Detect Rumors in Microblog Posts Using Propagation Structure via Kernel Learning
How fake news goes viral via social media? How does its propagation pattern differ from real stories? In this paper, we attempt to address the problem of identifying rumors, i.e., fake information, out of microblog posts based on their propagation structure. We firstly model microblog posts diffusion with propagation trees, which provide valuable clues on how an original message is transmitted and developed over time. We then propose a kernel-based method called Propagation Tree Kernel, which captures high-order patterns differentiating different types of rumors by evaluating the similarities between their propagation tree structures. Experimental results on two real-world datasets demonstrate that the proposed kernel-based approach can detect rumors more quickly and accurately than state-ofthe-art rumor detection models.
1 Introduction
On November 9th, 2016, Eric Tucker, a grassroots user who had just about 40 followers on Twitter, tweeted his unverified observations about paid protesters being bused to attend anti-Trump demonstration in Austin, Texas. The tweet, which was proved false later, was shared over 16 thousand times on Twitter and 350 thousand times on Facebook within a couple of days, fueling a nation-wide conspiracy theory1. The diffusion of the story is illustrated as Figure 1 which gives the key spreading points of the story along the time line. We can see that after the initial post, the tweet
1https://www.nytimes.com/2016/11/20/ business/media/how-fake-news-spreads. html
was shared or promoted by some influential online communities and users (including Trump himself), resulting in its wide spread.
A widely accepted definition of rumor is “unverified and instrumentally relevant information statements in circulation” (DiFonzo and Bordia, 2007). This unverified information may eventually turn out to be true, or partly or entirely false. In today’s ever-connected world, rumors can arise and spread at lightening speed thanks to social media platforms, which could not only be wrong, but be misleading and dangerous to the public society. Therefore, it is crucial to track and debunk such rumors in timely manner.
Journalists and fact-checking websites such as snopes.com have made efforts to track and detect rumors. However, such endeavor is manual, thus prone to poor coverage and low speed. Feature-based methods (Castillo et al., 2011; Yang et al., 2012; Ma et al., 2015) achieved certain success by employing large feature sets crafted from message contents, user profiles and holistic statistics of diffusion patterns (e.g., number of retweets, propagation time, etc.). But such an approach was over simplified as they ignored the dynamics of rumor propagation. Existing studies considering propagation characteristics mainly focused on the temporal features (Kwon et al., 2013, 2017) rather than the structure of propagation.
So, can the propagation structure make any difference for differentiating rumors from nonrumors? Recent studies showed that rumor spreaders are persons who want to get attention and popularity (Sunstein, 2014). However, popular users who get more attention on Twitter (e.g., with more followers) are actually less likely to spread rumor in a sense that the high audience size might hinder a user from participating in propagating unverified information (Kwon et al., 2017). Intuitively, for “successful” rumors being propagated as widely
2
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
Figure 1: An illustration of how the rumor about “buses used to ship in paid anti-Trump protesters to Austin, Texas” becomes viral, where ‘*’ indicates the level of influence.
as popular real news, initial spreaders (typically lack of popularity) must attract certain amount of broadcasting power, e.g., attention of influential users or communities that have a lot of audiences joining in promoting the propagation. We refer to this as a constrained mode propagation, relative to the open mode propagation of normal messages that everyone is open to share. Such different modes of propagation may imply some distinct propagation structures between rumors and nonrumors and even among different types of rumors.
Due to the complex nature of information diffusion, explicitly defining discriminant features based on propagation structure is difficult and biased. Figure 2 exemplifies the propagation structures of two Twitter posts, a rumor and a nonrumor, initiated by two users shown as the root nodes (in green color). The information flows here illustrates that the rumorous tweet is first posted by a low-impact user, then some popular users joining in who boost the spreading, but the non-rumorous tweet is initially posted by a popular user and directly spread by many general users; contentbased signal like various users’ stance (Zhao et al., 2015) and edge-based signal such as relative influence (Kwon et al., 2017) can also suggest the different nature of source tweets. Many of such implicit distinctions throughout propagation are hard to hand craft specifically using flat summary of statistics as previous work did. In addition, unlike representation learning for plain text, learning for representation of structures such as networks is not well studied in general. Therefore, traditional and latest text-based models (Castillo et al., 2011;
(a) A rumor (b) A non-rumor
Figure 2: Fragments of the propagation for two source tweets. Node size: denotes the popularity of the user who tweet the post (represented by # of followers); Red, black, blue node: content-wise the user express doubt/denial, support, neutrality in the tweet, respectively; Solid (dotted) edge: information flow from a more (less) popular user to a less (more) popular user; Dashed concentric circles: time stamps.
Ma et al., 2015, 2016) cannot be applied easily on such complex, dynamic structures.
To capture high-order propagation patterns for rumor detection, we firstly represent the propagation of each source tweet with a propagation tree which is formed by harvesting user’s interactions to one another triggered by the source tweet. Then, we propose a kernel-based data-driven method called Propagation Tree Kernel (PTK) to generate relevant features (i.e., subtrees) automatically for estimating the similarity between two propagation trees. Unlike traditional tree kernel (Moschitti, 2006; Zhang et al., 2008) for modeling syntactic structure based on parse tree, our propagation tree consists of nodes corresponding to microblog
3
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
posts, each represented as a continuous vector, and edges representing the direction of propagation and providing the context to individual posts. The basic idea is to find and capture the salient substructures in the propagation trees indicative of rumors. We also extend PTK into a context-enriched PTK (cPTK) to enhance the model by considering different propagation paths from source tweet to the roots of subtrees, which capture the context of transmission. Extensive experiments on two real-world Twitter datasets show that the proposed methods outperform state-of-the-art rumor detection models with large margin.
Moreover, most existing approaches regard rumor detection as a binary classification problem, which predicts a candidate hypothesis as rumor or not. Since a rumor often begins as unverified and later turns out to be confirmed as true or false, or remains unverified (Zubiaga et al., 2016), here we consider a set of more practical, finer-grained classes: false rumor, true rumor, unverified rumor, and non-rumor, which becomes an even more challenging problem.
2 Related Work
Tracking misinformation or debunking rumors has been a hot research topic in multiple disciplines (DiFonzo and Bordia, 2007; Morris et al., 2012; Rosnow, 1991). Castillo et al. (2011) studied information credibility on Twitter using a wide range of hand-crafted features. Following that, various features corresponding to message contents, user profiles and statistics of propagation patterns were proposed in many studies (Yang et al., 2012; Wu et al., 2015; Sun et al., 2013; Liu et al., 2015). Zhao et al. (2015) focused on early rumor detection by using regular expressions for finding questing and denying tweets as the key for debunking rumor. All such approaches are over simplistic because they ignore the dynamic propagation patterns given the rich structures of social media data.
Some studies focus on finding temporal patterns for understanding rumor diffusion. Kown et al. (2013; 2017) introduced a time-series fitting model based on the temporal properties of tweet volume. Ma et al. (2015) extended the model using time series to capture the variation of features over time. Friggeri et al. (2014) and Hannak et al. (2014) studied the structure of misinformation cascades by analyzing comments linking to
rumor debunking websites. More recently, Ma et al. (2016) used recurrent neural networks to learn the representations of rumor signals from tweet text at different times. Our work will consider temporal, structural and linguistic signals in a unified framework based on propagation tree kernel.
Most previous work formulated the task as classification at event level where an event is comprised of a number of source tweets, each being associated with a group of retweets and replies. Here we focus on classifying a given source tweet regarding a claim which is a finer-grained task. Similar setting was also considered in (Wu et al., 2015; Qazvinian et al., 2011).
Kernel methods are designed to evaluate the similarity between two objects, and tree kernel specifically addresses structured data which has been successfully applied for modeling syntactic information in many natural language tasks such as syntactic parsing (Collins and Duffy, 2001), question-answering (Moschitti, 2006), semantic analysis (Moschitti, 2004), relation extraction (Zhang et al., 2008) and machine translation (Sun et al., 2010). These kernels are not suitable for modeling the social media propagation structures because the nodes are not given as discrete values like part-of-speech tags, but are represented as high dimensional real-valued vectors. Our proposed method is a substantial extension of tree kernel for modeling such structures.
3 Representation of Tweets Propagation
On microblogging platforms, the follower/friend relationship embeds shared interests among the users. Once a user has posted a tweet, all his followers will receive the tweet. Furthermore, Twitter allows a user to retweet or comment another user’s post, so that the information could reach beyond the network of the original creator.
We model the propagation of each source tweet as a tree structure T (r) = 〈V,E〉, where r is the source tweet as well as the root of the tree, V refers to a set of nodes each representing a responsive post (i.e., retweet or reply) of an user at a certain time to the source tweet r which initiates the circulation, and E is a set of directed edges corresponding to the response relation among the nodes in V . If there exists a directed edge from vi to vj , it means vj is a direct response to vi.
More specifically, each node v ∈ V is a tuple v = (uv, wv, tv), which provides the following in-
4
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
formation: uv is the creator of the post, wv represents the text content of the post, and tv is the time lag between the source tweet r and v. In our case, uv contains attributes of the user such as # of followers/friends, verification status, # of history posts, etc., wv is a vector of bag-of-words representing the post’s content.
4 Propagation Tree Kernel Modeling
In this section, we describe our rumor detection model based on propagation trees using kernel method called Propagation Tree Kernel (PTK). Our task is, given a propagation tree T (r) of a source tweet r, to predict the label of r.
4.1 Background of Tree Kernel
Before presenting our proposed algorithm, we briefly present the traditional tree kernel, which our PTK model is based on.
Tree kernel was designed to compute the syntactic and semantic similarity between two natural language sentences by implicitly counting the number of common subtrees between their corresponding parse trees. Given a syntactic parse tree, each node with its children is associated with a grammar production rule. Figure 3 illustrates the syntactic parse tree of “cut a tree” and its subtrees. A subtree is defined as any subgraph which have more than one nodes, with the restriction that entire (not partial) rule productions must be included. For example, the fragment [NP [D a]] is excluded because it contains only part of the production NP→ D N (Collins and Duffy, 2001).
Following Collins and Duffy (2001), given two parse trees T1 and T2, the kernel function K(T1, T2) is defined as:∑
vi∈V1 ∑ vj∈V2 ∆(vi, vj) (1)
where V1 and V2 are the sets of all nodes respectively in T1 and T2, and each node is associated with a production rule, and ∆(vi, vj) evaluates the common subtrees rooted at vi and vj . ∆(vi, vj) can be computed using the following recursive procedure (Collins and Duffy, 2001):
1) if the production rules at vi and vj are different, then ∆(vi, vj) = 0;
2) else if the production rules at vi and vj are same, and vi and vj have only leaf children (i.e., they are pre-terminal symbols), then ∆(vi, vj) = λ;
where nc(v) is the number of children of node v, ch(v, k) is the k-th child of node v, and λ (0 < λ ≤ 1) is a decay factor. λ = 1 yields the number of common subtrees; λ < 1 down weighs the contribution of larger subtrees to make the kernel value less variable with respect to subtree size.
4.2 Our PTK Model
To classify propagation trees, we can calculate the similarity between the trees, which is supposed to reflect the distinction of different types of rumors and non-rumors based on structural, linguistic and temporal properties. However, existing tree kernels cannot be readily applied on propagation trees because 1) unlike parse tree where the node is represented by enumerable nominal value (e.g., part-of-speech tag), the propagation tree node is given as a vector of continuous numerical values representing the basic properties of the node; 2) the similarity of two parse trees is based on the count of common subtrees, for which the commonality of subtrees is evaluated by checking if the same production rules and the same children are associated with the nodes in two subtrees being compared, whereas in our context the similarity function should be defined softly since hardly two nodes from different trees are same.
With the representation of propagation tree, we first define a function f to evaluate the similarity between two nodes vi and vj (we simplify node representation such as vi = (ui, wi, ti)):
f(vi, vj) = e −t (αE(ui, uj) + (1− α)J (ci, cj))
where t = |ti − tj | is the absolute difference between the time lags of vi and vj , E and J are user-based similarity and content-based similarity, respectively, and α is the trade-off parameter. The intuition of using exponential function of t to
