Ensembles of models often yield improvements in system performance. These ensemble approaches have also been empirically shown to yield robust measures of uncertainty, and are capable of distinguishing between different forms of uncertainty. However, ensembles come at a computational and memory cost which may be prohibitive for many applications. There has been significant work done on the distillation of an ensemble into a single model. Such approaches decrease computational cost and allow a single model to achieve an accuracy comparable to that of an ensemble. However, information about the diversity of the ensemble, which can yield estimates of different forms of uncertainty, is lost. This work considers the novel task of Ensemble Distribution Distillation (EnD 2 ) -distilling the distribution of the predictions from an ensemble, rather than just the average prediction, into a single model. EnD 2 enables a single model to retain both the improved classification performance of ensemble distillation as well as information about the diversity of the ensemble, which is useful for uncertainty estimation. A solution for EnD 2 based on Prior Networks, a class of models which allow a single neural network to explicitly model a distribution over output distributions, is proposed in this work. The properties of EnD 2 are investigated on both an artificial dataset, and on the CIFAR-10, CIFAR-100 and TinyImageNet datasets, where it is shown that EnD 2 can approach the classification performance of an ensemble, and outperforms both standard DNNs and Ensemble Distillation on the tasks of misclassification and out-of-distribution input detection.

========= Post Rebuttal =========
I appreciate the authors' effort in addressing the raised issues. I think the revised paper has higher quality in that the additional ablation studies are very useful to understand the effectiveness of the method and the importance of the hyperparameters. It now also has higher clarity in that the presentation of the work is considerably more detailed in the last revision. The outstanding issue is that the final results are not consistent across datasets, baselines, and metrics which is concerning. But, I think, overall, the paper is pushing on an interesting line of research which is relevant and educational for ICLR audience. Th concerns on consistency and conclusiveness of the results can hopefully be addressed in a journal version of the work as suggested by the authors.
========= Summary =========

Distilling an ensemble of deep networks into a single student network is a common approach to reduce the inference-time computational complexity. In those cases, the paper poses the question of whether it is useful for the student to capture the diversity of ensemble members’ predictions on top of the mean distribution (as in the standard distillation).
The main motivation is that this captured diversity will enable the student network to decompose the total (predictive) uncertainty into data (aleatoric/irreducible) and knowledge (epistemic/model) uncertainty components.
In order to distill the diversity, it proposes to use “prior networks [Malinin&Gales 2018]” to output parameters of a  Dirichlet distribution over the simplex of possible predictive categorical distributions.
It uses one toy dataset as well as 3 small image classification datasets to compare the performance of the proposed method (EnD^2) with a) standard ensemble distillation (EnD), b) ensemble of deep networks, as well as c) an individual deep network. The performance is measured in terms of classification accuracy, and the quality of the predictive uncertainty for in-distribution (ID) and out-of-distribution (OOD) samples.
It shows that for OOD sample detection, the proposed EnD^2 outperforms the standard EnD and bridges the gap to the full ensemble. The classification accuracy and ID uncertainty quality is similar to the standard EnD.

========= Strengths and Weaknesses =========

+ the paper studies the interesting problem of decoupling data/knowledge uncertainty in the commonly-used framework of knowledge distillation. It proposes a simple solution to the problem. So, it is highly relevant for the field.
+ Results in Table 3 suggest significant improvements over the standard distillation (EnD).
+ Figure 3 is pedagogical and intuitive for the data vs knowledge uncertainty decomposition and the effectiveness of auxiliary dataset for this toy problem.

(I) General concerns:
- The technical novelty is limited to the combination of knowledge distillation and prior networks.
- Two closely-related works are not cited:
[Li&Hoiem, “Reducing Over-confident Errors outside the Known Distribution” 2019] uses auxiliary dataset for ensemble distillation.
[Englesson&Azizpour, “Efficient Evaluation-Time Uncertainty Estimation by Improved Distillation”, 2019] addresses the problem of efficient uncertainty estimation using knowledge distillation.

(II) Concerns regarding the experiments
- As also found curious by the authors, it is concerning that the EnD_Aux results are so low for OOD detection. Both [Li&Hoiem 2019] and [Englesson&Azizpour 2019] suggest that the standard distillation can perform similarly to (or even outperform) the individual model and the ensemble using an auxiliary dataset [Li&Hoiem 2019] or teacher label for augmented samples [Englesson&Azizpour 2019]. It should be mentioned that the OOD dataset setup is different across these works.
- Why only 100-ensembles are used for the real-world experiments? Does a “successful” training of the prior network require a large number of samples? This would be important since prior ensemble works (e.g. [Lakshminarayanan et al. 2017] ) hardly improve beyond 5-15 networks. Training 100 networks is very costly which would be an important limitation of this work in case it’s necessary. An ablation study on the number of networks in the ensemble is required for investigating this trade-off.
- Hyperparameter optimization: Appendix A provides the final values for the hyperparameters of each method. However, it is not clear how these were optimized? Was grid search used? What was the range for all the hyperparameters? Is there a validation set or cross validation is used and in each case how is the split done? Is it exactly the same hyper-parameter optimization that is done for EnD and EnD^2?

(III) Missing from experiments
- The main goal/motivation of the paper is to be able to decompose the total uncertainty when distilling an ensemble into a single model. In that respect, richer and more experiments are required to evaluate this ability. Currently, the experiments are focused on showing that EnD^2 outperforms EnD. The toy dataset, qualitatively, evaluates the decomposition quality with interesting results but is not enough to make conclusions for real-world datasets. For instance, as an additional experiment, plots/statistics can be given on data vs knowledge uncertainty for ID vs OOD samples.
- Prior network [Malinin&Gales 2018] in its standard form is an important single-network baseline that should be included for both ID and OOD experiments.
- Temperature scaling is mentioned to be a vital part of the model. As such, it requires a thorough ablation study to see the results with or without it as well as when changing the temperature and the annealing factor. It should be studied from two aspects: accuracy and convergence failure (as mentioned by the paper)
- P.7: “Prediction Rejection Ratio” (PRR) is a measure proposed in this work but it’s only defined in the appendix. That is the only metric that measures the quality of uncertainty for ID samples (Table 3). As such, I believe it’s important to define PRR in the main paper and also further include more standard metrics such as NLL, AUROC, AUPRcurve in table 3 so that some context is given to the newly-proposed PRR.
- Along the same line, it seems NLL is consistently and “more significantly” worse for EnD^2 compared to EnD.

(IV) Missing training and implementation details
- More details should be provided for the training of the student prior network including it’s loss function given a dataset and Dirichlet distribution. This can be obtained from [Malinin&Gales 2018] but it’s important for this work to be self-contained.
- the loss function in equation 8 has log(p(\pi|x;\theta)); is there any numerical issue regarding the Dirichlet distribution and/or the log? If so, how significant and what measures are accordingly taken? Could it be that the temperature scaling is more a way of alleviating these issues as opposed to the shared support of distributions for KL divergence?
- the details of the annealing algorithm is entirely missing.

========= Final Decision =========

The paper addresses a highly relevant problem in a simple (and potentially effective) way. This is great. However, there are several concerns as listed above which altogether makes me lean towards an initial “weak reject” rating. (II) and (III) are more central to this initial rating. I will carefully read the authors rebuttal as well as other reviewers’ comments before I finalize my rating.

========= Minor points =========

general:
- P.2: “[...] limitation of ensembles is that the computational cost of training and inference [...] One solution is to distill [...]“ -> this only remedies the computational complexity of inference and in fact increases the training time.
- P.3: [Malinin&Gales 2018] should be cited for equation 4 and the discussion around it.
- P.5: “Ensemble Distillation (EnD) is able to recover the classification performance [...] with only very minor degradation in performance”. Table 1 does not show any degradation for EnD. It shows some degradation for EnD^2 when 100-ensemble is used.
- P.7: “Note, that on C100 and TIM, EnD2 yields better classification performance than EnD”: almost all of the classification improvements are well within one-std. In the specific case of C100, it’s a stretch to call it a “better classification performance”.
- P.7: how many runs are used to obtain the mean and std reported in table 3 and 4.
- P.7: is the PRR in table 3 calculated using the total or knowledge uncertainty for ensemble and EnD2?
Typo:
- P.2: “. Consider an ensemble of models {P[…]” --> a closing parenthesis is missing.
- P.3: “Each of the models P([...]” --> a closing parenthesis is missing.
- P.3: “ the entropy of the expected and“ -> “the entropy of the expectation”
- P.4: “=\hat{p}(x,\pi)” → “\sim\hat{p}(x,\pi)”
- P3-4.: hat and star seem to have been arbitrarily used for input x, parameters theta, pi and p with most of them undefined.
- P.5: script MI is used for mutual information while in P.4 script I is used.
- P.6: “may require the use additional training” -> use of additional
- P.6: Results of EnD in table 2 does not match table 1.


We present a deep reinforcement learning approach to minimizing the execution cost of neural network computation graphs in an optimizing compiler. Unlike earlier learning-based works that require training the optimizer on the same graph to be optimized, we propose a learning approach that trains an optimizer offline and then generalizes to previously unseen graphs without further training. This allows our approach to produce high-quality execution decisions on real-world TensorFlow graphs in seconds instead of hours. We consider two optimization tasks for computation graphs: minimizing running time and peak memory usage. In comparison to an extensive set of baselines, our approach achieves significant improvements over classical and other learning-based methods on these two tasks.

