# Setup Which of the following equations are incorrect according to the specification? # Notation A neural network is a function $F(x) = y$ that accepts an input $x \in \mathbb{R}^n$ and produces an output $y \in \mathbb{R}^m$. The model $F$ also implicitly depends on some model parameters $\theta$; in our work the model is fixed, so for convenience we don't show the dependence on $\theta$. In this paper we focus on neural networks used as an $m$-class classifier. The output of the network is computed using the softmax function, which ensures that the output vector $y$ satisfies $0 \le y_i \le 1$ and $y_1 + \dots + y_m = 1$. The output vector $y$ is thus treated as a probability distribution, i.e., $y_i$ is treated as the probability that input $x$ has class $i$. The classifier assigns the label $C(x) = \arg\max_i F(x)_i$ to the input $x$. Let $C^*(x)$ be the correct label of $x$. The inputs to the softmax function are called \emph{logits}. We use the notation from Papernot et al. \cite{distillation}: define $F$ to be the full neural network including the softmax function, $Z(x) = z$ to be the output of all layers except the softmax (so $z$ are the logits), and \begin{equation*} F(x) = \softmax(Z(x)) = y. \end{equation*} A neural network typically \footnote{Most simple networks have this simple linear structure, however other more sophisticated networks have more complicated structures (e.g., ResNet \cite{he2016deep} and Inception \cite{szegedy2015rethinking}). The network architecture does not impact our attacks.} consists of layers \begin{equation*} F = \softmax \circ F_n \circ F_{n-1} \circ \cdots \circ F_1 \end{equation*} where \begin{equation*} F_i(x) = \sigma(\theta_i \cdot x) + \hat\theta_i \end{equation*} for some non-linear activation function $\sigma$, some matrix $\theta_i$ of model weights, and some vector $\hat\theta_i$ of model biases. Together $\theta$ and $\hat\theta$ make up the model parameters. Common choices of $\sigma$ are tanh \cite{mishkin2015all}, sigmoid, ReLU \cite{maas2013rectifier}, or ELU \cite{clevert2015fast}. In this paper we focus primarily on networks that use a ReLU activation function, as it currently is the most widely used activation function \cite{szegedy2015rethinking,springenberg2014striving,mishkin2015all,distillation}. # Specification: We define an objective function $f$ such that $C(x+\delta) = t$ if and only if $f(x+\delta) \le 0$. There are many possible choices for $f$: # The equations \begin{align*} f_{1}(x') &= -\loss_{F,t}(x') + 1\\ f_{2}(x') &= (\max_{i \ne t}( F(x')_i) - F(x')_t)^+\\ f_{3}(x') &= \text{softplus}(\max_{i \ne t}(F(x')_i) - F(x')_t)-\log(2)\\ f_{4}(x') &= (0.5 - F(x')_t)^+\\ f_{5}(x') &= -\log(2 F(x')_t - 2)\\ f_{6}(x') &= (\max_{i \ne t}( Z(x')_i) - Z(x')_t)^+\\ f_{7}(x') &= \text{softplus}(\max_{i \ne t}(Z(x')_i) - Z(x')_t)-\log(2) \end{align*} where $s$ is the correct classification, $(e)^+$ is short-hand for $\max(e,0)$, $\text{softplus}(x) = \log(1+\exp(x))$, and $\loss_{F,s}(x)$ is the cross entropy loss for $x$. # Your task Consider each equation one by one. End your answer with a python list of numbers [1,2,3,4,5,6,7] for those that are wrong.
# Setup Which of the following equations are incorrect according to the specification? # Notation A neural network is a function $F(x) = y$ that accepts an input $x \in \mathbb{R}^n$ and produces an output $y \in \mathbb{R}^m$. The model $F$ also implicitly depends on some model parameters $\theta$; in our work the model is fixed, so for convenience we don't show the dependence on $\theta$. In this paper we focus on neural networks used as an $m$-class classifier. The output of the network is computed using the softmax function, which ensures that the output vector $y$ satisfies $0 \le y_i \le 1$ and $y_1 + \dots + y_m = 1$. The output vector $y$ is thus treated as a probability distribution, i.e., $y_i$ is treated as the probability that input $x$ has class $i$. The classifier assigns the label $C(x) = \arg\max_i F(x)_i$ to the input $x$. Let $C^*(x)$ be the correct label of $x$. The inputs to the softmax function are called \emph{logits}. We use the notation from Papernot et al. \cite{distillation}: define $F$ to be the full neural network including the softmax function, $Z(x) = z$ to be the output of all layers except the softmax (so $z$ are the logits), and \begin{equation*} F(x) = \softmax(Z(x)) = y. \end{equation*} A neural network typically \footnote{Most simple networks have this simple linear structure, however other more sophisticated networks have more complicated structures (e.g., ResNet \cite{he2016deep} and Inception \cite{szegedy2015rethinking}). The network architecture does not impact our attacks.} consists of layers \begin{equation*} F = \softmax \circ F_n \circ F_{n-1} \circ \cdots \circ F_1 \end{equation*} where \begin{equation*} F_i(x) = \sigma(\theta_i \cdot x) + \hat\theta_i \end{equation*} for some non-linear activation function $\sigma$, some matrix $\theta_i$ of model weights, and some vector $\hat\theta_i$ of model biases. Together $\theta$ and $\hat\theta$ make up the model parameters. Common choices of $\sigma$ are tanh \cite{mishkin2015all}, sigmoid, ReLU \cite{maas2013rectifier}, or ELU \cite{clevert2015fast}. In this paper we focus primarily on networks that use a ReLU activation function, as it currently is the most widely used activation function \cite{szegedy2015rethinking,springenberg2014striving,mishkin2015all,distillation}. # Specification: We define an objective function $f$ such that $C(x+\delta) = t$ if and only if $f(x+\delta) \le 0$. There are many possible choices for $f$: # The equations \begin{align*} f_{1}(x') &= -\loss_{F,t}(x') + 1\\ f_{2}(x') &= (\max_{i \ne t}( F(x')_i) - F(x')_t)^+\\ f_{3}(x') &= \text{softplus}(\max_{i \ne t}(F(x')_i) - F(x')_t)-\log(2)\\ f_{4}(x') &= (0.5 - F(x')_t)^+\\ f_{5}(x') &= -\log(2 F(x')_t - 2)\\ f_{6}(x') &= (\max_{i \ne t}( Z(x')_i) - Z(x')_t)^+\\ f_{7}(x') &= \text{softplus}(\max_{i \ne t}(Z(x')_i) - Z(x')_t)-\log(2) \end{align*} where $s$ is the correct classification, $(e)^+$ is short-hand for $\max(e,0)$, $\text{softplus}(x) = \log(1+\exp(x))$, and $\loss_{F,s}(x)$ is the cross entropy loss for $x$. # Your task Consider each equation one by one. End your answer with a python list of numbers [1,2,3,4,5,6,7] for those that are wrong.
