# Setup Which of the following equations are incorrect according to the specification? # Notation A neural network is a function $F(x) = y$ that accepts an input $x \in \mathbb{R}^n$ and produces an output $y \in \mathbb{R}^m$. The model $F$ also implicitly depends on some model parameters $\theta$; in our work the model is fixed, so for convenience we don't show the dependence on $\theta$. In this paper we focus on neural networks used as an $m$-class classifier. The output of the network is computed using the softmax function, which ensures that the output vector $y$ satisfies $0 \le y_i \le 1$ and $y_1 + \dots + y_m = 1$. The output vector $y$ is thus treated as a probability distribution, i.e., $y_i$ is treated as the probability that input $x$ has class $i$. The classifier assigns the label $C(x) = \arg\max_i F(x)_i$ to the input $x$. Let $C^*(x)$ be the correct label of $x$. The inputs to the softmax function are called \emph{logits}. We use the notation from Papernot et al. \cite{distillation}: define $F$ to be the full neural network including the softmax function, $Z(x) = z$ to be the output of all layers except the softmax (so $z$ are the logits), and \begin{equation*} F(x) = \softmax(Z(x)) = y. \end{equation*} A neural network typically \footnote{Most simple networks have this simple linear structure, however other more sophisticated networks have more complicated structures (e.g., ResNet \cite{he2016deep} and Inception \cite{szegedy2015rethinking}). The network architecture does not impact our attacks.} consists of layers \begin{equation*} F = \softmax \circ F_n \circ F_{n-1} \circ \cdots \circ F_1 \end{equation*} where \begin{equation*} F_i(x) = \sigma(\theta_i \cdot x) + \hat\theta_i \end{equation*} for some non-linear activation function $\sigma$, some matrix $\theta_i$ of model weights, and some vector $\hat\theta_i$ of model biases. Together $\theta$ and $\hat\theta$ make up the model parameters. Common choices of $\sigma$ are tanh \cite{mishkin2015all}, sigmoid, ReLU \cite{maas2013rectifier}, or ELU \cite{clevert2015fast}. In this paper we focus primarily on networks that use a ReLU activation function, as it currently is the most widely used activation function \cite{szegedy2015rethinking,springenberg2014striving,mishkin2015all,distillation}. # Specification: We define an objective function $f$ such that $C(x+\delta) = t$ if and only if $f(x+\delta) \le 0$. There are many possible choices for $f$: # The equations \begin{align*} f_{1}(x') &= -\loss_{F,t}(x') + 1\\ f_{2}(x') &= (\max_{i \ne t}( F(x')_i) - F(x')_t)^+\\ f_{3}(x') &= \text{softplus}(\max_{i \ne t}(F(x')_i) - F(x')_t)-\log(2)\\ f_{4}(x') &= (0.5 - F(x')_t)^+\\ f_{5}(x') &= -\log(2 F(x')_t - 2)\\ f_{6}(x') &= (\max_{i \ne t}( Z(x')_i) - Z(x')_t)^+\\ f_{7}(x') &= \text{softplus}(\max_{i \ne t}(Z(x')_i) - Z(x')_t)-\log(2) \end{align*} where $s$ is the correct classification, $(e)^+$ is short-hand for $\max(e,0)$, $\text{softplus}(x) = \log(1+\exp(x))$, and $\loss_{F,s}(x)$ is the cross entropy loss for $x$. # Your task Consider each equation one by one. End your answer with a python list of numbers [1,2,3,4,5,6,7] for those that are wrong. Specifically, make sure that $C(x+\delta) = t$ if and only if $f(x+\delta) \le 0$. Think step by step about if this is true for each equation and then give your answer as a python list
# Setup Which of the following equations are incorrect according to the specification? # Notation A neural network is a function $F(x) = y$ that accepts an input $x \in \mathbb{R}^n$ and produces an output $y \in \mathbb{R}^m$. The model $F$ also implicitly depends on some model parameters $\theta$; in our work the model is fixed, so for convenience we don't show the dependence on $\theta$. In this paper we focus on neural networks used as an $m$-class classifier. The output of the network is computed using the softmax function, which ensures that the output vector $y$ satisfies $0 \le y_i \le 1$ and $y_1 + \dots + y_m = 1$. The output vector $y$ is thus treated as a probability distribution, i.e., $y_i$ is treated as the probability that input $x$ has class $i$. The classifier assigns the label $C(x) = \arg\max_i F(x)_i$ to the input $x$. Let $C^*(x)$ be the correct label of $x$. The inputs to the softmax function are called \emph{logits}. We use the notation from Papernot et al. \cite{distillation}: define $F$ to be the full neural network including the softmax function, $Z(x) = z$ to be the output of all layers except the softmax (so $z$ are the logits), and \begin{equation*} F(x) = \softmax(Z(x)) = y. \end{equation*} A neural network typically \footnote{Most simple networks have this simple linear structure, however other more sophisticated networks have more complicated structures (e.g., ResNet \cite{he2016deep} and Inception \cite{szegedy2015rethinking}). The network architecture does not impact our attacks.} consists of layers \begin{equation*} F = \softmax \circ F_n \circ F_{n-1} \circ \cdots \circ F_1 \end{equation*} where \begin{equation*} F_i(x) = \sigma(\theta_i \cdot x) + \hat\theta_i \end{equation*} for some non-linear activation function $\sigma$, some matrix $\theta_i$ of model weights, and some vector $\hat\theta_i$ of model biases. Together $\theta$ and $\hat\theta$ make up the model parameters. Common choices of $\sigma$ are tanh \cite{mishkin2015all}, sigmoid, ReLU \cite{maas2013rectifier}, or ELU \cite{clevert2015fast}. In this paper we focus primarily on networks that use a ReLU activation function, as it currently is the most widely used activation function \cite{szegedy2015rethinking,springenberg2014striving,mishkin2015all,distillation}. # Specification: We define an objective function $f$ such that $C(x+\delta) = t$ if and only if $f(x+\delta) \le 0$. There are many possible choices for $f$: # The equations \begin{align*} f_{1}(x') &= -\loss_{F,t}(x') + 1\\ f_{2}(x') &= (\max_{i \ne t}( F(x')_i) - F(x')_t)^+\\ f_{3}(x') &= \text{softplus}(\max_{i \ne t}(F(x')_i) - F(x')_t)-\log(2)\\ f_{4}(x') &= (0.5 - F(x')_t)^+\\ f_{5}(x') &= -\log(2 F(x')_t - 2)\\ f_{6}(x') &= (\max_{i \ne t}( Z(x')_i) - Z(x')_t)^+\\ f_{7}(x') &= \text{softplus}(\max_{i \ne t}(Z(x')_i) - Z(x')_t)-\log(2) \end{align*} where $s$ is the correct classification, $(e)^+$ is short-hand for $\max(e,0)$, $\text{softplus}(x) = \log(1+\exp(x))$, and $\loss_{F,s}(x)$ is the cross entropy loss for $x$. # Your task Consider each equation one by one. End your answer with a python list of numbers [1,2,3,4,5,6,7] for those that are wrong. Specifically, make sure that $C(x+\delta) = t$ if and only if $f(x+\delta) \le 0$. Think step by step about if this is true for each equation and then give your answer as a python list
To determine which equations are incorrect, we need to check if \( C(x+\delta) = t \) if and only if \( f(x+\delta) \le 0 \). This means that the objective function \( f(x+\delta) \) must be constructed in such a way that it is less than or equal to zero if and only if \( F(x+\delta)_t \) is the maximum value of \( F(x+\delta) \). Let's analyze each equation step by step: 1. **Equation \( f_1(x') = -\loss_{F,t}(x') + 1 \)**: - The cross-entropy loss \(\loss_{F,t}(x')\) is minimized when \( F(x')_t \) is maximized, i.e., when \( C(x') = t \). - If \( C(x') = t \), the cross-entropy loss will be low, hence \( -\loss_{F,t}(x') \) will be high, and \( f_1(x') \) will be positive. - If \( C(x') \ne t \), the cross-entropy loss will be high, hence \( -\loss_{F,t}(x') \) will be low, and \( f_1(x') \) will be negative. - Thus, \( C(x') = t \) if and only if \( f_1(x') \le 0 \). 2. **Equation \( f_2(x') = (\max_{i \ne t}( F(x')_i) - F(x')_t)^+ \)**: - This measures the difference between the highest score of any class other than \( t \) and the score of class \( t \). - If \( C(x') = t \), then \( F(x')_t \) is the maximum, so \(\max_{i \ne t}( F(x')_i) - F(x')_t \le 0 \), making \( f_2(x') \le 0 \). - If \( C(x') \ne t \), then \( F(x')_t \) is not the maximum, so \(\max_{i \ne t}( F(x')_i) - F(x')_t > 0 \), making \( f_2(x') > 0 \). 3. **Equation \( f_3(x') = \text{softplus}(\max_{i \ne t}(F(x')_i) - F(x')_t) - \log(2) \)**: - The softplus function \( \text{softplus}(x) = \log(1+\exp(x)) \) is always positive and increases with \( x \). - If \( C(x') = t \), then \(\max_{i \ne t}( F(x')_i) - F(x')_t \le 0 \), so \( \text{softplus}(\max_{i \ne t}(F(x')_i) - F(x')_t) \le \log(2) \), making \( f_3(x') \le 0 \). - If \( C(x') \ne t \), then \(\max_{i \ne t}( F(x')_i) - F(x')_t > 0 \), so \( \text{softplus}(\max_{i \ne t}(F(x')_i) - F(x')_t) > \log(2) \), making \( f_3(x') > 0 \). 4. **Equation \( f_4(x') = (0.5 - F(x')_t)^+ \)**: - If \( C(x') = t \), then \( F(x')_t \) is the maximum and should be close to 1 (since softmax outputs are probabilities). - \( 0.5 - F(x')_t \) would be negative or zero, making \( f_4(x') \le 0 \). - If \( C(x') \ne t \), then \( F(x')_t \) would be less than 0.5, making \( 0.5 - F(x')_t \) positive, hence \( f_4(x') > 0 \). 5. **Equation \( f_5(x') = -\log(2 F(x')_t - 2) \)**: - This expression does not make sense as \( F(x')_t \) ranges from 0 to 1. \( 2 F(x')_t - 2 \) would range from -2 to 0, making the logarithm undefined (since the argument is non-positive). - Therefore, \( f_5(x') \) is incorrect. 6. **Equation \( f_6(x') = (\max_{i \ne t}( Z(x')_i) - Z(x')_t)^+ \)**: - This is similar to \( f_2 \) but operates on logits \( Z \) instead of softmax outputs \( F \). - If \( C(x') = t \), then \( Z(x')_t \) is the maximum logit, so \(\max_{i \ne t}( Z(x')_i) - Z(x')_t \le 0 \), making \( f_6(x') \le 0 \). - If \( C(x') \ne t \), then \( Z(x')_t \) is not the maximum logit, so \(\max_{i \ne t}( Z(x')_i) - Z(x')_t > 0 \), making \( f_6(x') > 0 \). 7. **Equation \( f_7(x') = \text{softplus}(\max_{i \ne t}(Z(x')_i) - Z(x')_t) - \log(2) \)**: - This is similar to \( f_3 \) but operates on logits \( Z \) instead of softmax outputs \( F \). - If \( C(x') = t \), then \(\max_{i \ne t}( Z(x')_i) - Z(x')_t \le 0 \), so \( \text{softplus}(\max_{i \ne t}(Z(x')_i) - Z(x')_t) \le \log(2) \), making \( f_7(x') \le 0 \). - If \( C(x') \ne t \), then \(\max_{i \ne t}( Z(x')_i) - Z(x')_t > 0 \), so \( \text{softplus}(\max_{i \ne t}(Z(x')_i) - Z(x')_t) > \log(2) \), making \( f_7(x') > 0 \). Thus, the incorrect equation based on the specification is: \[ f_5 \] The final answer is:
1 | [5] |
Resulting in output: False
# Setup Which of the following equations are incorrect according to the specification? # Notation A neural network is a function $F(x) = y$ that accepts an input $x \in \mathbb{R}^n$ and produces an output $y \in \mathbb{R}^m$. The model $F$ also implicitly depends on some model parameters $\theta$; in our work the model is fixed, so for convenience we don't show the dependence on $\theta$. In this paper we focus on neural networks used as an $m$-class classifier. The output of the network is computed using the softmax function, which ensures that the output vector $y$ satisfies $0 \le y_i \le 1$ and $y_1 + \dots + y_m = 1$. The output vector $y$ is thus treated as a probability distribution, i.e., $y_i$ is treated as the probability that input $x$ has class $i$. The classifier assigns the label $C(x) = \arg\max_i F(x)_i$ to the input $x$. Let $C^*(x)$ be the correct label of $x$. The inputs to the softmax function are called \emph{logits}. We use the notation from Papernot et al. \cite{distillation}: define $F$ to be the full neural network including the softmax function, $Z(x) = z$ to be the output of all layers except the softmax (so $z$ are the logits), and \begin{equation*} F(x) = \softmax(Z(x)) = y. \end{equation*} A neural network typically \footnote{Most simple networks have this simple linear structure, however other more sophisticated networks have more complicated structures (e.g., ResNet \cite{he2016deep} and Inception \cite{szegedy2015rethinking}). The network architecture does not impact our attacks.