Summary
This paper proposes an ML-based method to optimize TensorFlow Graph execution. Specifically, it combines graph neural networks (GNNs) and BRKGA (a genetic algorithm) to search over the joint space of TF node-device placement and scheduling. The core claims on the advantages of this method are that (1) it co-searches placement and scheduling space, (2) the trained model can generalize to different graphs and inference cost is very  small. The experimental results show that REGEL can outperform a few baseline methods on this problem.
Writing
- The paper is well-written and I enjoyed reading the paper.
- Some more descriptions about the BRKGA algorithm could be added in.
Method and Results
Some confusion if the authors could answer:
- I am very confused by one of the claims that “ the first work on learning a policy for jointly optimizing placement and scheduling”. I don’t see much evidence in the result section about showing the co-searching the joint space yield advantages? I am fairly familiar with the line of work on only optimizing device placement, but it would be good to see some ablation studies showing search over the joint space is advantageous.
- The model is trained with standard REINFORCE -- how many training time and resources are needed to train a REGEL model for a task? How’re the training dynamics looking like (variance, convergence, etc?)?
- In terms of the generalization ability of REGEL, the paper has clearly shown that REGEL is able to generalize to differently shaped graphs, with acceptable cost, but I am wondering for the same dataflow graph, how REGEL generalizes to different input data configurations (size, modality, etc.)? E.g. if the batch size of the input data is changed, the execution time of each kernel and their memory usage (in general, the system treatment) would change; Can a trained REGEL model on a data config A generalize to B? How would this affect the performance of REGEL?
- It seems the method and assumptions about graphs or training data are pretty coupled with TensorFlow and graph-mode execution, how could the method be generalized to other ML frameworks (e.g. frameworks with eager execution)
- Could the authors clarify why the two methods mentioned in “Learning to directly predict a solution” has quadratic complexity w.r.t. # of nodes and whereas REGEL is linear?
- Confusion on Figure 4(b): Could some more critical statistics about the graphs in the training/test dataset be reported? e.g. what’s the average depth of the training graphs? When there are 32 MP layers a node’s feature will be passed across its 32-hop neighborhood, which seems surprising as it is common to observe GNN starts degenerating with increased depth (because all node features become similar during message passing)


Word embedding is an essential building block for deep learning methods for natural language processing. Although word embedding has been extensively studied over the years, the problem of how to effectively embed numerals, a special subset of words, is still underexplored. Existing word embedding methods do not learn numeral embeddings well because there are an infinite number of numerals and their individual appearances in training corpora are highly scarce. In this paper, we propose two novel numeral embedding methods that can handle the out-ofvocabulary (OOV) problem for numerals. We first induce a finite set of prototype numerals using either a self-organizing map or a Gaussian mixture model. We then represent the embedding of a numeral as a weighted average of the prototype number embeddings. Numeral embeddings represented in this manner can be plugged into existing word embedding learning approaches such as skip-gram for training. We evaluated our methods and showed its effectiveness on four intrinsic and extrinsic tasks: word similarity, embedding numeracy, numeral prediction, and sequence labeling.

The paper proposes a novel method for embedding numerals which can be learned by using neural word embedding learning techniques. The paper motivates the work by reviewing the difficulty of embedding components to represent numerals: OOV in most cases. Their main contribution is the introduction of a method composes numeral embedding by a weighted average of prototype embeddings based on the similarities between the numeral and prototypes. There are two proposed prototypes: SOM and GMM and the similarity functions are an absolute difference and the density function respectively. During the training, the numerals have the proposed embeddings while the others have normal word embeddings. The paper slightly modifies the negative sampling to ensure numerals being sampled. A series of 4 empirical studies have been presented. First, the paper confirms that the proposed method does not negatively affect non-numeral embeddings. And then, the quality of the numeral embeddings are evaluated and compared. The experiments show that the proposed method has better performance on numerical property tests, numeral prediction, and a sequence labeling task.
Overall, this paper has a novel contribution. The proposed method is well motivated and quite justified by the experiments abliet lacking comparison with previous published results. However, it has some weaknesses.
For the method part, one of the limitations is that it is not an end-to-end method and requires a regular expression to identify the numeral. Second, the weighted average of the prototypes is reasonable, but the similarity function only relies on the magnitude. I think there are other aspects of numerical tokens that it might not be able to capture (e.g. “2019” is similar to “19” in some context). In terms of training, I think it is not hard to extend the method to full language model training (using softmax). However, adding all numerals to the vocabulary would add significant overhead.
For the experiments, some design decisions are left unjustified. For example, a simple ablation experiment on the squashing function will be helpful. Furthermore, guidelines or empirical results on the effect of the number of prototypes can increase the impact of the paper. Finally, I think an analysis of the performance of numerical types will be helpful for future works (e.g., dates, phone numbers, currencies, etc, or discrete vs continuous).
Minor comments and questions:
1. The log sigmoid in equation 6 is a bit strange, isn’t it log sum exp(). https://arxiv.org/pdf/1402.3722v1.pdf
2. Why do you create a new dataset for the experiment in section 4.3?
3. In section 4.4, you rank only numerals in the test set, but the scores are computed based on all numerals in the vocab. Do you have the performance of ranking all numerals?
4. Just to confirm the “training” in section 4.4 refers to learning the embedding using the skip-gram model, right?


We explore the role of multiplicative interaction as a unifying framework to describe a range of classical and modern neural network architectural motifs, such as gating, attention layers, hypernetworks, and dynamic convolutions amongst others. Multiplicative interaction layers as primitive operations have a long-established presence in the literature, though this often not emphasized and thus under-appreciated. We begin by showing that such layers strictly enrich the representable function classes of neural networks. We conjecture that multiplicative interactions offer a particularly powerful inductive bias when fusing multiple streams of information or when conditional computation is required. We therefore argue that they should be considered in many situation where multiple compute or information paths need to be combined, in place of the simple and oft-used concatenation operation. Finally, we back up our claims and demonstrate the potential of multiplicative interactions by applying them in large-scale complex RL and sequence modelling tasks, where their use allows us to deliver state-of-the-art results, and thereby provides new evidence in support of multiplicative interactions playing a more prominent role when designing new neural network architectures.

The paper explores different types of multiplicative interactions. This allows understanding of both efficacy of multiplicative interaction (i.e., MI vs MLP), and the common between multiplicative-type models (e.g., hypernetworks, FiLM, gating,  attention etc). The authors also find MI models able to achieve a state-of-the-art performance on language modeling (WikiText-103) and reinforcement learning problems(DMLAB-30), along with several toy examples.
Strengths:
*The discussed MI subject is important research area, the paper presents the vast related work, proven by the fact MI techniques appears in many recent models.
* The authors  did comprehensive evaluation to show importance and usefulness of multiplicative interactions. A  toy regression experiment to show superiority of MI vs MLP . A Reinforcement learning task, i.e DMLAB-30 on par with the state-of-the-art model, but with simple model (i.e., less parameters). A sequence prediction with an alternative embedding technique that improves both accuracy and number of needed parameters.
* The paper is of high quality: well organized, clear, with good supporting figures.
Weaknesses:
* I suggest a better explanation how the suggested models compare to state-of-the-art models.  Currently, it is hard to assess the impact. For instance, proposed model alternate existing baselines, such as PopArt, or is completely novel?
* Although mentioned, it's not the focus of this work, the paper should have discussed attention models more.  Specifically recent years multimodal attention relied on multiplicative interactions. Therefore, at least in this domain multiplicative interactions are not "under-appreciated". Relevant papers: [1, 2, 3, 4] - advancement of multiplicative interactions over the years, [5] - introduce co-attention, [6] - introduce higher-order interactions (between three vectors), [7] - introduce bilinear attention .
To conclude, multiplicative interactions are extremely important, and I find the paper exploration useful. In addition,  the paper is of high quality, and with satisfied experiments to prove their claims. I do suggest a better discussion about multimodal attention networks, which are relevant examples.
[1] - Ask, Attend and Answer: Exploring Question-Guided Spatial Attention for Visual Question Answering; Xu et al.
[2] - Multimodal Compact Bilinear Pooling for Visual Question Answering and Visual Grounding; Fukui et al.
[3] - Hadamard Product for Low-rank Bilinear Pooling; Kim et al.
[4] - Multi-modal Factorized Bilinear Pooling with Co-Attention Learning for Visual Question Answering; Yu et al.
[5] - Hierarchical Question-Image Co-Attention for Visual Question Answering; Lu et al.
[6] - High-Order Attention Models for Visual Question Answering; Schwartz et al.
[7]  - Bilinear Attention Networks; Kim et al.


Many large text collections exhibit graph structures, either inherent to the content itself or encoded in the metadata of the individual documents. Example graphs extracted from document collections are co-author networks, citation networks, or named-entity-cooccurrence networks. Furthermore, social networks can be extracted from email corpora, tweets, or social media. When it comes to visualising these large corpora, either the textual content or the network graph are used. In this paper, we propose to incorporate both, text and graph, to not only visualise the semantic information encoded in the documents' content but also the relationships expressed by the inherent network structure. To this end, we introduce a novel algorithm based on multi-objective optimisation to jointly position embedded documents and graph nodes in a two-dimensional landscape. We illustrate the effectiveness of our approach with real-world datasets and show that we can capture the semantics of large document collections better than other visualisations based on either the content or the network information.

