Deep generative models such as Generative Adversarial Networks (GANs) and Variational Auto-Encoders (VAEs) are important tools to capture and investigate the properties of complex empirical data. However, the complexity of their inner elements makes their functionment challenging to assess and modify. In this respect, these architectures behave as black box models. In order to better understand the function of such networks, we analyze their modularity based on the counterfactual manipulation of their internal variables. Our experiments on the generation of human faces with VAEs and GANs support that modularity between activation maps distributed over channels of generator architectures is achieved to some degree, can be used to better understand how these systems operate and allow meaningful transformations of the generated images without further training.

This paper proposes to examine generative adversarial networks by using counterfactual reasoning. The authors propose to examine modularity through the lens of interventions on the generative networks. After observing that the nodes within the generative network obey a deterministic relationship, they propose a proxy for intervention which takes samples and creates “hybrid” samples by replacing the activation output of one sample with the others. Given the vast number of nodes that exist within a generative network, the authors propose a heuristic for choosing the nodes to perturb.
I found the underlying premise of this paper to be very strong (identifying modularity in generative networks), however I think there is a substantial amount of work that should go into this paper before acceptance. While the authors begin by working within the framework of causal reasoning there is no mention of what the effect is that they are seeking to measure, i.e. what is the causal estimand here? The influence maps provide an intuitive answer to this, but not one that defines a clear estimand. I would like to see additional evaluation. The evidence provided largely leaves the reader to interpret results subjectively, rather than providing clear evidence. I was also uncomfortable with the selection on hyperparameters (3 clusters). It would be very nice to either have a selection criterion or show the sensitivity of the proposed methodology to other choices.
Overall, I think this is an interesting idea in a very important area, but one that is not quite ready for publication.
Some editorial comments:
The layout of this paper is slightly strange. After the introduction, the authors introduce the notion of disentanglement and lead with an example from optics. This motivation should either be moved to the introduction or removed. After the definitions the authors jump into a related work section that feels slightly disjointed from the previous section.
I found definition 1 to be abstruse. In addition there are a couple of typos that should be addressed (“consists in a distribution” → “consists of a distribution”). It is non-standard to lead with the latent variables. I think it makes for a much easier narrative to describe the observed variables and structure first, before carrying on to the latent variables. Additionally, I believe you are stating an observation made by Pearl (2001) that after observing the noise variable, relationships become deterministic. This is slightly non-obvious from the wording used (and is also missing the proper reference).
Parens are missing from the following citation:
“generative models encountered in machine learning Besserve et al. (2018).”  → “generative models encountered in machine learning (Besserve et al., 2018).”


Variational auto-encoders (VAEs) offer a tractable approach when performing approximate inference in otherwise intractable generative models. However, standard VAEs often produce latent codes that are disperse and lack interpretability, thus making the resulting representations unsuitable for auxiliary tasks (e.g. classification) and human interpretation. We address these issues by merging ideas from variational auto-encoders and sparse coding, and propose to explicitly model sparsity in the latent space of a VAE with a Spike and Slab prior distribution. We derive the evidence lower bound using a discrete mixture recognition function thereby making approximate posterior inference as computational efficient as in the standard VAE case. With the new approach, we are able to infer truly sparse representations with generally intractable non-linear probabilistic models. We show that these sparse representations are advantageous over standard VAE representations on two benchmark classification tasks (MNIST and Fashion-MNIST) by demonstrating improved classification accuracy and significantly increased robustness to the number of latent dimensions. Furthermore, we demonstrate qualitatively that the sparse elements capture subjectively understandable sources of variation.

This paper proposes an extension of VAEs with sparse priors and posteriors to learn sparse interpretable representations. Training is made tractable by computing the analytic KL for spike and slab distributions, and using a continuous relaxation for the spike variable. The technique is evaluated on MNIST, Fashion MNIST, and CelebA where it learns sparse representations with reasonable log-likelihood compared to Gaussian priors/posteriors, but improved classification accuracy and interpretability of the representation.
While this paper is clear and well written, the novelty of the approach is limited. In particular, this is a straightforward application of vanilla VAEs with a different prior/posterior. The authors missed a bunch of related work and their main theoretical contributions are known in the literature (KL for spike and slab distributions, effective continuous relaxations for Bernoulli variables). The experiments are interesting but the authors should compare to more baselines with alternative priors (e.g. stick breaking VAEs, VampPrior, epitomic VAEs, discrete VAEs).
Strengths
+ Well written, clear, and self-contained paper. Figures are nice and polished.
+ Thorough experiments studying the effect of sparsity on the representation
Weaknesses
- No discussion/comparison to other VAE approaches that incorporate sparsity into the latents: Eptimoic VAEs (2017), discrete VAEs with binary or categorical latents are sparse (see: Discrete VAEs, Concrete/Gumbel-Softmax, VQ-VAE, output-interpretable VAEs), stick breaking VAEs, structured VAEs for the Beta-Bernoulli process (Singh, Ling, et al., 2017). Missing citation to foundational work on sparse coding from Olshausen and Field (1996).
- Lack of novelty: The analytic KL term for spike and slab priors has been derived before in Discrete VAEs (Rolfe, 2017) and in work on weight uncertainty (Yarin Gal's thesis, Blundell et al. 2016). Continous relaxations like the one used for the spike variable has been presented in earlier work (Concrete distributon, Gumbel-Softmax, Discrete VAEs).
Minor comments:
- Eq. 1, shape for B should be MxJ
- Cite Rezende & Mohamed for VAEs along w/ Kingma & Welling
- Definition of VAE is overly-restrictive. Typically a VAE is the combo of variational inference with an amortized inference network (and optionally reparameterization gradients). Saying that VAE implies Gaussian prior and Gaussian posterior is far too restrictive.
- VLB is a non-standard acronym, use ELBO for evidence lower bound
- I'm surprised that VAEs perform so poorly as latent dim increases. I'd expect it to just prune latent dimensions. Do you have an explanation for why performance drops for VAEs? Are they overfitting?
- VAEs with Gaussian p(x|z) are typically harder to train and more sensitive to hyperparameters than Bernoulli p(x|z). Could you repeat your experiments using the more common binarized MNIST so that numbers are comparable to prior work?
- If the goal is to learn representations with high information, then beta-VAEs or InfoVAEs should be compared (see analysis in Alemi et al., 2017). The number of dimensions may matter less for classification than the rate of the VAE. To analyze this further, you could plot the rate (KL(q(z|x) || p(z)) vs. the classification accuracy for all your models.
- Fig 4: consider adding in plots of continuous interpolation of the latent dimension (as in beta-VAE, TC-VAE, etc.)
- Would be interested to see how much class information is stored in the value vs. the pattern of non-zeroes in the latent representation (as done in Understanding Locally Competitive networks from Srivasta et al. 2014).
- Not at all expected as this came out after your submission, but would be nice to compare to a similar recent paper: https://www.biorxiv.org/content/early/2018/08/23/399246


Recent analysis of deep neural networks has revealed their vulnerability to carefully structured adversarial examples. Many effective algorithms exist to craft these adversarial examples, but performant defenses seem to be far away. In this work, we explore the use of edge-aware bilateral filtering as a projection back to the space of natural images. We show that bilateral filtering is an effective defense in multiple attack settings, where the strength of the adversary gradually increases. In the case of adversary who has no knowledge of the defense, bilateral filtering can remove more than 90% of adversarial examples from a variety of different attacks. To evaluate against an adversary with complete knowledge of our defense, we adapt the bilateral filter as a trainable layer in a neural network and show that adding this layer makes ImageNet images significantly more robust to attacks. When trained under a framework of adversarial training, we show that the resulting model is hard to fool with even the best attack methods.

