Despite the huge success of deep neural networks (NNs), finding good mechanisms for quantifying their prediction uncertainty is still an open problem. It was recently shown, that using an ensemble of NNs trained with a proper scoring rule leads to results competitive to those of Bayesian NNs. This ensemble method can be understood as finite mixture model with uniform mixing weights. We build on this mixture model approach and increase its flexibility by replacing the fixed mixing weights by an adaptive, input-dependent distribution (specifying the probability of each component) represented by an NN, and by considering uncountably many mixture components. The resulting model can be seen as the continuous counterpart to mixture density networks and is therefore referred to as compound density networks. We empirically show that the proposed model results in better uncertainty estimates and is more robust to adversarial examples than previous approaches.

In this work the authors propose an extension of mixture density networks to the continuous domain, named compound density networks. Specifically the paper builds on top of the idea of the ensemble neural networks (NNs) and introduces a stochastic neural network for handling the mixing components. The mixing distribution is also parameterised by a neural network. The authors claim that the proposed model can result in better uncertainty estimates and the experiments attempt to demonstrate the benefits of the approach, especially in cases of having to deal with adversarial attacks.
The paper in general is well written and easy to follow. I have some concerns regarding the presentation of the main objective and the lack of justification in certain parts of the methodology. Let me elaborate. First of all, I don’t understand how the main equation of the compound density network in Equation (3) is different from the general case of a Bayesian neural network? Can the authors please comment on that?
I also find weird the way that the authors arrive to their final objective in Equation (5). They start from Equation (4) which is incorrectly denoted as the log-marginal distribution while it is the same conditional distribution introduced in Equation (3) with the extra summation for all the available data points. Then they continue to Equation (5) which they present as the combination of the true likelihood with a KL regularisation term. However, what the authors implicitly did was to perform variational inference for maximising their likelihood by introducing a variational distribution q(\theta) = p(\theta | g(x_n; \psi). Is there a reason why the authors do not introduce their objective by following the variational framework?
Furthermore, in the beginning of Section 3.1 the authors present their idea on probabilistic hypernetoworks which “maps x to a distribution over parameters instead of specific value \theta.” How is this different from the case that we were considering so far? If we had a point estimate for \theta we would not require to take an expectation in Equation (3) in the first place.
My biggest concern in the methodology, however, has to do with the selection of the matrix variate normal prior for the weights and the imposition of diagonal covariances (diag(a) and diag(b)). The Kronecker product between two diagonal matrices results in another diagonal matrix, i.e., diagonal covariance, which implies that the weights within a layer are given by an independent multivariate Gaussian. What is the purpose then for introducing the matrix variate Gaussian? I would expect that you would like to impose additional structure to the weights. I expect the authors to comment on that.
Regarding the experimental evaluation of the model rather confusing. The authors have proposed a model that due to the mixing is better suited for predictions with heteroscedastic noise and can better quantify the aleatoric uncertainty. However, the selected experiments on the cubic regression toy data (Section 5.1) and the out-of-distribution classification (Section 5.2) are clear examples of system’s noise, i.e. epistemic uncertainty. The generative process of the toy data clearly states that there is no heteroscedastic noise to handle. The same applies for the notMNIST data which belong to a completely different data set compared to MNIST and thus out of sample prediction cannot benefit from the mixing; i.e., variations have to be explained by system’s noise. So overall I have the feeling that the authors have not succeeded to evaluate the model’s power with these two experiments and we cannot draw any strong conclusions regarding the benefit of the proposed mixing approach.
To continue with the experimental evaluation, I found the plots with the predictive uncertainty in Figure 3 a bit confusing. The plot by itself, as I understood, quantifies the model’s uncertainty in in- and out-of sample prediction. While I agree with the authors that it is generally desirable for a model to be more confident when predicting in MNIST (since it has already seen samples of it) compared to when predicting in notMNIST (completely different data), these plots tells us nothing regarding the predictive power of the model. There is no value in being very confident if you are wrong and vice-versa, so unless there is an accompanying plot/table reporting the accuracy I see not much value from this plot alone.
Finally, it is unclear how the authors have picked the best \lambda parameter for their approach? On page 5 they state that they “pick the value that results in a good trade-off between high uncertainty estimates and high prediction accuracy.” Does this mean that you get to observe the performance in the test in order to select the appropriate value for \lambda? If this is the case this is completely undesirable and is considered a bad practice.


ROTATE: KNOWLEDGE GRAPH EMBEDDING BY RELA- TIONAL ROTATION IN COMPLEX SPACE
We study the problem of learning representations of entities and relations in knowledge graphs for predicting missing links. The success of such a task heavily relies on the ability of modeling and inferring the patterns of (or between) the relations. In this paper, we present a new approach for knowledge graph embedding called RotatE, which is able to model and infer various relation patterns including: symmetry/antisymmetry, inversion, and composition. Specifically, the RotatE model defines each relation as a rotation from the source entity to the target entity in the complex vector space. In addition, we propose a novel self-adversarial negative sampling technique for efficiently and effectively training the RotatE model. Experimental results on multiple benchmark knowledge graphs show that the proposed RotatE model is not only scalable, but also able to infer and model various relation patterns and significantly outperform existing state-of-the-art models for link prediction.

# Summary
This paper presents a neural link prediction scoring function that can infer symmetry, anti-symmetry, inversion and composition patterns of relations in a knowledge base, whereas previous methods were only able to support a subset. The method achieves state of the art on FB15k-237, WN18RR and Countries benchmark knowledge bases. I think this will be interesting to the ICLR community. I particularly enjoyed the analysis of existing methods regarding the expressiveness of relational patterns mentioned above.
# Strengths
- Improvements over prior neural link prediction methods
- Clearly written paper
- Interesting analysis of existing neural link prediction methods
# Weaknesses
- As the authors not only propose a new scoring function for neural link prediction but also an adversarial sampling mechanism for negative data, I believe a more careful ablation study should have been carried out. There is an ablation study showing the impact of the negative sampling on the baseline TransE, as well as another ablation in the appendix demonstrating the impact of negative sampling on TransE and the proposed method, RotatE, for the FB15k-237. However, from Table 10 in the appendix, one can see that the two competing methods, TransE and RotatE, in fact, perform fairly similarly once both use adversarial sampling it still remains unclear whether the gains observed in table 4 and 5 are due to adversarial sampling or a better scoring function. Particularly, I want to see results of a stronger baseline, ComplEx, equipped with the adversarial sampling approach. Ideally, I would also like to see multiple repeats of the experiments to get a sense of the variance of the results (as it has been done for Countries in Table 6).
# Minor Comments
- Eq 5: Already introduce gamma (the fixed margin) here.
- While I understand that this paper focuses on knowledge graph embeddings, I believe the large body of other relational AI approaches should be mention as some of them can also model symmetry, anti-symmetry, inversion and composition patterns of relations as well (though they might be less scalable and therefore of less practical relevance), e.g. the following come to mind:
  - Lao et al. (2011). Random walk inference and learning in a large scale knowledge base.
  - Neelakantan et al. (2015). Compositional vector space models for knowledge base completion.
  - Das et al. (2016). Chains of Reasoning over Entities, Relations, and Text using Recurrent Neural Networks.
  - Rocktaschel and Riedel (2017). End-to-end Differentiable Proving.
  - Yang et al. (2017). Differentiable Learning of Logical Rules for Knowledge Base Completion.
- Table 6: How many repeats were used for estimating the standard deviation?
Update: I thank the authors for their response and additional experiments. I am increasing my score to 7.


ANALYSIS OF QUANTIZED MODELS
Deep neural networks are usually huge, which significantly limits the deployment on low-end devices. In recent years, many weight-quantized models have been proposed. They have small storage and fast inference, but training can still be time-consuming. This can be improved with distributed learning. To reduce the high communication cost due to worker-server synchronization, recently gradient quantization has also been proposed to train deep networks with full-precision weights. In this paper, we theoretically study how the combination of both weight and gradient quantization affects convergence. We show that (i) weight-quantized models converge to an error related to the weight quantization resolution and weight dimension; (ii) quantizing gradients slows convergence by a factor related to the gradient quantization resolution and dimension; and (iii) clipping the gradient before quantization renders this factor dimension-free, thus allowing the use of fewer bits for gradient quantization. Empirical experiments confirm the theoretical convergence results, and demonstrate that quantized networks can speed up training and have comparable performance as full-precision networks.