Authors introduce a novel algorithm based on multi-objective optimization to jointly position embedded documents and graph nodes in a 2-d landscape.
First, the multi-objective optimization used in this paper is quite confusing. Since the overall error defined in (5) is a weighted summation of three objectives, it is not a real multi-objective optimization where multiple objectives are optimized simultaneously.
Authors define a hypergraph to jointly model documents and entities. However, there lacks the novelty on the objectives defined in this paper. The optimization using gradient descent is also trivial.
It is hard to understand why equations (2) and (3) share the same objectives but the two sets of samples have totally different meanings. Moreover, both objectives are summed uniformly as shown in the experimental setting. Please explain it in details.
For the quantitative evaluation, Table 1 shows the percentage of papers for each community per cluster. There are many numbers for a single clustering problem. It might be preferred to use a single measurement such as normalized mutual information or accuracy for clustering evaluation. In this way, it is easy to judge the compared methods.


Few-shot classification may involve differentiating data that belongs to a different level of labels granularity. Compounded by the fact that the number of available labeled examples are scarce in the novel classification set, relying solely on the loss function to implicitly guide the classifier to separate data based on its label might not be enough; few-shot classifier needs to be very biased to perform well. In this paper, we propose a model that incorporates a simple inductive bias: focusing on differences by building a dissimilar set of class representations. The model treats a class representation as a vector and removes its component that is shared among closely related class representatives. It does so through the combination of learned attention and vector orthogonalization. Our model works well on our newly introduced dataset − CIFAR-Hard − that contains different levels of labels granularity. It also substantially improved the performance on fine-grained classification dataset, CUB; whereas staying competitive on standard benchmarks such as mini-Imagenet, Omniglot, and few-shot dataset derived from CIFAR.

The stated contributions of the paper are: (1) a method for performing few-shot learning and (2) an approach for building harder few-shot learning datasets from existing datasets. The authors describe a model for creating a task-aware embedding for different novel sets (for different image classification settings) using a nonlinear self-attention-like mechanism applied to the centroid of the global embeddings for each class. The resulting embeddings are used per class with an additional attention layer applied on the embeddings from the other classes to identify closely-related classes and consider the part of the embedding orthogonal to the attention-weighted-average of these closely-related classes. They compare the accuracy of their model vs others in the 1-shot and 5-shot setting on various datasets, including a derived dataset from CIFAR which they call Hierarchical-CIFAR.
Overall, while we like the concepts/ideas and the problem is definitely important, we were not enthusiastic about the paper. First, we found the write up to be cryptic, involving very long unclear statements. It read as if the authors were writing for themselves and not for ICLR general audience. Beyond the writing style, we found the paper to have:
* Inadequate description of the model, including mathematical inaccuracies.
* Inadequate description of Hierarchical-CIFAR, motivation, and evaluation.
Description of model:
------------------------------
The manuscripts describe the presented approach as metric learning but make no use of a distance function in the different spaces they map to. Instead, the manuscript defines an inner product over embeddings to compute similarities.
The manuscript describe their “self-attention operation” as a dynamic set-to-set operation. While the usual definition of self-attention is permutation invariant, the definition presented here is not and thus cannot be accurately described as a mapping between sets. Specifically, in the usual presentation of self-attention the only sharing of information between different set elements is during the outer product of the key and query vectors. The use of a BLSTM between “neighboring elements” of the set of prototype vectors violates this assumption and induces a lack of permutation invariance. This makes the method sensitive to permutations of classes, which does not make sense for predicting unordered classes.
In sections 2.2.3 and 2.2.4 the material is presented twice but slightly differently. For example, the definition of $b_k$ inline before equation 3 differs from equation 6 later in the text.
Equation 7 is incorrect and should not exclude the current class from the denominator.
The description of how to classify new points after equation 6 is poorly explained. The description of what happens when $h_V$ is a “BLTSM” [sic (should be BLSTM)] is noninformative.
The manuscript describes two dimension sizes $H$ and $M$ but the definition of $attn$ requires that $H = M$.
Description of new dataset and evaluations:
------------------------------------------------------------
One of the stated contributions of the manuscript is a methodology to build harder few-shot learning datasets. Section 4.2 is the only place in the text that appears to address this point, but is unclear where either new finer-grained or coarser-grained labels are coming from (new manual annotation or otherwise). The manuscript “leave[s] out the detail of its construction for simplicity”, but it is unclear what is being done here in the first place.
The manuscript does not detail tuning competing methods on the new dataset and so it is unclear whether it is a fair comparison.
The manuscript presents evaluations without any discussion of differences in performance between datasets or the 1-shot/5-shot settings. For example, their method is significantly better on CUB on 1-shot but not so much on 5-shot, on the other hand it is not significantly better on 1-shot for H-CIFAR and CIFAR-HS but then becomes better than the rest with 5-shot.
Additional comments/corrections
---------------------------------------------
There were numerous typos and grammatical errors that were present in the manuscript that did not directly impact this evaluation but should be fixed in the future.


Long short-term memory (LSTM) networks allow to exhibit temporal dynamic behavior with feedback connections and seem a natural choice for learning sequences of 3D meshes. We introduce an approach for dynamic mesh representations as used for numerical simulations of car crashes. To bypass the complication of using 3D meshes, we transform the surface mesh sequences into spectral descriptors that efficiently encode the shape. A two branch LSTM based network architecture is chosen to learn the representations and dynamics of the crash during the simulation. The architecture is based on unsupervised video prediction by an LSTM without any convolutional layer. It uses an encoder LSTM to map an input sequence into a fixed length vector representation. On this representation one decoder LSTM performs the reconstruction of the input sequence, while the other decoder LSTM predicts the future behavior by receiving initial steps of the sequence as seed. The spatio-temporal error behavior of the model is analysed to study how well the model can extrapolate the learned spectral descriptors into the future, that is, how well it has learned to represent the underlying dynamical structural mechanics. Considering that only a few training examples are available, which is the typical case for numerical simulations, the network performs very well.

Summary.
Long short-term memory (LSTM) networks are trained to learn the underlying dynamics of 3D structures -- An encoder LSTM encodes a sequence of 3D mesh representations and two decoder LSTMs reconstruct the input itself and predict the future structural geometry. Such structural deformation sequences are collected from a simulation and used to train and evaluate the model.
Strengths.
1. Deep neural network architecture is applied to learn a 3D mesh structure deformation. Its approach looks reasonable to me -- (i) a high-level (user-specified) feature is extracted to represent 3D structural mesh, and (ii) LSTMs are trained in this feature space.
2. The paper shows that LSTM can learn the underlying dynamics of 3D structural deformation (but since it does not provide any comparison with other work, I cannot determine the prediction error is within a reasonable bound for this task).
Weaknesses.
1. Weak technical and theoretical novelty.
An existing LSTM-based seq-to-seq style architecture is simply chosen and applied to the 3D mesh reconstruction and prediction task. LSTM networks have been successfully applied to various tasks, thus it would be less impactful even if a paper shows LSTM works well in the specific task.
2. Missing comparison with existing work.
(As far as I know) the task of predicting 3D structure deformation has long been studied and various simulation and analysis tools have widely used in academia and industries. The paper, however, does not thoroughly compare or cite any prior work in this area. As a reader from a different area, I would like to see more thorough analysis to support (i) what are the main bottlenecks of the conventional approaches, (ii) how the proposed data-driven approach can help to address these issues, and (iii) how the proposed approach can further extend.
For example, the paper mentions (as the main reason to use the deep neural network) that “Since one simulation run takes a couple of hours on a compute cluster, running a large number of simulation is not feasible” (in the 1st paragraph of Introduction). Can the authors provide an analysis of flops (floating-point operations per second)?
3. Simulated data for training.
205 samples are collected from a simulation to train and validate the proposed model and half an hour has taken to train this model. Judging from the common practices, does this imply the underlying dynamics function (of a simulation) is trivial to learn?
Also, only two parts (i.e. the left and right structural beam) of the whole 3D structure are analyzed. This implies that relations between any other parts are not considered and only a sole part is individually analyzed.
Minor concerns.
- Typo (In Figure 1 caption, ‘undo’).
- “Due to the encoder having 1000 layers”?
- Labels are needed in Figures.


Attention operators have been applied on both 1-D data like texts and higher-order data such as images and videos. Use of attention operators on high-order data requires flattening of the spatial or spatial-temporal dimensions into a vector, which is assumed to follow a multivariate normal distribution. This not only incurs excessive requirements on computational resources, but also fails to preserve structures in data. In this work, we propose to avoid flattening by developing Kronecker attention operators (KAOs) that operate on high-order tensor data directly. KAOs lead to dramatic reductions in computational resources. Moreover, we analyze KAOs theoretically from a probabilistic perspective and point out that KAOs assume the data follow matrix-variate normal distributions. Experimental results show that KAOs reduce the amount of required computational resources by a factor of hundreds, with larger factors for higher-dimensional and higher-order data. Results also show that networks with KAOs outperform models without attention, while achieving competitive performance as those with original attention operators.