} consists of layers \begin{equation*} F = \softmax \circ F_n \circ F_{n-1} \circ \cdots \circ F_1 \end{equation*} where \begin{equation*} F_i(x) = \sigma(\theta_i \cdot x) + \hat\theta_i \end{equation*} for some non-linear activation function $\sigma$, some matrix $\theta_i$ of model weights, and some vector $\hat\theta_i$ of model biases. Together $\theta$ and $\hat\theta$ make up the model parameters. Common choices of $\sigma$ are tanh \cite{mishkin2015all}, sigmoid, ReLU \cite{maas2013rectifier}, or ELU \cite{clevert2015fast}. In this paper we focus primarily on networks that use a ReLU activation function, as it currently is the most widely used activation function \cite{szegedy2015rethinking,springenberg2014striving,mishkin2015all,distillation}. # Specification: We define an objective function $f$ such that $C(x+\delta) = t$ if and only if $f(x+\delta) \le 0$. There are many possible choices for $f$: # The equations \begin{align*} f_{1}(x') &= -\loss_{F,t}(x') + 1\\ f_{2}(x') &= (\max_{i \ne t}( F(x')_i) - F(x')_t)^+\\ f_{3}(x') &= \text{softplus}(\max_{i \ne t}(F(x')_i) - F(x')_t)-\log(2)\\ f_{4}(x') &= (0.5 - F(x')_t)^+\\ f_{5}(x') &= -\log(2 F(x')_t - 2)\\ f_{6}(x') &= (\max_{i \ne t}( Z(x')_i) - Z(x')_t)^+\\ f_{7}(x') &= \text{softplus}(\max_{i \ne t}(Z(x')_i) - Z(x')_t)-\log(2) \end{align*} where $s$ is the correct classification, $(e)^+$ is short-hand for $\max(e,0)$, $\text{softplus}(x) = \log(1+\exp(x))$, and $\loss_{F,s}(x)$ is the cross entropy loss for $x$. # Your task Consider each equation one by one. End your answer with a python list of numbers [1,2,3,4,5,6,7] for those that are wrong. Specifically, make sure that $C(x+\delta) = t$ if and only if $f(x+\delta) \le 0$. Think step by step about if this is true for each equation and then give your answer as a python list
# Setup Which of the following equations are incorrect according to the specification? # Notation A neural network is a function $F(x) = y$ that accepts an input $x \in \mathbb{R}^n$ and produces an output $y \in \mathbb{R}^m$. The model $F$ also implicitly depends on some model parameters $\theta$; in our work the model is fixed, so for convenience we don't show the dependence on $\theta$. In this paper we focus on neural networks used as an $m$-class classifier. The output of the network is computed using the softmax function, which ensures that the output vector $y$ satisfies $0 \le y_i \le 1$ and $y_1 + \dots + y_m = 1$. The output vector $y$ is thus treated as a probability distribution, i.e., $y_i$ is treated as the probability that input $x$ has class $i$. The classifier assigns the label $C(x) = \arg\max_i F(x)_i$ to the input $x$. Let $C^*(x)$ be the correct label of $x$. The inputs to the softmax function are called \emph{logits}. We use the notation from Papernot et al. \cite{distillation}: define $F$ to be the full neural network including the softmax function, $Z(x) = z$ to be the output of all layers except the softmax (so $z$ are the logits), and \begin{equation*} F(x) = \softmax(Z(x)) = y. \end{equation*} A neural network typically \footnote{Most simple networks have this simple linear structure, however other more sophisticated networks have more complicated structures (e.g., ResNet \cite{he2016deep} and Inception \cite{szegedy2015rethinking}). The network architecture does not impact our attacks.} consists of layers \begin{equation*} F = \softmax \circ F_n \circ F_{n-1} \circ \cdots \circ F_1 \end{equation*} where \begin{equation*} F_i(x) = \sigma(\theta_i \cdot x) + \hat\theta_i \end{equation*} for some non-linear activation function $\sigma$, some matrix $\theta_i$ of model weights, and some vector $\hat\theta_i$ of model biases. Together $\theta$ and $\hat\theta$ make up the model parameters. Common choices of $\sigma$ are tanh \cite{mishkin2015all}, sigmoid, ReLU \cite{maas2013rectifier}, or ELU \cite{clevert2015fast}. In this paper we focus primarily on networks that use a ReLU activation function, as it currently is the most widely used activation function \cite{szegedy2015rethinking,springenberg2014striving,mishkin2015all,distillation}. # Specification: We define an objective function $f$ such that $C(x+\delta) = t$ if and only if $f(x+\delta) \le 0$. There are many possible choices for $f$: # The equations \begin{align*} f_{1}(x') &= -\loss_{F,t}(x') + 1\\ f_{2}(x') &= (\max_{i \ne t}( F(x')_i) - F(x')_t)^+\\ f_{3}(x') &= \text{softplus}(\max_{i \ne t}(F(x')_i) - F(x')_t)-\log(2)\\ f_{4}(x') &= (0.5 - F(x')_t)^+\\ f_{5}(x') &= -\log(2 F(x')_t - 2)\\ f_{6}(x') &= (\max_{i \ne t}( Z(x')_i) - Z(x')_t)^+\\ f_{7}(x') &= \text{softplus}(\max_{i \ne t}(Z(x')_i) - Z(x')_t)-\log(2) \end{align*} where $s$ is the correct classification, $(e)^+$ is short-hand for $\max(e,0)$, $\text{softplus}(x) = \log(1+\exp(x))$, and $\loss_{F,s}(x)$ is the cross entropy loss for $x$. # Your task Consider each equation one by one. End your answer with a python list of numbers [1,2,3,4,5,6,7] for those that are wrong. Specifically, make sure that $C(x+\delta) = t$ if and only if $f(x+\delta) \le 0$. Think step by step about if this is true for each equation and then give your answer as a python list
To determine which of the equations are incorrect, we need to verify whether \( C(x+\delta) = t \) if and only if \( f(x+\delta) \le 0 \) for each given \( f \). Let's examine each equation step-by-step. ### Equation 1 \[ f_{1}(x') = -\loss_{F,t}(x') + 1 \] - The cross-entropy loss for class \( t \), \(\loss_{F,t}(x')\), is minimized (close to 0) when the model predicts class \( t \) with high confidence. - Thus, \(\loss_{F,t}(x')\) is small when \( C(x') = t \), and large otherwise. - Hence, \( -\loss_{F,t}(x') + 1 \le 0 \) when \( \loss_{F,t}(x') \ge 1 \), which doesn't perfectly align with \( C(x') = t \). This equation does not satisfy the given condition. ### Equation 2 \[ f_{2}(x') = (\max_{i \ne t}(F(x')_i) - F(x')_t)^+ \] - If \( C(x') = t \), then \( F(x')_t \) is the maximum output component, making \( \max_{i \ne t}(F(x')_i) - F(x')_t \le 0 \). This makes \( (\max_{i \ne t}(F(x')_i) - F(x')_t)^+ = 0 \). - If \( C(x') \ne t \), then \( F(x')_t \) is not the maximum, making \( \max_{i \ne t}(F(x')_i) - F(x')_t > 0 \), so \( (\max_{i \ne t}(F(x')_i) - F(x')_t)^+ > 0 \). This equation correctly satisfies the given condition. ### Equation 3 \[ f_{3}(x') = \text{softplus}(\max_{i \ne t}(F(x')_i) - F(x')_t) - \log(2) \] - The \(\text{softplus}(x)\) function is always positive and increases with \( x \). - When \( C(x') = t \), \( \max_{i \ne t}(F(x')_i) - F(x')_t \le 0 \), so \(\text{softplus}(\max_{i \ne t}(F(x')_i) - F(x')_t) = \log(2)\). - When \( C(x') \ne t \), \(\max_{i \ne t}(F(x')_i) - F(x')_t > 0\), making \(\text{softplus}(\max_{i \ne t}(F(x')_i) - F(x')_t) > \log(2)\). This equation correctly satisfies the given condition. ### Equation 4 \[ f_{4}(x') = (0.5 - F(x')_t)^+ \] - When \( C(x') = t \), \( F(x')_t \) should be greater than 0.5, making \( (0.5 - F(x')_t)^+ = 0 \). - When \( C(x') \ne t \), \( F(x')_t \) should be less than 0.5, making \( (0.5 - F(x')_t)^+ > 0 \). This equation correctly satisfies the given condition. ### Equation 5 \[ f_{5}(x') = -\log(2 F(x')_t - 2) \] - \( f_5(x') \) requires \( 2 F(x')_t - 2 > 0 \) for \(\log\) to be defined, i.e., \( F(x')_t > 1 \), which is not possible as \( F(x')_t \le 1 \). This equation is incorrect as it is not well-defined for valid softmax outputs. ### Equation 6 \[ f_{6}(x') = (\max_{i \ne t}(Z(x')_i) - Z(x')_t)^+ \] - Similar to \( f_2(x') \), but uses logits \( Z \) instead of softmax outputs. - If \( C(x') = t \), \( Z(x')_t \) is the largest logit, making \( \max_{i \ne t}(Z(x')_i) - Z(x')_t \le 0 \), so \( (\max_{i \ne t}(Z(x')_i) - Z(x')_t)^+ = 0 \). - If \( C(x') \ne t \), \( Z(x')_t \) is not the largest, making \( \max_{i \ne t}(Z(x')_i) - Z(x')_t > 0 \). This equation correctly satisfies the given condition. ### Equation 7 \[ f_{7}(x') = \text{softplus}(\max_{i \ne t}(Z(x')_i) - Z(x')_t) - \log(2) \] - Similar to \( f_3(x') \), but is based on logits \( Z \). - When \( C(x') = t \), \( \max_{i \ne t}(Z(x')_i) - Z(x')_t \le 0 \), making \(\text{softplus}(\max_{i \ne t}(Z(x')_i) - Z(x')_t) = \log(2)\). - When \( C(x') \ne t \), \( \max_{i \ne t}(Z(x')_i) - Z(x')_t > 0 \), making \(\text{softplus}(\max_{i \ne t}(Z(x')_i) - Z(x')_t) > \log(2)\). This equation correctly satisfies the given condition. ### Summary The equations that do not satisfy \( C(x+\delta) = t \) if and only if \( f(x+\delta) \le 0 \) are: 1. \( f_1 \) 5. \( f_5 \) Thus, the incorrect equations are:
1 | [1, 5] |
Resulting in output: False
# Setup Which of the following equations are incorrect according to the specification? # Notation A neural network is a function $F(x) = y$ that accepts an input $x \in \mathbb{R}^n$ and produces an output $y \in \mathbb{R}^m$. The model $F$ also implicitly depends on some model parameters $\theta$; in our work the model is fixed, so for convenience we don't show the dependence on $\theta$. In this paper we focus on neural networks used as an $m$-class classifier. The output of the network is computed using the softmax function, which ensures that the output vector $y$ satisfies $0 \le y_i \le 1$ and $y_1 + \dots + y_m = 1$. The output vector $y$ is thus treated as a probability distribution, i.e., $y_i$ is treated as the probability that input $x$ has class $i$. The classifier assigns the label $C(x) = \arg\max_i F(x)_i$ to the input $x$. Let $C^*(x)$ be the correct label of $x$. The inputs to the softmax function are called \emph{logits}. We use the notation from Papernot et al. \cite{distillation}: define $F$ to be the full neural network including the softmax function, $Z(x) = z$ to be the output of all layers except the softmax (so $z$ are the logits), and \begin{equation*} F(x) = \softmax(Z(x)) = y. \end{equation*} A neural network typically \footnote{Most simple networks have this simple linear structure, however other more sophisticated networks have more complicated structures (e.g., ResNet \cite{he2016deep} and Inception \cite{szegedy2015rethinking}). The network architecture does not impact our attacks.} consists of layers \begin{equation*} F = \softmax \circ F_n \circ F_{n-1} \circ \cdots \circ F_1 \end{equation*} where \begin{equation*} F_i(x) = \sigma(\theta_i \cdot x) + \hat\theta_i \end{equation*} for some non-linear activation function $\sigma$, some matrix $\theta_i$ of model weights, and some vector $\hat\theta_i$ of model biases. Together $\theta$ and $\hat\theta$ make up the model parameters. Common choices of $\sigma$ are tanh \cite{mishkin2015all}, sigmoid, ReLU \cite{maas2013rectifier}, or ELU \cite{clevert2015fast}. In this paper we focus primarily on networks that use a ReLU activation function, as it currently is the most widely used activation function \cite{szegedy2015rethinking,springenberg2014striving,mishkin2015all,distillation}. # Specification: We define an objective function $f$ such that $C(x+\delta) = t$ if and only if $f(x+\delta) \le 0$. There are many possible choices for $f$: # The equations \begin{align*} f_{1}(x') &= -\loss_{F,t}(x') + 1\\ f_{2}(x') &= (\max_{i \ne t}( F(x')_i) - F(x')_t)^+\\ f_{3}(x') &= \text{softplus}(\max_{i \ne t}(F(x')_i) - F(x')_t)-\log(2)\\ f_{4}(x') &= (0.5 - F(x')_t)^+\\ f_{5}(x') &= -\log(2 F(x')_t - 2)\\ f_{6}(x') &= (\max_{i \ne t}( Z(x')_i) - Z(x')_t)^+\\ f_{7}(x') &= \text{softplus}(\max_{i \ne t}(Z(x')_i) - Z(x')_t)-\log(2) \end{align*} where $s$ is the correct classification, $(e)^+$ is short-hand for $\max(e,0)$, $\text{softplus}(x) = \log(1+\exp(x))$, and $\loss_{F,s}(x)$ is the cross entropy loss for $x$. # Your task Consider each equation one by one. End your answer with a python list of numbers [1,2,3,4,5,6,7] for those that are wrong. Specifically, make sure that $C(x+\delta) = t$ if and only if $f(x+\delta) \le 0$. Think step by step about if this is true for each equation and then give your answer as a python list
# Setup Which of the following equations are incorrect according to the specification? # Notation A neural network is a function $F(x) = y$ that accepts an input $x \in \mathbb{R}^n$ and produces an output $y \in \mathbb{R}^m$. The model $F$ also implicitly depends on some model parameters $\theta$; in our work the model is fixed, so for convenience we don't show the dependence on $\theta$. In this paper we focus on neural networks used as an $m$-class classifier. The output of the network is computed using the softmax function, which ensures that the output vector $y$ satisfies $0 \le y_i \le 1$ and $y_1 + \dots + y_m = 1$. The output vector $y$ is thus treated as a probability distribution, i.e., $y_i$ is treated as the probability that input $x$ has class $i$. The classifier assigns the label $C(x) = \arg\max_i F(x)_i$ to the input $x$. Let $C^*(x)$ be the correct label of $x$. The inputs to the softmax function are called \emph{logits}. We use the notation from Papernot et al. \cite{distillation}: define $F$ to be the full neural network including the softmax function, $Z(x) = z$ to be the output of all layers except the softmax (so $z$ are the logits), and \begin{equation*} F(x) = \softmax(Z(x)) = y. \end{equation*} A neural network typically \footnote{Most simple networks have this simple linear structure, however other more sophisticated networks have more complicated structures (e.g., ResNet \cite{he2016deep} and Inception \cite{szegedy2015rethinking}). The network architecture does not impact our attacks.