to claim a new message to the community: adversarial examples can be even found by exploiting semantic features that humans also utilize, since DNNs tend to overly-utilize them, e.g. colors. These claims are supported by the experiments showing that the generated examples are more transferrable across robust classifiers. Personally, I liked the idea of using another colorization method to design cAdv and the use of K-means clustering to control the imperceptibility.
- Some readers may wonder how the "averaged-case" corruption robustness behave for both cAdv and sAdv, e.g. considering random colorization. Would it be worse than the robustness on Gaussian noise?
- One of my concerns on tAdv is whether the texture added is indeed effective to reduce the accuracy, or its just from the (yet small) beta term in the objective. Adding an ablation of beta=0 case in the result would much help the understanding of the method.
- Eq 1: I think F should denote the classifier to attack, but the description tells it's the colorization network. As it seems to me that theta is nevertheless for the colorization network, I feel the notation should be refined for better understanding to the readers.


Since deep neural networks are over-parametrized, they may memorize noisy examples. We address such memorizing issue in the presence of annotation noise. From the fact that deep neural networks cannot generalize neighborhoods of the features acquired via memorization, we observe that noisy examples do not consistently incur small losses on the network under a certain perturbation. Based on this observation, we propose a novel training method called Learning with Ensemble Consensus (LEC) that prevents overfitting noisy examples by eliminating them using the consensus of an ensemble of perturbed networks. One of the proposed LECs, LTEC outperforms the current state-of-the-art methods on MNIST, CIFAR-10, and CIFAR-100 with efficient memory usage.

Summary:
This paper proposes a general method for eliminating noisy labels in supervised learning based on the combination of two ideas: outputs of noisy examples are less robust under noise, and noisy labels are less likely to have a low loss. The authors then propose 3 concrete instantiations of the idea, and do a thorough empirical study (including ablations) across multiple architectures, datasets, noise types, and comparing to multiple related methods. The results show pretty convincingly that one of the new methods (LTEC) that uses past networks outputs to build an ensemble performs really well.
Caveats:
1) I’m an emergency reviewer and had less time to do an in-depth review.
2) While my research is sufficiently close to review the paper, I’m not an expert on label noise specifically, so I cannot comment much on novelty and related work questions.
Comments:
* The readability of the paper could be dramatically improved by reporting results visually (eg bar-plots) and moving all tables into the appendix.
* The authors state that peak performance is valid because it *could* have been found using a validation set -- then why not just do that, and report this early-stopping performance everywhere, instead of always two numbers (peak and final)?
* Please make the perturbation properties in section 3.2 more precise: do you mean “there exists a threshold and perturbation such that for some (x, y)”? Or “For any threshold and any perturbation then for all (x, y) it holds...”? Or something in-between?
* For the “competing methods” paragraph, please cite the relevant papers in the main text, not only in the appendix.
* “over 4 runs” did you randomize the data noise in each run (and in the same way for each method?), or only the network initialisation?
* Table 5 is cool, but it raises the question: is 1.1epsilon the best, or would performance keep going up?
* Looking at the actual implementation of LTEC (Algorithm 4), I cannot resist the thought that M=infinity could work even better (at no extra cost): just maintain a monotonically shrinking set of samples?
Minor comments:
- Define the threshold symbol in section 3.2
- Define M in Algorithm 1
- Define (initial) \mathcal{P}_0 in Algorithm 4
- Fig 2: can you clarify what green is, does it correspond to “self-training”?
- “label precision … does not decrease” -- well, not a lot, but it does decrease!
- Fig 1, Fig 2: set max y to 100
- Table 4: Include M=1 (which is self-training) for comparison


In this paper, we propose a deep reinforcement learning (DRL) based framework to efficiently perform runtime channel pruning on convolutional neural networks (CNNs). Our DRL-based framework aims to learn a pruning strategy to determine how many and which channels to be pruned in each convolutional layer, depending on each specific input instance at runtime. The learned policy optimizes the performance of the network by restricting the computational resource on layers under an overall computation budget. Furthermore, unlike other runtime pruning methods which require to store all channels parameters for inference, our framework can reduce parameters storage consumption for deployment by introducing a static pruning component. Comparison experimental results with existing runtime and static pruning methods on state-of-the-art CNNs demonstrate that our proposed framework is able to provide a tradeoff between dynamic flexibility and storage efficiency in runtime channel pruning.