=== Summary ===
The authors propose the Kronecker Attention Operator (KAO), a novel efficient attention mechanism for high order data such as images (height H and width W dimensions). Regular self-attention on images produce HW queries attend to HW keys and their values, resulting in quadratic time/space complexity O((HW)^2).
In contrast, KAO applies self-attention after averaging keys, values (and potentially queries) along width or height dimension, resulting in (H+W) keys and values and thus achieving linear time/space complexity in O(HW).
The authors analyze their approach from a probabilistic perspective by assuming that the rows and columns follow matrix-variate normal distributions with Kronecker covariance.
Experimental results on ImageNet classification and PASCAL segmentation show that adding Kronecker Attention Operators to baseline architectures yields improvements with a negligible increase in parameters/computations.
=== Recommendation ===
Attention has been shown to provide improvements over convolutions but can indeed incur significant memory costs. Hence, discovering efficient attention mechanisms in an important research direction with practical impact.
The proposed method is sound and simple and may achieve significant speedups over regular self-attention.
However, there are many experimental presentation/evaluation issues in the draft:
- An important assumption of the method is that Kronecker factorization preserves structure well while reducing computations. Previous works reduce memory costs by pooling the input to the attention operator (and resizing accordingly the output). A natural baseline would be to pool in such a way that the number of queries is the same as when applying Kronecker factorization. Can the authors report results on such a baseline?
- Section 4.1 and Table 1 present computational efficiency (memory and latency) in simulated cases. Can the authors additionally report results for the gains obtained on the entire architectures? The rest of the architecture isn't an external factor to ignore.
- Can the authors also report memory consumption and latency time of KANet vs MobileNetv2?
- The authors ignore a vast literature on (self-)attention mechanisms used in vision, some of which are relatively cheap. These methods should also be cited as related work and potentially use as baselines (Squeeze-and-Excitation for example).
The probabilistic analysis does not convincingly motivate the Kronecker Attention Operator. Notably, the assumptions for Theorem 1 are also quite unrealistic for images (nearby pixels are correlated via locality, so rows and columns aren't independent). Can the authors clarify the assumptions and explain why they're reasonable?
In conclusion, the authors only compare their approach against regular self-attention and do not refer to relevant work on attention mechanisms for vision. They do not provide memory/consumption gains on actual architectures, which makes it hard to evaluate the significance of the work. The theoretical motivation for the method is not convincing. I argue for rejection.
=== Additional questions/comments ===
- Section 2.1: Self-attention is better described as Q = W^Q X, K = W^K X, V = W^V X, O = V softmax(K^TQ). As opposed to Q=K=V, O = W^V V softmax((W^KK)^TW^QQ)
- Since the base architecture KANet is MobileNetv2, there is no need to include VGG, AlexNet, SqueezeNet, in Table 2.


We propose negative sampling as an approach to improve the notoriously bad out-of-distribution likelihood estimates of Variational Autoencoder models. Our model pushes latent images of negative samples away from the prior. When the source of negative samples is an auxiliary dataset, such a model can vastly improve on baselines when evaluated on OOD detection tasks. Perhaps more surprisingly, we present a fully unsupervised version of employing negative sampling in VAEs: when the generator is trained in an adversarial manner, using the generator's own outputs as negative samples can also significantly improve the robustness of OOD likelihood estimates.

This paper discusses the detection of out-of-distribution (OOD) samples for variational autoencoders (VAE).
The idea is to train the encoder such that its output variational distribution q(z|\bar{x}) is pushed away from the prior of latent z.
I think the paper needs more clarification and investigation for being published in the conference.
My major concern is that more empirical investigation is necessary since the formulation provides a minor novelty.
Specific points are given below.
1) Weak novelty in terms of model design.
The objective function consists of the standard (negative) ELBO term and additional KL term to modify the variational posterior of negative samples.
This modification can be regarded as a form of outlier exposure (Hendrycks et al. 2018) specialized for VAE.
The choice of \bar{p} is not much investigated.
Any discussion if we use a more sophisticated model such as VampPrior* for stronger modeling capacity.
* J. Tomczak and M. Welling, VAE with a VampPrior, AISTATS 2018.
2) The use generated samples as negative samples is interesting but mysterious.
The authors conjecture that this works because the generated samples come from near the data manifold, but in-distribution samples and negative samples can be indistinguishable when the generative model is very well trained.
What happens if, for example, the negative samples are generated by data augmentation techniques (such as cropping, rotation, mirroring, though mirroring and much rotation may be unsuitable for text images)?
This can also produce near-manifold points.
A deeper analysis why generated samples can improve the OOD detection performance is necessary.
Furthermore, why does not this approach impact much for color images in Table 4?
3) More details of experimental procedures.
3-1) How was data points are generated from VAE as negative samples?
Possible ways are:
* sample z ~ p(z), then draw from the decoder x ~ p(x|z).
* use negative prior z ~ \bar{p}(z), then draw from the decoder x ~ p(x|z).
* this seems weird: use variational posterior z ~ q(z|x), then x ~ p(x|z).
3-2) Latent dimension of 10 for grayscale images seems small.
Does the size affect the OOD detection performance when the size is 50 or 100 to make the model richer.
3-3) How was the variance obtained when the decoder uses the Gaussian likelihood?
* fixed value?
* learned for each pixel?
* output from the decoder?
4) If we have access to diverse negative datasets, can the ODD detection perform better?
Mixing multiple datasets or using both available dataset and generated samples can improve the performance while the test OOD samples are kept unseen.
For example, train VAE on MNIST while using KMNIST and EMNIST as the negative sets to detect Fashion-MNIST as ODD.


Most unsupervised neural networks training methods concern generative models, deep clustering, pretraining or some form of representation learning. We rather deal in this work with unsupervised training of the final classification stage of a standard deep learning stack, with a focus on two types of methods: unsupervisedsupervised risk approximations and one-class models. We derive a new analytical solution for the former and identify and analyze its similarity with the latter. We apply and validate the proposed approach on multiple experimental conditions, in particular on four challenging recent Natural Language Processing tasks as well as on an anomaly detection task, where it improves over state-of-the-art models.