Summary:
This paper studies the convergence properties of loss-aware weight quantization with different gradient precisions in the distributed environment, in which servers keeps the full-precision weights and workers keeps quantized weights. The authors provided convergence analysis for weight quantization with full-precision, quantized and quantized clipped gradients. Specifically, they find that: 1) the regret of loss-aware weight quantization with full-precision gradient converge to an error related to the weight quantization resolution and dimension d. 2) gradient quantization slows the convergence by a factor related to gradient quantization resolution and dimension d. 3) gradient clipping renders the speed degradation dimension-free.
Comments:
Pros:
- The paper is generally well written and organized. The notation is clean and consistent. Detailed proofs can be found in the appendix, the reader can appreciate the main results without getting lost in details.
- The paper provides theoretical analysis for the convergence properties of loss-aware weight quantization with full-precision gradients, quantized gradient and clipped quantized gradient, which extends existing analysis beyond full-precision gradients, which could be useful for distributed training with limited bandwidth.
Cons:
- It is unclear what problems the authors try to solve. The problem is about gradient compression, or how the gradient precision will affect the convergence for training quantized nets in the distributed environment, in which workers have limited computation power and the network bandwidth is limited. It is an interesting setting, however, the author does not make it clear the questions they are asking and how the theoretical results can guide the practical algorithm design.
- The authors mentioned that quantized gradient slows convergence (relative to using full-precision gradient) in contribution 2 while also claims that quantizing gradients can significantly speed up training of quantized weights in contribution 4, which is contradictory to each other.
- It is not clear what relaxation was made on the assumptions of f_t in section 3.1. The analysis are still based on three common assumptions: 1) f_t is convex 2) f_t is twice differentiable 3) f_t has bounded gradients. The assumptions and theoretical results may not hold for non-convex deep nets. E.g., the author does not valides the theorems results on d with neural networks but only with linear models in section 4.1.
- The author demonstrate training quantized nets in the distributed environment with quantized gradients, however, no comparison is made with other related works (e.g., Wen et al, 2017).
Questions:
- Theorem 1 is an analysis for training with quantized weights and full-precision gradients, which is essentially the same setting as BinaryConnect. Similar analysis has been done in Li et al, 2017. What is the difference or connection with their bound?
- It is not clear how gradienta are calculated w.r.t. quantized weights on worker, is straight through estimator (STE) used for backpropagation through Q_w?
- In section 3.3, why is \tilde{g}_t stochastically quantized gradient? How about statiscally quantized gradients?
- Why do the authors use linear model in section 4.1? Why are the solid lines in Figure 3 finished earlier than dashed lines? For neural networks, a common observation is that the larger the dimension d, the better the generalization performance. However, Figure 3 and Theorem 1 seem to be contradictory to this common belief. Would it possible to verify the theorem on deep nets of different dimension?
- Why does the number of worker affect the performance? I failed to see why the number of workers affect the performance of training if it is a synchronized distributed training with the same total batch size. After checking appendix C, I think it is better to discuss the influence of batch sizes rather than the number of workers.
- Why is zero weight decay used for CIFAR-10 experiment but non-zero weight decay for imagenet experiment? How was weight decay applied in Adam for quantized weights?
Minor issues:
- The notation of full-precision gradient w.r.t quantized weights in Figure 1 should be \hat{g}_t, however, g_t is used.


SELF-MONITORING NAVIGATION AGENT VIA AUXIL- IARY PROGRESS ESTIMATION
The Vision-and-Language Navigation (VLN) task entails an agent following navigational instruction in photo-realistic unknown environments. This challenging task demands that the agent be aware of which instruction was completed, which instruction is needed next, which way to go, and its navigation progress towards the goal. In this paper, we introduce a self-monitoring agent with two complementary components: (1) visual-textual co-grounding module to locate the instruction completed in the past, the instruction required for the next action, and the next moving direction from surrounding images and (2) progress monitor to ensure the grounded instruction correctly reflects the navigation progress. We test our selfmonitoring agent on a standard benchmark and analyze our proposed approach through a series of ablation studies that elucidate the contributions of the primary components. Using our proposed method, we set the new state of the art by a significant margin (8% absolute increase in success rate on the unseen test set). Code is available at https://github.com/chihyaoma/selfmonitoring-agent.

This paper describes a model for vision-and-language navigation. The proposed
model adds two components to the baseline model proposed by Fried et al. (2018):
- a panoramic visual attention (referred to in this paper as "visual--textual
  co-grounding"), in which the full scene around the agent's current position is
  attended to prior to selecting a direction to follow
- an auxiliary "progress monitoring" loss which encourages the agent to to
  produce textual attentions from which the distance to the goal can be directly
  inferred
The two components combine to give state-of-the-art results on the Room2Room
dataset: small improvements over existing approaches on the "-seen" evaluation
set and larger improvements on the "-unseen" evaluation sets. These improvements
also stack with the data-augmentation approach of Fried et al.
I think this is a reasonable submission and should probably be accepted. However, I
have some concerns about presentation and a number of specific questions about
model implementation and evaluation.
PRESENTATION AND NAMING
First off: I implore the authors to find some descriptor other than "self-aware"
for the proposed model. "Self-aware" is an imprecise description of the agent in
this paper---the agent is specifically "aware" of its visual surroundings and
its distance from the goal, neither of which is meaningfully an aspect of
"self". Moreover, self-awareness means something quite different in adjacent
areas of cognitive science and philosophy; overloading the term in the specific
(and comparatively mundane) way used here creates confusion. See section 3.4 of
https://arxiv.org/abs/1807.03341 for broader discussion. Perhaps something
like "visual / temporal context-sensitivity" to describe what's new here? A bit
clunky, but I think it makes the contributions of this work much clearer.
As suggested in the summary above, I also think "visual--textual co-attention"
is also an unhelpfully vague description of this aspect of the contribution. The
textual attention mechanism used in this paper is the same as in all previous
work on the task. Representations of language don't even interact with the
visual attention mechanism except by way of the hidden state, and the salient
new feature of the visual attention is the fact that it considers the full
panoramic context before choosing a direction.
MODELING QUESTIONS
- p4: $y_t^{pm}$ is defined as the "normalized distance from the current
  viewpoint to the goal". Is this distance in units of length (as defined by the
  simulator) or units of time (i.e. the number of discrete "steps" needed to
  reach the goal)?
  The authors have already clarified on OpenReview that the progress monitor
  objective uses an MSE loss rather than a likelihood loss. Do I understand
  correctly that ground-truth distances are in [0, 1] but model predictions are
  in [-1, 1]? Why not use a sigmoid? Also, how does scoring beam-search
  candidates as $p_t^{pm} \times p_{k,t}$ work if $p_t^{pm}$ can flip the sign?
- The input to the progress monitor is formed by concatenating the attention
  vector $\alpha_t$ to a vector of state features, and then multiplying by a
  fixed weight matrix. How is this possible? The size of $\alpha_t$ varies
  depending on the length of the instruction sequence. Are attentions padded out
  to the length of the longest instruction in the training set? If so, how can
  the model learn when it's reached the end of a short instruction sequence?
  What would happen if the agent encountered a sequence that was too long?
EVALUATION QUESTIONS
- The progress monitor is used both as an auxiliary training objective and as a
  beam search heuristic. Is it possible to disentangle these two contributions?
  (E.g. by ignoring the scores during beam search, or by doing augmented beam
  search in a model that was trained without the auxiliary objective.)
- Not critical, but it would be nice to know if the contributions here stack
  with the pragmatic inference procedure in Fried et al.
- While, as pointed out on OpenReview, it is not required to include SPL
  evaluations, I think it would be informative to do so---the preliminary
  results with no beam search look good!
MISCELLANEOUS
p1: "without a map" If you can do beam search, you effectively have a map.
p1: "...smoothly" What does "smoothly" mean in this context?
p2: "the position of grounded instruction can follow past and future
    instructions". Is the claim here that if instructions are of the form "ACB"
    and the agent is supposed to do "ABC", that the proposed model will execute
    these instructions successfully and the baseline will not? This claim does
    not appear to be evaluated anywhere in the body of the paper.
p4: "intelligently prunes" "Intelligently" is unnecessary.
p4: "for empirical reasons" What does this mean?
p5: "Intuitively, an instruction-following agent is required..." The existence
    of non-attentive models that do reasonably well at these
    instruction-following tasks suggest that this is not actually a requirement.


META-LEARNING UPDATE RULES FOR UNSUPER- VISED REPRESENTATION LEARNING
A major goal of unsupervised learning is to discover data representations that are useful for subsequent tasks, without access to supervised labels during training. Typically, this involves minimizing a surrogate objective, such as the negative log likelihood of a generative model, with the hope that representations useful for subsequent tasks will arise as a side effect. In this work, we propose instead to directly target later desired tasks by meta-learning an unsupervised learning rule which leads to representations useful for those tasks. Specifically, we target semi-supervised classification performance, and we meta-learn an algorithman unsupervised weight update rule -that produces representations useful for this task. Additionally, we constrain our unsupervised update rule to a be a biologically-motivated, neuron-local function, which enables it to generalize to different neural network architectures, datasets, and data modalities. We show that the meta-learned update rule produces useful features and sometimes outperforms existing unsupervised learning techniques. We further show that the meta-learned unsupervised update rule generalizes to train networks with different widths, depths, and nonlinearities. It also generalizes to train on data with randomly permuted input dimensions and even generalizes from image datasets to a text task.

This paper introduces a novel meta-learning approach to unsupervised representation learning where an update rule for a base model (i.e., an MLP) is meta-learned using a supervised meta-objective (i.e., a few-shot linear regression from the learned representation to classification GTs). Unlike previous approaches, it meta-learns an update rule by directly optimizing the utility of the unsupervised representation using the meta-objective. In the phase of unsupervised representation learning, the learned update rule is used for optimizing a base model without using any other base model objective. Experimental evaluations on few-shot classification demonstrate its generalization performance over different base architectures, datasets, and even domains.
+  Novel and interesting formulation of meta-learning by learning an unsupervised update rule for representation learning.
+  Technically sound, and well organized overall with details documented in appendixes.
+  Clearly written overall with helpful schematic illustrations and, in particular, a good survey of related work.
+ Good generalization performance over different (larger and deeper) base models, activation functions, datasets, and even a different modality (text classification).
-  Motivations are not very clear in some parts. E.g., the reason for learning backward weights (V), and the choice of meta-objective.
- Experimental evaluation is limited to few-shot classification, which is very close to the meta-learning objective used in this paper.
- The result of text classification is interesting, but not so informative given no further analysis. E.g., why domain mismatch does not occur in this case?
I enjoyed reading this paper, and happy to recommend it as a clear accept paper. The idea of meta-learning update networks looks a promising direction worth exploring, indeed.
I hope the authors to clarify the things I mentioned above. Experimental results are enough considering the space limit, but not great. Since the current evaluation task is quite similar to the meta-objective, evaluations on more diverse tasks would strengthen this paper.
Finally, this paper aims at unsupervised representation learning, but it’s not clear from the current title, which is somewhat misleading. I think that's quite an important feature of this paper, so I highly recommend the authors to consider a more informative title, e.g., `Learning Rules for Unsupervised Representation Learning’ or else.