Let's analyze each equation to see if it satisfies the condition $C(x+\delta) = t$ if and only if $f(x+\delta) \le 0$. We will denote $x' = x + \delta$ for brevity. 1. $f_1(x') = -\loss_{F,t}(x') + 1$. Cross-entropy loss is minimized when the predicted probability for the true class is close to 1. If $C(x') = t$, then $F(x')_t$ is the largest probability, and the loss is minimized. However, we don't know if $f_1(x') \le 0$. For example, if $F(x')_t$ is very close to 1, then $-\loss_{F,t}(x')$ is close to 0, and $f_1(x')$ will be close to 1, which is greater than 0. This means $f_1$ isn't guaranteed to be less than or equal to 0 even when the classification is correct. Conversely, if $f_1(x') \le 0$, it implies $-\loss_{F,t}(x') \le -1$, or $\loss_{F,t}(x') \ge 1$. This doesn't guarantee that $C(x') = t$. **Incorrect.** 2. $f_2(x') = (\max_{i \ne t}(F(x')_i) - F(x')_t)^+$. If $C(x') = t$, then $F(x')_t$ is the maximum, so $\max_{i \ne t}(F(x')_i) - F(x')_t \le 0$, and thus $f_2(x') = 0$. Conversely, if $f_2(x') \le 0$, then since it's a positive part, we must have $\max_{i \ne t}(F(x')_i) - F(x')_t \le 0$, which means $F(x')_t$ is the maximum, so $C(x') = t$. **Correct.** 3. $f_3(x') = \text{softplus}(\max_{i \ne t}(F(x')_i) - F(x')_t) - \log(2)$. If $C(x') = t$, then $\max_{i \ne t}(F(x')_i) - F(x')_t \le 0$. Since softplus is monotonically increasing and $\text{softplus}(0) = \log(2)$, we have $f_3(x') \le 0$. If $f_3(x') \le 0$, then $\text{softplus}(\max_{i \ne t}(F(x')_i) - F(x')_t) \le \log(2)$. Since softplus is monotonically increasing and invertible, we have $\max_{i \ne t}(F(x')_i) - F(x')_t \le 0$, which implies $C(x') = t$. **Correct.** 4. $f_4(x') = (0.5 - F(x')_t)^+$. If $C(x') = t$, we don't necessarily have $F(x')_t \ge 0.5$. So $f_4(x')$ might be greater than 0. Conversely, if $f_4(x') \le 0$, then $F(x')_t \ge 0.5$, but that doesn't guarantee $C(x') = t$. **Incorrect.** 5. $f_5(x') = -\log(2F(x')_t - 2)$. This function isn't even defined if $F(x')_t = 0.5$ or $F(x')_t < 0.5$, so it's not a valid objective function. **Incorrect.** 6. $f_6(x') = (\max_{i \ne t}(Z(x')_i) - Z(x')_t)^+$. Since the softmax function preserves order, this is equivalent to $f_2(x')$. **Correct.** 7. $f_7(x') = \text{softplus}(\max_{i \ne t}(Z(x')_i) - Z(x')_t) - \log(2)$. Since the softmax function preserves order, this is equivalent to $f_3(x')$. **Correct.** Final Answer: The final answer is $\boxed{[1, 4, 5]}$
Resulting in output: False
# Setup Which of the following equations are incorrect according to the specification? # Notation A neural network is a function $F(x) = y$ that accepts an input $x \in \mathbb{R}^n$ and produces an output $y \in \mathbb{R}^m$. The model $F$ also implicitly depends on some model parameters $\theta$; in our work the model is fixed, so for convenience we don't show the dependence on $\theta$. In this paper we focus on neural networks used as an $m$-class classifier. The output of the network is computed using the softmax function, which ensures that the output vector $y$ satisfies $0 \le y_i \le 1$ and $y_1 + \dots + y_m = 1$. The output vector $y$ is thus treated as a probability distribution, i.e., $y_i$ is treated as the probability that input $x$ has class $i$. The classifier assigns the label $C(x) = \arg\max_i F(x)_i$ to the input $x$. Let $C^*(x)$ be the correct label of $x$. The inputs to the softmax function are called \emph{logits}. We use the notation from Papernot et al. \cite{distillation}: define $F$ to be the full neural network including the softmax function, $Z(x) = z$ to be the output of all layers except the softmax (so $z$ are the logits), and \begin{equation*} F(x) = \softmax(Z(x)) = y. \end{equation*} A neural network typically \footnote{Most simple networks have this simple linear structure, however other more sophisticated networks have more complicated structures (e.g., ResNet \cite{he2016deep} and Inception \cite{szegedy2015rethinking}). The network architecture does not impact our attacks.} consists of layers \begin{equation*} F = \softmax \circ F_n \circ F_{n-1} \circ \cdots \circ F_1 \end{equation*} where \begin{equation*} F_i(x) = \sigma(\theta_i \cdot x) + \hat\theta_i \end{equation*} for some non-linear activation function $\sigma$, some matrix $\theta_i$ of model weights, and some vector $\hat\theta_i$ of model biases. Together $\theta$ and $\hat\theta$ make up the model parameters. Common choices of $\sigma$ are tanh \cite{mishkin2015all}, sigmoid, ReLU \cite{maas2013rectifier}, or ELU \cite{clevert2015fast}. In this paper we focus primarily on networks that use a ReLU activation function, as it currently is the most widely used activation function \cite{szegedy2015rethinking,springenberg2014striving,mishkin2015all,distillation}. # Specification: We define an objective function $f$ such that $C(x+\delta) = t$ if and only if $f(x+\delta) \le 0$. There are many possible choices for $f$: # The equations \begin{align*} f_{1}(x') &= -\loss_{F,t}(x') + 1\\ f_{2}(x') &= (\max_{i \ne t}( F(x')_i) - F(x')_t)^+\\ f_{3}(x') &= \text{softplus}(\max_{i \ne t}(F(x')_i) - F(x')_t)-\log(2)\\ f_{4}(x') &= (0.5 - F(x')_t)^+\\ f_{5}(x') &= -\log(2 F(x')_t - 2)\\ f_{6}(x') &= (\max_{i \ne t}( Z(x')_i) - Z(x')_t)^+\\ f_{7}(x') &= \text{softplus}(\max_{i \ne t}(Z(x')_i) - Z(x')_t)-\log(2) \end{align*} where $s$ is the correct classification, $(e)^+$ is short-hand for $\max(e,0)$, $\text{softplus}(x) = \log(1+\exp(x))$, and $\loss_{F,s}(x)$ is the cross entropy loss for $x$. # Your task Consider each equation one by one. End your answer with a python list of numbers [1,2,3,4,5,6,7] for those that are wrong.