This paper proposes to learn static and dynamic channel pruning policies for convolutional neural networks. Static pruning depends only on the training dataset and is computed once before the model is deployed. Dynamic pruning is input-dependent. The policies are obtained with deep reinforcement learning on the training dataset using a combination of the loss function and storage/computation resource budgets as a reward signal. The key novelty in this paper is to combine static and dynamic pruning which can obtain the benefits from both worlds. Experimentally, the learned pruning policies are competitive with recent dynamic pruning approaches on CIFAR-10 and ILSVRC2012, in terms of both final test accuracy and number of parameters/inference time.
Overall, I do like the idea of combining static and dynamic pruning, the DRL approach is reasonable and it seems to do well in practice. However, there are some key issues that must be addressed by the authors. In summary, these are:
1- Additional baseline methods: why not compare against a simple combination of the best published static pruning method, and one of the best published dynamic pruning methods (e.g. FBS or RNP)? I'd like to understand what the added value of jointly learning the static and dynamic pruning policies is. If a simple combination of existing static and dynamic methods works well, you will need to justify the need for the more complicated DRL approach you propose in this paper.
2- Writing: it has to be substantially improved; please see the sections Writing and Minor below.
3- Training cost: how stable is the training process described in Section 4.1? Does it much longer to train compared to pure dynamic pruning methods?
Related work:
- Discuss connections to routing networks which adaptively route layer outputs to the next layer's modules: Rosenbaum, Clemens, Tim Klinger, and Matthew Riemer. "Routing networks: Adaptive selection of non-linear functions for multi-task learning." arXiv preprint arXiv:1711.01239 (2017).
Writing:
- Sections 3.3 up to Section 5 need lots of rewriting; I suggest some changes in "Minor" below but please make a full pass as the paper is difficult to read at the moment.
- Section 4.1 is extremely difficult to read and so I don't really understand how you train the pruning policies. Please improve the writing and summarize the process in pseudocode or illustrate it. Also, I believe 4.1 should be a section of 3 rather than in experiments. It is extremely important to understand how the network+DRL agents are trained!
Clarification:
- Number of pruned channels, runtime vs static: \ceil{d_r C} vs (C - \ceil{d_s C}); why are these different in form? Seems like the static formula prunes \ceil{(1-d_s) C}. Why is that?
- Tables 1-2: what is the "Baseline acc." and why is it different for each method? Isn't this the accuracy of the same network before any pruning?
Minor:
- Title is too long: particularly the expression "DYNAMIC FLEXIBLE RUNTIME CHANNEL". Perhaps you can think of shorter titles.
- "We consider a standard form of reinforcement learning an agent" --> "We consider a standard form of reinforcement learning: an agent"
- "are the the number of channels" --> "are the number of channels"
- "output feature F_out u_r is predicted" --> "output feature F_out, u_r, is predicted"
- "many existed dynamic" --> "many existing dynamic"
- "Since C_in is various among layers" --> "Since C_in varies among layers"
- "To avoid over-prune the filters and crashed in training, we set a minimum sparsity ratio +α, then the action space change to a_t^r ∈ (+α, 1]." --> "To avoid over-pruning the filters and crashing the training, we set a minimum sparsity ratio +α, such that the action space becomes a_t^r ∈ (+α, 1]."
- "The reward function is proposed to consider both of network accuracy and computation budget." --> "The reward function is considers both the network accuracy and computation budget."
- "and it may be various in scale" --> "and it may vary in scale"
- "large at begin of training and small near converge" --> "large at the beginning of training and small near convergence"
- "which filters can be to prune permanently" --> "which filters can be pruned permanently"
- "on two popular dataset" --> "on two popular datasets"
- "4.1 IMPLEMENT DETAILS" --> 4.1 IMPLEMENTATION DETAILS
- "For CNN fintuning" --> "For CNN finetuning"
- "Noted that for fair" --> "Note that for fair"
- Tables 1-2: "Compare to state-of-the-art" --> "Comparison to state-of-the-art"
- "Our methods has" --> "Our method has"


This paper considers label-flipping attacks, a type of data poisoning attack where an adversary relabels a small number of examples in a training set in order to degrade the performance of the resulting classifier. In this work, we propose a strategy to build linear classifiers based on deep features that are certifiably robust against a strong variant of label-flipping, where the adversary can target each test example independently. In other words, for each test point, our classifier makes a prediction and includes a certification that its prediction would be the same had some number of training labels been changed adversarially. Our approach leverages randomized smoothing, a technique that has previously been used to guarantee test-time robustness to adversarial manipulation of the input to a classifier. Further, we obtain these certified bounds with no additional runtime cost over standard classification. On the Dogfish binary classification task from ImageNet, in the face of an adversary who is allowed to flip 10 labels to individually target each test point, the baseline undefended classifier achieves no more than 29.3% accuracy; we obtain a classifier that maintains 64.2% certified accuracy against the same adversary. We generalize our results to the multi-class case, providing what we believe to be the first multi-class classification algorithm that is certifiably robust to label-flipping attacks.

Summary.
The paper investigates data poisoning type of attack. In such attacks, an adversary can alter/flip the labels of some of the training examples. The paper proposed a new approach towards certified robustness against this type of attack. In particular, the new classifier will output a prediction along with a certificate in which the prediction would not change if certain number of labels in the training data were flipped.
The authors use randomized smoothing on a binary linear classifier with logistic loss and deduce a radius of certification that is a function of the probability of flipping labels in the training data and the probabilistic separation p.
Major concerns.
1) I find the application of certification to data poisoning type adversarial attacks rather limited and is not of a major interest to the verification/certification community. Certification arose as a major issue since models implemented in practice can be fooled if subjected to noise at testing time. However, the proposed certification is on the flip rate of the labels in the training data. Since this is fixed, certification in this context is not of a major interest. The only potential relevance of such a problem is upon training models in a federated approach (online learning) even then, one can argue that the portion of the data that the adversary has access to is a small portion to the complete dataset. It feels to be that certification was somehow forced into data poisoning type of adversarial attacks although they jointly do not make much sense.
 While I do appreciate the work from authors, I am not convinced that certification in this context makes significant sense and has interest to only small group of researchers.
2) There are some serious limitation in the work specifically that the bounds are derived for a binary classifier. While the authors did indeed discuss the multi-class case, there are no experiments beyond the binary classification. The dataset sets where the sentiment analysis of IMDB, MNIST1/7 and the dog fish classes from ImageNet. Experiments on multi-class case is essential here for practical reasons.
3) May the authors clarify some few things in the experiments for me.
If I understand Figures 1,2,3 correctly, then what the authors do is that they train networks over different number of label flipping (shown as a percentage on the top of the figure). Then for each test example, they compute the maximum radius given in Eq 10 for multiple qs. If the number of flipping in the dataset is less than r (less than the maximum radius per sample) then the sample is certified.
	Question. I do not understand why is an example considered certifiable when it is both correctly classified and unaffected under at least r flips? In page 7 of the experiments section, the authors say "we plot the fraction of the test set that was both correctly classified and certified to not change under at least r flips".
	Question. Can the authors comment on the expected performance of the network upon comparing certified accuracy with networks having q as probability flip rate and when the training data flip rate percentage is exactly q. Will the certified accuracy for q that matches the flip rate in the dataset be better than the ones with q that does not match the training flip rate. For instance, in Figure 1, note that the percentage in the flip rate of the training dataset ranges from 0 to 14%, however the certified accuracy was for q that ranges from 30 to 47.5. Will the certified accuracy at a given percentage of the data be the highest for q that match the flip rate?
	Question. Since the classifier is linear (since features are fixed), can the authors comment perhaps on the relation between p and q?

Minor comments.
1) The authors need to define what p is. The authors can correct me if I'm wrong, p is a lower bound on the separation of the probability for some class, i.e.  Prop(f(x) = 1) >= p. This is similar to Cohen et al. 19. This was not defined and come as a surprise in Eq 3.
2) Moreover, in the work of Cohen et al. the smoothed classifier g is smoothed in probability which is unlike definition 1. Perhaps definition 1 fits more the framework of Lecuyer et al 19 as they showed that if an algorithm A is differentially private (probability distribution do not change much under database perturbations), the expectation over the algorithm is also differentially private.
3) In the solution to the ridge regression, \alpha is a function of the tested sample, e.g. eq 11. This can be confusing and I advise authors to consider adding a superscript \alpha^j indicating that this is a function of the test sample j. Similarly, in the algorithm \alpha in Eq 7 and bullet point 1.
4) In example 3, the paper cited is a concurrent submission to ICLR20 and not 19.