Highly regularized LSTMs achieve impressive results on several benchmark datasets in language modeling. We propose a new regularization method based on decoding the last token in the context using the predicted distribution of the next token. This biases the model towards retaining more contextual information, in turn improving its ability to predict the next token. With negligible overhead in the number of parameters and training time, our Past Decode Regularization (PDR) method achieves a word level perplexity of 55.6 on the Penn Treebank and 63.5 on the WikiText-2 datasets using a single softmax. We also show gains by using PDR in combination with a mixture-of-softmaxes, achieving a word level perplexity of 53.8 and 60.5 on these datasets. In addition, our method achieves 1.169 bits-per-character on the Penn Treebank Character dataset for character level language modeling. These results constitute a new state-of-the-art in their respective settings.

This paper proposes an additional loss term to use when training an LSTM LM.  The authors argue that, intuitively, we want the output distribution to retain some information about the context, or "past".  Given this, they use the output distribution as input to a one layer network that must predict the current token.  The loss for this network is incorporated as an additional term used when training the LM.  The authors show that by adding this loss term they can achieve SOTA (for single softmax model) perplexity on a number of LM benchmarks.
The technical contribution is proposing a new loss term to use when training a language model.  The idea is clear, simple, and well explained, and it seems to be effective in practice.  One drawback is that it is highly specific to language models.  Other recent works which have demonstrated effective regularization of LSTM LMs have proposed methods that can be used in any LSTM model, but that is not the case here.  In addition, there is not much theoretical justification for it, it seems like a one-off trick.  The loss term is motivated by the idea that we want the output distribution to retain some information about the context, but why should that be the case?
Although it is specific to language models, there are a few reasons it might be of broader significance:
- It falls in the recent line of work in incorporating auxiliary losses for various tasks.  This idea has touched many problems and seen success in practice.
- Perhaps it can be applied to other sequence models.  For example in encoder-decoder models, the decoder can be thought of as a conditional LM.
Experiments are comprehensive and rigorous.  They might be more convincing if there were results on a very large corpus such as 1 billion word corpus.
Pros:
- New SOTA for single softmax model on LM benchmarks.
- Simple, clearly explained idea.
- Demonstrates effectiveness of auxiliary losses.
- Rigorous experiments.
Cons
- Trick is specific to LM.
- No large corpus results.


ROBUSTNESS MAY BE AT ODDS WITH ACCURACY
We show that there exists an inherent tension between the goal of adversarial robustness and that of standard generalization. Specifically, training robust models may not only be more resource-consuming, but also lead to a reduction of standard accuracy. We demonstrate that this trade-off between the standard accuracy of a model and its robustness to adversarial perturbations provably exists even in a fairly simple and natural setting. These findings also corroborate a similar phenomenon observed in practice. Further, we argue that this phenomenon is a consequence of robust classifiers learning fundamentally different feature representations than standard classifiers. These differences, in particular, seem to result in unexpected benefits: the features learned by robust models tend to align better with salient data characteristics and human perception.

This paper presents a study of tradeoffs between adversarial and standard accuracy of classifiers. Though it might be expected that training for adversarial robustness always leads to improvement in standard accuracy, however the authors claim that the actual situation is quite subtle. Though adversarial training might help towards increasing standard accuracy in certain data regimes such as data scarcity, but when sufficient data is available there exists a trade-off between the two goals. The tradeoff is demonstrated in a fairly simple setting in which case data consists of two kinds of features - those which are weakly correlated with the output, and those which are strongly correlated. It is shown that adversarial accuracy depends on the feature which exhibit strong correlation, while standard accuracy depends on weakly correlated features.
Though the paper presents some interesting insights. Some of the concerns  are :
 - The paper falls short in answering the tradeoff question under a more general setup. The toy example is very specific with a clear separation between weak and strongly correlated features. It would be interesting to see how similar results can be derived when under more complicated setup with many features with varying extent of correlation.
 - The tradeoff between standard and robustness under linear classification has also been demonstrated in a recent work [1]. In [1], it is also argued that for datasets consisting of large number of labels, when some of the labels are under data-scarce regimes, an adversarial robustness view-point (via l1-regularization) helps in accuracy improvement for those labels. However, for other set of labels for which there is sufficient data available,  l2-regularization is more suited, and adversarial robustness perspective decreases standard accuracy. From this view-point, one could argue that some of the main contributions in the current paper, could be seen as empirical extensions for deep learning setup. It would be instructive to contrast and explore connections between this paper, and the observations in [1].
[1] Adversarial Extreme Multi-label Classification, https://arxiv.org/abs/1803.01570
==============post-rebuttal======
thanks for the feedback, I update my rating of the paper


Recent works find that DNNs are vulnerable to adversarial examples, whose changes from the benign ones are imperceptible and yet lead DNNs to make wrong predictions. One can find various adversarial examples for the same input to a DNN using different attack methods. In other words, there is a population of adversarial examples, instead of only one, for any input to a DNN. By explicitly modeling this adversarial population with a Gaussian distribution, we propose a new black-box attack called N ATTACK. The adversarial attack is hence formalized as an optimization problem, which searches the mean of the Gaussian under the guidance of increasing the target DNN's prediction error. N ATTACK achieves 100% attack success rate on six out of eleven recently published defense methods (and greater than 90% for four), all using the same algorithm. Such results are on par with or better than powerful state-of-the-art white-box attacks. While the white-box attacks are often model-specific or defense-specific, the proposed black-box N ATTACK is universally applicable to different defenses.

In this work the authors use a score-based adversarial attack (based on the natural evolution strategy (NES)) to successfully attack a multitude of defended networks, with success rates rivalling the best gradient-based attacks.
As confirmed by the authors in a detailed and very open response to a question of mine, the attack introduced here is actually equivalent to [1]. While the attack itself is not novel (which will require a major revision of the manuscript), the authors point out the following contributions over [1]:
* Attack experiments here go way beyond Ilyas et al. in terms of Lp metrics, different defense models, different datasets and transferability.
* Different motivation/derivation of NES.
* Concept of adversarial distributions.
* Regression network for good initialization.
* Introduction of accuracy-iterations plots.
My main concerns are as follows:
* The review of the prior literature, in particular on score-based and decision-based defences (the latter of which are not even mentioned), is very limited and is framed wrongly. In particular, the statement “However, existing black-box attacks are weaker than their white-box counterparts” is simply not true: as an example, the most prominent decision-based attack [2] rivals white-box attacks on vanilla DNNs as well as defended networks [3].
* The concept of adversarial distributions is not new but is common in the literature of real-world adversarials that are robust to transformations and perturbations (like gaussian noise), check for example [4]. In [4] the concept of _Expectation Over Transformation (EOT)_ is introduced, which is basically the generalised concept of the expectation over gaussian perturbations introduced in this work.
* While I like the idea of accuracy-iterations plots, the idea is not new, see e.g. the accuracy-iterations plot in [2] (sample-based, Figure 6), the loss-iterations plot in [5] or the accuracy-distortion plots in [3]. However, I agree that these type of visualisation or metric is not as widespread as it should be.
Hence, in summary the main contribution of the paper is the application of NES against different defence models, datasets and Lp metrics as well as the use of a regression network for initialisation. Along this second point it would be great if the authors would be able to demonstrate substantial gains in the accuracy-query metric. In any case, in the light of previous literature a major revision of the manuscript will be necessary.
[1] Ilyas et al. (2018) “Black-box Adversarial Attacks with Limited Queries and Information” (https://arxiv.org/abs/1804.08598)
[2] Brendel et al. (2018) “Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Models” (https://arxiv.org/abs/1712.04248)
[3] Schott et al. (2018) “Towards the first adversarially robust neural network model on MNIST” (https://arxiv.org/abs/1805.09190)
[4] Athalye et al. (2017) “Synthesizing Robust Adversarial Examples” (https://arxiv.org/pdf/1707.07397.pdf)
[5] Madry et al. {2017) “Towards Deep Learning Models Resistant to Adversarial Attacks” (https://arxiv.org/pdf/1706.06083.pdf)


Common approaches to Reinforcement Learning (RL) are seriously challenged by large-scale applications involving huge state spaces and sparse delayed reward feedback. Hierarchical Reinforcement Learning (HRL) methods attempt to address this scalability issue by learning action selection policies at multiple levels of temporal abstraction. Abstraction can be had by identifying a relatively small set of states that are likely to be useful as subgoals, in concert with the learning of corresponding skill policies to achieve those subgoals. Many approaches to subgoal discovery in HRL depend on the analysis of a model of the environment, but the need to learn such a model introduces its own problems of scale. Once subgoals are identified, skills may be learned through intrinsic motivation, introducing an internal reward signal marking subgoal attainment. In this paper, we present a novel model-free method for subgoal discovery using incremental unsupervised learning over a small memory of the most recent experiences of the agent. When combined with an intrinsic motivation learning mechanism, this method learns subgoals and skills together, based on experiences in the environment. Thus, we offer an original approach to HRL that does not require the acquisition of a model of the environment, suitable for large-scale applications. We demonstrate the efficiency of our method on two RL problems with sparse delayed feedback: a variant of the rooms environment and the ATARI 2600 game called Montezuma's Revenge.