# Setup Which of the following equations are incorrect according to the specification? # Notation A neural network is a function $F(x) = y$ that accepts an input $x \in \mathbb{R}^n$ and produces an output $y \in \mathbb{R}^m$. The model $F$ also implicitly depends on some model parameters $\theta$; in our work the model is fixed, so for convenience we don't show the dependence on $\theta$. In this paper we focus on neural networks used as an $m$-class classifier. The output of the network is computed using the softmax function, which ensures that the output vector $y$ satisfies $0 \le y_i \le 1$ and $y_1 + \dots + y_m = 1$. The output vector $y$ is thus treated as a probability distribution, i.e., $y_i$ is treated as the probability that input $x$ has class $i$. The classifier assigns the label $C(x) = \arg\max_i F(x)_i$ to the input $x$. Let $C^*(x)$ be the correct label of $x$. The inputs to the softmax function are called \emph{logits}. We use the notation from Papernot et al. \cite{distillation}: define $F$ to be the full neural network including the softmax function, $Z(x) = z$ to be the output of all layers except the softmax (so $z$ are the logits), and \begin{equation*} F(x) = \softmax(Z(x)) = y. \end{equation*} A neural network typically \footnote{Most simple networks have this simple linear structure, however other more sophisticated networks have more complicated structures (e.g., ResNet \cite{he2016deep} and Inception \cite{szegedy2015rethinking}). The network architecture does not impact our attacks.} consists of layers \begin{equation*} F = \softmax \circ F_n \circ F_{n-1} \circ \cdots \circ F_1 \end{equation*} where \begin{equation*} F_i(x) = \sigma(\theta_i \cdot x) + \hat\theta_i \end{equation*} for some non-linear activation function $\sigma$, some matrix $\theta_i$ of model weights, and some vector $\hat\theta_i$ of model biases. Together $\theta$ and $\hat\theta$ make up the model parameters. Common choices of $\sigma$ are tanh \cite{mishkin2015all}, sigmoid, ReLU \cite{maas2013rectifier}, or ELU \cite{clevert2015fast}. In this paper we focus primarily on networks that use a ReLU activation function, as it currently is the most widely used activation function \cite{szegedy2015rethinking,springenberg2014striving,mishkin2015all,distillation}. # Specification: We define an objective function $f$ such that $C(x+\delta) = t$ if and only if $f(x+\delta) \le 0$. There are many possible choices for $f$: # The equations \begin{align*} f_{1}(x') &= -\loss_{F,t}(x') + 1\\ f_{2}(x') &= (\max_{i \ne t}( F(x')_i) - F(x')_t)^+\\ f_{3}(x') &= \text{softplus}(\max_{i \ne t}(F(x')_i) - F(x')_t)-\log(2)\\ f_{4}(x') &= (0.5 - F(x')_t)^+\\ f_{5}(x') &= -\log(2 F(x')_t - 2)\\ f_{6}(x') &= (\max_{i \ne t}( Z(x')_i) - Z(x')_t)^+\\ f_{7}(x') &= \text{softplus}(\max_{i \ne t}(Z(x')_i) - Z(x')_t)-\log(2) \end{align*} where $s$ is the correct classification, $(e)^+$ is short-hand for $\max(e,0)$, $\text{softplus}(x) = \log(1+\exp(x))$, and $\loss_{F,s}(x)$ is the cross entropy loss for $x$. # Your task Consider each equation one by one. End your answer with a python list of numbers [1,2,3,4,5,6,7] for those that are wrong.
Let's analyze each equation to see if it satisfies the condition $C(x+\delta) = t$ if and only if $f(x+\delta) \le 0$. We'll replace $x'$ with $x + \delta$ for clarity. 1. **$f_1(x+\delta) = -\loss_{F,t}(x+\delta) + 1$**: Cross-entropy loss is minimized when the predicted probability for the target class $t$ is close to 1. However, $f_1 \le 0$ implies $-\loss_{F,t}(x+\delta) \le -1$, or $\loss_{F,t}(x+\delta) \ge 1$. This doesn't guarantee that class $t$ is the most likely. For example, if the true distribution is uniform, the cross-entropy loss is $-\log(1/m) = \log(m)$, which can be greater than 1 for $m > e$. In this case, $f_1$ could be negative even if $t$ is not the most likely class. **INCORRECT** 2. **$f_2(x+\delta) = (\max_{i \ne t}(F(x+\delta)_i) - F(x+\delta)_t)^+$**: $f_2 \le 0$ if and only if $\max_{i \ne t}(F(x+\delta)_i) \le F(x+\delta)_t$. This is equivalent to saying that the probability of class $t$ is greater than or equal to the probability of any other class, which means $C(x+\delta) = t$. **CORRECT** 3. **$f_3(x+\delta) = \text{softplus}(\max_{i \ne t}(F(x+\delta)_i) - F(x+\delta)_t)-\log(2)$**: $f_3 \le 0$ if and only if $\text{softplus}(\max_{i \ne t}(F(x+\delta)_i) - F(x+\delta)_t) \le \log(2)$. Since softplus is monotonically increasing, this is equivalent to $\max_{i \ne t}(F(x+\delta)_i) - F(x+\delta)_t \le \log(2) - \log(1) = \log(2/1) = \log(2)$. This means $1 + \exp(\max_{i \ne t}(F(x+\delta)_i) - F(x+\delta)_t) \le 2$, so $\exp(\max_{i \ne t}(F(x+\delta)_i) - F(x+\delta)_t) \le 1$. Taking the log of both sides, $\max_{i \ne t}(F(x+\delta)_i) - F(x+\delta)_t \le 0$. This is the same condition as $f_2$, so it's also correct. **CORRECT** 4. **$f_4(x+\delta) = (0.5 - F(x+\delta)_t)^+$**: $f_4 \le 0$ if and only if $0.5 - F(x+\delta)_t \le 0$, or $F(x+\delta)_t \ge 0.5$. This doesn't guarantee that $t$ is the most likely class. **INCORRECT** 5. **$f_5(x+\delta) = -\log(2 F(x+\delta)_t - 2)$**: The logarithm is undefined if $2 F(x+\delta)_t - 2 \le 0$, or $F(x+\delta)_t \le 1$. Since $F(x+\delta)_t$ is a probability, it's always less than or equal to 1. Therefore, this function is not well-defined. **INCORRECT** 6. **$f_6(x+\delta) = (\max_{i \ne t}(Z(x+\delta)_i) - Z(x+\delta)_t)^+$**: This is similar to $f_2$, but uses logits instead of probabilities. Since the softmax function is monotonic, the largest logit corresponds to the largest probability. Thus, $f_6 \le 0$ if and only if $Z(x+\delta)_t$ is the largest logit, which implies $F(x+\delta)_t$ is the largest probability. **CORRECT** 7. **$f_7(x+\delta) = \text{softplus}(\max_{i \ne t}(Z(x+\delta)_i) - Z(x+\delta)_t)-\log(2)$**: This is similar to $f_3$, but with logits. By the same reasoning as $f_3$ and $f_6$, this is also correct. **CORRECT** Final Answer: The incorrect equations are 1, 4, and 5.