In order to perform plausible interpolations in the latent space of a generative model, we need a measure that credibly reflects if a point in an interpolation is close to the data manifold being modelled, i.e. if it is convincing. In this paper, we introduce a realism index of a point, which can be constructed from an arbitrary prior density, or based on FID score approach in case a prior is not available. We propose a numerically efficient algorithm that directly maximises the realism index of an interpolation which, as we theoretically prove, leads to a search of a geodesic with respect to the corresponding Riemann structure. We show that we obtain better interpolations than the classical linear ones, in particular when either the prior density is not convex shaped, or when the soap bubble effect appears.

The paper proposes a density score, which is defined based on a density or some other score such as Fréchet Inception Distance (FID).
While the given problem is an important one, there are some substantial problems with the proposed approach:
1) The paper does not mention the limitations of the FID which, as described in (Shmelkov et al, ECCV 2018. How good is my GAN?), are: i) it is based on the pre-trained Inception network and therefore does not exactly match the distributions over the data in other datasets; and ii) crude approximation of the scores by Gaussian distributions. Overall, this score is empirical and aims at circumventing the subjective analysis and it should be better reflected in the paper.
2) The justification of the normal density based index (Section 2) seems weak. While it is obvious that this score could be used, is it possible to make the empirical assessment? E.g. compare between two scores on an extensive amount of data.
3) In addition to the previous comment, there is a substantial problem in the experimental results that all the observations are qualitative and based only on a few images. Further analysis of the realism index on the real images which are not included into the training dataset could improve the analysis.
4) Following up on the previous comment, the experiments on the real images may need the values from the latent space corresponding to the real images. Currently, the model has been mostly assessed using DCGAN (with the assessment of VAE in Figure 4 but only for FID score), while it is stated after equation (1) that 'This case covers both GAN-like and AE-like models.'  This might be used for the assessment of the realism index on real images as stated before. If the proposed model were assessed with variational auto-encoders (VAE) and flow based models, it would make it possible to transform between the latent representation and the data themselves.  From another perspective, experimental results on different types of models (VAE-type, flow based type such as GLOW) for different types of interpolation are needed for the sake of experimental completeness. It would help emphasise the limitations of the method and difference in interpolation results in different models.
4) In the optimisation section, the following statement is made: 'However, to accelerate the process of minimisation, we alternate the gradient step with the following one: first choose two random numbers i < j from the set {0, . . . , k} and then consider the linear interpolation between xi and xj given with...'. Could the authors elaborate on why does this acceleration happen? It might be necessary to give some references on the experimental results or at least provide some line of support for this phrase.
***
The following comments are not as critical but fall into the category of ‘nice to have':
5) Although the reviewer is aware that there were some experiments in the appendix on the value \epsilon, it might be a good idea to have more studies on the influence of this regularisation parameter for other datasets rather than just MNIST
6)  While figure 1 appears in the beginning of the paper, on page two, it is discussed on page seven, in the experimental section. Placing the figures closer to the narrative would improve the reading experience.


Mutual Information between agent Actions and environment States (MIAS) quantifies the influence of agent on its environment. Recently, it was found that the maximization of MIAS can be used as an intrinsic motivation for artificial agents. In literature, the term empowerment is used to represent the maximum of MIAS at a certain state. While empowerment has been shown to solve a broad range of reinforcement learning problems, its calculation in arbitrary dynamics is a challenging problem because it relies on the estimation of mutual information. Existing approaches, which rely on sampling, are limited to low dimensional spaces, because high-confidence distribution-free lower bounds for mutual information require exponential number of samples. In this work, we develop a novel approach for the estimation of empowerment in unknown dynamics from visual observation only, without the need to sample for MIAS. The core idea is to represent the relation between action sequences and future states using a stochastic dynamic model in latent space with a specific form. This allows us to efficiently compute empowerment with the "Water-Filling" algorithm from information theory. We construct this embedding with deep neural networks trained on a sophisticated objective function. Our experimental results show that the designed embedding preserves information-theoretic properties of the original dynamics.

This paper proposes to take advantage of a known result on the channel capacity of a linear-Gaussian channel in order to estimate the empowerment and maximize mutual information between  policies (action sequences) and final states (given  initial states). The idea is to map the raw action sequences and states to a latent space where learning would force that linear property to be appropriate.
I like the general idea of the paper (as stated above) along with its objectives but I have several concerns.
First, I need to be reassured that we are computing the right quantity. Channel capacity is the maximum mutual information (between inputs and outputs) over the input distribution, whereas I had the impression that empowerment would be this mutual information, and that we want to increase it, but not necessarily reach its maximum over all possible policies: it would usually be one of the terms in an objective function (e.g. here we have reconstruction error, and in practice there would be some task to solve in addition to the exploration reward). One way to see this problem in the given formulation is that the C* objective only depends on the matrix A (which encapsulates the conditional density of z_{t+1} given the trajectory) and it does not depend at all on the distribution of the trajectory itself! This is weird since if we are going to use this as reward the objective is to improve the trajectory. What's the catch? So either I misunderstand something (which is quite possible) or there is something seriously wrong here.
I am assuming that the training objective for the encoder is a sum of the reconstruction error and of C*. But note how this does not give a reward for policies, as such. This is a bit strange if the goal is to construct an exploratory reward!
A less radical comment is: have you verified that the linear relationship between z_{t+k} and the b actually holds well? In other words, is the encoder able to map the raw state and actions to a space where the linearity assumption  is correct, and thus where equation (3) is satisfied.
Figure 3 has something weird,  probably one of the two sequences of -1's should be a sequence of +1's.
Figure 4 is difficult to interpret, the caption should do a better job.
The experiment on the safety of the RL agent is weak. I don't see the longer path as safer, here. And the results are not very impressive, since the agent is only doing what it's told, i.e., go in areas with more options (more open areas) but there is no reason to believe that this is advantageous, here.
Finally, what would make this paper much more appealing is if the whole setup led to learning better high-level representations (how to measure that is another question, but it is a standard kind of question in representation learning papers).
Related work:
I don't understand why in the abstract the authors refer to sampling-based methods as requiring exponentially many samples. This is not generally the case for sampling based methods (e.g. think of VAEs). I suppose the authors refer to something in particular but it was not clear to me what.
References: in the intro, you might want to refer to the contrastive methods and variational methods to maximize mutual information between representations of the state and representations of the actions, e.g.,
 Thomas et al, 2018, 1802.09484
 Kim et al, 2018, arXiv:1810.01176
 Warde-Farley et al, 2018, arXiv:1811.11359

Evaluation: for now I suggest a weak reject but I am ready to modify my score if I am convinced that my main concerns were unfounded.