The paper proposes the use of bilateral filtering as a defense to adversarial examples (AE). Bilateral Filtering (BF) is a smoothening technique that averages pixels that are close to each other both in position and value. As a result BF preserves sharp edges and the denoised images appear to be of higher quality than those produces via simple Gaussian smoothing.
First, the method is evaluated on black-box attacks by constructing AE for the undefended network and then applying the defense. The method is then tested on white-box attacks which attack the defended system end-to-end with first order methods. Finally, the authors propose combining their defense with adversarial training.
Overall, I find the main idea of the paper interesting. BF seems like a natural approach to remove low-magnitude perturbations from the image while preserving the salient characteristics of the image. Thus, if it did not hurt classification accuracy significantly it might be considered as part of a cheap preprocessing pipeline that protects the model from simple attacks. However, as shown in Table 3 and 6, BF reduces the accuracy of the original model by at least 5% on ImageNet and CIFAR10.
My main objection about the paper is that BF is proposed as a defense that is extremely robust against even the best attacks. However, the evaluation is clearly incomplete for such a claim and fails to pass simple sanity checks.
*Epsilon values used to claim robustness are way too high*. Table 4 reports an L_infinity bound of 0.793 (almost 40% the image range) and L_2 of 187 (again roughly a quarter of the L2 radius of the image domain). One can change the class of the image completely (even for humans) with a smaller epsilon bound. This is a very clear indication that the attacks used are not sufficient to properly evaluate the robustness of the defense. Even in the images produced by the authors (Figure 2) it is clear that these perturbations are sufficient in terms of magnitude to completely distort the image.
*Only first-order attacks are considered*. From the point about epsilon values above, it is fairly clear that the defense is not easy to attack with first-order methods. This is understandable since BF, even if "fully differentiable", will lead to vanishing gradients for certain pixels. I think it is necessary that the authors to evaluate their defense on other attacks such as a) a straight-through approximation of BF (see BPDA from https://arxiv.org/abs/1802.00420), b) a finite-differences-based attack (see SPSA from https://arxiv.org/abs/1802.05666). As a sanity check, I would even recommend evaluating using the nearest neighbor of each image from a wrong class. It is clear that this attack will always succeed and the L_p distance will be smaller than those reported here.
I believe that these are fundamental issues about the paper that need to be addressed before even considering the paper for acceptance and I thus recommend rejection at this time.
Other comments and concerns:
--Table 6: what is the performance of BFNet without adversarial training? This is a necessary baseline to understand the results of the table.
-- I am confused by the adaptation of adversarial training to BFNet (last equation of section 3.4). The equations themselves are confusing since x is used twice (as a parameter to f and sampled from D). My first guess would be that the method is performing end-to-end adversarial training from the loss to the input x (before BF). It appears however that adversarial training is performed with respect to the image *after* applying the BF filter. If this is the case, it goes against the fundamental principles of adversarial training.
-- I do not see the point of adaptive filtering (AF) as a defense. BF is attractive because it is simple. Adding a classifier to figure out the right parameters seems dubious at best. The idea seems fundamentally flawed given that the classifier is only trained on known attacks and might thus not capture new, different attacks. Lastly, since the classifier is a ML model, it will clearly be susceptible to adversarial perturbations. So the adversary can choose an attack that fools the original model and forces the classifier to choose bad BF parameters. I would suggest that the authors completely remove AF from future versions of their paper.
-- The performance on ImageNet is significantly better than the performance on MNIST and CIFAR10. This is counter-intuitive since a much harder dataset both from a standard and adversarial point of view.
Minor comments to authors:
-- A JPEG compression-based defense can be bypassed (https://machine-learning-and-security.github.io/papers/mlsec17_paper_54.pdf).
-- Last paragraph of page 3 is too informal ("less holes for adversarials to maneuver on").
-- Top of page 4: you seem to confuse "iterative methods" with "small magnitude" attacks. One can use iterative attacks to create large adversarial perturbations (e.g. PGD).
-- I would suggest normalizing to the more common [0, 1] range as the current numbers can be confusing.
-- I am confused by Tables 2, 3. First row of Table 2 shows that on 95% of the clean inputs the label is not changed after BF. But table 3 shows that the accuracy drop from 78.8% to 71.7%. What is going on here?
-- Last part of first paragraph of 4.2 is hard to understand.
-- End of page 8, "the higher dimensionality of CIFAR10 makes it harder than MNIST". Yet the paper claims excellent performance on ImageNet.


SMOOTHING THE GEOMETRY OF PROBABILISTIC BOX EMBEDDINGS
There is growing interest in geometrically-inspired embeddings for learning hierarchies, partial orders, and lattice structures, with natural applications to transitive relational data such as entailment graphs. Recent work has extended these ideas beyond deterministic hierarchies to probabilistically calibrated models, which enable learning from uncertain supervision and inferring soft-inclusions among concepts, while maintaining the geometric inductive bias of hierarchical embedding models. We build on the Box Lattice model of Vilnis et al. (2018), which showed promising results in modeling soft-inclusions through an overlapping hierarchy of sets, parameterized as high-dimensional hyperrectangles (boxes). However, the hard edges of the boxes present difficulties for standard gradient based optimization; that work employed a special surrogate function for the disjoint case, but we find this method to be fragile. In this work, we present a novel hierarchical embedding model, inspired by a relaxation of box embeddings into parameterized density functions using Gaussian convolutions over the boxes. Our approach provides an alternative surrogate to the original lattice measure that improves the robustness of optimization in the disjoint case, while also preserving the desirable properties with respect to the original lattice. We demonstrate increased or matching performance on WordNet hypernymy prediction, Flickr caption entailment and a MovieLens-based market basket dataset. We show especially marked improvements in the case of sparse data, where many conditional probabilities should be low, and thus boxes should be nearly disjoint.

This paper proposes a soft relaxation of the box lattice (BL) model of Vilnis et al. 2018 and applies it to several graph prediction tasks. Results are comparable to the BL model on existing artificially-balanced data but significantly better on more natural unbalanced data with a large number of negatives. The paper assumes some familiarity with the problem domain and existing works (there is not a lot of exposition for an unfamilar reader), but should be of strong interest to anyone working on embeddings or graph prediction.
The paper is well-written, with clear explanations of the desired properties of the model and a concise set of experiments that are easy to follow. The strongest result is that on unbalanced WordNet, while the Flickr and MovieLens results are a little less clear but do show that this technique does not cause any loss in performance.
A few points of feedback:
- Missing citation / comparison: https://arxiv.org/pdf/1804.01882.pdf (Ganea et al. 2018) is an alternative way of generalizing order embeddings. They also report very high numbers on WordNet, though I'm not sure they are directly comparable.
- The Gaussian relaxation (Eq. (2) and (3)) defines a particular length scale, \sigma. It's not clear if this is also implicit in the softplus derivation (by analogy with Eq. (4), should we assume that it approximates the \sigma = 1 case?). What effect does this have on the embedding space? Without it, it would seem that the normal BL model is scale invariant, which might be a desirable property for representing hierarchical data.
- The main thrust of section 5.2 is that smoothed box embeddings retain better performance with increasing numbers of negatives. Could you include the ratio of positive / negative examples on the Flickr dataset, and some measure of the distribution of P(A|B) values on MovieLens to get a sense of how these datasets compare?
- Flickr data: what is the encoder model that produces the embeddings here, and how does it handle unseen captions? (Why would we expect the smoothed box model to handle unseen captions better?)
- There's a strong emphasis on how smoothing makes training easier. Do you have any metrics to directly support this, such as variance under random restarts?
- In the abstract and introduction, it's easy to gloss over "inspired by" and assume that the actual model is a Gaussian convolution. Could be more direct here that it's a softplus approximation.


Multi-goal reinforcement learning (MGRL) addresses tasks where the desired goal state can change for every trial. State-of-the-art algorithms model these problems such that the reward formulation depends on the goals, to associate them with high reward. This dependence introduces additional goal reward resampling steps in algorithms like Hindsight Experience Replay (HER) that reuse trials in which the agent fails to reach the goal by recomputing rewards as if reached states were psuedo-desired goals. We propose a reformulation of goal-conditioned value functions for MGRL that yields a similar algorithm, while removing the dependence of reward functions on the goal. Our formulation thus obviates the requirement of reward-recomputation that is needed by HER and its extensions. We also extend a closely related algorithm, Floyd-Warshall Reinforcement Learning, from tabular domains to deep neural networks for use as a baseline. Our results are competitive with HER while substantially improving sampling efficiency in terms of reward computation.

This paper presents a reinterpretation of hindsight experience replay (HER) that avoids recomputing the reward function on resampled hindsight goals in favor of simply forcing the terminal state flag for goal-achieving transitions, referred to by the authors as a "step loss".
The new proposal is evaluated on two goal-conditioned tasks from low-dimensional observations, and show modest improvements over HER and a function-approximation version of Floyd-Warshall RL, mostly as measured against the number of times the reward function needs to be recomputed.
Pros:
- minor improvement in computational cost
- investigation of classical FWRL technique in context of deep RL
Cons:
- computational improvement seems very minor
- sparse-reward implementations of HER already do essentially what this paper proposes
Comments:
The main contribution of the paper appears to be the addition of what the authors refer to as a "step loss", which in this case enforces the Q function to correctly incorporate the termination condition when goals are achieved. I.E. the discounted sum of future rewards for states that achieve termination should be exactly equal to the reward at that timestep.
It's not clear to me how this is fundamentally different than HER. One possible "sparse reward" implementation of HER involves no reward function recomputation at all, instead simply replacing the scalar reward and termination flag for resampled transitions with the indicator function for whether the transition achieves the resampled goal.
Is this not essentially identical to the proposal in this paper? I would consider this a task-dependent implementation detail for an application of HER rather than a research contribution that deserves an entire paper.
The authors claim the main advantage here is avoiding recomputation of the reward function for resampled goals.
I do not find this particularly compelling, given that all of the evaluations are done in low-dimensional state space: reward recomputation here is just a low-dimensional euclidean distance computation followed by a simple threshold.
In a world where we're doing millions of forward and backward passes of large matrix multiplications, is this a savings that really requires investigation?
It is somewhat telling that the results are compared primarily in terms of "# of reward function evaluations" rather than wall time. If the savings were significant, I expect a wall time comparison would be more compelling.
Maybe the authors can come up with a situation in which reward recomputation is truly expensive and worth avoiding?
All of the experiments in this paper use a somewhat unusual task setup where every timestep has a reward of -1. Have the authors considered other reward structures, such as the indicator function R=(1 if s==g else 0) or a distance-based dense reward?
Would this proposal work in these cases? If not, how significant is a small change to HER if it can only work for one specific reward function?
Conclusion:
In my view, the main contribution is incremental at best, and potentially identical to many existing implementations of HER.
The reconsideration of Floyd-Warshall RL in the context of deep neural networks is a refreshing idea and seems worth investigating, but I would need to see much more careful analysis before I could recommend this for publication.


