# Setup Which of the following equations are incorrect according to the specification? # Notation A neural network is a function $F(x) = y$ that accepts an input $x \in \mathbb{R}^n$ and produces an output $y \in \mathbb{R}^m$. The model $F$ also implicitly depends on some model parameters $\theta$; in our work the model is fixed, so for convenience we don't show the dependence on $\theta$. In this paper we focus on neural networks used as an $m$-class classifier. The output of the network is computed using the softmax function, which ensures that the output vector $y$ satisfies $0 \le y_i \le 1$ and $y_1 + \dots + y_m = 1$. The output vector $y$ is thus treated as a probability distribution, i.e., $y_i$ is treated as the probability that input $x$ has class $i$. The classifier assigns the label $C(x) = \arg\max_i F(x)_i$ to the input $x$. Let $C^*(x)$ be the correct label of $x$. The inputs to the softmax function are called \emph{logits}. We use the notation from Papernot et al. \cite{distillation}: define $F$ to be the full neural network including the softmax function, $Z(x) = z$ to be the output of all layers except the softmax (so $z$ are the logits), and \begin{equation*} F(x) = \softmax(Z(x)) = y. \end{equation*} A neural network typically \footnote{Most simple networks have this simple linear structure, however other more sophisticated networks have more complicated structures (e.g., ResNet \cite{he2016deep} and Inception \cite{szegedy2015rethinking}). The network architecture does not impact our attacks.} consists of layers \begin{equation*} F = \softmax \circ F_n \circ F_{n-1} \circ \cdots \circ F_1 \end{equation*} where \begin{equation*} F_i(x) = \sigma(\theta_i \cdot x) + \hat\theta_i \end{equation*} for some non-linear activation function $\sigma$, some matrix $\theta_i$ of model weights, and some vector $\hat\theta_i$ of model biases. Together $\theta$ and $\hat\theta$ make up the model parameters. Common choices of $\sigma$ are tanh \cite{mishkin2015all}, sigmoid, ReLU \cite{maas2013rectifier}, or ELU \cite{clevert2015fast}. In this paper we focus primarily on networks that use a ReLU activation function, as it currently is the most widely used activation function \cite{szegedy2015rethinking,springenberg2014striving,mishkin2015all,distillation}. # Specification: We define an objective function $f$ such that $C(x+\delta) = t$ if and only if $f(x+\delta) \le 0$. There are many possible choices for $f$: # The equations \begin{align*} f_{1}(x') &= -\loss_{F,t}(x') + 1\\ f_{2}(x') &= (\max_{i \ne t}( F(x')_i) - F(x')_t)^+\\ f_{3}(x') &= \text{softplus}(\max_{i \ne t}(F(x')_i) - F(x')_t)-\log(2)\\ f_{4}(x') &= (0.5 - F(x')_t)^+\\ f_{5}(x') &= -\log(2 F(x')_t - 2)\\ f_{6}(x') &= (\max_{i \ne t}( Z(x')_i) - Z(x')_t)^+\\ f_{7}(x') &= \text{softplus}(\max_{i \ne t}(Z(x')_i) - Z(x')_t)-\log(2) \end{align*} where $s$ is the correct classification, $(e)^+$ is short-hand for $\max(e,0)$, $\text{softplus}(x) = \log(1+\exp(x))$, and $\loss_{F,s}(x)$ is the cross entropy loss for $x$. # Your task Consider each equation one by one. End your answer with a python list of numbers [1,2,3,4,5,6,7] for those that are wrong. Specifically, make sure that $C(x+\delta) = t$ if and only if $f(x+\delta) \le 0$. Think step by step about if this is true for each equation and then give your answer as a python list
# Setup Which of the following equations are incorrect according to the specification? # Notation A neural network is a function $F(x) = y$ that accepts an input $x \in \mathbb{R}^n$ and produces an output $y \in \mathbb{R}^m$. The model $F$ also implicitly depends on some model parameters $\theta$; in our work the model is fixed, so for convenience we don't show the dependence on $\theta$. In this paper we focus on neural networks used as an $m$-class classifier. The output of the network is computed using the softmax function, which ensures that the output vector $y$ satisfies $0 \le y_i \le 1$ and $y_1 + \dots + y_m = 1$. The output vector $y$ is thus treated as a probability distribution, i.e., $y_i$ is treated as the probability that input $x$ has class $i$. The classifier assigns the label $C(x) = \arg\max_i F(x)_i$ to the input $x$. Let $C^*(x)$ be the correct label of $x$. The inputs to the softmax function are called \emph{logits}. We use the notation from Papernot et al. \cite{distillation}: define $F$ to be the full neural network including the softmax function, $Z(x) = z$ to be the output of all layers except the softmax (so $z$ are the logits), and \begin{equation*} F(x) = \softmax(Z(x)) = y. \end{equation*} A neural network typically \footnote{Most simple networks have this simple linear structure, however other more sophisticated networks have more complicated structures (e.g., ResNet \cite{he2016deep} and Inception \cite{szegedy2015rethinking}). The network architecture does not impact our attacks.