This paper proposes an unsupervised method for subgoal discovery and shows how to combine it with a model-free hierarchical reinforcement learning approach. The main idea behind the subgoal discovery approach is to first build up a buffer of “interesting” states using ideas from anomaly detection. The states in the buffer are then clustered and the centroids are taken to be the subgoal states.
Clarity:
I found the paper somewhat difficult to follow. The main issue is that the details of the algorithm are scattered throughout the paper with Algorithm 1 describing the method only at a very high level. For example, how does the algorithm determine that an agent has reached a goal? It’s not clear from the algorithm box. Some important details are also left out. The section on Montezuma’s Revenge mentioned that the goal set was initialized using a “custom edge detection algorithm”. What was the algorithm? Also, what exactly is being clustered (observations or network activations) and using what similarity measure? I can’t find it anywhere in the paper. Omissions like this make the method completely unreproducible.
Novelty:
The idea of using clustering to discover goals in reinforcement learning is quite old and the paper does a poor job of citing the most relevant prior work. For example, there is no mention of “Dynamic Abstraction in Reinforcement Learning via Clustering” by Mannor et al. or of “Learning Options in Reinforcement Learning” by Stolle and Precup (which uses bottleneck states as goals). The particular instantiation of clustering interesting states used in this paper does seem to be new but it is important to do a better job of citing relevant prior work and the overall novelty is still somewhat limited.
Significance:
I was not convinced that there are significant ideas or lessons to be taken away from this paper. The main motivation was to improve scalability of RL and HRL to large state spaces, but the experiments are on the four rooms domain and the first room of Montezuma’s Revenge, which is not particularly large scale. Existing HRL approaches, e.b. Feudal Networks from Vezhnevets et al. have been shown to work on a much wider range of domains. Further, it’s not clear how this method could address scalability issues. Repeated clustering could become expensive and it’s not clear how the number of clusters affects the approach as the complexity of the task increases. I would have liked to see some experiments showing how the performance changes for different numbers of clusters because setting the number of clusters to 4 in the four rooms task is a clear use of prior knowledge about the task.
Overall quality:
The proposed approach is based on a number of heuristics and is potentially brittle. Given that there are no ablation experiments looking at how different choices (number of clusters/goals, how outliers are selected, etc) I’m not sure what to take away from this paper. There are just too many seemingly arbitrary choices and moving parts that are not evaluated separately.
Minor comments:
- Can you back up the first sentence of the abstract? AlphaGo/AlphaZero do well on the game of Go which has ~10^170 valid states.
- First sentence of introduction. How can the RL problem have a scaling problem? Some RL methods might, but I don’t understand what it means for a problem to have scaling issues.
- Please check your usage of \cite and \citep. Some citations are in the wrong format.
- The Q-learning loss in section 2 is wrong. The parameters of the target (r+\gamma max Q) are held fixed in Q-learning.


Learning deep neural networks could be understood as the combination of representation learning and learning halfspaces. While most previous work aims to diversify representation learning by data augmentations and regularizations, we explore the opposite direction through the lens of empirical Bayes method. Specifically, we propose a matrix-variate normal prior whose covariance matrix has a Kronecker product structure to capture the correlations in learning different neurons through backpropagation. The prior encourages neurons to learn from the experience of others, hence it provides an effective regularization when training large networks on small datasets. To optimize the model, we design an efficient block coordinate descent algorithm with analytic solutions. Empirically, we show that the proposed method helps the network converge to better local optima that also generalize better, and we verify the effectiveness of the approach on both multiclass classification and multitask regression problems with various network structures.

Summary: The submission proposes a method to learn Kronecker factors of the covariance of a matrix-variate normal distribution over neural network weights. Given a setting of the neural network weights, the Kronecker factors can be found in closed form by solving a convex optimization problem.
Strengths:
+ The paper provides a thorough theoretical motivation for computing a positive definite factorization of the regularization term in the empirical Bayes setup.
Weaknesses:
- The novelty of the method is overstated.
- The method is claimed to be efficient, but each iteration requires an inner loop of solving a MAP problem (via gradient descent on the negative log likelihood with an extra regularization term), which is at least as expensive as a standard training run.
- The submission lacks precise technical writing, and many technical details appear in inappropriate places, such as the introduction.
- The experimental evaluation is not strong.
Major comments:
- The use of empirical Bayes is not novel in the context of neural networks despite the submission's claim that "Existing studies on
parametric empirical Bayes methods focus on the setting where the likelihood function and the prior are assumed to have specific forms" (pg. 1). In particular, see e.g., https://papers.nips.cc/paper/6864-an-empirical-bayes-approach-to-optimizing-machine-learning-algorithms.pdf, https://arxiv.org/abs/1801.08930, https://arxiv.org/abs/1807.01613 for the use of non-conjugate likelihoods in empirical Bayes.
- The cited motivation for the use of a matrix-variate normal prior over the weights of a neural network is weak. In particular, one iteration of credit assignment via backpropagation in a one-layer neural network does not adequately describe the complex interactions between parameters of a nonlinear model over the course of an optimization procedure such as the one used in line 2 of Algorithm 1. In addition, a learned prior can be used to introduce additional correlations between parameters, so it is strange to describe the learned prior as "capturing correlations" resulting from a single weight update.
- The submission lacks clarity on the assumptions entailed by using the proposed methodology, namely that the Kronecker factors are assumed positive definite. For instance, the logdet function is defined for positive definite (PD) matrices, the results in the paragraph titled "Approximate Volume Minimization" hold only for PD matrices, and the InvThresholding procedure is valid for only the same class. It should additionally be noted that this assumption is *not* required for a Kronecker factorization to be defined.
- The submission makes heavy use of Kronecker factorization, but neglects to cite works that use a similar factorization of the covariance matrices for neural network applications (e.g., https://arxiv.org/abs/1503.05671, https://arxiv.org/abs/1712.02390). Furthermore, the method bears a strong similarity to https://arxiv.org/abs/1506.02117 in learning a Kronecker-factored covariance structure between parameters of a neural network. Can the authors comment on the similarities and differences?
- Results are reported on a simple regression task (SARCOS) and multiclass classification problems (MNIST & CIFAR10) using a neural network with a single hidden layer. Moreover, "in all the experiments, the AEB algorithm is performed on the softmax layer" (pg. 7) and the justification for this in the "Ablations" section is opaque to me. Was a similar restriction used for L2 weight decay regularization? I can't interpret how thorough the evaluation is without such details. It is also not clear that the approach is extensible to more complex architectures, or that there would be a significant empirical benefit if this is done.
- Figure 5 does not really exhibit interesting learned structure in the correlation matrix. Why not plot a visualization of the learned prior, rather than the weights?
Minor comments:
- The submission needs to be checked for English grammar and style.
- abstract: "Learning deep neural networks could be understood as the combination of representation learning and learning halfspaces." This is unclear.
- pg. 2: "Empirically, we show that the proposed method helps the network
converge to better local optima that also generalize better..."  What is a "better" local optimum?
- Section 3.1 describes empirical Bayes with point estimates. Please make it clearer that this methodology is not itself a contribution of paper by citing prior work.
- pg. 5: "Alg. 1 terminates when a stationary point is found." What exactly is the stopping criterion?
- pg. 6: The labels in Figure 2 are extremely small. Moreover, please keep the y-axis range constant.
- pg. 6, Figure 2 caption: "AEB improves generalization under both minibatch settings and is most beneficial when training set is small." Do the CIFAR10 results not show the opposite effect, that the regularization is most beneficial when the training set is large?
- pg. 7: "Batch Normalization suffers from large batch size in CIFAR10" weird wording
- pg. 8: "One future direction is to develop a better approximate solution to optimize the two covariance matrices from the marginal log-likelihood function." This is unclear.


CONTINGENCY-AWARE EXPLORATION IN REINFORCEMENT LEARNING
This paper investigates whether learning contingency-awareness and controllable aspects of an environment can lead to better exploration in reinforcement learning. To investigate this question, we consider an instantiation of this hypothesis evaluated on the Arcade Learning Element (ALE). In this study, we develop an attentive dynamics model (ADM) that discovers controllable elements of the observations, which are often associated with the location of the character in Atari games. The ADM is trained in a self-supervised fashion to predict the actions taken by the agent. The learned contingency information is used as a part of the state representation for exploration purposes. We demonstrate that combining actor-critic algorithm with count-based exploration using our representation achieves impressive results on a set of notoriously challenging Atari games due to sparse rewards.
1 For example, we report a state-of-the-art score of >11,000 points on MONTEZUMA'S REVENGE without using expert demonstrations, explicit high-level information (e.g., RAM states), or supervisory data. Our experiments confirm that contingency-awareness is indeed an extremely powerful concept for tackling exploration problems in reinforcement learning and opens up interesting research questions for further investigations.