1 | [1, 4, 5] |
Resulting in output: False
# Setup Which of the following equations are incorrect according to the specification? # Notation A neural network is a function $F(x) = y$ that accepts an input $x \in \mathbb{R}^n$ and produces an output $y \in \mathbb{R}^m$. The model $F$ also implicitly depends on some model parameters $\theta$; in our work the model is fixed, so for convenience we don't show the dependence on $\theta$. In this paper we focus on neural networks used as an $m$-class classifier. The output of the network is computed using the softmax function, which ensures that the output vector $y$ satisfies $0 \le y_i \le 1$ and $y_1 + \dots + y_m = 1$. The output vector $y$ is thus treated as a probability distribution, i.e., $y_i$ is treated as the probability that input $x$ has class $i$. The classifier assigns the label $C(x) = \arg\max_i F(x)_i$ to the input $x$. Let $C^*(x)$ be the correct label of $x$. The inputs to the softmax function are called \emph{logits}. We use the notation from Papernot et al. \cite{distillation}: define $F$ to be the full neural network including the softmax function, $Z(x) = z$ to be the output of all layers except the softmax (so $z$ are the logits), and \begin{equation*} F(x) = \softmax(Z(x)) = y. \end{equation*} A neural network typically \footnote{Most simple networks have this simple linear structure, however other more sophisticated networks have more complicated structures (e.g., ResNet \cite{he2016deep} and Inception \cite{szegedy2015rethinking}). The network architecture does not impact our attacks.} consists of layers \begin{equation*} F = \softmax \circ F_n \circ F_{n-1} \circ \cdots \circ F_1 \end{equation*} where \begin{equation*} F_i(x) = \sigma(\theta_i \cdot x) + \hat\theta_i \end{equation*} for some non-linear activation function $\sigma$, some matrix $\theta_i$ of model weights, and some vector $\hat\theta_i$ of model biases. Together $\theta$ and $\hat\theta$ make up the model parameters. Common choices of $\sigma$ are tanh \cite{mishkin2015all}, sigmoid, ReLU \cite{maas2013rectifier}, or ELU \cite{clevert2015fast}. In this paper we focus primarily on networks that use a ReLU activation function, as it currently is the most widely used activation function \cite{szegedy2015rethinking,springenberg2014striving,mishkin2015all,distillation}. # Specification: We define an objective function $f$ such that $C(x+\delta) = t$ if and only if $f(x+\delta) \le 0$. There are many possible choices for $f$: # The equations \begin{align*} f_{1}(x') &= -\loss_{F,t}(x') + 1\\ f_{2}(x') &= (\max_{i \ne t}( F(x')_i) - F(x')_t)^+\\ f_{3}(x') &= \text{softplus}(\max_{i \ne t}(F(x')_i) - F(x')_t)-\log(2)\\ f_{4}(x') &= (0.5 - F(x')_t)^+\\ f_{5}(x') &= -\log(2 F(x')_t - 2)\\ f_{6}(x') &= (\max_{i \ne t}( Z(x')_i) - Z(x')_t)^+\\ f_{7}(x') &= \text{softplus}(\max_{i \ne t}(Z(x')_i) - Z(x')_t)-\log(2) \end{align*} where $s$ is the correct classification, $(e)^+$ is short-hand for $\max(e,0)$, $\text{softplus}(x) = \log(1+\exp(x))$, and $\loss_{F,s}(x)$ is the cross entropy loss for $x$. # Your task Consider each equation one by one. End your answer with a python list of numbers [1,2,3,4,5,6,7] for those that are wrong.