Deep neural networks have demonstrated unprecedented success in various knowledge management applications. However, the networks created are often very complex, with large numbers of trainable edges which require extensive computational resources. We note that many successful networks nevertheless often contain large numbers of redundant edges. Moreover, many of these edges may have negligible contributions towards the overall network performance. In this paper, we propose a novel iSparse framework, and experimentally show, that we can sparsify the network, by 30-50%, without impacting the network performance. iSparse leverages a novel edge significance score, E, to determine the importance of an edge with respect to the final network output. Furthermore, iSparse can be applied both while training a model or on top of a pre-trained model, making it a retraining-free approach -leading to a minimal computational overhead. Comparisons of iSparse against PFEC, NISP, DropConnect, and Retraining-Free on benchmark datasets show that iSparse leads to effective network sparsifications.

The paper proposed a method for network sparsification based on the significance of each edge (weight). Unlike some of the existing works, edge significance in this work is explicitly defined based on their influence over the network output.
The algorithm can be summarized as follows:
1. Compute the significance of each activation (neuron) using an existing method (infinite feature selection).
2. Compute the significance of each edge as the product between the neuron significance and the absolute edge weight.
3. Sort the edges according to their significance scores and keep the top portion.
I'm mainly concerned about the limited technical novelty: the proposed technique is essentially a heuristic. Specifically, it is not clear why the significance of each edge should be defined according to equation (5) rather than some other forms. The intuition behind masking out the gradients of in-significant edges in (10), i.e., "we argue that any edge that does not contribute towards the final model output, must not be included in the back-propagation", is again a heuristic that lacks justification. If theoretical analysis is not possible, it might be necessary for the authors to conduct controlled experiments/ablation studies to show that some of the design choices made in the paper are indeed superior over other alternatives.
Another of my concern is that, if the goal is to make the sparsification decision aware of the network output (e.g., the value of the loss function), a simpler approach would be to enforce L1 regularization over the edges. This way, edges that do not lead to significant impact on the loss would be automatically pruned away. I wonder how would the proposed approach compare against this simple baseline.
Other suggestions:
* Empirical evaluation is conducted using LeNet and VGG16. It would be interesting to extend the analysis to some other seminal architectures, such as ResNet, Inception and MobileNets.
* It would be informative to report the hardware configuration used to obtain the execution time in Figure 5. Note the relative inference cost of different models may differ substantially over different hardware platforms.
* Writing of the paper can probably be polished further for better clarity.


As 3D scanning solutions become increasingly popular, several deep learning setups have been developed for the task of scan completion, i.e., plausibly filling in regions that were missed in the raw scans. These methods, however, largely rely on supervision in the form of paired training data, i.e., partial scans with corresponding desired completed scans. While these methods have been successfully demonstrated on synthetic data, the approaches cannot be directly used on real scans in the absence of suitable paired training data. We develop a first approach that works directly on input point clouds, does not require paired training data, and hence can directly be applied to real scans for scan completion. We evaluate the approach qualitatively on several real-world datasets (ScanNet, Matterport3D, KITTI), quantitatively on 3D-EPN shape completion dataset, and demonstrate realistic completions under varying levels of incompleteness.

This paper proposes a new method for making 3D point clouds by automatically completing 3D scans. It does not require paired data samples for training which makes it possible to train it on real data instead of synthetic data. The authors use a generative adversarial network (GAN) to “generate” complete point clouds from noisy or partial point clouds obtained by 3D scanning. The generator learns to perform mapping from point set manifold of scanned noisy and partial input X_r to manifold of clean shapes X_c. The discriminator tries to tell between encoded clean shapes (synthetic data point clouds) and mappings of noisy input (point clouds from real-life data 3D scans).
An encoder-decoder network similar to those in Achlioptas et al. (2018) and Qi et al. (2017a) is trained to transform original point clouds to a low-dimensional latent space prior to training the GAN. The authors find that using the encoder-decoder trained on clean shape data even for noisy input yields better results.
One of the issues of completing noisy and partial scans is that the desired complete scan can have a very different shape compared to the noisy input. The generator can map latent vectors to any points on the target manifold which allows it to generate shapes that are far different from the original inputs. In order not to generate random clean shapes, the authors add a reconstruction loss to the generator which encourages it to preserve the partial shape of the input end reconstruct it in the completed clean shape. The choice of Hausdorff distance for reconstruction loss is sound and the ablation study confirms it.
The authors perform rather extensive experimental evaluation of their proposed method. They perform qualitative and quantitative analysis on several datasets, both real-life and synthetic ones. The proposed method outperforms existing methods in real-life data scenario. On the synthetic dataset (3D-EPN), the quantitative results are not as good as those of PCN (which is a supervised method, unlike the proposed method), but the qualitative results look plausible and comparable to PCN results. In terms of plausibility score, the proposed method outperforms existing methods in all experiments, which is probably thanks to its objective - map the input into the latent space of clean and complete shapes. However, plausible looking point clouds do not necessarily have to precisely match the input, which is the objective of 3D scan point cloud completion.
The ablation study also confirms the effectiveness of individual parts in the proposed method.
The main contribution of this paper is training with unpaired data, which enables training on real-life data, leading to better results on real-life scans. While I understand the difficulties, I believe it would be better to try to focus more on real-life data in the evaluation. There is only one experiment with quantitative analysis on real-life data in the paper. Supporting that with a visual Turing test would have been great.