5
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
scale down the similarity is to capture the discriminant signals or patterns at the different stages of propagation. For example, a questioning message posted very early may signal a false rumor while the same posted far later from initial post may indicate the rumor is still unverified, despite that the two messages are semantically similar.
The user-based similarity is defined as an Euclidean distance E(ui, uj) = ||ui − uj ||2, where ui and uj are the user vectors of node vi and vj and || • ||2 is the 2-norm of a vector. Here E is used to capture the characteristics of users participating in spreading rumors as discriminant signals, throughout the entire stage of propagation.
Contentwise, we use Jaccard coefficient to measure the similarity of post content:
J (ci, cj) = |Ngram(ci) ∩Ngram(cj)| |Ngram(ci) ∪Ngram(cj)|
where ci and cj are content words in two nodes. For n-grams here, we adopt both uni-grams and bi-grams. It can capture cue terms e.g., ‘false’, ‘debunk’, ‘not true’, etc. commonly occurring in rumors but not in non-rumors.
Given two propagation trees T1 = 〈V1, E1〉 and T2 = 〈V2, E2〉, PTK aims to compute the similarity between T1 and T2 iteratively based on enumerating all pairs of most similar subtrees. First, for each node vi ∈ V1, we obtain v′i ∈ V2, the most similar node of vi from V2:
v′i = arg max vj∈V2 f(vi, vj)
Similarly, for each vj ∈ V2, we obtain v′j ∈ V1:
v′j = arg max vi∈V1 f(vi, vj)
Then, the propagation tree kernel KP (T1, T2) is defined as:∑
vi∈V1
Λ(vi, v ′ i) + ∑ vj∈V2 Λ(v′j , vj) (2)
where Λ(v, v′) evaluates the similarity of two subtrees rooted at v and v′, which is computed recursively as follows:
1) if v or v′ are leaf nodes, then Λ(v, v′) = f(v, v′);
2) else Λ(v, v′) = f(v, v′) ∏min(nc(v),nc(v′)) k=1 (1 +
Λ(ch(v, k), ch(v′, k)))
Note that unlike traditional tree kernel, in PTK the node similarity f ∈ [0, 1] is used for softly counting similar subtrees instead of common subtrees. Also, λ in tree kernel is not needed as subtree size is not an issue here thanks to node similarity f .
PTK aims to capture discriminant patterns from propagation trees inclusive of user, content and temporal traits, which is inspired by prior analyses on rumors spreading, e.g., user information can be a strong clue in the initial broadcast, content features are important throughout entire propagation periods, and structural and temporal patterns help for longitudinal diffusion (Zubiaga et al., 2016; Kwon et al., 2017).
4.3 Context-Sensitive Extension of PTK
One defect of PTK is that it ignores the clues outside the subtrees, e.g., how the information propagates from source post to the current subtree. Intuitively, propagation paths provide further clue for determining the truthfulness of information since they embed the route and context of how the propagation happens. Therefore, we propose contextsensitive TPK (cPTK) by considering the propagation paths from the root of the tree to the roots of subtrees, which shares similar intuition with the context-sensitive tree kernel (Zhou et al., 2007).
For a propagation tree node v ∈ T (r), let Lrv be the length (i.e., # of nodes) of the propagation path from root r to v, and v[x] be the x-th ancestor of v on the path starting from v (0 ≤ x < Lrv, v[0] = v, v[Lrv − 1] = r). cPTK evaluates the similarity between two trees T1(r1) and T2(r2) as follows:
∑ vi∈V1 L r1 vi −1∑ x=0 Λx(vi, v ′ i) + ∑ vj∈V2 L r2 vj −1∑ x=0 Λx(v ′ j , vj)
(3) where Λx(v, v′) measures the similarity of subtrees rooted at v[x] and v′[x] for context-sensitive evaluation, which is computed as follows:
1) if x > 0, Λx(v, v′) = f(v[x], v′[x]), where v[x] and v′[x] are the x-th ancestor nodes of v and v′ on the respective propagation path.
2) else Λx(v, v′) = Λ(v, v′), namely PTK.
Clearly, PTK is a special case of cPTK when x = 0 (see equation 3). cPTK evaluates the occurrence of both context-free (without considering ancestors on propagation paths) and contextsensitive cases.
6
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
4.4 Rumor Detection via Kernel Learning
The advantage of kernel-based method is that we can avoid painstakingly engineering the features. This is possible because the kernel function can explore an implicit feature space when calculating the similarity between two objects (Culotta and Sorensen, 2004).
We incorporate the proposed tree kernel functions, i.e., PTK (equation 2) or cPTK (equation 3), into a supervised learning framework, for which we utilize a kernel-based SVM classifier. We treat each tree as an instance, and its similarity values with all training instances as feature space. Therefore, the kernel matrix of training set is m × m and that of test set is n×m where m and n are the sizes of training and test sets, respectively.
For our multi-class task, we perform a one-vsall classification for each label and then assign the one with the highest likelihood among the four, i.e., non-rumor, false rumor, true rumor or unverified rumor. We choose this method due to interpretability of results, similar to recent work on occupational class classification (Preoţiuc-Pietro et al., 2015; Lukasik et al., 2015).
5 Experiments and Results
5.1 Data Sets
To our knowledge, there is no public dataset available for classifying propagation trees, where we need source tweets, more accurately, tree roots together with propagation structure, to be appropriately annotated.
We constructed our datasets based on a couple of reference datasets, namely Twitter15 (Liu et al., 2015) and Twitter16 (Ma et al., 2016). The original datasets were used for binary classification of rumor and non-rumor with respect to a given event that contain its relevant tweets.
First, we extracted the popular source tweets2 that are highly retweeted or replied. We then collected all the propagation threads (i.e., retweets and replies) for these source tweets. Because Twitter API cannot retrieve the retweets or replies, we gathered the retweet users for a given tweet from Twrench3 and crawled the replies through Twitter’s web interface.
Finally, we annotated the source tweets by referring to the events they are from. We first turned
2Though unpopular tweets could be false, we ignore them as they do not draw much attention and are hardly impactful
3https://twren.ch
the label of each event in Twitter15 and Twitter16 from binary to quaternary according to the veracity tag of the article in rumor debunking websites (e.g., snopes.com, Emergent.info, etc). Then we labeled the source tweets by following these rules: 1) Source tweets from unverified rumor events or non-rumor events are labeled same as event label; 2) For a source tweet in false rumor event, we flip over the label and assign true to the source tweet if it expresses denial type of stance; otherwise, the label is assigned as false; 3) The analogous flipover/not-change rule applies to source tweets from true rumor events.
Table 1 gives statistics on the resulting datasets.
5.2 Experimental Setup
We compare our kernel-based method against the following baselines:
SVM-TS: A linear SVM classification model that uses time-series to model the variation of a set of hand-crafted features (Ma et al., 2015).
DTR: A Decision-Tree-based Ranking method to identify trending rumors (Zhao et al., 2015), which searches for enquiry phrases and clusters disputed factual claims, and ranked the clustered results based on statistical features.
DTC and SVM-RBF: The Twitter information credibility model using Decision Tree Classifier (Castillo et al., 2011) and the SVM-based model with RBF kernel (Yang et al., 2012), respectively, both using hand-crafted features based on the overall statistics of the posts.
RFC: The Random Forest Classifier proposed by Kwon et al. (2017) using three parameters to fit the temporal properties and an extensive set of hand-crafted features related to the user, linguistic and structure characteristics.
GRU: The RNN-based rumor detection model proposed by Ma et al. (2016) with gated recurrent
7
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
Table 2: Rumor detection results (NR: NonRumor; FR: False Rumor; TR: True Rumor; UR: Unverified Rumor)
(a) Twitter15 Dataset
Method NR FR TR URAcc. F1 F1 F1 F1 DTR 0.409 0.501 0.311 0.364 0.473 SVM-RBF 0.318 0.455 0.037 0.218 0.225 DTC 0.454 0.733 0.355 0.317 0.415
SVM-TS 0.544 0.796 0.472 0.404 0.483 RFC 0.565 0.810 0.422 0.401 0.543 GRU 0.646 0.792 0.574 0.608 0.592 BOW 0.548 0.564 0.524 0.582 0.512 PTK- 0.657 0.734 0.624 0.673 0.612
cPTK- 0.697 0.760 0.645 0.696 0.689 PTK 0.710 0.825 0.685 0.688 0.647
cPTK 0.750 0.804 0.698 0.765 0.733
(b) Twitter16 Dataset
Method NR FR TR URAcc. F1 F1 F1 F1 DTR 0.414 0.394 0.273 0.630 0.344 SVM-RBF 0.321 0.423 0.085 0.419 0.037 DTC 0.465 0.643 0.393 0.419 0.403
SVM-TS 0.574 0.755 0.420 0.571 0.526 RFC 0.585 0.752 0.415 0.547 0.563 GRU 0.633 0.772 0.489 0.686 0.593 BOW 0.585 0.553 0.556 0.655 0.578 PTK- 0.653 0.673 0.640 0.722 0.567
cPTK- 0.702 0.711 0.664 0.816 0.608 PTK 0.722 0.784 0.690 0.786 0.644
cPTK 0.732 0.740 0.709 0.836 0.686
unit for representation learning of high-level features from relevant posts over time.
BOW: A naive baseline we worked by representing the text in each tree using bag-of-words and building the rumor classifier with linear SVM.
Our models: PTK and cPTK are our full PTK and cPTK models, respectively; PTK- and cPTKare the setting only using content while ignoring user properties.
We implemented DTC and RFC with Weka4, SVM models with LibSVM5 and GRU with Theano6. We held out 10% of the trees in each dataset for model tuning, and for the rest of the trees, we performed 3-fold cross-validation. We used accuracy, F1 measure as evaluation metrics.
5.3 Experimental Results
Table 2 show that our proposed methods outperform all the baselines on both datasets.
4http://www.cs.waikato.ac.nz/ml/weka/ 5https://www.csie.ntu.edu.tw/˜cjlin/
libsvm/ 6http://deeplearning.net/software/ theano/
Among all baselines, GRU performs the best, which learns the low-dimensional representation of responsive tweets by capturing the textual and temporal information. This indicates the effectiveness of complex signals indicative of rumors beyond cue words or phrases (e.g., “what?”, “really?”, “not sure”, etc.). This also justifies the good performance of BOW even though it only uses uni-grams for representation. Although DTR uses a set of regular expressions, we found only 19.59% and 22.21% tweets in our datasets containing these expressions. That is why the results of DTR are not satisfactory.
SVM-TS and RFC are comparable because both of them utilize an extensive set of features especially focusing on temporal traits. But none of the models can directly incorporate structured propagation patterns for deep similarity comparison between propagation trees. SVM-RBF, although using a non-linear kernel, is based on traditional hand-crafted features instead of the structural kernel like ours. So, they performed obviously worse than our approach.
Representation learning methods like GRU cannot easily utilize complex structural information since learning features from networked data is not studied well. Our models capture complex propagation patterns from structured data rich of linguistic, user and temporal signals. The superiority of our models is clear: PTK- which only uses text is already better than GRU, demonstrating the importance of propagation structures. PTK that combines text and user yields better results on both datasets, implying that both properties are complementary and PTK integrating flat and structured information is more effective.
It is also observed that cPTK outperforms PTK except for non-rumor class. This suggests the context-sensitive modeling based on PTK is effective for different types of rumors, but for nonrumors, it seems that considering context of propagation path is not always helpful. This might be due to the generally weak signal from node properties on the paths during non-rumor’s diffusion as user distribution patterns in non-rumors are not as obvious as in rumors. This is not an issue in cPTK- since user information is not considered. Over all classes, cPTK achieves the highest accuracies on both datasets.
Furthermore, we observe that all the baseline methods perform much better on non-rumors than
8
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
Figure 4: The example subtree of a rumor captured by the algorithm at early stage of propagation
on rumors. This is because the exiting features were defined for binary (rumor vs. non-rumor) classification in previous works. So, they do not perform well for finer-grained classes. Our approach can differentiate various classes much better by deep, detailed comparison of different patterns based on propagation structure.
5.4 Early Detection Performance
Detecting rumors at an early stage of propagation is very important so that preventive measures could be taken. In early detection task, all the posts after a detection deadline are invisible during test. The earlier the deadline, the less propagation information can be available.
Figure 5 shows the performances of our PTK and cPTK models versus RFC (the best system based on feature engineering), GRU (the best system based on RNN) and DTR (an early-detectionspecific algorithm) against various deadlines. In the first few hours, our approach demonstrates superior early detection performance than other models. Particularly, cPTK achieve 75% accuracy on Twitter15 and 73% on Twitter16 within 24 hours, that is much faster than other models.
Our analysis shows that rumors typically demonstrate more complex propagation substructures especially at early stage. Figure 4 shows a detected subtree of a false rumor spread in its first few hours, where influential users are somehow captured to boost its propagation and the information flows among the users with an obvious unpopular-to-popular-to-unpopular trend in terms
of user popularity, but such pattern was not witnessed in non-rumors in early stage. Many textual signals (underlined) can also be observed in that early period. Our method can learn such structures and patterns naturally, but it is difficult to know and hand-craft them in feature engineering.
6 Conclusion
We propose a novel approach for detecting rumors in microblog posts based on kernel learning method using propagation trees. A propagation tree encodes the spread of a hypothesis (i.e., a source tweet) with complex structured patterns and flat information regarding content, user and time associated with the tree nodes. Enlightened by tree kernel techniques, our kernel method learns discriminant clues for identifying rumors of finer-grained levels by directly measuring the similarity among propagation trees via kernel functions. Experiments show that our approach outperforms state-of-the-art baselines with large margin for both general and early rumor detection tasks.
9
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899

