Open Questions about Generative Adversarial Networks(distill.pub)
distill.pub
Open Questions about Generative Adversarial Networks
https://distill.pub/2019/gan-open-problems/
51 comments
Hi! I help maintain Distill's infrastructure. We'd love to find a robust solution for archival, too, but we haven't been able to think of a satisfying automatic way of providing static fallbacks to interactive diagrams. (That's why index.archive.html isn't a public feature ^_^)
If you have an idea of what we could do on our side with a fixed amount of work, please let me know! Unfortunately we can't require our third-party authors to be experts in graceful degradation. I'm sure better tooling could help, but currently have no specific inspiration.
As a fallback for your specific use case—we do actually provide a tiny bit of print styles in our CSS. Try your browser's PDF conversion/print feature; I find it often produces acceptable results. (Minus proper alignment to pages, of course. :/)
If you have an idea of what we could do on our side with a fixed amount of work, please let me know! Unfortunately we can't require our third-party authors to be experts in graceful degradation. I'm sure better tooling could help, but currently have no specific inspiration.
As a fallback for your specific use case—we do actually provide a tiny bit of print styles in our CSS. Try your browser's PDF conversion/print feature; I find it often produces acceptable results. (Minus proper alignment to pages, of course. :/)
Really glad to hear you guys are aware of this! I do love the expressiveness and ease of understanding that interactive diagrams offer, but find the prospect of a mutable scientific literature to be a somewhat horrifying one. I understand and completely agree that academic authors can not reasonably be required to become experts in web design.
---
From my perspective, the main issue seems to be broken formatting and media (alignment, hoverable citations and notes, missing or partial images, etc). The recent activation atlases paper is a particularly good example of the problem (https://distill.pub/2019/activation-atlas). I don't have time to tally up all of the differences right now, but briefly just a few big ones so we have something concrete to refer to here:
* The index.archive.html version shows "Loading..." in place of all the images in the first figure (and most of the other figures as well).
* The Zotero web page snapshot version actually does have the images for the first figure, but that figure still has other issues. Many of the other figures still just show the "Loading..." text though.
* In both cases, text is flowing around the figures in strange and unreadable ways.
* The bibliography for the index.archive.html version is completely broken.
* In both archive cases, uMatrix is showing third party scripts running on the page. I've allowed them, but obviously loading things from remote locations means it isn't really standalone anymore.
---
> we haven't been able to think of a satisfying automatic way of providing static fallbacks to interactive diagrams.
Why does it have to be static? Why worry about graceful degradation at all? I guess I just find myself wondering why there would be two versions of a scientific paper (ie "real" and "archive") in the first place? I don't see any reason why scientific work needs to be published in a static medium, but it does seem like it should always be standalone and immutable.
To that end, why not require submissions themselves to be fully standalone entities with absolutely no external dependencies (ie review them without internet access) and then just publish those? Then instead of pdf papers, you end up with interactive (but standalone) html papers that are viewable in any standards compliant web browser, scripts and all.
Barring such a drastic solution, I don't have any clever ideas from a technical standpoint; I'm not a web design expert nor am I familiar with what tooling you allow authors to make use of in their papers. A fairly blunt approach might just be to require authors to provide static images as standins for each figure. It could literally just be a static image of what the interactive figure initially looks like before you do anything with it. Then you'd just have the existing formatting issues to sort out, but presumably those are fairly straightforward.
An aside: Figures don't seem to be numbered in the activation atlases paper I referenced above. It might be nice to add a requirement to clearly number and label figures, tables, and other such insets - as far as I know, all the major academic publications do this. If you're wondering why, at minimum it makes it much easier to discuss the paper when you have a clear label such as "fig 3a" or "fig 4 panel 2" or whatever to refer to.
---
From my perspective, the main issue seems to be broken formatting and media (alignment, hoverable citations and notes, missing or partial images, etc). The recent activation atlases paper is a particularly good example of the problem (https://distill.pub/2019/activation-atlas). I don't have time to tally up all of the differences right now, but briefly just a few big ones so we have something concrete to refer to here:
* The index.archive.html version shows "Loading..." in place of all the images in the first figure (and most of the other figures as well).
* The Zotero web page snapshot version actually does have the images for the first figure, but that figure still has other issues. Many of the other figures still just show the "Loading..." text though.
* In both cases, text is flowing around the figures in strange and unreadable ways.
* The bibliography for the index.archive.html version is completely broken.
* In both archive cases, uMatrix is showing third party scripts running on the page. I've allowed them, but obviously loading things from remote locations means it isn't really standalone anymore.
---
> we haven't been able to think of a satisfying automatic way of providing static fallbacks to interactive diagrams.
Why does it have to be static? Why worry about graceful degradation at all? I guess I just find myself wondering why there would be two versions of a scientific paper (ie "real" and "archive") in the first place? I don't see any reason why scientific work needs to be published in a static medium, but it does seem like it should always be standalone and immutable.
To that end, why not require submissions themselves to be fully standalone entities with absolutely no external dependencies (ie review them without internet access) and then just publish those? Then instead of pdf papers, you end up with interactive (but standalone) html papers that are viewable in any standards compliant web browser, scripts and all.
Barring such a drastic solution, I don't have any clever ideas from a technical standpoint; I'm not a web design expert nor am I familiar with what tooling you allow authors to make use of in their papers. A fairly blunt approach might just be to require authors to provide static images as standins for each figure. It could literally just be a static image of what the interactive figure initially looks like before you do anything with it. Then you'd just have the existing formatting issues to sort out, but presumably those are fairly straightforward.