UPDATE:
I acknowledge that I’ve read the author responses as well as other reviews.
After reading, I would keep my rating at 3 (Weak Reject), since the key reasons for my rating still hold.
####################
This work makes a connection between recently introduced one-class neural networks [8, 4] and the unsupervised approximation of the binary classifier risk under the hinge loss [1]. An explicit expression of this risk approximation is derived for the case that the prior class probabilities are known and that the class-conditional distributions of classification scores are Gaussian. This solution is then used to formulate an end-to-end differentiable loss for unsupervised binary classification which is combined with a posterior class probability regularizer to avoid trivial solutions. Finally, the paper presents an experimental evaluation on synthetic data, the Wisconsin Breast Cancer dataset, four NLP tasks, as well as on the anomaly detection task on MNIST where the proposed method slightly outperforms the two existing one-class networks [8, 4].
I think this paper makes an interesting, original connection between unsupervised-supervised risk estimation and one-class neural networks which provides a principled motivation for existing methods [8, 4] and also hints to potential flaws in their formulations, namely that OC-NN [4] and soft-boundary Deep SVDD [8] make no use of positive samples during learning (as illustrated in Figure 2). The paper is not yet ready for acceptance in my opinion, however, due to the following key reasons:
(i) The experimental evaluation is not convincing and not sufficient to assess the significance of results;
(ii) Though making this connection is interesting, the theoretical derivations presented in the paper are rather straightforward.
(i) I think the experimental evaluation is the weakest part of the paper at the moment which I find not convincing due to the lack of competitors, the use of rather simple datasets, and missing experimental details. The synthetic experiment only serves as a sanity check not giving any additional insights. As the proposed unsupervised method approximates the risk of a supervised binary classifier, I agree that it makes sense to compare to the supervised “gold standard” on binary classification tasks (Wisconsin and NLP sentiment tasks) to infer the unsupervised-supervised performance gap. However, there is no comparison to other unsupervised competitors (OC-SVM, GMM, Deep SVDD, OC-NN, etc.) to put the performance of the proposed method in these experiments into perspective (only K-Means does not establish a strong baseline). Those classification tasks further are not really a convincing use case in my mind since labels here are usually available. In contrast, I find anomaly detection to be an important application of this method, but an evaluation solely on MNIST that also lacks recent deep competitors [6] is not sufficient to assess the significance of the presented results. Moreover, from the text it seems that only the hyperparameters of the proposed method are tuned on some validation set that includes positive as well as negative samples which would be an unfair advantage and might explain the slight edge in performance. Finally, many experimental details are not reported: (ia) Are the networks used randomly initialized or pretrained? (ib) How are prior class probabilities set? (ic) What are the batch sizes (relevant for quantile estimation) (id) What score are the hyperparameters tuned on? (ie) Are negative samples in the validation set from all the anomaly classes?
(ii) The technical derivations in the paper (and the appendix) are correct but rather straightforward. The theoretical heavy-lifting is from Balasubramanian et al. [1] and this paper presents an explicit solution for the risk approximation under the assumption that the prior class probabilities are known and the class-conditional score distributions are Gaussian. I do not want to discount that making this connection and loss derivation may lead to significant results (which is left to be demonstrated experimentally), but I find the current theoretical contribution on its own not sufficient. Parts of the theoretical Section 3 could also be greatly cut in my opinion (no need to define a quantile or sample mean and variance etc.). Finally, one key property of the loss expressed in the paper is its differentiability and use with autograd, but this does not hold after adding the posterior regularization term which is based on the empirical p0-quantile, correct? (the gradient of the quantile is zero almost everywhere due to the argmin)
Apart from the two key points above, the presentation of the paper is unpolished (nested lists in the main text, etc.) and major deep anomaly detection related work [10, 6, 5, 7, 3] is missing.
####################
*Additional Feedback*
*Positive Highlights*
1. The paper makes an interesting connection between unsupervised-supervised risk approximation [1] and recently introduced one-class neural networks [8, 4] that provides a principled motivation and points to potential flaws in existing formulations.
2. I think the question how to learn neural classifiers in an unsupervised manner is original and interesting.
3. The technical derivations in the paper are rigorous and correct.
*Ideas for Improvement*
4. Make a comparison to state-of-the-art unsupervised deep anomaly detection (AD) methods.
5. Run AD experiments on more complex datasets like Fashion-MNIST, CIFAR-10, and the recently introduced MVTec [2].
6. Include major deep AD works [10, 6, 5, 7, 3] into the related work.
7. Compress Sections 1–3 (fewer lists; no need to give definitions of a quantile, sample mean and variance; etc.)
8. Motivate the non-AD experiments. Currently these appear rather constructed artificially.
9. In the NLP tasks, make a comparison to text-specific one-class classifiers [9].
10. Add a sensitivity analysis w.r.t. the prior class probability p0 to infer robustness to this parameter that seems crucial.
11. Provide guidance how to select p0 in a particular application.
12. Consistently report performance metrics with standard deviations in your tables to allow to infer statistical
significance.
13. What to do if there are no negative, but only normal samples as in fully unsupervised AD? Nevertheless make an assumption on the class prior?
*Minor comments*
14. Unordered lists should be used sparsely in a main text, stylistically speaking. Avoid nesting as in the introduction.
15. Section 2.1, first sentence (and elsewhere): “Let be given ...” is grammatically wrong. Correct would be either “Let f be a binary linear classifier ...” or “Given a binary linear classifier f ...”.
16. In Section 2.1, index the classifier $f$ with parameter $\theta$, i.e. $f_\theta$. Otherwise the risk optimization parameter $\theta$ does not even appear on the right hand side of the risk Eq. (1).
17. Combine Eqs. (1) and (2) into one equation.
18. Consistently enumerate equations throughout the paper or do not enumerate at all.
19. In Eq. (3) index $i$ misses in the sum.
20. A subsection title following a section title directly is bad style. A new major section should at least be introduced with a few sentences on what this section is about.
21. Mention that $erf$ is the Gaussian error function.
22. Center the equation in Section 3.2.
23. Plots is Figure 3 are rather poorly formatted: use thicker lines and more distinctive colors; place the legend legibly.
24. Show the average with confidence intervals over the 10 runs in Figure 3.
25. Put results, as in Section 4.2 on the Wisconsin Breast Cancer dataset rather in a table.
####################
*References*
[1] K. Balasubramanian, P. Donmez, and G. Lebanon. Unsupervised supervised learning ii: Margin-based classification without labels. Journal of Machine Learning Research, 12(Nov):3119–3145, 2011.
[2] P. Bergmann, M. Fauser, D. Sattlegger, and C. Steger. Mvtec ad–a comprehensive real-world dataset for unsupervised anomaly detection. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 9592–9600, 2019.
[3] R. Chalapathy and S. Chawla. Deep learning for anomaly detection: A survey. arXiv preprint arXiv:1901.03407, 2019.
[4] R. Chalapathy, A. K. Menon, and S. Chawla. Anomaly detection using one-class neural networks. arXiv preprint arXiv:1802.06360, 2018.
[5] H. Choi, E. Jang, and A. A. Alemi. Waic, but why? generative ensembles for robust anomaly detection. arXiv preprint arXiv:1810.01392, 2018.
[6] I. Golan and R. El-Yaniv. Deep anomaly detection using geometric transformations. In NIPS, 2018.
[7] D. Hendrycks, M. Mazeika, and T. G. Dietterich. Deep anomaly detection with outlier exposure. In ICLR, 2019.
[8] L. Ruff, R. A. Vandermeulen, N. Görnitz, L. Deecke, S. A. Siddiqui, A. Binder, E. Müller, and M. Kloft. Deep one-class classification. In International Conference on Machine Learning, pages 4393–4402, 2018.
[9] L. Ruff, Y. Zemlyanskiy, R. Vandermeulen, T. Schnake, and M. Kloft. Self-attentive, multi-context one-class classification for unsupervised anomaly detection on text. In Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics, pages 4061–4071, 2019.
[10] T. Schlegl, P. Seeböck, S. M. Waldstein, U. Schmidt-Erfurth, and G. Langs. Unsupervised anomaly detection with generative adversarial networks to guide marker discovery. In Proceedings International Conference on Information Processing in Medical Imaging, pages 146–157. Springer, 2017.


Federated learning allows edge devices to collaboratively learn a shared model while keeping the training data on device, decoupling the ability to do model training from the need to store the data in the cloud. We propose Federated matched averaging (FedMA) algorithm designed for federated learning of modern neural network architectures e.g. convolutional neural networks (CNNs) and LSTMs. FedMA constructs the shared global model in a layer-wise manner by matching and averaging hidden elements (i.e. channels for convolution layers; hidden states for LSTM; neurons for fully connected layers) with similar feature extraction signatures. Our experiments indicate that FedMA outperforms popular state-of-theart federated learning algorithms on deep CNN and LSTM architectures trained on real world datasets, while improving the communication efficiency.

Post Rebuttal Summary
---------------------------------
I have nudged my score up to an "Accept", based on my comments to the rebuttal below. I hope the authors continue to improve the readability of Sec. 2.1
Review Summary
--------------
Overall I think this is almost above the bar to be accepted, and I could be persuaded with a strong rebuttal.  The strengths here are the extensive experiments and the easy-to-implement method. The primary weakness of this paper is that it is a "straightfoward" way to extend the BBP-MAP method to CNNs and RNNs, so the methodological novelty is weak relative to the BBP-MAP past work (Yurochkin et al. ICML 2019). Other technical weaknesses limit the ability to use this method on clients with diverse class distributions, which will be common in real deployments.
Paper Summary
-------------
This paper addresses the problem of federated learning, where J separate "clients" with disjoint datasets each train a neural network model for a supervised problem, and then try to aggregate all J individual client models into one "global model" in a coherent way. The natural problem is that due to hidden units being permutable within one network, naively taking parameter averages across two client models will lead to bad accuracy without first coming up with a consistent ordering of the units in each layer.
Previous work (Yurochkin et al. ICML 2019) has developed a Bayesian nonparametric model based on the Beta-Bernoulli Process (BBP) for the case of federated learning of multi-layer perceptrons. However, the extension to convolutional layers or recurrent layers has yet to be solved, which is the focus of this paper.
This paper's algorithm (Federated Matched Averaging (FedMA), see Alg 1), proceeds by iteratively stepping thru the CNN or RNN layer by layer greedily from input to output. At each layer, we first solve a BBP-MAP optimization (bipartite matching using a BBP maximum a-posteriori objective as cost function, a subprocedure taken direclty from Yurochkin et al.). This obtains a consistent low-cost permutation for each client model. Then, the global model weights for that layer is the average of the aligned client weights. After the current layer update, each client keeps training, keeping all layers up to the current frozen but revising later layers. This layer-by-layer training can be applied to both CNNs and RNNs.
The proposed approach is compared to FedAvg and FedProx on MNIST and CIFAR image classification tasks with CNNs, and Shakespeare text classification tasks with RNNs. Later experiments explore the effect of communication efficiency (MB transfered between client and master), effect of local training epochs, handling biased class distributions, and interpretabilty.

Novelty & Significance
-----------------------
Solving federated learning problems is of increasing practical importance, and certainly trying to do so for CNNs and RNNs (more than just large MLPs) is important. So I like where the paper is going.
Although the method is "new", it is more or less a straightforward extension of work by Yurochkin et al. (ICML 2019) to CNNs and RNNs. If you read the last few sentences of Yurochkin et al., you'll see "Finally, it is of interest to extend our model-ing framework to other architectures such as Convolutional Neural Networks (CNNs) and Recurrent Neural Networks (RNNs). The permutation invariance necessitating matching inference also arises in CNNs since any permutation of the filters results in the same output, however additional bookkeeping is needed due to the pooling operations." I view this paper as a well-executed implementation of this "bookkeeping". Certainly not trivial, but to some readers perhaps not clearly "above the bar" for a top conference like ICLR.
Technical Concerns
------------------
## Concern 1: Client models will not always be alignable after permutation
My first concern is that there will not always be a one-to-one permutation of the neurons learned by two client models with different class distributions. Given fixed capacity at each layer, some clients may learn a filter for "horse hooves" (esp. if horse images are common to that client), while other clients may learn a filter for "snake skin" (if snakes are more common to that client). I wonder if we can quantify how well the aligned filters match in practice, and if there is any benefit to revising the alignment to allow some client-specific customizations (e.g. by having the global model can learn more units than the client model).
## Concern 2: Use of the BBP-MAP subprocedure poorly motivated
The paper prioritizes a clean and easy-to-implement algorithm to resolve practical alignment issues between client CNN and RNN models. However, I was a bit underwhelmed that the BBP-MAP solution used by Yurochkin et al. was treated as a black-box subprocedure without much justification. I could see 2 preferable alternatives to the current use of BBP-MAP. Either a simpler approach using Eq. 2 with a squared error cost and the Munkres algorithm to solve bipartitite matching to obtain the permutation (which seems more in spirit of the rest of the paper). Or, a more sophisticated probabilistic approach (taking a Bayesian hierarchical model from Yurochkin et al. seriously and forming the estimated global weights from a weighted sums that includes both the clients (weighted by dataset size) and the assumed prior). As it is, I feel the BBP-MAP subprocedure in the current Algorithm 1 is poorly motivated for the task at hand.
Experimental Evaluation
-----------------------
Overall the experiments were extensive and demonstrated several apparent advantages (reduced need to transfer large memory during communication, etc.).
Minor Presentation Concerns
---------------------
Before Eq. 2, you should introduce the "\theta" notation
I'm a bit confused about how "FedMA" differs from "FedMA with communication", even after reading Sec. 2.3. How exactly are communicate costs kept down? What are you sending from master to client at beginning of every "round" if not the full global model (all weights of the CNN)?