This paper investigates the problem of extracting a meaningful state representation to help with exploration in RL, when confronted to a sparse reward task. The core idea consists in identifying controllable (learned) features of the state, which in an Atari game for instance typically corresponds to the position of the player-controlled character / vehicle on the screen. Once this position is known (as x, y coordinates on a custom low-resolution grid), one can use existing count-based exploration mechanisms to encourage the agent to visit new positions (NB: in addition to the x, y coordinates, extra information is also used to disambiguate the states for counting purpose, namely the current score and the state’s cluster index obtained with a basic clustering scheme). To find the position, the algorithm trains one inverse dynamics model per x, y cell on the grid: each model tries to predict the action taken by the agent given two consecutive states, both represented by their feature map (at coordinate x, y) learned by a convolutional network applied to the pixel representation. The outputs of these inverse dynamics models are combined through an attention mechanism to output the final prediction for the action: the intuition is that the attention model will learn to focus on the grid cell with best predictive power (for a given state), which should correspond to where the controllable parts of the state are. Experiments on several Atari games (including Montezuma’s Revenge) indeed show that this mechanism is able to track the true agent’s coordinates (obtained from the RAM state) reasonably well. Using these coordinates for count-based exploration (in A2C) also yields significantly better results compared to vanilla A2C, and beats several previously proposed related techniques for exploration in sparse reward settings.
The topic being investigated here (hard-exploration tasks) is definitely very relevant to current RL research, and the proposed technique introduces some novel ideas to address it, notably the usage of an attention model combined with multiple inverse dynamics models so as to identify controllable features in the environment. The approach seems sound to me and is clearly explained. Combined with pretty good results on well known hard Atari games, I am leaning toward recommending acceptance at ICLR.
I have a few significant concerns though, the first one being that the end result seems quite tailored to the specific Atari games of interest: trying to apply it to other tasks (or even just Atari games with different characteristics) may require significant changes (ex: the assumption that a single region of the screen is being controlled by the agent, the clustering to identify the various “rooms” of a game, and using the total score as a proxy to important state information). I do believe that some components are more general though (in particular the main new ideas in the paper), so this is not necessarily a major issue, but another example of application of these ideas to a different domain could have strengthened the submission.
In addition, even if experiments definitely investigate relevant aspects of the algorithm, I wish there had been an ablation study on the three components of the state representation used for counting (coordinates, cluster and reward). In particular it would be disappointing if similar results could be obtained with just the cluster and reward... even if I do not expect it to be the case, an empirical validation would have been welcome to be 100% sure.
The good results obtained here from exploration alone also beg the question whether this state representation could be useful to train the agent, by plugging it directly as input to the policy network (which by the way may not be trivial due to the co-training, but you get the idea). I realize that the focus of the paper is on exploration, and this is fine, but it seems to me a bit of a waste to build such a powerful state abstraction mechanism and not give the agent access to it. I was surprised that it was not at least mentioned in the discussion or conclusion. Note by the way that the conclusion says the agent “benefits from a compact, informative representation of the world”, which can be misinterpreted as using it in its policy.
Regarding the algorithm itself, one potential limitation is the fact that the inverse dynamics models rely on a single time step to identify the action that was taken. This means that they can only identify controllable state features that change immediately after taking a given action. But if an action has “cascading” effects (the immediate state change causing further changes down the road), there may be other important state features that could be controlled (across longer timesteps), but the algorithm will ignore them (also, in a POMDP one may need to wait for more than one timestep to even observe a single change in the state). I suspect that a more generic variant of this idea, better accounting for long term effects of actions, may thus be needed in order to work optimally in more varied settings.
Finally, I believe more papers deserve to be cited in the “Related Work” section. In particular, the idea of controlling features of the environment, (even if not specifically for exploration), has also been explored in (at least) the following papers:
- “Reinforcement Learning with Unsupervised Auxiliary tasks” (Jaderberg et al, 2017)
- “Feature Control as Intrinsic Motivation for Hierarchical Reinforcement Learning” (Dilokthanakul et al, 2017)
- “Independently Controllable Factors” (Thomas et al, 2017)
- “Disentangling Controllable and Uncontrollable Factors of Variation by Interacting with the World” (Sawada, 2018)
Relying on the position of the agent on the screen to drive exploration in Atari games has also been used in: “Deep Curiosity Search: Intra-Life Exploration Improves Performance on Challenging Deep Reinforcement Learning Problems” (Stanton & Clune, 2018)
Other remarks:
- Please share the code if possible
- In the Introduction, the sentence “it is still an open question on how to construct an optimal representation for exploration” seems to repeat “there is an ongoing open question about the most effective way of using neural network representations for exploration” => I wonder if one was supposed to replace the other?
- On p.2, last line containing citations: Pathak et al should be in the parentheses
- Please explicitly refer to Fig. 1 (Right) in 3.1
- On p.4, three lines above eq. 5, there is a hat{alpha} that should probably be hat{a}
- Is the left hand side L in eq. 5 the same as L^inv in Alg. 1? If so please use the same notations
- “privious” work in 3.2
- In 3.2 please briefly explain what psi is going to be. It is a bit confusing to have it appear “out of nowhere“, with no details on how it is constructed.
- Please explain what the different shades mean in Fig. 2-3
- In Table 2’s caption please add a reference for DQN-PixelCNN. Also what do the star and cross symbols mean next to the algorithms’ names?
- “coule” at end of 4.6
- The “Watson” citation is duplicated in references
- Why are there games with no tau in Table 4? Is it because there was no such clustering on these games? (if yes, that was not clear in the paper). And how was tau chosen for other games? (in particular I want to make sure the RAM state was not used to optimize it)
Update 2018-11-23: I am reducing my rating to 5 (from 6) due to the absence of author response regarding a potential revision addressing my comments/questions as well as those from other reviewers
Update 2018-11-27: I am increasing my rating to 7 (from 5) after the authors responded to reviewers' comments and uploaded a revised version of the paper


Although stochastic gradient descent (SGD) is a driving force behind the recent success of deep learning, our understanding of its dynamics in a high-dimensional parameter space is limited. In recent years, some researchers have used the stochasticity of minibatch gradients, or the signal-to-noise ratio, to better characterize the learning dynamics of SGD. Inspired by these work, we here analyze SGD from a geometrical perspective by inspecting the stochasticity of the norms and directions of minibatch gradients. We propose a model of the directional concentration for minibatch gradients through von Mises-Fisher distribution and show that the directional uniformity of minibatch gradients increases over the course of SGD. We empirically verify our result using deep convolutional networks and observe a higher correlation between the gradient stochasticity and the proposed directional uniformity than that against the gradient norm stochasticity, suggesting that the directional statistics of minibatch gradients is a major factor behind SGD.

Quality and clarity: good.
Originality and significance: This paper studies the stochasticity
of the norms and directions of the mini-batch gradients, to
understand SGD dynamics. The contributions of this paper can be
summarized as: a) This paper defines gradient norm stochasticity as
the ratio of the variance of the stochastic norm to the expectation
of the stochastic norm. It theoretically and empirically shows that
this value is reduced as the batch size increases b) This paper
empirically finds that the distribution of angles between
mini-batch gradient and a given uniformly sampled unit vector
converges to an asymptotic distribution with mean 90 degrees, which
implies a uniform distribution of the mini-batch gradients. c)
This paper uses von Mises-Fisher Distribution to approximate the
distribution of the mini-batch gradients. By theoretically and
empirically observing that the estimated parameter \hat \kappa
decreases during training, they claim that the directional
uniformity of mini-batch gradients increases over SGD training.
The idea of measuring the uniformity of mini-batch gradients
through VMF distribution seems interesting. But it is unclear how
the study of this stochasticity dynamics of SGD can be related to
the convergence behavior of SGD for non-convex problems and/or the
generalization performance of SGD.
There are additional concerns/questions regarding both theoretical
part and empirical part:
[1] Section3.3: Assumption that p_i(w_0^0) =p_i(w_1^0) = p_i is not
reasonable when theoretically comparing \hat \kappa(w_1^0) and \hat
\kappa(w_0^0). The concentration parameter \hat \kappa(w) should be
estimated by the sum of the normalized mini-batch gradients "\hat
g_i(w)/||\hat g_i(w)||" . Instead of using mini-batch gradient,
this paper uses the sum of "p_i-w" by assuming that "p_i(w_0^0) -w"
is parallel to "\hat g_i(w)", which is ok. However, when comparing
\hat \kappa(w_0^0) and \hat \kappa(w_1^0), we say \hat
\kappa(w_0^0) = h(\sum p_i(w_0^0) - w_0^0) ) and \hat \kappa(w_1^0)
= h(\sum p_i(w_1^0) - w_1^0) ). It is not reasonable to use the
same p_i for p_i(w_0^0) and p_i(w_1^0) because p_i(w_0^0) -w_1^0 is
definitely not parallel to \hat g_i(w_1^0).
[2] Section 3.3: Assumption \hat g_i(w_t^{i-1}) \hat g_i(w_t^0) is
not convincing. With this assumption, the paper writes w_1^0 =
w_0^0 - \eta\sum_i \hat g_i(w_0^{i-1}) = w_0^0 - \eta\sum_i \hat
g_i(w_0^0) = w_0^0 - \eta \sum_i p_i-w_0^0. These equalities are
not persuasive. Because, \sum_i \hat g_i(w_0^0) is the full
gradient g(w_0^0) at w_0^0. In other words, these equalities imply
that from w_0^0 to w_1^0 (one epoch), SGD is doing a full gradient
descent: w_1^0 = w_0^0 -\eta g(w_0^0), which is not the case in
reality.
[3] Experiment: Batch size should be consistent with the given
assumption in the theoretical part. In theoretical part, \hat
\kappa(w_1^0) < \hat \kappa(w_0^0) is based on the assumption that
|\hat g_i(wt^{i-1}| \tat for all i, with *large mini-batch size*.
But in the experiment, they prove \hat \kappa(w_1^0) < \hat
\kappa(w_0^0) by using small-batch size which is 64. The authors
should either provide experiments with large batch size or try to
avoid the assumption of large batch size in theoretical part.
[4] The CNN experiment; It is better to add a discussion why the
\kappa increases in the early phase of training.
[5] The experiment results show, by the end of training, all models
FNN, DENN and CNN have very large value of \kappa which is around
10^4. This value implies that the mini-batch gradients distribution
is pretty concentrated, and it is contradictory to the statement in
the introduction which is "SGD converges or terminates when either
the norm of the minibatch gradient vanishes to zeros, or when the
angles of the mini-batch gradients are uniformly distributed and
their non-zero norms are close to each other''. It is also
contradictory to the experiment in 3.2 which implies the mini-batch
gradient are uniformly distributed after training.
[6] The notations in this paper can be improved, some notations are
using "i" for batch index, some notations are using "i" for one
data sample. Some notations in Section 3.3 and 3.1 can be moved to
Section 2 Preliminaries. It will be clearer to define all the
notations in one place.
Typos: -Section 3.1: first paragraph, E\hat g(w) -> E[\hat g(w)]; -
Paragraph before Lemma2: \hat \kappa increases -> \hat \kappa
decreases; - Paragraph after Theorem2: double the directions in "If
SGD iterations indeed drive the directions the directions of
minibatch gradients to be uniform".