Generative Adversarial Networks (GANs) are powerful tools for realistic image generation. However, a major drawback of GANs is that they are especially hard to train, often requiring large amounts of data and long training time. In this paper we propose the Deli-Fisher GAN, a GAN that generates photo-realistic images by enforcing structure on the latent generative space using similar approaches by DeliGAN as introduced in Gurumurthy et al. (2017). The structure of the latent space we consider in this paper is modeled as a mixture of Gaussians, whose parameters are learned in the training process. Furthermore, to improve stability and efficiency, we use the Fisher Integral Probability Metric as the divergence measure in our GAN model, instead of the Jensen-Shannon divergence. We show by experiments that the Deli-Fisher GAN performs better than DC-GAN, WGAN, and the Fisher GAN as measured by inception score.

- Summary
This paper presents a minor improvement over the previous Deli-GAN framework (Gurumurthy et al CVPR'17). Specifically, the work proposes to use the Fisher Integral Probability Metric as the divergence measure in our GAN model, instead of the Jensen-Shannon divergence. It shows little results (seems to be positive) using this new distance measure other than traditional ones.  Except that, I didn't see any other contribution from this paper.
- Suggestions
The paper is poorly written and seems to be a rush submission to ICLR. For example:
* a lot of grammatical errors throughout the paper
* only 6.5 papes out of 8 pages are utilized
* the introduction is not convincing -- what problem are you going to address? any summary of your methodology? why it is expected to outperform existing frameworks? what distinguishes your work from existing works? and what're your main results? I cannot conclude after reading the intro.
* the results are very minor and not convincing. It seems the authors conducted a very limited set of experiments and concluded that the proposed Deli-Fisher GAN is better. If you claim that the proposed framework can generate better images, at least the framework should be compared to the latest state-of-the-art GANs (e.g. spectral GANs, etc.)
* The writing is not polished.
Overall, the paper is far from ready to be submitted to ICLR, not mentioning acceptance. I would recommend the authors to conduct more experiments and comparisons and do a better job before submitting it to future conferences.


One can substitute each neuron in any neural network with a kernel machine and obtain a counterpart powered by kernel machines. The new network inherits the expressive power and architecture of the original but works in a more intuitive way since each node enjoys the simple interpretation as a hyperplane (in a reproducing kernel Hilbert space). Further, using the kernel multilayer perceptron as an example, we prove that in classification and under certain losses, an optimal representation that minimizes the risk of the network can be characterized for each hidden layer. This result removes the need of backpropagation in learning the model and can be generalized to any feedforward kernel network. Moreover, unlike backpropagation, which turns models into black boxes, the optimal hidden representation enjoys an intuitive geometric interpretation, making the dynamics of learning in a deep kernel network transparent. Empirical results are provided to complement our theory.

****Reply to authors' rebuttal****
Dear Authors,
Thank you very much for all the effort you have put into the rebuttal. Based on the improved theoretical and experimental results, I have decided to increase my score from 5 to 6.
Best wishes,
Rev 1
****Original review****
This paper explores integration of kernel machines with neural networks based on replacing the non-linear function represented by each neuron with a function living in some pre-defined RKHS. From the theoretical standpoint, this work is a clear improvement upon the work of Zhang et al. (2017). Authors further propose a layer-wise training algorithm based on optimisation of a particular similarity measure between embeddings based on their class assignments at each layer, which eliminates necessity of gradient-based training. However, the experimental performance of the proposed algorithm is somewhat lacking in comparison, perhaps because the authors focus on kernelised equivalents of MLPs instead of CNNs as Zhang et al.
My rating of the paper is mainly due to the lack of experimental evidence for usefulness of the layer-wise training, and absence of experimental comparison with several baselines (see details below). It is also unclear whether the structure of KNs is significantly better than that of NNs in terms of interpretability. Apart from the comments below, I would like to ask the authors to discuss relation to the following related papers:
	1) Kulkarni & Karande, 2017: "Layer-wise training of deep networks using kernel similarity" https://arxiv.org/pdf/1703.07115.pdf
	2) Scardapanea et al., 2017: "Kafnets: kernel-based non-parametric activation functions for neural networks" https://arxiv.org/pdf/1707.04035.pdf
Detailed comments:
Theory
- (Sec 4.1) Backpropagation (BP) is being criticised: BP is only a particular implementation of gradient calculation. It seems to me that your criticisms are thus more related to use of iterative gradient-based optimisation algorithms, rather than to obtaining gradients through BP?! Regarding the criticism that BP forces intermediate layers to correct for "mistakes" made by layers higher up: it seems your layer-wise algorithm attempts to learn the best possible representation in first layer, and then progresses to the next layer where it tries to correct for the potential error of the first layer and so on. In other words it seems that the errors of layers are propagated from first to last, instead of last to first as in BP, but are still being propagated in a sense. I do not immediately see why propagation forward should be preferable. Can you please further explain this point?
- It is proven in the appendix (Lemma B.3) that under certain conditions stacking additional layers never leads to degradation of training loss. Can you please clarify whether additional layers can be helpful even in the case where previous layers already succeeded in learning the optimal representation?
- (Sec 4.1) Layer-wise vs. network-wise optimality: I find the claim that BP-based learner is not aware of the network-wise optimality confusing. BP explicitly optimises for network-wise optimality and the relative contribution to the network-wise error of each weight is propagated accordingly. I suppose my confusion stems from lack of a clear description of what defines a learner "aware" or "blind" to network-wise optimality. In general, I am not convinced layer-wise optimality is a useful criterion when what we want to achieve is network-wise optimality. As you show in the appendix, if layer-wise optimality is achieved then it implies network-wise optimality; however, layer-wise optimality is only a sufficient condition and likely not a necessary one (except for the simplified scenario studied in B.3). It is thus not clear to me why layer-wise training would always be preferable to network-wise training (e.g. using BP) especially because its greedy nature might intuitively prevent learning of hierarchical representations which are commonly claimed to be key to the success of neural networks. Can you please clarify?
- (Sec 4.2) I think it would be beneficial to state in the introduction that the "risk" is with respect to the hinge loss which is common in the SVM/kernel literature but much less in the deep learning literature and thus could surprise a few people when they reach this point.
Futher questions:
	- From Lemma 4.3, it seems that the derived representation is only optimal with respect to the **upper bound** on the empirical risk (which for \tau >= 2 will be an upper bound on the population risk). I got slightly confused at this point as my interpretation of the previous text was that the representation is optimal with respect to the population risk itself. Does the upper bound have the same set of optima? Please clarify.
	- (p.5) There are two assumptions that I find somewhat restrictive. Just before Lemma 4.3 you assume that the number of points in each class must be the same. Can you comment on whether you expect the same representation to be optimal for classification problems with significantly imbalanced number of samples per class? The second assumption is after Lemma 4.4 where you state that the stationary kernel k^{l-1} should attain its infinum for all x, y s.t. || x - y || greater than some threshold. This does not hold for many of the popular kernels like RBF, Matern, or inverse multiquadric. Do you think this assumption can be relaxed?
	- (p.5) Choice of the dissimilarity measure for G: Can you provide more intuition about why you selected L^1 distance and whether you would expect different results with L^2 or other common metrics?
- (Sec 4.3) Can you please provide more detaild about the relation of the proposed objective (\hat(R)(F) + \tau max_j ||f_j||_H) to Lemmas 4.3 and 4.5 where the optimal representation was derived for functions that optimise an upper bound in terms of Gaussian complexity (e.g. is the representation that minimises risk w.r.t. the Gaussian bound also optimal with respect to functions that optimise this objective)?
Experiments
- I would appreciate addition of some standard baselines, like MLP combined with dropout or batch normalisation, and optimised with RMSProp (or similar). These would greatly help with assessing competitiveness with current SOTA results.
- It would be nice to see the relative contribution of the two main components of the paper. Specifically, an experiment which would evaluate empirical performance of KNs optimised by some form of gradient descent vs. by your layer-wise training rule would be very insightful.
Other
- (p.2, 1st par in Sec 2) [minor] You state "a kernel machine is a universal function approximator". I suppose that might be true for a certain class of kernels but not in general?! Please clarify.
- (p.2, 3rd par in Sec 2) [minor] Are you using a particular version of the representer theorem in the representation of f_j^{(i)} as linear combination of feature maps? Please clarify.
- (p.2, end of 1st par in Sec 3) L^{(i)} is defined as sup over X_i. It is not clear to me that this constant is necessarily finite and I suspect it will not be in general (it will for the RBF kernel (and most stationary kernels) used in experiments though). Finiteness of L^{(i)} is necessary for the bound in Eq. (2) to be non-vacuous. Please clarify.
- (p.3, after 1st display in Sec 4.2.1) [minor] Missing dot after "that we wish to minimise". Next sentence states "**the** optimal F" (emphasis mine) -- I am sorry if I overlooked it, but I did not notice a proof that a solution exists and is unique, and am not familiar enough with the literature to immediately see the answer. Perhaps a footnote clarifying the statement would help.
- (p.4, 1st par in Sec 4) You say "A generalisation to regression is reserved for future work". I did not expect that based on the first few pages. On high-level, it seems that generalisation to regression need not be trivial as, for example, the optimal representation derived in Lemma 4.3 and Lemma 4.5 explicitly relies on the classification nature of the problem. Can you comment on expected difficulty of extension to regression? Possibly state in the introduction that only classification is considered in this paper.
	- (p.7, 1st par in Sec 6) [related] "However they did not extend the idea to any **arbitrary** NN" (emphasis mine). Can you please be more specific here?
- (p.5-6) [minor] Last sentence in Lemmas 4.3 and 4.5 is slightly confusing. Can you rephrase please?
- (p.6) [minor] You say "the learned decision boundary would generalise better to unseen data". Can you please clarify the last sentence (e.g. being more precise about the meaning of the word "simple" in the same sentence) and provide reference for why this is necessarily the case?


