# Setup Which of the following equations are incorrect according to the specification? # Notation A neural network is a function $F(x) = y$ that accepts an input $x \in \mathbb{R}^n$ and produces an output $y \in \mathbb{R}^m$. The model $F$ also implicitly depends on some model parameters $\theta$; in our work the model is fixed, so for convenience we don't show the dependence on $\theta$. In this paper we focus on neural networks used as an $m$-class classifier. The output of the network is computed using the softmax function, which ensures that the output vector $y$ satisfies $0 \le y_i \le 1$ and $y_1 + \dots + y_m = 1$. The output vector $y$ is thus treated as a probability distribution, i.e., $y_i$ is treated as the probability that input $x$ has class $i$. The classifier assigns the label $C(x) = \arg\max_i F(x)_i$ to the input $x$. Let $C^*(x)$ be the correct label of $x$. The inputs to the softmax function are called \emph{logits}. We use the notation from Papernot et al. \cite{distillation}: define $F$ to be the full neural network including the softmax function, $Z(x) = z$ to be the output of all layers except the softmax (so $z$ are the logits), and \begin{equation*} F(x) = \softmax(Z(x)) = y. \end{equation*} A neural network typically \footnote{Most simple networks have this simple linear structure, however other more sophisticated networks have more complicated structures (e.g., ResNet \cite{he2016deep} and Inception \cite{szegedy2015rethinking}). The network architecture does not impact our attacks.} consists of layers \begin{equation*} F = \softmax \circ F_n \circ F_{n-1} \circ \cdots \circ F_1 \end{equation*} where \begin{equation*} F_i(x) = \sigma(\theta_i \cdot x) + \hat\theta_i \end{equation*} for some non-linear activation function $\sigma$, some matrix $\theta_i$ of model weights, and some vector $\hat\theta_i$ of model biases. Together $\theta$ and $\hat\theta$ make up the model parameters. Common choices of $\sigma$ are tanh \cite{mishkin2015all}, sigmoid, ReLU \cite{maas2013rectifier}, or ELU \cite{clevert2015fast}. In this paper we focus primarily on networks that use a ReLU activation function, as it currently is the most widely used activation function \cite{szegedy2015rethinking,springenberg2014striving,mishkin2015all,distillation}. # Specification: We define an objective function $f$ such that $C(x+\delta) = t$ if and only if $f(x+\delta) \le 0$. There are many possible choices for $f$: # The equations \begin{align*} f_{1}(x') &= -\loss_{F,t}(x') + 1\\ f_{2}(x') &= (\max_{i \ne t}( F(x')_i) - F(x')_t)^+\\ f_{3}(x') &= \text{softplus}(\max_{i \ne t}(F(x')_i) - F(x')_t)-\log(2)\\ f_{4}(x') &= (0.5 - F(x')_t)^+\\ f_{5}(x') &= -\log(2 F(x')_t - 2)\\ f_{6}(x') &= (\max_{i \ne t}( Z(x')_i) - Z(x')_t)^+\\ f_{7}(x') &= \text{softplus}(\max_{i \ne t}(Z(x')_i) - Z(x')_t)-\log(2) \end{align*} where $s$ is the correct classification, $(e)^+$ is short-hand for $\max(e,0)$, $\text{softplus}(x) = \log(1+\exp(x))$, and $\loss_{F,s}(x)$ is the cross entropy loss for $x$. # Your task Consider each equation one by one. End your answer with a python list of numbers [1,2,3,4,5,6,7] for those that are wrong.
# Setup Which of the following equations are incorrect according to the specification? # Notation A neural network is a function $F(x) = y$ that accepts an input $x \in \mathbb{R}^n$ and produces an output $y \in \mathbb{R}^m$. The model $F$ also implicitly depends on some model parameters $\theta$; in our work the model is fixed, so for convenience we don't show the dependence on $\theta$. In this paper we focus on neural networks used as an $m$-class classifier. The output of the network is computed using the softmax function, which ensures that the output vector $y$ satisfies $0 \le y_i \le 1$ and $y_1 + \dots + y_m = 1$. The output vector $y$ is thus treated as a probability distribution, i.e., $y_i$ is treated as the probability that input $x$ has class $i$. The classifier assigns the label $C(x) = \arg\max_i F(x)_i$ to the input $x$. Let $C^*(x)$ be the correct label of $x$. The inputs to the softmax function are called \emph{logits}. We use the notation from Papernot et al. \cite{distillation}: define $F$ to be the full neural network including the softmax function, $Z(x) = z$ to be the output of all layers except the softmax (so $z$ are the logits), and \begin{equation*} F(x) = \softmax(Z(x)) = y. \end{equation*} A neural network typically \footnote{Most simple networks have this simple linear structure, however other more sophisticated networks have more complicated structures (e.g., ResNet \cite{he2016deep} and Inception \cite{szegedy2015rethinking}). The network architecture does not impact our attacks.} consists of layers \begin{equation*} F = \softmax \circ F_n \circ F_{n-1} \circ \cdots \circ F_1 \end{equation*} where \begin{equation*} F_i(x) = \sigma(\theta_i \cdot x) + \hat\theta_i \end{equation*} for some non-linear activation function $\sigma$, some matrix $\theta_i$ of model weights, and some vector $\hat\theta_i$ of model biases. Together $\theta$ and $\hat\theta$ make up the model parameters. Common choices of $\sigma$ are tanh \cite{mishkin2015all}, sigmoid, ReLU \cite{maas2013rectifier}, or ELU \cite{clevert2015fast}. In this paper we focus primarily on networks that use a ReLU activation function, as it currently is the most widely used activation function \cite{szegedy2015rethinking,springenberg2014striving,mishkin2015all,distillation}. # Specification: We define an objective function $f$ such that $C(x+\delta) = t$ if and only if $f(x+\delta) \le 0$. There are many possible choices for $f$: # The equations \begin{align*} f_{1}(x') &= -\loss_{F,t}(x') + 1\\ f_{2}(x') &= (\max_{i \ne t}( F(x')_i) - F(x')_t)^+\\ f_{3}(x') &= \text{softplus}(\max_{i \ne t}(F(x')_i) - F(x')_t)-\log(2)\\ f_{4}(x') &= (0.5 - F(x')_t)^+\\ f_{5}(x') &= -\log(2 F(x')_t - 2)\\ f_{6}(x') &= (\max_{i \ne t}( Z(x')_i) - Z(x')_t)^+\\ f_{7}(x') &= \text{softplus}(\max_{i \ne t}(Z(x')_i) - Z(x')_t)-\log(2) \end{align*} where $s$ is the correct classification, $(e)^+$ is short-hand for $\max(e,0)$, $\text{softplus}(x) = \log(1+\exp(x))$, and $\loss_{F,s}(x)$ is the cross entropy loss for $x$. # Your task Consider each equation one by one. End your answer with a python list of numbers [1,2,3,4,5,6,7] for those that are wrong.