Combining information from different sensory modalities to execute goal directed actions is a key aspect of human intelligence. Specifically, human agents are very easily able to translate the task communicated in one sensory domain (say vision) into a representation that enables them to complete this task when they can only sense their environment using a separate sensory modality (say touch). In order to build agents with similar capabilities, in this work we consider the problem of a retrieving a target object from a drawer. The agent is provided with an image of a previously unseen object and it explores objects in the drawer using only tactile sensing to retrieve the object that was shown in the image without receiving any visual feedback. Success at this task requires close integration of visual and tactile sensing. We present a method for performing this task in a simulated environment using an anthropomorphic hand. We hope that future research in the direction of combining sensory signals for acting will find the object retrieval from a drawer to be a useful benchmark problem.

This paper is poorly written, and looks like it was not proof-read.
Presentation of the problem at hand is presented over so many times that it becomes confusing.
Authors ought to better define the image description space of the objects and the haptic space.
More interesting would have been a good explanation of the different sensors used in the anthropomorphic hand  and the vector built to represent the different sensed objects.
The most expected contribution of this work is barely explained: how the haptic sensors' values/object labels vectors were built and fed to the predictor network, what their values looked like for the various objects, how these vectors clustered for the various objects etc.
Among the many evident weaknesses:
- Domain specific concepts and procedures of most importance to this work are not explained: "... measure various physical properties of objects using the bio-tac sensor using five different exploration procedures (EP)".  Page 3, Paragraph 1. Bio-tac sensor and most importantly exploration procedures (EP) should be presented more clearly.
- Incomplete and out of nowhere sentences are common: "The SHAP procedure
was established for evaluating prosthetic hands and arms. With this idea in mind, prior work (?)
built a prosthetic arm which could ..." Page 4, Paragraph 1.
- Many references are not well introduced and justified: "We then trained the network using
ADAM (Kingma & Ba (2014)) with an initial learning rate set to 1e-4." Page 4, Paragraph 6. In the same paragraph,  authors explain using "The groundtruth predictions were per-channel averaged haptic forces" without having defined those channels (that one can guess but shouldn't). Concepts have to be clearly defined prior to their use.


For a long time, designing neural architectures that exhibit high performance was considered a dark art that required expert hand-tuning. One of the few well-known guidelines for architecture design is the avoidance of exploding or vanishing gradients. However, even this guideline has remained relatively vague and circumstantial, because there exists no well-defined, gradient-based metric that can be computed before training begins and can robustly predict the performance of the network after training is complete. We introduce what is, to the best of our knowledge, the first such metric: the nonlinearity coefficient (NLC). Via an extensive empirical study, we show that the NLC, computed in the network's randomly initialized state, is a powerful predictor of test error and that attaining a right-sized NLC is essential for attaining an optimal test error, at least in fully-connected feedforward networks. The NLC is also conceptually simple, cheap to compute, and is robust to a range of confounders and architectural design choices that comparable metrics are not necessarily robust to. Hence, we argue the NLC is an important tool for architecture search and design, as it can robustly predict poor training outcomes before training even begins.

This paper proposes a metric to measure the "nonlinearity" of neural network, and presents evidence that the value of this metric at initialization time is predictive of generalization performance.
Apart from a few problems I think this paper is well written and thorough. The contribution is solid, although not earth shattering given previous work on such metrics.  There seems to be a basic error in some of the early math, although I don't think this will qualitatively affect the results in any significant way.
-----------------
Detailed comments by section:
------------------
Section 3:
It seems like a 1/sqrt(d) factor is missing from these Q_i(S_x x(i)) and Q_j(S_x f(x,j)) formulas.  As far as I can tell this doesn't affect Def 1 because you seemed to use the correct formula there.
However, the rewritten version with the traces doesn't seem to be correct. There should be a d_in factor in the denominator (inside the square root). This error seems unrelated to the other one.  Assuming I'm correct and that this is an error, does this affect your results in the various figures?  And what is the actual final definition of NLC that you used?
In general, it's annoying for the reader to verify that all of these forms are equivalent.  And it's fiddly enough with the sqrt(d) terms constantly disappearing and reappearing in the numerator and denominators that even you made multiple errors (as far as I can tell).  I would suggest making this section more rigorous and writing out everything carefully. And you probably don't need to rewrite it in so many equivalent forms with different notation unless they are useful somehow.
The use of the Q and S symbols feels superfluous and counterproductive. Standard notation with expectations and squares wouldn't take much more space and would be a lot clearer.
Section 4:
"we plot the relative diameter of the linearly approximable regions of the network as defined in section 3": but you don't seem to define "relative diameter" there. As far as I can tell it's only defined in Appendix E, and this is only mentioned in the caption of figure 1.  It's impossible to interpret this result without knowing precisely what "relative diameter" is.  If you can't afford to describe this in the main paper you should at least mention that it's a different (more expensive) way of estimating the same thing that the NLC estimates.
In Figure 2, are the higher test errors due to the optimizer failing to lower the training error, or due to a greater generalization gap?  I guess the Figure 3 results suggest the latter possibility, which is surprising to me.
What does it mean to have a "very biased output".  What does that inequality mean intuitively?  Should there be an absolute value on the RHS?  It would be much easier to parse it if it were written in plain notation without these S and Q symbols.
Section 6:
"metric also an" -> "metric also has an"
Can you generate a failure case for "correlation information" that doesn't involve Batch Norm layers?  I don't think the authors of those works meant for their results to deal with that.
Note that there are actually a lot of papers going back to the 90s that discussed and proved representational benefits of depth in neural networks.


We analyze the joint probability distribution on the lengths of the vectors of hidden variables in different layers of a fully connected deep network, when the weights and biases are chosen randomly according to Gaussian distributions, and the input is in {−1, 1} N . We show that, if the activation function φ satisfies a minimal set of assumptions, satisfied by all activation functions that we know that are used in practice, then, as the width of the network gets large, the "length process" converges in probability to a length map that is determined as a simple function of the variances of the random weights and biases, and the activation function φ. We also show that this convergence may fail for φ that violate our assumptions.
second layer may not be independent, even for some permissible φ like the ReLU. The results of this section contradict claims made in [14,10]. Section 5 describes some simulation experiments verifying some of the findings of the paper, and illustrating the dependence among the values of the hidden nodes.
Our analysis of the convergence of the length map borrows ideas from Daniely, et al. [2], who studied the properties of the mapping from inputs to hidden representations resulting from random Gaussian initialization. Their theory applies in the case of activation functions with certain smoothness properties, and to a wide variety of architectures. Our analysis treats a wider variety of values of σ w and σ b , and uses weaker assumptions on φ.

Summary: the paper proves the convergence of empirical length map (length process) in NN to the length map for a permissible activation functions in a wide-network limit. The authors also show why the assumptions on the permissible functions can not be relaxed.
Quality: the paper seems to be technically correct. However, the authors do not discuss any consequence of their result. Why was it important to prove it? What does it tell us about the networks? While the proof may be of interest to the authors of [14] to correct their (possible) mistakes, I think the paper will go under the radar for most people and thus encourage the authors to heavily revise the paper.
Clarity: the writing is clear in general. The proofs sometimes jump over non-trivial things and explain easy steps, but that maybe subjective. The paper spends no effort explaining the contribution and its consequences.
Originality: the proven statements are novel and extend/fix the claims of [14]
Significance: as said above, I believe that in the current form the paper will have little to no impact. The importance of proving the main statement under more general conditions on activation functions is doubtful and the authors do not comment on that.
Minor comments:
* when introducing T{i,:,:} the <> notation is not clear. I could guess it from the later usage of the symbol, but these brackets can mean a lot of things, e.g. bracket mean (Section 2.1)
* it would be beneficial to define the main objects, wide-network limits, in a more formal way (Section 2.3)
* how the wide regime (large N) is interesting for studying deep NNs? [14] discusses that to some extent, but this should be explained here as well
* q_0 is never defined
* it's good practice to add numbers to all equations
* I believe the claim in the appendix of [14] was meant to be conditionally independent (see also the reviews of [14]). It's clear that preactivations should not be independent and, while technically interesting, spending a page of theorem 10 and on plots seems unnecessary. Even in the paper's example preactivations are uncorrelated in the limit of large N.
* I don't see the point of having experiments in this paper. The authors have already proven the fact. Also, it is not clear how to read the plots (no axes, little description) and come to the statements from page 9.
********************
After the authors' response:
If the main motivation of the paper is to fix the mistakes in [14], then the paper should clearly state so, in addition to explaining why fixing is necessary. While I believe that pointing out other paper's mistakes and correcting them is important, the current state of the paper leads me to keeping my initial score and recommending to reject the paper.