Questions raised:
In 4.3, you say that “ground truth complete scans are not available for training.” How do you then train the supervised methods? Are they trained on 3D-EPN? In that case, is your proposed method also trained on 3D-EPN? If your method is the only one trained on your synthetic data (dataset D), which is also used for testing, then I do not think you could claim that your method is better at dealing with different data distributions. Please make clear in the comments what data you use for training in this experiment.
The meaning of section 4.4 is not very clear to me. If my understanding is correct, when completing noisy or partial point clouds, low diversity in results is better than high diversity because it is a task of repairing the input, which only has one correct result. Are you trying to say in this section that your method yields more consistent results with lower diversity than the method from previous work? If that is the case, you should consider rewriting that part to make it clearer to readers.
The PCN paper (Yuan et al., 2018) shows that PCN can generalize and complete point clouds of objects unseen during training very well. Unfortunately, this paper does not discuss performance on objects of unseen classes. Were such experiments considered? It would be beneficial to do a qualitative analysis of performance on unseen objects.
The description of the left table in Table 1 first says that it shows performance on real-life scans, but performance on synthetic data also appears there. Shouldn’t it rather say that it is plausibility comparison on real-life scans and synthetic data?
Summary:
The proposed method is easy to understand, exploits recent progress in generative models, and allows training on real-life scans as it does not require paired training data.
The paper does not contain much algorithmical novelty and mostly combines existing methods to solve the problem of obtaining clean and complete point clouds from real 3D scans. However, the ablation study shows that adding a good reconstruction loss to the generator is crucial for the performance.
The main strengths of this paper are extensive experimental evaluation using both quantitative and qualitative analysis, and significant improvement in performance on real-life data over previous works.
The main weakness is limited novelty in terms of the techniques used in the proposed method.
Additional comments that do not affect the review decision:
Citations in the text have to be revised and correctly put into parentheses where necessary. E.g., on page 2: “Since its introduction, GAN Goodfellow et al. (2014) has been used...” should be rewritten to “Since its introduction, GAN (Goodfellow et al., 2014) has been used...”
Table 2 is the only table where the best results are not highlighted by bold text. It is also the only table where the proposed method is not the best performing method as it loses to PCN. I apologize if it is just a pure coincidence but it seems as if the authors did not want to draw attention to the fact that their proposed method loses to an existing method in that experiment. I believe that you should be fair and highlight best results in all tables.


A series of recent works established a rigorous correspondence between very wide deep neural networks (DNNs), trained in a particular manner, and noiseless Bayesian Inference with a certain Gaussian Process (GP) known as the Neural Tangent Kernel (NTK). Here we leverage this correspondence to provide explicit analytical predictions for the learning curves of DNNs on any fixed target function. Focusing on datasets whose input measure is uniform on a hypersphere, our predictions match experimental curves very well and reveal a strong implicit bias towards functions which are low order polynomials of the input. Two novel analytical tools underlay our approach. First a renormalization-group approach is used to show that noiseless GP inference using NTK, which lacks a good analytical handle, can be well approximated by noisy GP inference on a related kernel we call the renormalized NTK. Second a field theory reformulation of the problem allows a controlled perturbative expansion of the test error in the inverse dataset size. We believe our approach lays the foundations for a more precise quantitative understanding of DNNs.

This theoretical paper exploits a recent rigorous correspondence between very wide DNNs (trained in a certain way) and Neural Tangent Kernel (a case of Gaussian Process-based noiseless Bayesian Inference).
A field-theory formalism was developed for Gaussian Processes (2001). Here it is thus extended to the NTK case. There are 3 important theoretical results which are both proven and backed by numerical confirmation.  These results, in particular the first, provide a very accurate prediction for the learning curve of some models.  The paper is well situated within this literature.  I am not very knowledgeable about NTK or even Gps, however I understand the challenges of understanding DNNs and I am familiar with field theory and renormalization group.
Given the importance and quality of the results, and the overall quality and clarity of this (dense) paper, I recommend acceptation without hestiation.
There are a couple of points however that could be improved, that would make the paper more useful for the community.
Given the density of results in the paper, I would relax the length constraint, allowing up to 9 or 10 pages if possible, to add more explanations (not computations).
I would like the paper to present more explicitly how the regression target labels g(x) are generated. Maybe it is said but I couldn’t easily understand, for sure, how they are generated.
Also, please explain early enough what is meant by uniform dataset (I understood it simply means the data x is drawn uniformly at random over a manifold, here this manifold is often the d-dimensional hypersphere).
Claim II states that ‘...lead to clear relations between deep fully-connected networks and polynomial
regression’’. This is, I believe, supported by theoretical proof and numerical double-check, however it is not discussed enough for the abstract’s promise to be fulflled ‘a coherent picture emerges wherein fully-connected DNNs ...’.
I think this point deserves a more ample discussion in section 7.
More generally, the claims in the introduction or at the end of section 3 are stated rather explicitly, but very densely, and the careful reader can get the hypothesis of each result from the text.
However for the sake of ease of read of less patient readers, I think it would be appropriate to have, somewhere, a more self-contained description of the results’ list. This paper is technical and some readers will be interested of simply knowing the hypothesis made and type of results obtained.
For instance, the sentence ‘‘They [results] hold without any limitations on the dataset or the kernel and yield a variant of the EK result along with its sub-leading correction.’’ is misleading: as stated in the previous sentence in the text, this is for the fixed-teacher learning curve, etc.
Please try to explain a bit more the intuition behind renormalization / trimming terms q>r (r integer fixed, the higher the less approximated).  More specifically, it is not very clear to me how it can be interpreted in terms of how we look at the data. You mention (x.x’)^r being negligible or not depending on r,d etc, but I wounder if there is some kind of simple ‘geometrical’ interpretation (is it a coarse graining of the data in angular space, the ‘high energy’ eigenvalues corresponding to the high frequency, high resolution distinction between very close angles ?).  On that point I am a bit lost and it’s a pity because your results are strong and rely on few, rather simple/elegant assumptions (which call for some intuitive understanding).
Could you explain intuitively, to the inexperienced reader, why the noiseless case is harder to deal with than the finite-noise one ?
In appendix D, it is mentioned that you need averaging over about 10 samples to have a decent average. For a single realization of a N-sized training set, there is additional variation (Adding or subtracting to the error epsilon).  Given actual experiments are typically performed for a single realization of the data, I think this point should be mentioned in the main text more explicitly. Ideally, you could add error bars to the data, accounting for the dispersion inherent to a single-realization case.
In early section 3, a short definition of a GP should be provided (there, or before).
Around Eq. 2, you should specify the interpretation of P_0[f]
After Eq. 3, ‘where F is some functional of f.’ I would add: ‘[where F is some functional of f,] for instance Eq. 2.’
The derivation of eq 6 is not obvious. You do detail it in the appendix, but forgot to cite the appendix !
‘Notably none of these cited results apply in any straightforward manner in the NTK-regime.’ : could you quickly explain why (no matched priors ? Noise ?)
‘‘The d^-l scaling of eigenvalues’’ : at this point, the variable ‘l’ had not been defined.
‘‘notably cross-talk between features has been eliminated’’ : has it been eliminated or does it simply become constant ?
‘3% accuracy’ [relating to figure 1]
I understand the idea but accuracy seems misleading. I would replace everywhere with something like ‘relative mismatch’.  OR explain better why you call this accuracy: usually a high accuracy is preferred, and here you are proud with this very low imprecision of 3%
‘’Taking the leading order term one obtains the aforementioned EK result with N’’ : maybe (just a suggestion here) you could recall it here, given it was in page 1 (and in-line).
Appendix B:  could you explain why this difference increases with N ? I would have expected this kind of quantity to decrease with N.
Appendix F: there are typos in the r.h.s. in the first line.
\sum_j f_j \phi_j  (I think).
Appendix G: ‘noisy targets’ : you mean fully random or Kernel + some degree of noise with variance sigma^2 ?  I think it’s the first time you use this phrasing.
Appendix G: you denote \partial / \partial \alpha for the functional derivative. I would replace with \delta to stress out it is a functional and not regular derivative.
Beyond	 appendix G.1 : I confess I didn’t have time to read it.
Despite the overall quality of the text, there are a number of wrong singular/plural matchings, which can easily be corrected. Here are some of them, with other typos as well:
‘Furthermore since our aim was to predict what the DNNs would predict rather [THAN?] reach SOTA predictions’
‘a factor of a factor
of about 3.’
as do for – > as we do for
uniformally - > uniformly