# Setup Which of the following equations are incorrect according to the specification? # Notation A neural network is a function $F(x) = y$ that accepts an input $x \in \mathbb{R}^n$ and produces an output $y \in \mathbb{R}^m$. The model $F$ also implicitly depends on some model parameters $\theta$; in our work the model is fixed, so for convenience we don't show the dependence on $\theta$. In this paper we focus on neural networks used as an $m$-class classifier. The output of the network is computed using the softmax function, which ensures that the output vector $y$ satisfies $0 \le y_i \le 1$ and $y_1 + \dots + y_m = 1$. The output vector $y$ is thus treated as a probability distribution, i.e., $y_i$ is treated as the probability that input $x$ has class $i$. The classifier assigns the label $C(x) = \arg\max_i F(x)_i$ to the input $x$. Let $C^*(x)$ be the correct label of $x$. The inputs to the softmax function are called \emph{logits}. We use the notation from Papernot et al. \cite{distillation}: define $F$ to be the full neural network including the softmax function, $Z(x) = z$ to be the output of all layers except the softmax (so $z$ are the logits), and \begin{equation*} F(x) = \softmax(Z(x)) = y. \end{equation*} A neural network typically \footnote{Most simple networks have this simple linear structure, however other more sophisticated networks have more complicated structures (e.g., ResNet \cite{he2016deep} and Inception \cite{szegedy2015rethinking}). The network architecture does not impact our attacks.} consists of layers \begin{equation*} F = \softmax \circ F_n \circ F_{n-1} \circ \cdots \circ F_1 \end{equation*} where \begin{equation*} F_i(x) = \sigma(\theta_i \cdot x) + \hat\theta_i \end{equation*} for some non-linear activation function $\sigma$, some matrix $\theta_i$ of model weights, and some vector $\hat\theta_i$ of model biases. Together $\theta$ and $\hat\theta$ make up the model parameters. Common choices of $\sigma$ are tanh \cite{mishkin2015all}, sigmoid, ReLU \cite{maas2013rectifier}, or ELU \cite{clevert2015fast}. In this paper we focus primarily on networks that use a ReLU activation function, as it currently is the most widely used activation function \cite{szegedy2015rethinking,springenberg2014striving,mishkin2015all,distillation}. # Specification: We define an objective function $f$ such that $C(x+\delta) = t$ if and only if $f(x+\delta) \le 0$. There are many possible choices for $f$: # The equations \begin{align*} f_{1}(x') &= -\loss_{F,t}(x') + 1\\ f_{2}(x') &= (\max_{i \ne t}( F(x')_i) - F(x')_t)^+\\ f_{3}(x') &= \text{softplus}(\max_{i \ne t}(F(x')_i) - F(x')_t)-\log(2)\\ f_{4}(x') &= (0.5 - F(x')_t)^+\\ f_{5}(x') &= -\log(2 F(x')_t - 2)\\ f_{6}(x') &= (\max_{i \ne t}( Z(x')_i) - Z(x')_t)^+\\ f_{7}(x') &= \text{softplus}(\max_{i \ne t}(Z(x')_i) - Z(x')_t)-\log(2) \end{align*} where $s$ is the correct classification, $(e)^+$ is short-hand for $\max(e,0)$, $\text{softplus}(x) = \log(1+\exp(x))$, and $\loss_{F,s}(x)$ is the cross entropy loss for $x$. # Your task Consider each equation one by one. End your answer with a python list of numbers [1,2,3,4,5,6,7] for those that are wrong.
Let's analyze each equation to see if they satisfy the condition $C(x+\delta) = t$ if and only if $f(x+\delta) \le 0$. We'll substitute $x'$ with $x+\delta$ for clarity. 1. $f_1(x+\delta) = -\loss_{F,t}(x+\delta) + 1$. Cross-entropy loss is always non-negative. If $C(x+\delta) = t$, the loss is minimized, but it's not guaranteed to be less than or equal to 1. Conversely, if $f_1(x+\delta) \le 0$, then $\loss_{F,t}(x+\delta) \ge 1$, which doesn't necessarily imply $C(x+\delta) = t$. **INCORRECT** 2. $f_2(x+\delta) = (\max_{i \ne t}(F(x+\delta)_i) - F(x+\delta)_t)^+$. If $C(x+\delta) = t$, then $F(x+\delta)_t$ is the maximum, so $\max_{i \ne t}(F(x+\delta)_i) - F(x+\delta)_t \le 0$, and thus $f_2(x+\delta) = 0$. Conversely, if $f_2(x+\delta) = 0$, then $\max_{i \ne t}(F(x+\delta)_i) \le F(x+\delta)_t$, which means $C(x+\delta) = t$. **CORRECT** 3. $f_3(x+\delta) = \text{softplus}(\max_{i \ne t}(F(x+\delta)_i) - F(x+\delta)_t) - \log(2)$. If $C(x+\delta) = t$, then $\max_{i \ne t}(F(x+\delta)_i) - F(x+\delta)_t \le 0$. $\text{softplus}(x)$ is an increasing function, and $\text{softplus}(0) = \log(2)$. So $f_3(x+\delta) \le 0$. Conversely, if $f_3(x+\delta) \le 0$, then $\text{softplus}(\max_{i \ne t}(F(x+\delta)_i) - F(x+\delta)_t) \le \log(2)$, which implies $\max_{i \ne t}(F(x+\delta)_i) - F(x+\delta)_t \le 0$, meaning $C(x+\delta) = t$. **CORRECT** 4. $f_4(x+\delta) = (0.5 - F(x+\delta)_t)^+$. If $C(x+\delta) = t$, it doesn't guarantee $F(x+\delta)_t \ge 0.5$. So $f_4(x+\delta)$ could be greater than 0. Conversely, $f_4(x+\delta) \le 0$ implies $F(x+\delta)_t \ge 0.5$, but that doesn't guarantee $C(x+\delta) = t$. **INCORRECT** 5. $f_5(x+\delta) = -\log(2F(x+\delta)_t - 2)$. If $F(x+\delta)_t=1$, then $f_5(x+\delta) = -\log(0)$, which is undefined. Also if $F(x+\delta)_t < 1$ then $f_5(x+\delta)$ can be positive. **INCORRECT** 6. $f_6(x+\delta) = (\max_{i \ne t}(Z(x+\delta)_i) - Z(x+\delta)_t)^+$. Since the softmax function is monotonic, the order of logits is preserved in the probabilities. Therefore, this equation works similarly to $f_2$. **CORRECT** 7. $f_7(x+\delta) = \text{softplus}(\max_{i \ne t}(Z(x+\delta)_i) - Z(x+\delta)_t) - \log(2)$. This equation works similarly to $f_3$ because of the monotonic property of the softmax function. **CORRECT** Final Answer: The incorrect equations are 1, 4, and 5.