- Strengths:  The authors propose a kernel-based method that captures high-order patterns differentiting different types of rumors by evaluating the similarities between their propagation tree structures.  - Weaknesses:  maybe the maths is not always clear in Sect. 4.   - General Discussion:  The authors propose a propagation tree kernel, a kernel-based method that captures high-order patterns differentiating types of rumors by evaluating the similarities between their propagation tree structures. The proposed approach detects rumors more quickly and with a higher accuracy compared to the one obtained by the state of the art methods.  The data set should be made public for research purposes.  Typos need to be fixed (e.g. 326 3277: any subgraph which havetohas; 472: TPKtoPTK; 644: Table 2 show+s), missing information needs to be added (875: where was it published?), information needs to be in the same format (e.g. 822 vs 897). Figure 5 is a bit small.


Identifying Products in Online Cybercrime Marketplaces: A Dataset and Fine-grained Domain Adaptation Task
One weakness of machine-learned NLP models is that they typically perform poorly on out-of-domain data. In this work, we study the task of identifying products being bought and sold in online cybercrime forums, which exhibits particularly challenging cross-domain effects. We formulate a task that represents a hybrid of slot-filling information extraction and named entity recognition and annotate datasets consisting of data from four different forums. Each of these forums constitutes its own “fine-grained domain” in that the forums cover different market sectors with different properties, even though all forums are in the broad domain of cybercrime. We characterize these domain differences in the context of a learning-based system: supervised models see decreased accuracy when applied to new forums, and standard techniques for semisupervised learning and domain adaptation have limited effectiveness on this data, which suggests the need to improve these techniques. We release a dataset of 93,924 posts from across 4 forums, with annotations for 1,938 posts.
1 000
009
010
011
012
013
014
015
016
017
018
019
020
021
022
023
024
025
026
027
028
029
030
031
032
033
034
035
036
037
038
039
040
041
042
043
044
045
046
047
048
049
059
060
061
062
063
064
065
066
067
068
069
070
071
072
073
074
075
076
077
078
079
080
081
082
083
084
085
086
087
088
089
090
091
092
093
094
095
096
097
098
099
We release a dataset of 93,924 posts from across 4 forums, with annotations for 1,938 posts.1
1 Introduction
NLP can be extremely useful for enabling scientific inquiry, helping us to quickly and efficiently understand large corpora, gather evidence, and test hypotheses (Bamman et al., 2013; O’Connor et al., 2013). One domain for which automated analysis is particularly useful is Internet security: researchers obtain large amounts of text data pertinent to active threats or ongoing cybercriminal activity, for which the ability to rapidly characterize that text and draw conclusions can reap major benefits (Krebs, 2013a,b). However, conducting automatic analysis is difficult because this data is outof-domain for conventional NLP models, which harms the performance of both discrete models (McClosky et al., 2010) and deep models (Zhang et al., 2017). Not only that, we show that data from one cybercrime forum is even out of domain with respect to another cybercrime forum, making this data especially challenging.
1Available upon publication, along with all models and code from this work.
In this work, we present the task of identifying products being bought and sold in the marketplace sections of these online cybercrime forums. We define a token-level annotation task where, for each post, we annotate references to the product or products being bought or sold in that post. Having the ability to automatically tag posts in this way lets us characterize the composition of a forum in terms of what products it deals with, identify trends over time, associate users with particular activity profiles, and connect to price information to better understand the marketplace. Some of these analyses only require post-level information (what is the product being bought or sold in this post?) whereas other analyses might require token-level references; we annotate at the token level to make our annotation as general as possible. Our dataset has already proven enabling for case studies on these particular forums (anon. work in press).
Our task has similarities to both slot-filling information extraction (with provenance information) as well as standard named-entity recognition (NER). Compared to NER, our task features a higher dependence on context: we only care about the specific product being bought or sold in a post, not other products that might be mentioned. Moreover, because we are operating over forums, the data is substantially messier than classical NER corpora like CoNLL (Tjong Kim Sang and De Meulder, 2003). While prior work has dealt with these messy characteristics for syntax (Kaljahi et al., 2015) and for discourse (Lui and Baldwin, 2010; Kim et al., 2010; Wang et al., 2011), our work is the first to tackle forum data (and marketplace forums specifically) from an information extraction perspective.
Having annotated a dataset, we examine basic supervised learning approaches to the product extraction problem. Simple binary classification of tokens as product names can be effective, but performance drops off precipitously when a system trained on one forum is applied to a different fo-
2
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
Words Products Annotated Annotators Inter-annotator agreement Forum Posts per post per post posts per post 3-annotated all-annotated Darkode 3,368 61.5 3.2 660/100/100 3/8/8 0.62 0.66 Hack Forums 51,271 58.9 2.2 758/140 3/4 0.58 0.65
Blackhat 167 174 3.2 80 3 0.66 0.67 Nulled 39,118 157 2.3 100 3 0.77 -
Table 1: Forum statistics. The left columns (posts and words per post) are calculated over all data, while the right columns are based on annotated data only. Slashes indicate the train/development/test split for Darkode and train/test split for Hack Forums. Agreement is measured using Fleiss’ Kappa; the two columns cover data where three annotators labeled each post and a subset labeled by all annotators.
rum: in this sense, even two different cybercrime forums seem to represent different “fine-grained domains.” Since we want to avoid having to annotate data for every new forum that might need to be analyzed, we explore several methods for adaptation, mixing type-level annotation (Garrette and Baldridge, 2013; Garrette et al., 2013), tokenlevel annotation (Daume III, 2007), and semisupervised approaches (Turian et al., 2010).2 We find little improvement from these methods and discuss why they fail to have a larger impact.
Overall, our results characterize the challenges of our fine-grained domain adaptation problem in online marketplace data. We believe that this new dataset provides a useful testbed for additional inquiry and investigation into modeling of finegrained domain differences.
2 Dataset and Annotation
We consider several forums that vary in the nature of products being traded:
• Darkode: Cybercriminal wares, including exploit kits, spam services, ransomware programs, and stealthy botnets.
• Hack Forums: A mixture of cyber-security and computer gaming blackhat and noncybercrime products.
• Blackhat: Blackhat Seach Engine Optimization techniques.
• Nulled: Data stealing tools and services.
Table 1 gives some statistics of these forums. Figure 1 shows two examples of posts from Darkode. In addition to aspects of the annotation, which we will discuss shortly, we see that
2Of course, these techniques can also be combined in a single system (Kshirsagar et al., 2015).
0-initiator4856 TITLE: [ buy ] Backconnect bot BODY: Looking for a solid backconnect bot .
If you know of anyone who codes them please let me know
0-initiator6830 TITLE: Coder BODY: Need sombody too mod DCIBot for me add the
following : Update Cmd Autorun Obfuscator ( each autorun diffrent & fud ) Startup Mod ( needs too work on W7/VISTA ) Pm .
Figure 1: Example post and annotations from Darkode, with one sentence per line. Annotated product tokens are underlined. The first example is quite short and straightforward. The second exhibits our annotations of both the core product (mod DCIBot) and the method for obtaining that product (sombody).
the text exhibits common features of web text: abbreviations, ungrammaticality, spelling errors, and visual formatting, particularly in thread titles. Additionally, note how some words are present that might be products in other contexts, but are not here (e.g., obfuscator).
2.1 Annotation Process
We developed our annotation guidelines through six preliminary rounds of annotation, covering 560 posts. Each round was followed by discussion and resolution of every post with disagreements. We benefited from members of our team who brought extensive domain expertise to the task. As well as refining the annotation guidelines, the development process trained annotators who were not security experts. The data annotated during this process is not included in Table 1.
Once we had defined the annotation standard,
3
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
we annotated datasets from Darkode, Hack Forums, Blackhat, and Nulled as described in Table 1.3 Every post in the Darkode training, Hack Forums training, Blackhat test, and Nulled test sets was annotated by three people; these annotations were then merged into a final annotation based on majority vote. The development and test sets for Darkode and Hack Forums were annotated by addition team members (five for Darkode, one for Hack Forums), and then every disagreement was discussed and resolved to produce a final annotation. The annotation was performed entirely by the authors, who are researchers in either NLP or computer security.
We preprocessed the data using the tokenizer and sentence-splitter from the Stanford CoreNLP toolkit (Manning et al., 2014). Note that many sentences in the data are already delimited by line breaks, making the sentence-splitting task slightly easier. We performed annotation on the tokenized data so that annotations would be consistent with surrounding punctuation and hyphenated words.
Our full annotation guide will be available in supplementary material. Our basic annotation principle is to annotate tokens when they are either the product that will be delivered or are an integral part of the method leading to the delivery of that product. For example, in Figure 1, the fragment mod DCIBot is the core product, but coder is annotated as well, since this person is inextricably linked to the service being provided: the post seeks someone to perform the task. However, the Backconnect bot example is a more straightforward transaction (the human agent is less integral), so only the product is annotated. Verbs may also be annotated, as in the case of hack an account: here hack is the method and the deliverable is the account, so both are annotated.
When the product is a multiword expression (e.g., Backconnect bot), it is almost exclusively a noun phrase, in which case we annotate the head word of the noun phrase (bot). Annotating single tokens instead of spans meant that we avoided having to agree on an exact parse of each post, since even the boundaries of base noun phrases can be quite difficult to agree on in ungrammatical text.
If multiple different products are being bought/sold, we annotate them all. We do not annotate:
3Not pictured is the fact that we annotated small numbers of Darkode training, Hack Forums training, and Blackhat test posts with all annotators in order to simply check agreement.
• Features of products, e.g., Update Cmd in Figure 1.
• Generic product references, e.g., this, them. • Product mentions inside “vouches” (reviews
from other users).
• Product mentions outside of the first and last 10 lines of each post.4
Table 1 shows interannotator agreement according to our annotation scheme. We use the Fleiss’ Kappa measurement (Fleiss, 1971), treating our task as a token-level annotation where every token is annotated as either a product or not. We chose this measure as we are interested in agreement between more than two annotators (ruling out Cohen’s kappa), have a binary assignment (ruling out correlation coefficients) and have datasets large enough that the biases Krippendorff’s Alpha addresses are not a concern. The values indicate reasonable agreement.
2.2 Discussion
Because we annotate entities in a context-sensitive way (i.e., only annotating those in product context), our task resembles a post-level information extraction task. The product information in a post can be thought of as a list-valued slot to be filled in the style of TAC KBP (Surdeanu, 2013; Surdeanu and Ji, 2014), with the token-level annotations constituting provenance information. However, we chose to anchor the task fully at the token level to simplify the annotation task: at the post level, we would have to decide whether two distinct product mentions were actually distinct products or not, which requires heavier domain knowledge. Our approach also resembles the fully token-level annotations of entity and event information in the ACE dataset (NIST, 2005).
3 Evaluation Metrics
In light of the various views on this task and its different requirements for different potential applications, we describe and motivate a few distinct evaluation metrics below. The choice of metric will impact system design, as we discuss in the following sections.
4In preliminary annotation we found that content in the middle of the post typically described features or gave instructions, without explicitly mentioning the product. Most posts are unaffected by this rule (96% of Darkode, 77% of Hack Forums, 84% of Blackhat, and 93% of Nulled), but it still substantially reduced annotator effort because the posts it does affect are quite long – 61 lines on average.
4
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
Token-level accuracy We can follow the approach used in token-level tasks like NER and compute precision, recall, and F1 over the set of tokens labeled as products. This most closely mimics our annotation process.
Type-level product extraction (per post) For many applications, the primary goal of the extraction task is more in line with KBP-style slot filling, where we care about the set of products extracted from a particular post. Without a domain-specific lexicon containing full synsets of products we care about (e.g., something that could recognize the synonymity of hack and access), it is difficult to evaluate this in a fully satisfying way. However, we can approximate this evaluation by comparing the set of (lowercased, stemmed) product types in a post with the set of product types predicted by the system. Again, we can consider precision, recall, and F1 over these two sets. This metric favors systems that consistently make correct postlevel predictions even if they do not retrieve every token-level occurrence of the product.
Post-level accuracy Our type-level extraction will naturally be a conservative estimate of performance simply because there may seem to be multiple “products” that are actually just different ways of referring to one core product. Roughly 60% of posts in the two forums contain multiple annotated tokens that are distinct beyond stemming and lowercasing. However, we analyzed 100 of these multiple product posts across Darkode and Hack Forums, and found that only 6 of them were actually selling multiple products, indicating that posts selling multiple types of products are actually quite rare (roughly 3% of cases overall). In the rest of the cases, the variations were due to slightly different ways of describing the same product.
In light of this, we also might consider asking the system to extract some product reference from the post, rather than all of them. Specifically, we compute accuracy on a post-level by checking whether a single product type extracted by the system is contained in the annotated set of product types. Because most posts feature one product, this metric is sufficient to evaluate whether we understood what the core product of the post was.
3.1 Phrase-level Evaluation
Another axis of variation in metrics comes from whether we consider token-level or phrase-level outputs. As noted in the previous section, we did
not annotate noun phrases, but we may actually be interested in identifying them. In Figure 1, for example, extracting Backconnect bot is more useful than extracting bot in isolation, since bot is a less specific characterization of the product.
We can convert our token-level annotations to phrase-level annotations by projecting our annotations to the noun phrase level based on the output of an automatic parser. We used the parser of Chen and Manning (2014) to parse all sentences of each post. For each annotated token that was given a nominal tag (N*), we projected that token to the largest NP containing it of length less than or equal to 7; most product NPs are shorter than this, and when the parser predicts a longer NP, our analysis found that it typically reflects a mistake. In Figure 1, the entire noun phrase Backconnect bot would be labeled as a product. For products realized as verbs (e.g., hack), we leave the annotation as the single token.
Throughout the rest of this work, we will evaluate sometimes at the token-level and sometimes at the NP-level5 (including for the product type evaluation and post-level accuracy); we will specify which evaluation is used where.
4 Models