Equilibrium Propagation (EP) is a learning algorithm that bridges Machine Learning and Neuroscience, by computing gradients closely matching those of Backpropagation Through Time (BPTT), but with a learning rule local in space. Given an input x and associated target y, EP proceeds in two phases: in the first phase neurons evolve freely towards a first steady state; in the second phase output neurons are nudged towards y until they reach a second steady state. However, in existing implementations of EP, the learning rule is not local in time: the weight update is performed after the dynamics of the second phase have converged and requires information of the first phase that is no longer available physically. In this work, we propose a version of EP named Continual Equilibrium Propagation (C-EP) where neuron and synapse dynamics occur simultaneously throughout the second phase, so that the weight update becomes local in time. Such a learning rule local both in space and time opens the possibility of an extremely energy efficient hardware implementation of EP. We prove theoretically that, provided the learning rates are sufficiently small, at each time step of the second phase the dynamics of neurons and synapses follow the gradients of the loss given by BPTT (Theorem 1). We demonstrate training with C-EP on MNIST and generalize C-EP to neural networks where neurons are connected by asymmetric connections. We show through experiments that the more the network updates follows the gradients of BPTT, the best it performs in terms of training. These results bring EP a step closer to biology by better complying with hardware constraints while maintaining its intimate link with backpropagation.

I think it is an intriguing paper, but unfortunately left me a bit confused. I have to admit is not a topic I'm really versed in, so it might be that this affected my evaluation of the work. But also, as a paper submitted to ICLR I would expect the paper to be self-contained and be able to provide all the details needed.
I do appreciate the authors providing in the appendix the proofs of the other theorems even if they come form other works.
The paper introduces C-EP, an extension of  a previously introduced algorithm EP, such that it becomes biologically plausible. In particular EP is local in space but not in time (you need the steady state of the recurrent state after the first stage at the end of the second stage to get your gradients). I think this is fair, and the need for biological plausibility is well motivated in the beginning of the work.
My first issue is with the proof for the equivalence between EP and C-EP. This is done by taking the limit of eta goes to 0. I think I must be missing something. But the proof relies on eta being small enough such that \theta_i = \theta (i.e. theta does not change). Given this state evolves the same way as for EP, because we basically not changing theta.
Yet the crux of my issue is exactly here. The proof relies on the fact that we don't change theta. So then when you converged on the second phase, isn't theta the same as theta_0? So you haven't actually learned anything!? Basically looking at the delta isn't this just misleading?
Ok lets assume that on the last step you allow yourself to change eta to be non-zero. (I.e. we are just after the delta in theta, and what to show we can get the same delta in theta as EP which is how the proof is phrased). Then in that difference aren't you looking at s_{t+1} and s_t rather than s_{t+1} and s_0, which is what EP would do? In EP you have s^\beta_* - s_*. This is not what you get if you don't update theta and apply C-EP?
I think there might be something I'm missing about the mathematical argument here.
At a higher-level question, we talk about the transition function F as being a gradient vector field, i.e. there exist a phi such that F is d phi/d theta.  Why is this assumption biologically plausable ? Parametrizing gradient vector fields in general is far from trivial, and require very specific structure of the neural implementation of F to be true. Several works have looked at parametrizing gradient vector fields (https://arxiv.org/abs/1906.01563, https://arxiv.org/pdf/1608.05343.pdf) and the answer is that without parametrizing it by actually taking the gradient of a function there is not much of a choice.
Incidentally, here we exploit that  F = sigma (Wx), with W symmetric. This is a paramtrization of a gradient vector field, i.e. of xU, where UU^T =W I think. But if you want to make F deep than it becomes non-trivial to restrict it to gradient vector field. Is the assumption that we never want to move away from vanilla RNNs? And W symmetric is also not biologically plausible. In C-EP you say is not needed to be symmetric, but that implicitly means there exist no phi and everything that follows breaks, no?
I'm also confused by how one has access to d phi / ds and d phi / d theta. Again I feel like I'm missing information and the formalism is not introduced in a way that it is easy to parse. My understand is that you have an RNN that updates the state s. And the transfer function of this RNN is meant to be d phi / ds, which is trues if the recurrent weight is symmetric. Fine. But then why do we have access to d phi/ dtheta? Who is this function? Is the assumption that d s / dtheta is something we can compute in a biologically plausible way? Is this something that is obvious?