Many important classification performance metrics, e.g. the F -measure, are nondifferentiable and non-decomposable, and are thus unfriendly to the gradient descent algorithm. Consequently, despite their popularity as evaluation metrics, these metrics are rarely optimized as training objectives in neural network community. In this paper, we propose an empirical utility maximization scheme with provable learning guarantees to address the non-differentiability of these metrics. We then derive a strongly consistent gradient estimator to handle nondecomposability. These innovations enable end-to-end optimization of these performance metrics with the same computational complexity as optimizing a decomposable and differentiable metric, e.g. the cross-entropy loss.

Update: I still feel that the paper should have either strong theory, strong experiments, or some of each to be accepted, but that both are lacking. The revisions required would be too great for acceptance at this time.
Original review:
The paper proposes a general method to optimize for performance metrics which can be written in terms of the entries of the confusion matrix. The idea is to approximate the entries of the confusion matrix using their expected values for a randomized classifier, plug these estimates into the formula for the desired metric, and optimize that quantity. This is a compelling idea but it needs more support than the theoretical or experimental sections give.
The simplicity and generality of the method are appealing. Smooth surrogates derived from randomized classifiers have been considered in the context of accuracy [1] and other performance measures [2, 3] and the paper should include some discussion of this prior work, but to my knowledge the broad applicability to non-decomposable and non-differentiable metrics expressible in terms of the confusion matrix is new.
The theoretical sections could use some improvement. It is worth mentioning that the loss obtained with the proposed method is nonconvex. The first equation in theorem 1 is described with “... where convergence in probability is entry-wise”, when the equation refers to almost sure convergence for a scalar, not convergence in probability for entries of a matrix.
No convergence rates are given, only asymptotic almost sure convergence as the size of the dataset or the minibatch goes to infinity. For finite datasets these statements are obvious, and while convergence is reassuring for infinite datasets, I imagine the rates will look very different for the loss (a scalar) and the gradient (which may have millions of coordinates). Theorem 3 considers the generalization of a single classifier which is independent of the empirical sample, which makes it irrelevant to cases where the model is learned. Theorem 4, which seeks to give a uniform bound over the model class, only shows that generalization occurs in the limit of infinitely much data (which is not surprising or particularly interesting).
The experimental section compares the algorithm against a well-known and strong baseline, but without any information about the variance of the results and only for a deep network. Several questions remain: Where the proposed method improves over the baseline, is this improvement due to the new method or the interaction between the method and the model? How would the method perform on e.g. a linear model, which is better understood? How do the results depend on batch size, which affects the bias in the gradients?
[1] Roux, Nicolas Le. "Tighter bounds lead to improved classifiers." arXiv preprint arXiv:1606.09202 (2016).
[2] Mozer, Michael C., et al. "Prodding the ROC curve: Constrained optimization of classifier performance." Advances in Neural Information Processing Systems. 2002.
[3] Goh, Gabriel, et al. "Satisfying real-world goals with dataset constraints." Advances in Neural Information Processing Systems. 2016.


We propose a novel neural architecture, Transformer-XL, for modeling longerterm dependency. To address the limitation of fixed-length contexts, we introduce a notion of recurrence by reusing the representations from the history. Empirically, we show state-of-the-art (SoTA) results on both word-level and character-level language modeling datasets, including WikiText-103, One Billion Word, Penn Treebank, and enwiki8. Notably, we improve the SoTA results from 1.06 to 0.99 in bpc on enwiki8, from 33.0 to 18.9 in perplexity on WikiText-103, and from 28.0 to 23.5 in perplexity on One Billion Word. Performance improves when the attention length increases during evaluation, and our best model attends to up to 1,600 words and 3,800 characters. To quantify the effective length of dependency, we devise a new metric and show that on WikiText-103 Transformer-XL manages to model dependency that is about 80% longer than recurrent networks and 450% longer than Transformer. Moreover, Transformer-XL is up to 1,800+ times faster than vanilla Transformer during evaluation.

This paper proposes a Transformer based RNN structure "Transformer-XL" to capture long-range contextual relations and targets on language model task. The idea is straightforward: it splits the input sequence into equal and fixed length segments, and recurrently apply the Transformer over the sequence of segments, in which the hidden states for the previous segment are treated as a memory to attend for the next segment.
This paper is well-organized and well-written, and easy to follow. The empirical results also demonstrate the proposed model can achieve SoTA performance on several word- and character-based language model benchmarks.
Pros:
1. The model is designed based on a careful engineering: 1) taking into account the history hidden states for long-term dependency modeling and 2) alignment scores calculated from multiple perspectives for relative position modeling and global significance capturing. In addition, in contrast to the previous Transformer-based language model, benefiting from the recurrent architecture, both training and decoding can be accelerated.
2. The experimental results show that the proposed Transformer-XL can surpass the baseline model and achieve new state-of-the-art perplexity or bpc on word- or char-based language model task. And, based on the proposed new metric, RECL, the analysis for context length modeling verifies the proposed model can make the best of long-range dependencies.
Cons:
1. The proposed model is ad-hoc and is only compatible with language model task. Is it possible to extend the proposed model to more general and practical tasks (e.g., seq2seq tasks)?
2. The absence of a popular language model benchmark, WikiText-2, which has been evaluated in most previous papers.
3. It is notable that there are no ubiquitous decoding techniques for the language used in both the proposed model and baselines, such as dynamical evaluation and continuous cache pointer. However, these techniques are essential for the RNN-LM baselines to achieve state-of-the-art performance, and has been standardly used in most previous works. Therefore, the comparison seems unfair.
Minor comments: In Figure 1 and 2, it is better to include a legend explaining the meaning of different colors for different nodes.


This paper focuses on the synthetic generation of human mobility data in urban areas. We present a novel and scalable application of Generative Adversarial Networks (GANs) for modeling and generating human mobility data. We leverage actual ride requests from ride sharing/hailing services from four major cities in the US to train our GANs model. Our model captures the spatial and temporal variability of the ride-request patterns observed for all four cities on any typical day and over any typical week. Previous works have succinctly characterized the spatial and temporal properties of human mobility data sets using the fractal dimensionality and the densification power law, respectively, which we utilize to validate our GANs-generated synthetic data sets. Such synthetic data sets can avoid privacy concerns and be extremely useful for researchers and policy makers on urban mobility and intelligent transportation systems.

The paper produces a heat-map of ride-share requests in four cities in the USA. For each city 'block' they produce a time-sequence of 2016 images representing a week-long run from combining each 5-minute interval. This is used with a GAN to produce new data. The techniques applied, although not commonly used in the context of ride sharing / hailing, have been used extensively in other literature.
Some major points on the paper:
1) A GAN approach is normally used to generate more data when enough real data is not obtainable. However, here you only use one week of data from a much larger set. Surely, it would be better to make use of all the weeks available?
2) It is not clear how the heat-maps once produced could be used in the future. There is a hint in the results section about how they can be converted back to ride requests, but this is not clearly defined.
3) There are a number of cases where you state that some approach has been found to be better. However, no evidence is presented for how you determined this to be true.
4) The conversion of data to heat-maps has been used extensively in prior research. Although I'm not directly aware of the use in machine learning I am aware of the use in transport - "Interactive, graphical processing unit- based evaluation of evacuation scenarios at the state scale". The novelty here seems to be the application to this specific problem.
More specific points:
- "Our real ride request data sets consist of all the ride requests for an entire week for the four cities." - it's not clear - are all four cities used to train one model?
- "Hence the week-long data should be quite representative." - This fails to take into account such things as national holidays or other major events such as sports. Did your chosen week contain one of these?
- "Hence we believe the ride request data sets also reflect the overall urban mobility patterns for these cities." - This is a huge assumption, which would seem to need evidence to back it up.
- "and lump together all the ride requests within each interval." - Presumably you mean that all time values are to the granularity of 5 minutes?
- "We arbitrarily sized each block to represent an image of 2424 pixels" - this seems particularly small.
- "Each image of that block is labeled with a time interval (for our experiments, the hour in a day)." - Can the variability within an hour not make this more difficult?
- "We find that small networks are appropriate for the training data" - evidence to support this.
- "This network is pre-trained on the training data" - which training data are you referring to?
- "This is found to increase the efficiency of the training process" - evidence?
- "In this work we set the block size for each of the four cities to be
1200  1200 meters" - how was this value arrived at?
- You state that GPUs were no more efficient, it would be good to see more analysis of this.
- "To help enhancing the scalability" -> "To help enhance the scalability"
- "and other useful functions" - such as?
- Figure 4 would probably work better as a speedup graph.
- "Running times for sampling ride requests from the trained models and stitching the images of all the blocks together are significantly less than the training times, and are not included in these results." - at least some figures to give an idea of scale should be provided.


Deep reinforcement learning (RL) has achieved breakthrough results on many tasks, but has been shown to be sensitive to system changes at test time. As a result, building deep RL agents that generalize has become an active research area. Our aim is to catalyze and streamline community-wide progress on this problem by providing the first benchmark and a common experimental protocol for investigating generalization in RL. Our benchmark contains a diverse set of environments and our evaluation methodology covers both in-distribution and outof-distribution generalization. To provide a set of baselines for future research, we conduct a systematic evaluation of deep RL algorithms, including those that specifically tackle the problem of generalization. We find that classic deep RL algorithms often perform as well or better than those that aim to generalize.