To determine which of the given equations are incorrect according to the specification, we need to analyze each equation in the context of the provided notation and specification. The specification defines an objective function $f$ such that $C(x+\delta) = t$ if and only if $f(x+\delta) \le 0$. This means that the objective function $f$ should be designed in a way that its output is less than or equal to zero when the classification of $x+\delta$ is $t$, and greater than zero otherwise. Let's examine each equation: 1. $f_{1}(x') = -\loss_{F,t}(x') + 1$ - The cross-entropy loss $\loss_{F,t}(x')$ is minimized when $x'$ is correctly classified as $t$. Therefore, $-\loss_{F,t}(x')$ is maximized when $x'$ is correctly classified as $t$, making $-\loss_{F,t}(x') + 1 \le 0$ when $x'$ is not correctly classified as $t$, which seems incorrect based on the specification. This equation does not directly align with the requirement that $f(x+\delta) \le 0$ when $C(x+\delta) = t$. 2. $f_{2}(x') = (\max_{i \ne t}( F(x')_i) - F(x')_t)^+$ - This equation checks if the maximum probability of any class other than $t$ is greater than the probability of class $t$. If this difference is positive, it means $x'$ is not classified as $t$, which aligns with the condition $f(x+\delta) > 0$ when $C(x+\delta) \neq t$. However, when $x'$ is classified as $t$, $f_{2}(x') = 0$, which seems to partially align with the specification but might not fully capture the condition $f(x+\delta) \le 0$ when $C(x+\delta) = t$ because it does not guarantee $f(x+\delta) < 0$ for incorrect classifications. 3. $f_{3}(x') = \text{softplus}(\max_{i \ne t}(F(x')_i) - F(x')_t)-\log(2)$ - The softplus function is always positive, and subtracting $\log(2)$ shifts its output. When $\max_{i \ne t}(F(x')_i) - F(x')_t$ is positive (meaning $x'$ is not classified as $t$), $\text{softplus}(\max_{i \ne t}(F(x')_i) - F(x')_t)$ will be greater than $\log(2)$, making $f_{3}(x') > 0$. When $x'$ is classified as $t$, $\max_{i \ne t}(F(x')_i) - F(x')_t \le 0$, and $\text{softplus}(\max_{i \ne t}(F(x')_i) - F(x')_t) - \log(2)$ will be less than or equal to zero because $\text{softplus}(0) = \log(2)$. This equation seems to correctly implement the condition. 4. $f_{4}(x') = (0.5 - F(x')_t)^+$ - This equation checks if the probability of the true class $t$ is less than 0.5. If it is, then $f_{4}(x') > 0$, indicating $x'$ is not classified as $t$. However, this does not directly align with the specification because it does not consider the relative probabilities of other classes, only the absolute probability of class $t$. 5. $f_{5}(x') = -\log(2 F(x')_t - 2)$ - This function will be negative (and thus less than zero) when $F(x')_t > 1$, which is not possible since probabilities are between 0 and 1. For $F(x')_t \le 1$, the function will approach positive infinity as $F(x')_t$ approaches 1, and it will be undefined for $F(x')_t = 1$ because $\log(0)$ is undefined. This equation seems incorrect based on the specification. 6. $f_{6}(x') = (\max_{i \ne t}( Z(x')_i) - Z(x')_t)^+$ - This equation operates on the logits $Z(x')$ instead of the softmax outputs $F(x')$. It checks if the maximum logit of any class other than $t$ is greater than the logit of class $t$. If so, $f_{6}(x') > 0$, indicating $x'$ is not classified as $t$. This aligns with the condition for incorrect classification but does not guarantee $f(x+\delta) \le 0$ when $C(x+\delta) = t$ because it's based on logits, not the final classification probabilities. 7. $f_{7}(x') = \text{softplus}(\max_{i \ne t}(Z(x')_i) - Z(x')_t)-\log(2)$ - Similar to $f_{3}$ but operating on logits, this function will be positive when the maximum logit of any class other than $t$ is significantly greater than the logit of $t$, indicating $x'$ is not classified as $t$. However, like $f_{6}$, it operates on logits and does not directly reflect the final classification probabilities. Based on the analysis, equations $f_{1}$, $f_{4}$, and $f_{5}$ seem incorrect according to the specification because they either do not correctly implement the condition $f(x+\delta) \le 0$ when $C(x+\delta) = t$ or do not align with the intended behavior based on the classification probabilities or logits. The final answer is: $\boxed{[1,4,5]}$
Resulting in output: False