We consider several simple baselines for product extraction as well as two learning-based methods.
Baselines A simple frequency baseline is to take the most frequent noun or verb in a post and classify all occurrences of that word type as products. A more sophisticated lexical baseline is based on a product dictionary extracted from our training data: we tag the most frequent noun or verb in a post that also appears in this dictionary. This method fails primarily in that it prefers to extract common words like account and website even when they do not occur as products. Finally, we can tag the first noun phrase of the post as a product, which will often capture the product if it is mentioned in the title of the post.6
Binary classifier One learning-based approach to this task is to employ a binary SVM classifier
5Where NP-level means “noun phrases and verbs” as described in Section 3.1.
6Since this baseline fundamentally relies on noun phrases, we only evaluate it in the noun phrase setting.
5
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
for each token in isolation.7 Our features look at both the token under consideration as well as neighboring tokens, as described in the next paragraph. A vector of “base features” is extracted for each of these target tokens: these include 1) sentence position in the document and word position in the current sentence as bucketed indices; 2) word identity (for common words), POS tag, and dependency relation to parent for each word in a window of size 3 surrounding the current word; 3) character 3-grams of the current word. The same base feature set is used for every token.
Our token-classifying SVM extracts base features on the token under consideration as well as its syntactic parent. Before inclusion in the final classifier, these features are conjoined with an indicator of their source (i.e., the current token or the parent token). Our NP-classifying SVM extracts base features on first, last, head, and syntactic parent tokens of the noun phrase, again with each feature conjoined with its token source.
We weight false positives and false negatives differently to adjust the precision/recall curve (tuned on development data for each forum), and we also empirically found better performance by upweighting the contribution to the objective of singleton products (product types that occur only once in the training set).
Post-level classifier As discussed in Section 3, one metric we are interested in is whether we can find any occurrence of a product in a post. This task may be easier than the general tagging problem: for example, if we can effectively identify the product in the title of a post, then we do not need to identify additional references to that product in the body of the post. Therefore, we also consider a post-level model, which directly tries to select one token (or NP) out of a post as the most likely product. Structuring the prediction problem in this way naturally lets the model be more conservative in its extractions and simplifies the task, since highly ambiguous product mentions can be ignored if a clear product mention is present. Put another way, it supplies a form of prior knowledge that can be useful for the task, namely that each post has exactly one product.
Our post-level system is formulated as an instance of a latent SVM (Yu and Joachims, 2009). The output space is the set of all tokens (or noun
7This performs similarly to using a token-level CRF with a binary tagset.
phrases, in the NP case) in the post. The latent variable is the choice of token/NP to select, since there may be multiple annotated tokens. The features used on each token/NP are the same as in the token classifier.
We trained all of the learned models by subgradient descent on the primal form of the objective (Ratliff et al., 2007; Kummerfeld et al., 2015). We use AdaGrad (Duchi et al., 2011) to speed convergence in the presence of a large weight vector with heterogeneous feature types. All product extractors in this section are trained for 5 iterations with `1-regularization tuned on the development set.
4.1 Basic Results
Table 2 shows development set results on Darkode for each of the four systems for each metric described in Section 3. Our learning-based systems substantially outperform the baselines on the metrics they are optimized for. The post-level system underperforms the binary classifier on the token evaluation, but is superior at not only post-level accuracy but also product type F1. This lends credence to our hypothesis that picking one product suffices to characterize a large fraction of posts.
When evaluated on noun phrases, we see that the systems generally perform better, an unsurprising result given that this evaluation is more
6
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
System Eval data Darkode Hack Forums Blackhat Nulled Avg
P R F1 P R F1 P R F1 P R F1 F1 Trained on Darkode
Dictionary 57.3 54.3 55.8 44.8 40.8 42.7 42.5 39.0 40.7 57.3 43.9 49.7 47.2 Binary 75.4 79.8 77.6 49.2 49.7 49.5 57.5 59.1 58.3 56.9 64.1 60.3 61.4 Binary + Brown Clusters 76.8 79.4 78.1 52.1 49.1 50.6 58.5 60.9 59.7 60.5 63.2 61.8 62.6 Binary + Gazetteers 73.8 77.7 75.7 52.3 51.9 52.1 − − − − − − − Trained on Hack Forums Dictionary 57.7 44.4 50.2 51.4 51.9 51.7 45.6 44.8 45.2 53.8 43.4 48.1 48.8 Binary 68.9 58.4 63.2 58.3 62.6 60.4 60.8 56.3 58.5 76.4 66.8 71.2 63.3 Binary + Brown Clusters 69.5 57.2 62.7 59.2 64.1 61.6 60.9 57.4 59.1 78.1 65.9 71.5 63.7 Binary + Gazetters 65.1 64.6 64.8 59.5 60.4 60.0 − − − − − − −
Table 3: Test set results at the NP level in within-forum and cross-forum settings for a variety of different systems. Using either Brown clusters or gazetteers gives mixed results on cross-forum performance: none of the improvements are statistically significant with p < 0.05 according to a bootstrap resampling test. Gazetteers are unavailable for Blackhat and Nulled since we have no training data for those forums.
forgiving (token distinctions within noun phrases are erased). The post-level NP system achieves an F-score of roughly 80 on product type identification and post-level accuracy is around 90%. While there is room for improvement, this variant of the system is accurate enough to enable analysis of the entire Darkode forum with automatic annotation.
Throughout the rest of this work, we focus on NP-level evaluation and post-level NP accuracy.
5 Domain Adaptation
Table 2 only showed results for training and evaluating within the same forum (Darkode). However, we wish to apply our system to extract product occurrences from a wide variety of forums, so we are interested in how well the system will generalize to a new forum. Tables 3 and 4 show full results of several systems in within-forum and crossforum evaluation settings. Performance is severely degraded in the cross-forum setting compared to the within-forum setting, e.g., on NP-level F1, a Hack Forums-trained model is 14.4 F1 worse at the Darkode task than a Darkode-trained model (63.2 vs. 77.6). Differences in how the systems adapt between different forums will be explored more thoroughly in Section 5.4.
In the next few sections, we explore several possible methods for improving results in the crossforum settings and attempting to build a more domain-general system. These techniques generally reflect two possible hypotheses for the difficult cross-domain effects:
Hypothesis 1: Product inventories are the primary difference across domains; context-based features will transfer, but the main challenge is not being able to recognize unknown products.
Darkode Hack Forums Blackhat Nulled Trained on Darkode
Dict 62.5 43.3 48.3 61.6 Post 95.8 67.6 75.8 82.5 +Brown 92.7 69.8 75.8 86.0 +Gaz 93.7 71.3 − −
Trained on Hack Forums Dict 51.0 52.2 51.6 56.9 Post 84.3 80.8 80.6 83.7 +Brown †89.5 81.6 80.6 83.7 +Gaz 85.4 †85.2 − −
Table 4: Test set results at the whole-post level in within-forum and cross-forum settings for a variety of different systems. Here, Brown clusters and gazetteers may be slightly more impactful; daggers indicate statistically significant gains over the post-level system with p < 0.05 according to a bootstrap resampling test.
Hypothesis 2: Product inventories and stylistic conventions both differ across domains; we need to capture both to adapt models successfully.
5.1 Brown Clusters
To test Hypothesis 1, we investigate whether additional lexical information helps identify productlike words in new domains. A classic semisupervised technique for exploiting unlabeled target data is to fire features over word clusters or word vectors (Turian et al., 2010). These features should generalize well across domains that the clusters are formed on: if product nouns occur in similar contexts across domains and therefore wind up in the same cluster, then a model trained on domain-limited data should be able to learn that that cluster identity is indicative of products.
We form Brown clusters on our unlabeled data from both Darkode and Hack Forums (see Table 1
7
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
for sizes). We use Liang (2005)’s implementation to learn 50 clusters.8 Upon inspection, these clusters do indeed capture some of the semantics relevant to the problem: for example, the cluster 110 has as its most frequent members service, account, price, time, crypter, and server, many of which are product-associated nouns. We incorporate these as features into our model by characterizing each token with prefixes of the Brown cluster ID; we used prefixes of length 2, 4, and 6.
Tables 3 and 4 show the results of incorporating Brown cluster features into our trained models. Overall, these features lead almost uniformly to slight improvements on NP-level product F1. Results are more mixed on post-level accuracy, and overall, only one result improves significantly. This indicates that Brown clusters might be a useful feature, but do not solve the domain adaptation problem in this context.9
5.2 Type-level Annotation
Another approach following Hypothesis 1 is to use small amounts of supervised data, One cheap approach for annotating data in a new domain is to exploit type-level annotation (Garrette and Baldridge, 2013; Garrette et al., 2013). Our tokenlevel annotation standard is relatively complex and time-consuming, but a researcher could quite easily provide a few exemplar products for a new forum based on just a few minutes of reading posts and analyzing the forum.
Given the data that we’ve already annotated, we can simulate this process by iterating through our labeled data and collecting annotated product names that are sufficiently common. Specifically, we take all (lowercased, stemmed) product tokens and keep those occurring at least 4 times in the training dataset (recall that these datasets are ≈ 700 posts). This gives us a list of 121 products in Darkode and 105 products in Hack Forums.
To incorporate this information into our system, we add a new feature on each token indicating whether or not it occurs in the gazetteer. At training time, we scrape the gazetteer from the training set. At test time, we use the gazetteer from
8The number of clusters was selected based on experimentation with our various development sets.
9Vector representations of words are also possible here; however, our initial experiments with these did not show better gains than with using Brown clusters. That is consistent with the results of Turian et al. (2010) who showed similar performance between Brown clusters and word vectors for chunking and NER.
N P-
le ve
l F 1
30
40
50
60
70
80
Number of labeled posts in target domain
0 40 80 120 160
HF → D HF → D +feats D → HF D → HF +feats
Figure 2: Token-supervised domain adaptation results for two settings. As our system is trained on an increasing amount of target-domain data (xaxis), its performance generally improves. However, adaptation from Hack Forums to Darkode is much more effective than the other way around, and using domain features as in Daume III (2007) gives little benefit over naı̈ve use of the new data.
the target test domain as a form of partial typelevel supervision. Tables 3 and 4 shows the results of incorporating the gazetteer into the system. In aggregate, gazetteers appear to provide a slight gain over the baseline system, like Brown clusters, though many of these individual improvements are not statistically significant.
5.3 Token-level Annotation
We now turn our attention to methods that might address Hypothesis 2. If we assume the domain transfer problem is more complex, we really want to leverage labeled data in the target domain rather than attempting to transfer features based only on type-level information. Specifically, we are interested in cases where a relatively small number of labeled posts (less than 100) might provide substantial benefit to the adaptation; a researcher could plausibly do this annotation in a few hours.
We consider two ways of exploiting labeled target-domain data. The first is to simply take these posts as additional training data. The second is to also employ the “frustratingly easy” domain adaptation method of Daume III (2007). In this framework, each feature fired in our model is actually fired twice: one copy is domaingeneral and one is conjoined with the domain label (here, the name of the forum).10 In doing
10If we are training on data from k domains, this gives rise
8
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
System Test Darkode Hack Forums Blackhat Nulled
% OOV Rseen Roov % OOV Rseen Roov % OOV Rseen Roov % OOV Rseen Roov Binary (Darkode) 21 82 67 41 69 51 44 73 51 33 73 50 Binary (HF) 52 75 35 36 77 40 54 71 36 38 79 37
Table 5: Product token OOV rates on development sets (test set for Blackhat and Nulled) of various forums with respect to training on Darkode and Hack Forums. We also show the recall of an NP-level system on seen (Rseen) and OOV (Roov) tokens. Darkode seems to be more “general” than Hack Forums: the Darkode system generally has lower OOV rates and provides more consistent performance on OOV tokens than the Hack Forums system.
so, the model should gain some ability to separate domain-general from domain-specific feature values. For both training methods, we upweight the contribution of the target-domain posts in the objective by a factor of 5.
Figure 2 shows learning curves for both of these methods in two adaptation settings as we vary the amount of labeled target-domain data. The system trained on Hack Forums is able to make good use of labeled data from Darkode: having access to 20 labeled posts leads to gains of roughly 7 F1. Interestingly, the system trained on Darkode is not able to make good use of labeled data from Hack Forums, and the domain-specific features actually cause a substantial drop in performance until we have included a substantial amount of data from Hack Forums. This likely indicates we are overfitting the small Hack Forums training set with the domain-specific features.
5.4 Analysis
In order to understand the variable performance and shortcomings of the domain adaptation approaches we explored, it is useful to examine our two initial hypotheses and characterize the datasets a bit further. To do so, we break down system performance on products seen in the training set versus novel products. Because our systems depend on lexical and character n-gram features, we expect that they will do better at predicting products we have seen before.
Table 5 confirms this intuition: it shows product out-of-vocabulary rates in each of the four forums relative to training on both Darkode and Hack Forums, along with recall of a NP-level system on both previously seen and OOV products. As expected, performance is substantially higher on invocabulary products. Interestingly, OOV rates of a Darkode-trained system are generally lower, indicating that that forum has better all-around product
to up to k + 1 total versions of each feature.
coverage. A system trained on Darkode is therefore in some sense more domain-general than one trained on Hack Forums.
This would seem to confirm Hypothesis 1. Table 3 shows that the Hack Forums-trained system achieves a 20% error reduction on Hack Forums compared to a Darkode-trained system. In contrast, the Darkode-trained system obtains a 43% error reduction on Darkode relative to a Hack Forums-trained system. Darkode’s better product coverage helps explain why Section 5.3 showed better performance of adapting Hack Forums to Darkode than vice versa: augmenting Hack Forums data with a few posts from Darkode can give critical knowledge about new products, but this is less true if the forums are reversed. Duplicating features and adding parameters to the learner also has less of a clear benefit when adapting from Darkode, when the types of knowledge that need to be added are less concrete.
Note, however, that these results do not tell the full story. Table 5 reports recall values, but not all systems have the same precision/recall tradeoff: although they were tuned to balance precision and recall on their respective development sets, the Hack Forums-trained system is much more precision-oriented on Nulled than the Darkodetrained system. In fact, Table 3 shows that the Hack Forums-trained system actually performs better on Nulled. This indicates that there is some truth to Hypothesis 2: product coverage is not the only important factor determining performance.
6 Conclusion
We present a new dataset of posts from cybercrime marketplaces annotated with product references, a task which blends IE and NER. Learning-based methods degrade in performance when applied to new forums, and while we explore methods for fine-grained domain adaption in this data, effective methods for this task are still an open question.
9
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899