DON'T LET YOUR DISCRIMINATOR BE FOOLED
Generative Adversarial Networks are one of the leading tools in generative modeling, image editing and content creation. However, they are hard to train as they require a delicate balancing act between two deep networks fighting a never ending duel. Some of the most promising adversarial models today minimize a Wasserstein objective. It is smoother and more stable to optimize. In this paper, we show that the Wasserstein distance is just one out of a large family of objective functions that yield these properties. By making the discriminator of a GAN robust to adversarial attacks we can turn any GAN objective into a smooth and stable loss. We experimentally show that any GAN objective, including Wasserstein GANs, benefit from adversarial robustness both quantitatively and qualitatively. The training additionally becomes more robust to suboptimal choices of hyperparameters, model architectures, or objective functions.

## Overview
This paper proposes a new way to stabilize the training process of GAN by regularizing the Discriminator to be robust to adversarial examples. Specifically, this paper proves that a discriminator which is robust to adversarial attacks also leads to a robust minimax objects. Authors provide theoretical analysis about the how the robustness of the Discriminator affects the properties of the objective function, and the proposed regularization term provides an efficient and effective way to regularize the discriminator to be robust. However, it does not build connection between the robustness of the Discriminator and why it can provide meaningful gradient to the Generator. Experimental results demonstrate the effectiveness of the proposed method. This paper is easy to understand.
## Drawbacks
There are some problems in this paper. First, this paper is not highly motivated and lacks of intuition. I can hardly understand why the robustness can stabilize the training of GAN. Will it solve the problem of gradient vanishing problem or speed up the convergence of GAN? The toy example in Sec. 4.2 shows that it can regularize the Discriminator to provide a meaningful gradient to Generator, but no theoretical analysis is provided. The main gap between them is that the smoothness of D around the generated data points does not imply the effectiveness of gradients. Second, the theoretical analysis is inconsistent with the experimental settings. Theorem 4.3 holds true when f is non-positive, but WGAN’s loss function can be positive and this paper does not give any details about this part. Third, in Sec. 4.2, I can hardly distinguish the difference between robust loss, robust discriminator and regularized objectives.
Besides, there are lots of typos in this paper. In Sec 3, Generative Adversarial Networks part, the notations of x and z are quiet confusing. In Definition 3.2, d which measures the distance between network outputs is not appeared above.
## Summarization
Generally, this paper provides a novel way to stabilize the training of GAN. However, it does not illustrate its motivation clearly and no insight is provided.
## After rebuttal
Some of the issues are addressed. So I change my rating to 6.


Generative Adversarial Networks (GANs) have proven to be a powerful framework for learning to draw samples from complex distributions. However, GANs are also notoriously difficult to train, with mode collapse and oscillations a common problem. We hypothesize that this is at least in part due to the evolution of the generator distribution and the catastrophic forgetting tendency of neural networks, which leads to the discriminator losing the ability to remember synthesized samples from previous instantiations of the generator. Recognizing this, our contributions are twofold. First, we show that GAN training makes for a more interesting and realistic benchmark for continual learning methods evaluation than some of the more canonical datasets. Second, we propose leveraging continual learning techniques to augment the discriminator, preserving its ability to recognize previous generator samples. We show that the resulting methods add only a light amount of computation, involve minimal changes to the model, and result in better overall performance on the examined image and text generation tasks.

The authors argue that catastrophic forgetting may cause mode collapse and oscillation, and propose a novel plug-and-play  regularizer that can be applied to a variety of GANs' training process to counter catastrophic forgetting of the discriminator. The regularizer is a clever adaption of EWC and IS into the context of GAN training. With the authors' formulation, this regularizer will account for the discriminator's parameter from all previous "tasks" (snapshots taken at certain iterations) with extra memory budget of only one set of parameters, while assigning higher regularization strengths to parameters learned from recent tasks. Experiments demonstrate such regularizer improves GAN models including DCGAN, SN-DCGAN, WGAN-GP on image generation tasks and textGAN on text generation tasks.
Pros:
The paper is well-written. The formulation of online memory and controlled forgetting are clever, giving rise to the adaption of EWC and IS as a practical regularizer to overcome the problem of catastrophic forgetting in GANs. The experiments also demonstrate the regularizer is superior than historical averaging and SN on the synthetic dataset, and it is able to improve multiple GAN models in both image and text generation tasks.
Cons/Suggestions:
1. Although I can see the method is working, the empirical evidence to support "mode oscillation" is not strong enough for me. I think in order for continual learning to make perfect sense, mode oscillation should be an obvious issue for GANs; otherwise, we probably don't need remembering the history, as the generator is probably evolving towards the right direction even in the vanilla approach. Still, since there have been several papers showing history is important, it should be helpful in some sense. In Figure 1, I cannot tell whether in (d), the generator returned to the previous space (probably refers to (a)). Even the centers of mass of (a) and (d) look different for me. Figure 2 (left) only shows the distribution of generated data is changing as the training proceeds in vanilla GANs, since few of them (some shallow blue lines) have low peaks in previous datasets. If the mode oscillates and the generator returns to previous state, there should at least be another peak along the line, which is missing in curves on later datasets (darker blue ones). (I guess I have understood this figure correctly, but Figure 2 seems horizontally flipped to me. Since you are testing on previous fake datasets, and the accuracy should drop on previous datasets; however, the accuracy drops on later datasets in the figure.)
2. I doubt the authors may not have tried enough sets of hyper parameters for baseline models. In table 1, the variance of GAN, GAN + l2 weight and GAN + SN are significantly higher than the others. I don't think with l2 weight regularizer, the model will be much more unstable than the authors' approach.
3. The authors didn't give the results of their regularizer with LeakGAN on text generation. Currently their model has lower test BLEU than LeakGAN, which indicates lower fluency, but its self BLEU is lower than LeakGAN, which indicates higher diversity. It would be much better if the proposed method can surpass LeakGAN on both metrics.
4. Using inception score on mixture of eight Gaussians may not make much sense, if they are using the ImageNet pre-trained model, since such a model is not trained to fit this distribution. Still, the author has reported symmetric KL.
5. The authors did not specify their inception score on real Celeb-A and CIFAR10 images.
Overall, I tend to accept this paper for its contribution on methods. It would be even better if my concerns could be addressed.
Edit: after seeing the review of Reviewer 3, I find the proposed method seems to be the same as Online EWC and I have downgraded the rating. The authors should address these concerns.


Recent findings suggest that humans deploy cognitive mechanism of physics simulation engines to simulate the physics of objects. We propose a framework for bots to deploy similar tools for interacting with intuitive physics environments. The framework employs a physics simulation in a probabilistic way to infer about moves performed by an agent in a setting governed by Newtonian laws of motion. However, methods of probabilistic programs can be slow in such setting due to their need to generate many samples. We complement the model with a model-free approach to aid the sampling procedures in becoming more efficient through learning from experience during game playing. We present an approach where a myriad of model-free approaches (a convolutional neural network in our model) and model-based approaches (probabilistic physics simulation) is able to achieve what neither could alone. This way the model outperforms an all model-free or all model-based approach. We discuss a case study showing empirical results of the performance of the model on the game of Flappy Bird.

This paper combines a model-free approach and a model-based approach for the game of Flappy Bird. The model-free approach is a CNN on the screen snapshots, in the same fashion as DQN was used for Atari games. The model-based approach is a probabilistic model of Newtonian laws of motion.
The combination of model-free and model-based approaches is definitely one very relevant issue in machine learning, especially in interactive situations, such as reinforcement learning and robotics. The ideas that this paper combines are state-of-the-art and hence is it informative to see how these two particular techniques from each paradigm work together. The most interesting part is that the probabilistic model restricts the CNN restricts the sample action for the model.
I’m not sure how novel this particular combination is, but other systems have also used a model (or a solver) to restrict the possibilities of the exploration. For instance, AlphaGo combines the model-free approach with the rules of the game (at least in the first versions of AlphaGo), and others use Montecarlo Tree Search in a similar vain.
The paper is generally well-written, with some typos occasionally. However, I think that some parts of the process are no well explained, or explained in the wrong order.
For instance, the title and the abstract misled me for quite a while. The title says program induction, and this is then said to be in a fashion similar to Ghahramani 2015, but no further details are given. Is this using Julia? In any case, where is the induction? Later on, it is said that “the model learns the distributions”. but the exact way is completely missing. In other words, the model-based part is not described and encapsulated in a cryptic PHYSICSSIMULATION. In any case, if the model just learn the parameter, I wouldn’t call this “program induction”, at least in the same way as Lake and others use it, or in the way it is used in the area of “inductive programming”.
The game should be describe at the start as “unwanted collisions” are meaningless for a reader who doesn’t know the goal of the game (which is explained in the last paragraph of the paper).
The main problem is that the physics simulation is not learnt and hence rewritten for other games with other physics. This should be solved, in order to see significant progress for benchmarks such as ALE (and properly compare with DQN and many other variants). Perhaps robotics is a better application area, as the physics are always the same (true physics).
Regarding the experiments, they are not very conclusive, especially because the difference is not that large and it is only one single game. The application to other games would be needed, especially if the physics is different. Also, the parameters are different (the ms) and I didn’t understand if these are the best choices, or the possible choices given the computational limitations. In other words, I don’t know if all techniques are compared in the same compute and data conditions. In Figure 3, the yaxis should be explained.
(hum 2017) I imagine that this refers to the authors, otherwise it is a typo.
I didn’t understand the future work. I didn’t parse the bit: “learn about rewards structures in games of physics intuition”.  Actually, the final paragraph gives hints about how much assistance and specialisation the approach is given and hence the limit of generalisations to other problems. These limitations should be stated from the beginning.
Pros:
-	Important integration of model-free and model-based approaches.
-	State-of-the-art techniques
Cons:
-	I don’t see program induction, despite being in the title.
-	Experiments are limited to one game
-	The physics engine is specialised for this game, and hence the approach is difficult to generalise (automatically) for a range of problems where the models should be different.
Typos:
Gharmani -> Ghahramani
overs -> over
bird is required to chose -> the bird is required to choose