This paper focuses on valuating training data for supervised learning tasks and studies the Shapley value, a data value notion originated in cooperative game theory. The Shapley value defines a unique value distribution scheme that satisfies a set of appealing properties desired by a data value notion. However, the Shapley value requires exponential complexity to calculate exactly. Existing approximation algorithms, although achieving great improvement over the exact algorithm, relies on retraining models for multiple times, thus remaining limited when applied to larger-scale learning tasks and real-world datasets. In this work, we develop a simple and efficient heuristic for data valuation based on the Shapley value with complexity independent with the model size. The key idea is to approximate the model via a K-nearest neighbor (KNN) classifier, which has a locality structure that can lead to efficient Shapley value calculation. We evaluate the utility of the values produced by the KNN proxies in various settings, including label noise correction, watermark detection, data summarization, active data acquisition, and domain adaption. Extensive experiments demonstrate that our algorithm achieves at least comparable utility to the values produced by existing algorithms while significant efficiency improvement. Moreover, we theoretically analyze the Shapley value and justify its advantage over the leave-one-out error as a data value measure.

In short, the paper reports improved results on a few applications of Shapley Value of data points using an introduced approximation method that is orders of magnitude faster compared to existing methods.
I vote for rejection of this paper mainly because of two reasons. First, the contributions are not enough for this venue. The paper uses an already existing method (Jia et al. (2019a)) with the only difference being that they use it on top of learned features and therefore the main contribution seems to be the discussions in Sec4. Secondly, the paper makes technically "false" claims (as will be dicussed below).
The positive aspects of the work are as follows: First, the elephant in the room for data valuation methods, which is assessing how good or bad a data point is, is against privacy and this work addresses this question for the first time in the (very small) literature. Secondly, the experimental results are very comprehensive and make a very good case for usefulness of the introduced algorithm. Thirdly, new useful terms for the emerging community of data valuation are introduced through the clear and well-written definitions of the paper.
The paper mentions that the previously introduced KNN-Shapley method applied to the learned features of a deep neural network could be used as an approximation of data points' Shapley values. This is false. All data points contribute value to the feature learning part and the approximation simply ignores this crucial fact. The whole point of using Shapley values a measure of data value is its properties which are not satisfied for the "collaborative game of ML model training" by this approximation; the approximation can be heavily biased due to the fact that ignores the contributions to the feature learning (let's not forget what made deep network's desirable in the first place is their feature extracting power). One cannot use the training data to learn the feature extractor and then ignore the contributions by definition of the Shapley value being the average contribution to a random subset of data points (which means the rest of the data points are removed from the game). Or, one can do such a thing but the method cannot be called an approximation for the true Shapley Value of data points. The G-Shapley heuristic mentioned in the paper from previous work also seems to suffer from the same drawback as it is not playing the same collaborative game of training the ML model (unless one assumes that simply taking one step of the gradient for every data points would be a good approximation for a complete training!)
The experimental results are comprehensive and convincing.  The main issue is that the work discusses these experiments as if the goal of computing data value is performing such tasks (for each of which there exist simpler methods not related to data valuation). " The valuation methods often serve as a preprocessing step to filter out low-quality data,
such as mislabeled or noisy data, in a given dataset" is not a correct statement. The valuation methods serve as valuation methods which the introduced method, although providing " a valuation method", is not providing an unbiased estimate of the equitable Shapley value valuation method. For many of the provided tasks in the experiments section, previous works (Ghorbani & Zou, Jia et al 2019 b) report the same experiments as further inspections into the Shapley Value for data and not as goals of computing these computationally expensive values.
All in all, although the paper's experimental and theoretical results are useful and interesting as the use case of "a valuation method", but is technically incorrect as calling it an approximation for Data Shapley values makes it not publishable. My score is subject to drastic change if a major rework is done to make this point clear.
A few questions and suggestions:
* One of the most striking results from the Data-Shapley works were removing points from most valuable to least valuable and looking at the accuracy drop speed. It would be very necessary and also very convincing if the introduced method is good at detecting very positive points as well as very negative points.
* An interesting empirical experiment would be to look at the Rank Correlation between the introduced approximation and other unbiased Shapley Value approximations. If the correlation is high, it means that empirically the data points contribute equally to feature learning and their value can actually be approximated just by looking at the accuracy on extracted features.
* Is any unbiased estimator of true Shapley Values is "order-preserving" by definition?
* In Sec 2 it would be more useful for the general audience to include the third Shapley property too.
* For almost all of the cases of comparison where previous methods are present for comparison, there seems to be no meaningful advantage. This makes interpreting Figures like 4b, 4c, 5b and most importantly Fig 6b. It would be necessary to add other benchmarks that are not Shapley based. For instance, for data summarization, there has been a line of work the methods of which could be used as a measure of comparison.


Skip connections are an essential component of current state-of-the-art deep neural networks (DNNs) such as ResNet, WideResNet, DenseNet, and ResNeXt. Despite their huge success in building deeper and more powerful DNNs, we identify a surprising property of skip connections in this paper. Use of skip connections allows easier generation of highly transferable adversarial examples. Specifically, in ResNet-like (with skip connections) neural networks, gradients can backpropagate through either skip connections or residual modules. We find that using more gradients from the skip connections rather than the residual modules according to a decay factor, allows one to craft adversarial examples with high transferability. Our method is termed Skip Gradient Method (SGM). We conduct comprehensive transfer attacks against 10 state-of-the-art DNNs including ResNets, DenseNets, Inceptions, Inception-ResNet, Squeeze-and-Excitation Network (SENet) and robustly trained DNNs. We show that employing SGM on the gradient flow can greatly improve the transferability of crafted attacks in almost all cases. Furthermore, SGM can be easily combined with existing black-box attack techniques, and obtain high improvements over state-of-the-art transferability methods. Our findings not only motivate new adversarial research into the architectural characteristics of DNNs, but also open up further challenges for the design of secure DNN architectures.

Summary:
This paper proposes a modification to standard Projected Gradient Descent to improve transferability of adversarial examples, when the source model is a ResNet-like model containing skip connections. The method, Skip Gradient Method (SGM) modifies the backwards pass to scale down the gradient computed in each residual branch of the model, before these gradients are combined with the gradient from the skip connection. This thus upweights the gradients from the skip connections as opposed to residual modules. The paper demonstrates significant improvements in the single-model black-box transfer setting, against a variety of undefended and defended models.
Strengths:
- Lots of interesting empirical results here! One result which stands out to me is Table 4, where across a wide range of target models, adding SGM to existing techniques cuts defender accuracy by ~1/2 (e.g. 79.9% to 89.66% for SE154). The results in Table 3, showing that even without additional techniques, SGM results in large improvements and outperforms previous approaches, are also quite nice.
- It's notable that such a simple approach leads to significant improvements.
- Results are very clearly presented, and writing is clear throughout.
Suggestions for improvement:
I have 3 major concerns: (1) discrepancies between baselines and previously published results (2) unrealistic threat model (3) framing / conclusions drawn by paper.
I suspect (1) is easily addressed, but was not clear to me from the current paper.
(1) Baselines:
- For multi-step transfer against undefended models (Table 3), the attack success rates seem low compared to numbers reported in e.g. Liu et al. For example, using ResNet-152 as the source, and VGG-19 as the target, Liu et al reports 19% defender accuracy = 81% attacker success. This is significantly higher than the 65.52% reported for MI (both are non-regularized optimization attacks), also stronger than the 80.68% reported for SGM. In general, considering these are *untargeted* attacks, with eps=16, the transfer rates seem pretty low.
- For multi-step transfer against defended models (Table 5), the numbers are slightly lower than previously reported. E.g. attacking IncV3_ens3, Dong et al 19 reports 46.9% for MI, but here, 44.28% is reported. (I realize these differences are slight.)
- In general, it would be nice if the paper were structured so as to make these comparisons easier. For example, the appendix could include tables comparing the baselines reported here, to values previously reported, and explain any discrepancies. Particularly with black-box transfer, where baseline performance is so sensitive to small choices, it's important to ensure baselines are properly implemented, and the current writing of the paper makes it impossible for the reader to assess this unless they are very familiar with the black-box transfer literature.
(2) Unrealistic threat model:
- For black-box transfer, all the strongest attacks use multiple source models (see e.g. NeurIPS 2017 Adversarial Examples contest, the baselines cited in the paper). While this paper shows significant improvements in the single-source setting, these results are significantly weaker than any multiple-source attack. For instance, Liu et al 17 achieve near 100% untargeted success (and near 100% targeted success) against all undefended models they study (many which overlap), and Dong et al 19 report ~85% accuracy against IncV3_ens3 (compared to <60% here).
- There's no reason in practice that an adversary would not employ an ensemble-based attack if they wanted to fool an unknown model.
(3) Framing / conclusions:
- The paper frames the results as a "security vulnerability of ResNets," but the results don't show this. In particular, they show that ResNets make effective *source* models to be used by *attackers*, but they don't imply which models defenders should use in order to be robust to black-box attacks. In this way, the main message of the paper seems misleading to practitioners.
- The main message of the paper thus seems to be "on the transferability of adversarial examples generated  with resnets" as opposed to the "security of skip connections." I would encourage rewriting of the title/intro/conclusion as such.
Overall, there are several very interesting empirical findings in this paper. I view the two main impacts these results could later have would be leading to (1) improved understanding of what causes transfer of adversarial examples and (2) improved understanding of ResNet-like architectures (for example, the results provide some support for the view of ResNets as ensembles of shallow models, cited in the paper). If the paper were written with this view, then concern (2) above becomes unimportant.
Suggestions I believe could strengthen the paper, but I do not view as weaknesses, or necessities:
- Can you decouple the effect of SGM on optimization and transfer? The paper does a bit of this, but restricts the analysis to the single-step case. For instance, if the main effect of SGM is on optimization, this has interesting implications for optimization of ResNets. If the main effect is on transfer, this has interesting implications for what causes transfer.
Minor:
- I'd suggest moving Table 1 (one-step attacks) to the Appendix. The results are less impressive than multi-step, and the community as a whole favors stronger attacks.
Overall, there are several interesting empirical findings in this paper (modulo concerns about baselines indicated above). I suggest that the paper either consider more realistic threat models to be useful to the adversarial examples field, or focus on the insights revealed by these findings. I hope that the authors can address the concerns outlined here, and I would be happy to adjust my score if so.
Note that my current indicated confidence rating is for the current state of the paper. I would be happy to adjust my evaluation if revisions to the paper can one/several of the concerns indicated above.
__________________
EDIT: Rating adjusted from 3: Weak Reject to 8: Accept, after accounting for revisions and author rebuttal. See reply below.