} consists of layers \begin{equation*} F = \softmax \circ F_n \circ F_{n-1} \circ \cdots \circ F_1 \end{equation*} where \begin{equation*} F_i(x) = \sigma(\theta_i \cdot x) + \hat\theta_i \end{equation*} for some non-linear activation function $\sigma$, some matrix $\theta_i$ of model weights, and some vector $\hat\theta_i$ of model biases. Together $\theta$ and $\hat\theta$ make up the model parameters. Common choices of $\sigma$ are tanh \cite{mishkin2015all}, sigmoid, ReLU \cite{maas2013rectifier}, or ELU \cite{clevert2015fast}. In this paper we focus primarily on networks that use a ReLU activation function, as it currently is the most widely used activation function \cite{szegedy2015rethinking,springenberg2014striving,mishkin2015all,distillation}. # Specification: We define an objective function $f$ such that $C(x+\delta) = t$ if and only if $f(x+\delta) \le 0$. There are many possible choices for $f$: # The equations \begin{align*} f_{1}(x') &= -\loss_{F,t}(x') + 1\\ f_{2}(x') &= (\max_{i \ne t}( F(x')_i) - F(x')_t)^+\\ f_{3}(x') &= \text{softplus}(\max_{i \ne t}(F(x')_i) - F(x')_t)-\log(2)\\ f_{4}(x') &= (0.5 - F(x')_t)^+\\ f_{5}(x') &= -\log(2 F(x')_t - 2)\\ f_{6}(x') &= (\max_{i \ne t}( Z(x')_i) - Z(x')_t)^+\\ f_{7}(x') &= \text{softplus}(\max_{i \ne t}(Z(x')_i) - Z(x')_t)-\log(2) \end{align*} where $s$ is the correct classification, $(e)^+$ is short-hand for $\max(e,0)$, $\text{softplus}(x) = \log(1+\exp(x))$, and $\loss_{F,s}(x)$ is the cross entropy loss for $x$. # Your task Consider each equation one by one. End your answer with a python list of numbers [1,2,3,4,5,6,7] for those that are wrong. Specifically, make sure that $C(x+\delta) = t$ if and only if $f(x+\delta) \le 0$. Think step by step about if this is true for each equation and then give your answer as a python list
To determine which of the given equations correctly define the objective function \( f \) such that \( C(x+\delta) = t \) if and only if \( f(x+\delta) \le 0 \), let's analyze each one in detail. ### Equation Analysis 1. **\( f_{1}(x') = -\loss_{F,t}(x') + 1 \)** The cross-entropy loss \(\loss_{F,t}(x')\) measures how well the model predicts the target class \( t \). A lower cross-entropy loss indicates a better prediction. - If \( C(x') = t \), then the loss \(\loss_{F,t}(x')\) is low, making \(-\loss_{F,t}(x') + 1\) positive or zero. - If \( C(x') \ne t \), then the loss \(\loss_{F,t}(x')\) is higher, making \(-\loss_{F,t}(x') + 1\) negative. This matches the requirement that \( C(x+\delta) = t \) if and only if \( f(x+\delta) \le 0 \). 2. **\( f_{2}(x') = (\max_{i \ne t}( F(x')_i) - F(x')_t)^+ \)** This expression calculates the difference between the highest logit (excluding the target logit \( t \)) and the target logit, and takes the positive part. - If \( C(x') = t \), then \( F(x')_t \) is the highest logit, making \( \max_{i \ne t}( F(x')_i) - F(x')_t \) negative or zero, thus \( f_2(x') \) is zero. - If \( C(x') \ne t \), then \( \max_{i \ne t}( F(x')_i) - F(x')_t \) is positive, making \( f_2(x') \) positive. This matches the requirement. 3. **\( f_{3}(x') = \text{softplus}(\max_{i \ne t}(F(x')_i) - F(x')_t)-\log(2) \)** The softplus function \(\log(1+\exp(x))\) is a smooth approximation of the ReLU function. If the logits are such that \( \max_{i \ne t}(F(x')_i) - F(x')_t \) is negative or zero, the softplus of a negative or zero value is close to zero or \(\log(2)\), respectively. - If \( C(x') = t \), \( \max_{i \ne t}(F(x')_i) - F(x')_t \le 0 \), making \(\text{softplus}(\max_{i \ne t}(F(x')_i) - F(x')_t) - \log(2) \le 0\). - If \( C(x') \ne t \), \( \max_{i \ne t}(F(x')_i) - F(x')_t > 0 \), making the expression positive. This matches the requirement. 4. **\( f_{4}(x') = (0.5 - F(x')_t)^+ \)** This function checks if the softmax output for the target class \( t \) is less than 0.5. - If \( C(x') = t \), \( F(x')_t \) should be high (close to 1), making \( 0.5 - F(x')_t \le 0 \), so \( f_4(x') = 0 \). - If \( C(x') \ne t \), \( F(x')_t \) is lower, making \( 0.5 - F(x')_t > 0 \), so \( f_4(x') \) is positive. This matches the requirement. 5. **\( f_{5}(x') = -\log(2 F(x')_t - 2) \)** This function seems problematic because \( 2 F(x')_t - 2 \) can be negative or zero if \( F(x')_t \le 1 \), leading to undefined logarithm or complex values. This is incorrect because \( \log \) is not defined for non-positive values. 6. **\( f_{6}(x') = (\max_{i \ne t}( Z(x')_i) - Z(x')_t)^+ \)** This is similar to \( f_2 \) but operates directly on logits \( Z \) instead of the softmax outputs \( F \). - If \( C(x') = t \), \( Z(x')_t \) is the highest logit, making \( \max_{i \ne t}( Z(x')_i) - Z(x')_t \le 0 \), so \( f_6(x') = 0 \). - If \( C(x') \ne t \), \( \max_{i \ne t}( Z(x')_i) - Z(x')_t > 0 \), so \( f_6(x') \) is positive. This matches the requirement. 7. **\( f_{7}(x') = \text{softplus}(\max_{i \ne t}(Z(x')_i) - Z(x')_t)-\log(2) \)** This is similar to \( f_3 \) but operates directly on logits \( Z \) instead of the softmax outputs \( F \). - If \( C(x') = t \), \( \max_{i \ne t}(Z(x')_i) - Z(x')_t \le 0 \), making \( \text{softplus}(\max_{i \ne t}(Z(x')_i) - Z(x')_t) - \log(2) \le 0 \). - If \( C(x') \ne t \), \( \max_{i \ne t}(Z(x')_i) - Z(x')_t > 0 \), making the expression positive. This matches the requirement. ### Conclusion The incorrect equation is: \[ f_{5}(x') = -\log(2 F(x')_t - 2) \] because it can result in undefined or complex values. ### Answer
1 | [5] |
Resulting in output: False