EXPLAINING IMAGE CLASSIFIERS BY COUNTERFACTUAL GENERATION
When an image classifier makes a prediction, which parts of the image are relevant and why? We can rephrase this question to ask: which parts of the image, if they were not seen by the classifier, would most change its decision? Producing an answer requires marginalizing over images that could have been seen but weren't. We can sample plausible image in-fills by conditioning a generative model on the rest of the image. We then optimize to find the image regions that most change the classifier's decision after in-fill. Our approach contrasts with ad-hoc in-filling approaches, such as blurring or injecting noise, which generate inputs far from the data distribution, and ignore informative relationships between different parts of the image. Our method produces more compact and relevant saliency maps, with fewer artifacts compared to previous methods.

Summary: This paper aims to find important regions to classify an image. The main algorithm, FIDO, is trained to find a saliency map based on SSR or SDR objective functions. The main novelty of this work is that it uses generative models to in-fill masked out regions by SSR or SDR. As such, compared to existing algorithms, FIDO can synthesize more realistic samples to evaluate.
I like the motivation of this paper since existing algorithms have clear limitations, i.e., using out-of-distribution samples. This issue can be addressed by using a generative network as described in this paper.
However, I think this approach yields another limitation: the performance of the algorithm is bound by the generative network. For example, let’s assume that a head region is important to classify birds. Also assume that the proposed algorithm somehow predicts a mask for the head region during training. If the generative network synthesizes a realistic bird from the mask, then the proposed algorithm will learn that the head region is a supporting region of SSR. In the other case, however, the rendered bird is often not realistic and classified incorrectly. Then, the algorithm will seek for other regions. As a result, the proposed method interprets a classifier network conditioned on the generative network parameters. Authors did not discuss these issues importantly in the paper.
Although the approach has its own limitation, I still believe that the overall direction of the paper is reasonable. It is because I agree that using a generative network to in-fill images to address the motivation of this paper is the best option we have at this current moment. In addition, authors report satisfactory amount of experimental results to support their claim.
Quality: The paper is well written and easy to follow.
Clarify: The explanation of the approach and experiments are clear. Since the method is simple, it also seems that it is easy to reproduce their results.
Originality: Authors apply off-the-shelf algorithms to improve the performance of a known problem. Therefore, I think there is no technical originality except that authors found a reasonable combination of existing algorithms and a problem.
Significance: The paper has a good motivation and deals with an important problem. Experimental results show improvements. Overall, the paper has some amount of impact in this field.
Pros and Cons are discussed above. As a summary,
Pros:
+ Good motivation.
+ Experiments show qualitative and quantitative improvements.
Cons:
- Lack of technical novelty and justification of the approach.


TIMBRETRON: A WAVENET(CYCLEGAN(CQT(AUDIO))) PIPELINE FOR MUSICAL TIMBRE TRANSFER
In this work, we address the problem of musical timbre transfer, where the goal is to manipulate the timbre of a sound sample from one instrument to match another instrument while preserving other musical content, such as pitch, rhythm, and loudness. In principle, one could apply image-based style transfer techniques to a time-frequency representation of an audio signal, but this depends on having a representation that allows independent manipulation of timbre as well as highquality waveform generation. We introduce TimbreTron, a method for musical timbre transfer which applies "image" domain style transfer to a time-frequency representation of the audio signal, and then produces a high-quality waveform using a conditional WaveNet synthesizer. We show that the Constant Q Transform (CQT) representation is particularly well-suited to convolutional architectures due to its approximate pitch equivariance. Based on human perceptual evaluations, we confirmed that TimbreTron recognizably transferred the timbre while otherwise preserving the musical content, for both monophonic and polyphonic samples. We made an accompanying demo video 1 which we strongly encourage you to watch before reading the paper.

The paper proposes a method for converting recordings of a specific musical instrument to another. The proposed approach is apply CycleGAN, which was developed for image style transfer, to transfer spectrograms. The synthesis is done using WaveNet.
The paper is interesting in the core idea. It demonstrates that this combination of building blocks can indeed map recordings while achieving certain characteristics of the target instrument.
The paper correctly describes "timbre" as a catch-all term for characterizing instruments besides pitch and volume. The success of the method should be judged along two dimensions, which are both very subjective:
 - Does the method transfer "enough" of the target instrument's characteristics?
 - Is the resulting audio quality sufficient?
The paper is easy to follow for someone with background in signal processing. I believe it is sufficiently easy to follow for readers with general computer-science and machine-learning background.
The paper focusses a lot on the choice of spectral representation. It compares short-term Fourier transform (STFT), which is the generic standard, and Constant-Q Transforms (CQT), a variant of STFT that uses a logarithmic frequency axis. To someone with signal-processing background, the choice of CQT seems logical and not something that would be challenged strongly as long as a simple comparison to STFT confirms that it works a bit better. I find the comparison between the two too dominant in the paper, and distracting from the other issues that I feel are more important (see below). For example, Section 6.2 states "We demonstrate that the aforementioned translation does indeed result in a perceivable pitch shift when fed to our conditional WaveNet." But that is trivial: Since changing the playback sample rate by a few half steps does not fundamentally alter the perceived timbre of an instrument, and such a change will, by construction of CQT, shift the CQT representation, and since the WaveNet has seen examples of the source instrument for all notes, shifting the CQT respresentation must necessarily result in a perceived pitch change in the re-synthesized wveform that does not fundamentally change its timbre. The real question here is whether the reconstructed signal is of the same quality as, for example, a simple PSOLA-based pitch change would be.
A larger problem of the paper is that the result section seems to only test two instrument mappings, violin to flute, and piano to harpsichord. One notes that these instrument pairs mostly differ in spectral envelope, while they are rather similar in longer-term temporal variations, such as what is sometimes characterized as the ADSR curve (attack-decay-sustain-release) and vibrato. These, in my view, are very important aspects of a musical instrument's characteristics, which are not addressed by the paper. (Whether they are considered part of "timbre" is not clear, but without mapping these, one cannot meaningfully speak of mapping instruments, which is the end goal of this paper.)
Another big problem in my view is that the audio quality is just not good. I hear a lot of musical-noise artifacts and local timbre modulations. Also it is not clear why the source material is of poor quality (sounds quite noisy, most likely in part due to mu-law 8-bit encoding, and they sound like 11 kHz recordings), for which there is no justification in 2018.
Lastly, I am not happy with the "beam-search" approach. That approach is used to post-correct imperfections in the WaveNet synthesis. It samples multiple generation hypotheses, and re-weights hypotheses by how well they match the original CQT when converted back. The need for this indicates a fundamental flaw in the WaveNet synthesizer. The authors explicitly say they did not want to fix the WaveNet algorithm itself. In my view, this is what should have been done.
The authors should focus much more on how to achieve sufficient WaveNet synthesis quality. This should be the main bulk of the paper, and would be a requirement for me to accept the paper.
So overall, the paper feels a little too much of combining black boxes.
In terms of significance, I would not think that this paper is getting near solving this problem, hence I rate it of less significance in the current state of results.
Pros:
 - interesting idea
 - reasonable approach by combining existing building blocks
Cons:
 - too much focus on STFT vs. CQT
 - too little focus on getting WaveNet synthesis right
 - too limited experimental validation (too restricted choice of instruments)
 - poor resulting audio quality
 - feels too much of combining black boxes
As a result I rate the paper "not good enough" in its current form.


Machine learning models that take computer program source code as input typically use Natural Language Processing (NLP) techniques. However, a major challenge is that code is written using an open, rapidly changing vocabulary due to, e.g., the coinage of new variable and method names. Reasoning over such a vocabulary is not something for which most NLP methods are designed. We introduce a Graph-Structured Cache to address this problem; this cache contains a node for each new word the model encounters with edges connecting each word to its occurrences in the code. We find that combining this graph-structured cache strategy with recent Graph-Neural-Network-based models for supervised learning on code improves the models' performance on a code completion task and a variable naming task -with over 100% relative improvement on the latter -at the cost of a moderate increase in computation time.