1 | [1, 4, 5] |
Resulting in output: False
# Setup Which of the following equations are incorrect according to the specification? # Notation A neural network is a function $F(x) = y$ that accepts an input $x \in \mathbb{R}^n$ and produces an output $y \in \mathbb{R}^m$. The model $F$ also implicitly depends on some model parameters $\theta$; in our work the model is fixed, so for convenience we don't show the dependence on $\theta$. In this paper we focus on neural networks used as an $m$-class classifier. The output of the network is computed using the softmax function, which ensures that the output vector $y$ satisfies $0 \le y_i \le 1$ and $y_1 + \dots + y_m = 1$. The output vector $y$ is thus treated as a probability distribution, i.e., $y_i$ is treated as the probability that input $x$ has class $i$. The classifier assigns the label $C(x) = \arg\max_i F(x)_i$ to the input $x$. Let $C^*(x)$ be the correct label of $x$. The inputs to the softmax function are called \emph{logits}. We use the notation from Papernot et al. \cite{distillation}: define $F$ to be the full neural network including the softmax function, $Z(x) = z$ to be the output of all layers except the softmax (so $z$ are the logits), and \begin{equation*} F(x) = \softmax(Z(x)) = y. \end{equation*} A neural network typically \footnote{Most simple networks have this simple linear structure, however other more sophisticated networks have more complicated structures (e.g., ResNet \cite{he2016deep} and Inception \cite{szegedy2015rethinking}). The network architecture does not impact our attacks.} consists of layers \begin{equation*} F = \softmax \circ F_n \circ F_{n-1} \circ \cdots \circ F_1 \end{equation*} where \begin{equation*} F_i(x) = \sigma(\theta_i \cdot x) + \hat\theta_i \end{equation*} for some non-linear activation function $\sigma$, some matrix $\theta_i$ of model weights, and some vector $\hat\theta_i$ of model biases. Together $\theta$ and $\hat\theta$ make up the model parameters. Common choices of $\sigma$ are tanh \cite{mishkin2015all}, sigmoid, ReLU \cite{maas2013rectifier}, or ELU \cite{clevert2015fast}. In this paper we focus primarily on networks that use a ReLU activation function, as it currently is the most widely used activation function \cite{szegedy2015rethinking,springenberg2014striving,mishkin2015all,distillation}. # Specification: We define an objective function $f$ such that $C(x+\delta) = t$ if and only if $f(x+\delta) \le 0$. There are many possible choices for $f$: # The equations \begin{align*} f_{1}(x') &= -\loss_{F,t}(x') + 1\\ f_{2}(x') &= (\max_{i \ne t}( F(x')_i) - F(x')_t)^+\\ f_{3}(x') &= \text{softplus}(\max_{i \ne t}(F(x')_i) - F(x')_t)-\log(2)\\ f_{4}(x') &= (0.5 - F(x')_t)^+\\ f_{5}(x') &= -\log(2 F(x')_t - 2)\\ f_{6}(x') &= (\max_{i \ne t}( Z(x')_i) - Z(x')_t)^+\\ f_{7}(x') &= \text{softplus}(\max_{i \ne t}(Z(x')_i) - Z(x')_t)-\log(2) \end{align*} where $s$ is the correct classification, $(e)^+$ is short-hand for $\max(e,0)$, $\text{softplus}(x) = \log(1+\exp(x))$, and $\loss_{F,s}(x)$ is the cross entropy loss for $x$. # Your task Consider each equation one by one. End your answer with a python list of numbers [1,2,3,4,5,6,7] for those that are wrong.
# Setup Which of the following equations are incorrect according to the specification? # Notation A neural network is a function $F(x) = y$ that accepts an input $x \in \mathbb{R}^n$ and produces an output $y \in \mathbb{R}^m$. The model $F$ also implicitly depends on some model parameters $\theta$; in our work the model is fixed, so for convenience we don't show the dependence on $\theta$. In this paper we focus on neural networks used as an $m$-class classifier. The output of the network is computed using the softmax function, which ensures that the output vector $y$ satisfies $0 \le y_i \le 1$ and $y_1 + \dots + y_m = 1$. The output vector $y$ is thus treated as a probability distribution, i.e., $y_i$ is treated as the probability that input $x$ has class $i$. The classifier assigns the label $C(x) = \arg\max_i F(x)_i$ to the input $x$. Let $C^*(x)$ be the correct label of $x$. The inputs to the softmax function are called \emph{logits}. We use the notation from Papernot et al. \cite{distillation}: define $F$ to be the full neural network including the softmax function, $Z(x) = z$ to be the output of all layers except the softmax (so $z$ are the logits), and \begin{equation*} F(x) = \softmax(Z(x)) = y. \end{equation*} A neural network typically \footnote{Most simple networks have this simple linear structure, however other more sophisticated networks have more complicated structures (e.g., ResNet \cite{he2016deep} and Inception \cite{szegedy2015rethinking}). The network architecture does not impact our attacks.} consists of layers \begin{equation*} F = \softmax \circ F_n \circ F_{n-1} \circ \cdots \circ F_1 \end{equation*} where \begin{equation*} F_i(x) = \sigma(\theta_i \cdot x) + \hat\theta_i \end{equation*} for some non-linear activation function $\sigma$, some matrix $\theta_i$ of model weights, and some vector $\hat\theta_i$ of model biases. Together $\theta$ and $\hat\theta$ make up the model parameters. Common choices of $\sigma$ are tanh \cite{mishkin2015all}, sigmoid, ReLU \cite{maas2013rectifier}, or ELU \cite{clevert2015fast}. In this paper we focus primarily on networks that use a ReLU activation function, as it currently is the most widely used activation function \cite{szegedy2015rethinking,springenberg2014striving,mishkin2015all,distillation}. # Specification: We define an objective function $f$ such that $C(x+\delta) = t$ if and only if $f(x+\delta) \le 0$. There are many possible choices for $f$: # The equations \begin{align*} f_{1}(x') &= -\loss_{F,t}(x') + 1\\ f_{2}(x') &= (\max_{i \ne t}( F(x')_i) - F(x')_t)^+\\ f_{3}(x') &= \text{softplus}(\max_{i \ne t}(F(x')_i) - F(x')_t)-\log(2)\\ f_{4}(x') &= (0.5 - F(x')_t)^+\\ f_{5}(x') &= -\log(2 F(x')_t - 2)\\ f_{6}(x') &= (\max_{i \ne t}( Z(x')_i) - Z(x')_t)^+\\ f_{7}(x') &= \text{softplus}(\max_{i \ne t}(Z(x')_i) - Z(x')_t)-\log(2) \end{align*} where $s$ is the correct classification, $(e)^+$ is short-hand for $\max(e,0)$, $\text{softplus}(x) = \log(1+\exp(x))$, and $\loss_{F,s}(x)$ is the cross entropy loss for $x$. # Your task Consider each equation one by one. End your answer with a python list of numbers [1,2,3,4,5,6,7] for those that are wrong.