} consists of layers \begin{equation*} F = \softmax \circ F_n \circ F_{n-1} \circ \cdots \circ F_1 \end{equation*} where \begin{equation*} F_i(x) = \sigma(\theta_i \cdot x) + \hat\theta_i \end{equation*} for some non-linear activation function $\sigma$, some matrix $\theta_i$ of model weights, and some vector $\hat\theta_i$ of model biases. Together $\theta$ and $\hat\theta$ make up the model parameters. Common choices of $\sigma$ are tanh \cite{mishkin2015all}, sigmoid, ReLU \cite{maas2013rectifier}, or ELU \cite{clevert2015fast}. In this paper we focus primarily on networks that use a ReLU activation function, as it currently is the most widely used activation function \cite{szegedy2015rethinking,springenberg2014striving,mishkin2015all,distillation}. # Specification: We define an objective function $f$ such that $C(x+\delta) = t$ if and only if $f(x+\delta) \le 0$. There are many possible choices for $f$: # The equations \begin{align*} f_{1}(x') &= -\loss_{F,t}(x') + 1\\ f_{2}(x') &= (\max_{i \ne t}( F(x')_i) - F(x')_t)^+\\ f_{3}(x') &= \text{softplus}(\max_{i \ne t}(F(x')_i) - F(x')_t)-\log(2)\\ f_{4}(x') &= (0.5 - F(x')_t)^+\\ f_{5}(x') &= -\log(2 F(x')_t - 2)\\ f_{6}(x') &= (\max_{i \ne t}( Z(x')_i) - Z(x')_t)^+\\ f_{7}(x') &= \text{softplus}(\max_{i \ne t}(Z(x')_i) - Z(x')_t)-\log(2) \end{align*} where $s$ is the correct classification, $(e)^+$ is short-hand for $\max(e,0)$, $\text{softplus}(x) = \log(1+\exp(x))$, and $\loss_{F,s}(x)$ is the cross entropy loss for $x$. # Your task Consider each equation one by one. End your answer with a python list of numbers [1,2,3,4,5,6,7] for those that are wrong. Specifically, make sure that $C(x+\delta) = t$ if and only if $f(x+\delta) \le 0$. Think step by step about if this is true for each equation and then give your answer as a python list
To determine which of the given equations are incorrect according to the specification, we need to evaluate each equation in the context of the condition $C(x+\delta) = t$ if and only if $f(x+\delta) \le 0$. This means that for $C(x+\delta)$ to equal $t$, the function $f(x+\delta)$ should be less than or equal to zero, and for $C(x+\delta)$ not to equal $t$, $f(x+\delta)$ should be greater than zero. Let's examine each equation: 1. $f_{1}(x') = -\loss_{F,t}(x') + 1$ - The cross-entropy loss $\loss_{F,t}(x')$ is minimized when $x'$ is correctly classified as $t$. Therefore, $-\loss_{F,t}(x')$ is maximized when $x'$ is correctly classified as $t$. Adding 1 shifts this value, but the condition $f_{1}(x') \le 0$ implies that the loss must be greater than or equal to 1 for $C(x') = t$, which doesn't directly align with the minimization of loss for correct classification. This seems incorrect based on the typical use of cross-entropy loss. 2. $f_{2}(x') = (\max_{i \ne t}( F(x')_i) - F(x')_t)^+$ - This function is 0 if and only if $F(x')_t \ge \max_{i \ne t}( F(x')_i)$, meaning $x'$ is classified as $t$. Otherwise, it's positive. This aligns with the condition. 3. $f_{3}(x') = \text{softplus}(\max_{i \ne t}(F(x')_i) - F(x')_t)-\log(2)$ - The softplus function is always positive, and $\log(2)$ is a constant. This function will be less than or equal to zero if $\max_{i \ne t}(F(x')_i) - F(x')_t$ is sufficiently negative, which happens when $F(x')_t$ is the largest, aligning with the condition for $C(x') = t$. 4. $f_{4}(x') = (0.5 - F(x')_t)^+$ - This function is less than or equal to zero if $F(x')_t \ge 0.5$, which means the model is at least 50% confident that $x'$ belongs to class $t$. However, the classification $C(x') = t$ only requires $F(x')_t$ to be the largest among all classes, not necessarily greater than or equal to 0.5. This does not perfectly align with the condition. 5. $f_{5}(x') = -\log(2 F(x')_t - 2)$ - For this to be less than or equal to zero, $2 F(x')_t - 2$ must be less than or equal to 1 (since $\log(1) = 0$ and $\log(x)$ for $x < 1$ is negative), implying $F(x')_t \le 1.5$. However, this function will be undefined if $2F(x')_t - 2 \le 0$ because the log of a non-positive number is undefined. This function seems to be incorrect as it doesn't directly relate to the condition $C(x') = t$ in a straightforward manner and has domain issues. 6. $f_{6}(x') = (\max_{i \ne t}( Z(x')_i) - Z(x')_t)^+$ - This function operates on the logits $Z(x')$ instead of the softmax outputs $F(x')$. It will be 0 if and only if $Z(x')_t \ge \max_{i \ne t}(Z(x')_i)$, which aligns with $C(x') = t$ because the softmax function is monotonically increasing. 7. $f_{7}(x') = \text{softplus}(\max_{i \ne t}(Z(x')_i) - Z(x')_t)-\log(2)$ - Similar to $f_3$, but operating on logits. It will be less than or equal to zero if $Z(x')_t$ is sufficiently larger than $\max_{i \ne t}(Z(x')_i)$, which aligns with the condition for $C(x') = t$. Based on the analysis: - $f_1$ seems incorrect because it doesn't directly relate to minimizing loss for correct classification in the context given. - $f_4$ is incorrect because it imposes a stricter condition (confidence of at least 50%) than necessary for $C(x') = t$. - $f_5$ is incorrect due to its domain issues and not directly aligning with the classification condition. Therefore, the incorrect equations according to the specification are:
1 | [1, 4, 5] |
Resulting in output: False