One-shot neural architecture search (NAS) has played a crucial role in making NAS methods computationally feasible in practice. Nevertheless, there is still a lack of understanding on how these weight-sharing algorithms exactly work due to the many factors controlling the dynamics of the process. In order to allow a scientific study of these components, we introduce a general framework for one-shot NAS that can be instantiated to many recently-introduced variants and introduce a general benchmarking framework that draws on the recent large-scale tabular benchmark NAS-Bench-101 for cheap anytime evaluations of one-shot NAS methods. To showcase the framework, we compare several state-of-the-art one-shot NAS methods, examine how sensitive they are to their hyperparameters and how they can be improved by tuning their hyperparameters, and compare their performance to that of blackbox optimizers for NAS-Bench-101.

This paper introduces a benchmarking framework to evaluate a class of one-shot NAS methods by exploiting the NAS-Bench-101 database. In order to do so, the authors apply techniques from Bender et al. (2018) to match the search spaces in NAS-Bench to one-shot scenarios and weight edges in the search graph allowing for a variable number of edges per cell. These weights are then used to query a larger, discrete architecture from NAS-Bench for the corresponding evaluation errors. The authors motivate the soundness of a unique framework by showing minimal differences between three NAS optimizers.
In their analysis, they also corroborate the findings of Sciuto et al. (2019) on a larger scale, showing little generalization of the ranking from one-shot validation to the final architecture. Finally, the authors also use this framework to show that a fine-tuned baseline compares favorably to SOTA methods, and that large regularization factors lead to more robust configurations.
The paper is well-written and introduces a framework to cheaply compare one-shot NAS optimizers based on expensive computations behind the NAS-Bench-101 benchmark. In addition, the authors provide empirical analyses that reflect generalization and regularization issues with current methods and that could lead towards designing more robust algorithms.
In my opinion, the the background section might be improved by presenting higher level notions that would lead to an easier understanding by a wider audience. Also, although comprehensible due to the nature of this study, readers not familiar with a variety of previous work might find difficult to parse the paper as many concepts are just referenced.


This work seeks the possibility of generating the human face from voice solely based on the audio-visual data without any human-labeled annotations. To this end, we propose a multi-modal learning framework that links the inference stage and generation stage. First, the inference networks are trained to match the speaker identity between the two different modalities. Then the trained inference networks cooperate with the generation network by giving conditional information about the voice. The proposed method exploits the recent development of GANs techniques and generates the human face directly from the speech waveform making our system fully end-to-end. We analyze the extent to which the network can naturally disentangle two latent factors that contribute to the generation of a face imageone that comes directly from a speech signal and the other that is not related to itand explore whether the network can learn to generate natural human face image distribution by modeling these factors. Experimental results show that the proposed network can not only match the relationship between the human face and speech, but can also generate the high-quality human face sample conditioned on its speech. Finally, the correlation between the generated face and the corresponding speech is quantitatively measured to analyze the relationship between the two modalities.

Summary -
In this work the authors propose a two-stage procedure for training a GAN which generates plausible faces conditioned on the raw waveform of a speech signal. In the first stage two embedding functions are trained, one taking as input a frame from a video (of a person speaking), the other taking as input the raw waveform of the same video's audio. These embeddings are trained to maximize the inner product of positively sampled embeddings (frame and audio from same video), and minimize the inner product of negatively sampled embeddings (frame and audio from different videos). In the second stage a GAN is trained where the input to the generator is the a random latent code (z), concatenated with the learned embedding of a speech signal from stage 1 (c). They also initialize the first half (\phi) of the discriminator using the face embedding network from stage 1, and propose a modification of the relativistic GAN loss to prevent \phi from losing the ability to produce face embeddings that have low inner product with the wrong speech embedding.
The authors explore the properties of their learned pipeline in a number of experiments. In 4.1 they compare their self-supervised speaker matching pipeline with prior work, showing that it has competitive performance with prior work that relies on either supervised pretraining, or additional labels such as age and gender. In particular they show that as the number of negative samples increases from 1 to 9, their identity matching performance significantly improves over prior work (in the K=2 regime their method underperforms prior work). Qualitatively they show that their generator has some reasonable success (it is hard to judge what perfect success would look like, and how far they are from reaching it) at disentangling aspects of facial appearence that can and cannot be inferred from the speech signal (QLA1). They also show qualitatively that the output of their generator can be smoothly controlled by interpolating between speech conditioning vectors, producing reasonable faces at each intermediary step (QLA2). In experiment QTA1 they quantitatively validate the conditioning vector c is affecting the generated image. In experiment QTA2 the authors (with a small issue, see weaknesses) show that their proposed modification to the loss function causes their outputs to be better matched to the speech conditioning as measured by the fixed embedding network trained in stage 1. Finally in QT3 they measure how well their generated faces can be used with the original face embedding network to perform image retrieval (I am a bit unclear on the details of this experiment, see questions)
Strengths -
* The authors' proposed pipeline and modified loss function offers a generalized framework for jumpstarting conditional GAN training
* Their pipeline does not assume human-specified labels, but instead access to paired data from different modalities, which is can easily be obtained for many conditional image generation tasks (inpainting, super-resolution, colorization, etc.)
* Their pipeline also doesn't seem particularly finetuned for the speech-driven image synthesis task, so it seems reasonable to believe it could be adapted to other tasks
* Their results are qualitatively compelling, and they make a convincing efforts in experiments QTA1-3 to quantitatively show that the conditioning information is affecting the output
* The paper is generally well-written and easy to follow
Weaknesses -
* Without completing the loop, and showing that the second stage of this pipeline helps with identity matching for speakers, I'm not clear on what the motivation for this particular form of conditional image generation is (this is unfortunate, because their framework is quite general, and it seems feasible that the authors could have applied it directly to a task where the output of conditional image generation is directly useful)
* I interpret the main purpose of experiment QTA 2 as validating the effectiveness of their proposed loss modification, it seems like a natural experiment to make this claim more convincing is to compare a generator trained with Eq 4. against real images (hopefully getting a much lower matching probability than the 76.65% reported in the first experiment of this section)
* It seems like an important ablation study is testing the effect of jumpstarting the GAN training with the pretrained networks of stage 1, and reporting what happens when one or both of these networks are initialized randomly (assuming that initializing randomly hurts performance significantly, this would be further evidence of their framework's strengths)
* The novelty of the proposed approach is limited so far as I can tell (slight architectural modifications, and adding a negative sampling term to the discriminator loss)
Initial Rating - Weak Accept
Questions -
* In experiment QTA3 I'm confused by how including multiple faces from the same video clip affects measuring retrieval accuracy. Does retrieving any of the 50 faces from the same clip count as correct?
Explanation of Rating - The novelty of the work is limited, and it doesn't seem clearly useful for any practical task. However the stated task is certainly a non-trivial one, and the qualitative results and experiments give compelling evidence that the authors are proposing a powerful framework for conditional image generation. I think that the high quality writing, experiments, and results; coupled with potential impact for other conditional image generation tasks warrant acceptance. However the paper is held back by the lack of novelty and lack of clear motivation.
Revised Rating After Rebuttal: Accept
Explanation of Revised Rating: The authors addressed my concrete concerns about missing experiments in the rebuttal. Despite my concerns about the motivation for this particular task, I think the good results produced by author's methodology indicate this work will be valuable in the context of conditional image generation more broadly. I am upgrading my rating to accept.