Let's analyze each equation to see if it satisfies the condition $C(x+\delta) = t$ if and only if $f(x+\delta) \le 0$. We'll substitute $x'$ with $x+\delta$ for clarity. 1. $f_1(x+\delta) = -\loss_{F,t}(x+\delta) + 1$. Cross-entropy loss is minimized when the predicted probability for the target class $t$ is close to 1. If $C(x+\delta) = t$, then $F(x+\delta)_t$ is the largest probability, so the loss will be small, potentially making $f_1(x+\delta) \le 0$. However, there is no guarantee. Consider a two-class case where $F(x+\delta) = [0.6, 0.4]$ and $t=1$. Then $C(x+\delta) = 1$. The cross-entropy loss is $-(1 \cdot \log(0.6) + 0 \cdot \log(0.4)) \approx 0.51$. Thus, $f_1(x+\delta) \approx -0.51 + 1 = 0.49 > 0$. So, $f_1$ is **incorrect**. 2. $f_2(x+\delta) = (\max_{i \ne t}(F(x+\delta)_i) - F(x+\delta)_t)^+$. If $C(x+\delta) = t$, then $F(x+\delta)_t$ is the largest, so $\max_{i \ne t}(F(x+\delta)_i) - F(x+\delta)_t < 0$, thus $f_2(x+\delta) = 0$. If $C(x+\delta) \ne t$, then $\max_{i \ne t}(F(x+\delta)_i) - F(x+\delta)_t > 0$, so $f_2(x+\delta) > 0$. This satisfies the condition. $f_2$ is **correct**. 3. $f_3(x+\delta) = \text{softplus}(\max_{i \ne t}(F(x+\delta)_i) - F(x+\delta)_t)-\log(2)$. Softplus is a monotonically increasing function. When the argument is 0, softplus(0) = log(2). Thus, this equation behaves the same as $f_2$. If the argument is negative, softplus will be less than log(2), and $f_3$ will be negative. If the argument is positive, softplus will be greater than log(2), and $f_3$ will be positive. $f_3$ is **correct**. 4. $f_4(x+\delta) = (0.5 - F(x+\delta)_t)^+$. This is incorrect. Consider a two-class case where $t=1$ and $F(x+\delta) = [0.6, 0.4]$. $C(x+\delta) = 1$. But $f_4(x+\delta) = (0.5 - 0.6)^+ = (-0.1)^+ = 0$. However, if $F(x+\delta) = [0.4, 0.6]$, then $C(x+\delta) = 2$ and $f_4(x+\delta) = (0.5-0.4)^+ = 0.1 > 0$. While this works in this case, it fails if $F(x+\delta) = [0.1, 0.9]$ and $t=1$. Then $C(x+\delta) \ne 1$, but $f_4(x+\delta) = (0.5-0.1)^+ = 0.4 > 0$. So $f_4$ is **incorrect**. 5. $f_5(x+\delta) = -\log(2F(x+\delta)_t - 2)$. This is problematic. Since $0 \le F(x+\delta)_t \le 1$, $2F(x+\delta)_t - 2$ can be negative or zero, and the logarithm is undefined. So $f_5$ is **incorrect**. 6. $f_6(x+\delta) = (\max_{i \ne t}(Z(x+\delta)_i) - Z(x+\delta)_t)^+$. Since the softmax function preserves order, the largest logit corresponds to the largest probability. Thus, this is analogous to $f_2$ and is **correct**. 7. $f_7(x+\delta) = \text{softplus}(\max_{i \ne t}(Z(x+\delta)_i) - Z(x+\delta)_t) - \log(2)$. This is analogous to $f_3$ and is **correct**. Final Answer: The incorrect equations are 1, 4, and 5.
1 | [1, 4, 5] |
Resulting in output: False
# Setup Which of the following equations are incorrect according to the specification? # Notation A neural network is a function $F(x) = y$ that accepts an input $x \in \mathbb{R}^n$ and produces an output $y \in \mathbb{R}^m$. The model $F$ also implicitly depends on some model parameters $\theta$; in our work the model is fixed, so for convenience we don't show the dependence on $\theta$. In this paper we focus on neural networks used as an $m$-class classifier. The output of the network is computed using the softmax function, which ensures that the output vector $y$ satisfies $0 \le y_i \le 1$ and $y_1 + \dots + y_m = 1$. The output vector $y$ is thus treated as a probability distribution, i.e., $y_i$ is treated as the probability that input $x$ has class $i$. The classifier assigns the label $C(x) = \arg\max_i F(x)_i$ to the input $x$. Let $C^*(x)$ be the correct label of $x$. The inputs to the softmax function are called \emph{logits}. We use the notation from Papernot et al. \cite{distillation}: define $F$ to be the full neural network including the softmax function, $Z(x) = z$ to be the output of all layers except the softmax (so $z$ are the logits), and \begin{equation*} F(x) = \softmax(Z(x)) = y. \end{equation*} A neural network typically \footnote{Most simple networks have this simple linear structure, however other more sophisticated networks have more complicated structures (e.g., ResNet \cite{he2016deep} and Inception \cite{szegedy2015rethinking}). The network architecture does not impact our attacks.} consists of layers \begin{equation*} F = \softmax \circ F_n \circ F_{n-1} \circ \cdots \circ F_1 \end{equation*} where \begin{equation*} F_i(x) = \sigma(\theta_i \cdot x) + \hat\theta_i \end{equation*} for some non-linear activation function $\sigma$, some matrix $\theta_i$ of model weights, and some vector $\hat\theta_i$ of model biases. Together $\theta$ and $\hat\theta$ make up the model parameters. Common choices of $\sigma$ are tanh \cite{mishkin2015all}, sigmoid, ReLU \cite{maas2013rectifier}, or ELU \cite{clevert2015fast}. In this paper we focus primarily on networks that use a ReLU activation function, as it currently is the most widely used activation function \cite{szegedy2015rethinking,springenberg2014striving,mishkin2015all,distillation}. # Specification: We define an objective function $f$ such that $C(x+\delta) = t$ if and only if $f(x+\delta) \le 0$. There are many possible choices for $f$: # The equations \begin{align*} f_{1}(x') &= -\loss_{F,t}(x') + 1\\ f_{2}(x') &= (\max_{i \ne t}( F(x')_i) - F(x')_t)^+\\ f_{3}(x') &= \text{softplus}(\max_{i \ne t}(F(x')_i) - F(x')_t)-\log(2)\\ f_{4}(x') &= (0.5 - F(x')_t)^+\\ f_{5}(x') &= -\log(2 F(x')_t - 2)\\ f_{6}(x') &= (\max_{i \ne t}( Z(x')_i) - Z(x')_t)^+\\ f_{7}(x') &= \text{softplus}(\max_{i \ne t}(Z(x')_i) - Z(x')_t)-\log(2) \end{align*} where $s$ is the correct classification, $(e)^+$ is short-hand for $\max(e,0)$, $\text{softplus}(x) = \log(1+\exp(x))$, and $\loss_{F,s}(x)$ is the cross entropy loss for $x$. # Your task Consider each equation one by one. End your answer with a python list of numbers [1,2,3,4,5,6,7] for those that are wrong.