This paper presents a new benchmark for studying generalization in deep RL along with a set of benchmark results. The benchmark consists of several standard RL tasks like Mountain Car along with several Mujoco continuous control tasks. Generalization is measured with respect to changes in environment parameters like force magnitude and pole length. Both interpolation and extrapolation are considered.
The problem considered in this paper is important and I agree with the authors that a good set of benchmarks for studying generalization is needed. However, a paper proposing a new benchmark should have a good argument for why the set of problems considered is interesting. Similarly, the types of generalization considered should be well motivated. This paper doesn’t do a good job of motivating these choices.
For example, why is Mountain Car a good task for studying generalization in deep RL? Mountain Car is a classic problem with a two-dimensional state space. This is hardly the kind of problem where deep RL shines or is even needed at all. Similarly, why should we care whether an agent trained on the Cart Pole task can generalize to a pole length between 2x and 10x shorter than the one it was trained on without being allowed to update its policy? Both the set of tasks and the distributions of parameters over which generalization is measured seem somewhat arbitrary.
Similarly, the restriction to methods that do not update its policy at test time also seems arbitrary since this is somewhat of a gray area. RL^2, which is one of the baselines in the paper, uses memory to adapt its policy to the current environment at test time. How different is this from an agent that updates its weights at test time? Why allow one but not the other?
In addition to these issues with the proposed benchmark, the baseline results don’t provide any new insights. The main conclusion is that extrapolation is more difficult than interpolation, which is in turn more difficult than training and testing on the same task. Beyond that, the results are very confusing. Two methods for improving generalization (EPOpt and RL^2) are evaluated and both of them seem to mostly decrease generalization performance. I find the poor performance of RL^2-A2C especially worrisome. Isn’t it essentially recurrent A2C where the reward and action are fed in as inputs? Why should the performance drop by 20-40%?
Overall, I don’t see the proposed tasks becoming a widely used benchmark for evaluating generalization in deep RL. There are just too many seemingly arbitrary choices in the design of this benchmark and the lack of interesting findings in the baseline experiments highlights these issues.
Other comments:
- “Massively Parallel Methods for Deep Reinforcement Learning” by Nair et al. introduced the human starts evaluation condition for Atari games in order to measure generalization to potentially unseen states. This should probably be discussed in related work.
- It would be good to include the exact architecture details since it’s not clear how rewards and actions are given to the RL^2 agents.


Deep convolutional neural networks (CNNs) are deployed in various applications but demand immense computational requirements. Pruning techniques and Winograd convolution are two typical methods to reduce the CNN computation. However, they cannot be directly combined because Winograd transformation fills in the sparsity resulting from pruning. Li et al. (2017) propose sparse Winograd convolution in which weights are directly pruned in the Winograd domain, but this technique is not very practical because Winograd-domain retraining requires low learning rates and hence significantly longer training time. Besides,  Liu et al. (2018)  move the ReLU function into the Winograd domain, which can help increase the weight sparsity but requires changes in the network structure. To achieve a high Winograd-domain weight sparsity without changing network structures, we propose a new pruning method, spatial-Winograd pruning. As the first step, spatial-domain weights are pruned in a structured way, which efficiently transfers the spatial-domain sparsity into the Winograd domain and avoids Winograd-domain retraining. For the next step, we also perform pruning and retraining directly in the Winograd domain but propose to use an importance factor matrix to adjust weight importance and weight gradients. This adjustment makes it possible to effectively retrain the pruned Winograd-domain network without changing the network structure. For the three models on the datasets of CIFAR-10, CIFAR-100, and ImageNet, our proposed method can achieve the Winograddomain sparsities of 63%, 50%, and 74%, respectively.

Review of Spatial-Winograd Pruning Enabling Sparse Winograd Convolution
Summary:
In this submission, the authors propose a new method for pruning weights in the presence in CNNs in which the convolution is expressed as a CNN. The goal of the project is to demonstrate that they can achieve a network which contains fewer weights (and runs faster) then the original network with minimal sacrifice in network performance and without altering the network architecture.
Major Comments:
My largest comments and concerns revolve around the degree to which the proposed pruning methods results in a model that is applicable for real world devices.
1. At the minimum, the authors should provide a table with the number of parameters in the (a) original networks, (b) network with baseline pruning method and (c) network with their pruning methods. (Are the savings entirely in convolutional filters or are there savings from fully connected layers?)
2. If the authors are indeed arguing that a goal of network pruning is to perform faster inference, then results must be shown to justify this -- as it is not obvious that speed-ups could be achieved by just pruning weights. In the case of other methods, speed-ups may be achieved by selectively pruning channel filters (as opposed to spatial positions in the convolutional filter) or pruning fully connected layers (in fact, for VGG and AlexNet, a majority of the reduction in parameters due to pruning were found in these layers).
3. Are these levels of sparsity useable in a real-world system? Often the degree of sparsity in "vanilla" CNNs are at levels (e.g. in AlexNet, 30-50% sparsity in higher layers) not high enough to be harnessed for a fast implementation. Selectively zero-ing out individual spatial components of a filter might reduce the parameter count but not achieve any speed up gains. That is, the sparsity must be structured in such a way as to permit a faster implementation [e.g. 1]
4. Considering that one of the baselines changes the network architecture itself [2], I would be curious to understand how effective this method is versus other, simple baselines that change the network architecture such as (1) decreasing the number of filter, (2) decreasing the kernel sizes, (3) swapping a convolutional filter for a separable convolution [3, 4]. All of these baselines are simple to train and experiment with and a practitioner would probably consider in many situations where speed or # parameters are a constraint.
Minor Comments:
- It is unclear from the presentation whether both proposed pruning methods may be trained in tandem or in series. Please clarify in the manuscript.
- Why does Figure 3a, 3b focus on maintaining 20% sparsity on the 1st layer of the network systematically all other layers in sparsity? What is special about the first layer?
- Why do the authors explore a different range of sparsities in Figure 3a and Figure 3b?
- The authors should discuss the source of the variability (and non-monotonicity) in the plots in Figure 3 and 4 for their proposed method. How are we to interpret this? Naively, it would be appear that the method is somewhat unpredictable in performance across a range of sparsity.
- Why do the blue and purple curves in Figure 4 not space the entire range of sparsities?
- Figure 5b. What is the relative accuracy measured with respect to? The baseline model at that particular epoch or at final asymptotic performance?
[1] Outrageously Large Neural Networks: The Sparsely-Gated Mixture-of-Experts Layer
https://openreview.net/forum?id=B1ckMDqlg
[2] Efficient sparse-winograd convolutional neural networks.
Xingyu Liu, Jeff Pool, Song Han, and William J Dally.
[3] MobileNets: Efficient Convolutional Neural Networks for Mobile Vision Applications
Andrew G. Howard, Menglong Zhu, Bo Chen, Dmitry Kalenichenko, Weijun Wang, Tobias Weyand, Marco Andreetto, Hartwig Adam
https://arxiv.org/abs/1704.04861
[4] Xception: Deep Learning with Depthwise Separable Convolutions
François Chollet
https://arxiv.org/abs/1610.02357


MINIMAL IMAGES IN DEEP NEURAL NETWORKS: FRAGILE OBJECT RECOGNITION IN NATURAL IMAGES
The human ability to recognize objects is impaired when the object is not shown in full. "Minimal images" are the smallest regions of an image that remain recognizable for humans. Ullman et al. (2016) show that a slight modification of the location and size of the visible region of the minimal image produces a sharp drop in human recognition accuracy. In this paper, we demonstrate that such drops in accuracy due to changes of the visible region are a common phenomenon between humans and existing state-of-the-art deep neural networks (DNNs), and are much more prominent in DNNs. We found many cases where DNNs classified one region correctly and the other incorrectly, though they only differed by one row or column of pixels, and were often bigger than the average human minimal image size. We show that this phenomenon is independent from previous works that have reported lack of invariance to minor modifications in object location in DNNs. Our results thus reveal a new failure mode of DNNs that also affects humans to a much lesser degree. They expose how fragile DNN recognition ability is for natural images even without adversarial patterns being introduced. Bringing the robustness of DNNs in natural images to the human level remains an open challenge for the community.

Thanks the authors for an interesting work!
The paper studies the differences between human and DNN vision via means of minimal images (i.e. smallest image crops that can be correctly classified).
There are a few notable take-away messages:
1. DNNs are not invariant to even tiny (1-2 px) translations of small image crops.
    - It would be more insightful if authors added comparison between DNN sensitivity to tiny translations of small image crops vs. full-size images (i.e. translation-based adversarial examples https://openreview.net/forum?id=BJfvknCqFQ ).
2. The smaller the image crops, the more sensitive DNNs become (here, more FRIs)
3. DNNs and human vision misclassify the image crops differently: (1) DNNs have almost twice more FRI(s) and (2) FRIs of human and DNNs differ in location.
Questions:
- "After extracting the region from the image, the region is resized to be of the size required by the network."
Would upscaling say a small 28x28 crop into 224x224 image here naturally negatively impact the DNN predictive performance?
That is, because typically image classifiers are trained on one (or a few) fixed resolution(s) of images.
One hypothesis here is that fragile recognition may be because the test image resolution does not match the training image resolution.
Human on the other hands, have been trained on images of variable resolutions.
An alternative to upscaling here is to zero-pad the crop region. Can you help us understand your choice of upscaling here?
+ Originality
The originality is limited as it is a close extenstion work of Ullman et al. 2016
+ Clarity
The paper is well written and presented.
+ Significance
This work extends our understanding of the differences between DNNs and human vision.
However, given what we learned from the adversarial example research area, the contribution of this work is low because results might not be too surprising.