A recent line of work studies overparametrized neural networks in the "kernel regime," i.e. when the network behaves during training as a kernelized linear predictor, and thus training with gradient descent has the effect of finding the minimum RKHS norm solution. This stands in contrast to other studies which demonstrate how gradient descent on overparametrized multilayer networks can induce rich implicit biases that are not RKHS norms. Building on an observation by Chizat and Bach (2018), we show how the scale of the initialization controls the transition between the "kernel" (aka lazy) and "rich" (aka active) regimes and affects generalization properties in multilayer homogeneous models. We provide a complete and detailed analysis for a simple two-layer model that already exhibits an interesting and meaningful transition between the kernel and rich regimes, and we demonstrate the transition for more complex matrix factorization models and multilayer non-linear networks.

This paper analyzes an inductive bias of the gradient flow for diagonal two-or higher-homogeneous models and characterizes a limit point depending on the initialization scale of parameters. Concretely, the paper shows that the gradient flow converges to an interpolator attaining minimum L1- (or L2-norm) when the scale is small (or large). In addition, these analyses are well verified empirically on MNIST and CIFAR-10 datasets.
Quality:
The work is of good quality and is technically sound.
Clarity:
The paper is well organized and easy to read.
Significance:
To explain the generalization ability of powerful machine learning models that can perfectly learn a training dataset, the implicit bias of the optimization methods and models play key roles when explicit regularization is not adopted. For instance, deep neural networks fall into this scenario. I think this paper makes a better contribution in this line of researches. Although, homogeneous models treated in this study is restricted (essentially linear models) and a theory is limited to the continuous gradient flow, these settings are rather common in this context. In [Gunasekar+(2017)], the convergence to the minimum L1-norm solution was shown for a slightly different model when the scale goes to zero. However, in addition to this property, the paper analyzes arbitrary scales of parameters and shows the convergence to the minimum L2-norm solution when the scale goes to infinity for diagonal homogeneous models.
It would be nice if the authors could emphasize the technical difficulty compared to [Gunasekar+(2017)] to strengthen the contribution of the paper.
A few questions:
- Can this analysis be extended to the setting of early stopping? Toward a better explanation of the generalization performance of deep learning, understanding of the inductive bias of the early stopping before convergence is more important.
- A provided theory is limited to linear models essentially. Is it possible to extend a theory to non-linear models?
-----
Update:
I thank the authors for the response. I am convinced of the difference from [Gunasekar+(2017)] and my review stands. I  would like to keep my score.


In recent years several adversarial attacks and defenses have been proposed. Often seemingly robust models turn out to be non-robust when more sophisticated attacks are used. One way out of this dilemma are provable robustness guarantees. While provably robust models for specific l p -perturbation models have been developed, we show that they do not come with any guarantee against other l q -perturbations. We propose a new regularization scheme, MMR-Universal, for ReLU networks which enforces robustness wrt l 1 -and l ∞ -perturbations and show how that leads to the first provably robust models wrt any l p -norm for p ≥ 1.

Summary of the paper's contributions:
This paper proves a result on the l_p robustness (p \neq 1, \infty) of a piecewise affine classifier in terms of its l_1 and l_\infty robustness. This result is based on the insight that a guarantee for l_1 and l_\infty robustness of a piecewise affine classifier also guarantees robustness within the convex hull of the union of the l_1 and l_\infty balls. The paper then proposes a regularization scheme called MMR-Universal for a ReLU neural network that simultaneously trains for l_1 and l_\infty robustness. This scheme is based on maximizing the linear regions of the network as in Croce et al., AISTATS 2019. Using the main result of the paper, it is implied that the proposed regularization scheme also enforces l_p robustness for any p \geq 1.
Main comments: (1) The paper provides an interesting result that guarantees l_p robustness for a piecewise affine classifier based on only l_1 and l_\infty robustness. (2) The experiments show that the proposed regularization scheme is indeed effective in simultaneously guaranteeing robustness with respect to all l_p balls.
Detailed comments:
- The proposed regularization scheme does not come with any explicit robustness guarantee. Is it possible to show that a model that minimizes the regularized loss is guaranteed to be l_p robust for some radius? In Appendix C.3, it is mentioned that the best values for \gamma_p were empirically found to be 1-2 times the desired \epsilon_p robustness. Could this be formalized in theory?
- From Figure 2, it seems that there is an optimal ratio of l_1 to l_\infty robustness for which the l_2 guarantee is maximized. It would be interesting to see what this optimal ratio is for maximizing the l_p guarantee, as a function of dimension d and p.
- In the experiments, the MMR-Universal scheme is compared with MMR+AT-l_2 and MMR+AT-l_\infty. It would be interesting to compare it with MMR-l_1+AT-l_\infty or with MMR-l_\infty+AT-l_1.
- In eq(1), is c intended to be the true label at x?
- In Figure 2, the red curves are missing in the first and third plots.