We introduce Deep Reasoning Networks (DRNets), an end-to-end framework that combines deep learning with reasoning for solving pattern de-mixing problems, typically in an unsupervised or weakly-supervised setting. DRNets exploit problem structure and prior knowledge by tightly combining logic and constraint reasoning with stochastic-gradient-based neural network optimization. We illustrate the power of DRNets on de-mixing overlapping hand-written Sudokus (Multi-MNIST-Sudoku) and on a substantially more complex task in scientific discovery that concerns inferring crystal structures of materials from X-ray diffraction data (Crystal-Structure-Phase-Mapping). DRNets significantly outperform the state of the art and experts' capabilities on Crystal-Structure-Phase-Mapping, recovering more precise and physically meaningful crystal structures. On Multi-MNISTSudoku, DRNets perfectly recovered the mixed Sudokus' digits, with 100% digit accuracy, outperforming the supervised state-of-the-art MNIST de-mixing models.

This paper proposes a new encoder-decoder framework that combines prior knowledge-based regularization and constrained reconstruction for unsupervised and weakly-supervised classification in structure rich scenarios. This framework injects prior knowledge in the form of relaxed constraints that act as regularization during the training of the encoder network. Some of the constraints concern sets of training examples. In this case, the paper proposes corresponding sampling schemes. Three experiments demonstrate the efficacy of the model. The first is a synthetically created 4x4 Sudoku made of overlaid MNIST digits. The other two are based on predicting crystal structures from x-ray diffraction measurements. Here, the first experiment is on simulated data for the Al-Li-Fe oxide system, while the other is performed on real measurements for the Bi-Cu-V oxide system.
Overall, I believe that the proposed framework could be a significant contribution to the fields of representation learning and constrained optimization. However, the paper exhibits serious shortcomings, which require revision.
First, the positive aspects of the paper:
•	The framework is simple yet ingenious. It makes intelligent use of constraints in the form of regularization to guide the training of the encoder. Furthermore, it enables the direct design of the latent representation through the use of (pre-trained) generative models for constrained reconstruction of data points.
•	The proposed entropy-based method for relaxation of discrete constraints is intuitive and potentially adaptable for further constraints.
•	The experiments presented in this paper are well chosen. They demonstrate the contribution of the model to both general CV data as well as a specialized domain, where it can solve both simulated and real scenarios.
•	The paper provides an extensive literature survey, which makes it easy to embed the presented work in the proper context. However, I propose to remove the paragraph titled “Other less closely related work” as the connection to the current work is not clear, and the space could be used more effectively (see below).
Unfortunately, this paper has a couple of major flaws:
•	The results for DRNets (Generalization) on the MNIST Sudoku are compromised because the model trained on the test set for 25 epochs after being trained on the training set. Honestly, I was baffled to read the following sentence in the appendix: “Note that, during the test, instead of predicting the overlapping digits directly as other networks, we further optimize DRNets on the test set for 25 epochs to achieve a better result.” What is more, the main paper does not even mention this fact!
•	Although this paper relies on empirical verification of its proposition, the experimental results are almost impossible to interpret with just the information provided in the paper. Both experiments are poorly described, and even after reading the appendix several times, some serious detective work was necessary to piece together what happened in the experiments. The XRD experiments are especially hard to decipher, even with a physics background. Many vital components remain shrouded in mystery: What is a composition graph, and how are the paths sampled from it? How does the restart method, which is part of the results, work? Why are only six phases shown in the phase concentration visualizations if there were 159 possible phases? Are these the first six, a random subset, or were the other phases not realized?
•	The paper introduces the constraint-aware SGD algorithm to incorporate batching rules into the training of the encoder. On pages 2 and 6 and in Algorithm 1, I found the statement that the weights for each constrained are updated dynamically. However, that is where the information on the dynamic update method ends. Nowhere in the paper or the appendix did I find an explanation of how this is done. As this mechanism is a critical component of the proposed framework, the absence of an explanation is a significant oversight.
Other remarks:
•	In the context of global constraints, the paper talks about a constraint graph. If I understand the creation of this graph correctly, this graph has several connected components in which every element connects to every other element. As such, this seems to be a collection of sets rather than a real graph. This is especially confusing in the case of XRD, where all data points are in the same global constraint, leading to a fully connected “graph”.
•	Although I appreciate the reference to Kahneman’s model of the mind, I suggest to remove the first two paragraphs from the introduction and use the space to motivate the de-mixing problem instead. While it is a compelling (but not novel) observation, the analogy to system 1 and system 2 does not benefit the proposed work in the slightest.
•	In general, I fail to see the connection between reasoning and the proposed work. The model itself is an encoder-decoder network that cannot reason. It does not discover any new rules during training. All the reasoning has to be done manually beforehand to be then incorporated in the form of constraints. To clarify, I do believe that there is value in the presented work, but not necessarily in the way, it is advertised.


In this paper, we present a method for learning discrete linguistic units by incorporating vector quantization layers into neural models of visually grounded speech. We show that our method is capable of capturing both word-level and sub-word units, depending on how it is configured. What differentiates this paper from prior work on speech unit learning is the choice of training objective. Rather than using a reconstruction-based loss, we use a discriminative, multimodal grounding objective which forces the learned units to be useful for semantic image retrieval. We evaluate the sub-word units on the ZeroSpeech 2019 challenge, achieving a 27.3% reduction in ABX error rate over the top-performing submission, while keeping the bitrate approximately the same. We also present experiments demonstrating the noise robustness of these units. Finally, we show that a model with multiple quantizers can simultaneously learn phone-like detectors at a lower layer and word-like detectors at a higher layer. We show that these detectors are highly accurate, discovering 279 words with an F1 score of greater than 0.5.