(updated with some summaries from discussion over the initial review)
The paper discusses the topics of predicting out-of-vocabulary tokens in programs abstract syntax trees. This could have application in code completion and more concretely two tasks are evaluated:
 - predicting a missing reference to a variable (called FillInTheBlank)
 - predicting a name of a variable (NameMe)
Unfortunately, the paper proposes overly complex and strange formulations of these tasks, heavy implementation with unnecessary (non-motivated) neural architectures and as a result, does not demonstrate state-of-the-art performance or precision on comparable tasks. Figure 1 shows the complexity of the approach, with multiple steps of building a graph, introducing the vocabulary cache to then produce a vector at every node of the input tree of the program (instead of creating architecture for a given task), yet simple analysis over which variables can be chosen is missing.
The FillInTheBlank task is badly defined already on the running example. The goal is to select a variable to fill in a blank and already in the example on Figure 2, one of the candidate variables is out of scope at the location to fill. The motivation for the proposed formulation with building a graph and then computing attention over nodes in that graph is unclear and experiments do not help it. For example, [1] (also cited in the paper) solves the same problem more cleanly by considering only the variables in the scope*. There is no good experimental comparison to that work, but it is unlikely it will perform worse. Also [1] does not suffer from vocabulary problems for that task.
Summary discussion below: the experiments here are incomparable on many levels with prior works: different architecture details, different even smaller dataset than from [1]. There is a third-party claim that on a full system, the general idea improves performance, but I take it with a grain of salt as no clean experiment was yet done. The reviewer notes that the authors disagree the baselines are not meaningful.
The NameMe tasks also shows the weakness of the proposed architectures. This work proposes to compute vectors at every node where a variable occurs and then to average them and decode the variable name to predict. In comparison, several prior works introduce one node per variable (not per occurrence), essentially removing the long distance relationships between occurrences of the same variable variables and removing the need to average vectors and enforcing the same name representation at every occurrence of the variable [name]. The setup here is incomparable to specialized naming prior works, one feature (a node per variable) is replaced with another (a node per subtoken), but for baselines authors choose to only to be similar to [1]. Also, while not on the same dataset, [2,3] consistently get higher accuracy on a related and more complicated task of predicting multiple names at the same time over multiple programming languages and with much simpler linear models. This is not surprising, because they propose simpler architectures better suited for the NameMe task.
[1] Miltiadis Allamanis, Marc Brockschmidt, and Mahmoud Khademi. Learning to represent programs
with graphs. ICLR 2017
[2] Veselin Raychev, Martin Vechev, and Andreas Krause. Predicting program properties from Big
Code
[3] Uri Alon, Meital Zilberstein, Omer Levy, Eran Yahav. A General Path-Based Representation for Predicting Program
* corrected text


ON THE SENSITIVITY OF ADVERSARIAL ROBUSTNESS TO INPUT DATA DISTRIBUTIONS
Neural networks are vulnerable to small adversarial perturbations. Existing literature largely focused on understanding and mitigating the vulnerability of learned models. In this paper, we demonstrate an intriguing phenomenon about the most popular robust training method in the literature, adversarial training: Adversarial robustness, unlike clean accuracy, is sensitive to the input data distribution. Even a semantics-preserving transformations on the input data distribution can cause a significantly different robustness for the adversarial trained model that is both trained and evaluated on the new distribution. Our discovery of such sensitivity on data distribution is based on a study which disentangles the behaviors of clean accuracy and robust accuracy of the Bayes classifier. Empirical investigations further confirm our finding. We construct semantically-identical variants for MNIST and CIFAR10 respectively, and show that standardly trained models achieve comparable clean accuracies on them, but adversarially trained models achieve significantly different robustness accuracies. This counter-intuitive phenomenon indicates that input data distribution alone can affect the adversarial robustness of trained neural networks, not necessarily the tasks themselves. Lastly, we discuss the practical implications on evaluating adversarial robustness, and make initial attempts to understand this complex phenomenon.

The paper is interesting and topical: robustness to adversarial input presentation (or shifts in training data itself, even those of the nature described by the authors 'semantic-lossless' shifts). Adversarial inputs are investigated under l-inf bounded perturbations, while multiclass classification on images is the target problem considered. The theoretical parts of the paper, assigning lack of adversarial robustness to the shape of the input distribution (Section 2) is the strongest part of the paper, adding some simple and important insights. Unfortunately, the empirical part of the paper is weakened by an over-reliance of (custom perturbations of ) the popular MNIST and CIFAR10 datasets (which are themselves based on larger sets). Furthermore, the basic conclusion as to causes and remedies of lack of robustness is not evident, and it is not evident that it has been sufficiently investigated. Shape yes, differences in perturbable volume not (how does that concur with Section 2?), and inter-class distance also not. Are we to base these conclusions on 2 perturbed datasets? How are readers to synthesize the final conclusion that robustness is a 'complex interaction of tasks and data', other than what they would already expect? In short, a valiant effort, and a good direction, but one that needs more work.


Face completion is a challenging task with the difficulty level increasing significantly with respect to high resolution, the complexity of "holes" and the controllable attributes of filled-in fragments. Our system addresses the challenges by learning a fully end-to-end framework that trains generative adversarial networks (GANs) progressively from low resolution to high resolution with conditional vectors encoding controllable attributes. We design a novel coarse-to-fine attentive module network architecture. Our model is encouraged to attend on finer details while the network is growing to a higher resolution, thus being capable of showing progressive attention to different frequency components in a coarse-to-fine way. We term the module Frequency-oriented Attentive Module (FAM). Our system can complete faces with large structural and appearance variations using a single feed-forward pass of computation with mean inference time of 0.54 seconds for images at 1024 × 1024 resolution. A pilot human study shows our approach outperforms state-of-the-art face completion methods. The code will be released upon publication.

This work uses GANs to recover clean faces from occluded counterparts. The effectiveness of the proposed method is verified qualitatively and quantitatively on CelebA-HQ. The proposed framework can be generalized to several face-related tasks, such as unconstrained face recognition. Although the novelty of the method is not really impressive, the proposed method seems to be useful for face-related applications and the experimental results are convincing to me.
Pros:
- This method is simple, apparently effective and is a nice use of GANs for a practical task. The paper is written clearly and the English is fine.
Cons:
- My main concern with this paper is regarding the novelty. The authors seem to claim a novel GAN architecture by using an adversarial auto-encoder-based architecture. However, it is not clear to me what aspect of their GAN is particularly new.
- Missing experimental comparisons with state-of-the-arts. Detailed experimental comparisons with more state-of-the-arts (e.g., RLA, Zhao et al., TIP 2018, 3D-PIM, Zhao et al., IJCAI 2018) are needed to justify the superiority of the proposed method.
- Missing more in-the-wild comparisons in the Experiment section. This paper mainly performed experiments on CelebA-HQ. More in-the-wild qualitative and quantitative experiments on recent benchmarks with large occlusion variations are needed to verify the efficacy of the proposed method.
Additional comments:
- How did authors update each component and ensure stable yet fast convergence while optimising the whole GAN-based framework?
- Can the proposed method solve other challenging in-the-wild facial variations except occlusion? e.g., pose, expression, lighting, noise, etc.


UNDERSTANDING AND IMPROVING INTERPOLATION IN AUTOENCODERS VIA AN ADVERSARIAL REGULARIZER
Autoencoders provide a powerful framework for learning compressed representations by encoding all of the information needed to reconstruct a data point in a latent code. In some cases, autoencoders can "interpolate": By decoding the convex combination of the latent codes for two datapoints, the autoencoder can produce an output which semantically mixes characteristics from the datapoints. In this paper, we propose a regularization procedure which encourages interpolated outputs to appear more realistic by fooling a critic network which has been trained to recover the mixing coefficient from interpolated data. We then develop a simple benchmark task where we can quantitatively measure the extent to which various autoencoders can interpolate and show that our regularizer dramatically improves interpolation in this setting. We also demonstrate empirically that our regularizer produces latent codes which are more effective on downstream tasks, suggesting a possible link between interpolation abilities and learning useful representations.

Summary: The authors propose a new approach to encourage valid interpolation in Auto-Encoders (AE). It is based on a regularization procedure involving a critic network judging the realistic nature of reconstructed data point from its mixed latent representations by recovering the mixing coefficient. The authors show that this approach does indeed improve the quality of interpolated samples on few tasks. A synthetic tasks of lines interpolation (proposing new Mean Distance and Smoothness metric for this task), classification task (with a single-layer classifier) from the latent space representation and finally a clustering accuracy on the latent space. On the proposed regularization method seems to help significantly compared to commonly used AE architectures (Basic AE, Denoising AE, Variational AE, Adversarial AE and VQ-VAE).
This paper was a very interesting read, and the work seems to be of significance for the unsupervised learning community.
It was clearly written and conveys the contributions clearly and the experimental results and their interpretations seem valid.
The proposed approach of a critic based regularizer is a simple but seemingly important addition that contributes to improving interpolation in AE significantly and even show impact "downstream tasks" as the authors put it.
Few comments/questions come to mind:
- For the critic Loss L_d in equation (1) , the authors mention that the \gamma based second term (that should ensure that the critic outputs 0 for non-interpolated inputs and expose the critic to realistic data even if the AE reconstruction is poor)  does not seem to be crucial in your approach but stabilized the adversarial training. Could you somehow quantify this. It seems like stability of the adversarial training should be paramount to your method to make sure the AE learns a better latent representation. This comment, even though I assume it well-founded, seems a bit of a contradiction.
- For the Lines synthetic data. It was chosen to use a 32x32 image size with 16 points length lines. This configuration does quantize directly the angles your measures can distinguish. Below a certain angle differences (or delta), 2 angles must have the same pixel representation, i.e. exact overlapping lines. My question is simple: What is the smallest angle you can use/distinguish or, how many exact unique lines can you have?
Overall this is a good paper that deserves publications.