This paper presents a new dataset with annotations of products coming from online cybercrime forums. The paper is clear and well-written and the experiments are good. Every hypothesis is tested and compared to each other.  However, I do have some concerns about the paper:  1. The authors took the liberty to change the font size and the line spacing of the abstract, enabling them to have a longer abstract and to fit the content into the 8 pages requirement.  2. I don't think this paper fits the tagging, chunking, parsing area, as it is more an information extraction problem.  3. I have difficulties to see why some annotations such as sombody in Fig. 1 are related to a product.  4. The basic results are very basic indeed and - with all the tools available nowadays in NLP -, I am sure that it would have been possible to have more elaborate baselines without too much extra work.  5. Domain adaptation experiments corroborate what we already know about user-generated data where two forums on video games, e.g., may have different types of users (age, gender, etc.) leading to very different texts. So this does not give new highlights on this specific problem.


Anchor-Free Correlated Topic Modeling: Identifiability and Algorithm
In topic modeling, many algorithms that guarantee identifiability of the topics have been developed under the premise that there exist anchor words -i.e., words that only appear (with positive probability) in one topic. Follow-up work has resorted to three or higher-order statistics of the data corpus to relax the anchor word assumption. Reliable estimates of higher-order statistics are hard to obtain, however, and the identification of topics under those models hinges on uncorrelatedness of the topics, which can be unrealistic. This paper revisits topic modeling based on second-order moments, and proposes an anchor-free topic mining framework. The proposed approach guarantees the identification of the topics under a much milder condition compared to the anchor-word assumption, thereby exhibiting much better robustness in practice. The associated algorithm only involves one eigendecomposition and a few small linear programs. This makes it easy to implement and scale up to very large problem instances. Experiments using the TDT2 and Reuters-21578 corpus demonstrate that the proposed anchor-free approach exhibits very favorable performance (measured using coherence, similarity count, and clustering accuracy metrics) compared to the prior art.