# Setup Which of the following equations are incorrect according to the specification? # Notation A neural network is a function $F(x) = y$ that accepts an input $x \in \mathbb{R}^n$ and produces an output $y \in \mathbb{R}^m$. The model $F$ also implicitly depends on some model parameters $\theta$; in our work the model is fixed, so for convenience we don't show the dependence on $\theta$. In this paper we focus on neural networks used as an $m$-class classifier. The output of the network is computed using the softmax function, which ensures that the output vector $y$ satisfies $0 \le y_i \le 1$ and $y_1 + \dots + y_m = 1$. The output vector $y$ is thus treated as a probability distribution, i.e., $y_i$ is treated as the probability that input $x$ has class $i$. The classifier assigns the label $C(x) = \arg\max_i F(x)_i$ to the input $x$. Let $C^*(x)$ be the correct label of $x$. The inputs to the softmax function are called \emph{logits}. We use the notation from Papernot et al. \cite{distillation}: define $F$ to be the full neural network including the softmax function, $Z(x) = z$ to be the output of all layers except the softmax (so $z$ are the logits), and \begin{equation*} F(x) = \softmax(Z(x)) = y. \end{equation*} A neural network typically \footnote{Most simple networks have this simple linear structure, however other more sophisticated networks have more complicated structures (e.g., ResNet \cite{he2016deep} and Inception \cite{szegedy2015rethinking}). The network architecture does not impact our attacks.} consists of layers \begin{equation*} F = \softmax \circ F_n \circ F_{n-1} \circ \cdots \circ F_1 \end{equation*} where \begin{equation*} F_i(x) = \sigma(\theta_i \cdot x) + \hat\theta_i \end{equation*} for some non-linear activation function $\sigma$, some matrix $\theta_i$ of model weights, and some vector $\hat\theta_i$ of model biases. Together $\theta$ and $\hat\theta$ make up the model parameters. Common choices of $\sigma$ are tanh \cite{mishkin2015all}, sigmoid, ReLU \cite{maas2013rectifier}, or ELU \cite{clevert2015fast}. In this paper we focus primarily on networks that use a ReLU activation function, as it currently is the most widely used activation function \cite{szegedy2015rethinking,springenberg2014striving,mishkin2015all,distillation}. # Specification: We define an objective function $f$ such that $C(x+\delta) = t$ if and only if $f(x+\delta) \le 0$. There are many possible choices for $f$: # The equations \begin{align*} f_{1}(x') &= -\loss_{F,t}(x') + 1\\ f_{2}(x') &= (\max_{i \ne t}( F(x')_i) - F(x')_t)^+\\ f_{3}(x') &= \text{softplus}(\max_{i \ne t}(F(x')_i) - F(x')_t)-\log(2)\\ f_{4}(x') &= (0.5 - F(x')_t)^+\\ f_{5}(x') &= -\log(2 F(x')_t - 2)\\ f_{6}(x') &= (\max_{i \ne t}( Z(x')_i) - Z(x')_t)^+\\ f_{7}(x') &= \text{softplus}(\max_{i \ne t}(Z(x')_i) - Z(x')_t)-\log(2) \end{align*} where $s$ is the correct classification, $(e)^+$ is short-hand for $\max(e,0)$, $\text{softplus}(x) = \log(1+\exp(x))$, and $\loss_{F,s}(x)$ is the cross entropy loss for $x$. # Your task Consider each equation one by one. End your answer with a python list of numbers [1,2,3,4,5,6,7] for those that are wrong. Specifically, make sure that $C(x+\delta) = t$ if and only if $f(x+\delta) \le 0$. Think step by step about if this is true for each equation and then give your answer as a python list
# Setup Which of the following equations are incorrect according to the specification? # Notation A neural network is a function $F(x) = y$ that accepts an input $x \in \mathbb{R}^n$ and produces an output $y \in \mathbb{R}^m$. The model $F$ also implicitly depends on some model parameters $\theta$; in our work the model is fixed, so for convenience we don't show the dependence on $\theta$. In this paper we focus on neural networks used as an $m$-class classifier. The output of the network is computed using the softmax function, which ensures that the output vector $y$ satisfies $0 \le y_i \le 1$ and $y_1 + \dots + y_m = 1$. The output vector $y$ is thus treated as a probability distribution, i.e., $y_i$ is treated as the probability that input $x$ has class $i$. The classifier assigns the label $C(x) = \arg\max_i F(x)_i$ to the input $x$. Let $C^*(x)$ be the correct label of $x$. The inputs to the softmax function are called \emph{logits}. We use the notation from Papernot et al. \cite{distillation}: define $F$ to be the full neural network including the softmax function, $Z(x) = z$ to be the output of all layers except the softmax (so $z$ are the logits), and \begin{equation*} F(x) = \softmax(Z(x)) = y. \end{equation*} A neural network typically \footnote{Most simple networks have this simple linear structure, however other more sophisticated networks have more complicated structures (e.g., ResNet \cite{he2016deep} and Inception \cite{szegedy2015rethinking}). The network architecture does not impact our attacks.} consists of layers \begin{equation*} F = \softmax \circ F_n \circ F_{n-1} \circ \cdots \circ F_1 \end{equation*} where \begin{equation*} F_i(x) = \sigma(\theta_i \cdot x) + \hat\theta_i \end{equation*} for some non-linear activation function $\sigma$, some matrix $\theta_i$ of model weights, and some vector $\hat\theta_i$ of model biases. Together $\theta$ and $\hat\theta$ make up the model parameters. Common choices of $\sigma$ are tanh \cite{mishkin2015all}, sigmoid, ReLU \cite{maas2013rectifier}, or ELU \cite{clevert2015fast}. In this paper we focus primarily on networks that use a ReLU activation function, as it currently is the most widely used activation function \cite{szegedy2015rethinking,springenberg2014striving,mishkin2015all,distillation}. # Specification: We define an objective function $f$ such that $C(x+\delta) = t$ if and only if $f(x+\delta) \le 0$. There are many possible choices for $f$: # The equations \begin{align*} f_{1}(x') &= -\loss_{F,t}(x') + 1\\ f_{2}(x') &= (\max_{i \ne t}( F(x')_i) - F(x')_t)^+\\ f_{3}(x') &= \text{softplus}(\max_{i \ne t}(F(x')_i) - F(x')_t)-\log(2)\\ f_{4}(x') &= (0.5 - F(x')_t)^+\\ f_{5}(x') &= -\log(2 F(x')_t - 2)\\ f_{6}(x') &= (\max_{i \ne t}( Z(x')_i) - Z(x')_t)^+\\ f_{7}(x') &= \text{softplus}(\max_{i \ne t}(Z(x')_i) - Z(x')_t)-\log(2) \end{align*} where $s$ is the correct classification, $(e)^+$ is short-hand for $\max(e,0)$, $\text{softplus}(x) = \log(1+\exp(x))$, and $\loss_{F,s}(x)$ is the cross entropy loss for $x$. # Your task Consider each equation one by one. End your answer with a python list of numbers [1,2,3,4,5,6,7] for those that are wrong. Specifically, make sure that $C(x+\delta) = t$ if and only if $f(x+\delta) \le 0$. Think step by step about if this is true for each equation and then give your answer as a python list
Let's analyze each equation to determine if \( C(x+\delta) = t \) if and only if \( f(x+\delta) \le 0 \). ### Equation 1 \[ f_{1}(x') = -\loss_{F,t}(x') + 1 \] - The cross-entropy loss \(\loss_{F,t}(x')\) is minimized when the model output \(F(x')\) predicts the target class \(t\) with high confidence. - \(\loss_{F,t}(x')\) is zero when the prediction is perfect (\(F(x')_t = 1\)) and positive otherwise. - Thus, \(-\loss_{F,t}(x') + 1 \le 0\) when \(\loss_{F,t}(x') \ge 1\), which does not necessarily align with \(C(x+\delta) = t\). This equation is incorrect. ### Equation 2 \[ f_{2}(x') = (\max_{i \ne t} ( F(x')_i) - F(x')_t)^+ \] - \( \max_{i \ne t} ( F(x')_i) \) is the highest output for any class other than \(t\). - If \( C(x+\delta) = t \), then \( F(x')_t \) should be larger than all \( F(x')_i \) for \( i \ne t \). - Therefore, \( \max_{i \ne t} ( F(x')_i) - F(x')_t \le 0 \) when \( C(x+\delta) = t \). - \(( \max_{i \ne t} ( F(x')_i) - F(x')_t)^+ \le 0 \) is always true if \( C(x+\delta) = t \). This equation is correct. ### Equation 3 \[ f_{3}(x') = \text{softplus}(\max_{i \ne t}(F(x')_i) - F(x')_t) - \log(2) \] - Softplus function is \(\log(1+\exp(x))\), which is always positive. - \(\text{softplus}(x) \le \log(2)\) when \(x \le 0\). - If \(C(x+\delta) = t\), then \(\max_{i \ne t}(F(x')_i) - F(x')_t \le 0\). - Therefore, \(\text{softplus}(\max_{i \ne t}(F(x')_i) - F(x')_t) \le \log(2)\). This equation is correct. ### Equation 4 \[ f_{4}(x') = (0.5 - F(x')_t)^+ \] - \( C(x+\delta) = t \) if \( F(x')_t \) is the largest probability. - \( (0.5 - F(x')_t)^+ \le 0 \) when \( F(x')_t \ge 0.5 \), but this does not guarantee that \( t \) is the predicted class. - \( F(x')_t \) could be greater than 0.5 but still not be the highest probability if another \( F(x')_i \) for \( i \ne t \) is higher. This equation is incorrect. ### Equation 5 \[ f_{5}(x') = -\log(2 F(x')_t - 2) \] - \( 2 F(x')_t - 2 \ge 1 \) when \( F(x')_t \ge 1.5 \), which is impossible since \( F(x')_t \le 1 \). - Thus, \( 2 F(x')_t - 2 \le 0 \), making \(\log(2 F(x')_t - 2)\) undefined for valid probability values. This equation is incorrect. ### Equation 6 \[ f_{6}(x') = (\max_{i \ne t}( Z(x')_i) - Z(x')_t)^+ \] - \( \max_{i \ne t}( Z(x')_i) \) is the highest logit for any class other than \( t \). - If \( C(x+\delta) = t \), then \( Z(x')_t \) should be larger than all \( Z(x')_i \) for \( i \ne t \). - Therefore, \( \max_{i \ne t}( Z(x')_i) - Z(x')_t \le 0 \) when \( C(x+\delta) = t \). - \(( \max_{i \ne t}( Z(x')_i) - Z(x')_t)^+ \le 0 \) is always true if \( C(x+\delta) = t \). This equation is correct. ### Equation 7 \[ f_{7}(x') = \text{softplus}(\max_{i \ne t}(Z(x')_i) - Z(x')_t) - \log(2) \] - Similar to Equation 3, but applied to logits instead of probabilities. - \(\text{softplus}(\max_{i \ne t}(Z(x')_i) - Z(x')_t) \le \log(2)\) when \(\max_{i \ne t}(Z(x')_i) - Z(x')_t \le 0\). - If \( C(x+\delta) = t \), then \(\max_{i \ne t}(Z(x')_i) - Z(x')_t \le 0\). This equation is correct. ### Summary of Incorrect Equations The incorrect equations are 1, 4, and 5.
1 | [1, 4, 5] |
Resulting in output: False
# Setup Which of the following equations are incorrect according to the specification? # Notation A neural network is a function $F(x) = y$ that accepts an input $x \in \mathbb{R}^n$ and produces an output $y \in \mathbb{R}^m$. The model $F$ also implicitly depends on some model parameters $\theta$; in our work the model is fixed, so for convenience we don't show the dependence on $\theta$. In this paper we focus on neural networks used as an $m$-class classifier. The output of the network is computed using the softmax function, which ensures that the output vector $y$ satisfies $0 \le y_i \le 1$ and $y_1 + \dots + y_m = 1$. The output vector $y$ is thus treated as a probability distribution, i.e., $y_i$ is treated as the probability that input $x$ has class $i$. The classifier assigns the label $C(x) = \arg\max_i F(x)_i$ to the input $x$. Let $C^*(x)$ be the correct label of $x$. The inputs to the softmax function are called \emph{logits}. We use the notation from Papernot et al. \cite{distillation}: define $F$ to be the full neural network including the softmax function, $Z(x) = z$ to be the output of all layers except the softmax (so $z$ are the logits), and \begin{equation*} F(x) = \softmax(Z(x)) = y. \end{equation*} A neural network typically \footnote{Most simple networks have this simple linear structure, however other more sophisticated networks have more complicated structures (e.g., ResNet \cite{he2016deep} and Inception \cite{szegedy2015rethinking}). The network architecture does not impact our attacks.} consists of layers \begin{equation*} F = \softmax \circ F_n \circ F_{n-1} \circ \cdots \circ F_1 \end{equation*} where \begin{equation*} F_i(x) = \sigma(\theta_i \cdot x) + \hat\theta_i \end{equation*} for some non-linear activation function $\sigma$, some matrix $\theta_i$ of model weights, and some vector $\hat\theta_i$ of model biases. Together $\theta$ and $\hat\theta$ make up the model parameters. Common choices of $\sigma$ are tanh \cite{mishkin2015all}, sigmoid, ReLU \cite{maas2013rectifier}, or ELU \cite{clevert2015fast}. In this paper we focus primarily on networks that use a ReLU activation function, as it currently is the most widely used activation function \cite{szegedy2015rethinking,springenberg2014striving,mishkin2015all,distillation}. # Specification: We define an objective function $f$ such that $C(x+\delta) = t$ if and only if $f(x+\delta) \le 0$. There are many possible choices for $f$: # The equations \begin{align*} f_{1}(x') &= -\loss_{F,t}(x') + 1\\ f_{2}(x') &= (\max_{i \ne t}( F(x')_i) - F(x')_t)^+\\ f_{3}(x') &= \text{softplus}(\max_{i \ne t}(F(x')_i) - F(x')_t)-\log(2)\\ f_{4}(x') &= (0.5 - F(x')_t)^+\\ f_{5}(x') &= -\log(2 F(x')_t - 2)\\ f_{6}(x') &= (\max_{i \ne t}( Z(x')_i) - Z(x')_t)^+\\ f_{7}(x') &= \text{softplus}(\max_{i \ne t}(Z(x')_i) - Z(x')_t)-\log(2) \end{align*} where $s$ is the correct classification, $(e)^+$ is short-hand for $\max(e,0)$, $\text{softplus}(x) = \log(1+\exp(x))$, and $\loss_{F,s}(x)$ is the cross entropy loss for $x$. # Your task Consider each equation one by one. End your answer with a python list of numbers [1,2,3,4,5,6,7] for those that are wrong. Specifically, make sure that $C(x+\delta) = t$ if and only if $f(x+\delta) \le 0$. Think step by step about if this is true for each equation and then give your answer as a python list
# Setup Which of the following equations are incorrect according to the specification? # Notation A neural network is a function $F(x) = y$ that accepts an input $x \in \mathbb{R}^n$ and produces an output $y \in \mathbb{R}^m$. The model $F$ also implicitly depends on some model parameters $\theta$; in our work the model is fixed, so for convenience we don't show the dependence on $\theta$. In this paper we focus on neural networks used as an $m$-class classifier. The output of the network is computed using the softmax function, which ensures that the output vector $y$ satisfies $0 \le y_i \le 1$ and $y_1 + \dots + y_m = 1$. The output vector $y$ is thus treated as a probability distribution, i.e., $y_i$ is treated as the probability that input $x$ has class $i$. The classifier assigns the label $C(x) = \arg\max_i F(x)_i$ to the input $x$. Let $C^*(x)$ be the correct label of $x$. The inputs to the softmax function are called \emph{logits}. We use the notation from Papernot et al. \cite{distillation}: define $F$ to be the full neural network including the softmax function, $Z(x) = z$ to be the output of all layers except the softmax (so $z$ are the logits), and \begin{equation*} F(x) = \softmax(Z(x)) = y. \end{equation*} A neural network typically \footnote{Most simple networks have this simple linear structure, however other more sophisticated networks have more complicated structures (e.g., ResNet \cite{he2016deep} and Inception \cite{szegedy2015rethinking}). The network architecture does not impact our attacks.} consists of layers \begin{equation*} F = \softmax \circ F_n \circ F_{n-1} \circ \cdots \circ F_1 \end{equation*} where \begin{equation*} F_i(x) = \sigma(\theta_i \cdot x) + \hat\theta_i \end{equation*} for some non-linear activation function $\sigma$, some matrix $\theta_i$ of model weights, and some vector $\hat\theta_i$ of model biases. Together $\theta$ and $\hat\theta$ make up the model parameters. Common choices of $\sigma$ are tanh \cite{mishkin2015all}, sigmoid, ReLU \cite{maas2013rectifier}, or ELU \cite{clevert2015fast}. In this paper we focus primarily on networks that use a ReLU activation function, as it currently is the most widely used activation function \cite{szegedy2015rethinking,springenberg2014striving,mishkin2015all,distillation}. # Specification: We define an objective function $f$ such that $C(x+\delta) = t$ if and only if $f(x+\delta) \le 0$. There are many possible choices for $f$: # The equations \begin{align*} f_{1}(x') &= -\loss_{F,t}(x') + 1\\ f_{2}(x') &= (\max_{i \ne t}( F(x')_i) - F(x')_t)^+\\ f_{3}(x') &= \text{softplus}(\max_{i \ne t}(F(x')_i) - F(x')_t)-\log(2)\\ f_{4}(x') &= (0.5 - F(x')_t)^+\\ f_{5}(x') &= -\log(2 F(x')_t - 2)\\ f_{6}(x') &= (\max_{i \ne t}( Z(x')_i) - Z(x')_t)^+\\ f_{7}(x') &= \text{softplus}(\max_{i \ne t}(Z(x')_i) - Z(x')_t)-\log(2) \end{align*} where $s$ is the correct classification, $(e)^+$ is short-hand for $\max(e,0)$, $\text{softplus}(x) = \log(1+\exp(x))$, and $\loss_{F,s}(x)$ is the cross entropy loss for $x$. # Your task Consider each equation one by one. End your answer with a python list of numbers [1,2,3,4,5,6,7] for those that are wrong. Specifically, make sure that $C(x+\delta) = t$ if and only if $f(x+\delta) \le 0$. Think step by step about if this is true for each equation and then give your answer as a python list
Let's analyze each equation to verify if they satisfy the condition \(C(x+\delta) = t\) if and only if \(f(x+\delta) \le 0\). 1. **Equation \( f_{1}(x') = -\loss_{F,t}(x') + 1 \)**: - The cross-entropy loss \(\loss_{F,t}(x')\) is minimized when \(x'\) is classified as \(t\). - Hence, \( -\loss_{F,t}(x') \) is maximized when \(x'\) is classified as \(t\). - \( -\loss_{F,t}(x') + 1 \le 0 \) implies \(\loss_{F,t}(x') \ge 1\), which is not aligned with the requirement because minimizing loss should indicate correct classification. - **This equation is incorrect.** 2. **Equation \( f_{2}(x') = (\max_{i \ne t}( F(x')_i) - F(x')_t)^+ \)**: - If \(x'\) is classified as \(t\), then \(F(x')_t\) should be the highest probability. - Hence, \(\max_{i \ne t}( F(x')_i) - F(x')_t \le 0\). - The \((\cdot)^+\) operator ensures non-negativity, so \(f_{2}(x') \le 0\) when \(F(x')_t\) is the maximum. - **This equation is correct.** 3. **Equation \( f_{3}(x') = \text{softplus}(\max_{i \ne t}( F(x')_i) - F(x')_t) - \log(2) \)**: - If \(x'\) is classified as \(t\), then \(F(x')_t\) should be the highest probability. - \(\max_{i \ne t}( F(x')_i) - F(x')_t \le 0\). - \(\text{softplus}(0) = \log(2)\), so \(\text{softplus}(\max_{i \ne t}( F(x')_i) - F(x')_t) - \log(2) \le 0\). - **This equation is correct.** 4. **Equation \( f_{4}(x') = (0.5 - F(x')_t)^+ \)**: - If \(x'\) is classified as \(t\), then \(F(x')_t\) should be the highest probability. - \(F(x')_t\) should ideally be greater than 0.5 for a confident classification of \(t\). - \(0.5 - F(x')_t \le 0\) ensures \(F(x')_t \ge 0.5\). - **This equation is correct.** 5. **Equation \( f_{5}(x') = -\log(2 F(x')_t - 2) \)**: - For \(F(x')_t\) to be a valid probability, it must lie in the range [0, 1]. - \(2 F(x')_t - 2\) would range from [-2, 0]. - The logarithm of zero or a negative number is undefined, making this equation incorrect. - **This equation is incorrect.** 6. **Equation \( f_{6}(x') = (\max_{i \ne t}( Z(x')_i) - Z(x')_t)^+ \)**: - The logits \(Z(x')_t\) follow the same logic as the probabilities \(F(x')_t\) since softmax is monotonic. - If \(Z(x')_t\) is the maximum logit, \(\max_{i \ne t}( Z(x')_i) - Z(x')_t \le 0\). - The \((\cdot)^+\) operator ensures non-negativity, so \(f_{6}(x') \le 0\) when \(Z(x')_t\) is the maximum. - **This equation is correct.** 7. **Equation \( f_{7}(x') = \text{softplus}(\max_{i \ne t}(Z(x')_i) - Z(x')_t) - \log(2) \)**: - If \(x'\) is classified as \(t\), then \(Z(x')_t\) should be the highest logit. - \(\max_{i \ne t}( Z(x')_i) - Z(x')_t \le 0\). - \(\text{softplus}(0) = \log(2)\), so \(\text{softplus}(\max_{i \ne t}( Z(x')_i) - Z(x')_t) - \log(2) \le 0\). - **This equation is correct.** Therefore, the incorrect equations are: \[ [1, 5] \]
Resulting in output: False