We propose Bayesian Deep Q-Networks (BDQN), a principled and a practical Deep Reinforcement Learning (DRL) algorithm for Markov decision processes (MDP). It combines Thompson sampling with deep-Q networks (DQN). Thompson sampling ensures efficient exploration-exploitation trade-off in high dimensions. It is typically carried out through posterior sampling over the model parameters, which makes it computationally expensive. To overcome this limitation, we directly incorporate uncertainty over the value (Q) function. Further, we only introduce randomness in the last layer (i.e. the output layer) of the DQN and use independent Gaussian priors on the weights. This allows us to efficiently carry out Thompson sampling through Gaussian sampling and Bayesian Linear Regression (BLR), which has fast closed-form updates. The rest of the layers of the Q network are trained through back propagation, as in a standard DQN. We apply our method to a wide range of Atari games in Arcade Learning Environments and compare BDQN to a powerful baseline: the double deep Q-network (DDQN). Since BDQN carries out more efficient exploration, it is able to reach higher rewards substantially faster: in less than 5M±1M interactions for almost half of the games to reach DDQN scores while a typical run of DDQN is 50-200M. We also establish theoretical guarantees for the special case when the feature representation is d-dimensional and fixed. We show that the Bayesian regret of posterior sampling RL (PSRL) and frequentist regret of the optimism in the face of uncertainly (OFU) after N time step are upper bounded by O(d √ N ) which are tight up-to logarithmic factors. To the best of our knowledge, these are the first model free theoretical guarantee for continuous state-action space MDP, beyond the tabular setting.

Update after feedback: I would like to thank the authors for huge work done on improving the paper. I appreciate the tight time constrains given during the discussion phase and big steps towards more clear paper, but at the current stage I keep my opinion that the paper is not ready for publication. Also variability of concerns raised by other reviewers does not motivate acceptance.
I would like to encourage the authors to make careful revision and I would be happy to see this work published. It looks very promising.
Just an example of still unclear parts of the paper: the text between eq. (3) and (4). This describes the proposed method, together with theoretical discussions this is the main part of the paper. As a reader I would appreciate this part being written detailed, step by step.
=========================================================
The paper proposes the Bayesian version of DQN (by replacing the last layer with Bayesian linear regression) for efficient exploration.
The paper looks very promising because of a relatively simple methodology (in the positive sense) and impressive results, but I find the paper having big issues with clarity. There are so many mistakes, typos, unclear statements and a questionable structure in the text that it is difficult to understand many parts. In the current version the paper is not ready for publication.
In details (more in the order of appearance rather than of importance):
1. It seems that the authors use “sample” for tuples from the experience replay buffer and draws W from its posterior distribution (at least for these two purposes), which is extremely confusing
2. pp.1-2 “We show that the Bayesian regret is bounded by O(d \sqrt{N}), after N time steps for a d-dimensional feature map, and this bound is shown to be tight up-to logarithmic factors.” – maybe too many details for an abstract and introduction and it is unclear for a reader anyway at that point
3. p.1 “A central challenge in reinforcement learning (RL) is to design efficient exploration-exploitation tradeoff” – sounds too strong. Isn’t the central challenge to train an agent to get a maximum reward? It’s better to change to at least “One of central challenges”
4. p.1 “ε-greedy which uniformly explores over all the non-greedy strategies with 1 − ε probability” – it is possible, but isn’t it more conventional for an epsilon-greedy policy to take a random action with the probability epsilon and acts greedy with the probability 1 – epsilon? Moreover, later in Section 2 the authors state the opposite “where with ε probability it chooses a random action and with 1 − ε probability it chooses the greedy action based on the estimated Q function.”
5. p.1 “An action is chosen from the posterior distribution of the belief” – a posterior distribution is the belief
6. p.2 “and follow the same target objective” – if BDQN is truly Bayesian it should find a posterior distribution over weights, whereas in DDQN there is no such concept as a posterior distribution over weights, therefore, this statement does not sound right
7. p.2 “This can be considered as a surrogate for sample complexity and regret. Indeed, no single measure of performance provides a complete picture of an algorithm, and we present detailed experiments in Section 4” – maybe too many details for introduction (plus missing full stop at the end)
8. p.2 “This is the cost of inverting a 512 × 512 matrix every 100,000 time steps, which is negligible.” – doesn’t this depend on some parameter choices? Now the claim looks like it is true unconditionally. Also too many details for introduction
9. p.2 “On the other hand, more sophisticated Bayesian RL techniques are significantly more expensive and have not lead to large gains over DQN and DDQN.” – it would be better to justify the claim with some reference
10. Previous work presented in Introduction is a bit confusing. If the authors want to focus only on Thompson Sampling approaches, then it is unclear, why they mentioned OFU methods. If they mention OFU methods, then it is unclear why other exploration methods are not covered (in Introduction). It is better to either move OFU methods to Related Work completely, or to give a taste of other methods (for example, from Related Work) in Introduction as well
11. p.3 “Consider an MDP M as a tuple <X , A, P, P0, R, γ>, with state space X , action space A, the transition kernel P, accompanied with reward function of R, and discount factor 0 ≤ γ < 1.” – P_0 is not defined
12. p.4 “A common assumption in DNN is that the feature representation is suitable for linear classification or regression (same assumption in DDQN), therefore, building a linear model on the features is a suitable choice.” – the statement is more confusing than explaining. Maybe it is better to state that the last fully connected layer, representing linear relationship, in DQN is replaced with BLR in the proposed model
13. p.5 In eq. (3) it is better to carry definition of $\bar{w}_a$ outside the Gaussian distribution, as it is done for $\Xi_a$
14. p.5 The text between eq. (3) and (4) seems to be important for the model description and yet it is very unclear: how $a_{TS}$ is used? “we draw $w_a$ follow $a_{TS}$” – do the authors mean “following” (though it is still unclear with “following”)? What does notation $[W^T \phi^{\theta} (x_{\tau})]_{a_{\tau}}$ denote? Which time steps do the authors mean?
15. p.5 The paragraph under eq. (4) is also very confusing. “to the mean of the posterior A.6.” – reference to the appendix without proper verbal reference. Cov in Algorithm 1 is undefined, is it equal to $\Xi$? Notation in step 8 in Algorithm 1 is too complicated.
16. Algorithm 1 gives a vague idea about the proposed algorithm, but the text should be revised, the current version is very unclear and confusing
17. pp.5-6 The text of the authors' attempts to reproduce the results of others' work (from "We also aimed to implement..." to "during the course of learning and exploration") should be formalised
18. p. 6 "We report the number of samples" - which samples? W? from the buffer replay?
19. p. 6 missing reference for DDQN+
20. p. 6 definition of SC+ and references for baselines should be moved from the table caption to the main text of the paper
21. p. 6 Table 3 is never discussed, appears in a random place of the text, there should be note in its reference that it is in the appendix
22. p.6 Where is the text for footnotes 3-6?
23. p.6 Table 2 may be transposed to fit the borders
24. p.6 (and later) It is unclear why exploration in BDQN is called targeted
25. p.7 Caption of Figure 3 is not very good
26. p.7 Too small font size of axis labels and titles in plots in Figure 3 (there is still a room for 1.5 pages, moreover the paper is allowed to go beyond 10 pages due to big figures)
27. p.7 Figure 3. Why Assault has different from the others y-axis? Why in y-axis (for the others) is "per episode" and x-axis is "number of steps" (wise versa for Assault)?
27. Section 5 should go before Experiments
28. p. 7 “Where Ψ is upper triangular matrix all ones 6.” – reference 6 should be surrounded by brackets and/or preceded by "eq." and it is unclear what “all ones” means especially given than the matrix in eq. (6) does not contain only ones
29. p. 7 “Similar to the linear bandit problems,” – missing citation
30. p. 7 PSRL appears in the theorem, but is introduced only later in Related work
31. p. 7 “Proof: in Theorem. B” – proof is given in Appendix B?
32. p. 8 Theorem discussion, “grows not faster than linear in the dimension, and \sqrt(HT)” – unclear. Is it linear in the product of dimension (of what?) and \sqrt(HT)?
33. p.8 “On lower bound; since for H = 1…” – what on lower bound?
34. p.8 “our bound is order optimal in d and T” – what do the authors mean by this?
35. p.8 "while also the state of the art performance bounds are preserved" - what does it mean?
36. p.8 "To combat these shortcomings, " - which ones?
37. p.8 "one is common with our set of 15 games which BDQN outperformS it..." - what is it?
38. p.9 "Due to the computational limitations..." - it is better to remove this sentence
39. p.9 missing connection in "where the feature representation is fixed, BDQN is given the feature representation", or some parts of this sentence should be removed?
40. p.9 PAC is not introduced
41. pp.13-14 There is no need to divide Appendices A.2 and A.3. In fact, it is more confusing than helpful with the last paragraph in A.2 repeating, sometimes verbatim, the beginning of the first paragraph in A.3
42. In the experiments, do the authors pre-train their BDQN with DQN? In this case, it is unfair to say that BDQN learns faster than DDQN if the latter is not pre-trained with DQN as well. Or is pre-training with DQN is used only for hyperparameter tuning?
43. p.14 “Fig. 4 shows that the DDQN with higher learning rates learns as good as BDQN at the very beginning but it can not maintain the rate of improvement and degrade even worse than the original DDQN.” – it seems that the authors tried two learning rates for DDQN, for the one it is clear that it is set to 0.0025, another one is unclear. The word “original” is also unclear in this context. From the legend of Figure 4 it seems that the second choice for the learning rate is 0.00025, but it should be stated in the text more explicitly. The legend label “DDQN-10xlr” is not the best choice either. It is better to specify explicitly the value of the learning rate for both DDQN
44. p.15 “As it is mentioned in Alg. 1, to update the posterior distribution, BDQN draws B samples from the replay buffer and needs to compute the feature vector of them.” – B samples never mentioned in Algorithm 1
45. p.15 “during the duration of 100k decision making steps, for the learning procedure,” – i) “during … duration”, ii) what did the authors meant by “decision making steps” and “the learning procedure”?, and iii) too many commas
46. p.15 “where $\tilde{T}^{sample}$, the period that of $\tilde{W}$ is sampled our of posterior” – this text does not make sense. Is “our” supposed to be “out”? “… the number of steps, after which a new $\tilde{W}$ is sampled from the posterior”?
47. p.15 “$\tilde{W}$ is being used just for making Thompson sampling actions” – could the authors be more specific about the actions here?
48. p.16 “In BDQN, as mentioned in Eq. 3, the prior and likelihood are conjugate of each others.” – it is difficult to imagine that an equation would mention anything and eq. (3) gives just the final formula for the posterior, rather than the prior and likelihood
49. p.16 The formula after “we have a closed form posterior distribution of the discounted return, ” is unclear
50. p.17 “we use ω instead of ω to avoid any possible confusion” – are there any differences between two omegas?
51. p.17 what is $\hat{b}_t$?
There are a lot of minor mistakes and typos also, I will add them as a comment since there is a limit of characters for the review.