This paper presents a provably correct method for identifying topics in documents that moves beyond the "anchor-free" assumption in existing work.
[update after author response]: the authors' explanation for decreasing accuracy as F increases makes perfect sense.  If it was in the paper that F is set equal to the number of classes, I missed it.  Please consider adding a sentence giving your explanation for the decrease, in any case.  I also appreciate the authors reporting the accuracy of a simple LDA baseline in the author response.  In general the author response addressed my major concerns. [END update after author response]  In general I think this paper is a strong contribution.  I discuss particular strengths and areas for improvement below.  Strengths:  The work gives a technique with novel provable guarantees.  It also provides an experimental evaluation of the approach.  Parts of the paper are brilliantly clear.  Figure 1 is extremely helpful for understanding the new power of the technique.  The math is succinct and clear.  Areas for Improvement:  Lines 209-218 introduce some questions about the novelty of the underlying approach, even if this paper's algorithm itself is novel.  The scalability of the technique is not great.  This is shown in both the empirical results (Fig 2) and also the complexity O(F^3.5).  However, this is not a fatal limitation.  The authors should be aware that F values in the several thousands often provide the best held-out likelihood in practice, for even moderate-sized corpora, especially when topic correlations are modeled.  The experiments could use some enhancements.  First, a vanilla LDA approach using Gibbs sampling is worth including as a simple baseline.  Second, there is a major unanswered question in how clustering accuracy (which in my view is the most important experimental metric, because it reflects best what users want out of a topic model) decreases with the number of topics.  Especially when the number of classes considered (for TDT2 at least) is larger than the number of topics, I do not understand why as F increases, classification accuracy goes from outstanding (0.98 accuracy for F=3, TDT2) to mediocre (0.74 for F=25).  The 0.98 is hard to understand by itself, when each document vector is only length 3 and you are performing a 30-way classification task.  Some explanation is necessary here.  Also, another approach that used the W vectors as feature vectors, and trained a supervised classifier on a small number of labeled documents, might yield more meaningful results.  This experimental detail was the primary reason I did not assign a higher score.  The background section could be reduced considerably in order to provide more space for experiments.  Minor:  The point about how normalization can increase noise should be clarified with an example, or more explanation.  The paper returns to this claim at multiple points in the paper but without reading [8] it is hard for me to understand why normalization amplifies noise.  Is this because documents with few supporting observations will receive equal weight in the model as those with more observations?  The phrase third or higher-order statistics (trigrams) is a little confusing, because the paper is talking about word co-occurrance within the same document, whereas trigrams refer to a more specific notion (three *consecutive* words)  Line 1 in Algorithm 1 says Epsilon = 1^TD^T whereas the text has Diag of that.  "the size of P does not grow with the size of the data if the vocabulary is fixed" -- only true if P is stored in a dense format, but normally wouldn't it be quite sparse?  I didn't understand what it meant for topics to be "uncorrelated" in the previous work, defining this more precisely would help  How many document classes were used from ModApte?  The paper characterizes its algorithm's complexity as F^3.5, but won't some steps, like line 2, depend on the number of non-zero entries of P?  Perhaps this is negligible with current eigen-decomposition code.  Two especially minor comments on first proof in the supplementary material.  It's confusing that you refer to Assumption 1 by two different names ("Assumption 1" and the "anchor-word" assumption).  I also think you should unpack the sentence: "Therefore, for non-negative matrices the equalities in (1.1) hold if and only if A is a permutation matrix."  Saying "because any non-negative square matrix with orthonormal columns must be a permutation matrix" instead of "therefore" might help.