Overview:
The paper proposes a method to learn discrete linguistic units in a low-resource setting using speech paired with images (no labels). The visual grounding signal is different from other recent work, where a reconstruction objective was used to learn discrete representations in unsupervised neural networks. In contrast to other work, a hierarchy of discretization layers are also considered, and the paper shows that, with appropriate initialization, higher discrete layers capture word-like units while lower layers capture phoneme-like units.
Strengths:
The paper is extremely well-written with a clear motivation (Section 1). The approach is novel. But I think the paper's biggest strength is in its very thorough experimental investigation. Their approach is compared to other very recent speech discretization methods on the same data using the same (ABX) evaluation metric. But the work goes further in that it systematically attempts to actually understand what types of structures are captured in the intermediate discrete layers, and it is able to answer this question convincingly. Finally, very good results on standard benchmarks are achieved.
Weaknesses:
Although I think the paper is very well-motivated, my first criticism is that discretization itself is not motivated: why is it necessary to have a model with discrete intermediate layers? Does this give us something other than interpretability (which we obtain due to the sparse bottleneck)? In the detailed questions below, I also specifically ask whether, for instance, the downstream speech-image task actually benefits from including discrete layers.
My second point is that it is unclear why word-like units only appear when the higher-level discrete layers are trained from scratch; as soon as warm-starting is used, the higher level layers capture phoneme-like units (Table 1). Is it possible to answer/speculate why this is the case?
Overall assessment:
The paper presents a new approach with a thorough experimental investigation. I therefore assign an "accept". The weaknesses above asks for additional motivation and some speculation.
Questions, suggestions, typos, grammar and style:
- Section 3.3: It maybe makes less sense for the end-task, but did the authors consider discretization on the image side of the network? This could maybe lead to parts of objects being composed to form larger objects (in analogy to the speech network).
- Section 3.3, par. 3: "with the intention that they should capture discrete word-like and sub-word-like units" -> "with the intention that they should capture discrete *sub-word-like and word-like units*" (easier to read with first part of sentence)
- Section 3.3: The more standard VQ-VAE adds a commitment loss and a loss for updating the embeddings; was this used or considered at all, or is this all captured through the exponential moving average method?
- Section 3.4: "with same VQ layers" -> "with *the* same VQ layers"
- Section 3.5: Can you briefly outline the motivation for adding the two losses (so that it is not required to read the previous work).
- Section 4.1: Following from the first weakness listed above, the caption under Figure 2 states that the non-discrete model achieves a speech-image retrieval R@10 of 0.735. This is lower than some of the best scores achieved in Table 1. Can this be taken as evidence that discretization actually improves the downstream task? If so, it would be worth highlighting the point more; if there is some other reason, that would also be worth knowing.
- Figure 1: Did the authors ever consider putting discrete layers right at the top of the speech component, just before the pooling layer? Would this more consistently lead to word-like units?


Learning to disentangle the hidden factors of variations within a set of observations is a key task for artificial intelligence. We present a unified formulation for class and content disentanglement and use it to illustrate the limitations of current methods. We therefore introduce LORD, a novel method based on Latent Optimization for Representation Disentanglement. We find that latent optimization, along with an asymmetric noise regularization, is superior to amortized inference for achieving disentangled representations. In extensive experiments, our method is shown to achieve better disentanglement performance than both adversarial and non-adversarial methods that use the same level of supervision. We further introduce a clustering-based approach for extending our method for settings that exhibit in-class variation with promising results on the task of domain translation.

Summary: this paper proposes to basically combine class-conditional noisy autoencoding with GLO to achieve disentanglement while having only access to the content labels. They demonstrate that the method achieves impressive empirical results both in terms of disentanglement and a limited experiment on unsupervised domain translation.
Decision: Weak Reject. I find the experimental results in this paper very appealing. However, I am weakly rejecting the paper because of 1) some problematic claims put forth in the paper, which I worry might mislead the reader and 2) lack of clarity in describing the procedure in the unsupervised domain translation setting.
Here are some main comments:
1.  KL-divergence v. asymmetric noise
First, the authors claim that regularizing with KL-divergence leads to posterior collapse. But the particular experimental set up is tested on SmallNORB, which only has a small handful of factors of variation anyway). That KL-divergence “causes” posterior collapse is a claim that must be made very carefully. There are some very specific conditions under which this is known to be true empirically (for example, see the experiments in Burda’s IWAE paper and Hoffman’s DLGM paper), but in general, one should be careful with this claim. Can the authors please walk back on this statement?
Second, it is worth noting that asymmetric noise regularization is itself actually a special case of KL-divergence regularzation. When q(z|x) is forced to have a globally fixed variance, KL-divergence regularization becomes asymmetric noise regularization.
2. Cost of training
One thing I feel should be made more clear in the paper is the training cost of GLO v. amortized models. How much slower is GLO compared to amortized models? How many iterations do you employ on a given minibatch of data when using GLO?
3. Ablation study
First, I think the authors should show us the actual visualizations for the amortized models. Without visual inspection, it’s hard to gauge the significance of the numbers in Table 3.
Second, the authors observed that the amortized models leak class information into the content representation. I find it fascinating that GLO does not. I would like the authors to dig deeper into what exactly is the inductive bias conferred by latent optimization. As of the moment, claim that “this variant is inferior to our fully unamortized model as a result of an inductive bias conferred by latent optimization” is a vacuously true statement since we know that amortized models and unamortized models should in theory have equivalent behavior in the infinite-capacity / oracle optimizer regime. I request that the authors show us the training and test losses (Eq 6 and its decomposition into reconstruction + regularization terms). Inspecting it may shed light on the inductive bias.
4. Unsupervised Domain Translation
The result looks very good. However, the experimentation is too limited. I recommend that the authors try at least one other dataset.
Furthermore, the description of how to apply LORD to unsupervised domain translation is uncomfortably vague. I am not sure if the provided code and description in the main text allows for reproduction of the UDT experiments.
If the authors are able to address the above questions and requests, then I am more than happy to raise my score.


Despite considerable advances in neural language modeling, it remains an open question what the best decoding strategy is for text generation from a language model (e.g. to generate a story). The counter-intuitive empirical observation is that even though the use of likelihood as training objective leads to high quality models for a broad range of language understanding tasks, maximization-based decoding methods such as beam search lead to degeneration -output text that is bland, incoherent, or gets stuck in repetitive loops. To address this we propose Nucleus Sampling, a simple but effective method to draw considerably higher quality text out of neural language models than previous decoding strategies. Our approach avoids text degeneration by truncating the unreliable tail of the probability distribution, sampling from the dynamic nucleus of tokens containing the vast majority of the probability mass. To properly examine current maximization-based and stochastic decoding methods, we compare generations from each of these methods to the distribution of human text along several axes such as likelihood, diversity, and repetition. Our results show that (1) maximization is an inappropriate decoding objective for openended text generation, (2) the probability distributions of the best current language models have an unreliable tail which needs to be truncated during generation and (3) Nucleus Sampling is the best available decoding strategy for generating longform text that is both high-quality -as measured by human evaluation -and as diverse as human-written text.

In the domain of language models, the paper introduces a new heuristic sampling method called top-p sampling, or nucleus sampling (NS). It is a variant of top-k sampling where the smallest k is selected to ensure the combined likelihood is no less than p. The paper centers on claiming and showing that the generated samples are of higher quality and more diverse than common alternatives such as beam search, pure sampling, top-k sampling, and low-temperature sampling.
While overall I think the proposed method is sound as an alternative to other heuristics such as beam search, I have reservations on the presentation and arguments made in the paper.
Pros:
1. NS is sound as a heuristic sampling method.
2. The paper contains many interesting experimental observations and I speculate that some of them will find future uses. For example, the selection of parameter values (not just for NS, also for top-k) and the nontrivial perplexity of generated text.
Cons:
1. The ultimate performance measure (open-ended generation) of “high quality” and “diversity” is very vague. It seems that the authors end up doing is to evaluate by high self-BLEU, HUSE, few repetitions, and perplexity. Furthermore, it is unclear why one _should_ train with cross-entropy (trying to match the distributions) and then rely on the sampling procedure to fulfill these desiderata (See also Min1 and Min2).
2. The comparison with beam search (BS) is not well motivated. BS is devised to find the maximal sentence and it is not stochastic. It seems out of place in the context of generating a “diverse” set of samples.
3. The arguments in the comparison with pure sampling is vague and sometimes misplaced. The key argument seems to hinge on the idea that the low likelihood tail is of “low confidence.” But this claim is problematic. If the estimate is wrong on the low probability tail, then so is the estimate on p(head) = 1-p(tail) by virtue of p being a probability measure.
4. The arguments in the comparison with top-k is vague and sometimes misplaced. The main argument against top-k is the “[d]ifficulty in choosing a suitable value of k” but the same can be said for choosing p. After all, top-k and top-p (NS) can be thought of as a variant of each other (by dynamically choosing k or p respectively). Moreover, in Figure 5, a selection for k value is suggested. I agree that this value might not _appear_ as intuitive as p, and maybe other works have chosen a smaller k than they should have, but similarly, people might intuitively choose too high a value for p (Figure 5).
Possible mistakes/typos:
1. (2), “>=“ -> ≥.
2. Figure 7, the human self-BLEU4 < human self-BLEU5 and that seems wrong, especially when all other bars show the opposite ordering.
3. In References, “Angela Fan, Mike Lewis, and Yann Dauphin. Hierarchical neural story generation. In ACL, 2018a” is duplicated.
4. In References, the citation of “Unifying human and statistical evaluation for natural language generation” is from NAACL 2019, not “2018.”
5. In References, the first names are shown as initials in “Sparse forward-backward using minimum divergence beams for fast training of conditional random fields.”
Questions:
1. In Table 1, how is Human perplexity estimated?
Minor issues:
1. Partly due to what the authors position NS to solve, i.e. open-ended generation, the core arguments is not as precise or rigorous as it could have been in my opinion. I feel that focusing on comparing NS to other heuristics as a heuristic might make the text appeal to a wider audience and the discussion more precise.
2. The distinction drawn between open-ended generation and directed generation is unpersuasive to me. In the context of language modeling, the former is to approximate a distribution (over an extended alphabet) whereas the latter is to approximate a conditional distribution (given the input). However, the most common formulation to solve the former is to decompose the distribution into a product of conditional distributions (1).
3. The caption in Figure 1 draws a misleading comparison. The “admirable” generation (presumably referring to the OpenAI blog post) was from the full GPT-2 model, not the initially released GPT-2-117M.
Please point out my misunderstanding directly. I am open to acknowledging them and revising my assessment.