Deep neural networks are vulnerable to adversarial examples: input data that has been manipulated to cause dramatic model output errors. To defend against such attacks, we propose NeuralFingerprinting: a simple, yet effective method to detect adversarial examples that verifies whether model behavior is consistent with a set of fingerprints. These fingerprints are encoded into the model response during training and are inspired by the use of biometric and cryptographic signatures. In contrast to previous defenses, our method does not rely on knowledge of the adversary and can scale to large networks and input data. In this work, we 1) theoretically analyze NeuralFingerprinting for linear models and 2) show that NeuralFingerprinting significantly improves on state-of-the-art detection mechanisms for deep neural networks, by detecting the strongest known adversarial attacks with 98-100% AUC-ROC scores on the MNIST, CIFAR-10 and MiniImagenet (20 classes) datasets. In particular, we consider several threat models, including the most conservative one in which the attacker has full knowledge of the defender's strategy. In all settings, the detection accuracy of NeuralFingerprinting generalizes well to unseen test-data and is robust over a wide range of hyperparameters.

This paper proposes a new technique for detecting adversarial examples by introducing "fingerprints" into the landscape while training, and exploiting the fingerprints at test time to detect adversarial examples. The idea is novel and the paper is well-written, but concerns about gradient masking prevent me from recommending acceptance just yet.
Positives:
The paper is extremely well-written, and the approach is clear and presented well. The authors also clearly put significant effort into the evaluation, and accurately/consistently describe threat models that they consider. The approach is also clearly novel, and is interesting.
Concerns:
My biggest concern is that this detection mechanism masks gradients in its loss function. The two reasons I strongly believe this is the case are (a) Figure 5 and (b) the authors themselves state that their loss is highly non-convex and that no gradient-based method may be able to find a solution. This, however, does not guarantee robustness (see [1] for why such “unfriendly” landscapes can usually be circumvented)
Some concrete evaluation concerns and experiments that the authors can run to alleviate them:
- Figure 5 shows adversarial robustness even against eta = 0.25---at this value of epsilon, the attacker should be able to create realistic images of other classes (even without PGD), so this suggests that the loss is somehow making examples hard to find rather than removing them. The authors should address this issue.
- Showing that at a sufficiently high eta attacks start to succeed is also useful
- Running SPSA, CarliniL2-FP, and PGD for *many* more iterations and using *many* more steps for binary search (right now it looks like the binary search is looking in a space of size 10^6 with 10 steps, which only has a granularity of about 5k, which means you never see any value < 5k in a bisection search, which casts into doubt all of these results)
- The AUC should monotonically degrade with eta (this is another indication the attacks might not be running for long enough)
- The method does not seem to be specific to L-infinity constraint. To this end, a version of Figure 5 in the L2 case would be extremely useful in understanding the detection method.
I also apologize if some of these concerns about gradient masking seem unsubstantiated; that said, I tried to run the code given in the paper, but got several OOM and other errors (utils modules not found, and PyTorch deprecations), even on a machine with 8 12GB-memory GPUs. If the authors can provide instructions for running the code I will be happy to test it and alleviate some of my own concerns. I also tried to reimplement the approach, but did not manage to finish before the review deadline. If I am able to reimplement the approach I will update my review accordingly.
Some smaller comments on the paper:
A consolidated set of tables for attack parameters in an appendix is needed
- Page 4 last paragraph line 4 find the subset that “satisfies” instead of “satisfy”
- Page 5 paragraph 1 line 1 defender,for needs a space before for
- Page 5 paragraph right before theorem 1 last line Here, for detection needs a , after detection
- Page 7 paragraph 1 line 2 (2 hidden layers the 2 should be written two
- Page 7 second last paragraph line 2 “is chosen” instead of “are chosen”
- Page 7 last paragraph line 2 “across attacks” needs a , after
- Page 9 table 6 label line 2 “does not shown” should be “show” instead of “shown”
- Page 9 last line “measure of robustness” remove "of"
[1] https://arxiv.org/pdf/1802.00420.pdf


MAXIMAL DIVERGENCE SEQUENTIAL AUTO- ENCODER FOR BINARY SOFTWARE VULNERABILITY DETECTION *
Due to the sharp increase in the severity of the threat imposed by software vulnerabilities, the detection of vulnerabilities in binary code has become an important concern in the software industry, such as the embedded systems industry, and in the field of computer security. However, most of the works in binary code vulnerability detection has relied on handcrafted features which are manually chosen by a select few domain experts. In this paper, we attempt to alleviate this severe binary vulnerability detection bottleneck by leveraging recent advances in deep learning representations and propose the Maximal Divergence Sequential Auto-Encoder. In particular, latent codes representing vulnerable and non-vulnerable binaries are encouraged to be maximally divergent, while still being able to maintain crucial information from the original binaries. We conducted extensive experiments to compare and contrast our proposed methods with the baselines, and the results indicate that our proposed methods outperform the baselines in all performance measures of interest.

This paper sets out to classify source code snippets are “vulnerable” or “not vulnerable” using sequential auto-encoders with two latent distributions (corresponding to the output classes), regularized to maximize divergence between theses two distributions (named Maximal Divergence Sequential Auto-Encoder).  The authors created a compiled subset of the NDSS18 vulnerable vs. non-vulnerable software dataset (which is listed as one of their primary contributions). The dataset construction required non-trivial effort since example code snippets are often incomplete and the authors needed to “fix” these code examples in order to compile them. The fixed code examples are then compiled against both Windows and Linux and both the x86 and x86-64 architectures. The inputs to all predictive models are the opcode sequence of the compiled programs.
This paper compares against one previously published vulnerability detection method (VulDeePecker) which is a bidirectional RNN followed by a linear classifier. They also compare with a cascade of models with increasingly complex components:
* RNN-R: A recurrent neural network trained in an unsupervised fashion (language modeling over opcode sequences), whose representations are then fed into an independent linear model.
* RNN-C: End-to-end training of a recurrent model over opcodes, followed by a single dense layer.
* Para2Vec: Encoding of the opcode sequence using the paragraph-to-vector architecture — I’m curious what they used as the paragraph boundaries in the compiled programs and whether the subsequent classifier was the same as RNN-C.
* SeqVAE-C: Sequential variational auto encoder trained end-to-end with a final classification layer.
* MDSAE-RKL:  Maximal divergence sequential auto-encoder with KL divergence between the two class’s latent distributions, final classifier trained independently.
* MDSAE-RWS: Maximal divergence sequential auto-encoder with L2/Wasserstein  divergence between the two class’s latent distributions, final classifier trained independently.
* MDSAE-CKL: Maximal divergence sequential auto-encoder with KL divergence between the two class’s latent distributions, final classifier included as the final layer of the whole model.
* MDSAE-CWS: Maximal divergence sequential auto-encoder with L2/Wasserstein  divergence between the two class’s latent distributions, final classifier included as the final layer of the whole model.
The two MDSAE models using Wasserstein divergence vastly outperform the two equivalent models using KL divergence. Another generalization that can be drawn from the evaluation is that models which are trained  with supervision end-to-end outperform those which train representation and classifier separately.
Overall, I think this is an interesting and cool paper but I’m not sure I actually buy into the basic premise that it makes sense to model vulnerable vs. non-vulnerable code as two different latent spaces. Aren’t the changes to make a vulnerable function safe again rather small and/or subtle? I think that beyond visualizing the convergence of properties of the latent spaces it would greatly improve this paper to inspect which aspects of the source contribute to both the latent representation and final classification as vulnerable vs. non-vulnerable.
Also, I wish the process of “fix”ing the input code was better described, since the failure of this procedure excluded 4k/13k of the programs/functions in their initial dataset and had the potential to introduces learnable biases in the source code. At the very least, the authors should list how many vulnerable vs. non-vulnerable samples required fixing vs. could be compiled in their original form.
Lastly, the definition of "vulnerable" may be obvious to someone more familiar with the domain but seemed to me somewhat vague and never directly addressed.
Typo:
p3, need space in "obtain32, 281"