Visual Dynamics: Probabilistic Future Frame Synthesis via Cross Convolutional Networks
We study the problem of synthesizing a number of likely future frames from a single input image. In contrast to traditional methods, which have tackled this problem in a deterministic or non-parametric way, we propose to model future frames in a probabilistic manner. Our probabilistic model makes it possible for us to sample and synthesize many possible future frames from a single input image. To synthesize realistic movement of objects, we propose a novel network structure, namely a Cross Convolutional Network; this network encodes image and motion information as feature maps and convolutional kernels, respectively. In experiments, our model performs well on synthetic data, such as 2D shapes and animated game sprites, as well as on real-world video frames. We also show that our model can be applied to visual analogy-making, and present an analysis of the learned network representations.

Paper proposes a model for synthesizing likely future frames form a single input image. The difference from the existing literature is that the paper proposes a probabilistic framework that allows sampling potentially a variety of future frames (from the conditional distribution). The model encodes images as feature maps and differential motion information as convolutional kernels. The two are then combined using proposed cross-convolution layer to produce final predictions. The conditional distribution of future frames is modeled using a conditional variational auto encoder and the predictions are made for the intensity changes (Eulerian motions) that are then combined with the original image to produce final predictions (as opposed to predicting raw pixels of the future image). The approach is illustrated on synthetic and more realistic datasets with promising results.
Overall the paper addresses an interesting problem and the formulation is also intriguing. However, lack of more through ablation studies makes it unclear which parts of the model are truly important. The baselines are also rather weak as only a very simple kNN approach is tested as the baseline. A more through evaluation would make the paper considerably stronger. Generally I actually liked the paper for its ideas and addressed problem, but would like to read authors rebuttal before finalizing the decision.  > References  Generally, references are adequate and well discussed. Activity forecasting is also related to the proposed problem, though, typically deals with individual agents and their trajectories as opposed to an image as a whole. I would suggest citing and discussing some of those works. A good overview is given in:  Social LSTM: Human Trajectory Prediction in Crowded Spaces A. Alahi, K. Goel, V. Ramanathan, A. Robicquet, L. Fei-Fei, S. Savarese CVPR, 2016  > Assumption  - An intrinsic assumption of the work, it appears, that predictions are made under assumption of effectively static camera (this appears to be the reason why camera motion is factored out in the experiments as a pre-processing step). I do not view this as a negative, but do think that stating this assumption more clearly earlier on would be helpful for the reader.  - It is unclear from either motivation or the description why latent variables, z, in Figure 2 (d) are really necessary. The direct motion prediction (Figure 2(b)) could also be done presumably probabilistically, where given an image I a conditional distribution over the difference image could be modeled. What is the presumptive benefit of introducing latent variables z? I would like authors to address this in the rebuttal.   > Typos  - Page 3, bottom line, “frame without almost no motion” -> “frame with almost no motion”    > Experiments  Overall the experiments are interesting and compelling. However, the only baseline is rather weak (10 nearest neighbors to the input image with random sampling among the 10). In the very least a non-parametric generative model should be considered as a baseline. In particular, consider taking features of the image f(I) and a difference image and forming a KDE (e.g., Gaussian kernel on every sample) from joint samples to model p(I,v). This KDE can then be trivially conditioned (gaussian mixture conditioned is still a gaussian mixture) to obtain p(v|I). This conditional KDE can then be sampled or evaluated. This is still simple, but my guess is that it will work better then NN baseline and is also more inline with the premise of the paper.


Learning a Probabilistic Latent Space of Object Shapes via 3D Generative-Adversarial Modeling
We study the problem of 3D object generation. We propose a novel framework, namely 3D Generative Adversarial Network (3D-GAN), which generates 3D objects from a probabilistic space by leveraging recent advances in volumetric convolutional networks and generative adversarial nets. The benefits of our model are three-fold: first, the use of an adversarial criterion, instead of traditional heuristic criteria, enables the generator to capture object structure implicitly and to synthesize high-quality 3D objects; second, the generator establishes a mapping from a low-dimensional probabilistic space to the space of 3D objects, so that we can sample objects without a reference image or CAD models, and explore the 3D object manifold; third, the adversarial discriminator provides a powerful 3D shape descriptor which, learned without supervision, has wide applications in 3D object recognition. Experiments demonstrate that our method generates high-quality 3D objects, and our unsupervisedly learned features achieve impressive performance on 3D object recognition, comparable with those of supervised learning methods.

This paper proposes to combine Generative Adversarial Network with Volumetric Convolutional Network to perform 3D shape generation. The combined network, called VAN,  learns a latent representation for the objects, which is also used to generate shape. In the experiment section, the shape generation pipeline performs reasonably well and produces very convincing results. The experiment also shows that the latent representation z is semantically meaningful.
I think this paper presents an straightforward way to generate 3D objects. The idea of training a Generative Adversarial Network combined with a Volumetric Network to generate 3D shape is definitely novel. Furthermore, incriminating an image encoder to VAN in order to output the latent representation vector z from an image is interesting. The experiments are extensive and well-designed, and prove the effectiveness of the method.    However, it gives me the impression that the method proposed is a  combination of existing methods but applied to a novel problem setup, so the novelty is limited.    Here are my concerns:   1. The paper argues that the shape generated by VAN is similar but not identical to the nearest neighbor retrieved from the training set. It’s very hard to judge the similarity by just looking at Figure 2., and thus not very convincing. They looks kind of the same to me. Can you provide any quantitative evaluation?  2.It’s not clear what exactly you did with the output feature from the second to last layer in Section 4.3.Do you use these features to retrain a classifier to perform classification?   3.What is the intuition behind the loss function of VAE-VAN in Equation (2) ? How do you train the VAE-VAN? Is the training procedure the same as training the VAN?  4.In section 4.3, the paper shows an experiment on reconstructing 3D from single images using VAE-VAN. Figure 4 shows a large variety of examples of furnitures taken at widely different angles. Does that mean the method is invariant to viewing angle? Does the images of the same object taken at different angles produce the same latent representation z, as well as the final shape?   5.The paper performs classification using the output of the second to last layer of the discriminator network as feature, and the results looks very promising. But given that the latent representation z is so meaningful as shown in section 5, have you tried to use z as a feature to do classification? I wonder what the result would be.  6.The output mesh grid looks very coarse, and I guess that’s because the low resolution you are using. In that sense, the network is actually learning some general mid-level structures of the shapes, like armpits or legs of a chair, just as it is demonstrated in your experiment. Have you tried a higher resolution? Does this method work on higher resolution, where there are more details? Can it still learn as well?    Overall, I think this is an interesting paper. Please address my concerns.