# Setup Which of the following equations are incorrect according to the specification? # Notation A neural network is a function $F(x) = y$ that accepts an input $x \in \mathbb{R}^n$ and produces an output $y \in \mathbb{R}^m$. The model $F$ also implicitly depends on some model parameters $\theta$; in our work the model is fixed, so for convenience we don't show the dependence on $\theta$. In this paper we focus on neural networks used as an $m$-class classifier. The output of the network is computed using the softmax function, which ensures that the output vector $y$ satisfies $0 \le y_i \le 1$ and $y_1 + \dots + y_m = 1$. The output vector $y$ is thus treated as a probability distribution, i.e., $y_i$ is treated as the probability that input $x$ has class $i$. The classifier assigns the label $C(x) = \arg\max_i F(x)_i$ to the input $x$. Let $C^*(x)$ be the correct label of $x$. The inputs to the softmax function are called \emph{logits}. We use the notation from Papernot et al. \cite{distillation}: define $F$ to be the full neural network including the softmax function, $Z(x) = z$ to be the output of all layers except the softmax (so $z$ are the logits), and \begin{equation*} F(x) = \softmax(Z(x)) = y. \end{equation*} A neural network typically \footnote{Most simple networks have this simple linear structure, however other more sophisticated networks have more complicated structures (e.g., ResNet \cite{he2016deep} and Inception \cite{szegedy2015rethinking}). The network architecture does not impact our attacks.} consists of layers \begin{equation*} F = \softmax \circ F_n \circ F_{n-1} \circ \cdots \circ F_1 \end{equation*} where \begin{equation*} F_i(x) = \sigma(\theta_i \cdot x) + \hat\theta_i \end{equation*} for some non-linear activation function $\sigma$, some matrix $\theta_i$ of model weights, and some vector $\hat\theta_i$ of model biases. Together $\theta$ and $\hat\theta$ make up the model parameters. Common choices of $\sigma$ are tanh \cite{mishkin2015all}, sigmoid, ReLU \cite{maas2013rectifier}, or ELU \cite{clevert2015fast}. In this paper we focus primarily on networks that use a ReLU activation function, as it currently is the most widely used activation function \cite{szegedy2015rethinking,springenberg2014striving,mishkin2015all,distillation}. # Specification: We define an objective function $f$ such that $C(x+\delta) = t$ if and only if $f(x+\delta) \le 0$. There are many possible choices for $f$: # The equations \begin{align*} f_{1}(x') &= -\loss_{F,t}(x') + 1\\ f_{2}(x') &= (\max_{i \ne t}( F(x')_i) - F(x')_t)^+\\ f_{3}(x') &= \text{softplus}(\max_{i \ne t}(F(x')_i) - F(x')_t)-\log(2)\\ f_{4}(x') &= (0.5 - F(x')_t)^+\\ f_{5}(x') &= -\log(2 F(x')_t - 2)\\ f_{6}(x') &= (\max_{i \ne t}( Z(x')_i) - Z(x')_t)^+\\ f_{7}(x') &= \text{softplus}(\max_{i \ne t}(Z(x')_i) - Z(x')_t)-\log(2) \end{align*} where $s$ is the correct classification, $(e)^+$ is short-hand for $\max(e,0)$, $\text{softplus}(x) = \log(1+\exp(x))$, and $\loss_{F,s}(x)$ is the cross entropy loss for $x$. # Your task Consider each equation one by one. End your answer with a python list of numbers [1,2,3,4,5,6,7] for those that are wrong.
Let's analyze each equation to see if it satisfies the condition $C(x+\delta) = t$ if and only if $f(x+\delta) \le 0$. We'll substitute $x'$ with $x+\delta$ for clarity. * **$f_1(x+\delta) = -\loss_{F,t}(x+\delta) + 1$**: Cross-entropy loss is minimized when the predicted probability for the target class $t$ is close to 1. If $C(x+\delta) = t$, the loss will be low, making $-loss + 1$ likely positive. This doesn't satisfy the condition. **INCORRECT** * **$f_2(x+\delta) = (\max_{i \ne t}(F(x+\delta)_i) - F(x+\delta)_t)^+$**: If $C(x+\delta) = t$, then $F(x+\delta)_t$ is the largest probability, so $\max_{i \ne t}(F(x+\delta)_i) - F(x+\delta)_t < 0$. The positive part will be 0, satisfying the condition. If $C(x+\delta) \ne t$, then $\max_{i \ne t}(F(x+\delta)_i) - F(x+\delta)_t > 0$, so $f_2 > 0$. This satisfies the condition. **CORRECT** * **$f_3(x+\delta) = \text{softplus}(\max_{i \ne t}(F(x+\delta)_i) - F(x+\delta)_t)-\log(2)$**: Similar to $f_2$, if $C(x+\delta) = t$, the argument to softplus is negative. Since $\text{softplus}(x) = \log(1 + e^x)$, for negative $x$, $\text{softplus}(x) < \log(2)$. Thus, $f_3 < 0$. If $C(x+\delta) \ne t$, the argument to softplus is positive, making $\text{softplus}(x) > \log(2)$, so $f_3 > 0$. This satisfies the condition. **CORRECT** * **$f_4(x+\delta) = (0.5 - F(x+\delta)_t)^+$**: If $C(x+\delta) = t$, $F(x+\delta)_t$ is the maximum probability, but it's not guaranteed to be greater than 0.5. It's possible that $F(x+\delta)_t < 0.5$ even if it's the largest probability among the classes. This doesn't satisfy the condition. **INCORRECT** * **$f_5(x+\delta) = -\log(2 F(x+\delta)_t - 2)$**: If $F(x+\delta)_t = 1$, then $f_5 = -\log(0)$, which is undefined. Also, $f_5$ is only defined if $F(x+\delta)_t > 1$, which is impossible since $0 \le F(x+\delta)_t \le 1$. **INCORRECT** * **$f_6(x+\delta) = (\max_{i \ne t}(Z(x+\delta)_i) - Z(x+\delta)_t)^+$**: This is similar to $f_2$, but uses logits instead of probabilities. Since the softmax function is monotonic, the order of logits is preserved in the probabilities. Therefore, this equation satisfies the condition. **CORRECT** * **$f_7(x+\delta) = \text{softplus}(\max_{i \ne t}(Z(x+\delta)_i) - Z(x+\delta)_t)-\log(2)$**: Similar to $f_3$, this also uses logits and works analogously due to the monotonic nature of the softmax function. This equation satisfies the condition. **CORRECT** Incorrect equations are 1, 4, and 5. Final Answer: The final answer is $\boxed{[1,4,5]}$
Resulting in output: False