Unsupervised Feature Extraction by Time-Contrastive Learning and Nonlinear ICA
Nonlinear independent component analysis (ICA) provides an appealing framework for unsupervised feature learning, but the models proposed so far are not identifiable. Here, we first propose a new intuitive principle of unsupervised deep learning from time series which uses the nonstationary structure of the data. Our learning principle, time-contrastive learning (TCL), finds a representation which allows optimal discrimination of time segments (windows). Surprisingly, we show how TCL can be related to a nonlinear ICA model, when ICA is redefined to include temporal nonstationarities. In particular, we show that TCL combined with linear ICA estimates the nonlinear ICA model up to point-wise transformations of the sources, and this solution is unique -thus providing the first identifiability result for nonlinear ICA which is rigorous, constructive, as well as very general.

This paper proposes a new method for unsupervised learning of nonlinear features from non-stationary data. The features are tuned to be optimally discriminative between different time segments in the data. Interestingly, they show that this model can uniquely recover nonlinear independent components under certain conditions.
There has been a lot of progress taking the successes of supervised techniques and extending them to unsupervised domains by defining an interesting label to predict, and this paper continues this trend by highlighting the task of discriminating between time windows. Furthermore, I think the emphasis on the importance of identifiability for nonlinear ICA and showing how it is solved in this case is a timely contribution. However, these contributions were somewhat muted by other shortcomings of the approach which make me doubt the robustness and generality of the method.   1) Temporal "Artifacts", a systematic deficiency in the setup In the MRI results, the authors use a single MLP across all data but a separate MLR for each subject and session to avoid learning "artifactual differences". This is a significant source of prior knowledge to include in the experiments and makes the comparisons unfair. In particular the comment that "none of the hidden units seem to represent artefacts, in contrast to ICA" rings a bit hollow since it seems that the elimination of artifacts was really achieved through hand-picked choice in the model.  The idea of trivial temporal artifacts that distinguish time periods is not, I think, an unlucky result of the MRI experimental setup either. I've noticed this occurring, e.g., in financial data where historical periods are trivially distinguished by the overall size of the market. If the method as described typically fails in the presence of these artifacts, I think its overall usefulness will be limited. The bright side is that putting in additional information about which types of temporal differences to learn really seems to help, so systematically exploring this effect could really strengthen the results.   2) Generality of the identifiability result unclear  As the authors point out, independent components suffer from a bad identifiability problem, so I was most intrigued by Theorem 1. However, I immediately began to wonder about the generality of the result. Does it rely on the assumption that the discriminator has "universal approximation capacity"? To me this seems like a large and poorly defined assumption.  Also in A1: "for simplicity we assume only a single function". The proof also assumes this, so it seems to be necessary for the proof? It seems like a large restriction, though it covers the non-stationary variance problem which seems to have been studied previously.  Extension 2 suggests that the extension is straightforward, but if this is true, why not include this proof in the supplementary material? To me, it looks significantly harder.   Minor point:  - In some cases, there might be a natural way to split up time windows, or you can simply split them finely enough that the stationarity holds within each window. I guess you need enough samples in each window to estimate the parameters of a totally new model. Is it easy to estimate exactly how many this should be?   edit: Thanks for the clarification about artifacts. I am still worried about it, but I think it is a general problem for unsupervised learning that could be addressed in future work. I.e., what if the best predictors of time slices are not good predictors for different tasks? Are there perhaps more systematic ways to force the method to learn interesting features (tying weights across subjects was certainly effective in this case)?


Can Active Memory Replace Attention?
Several mechanisms to focus attention of a neural network on selected parts of its input or memory have been used successfully in deep learning models in recent years. Attention has improved image classification, image captioning, speech recognition, generative models, and learning algorithmic tasks, but it had probably the largest impact on neural machine translation. Recently, similar improvements have been obtained using alternative mechanisms that do not focus on a single part of a memory but operate on all of it in parallel, in a uniform way. Such mechanism, which we call active memory, improved over attention in algorithmic tasks, image processing, and in generative modelling. So far, however, active memory has not improved over attention for most natural language processing tasks, in particular for machine translation. We analyze this shortcoming in this paper and propose an extended model of active memory that matches existing attention models on neural machine translation and generalizes better to longer sentences. We investigate this model and explain why previous active memory models did not succeed. Finally, we discuss when active memory brings most benefits and where attention can be a better choice.

This paper is built on the top of Neural GPU model by making changes to the decoder to handle sequence generation tasks like machine translation better. While the original Neural GPU model was applied for algorithmic tasks, author try to use this model for machine translation task. Results show that proposed active memory model is comparable to Attention model for NMT.
After Rebuttal:  I have read the rebuttal and I see that authors have addressed most of my concerns. I am changing my rating for impact from 2 to 3.  Before Rebuttal:  This paper proposes 2 extensions to Neural GPU model. Markovian Neural GPU is an obvious extension of Neural GPU for sequence generation. Extended Neural GPU is a non-trivial extension.  Firstly the claim (in abstract and everywhere) that active memory has not improved over attention for NLP tasks is wrong. Dynamic Memory Networks and End-to-end memory networks have been used for comprehension based question answering task. For machine translation, Meng et al., 2016 (http://arxiv.org/pdf/1506.06442v4.pdf) proposes a deep memory based architecture which is an active memory model and it does perform better than the attention based NMT model. In fact their model is very similar to Neural GPU, except for the fact that they use a different transformation instead of convolution.  Input structure as described in line 106-110 is not very clear. If I understand correctly, authors use w*n*m matrix as input where only w[0] is filled with n m-dimensional word vectors and w[k] for k > 0 are all set to 0? Also if number of words are less than n, then remaining part of the w[0] matrix are also set to 0? Please clarify.  From lines 39-41 I understand that authors consider NTM as a complex attention model than an active memory model? If so, I disagree with that point of view.   Experiments:  1. I understand that the authors want to compare their model with attention based model without beam search. But I do not understand the reason for choosing two attention models – one trained with sentences upto 64 tokens and another one with sentences upto 128 tokens. Why is Extended Neural GPU trained with sentences upto 64 tokens only? Specifically, the comparison is incomplete without the following rows:  a. Attention model trained with sentences upto 64 + beam search b. Attention model trained with sentence upto 128 tokens + greedy decoder. c. Neural GPU models trained with sentences upto 128 tokens. d. Meng et al., 2016  2. Authors should also highlight the limitations of the proposed model clearly. a. Is it not possible to train Neural GPU with 128 tokens? Or the results are worse? In either case, this is a limitation. b. Neural GPU models expect the output sentence size. In lines 203-208, authors say that they consider all sizes between input size and double of it and pick the result with smallest perplexity. This is very inefficient when compared to simple decoding done with LSTM decoder. c. I see that it is very difficult to do beam search with Neural GPU, because of the proposed complex decoder. This is another limitation.  3. Just based on Figure 6 (which is approximate), authors cannot make the claim that less sensitive to sentence length than the attention baseline. Because other 2 models where trained with UNK token and few other variations.  Overall, this paper proposes an interesting extension to Neural GPU, but the application is not very convincing. It is not very clear, what is the gain in using a complex architecture like this when compared to the simple attention model if the results are only comparable and not better. I would like to see a comparison with Meng et al., 2016 to see if this complex architecture really helps to improve the performance.


Deep Submodular Functions: Definitions & Learning
We propose and study a new class of submodular functions called deep submodular functions (DSFs). We define DSFs and situate them within the broader context of classes of submodular functions in relationship both to various matroid ranks and sums of concave composed with modular functions (SCMs). Notably, we find that DSFs constitute a strictly broader class than SCMs, thus motivating their use, but that they do not comprise all submodular functions. Interestingly, some DSFs can be seen as special cases of certain deep neural networks (DNNs), hence the name. Finally, we provide a method to learn DSFs in a max-margin framework, and offer preliminary results applying this both to synthetic and real-world data instances.

The papers introduces deep submodular functions which is a generalization of previous considered sums of concave over modular functions (SCM). SCM's are basically submodular functions obtained by summing over concave functions applied to the output of a sum of modular/linear functions.  Now the deep submodular functionsare sum of concave sum of concave ... on sum of modular functions. This seems like a natural generalization of SCMs.  The paper proves that deep submodular functions is a strictly bigger class than SCMs and a strict subset of submodular functions.   They also argue that these functions are easier to optimize than submodular functions in general. In particular, they consider the problem of learning a deep submodular function. These results are experimental  (and no real proofs).
The novelty in terms of techniques seems limited and the theory results not too surprising. I would say that the main contribution of the paper is the introduction of deep submodular functions. This is definitely a worthwhile conceptual contribution. But, as the paper contains limited indications of its usefulness, I rate this contribution as insufficient for NIPS.   I would also recommend that the authors are more careful in some of the writing. For example, in the first paragraph you say that submodular function maximization is one of the easiest NP-hard problems and then cite the result of Nemhauser's (1-1/e)-approximation. The best approximation for submodular function maximization is 1/2 and that is tight. Nemhauser result is in the monotone case and then it is trivial to maximize; his result is when you have a cardinality constraint.  Also, I would say that the rank function of the laminar matroid is a fairly simple submodular function.