An aside: Figures don't seem to be numbered in the activation atlases paper I referenced above. It might be nice to add a requirement to clearly number and label figures, tables, and other such insets - as far as I know, all the major academic publications do this. If you're wondering why, at minimum it makes it much easier to discuss the paper when you have a clear label such as "fig 3a" or "fig 4 panel 2" or whatever to refer to.
I use Zotero with [Zotero Connector](https://www.zotero.org/download/connectors) plugin for Firefox. When saving a webpage to Zotero, it will also save a snapshot of that webpage (a configurable option in Zotero preferences). I tried it with latest two Distill posts, and didn't see any missing images. Actually for those interactive images, there will be a static version and an interactive version of that image in the snapshot, which is acceptable for me. Another problem more annoying is that those inline citations will show up even if you don't hover over them, thus covering underlying texts.
Forgot to mention originally, but I did try Zotero's snapshot feature. It seems to work better for some papers than others - the activation atlases one (https://distill.pub/2019/activation-atlas/) is particularly bad. As you note, the hoverable citations and notes are also a problem.
It's not that I have any pressing need for offline copies at this precise instant, but they have proven useful on a number of occasions.
It's not that I have any pressing need for offline copies at this precise instant, but they have proven useful on a number of occasions.
Haven't tried it on distil, but maybe this works? https://github.com/jgm/standalone-html
Looks interesting, I'll try it out when I get a chance. I suspect it functions in a similar manner to Zotero's built in archiver though, so I'm not optimistic about what the results will look like.
It depends how deep you want to go into the web archiving rabbit-hole, but using something like `archivenow`[0] would probably be the local optimum in terms of convenience, robustness, and permanence.
It's "a tool to push web resources into web archives", which basically entails making requests of archiving services (like the Wayback machine, for example). Using `archivenow --all <url>`, you can back up <url> to a whole bunch of different services, and get links to snapshots of that page at the time of access.
This is mostly sufficient, so long as at least one service is trustworthy and doesn't shut down unexpectedly. One issue that might come up is that the archives might miss content if the user has to interact with the page a bunch in order to reveal it, but that's unlikely to be an issue for the sorts of things an academic would be archiving.
As another poster mentioned, some bibliography managers have this capability baked in, or can acquire it with a plugin.
However, if you want more control, you might consider using something like `pywb`[1] to make your own web archive, and then host it yourself (e.g., on S3 or something). For more robustness, you could also publish those WARC files as torrents, or on IPFS, or if you're really cool, as part of the transaction messages on some blockchain (provided that you can stomach the transaction fees and don't anticipate having a large audience in China).
The above will probably suffice so long as the Internet continues to function as a going concern. To accommodate concerns about what happens in the case of total societal collapse, I've been backing up the papers that I cite by converting to binary[2] and preserving the result via aluminum punchcards, which I then mail to Sam Altman since he's got a way better game plan for the end times than I do[3].
I'm not sure if aluminum is optimal for this purpose though, both for material science reasons and because I've been informed that I am under investigation for my role in some sort of aluminum smuggling ring. If that fails, my last backup plan entails constructing an allegorical representation of the papers in question (which is surprisingly easy-- the Hero's Journey from Joseph Campbell[4]'s exegesis is basically about differential equations anyways), which I will then craft into a compelling mythology and teach to the local youths. Hopefully this will ensure that the citations are preserved via oral tradition even in the wake of cataclysmic change. Figuring out the BibTeX for this archival format will be pretty tricky, though.
But yeah, unless you have some extra aluminum lying around, `archivenow` or whatever's built-in to your reference manager should do the trick.
---
0. github.com/oduwsdl/archivenow
1. github.com/webrecorder/pywb
2. After stripping most of the markup removing images using `pandoc`, as aluminum is expensive.
3. https://www.bloomberg.com/features/2018-rich-new-zealand-doo...
4. https://en.wikipedia.org/wiki/Joseph_Campbell
It's "a tool to push web resources into web archives", which basically entails making requests of archiving services (like the Wayback machine, for example). Using `archivenow --all <url>`, you can back up <url> to a whole bunch of different services, and get links to snapshots of that page at the time of access.
This is mostly sufficient, so long as at least one service is trustworthy and doesn't shut down unexpectedly. One issue that might come up is that the archives might miss content if the user has to interact with the page a bunch in order to reveal it, but that's unlikely to be an issue for the sorts of things an academic would be archiving.
As another poster mentioned, some bibliography managers have this capability baked in, or can acquire it with a plugin.
However, if you want more control, you might consider using something like `pywb`[1] to make your own web archive, and then host it yourself (e.g., on S3 or something). For more robustness, you could also publish those WARC files as torrents, or on IPFS, or if you're really cool, as part of the transaction messages on some blockchain (provided that you can stomach the transaction fees and don't anticipate having a large audience in China).
The above will probably suffice so long as the Internet continues to function as a going concern. To accommodate concerns about what happens in the case of total societal collapse, I've been backing up the papers that I cite by converting to binary[2] and preserving the result via aluminum punchcards, which I then mail to Sam Altman since he's got a way better game plan for the end times than I do[3].
I'm not sure if aluminum is optimal for this purpose though, both for material science reasons and because I've been informed that I am under investigation for my role in some sort of aluminum smuggling ring. If that fails, my last backup plan entails constructing an allegorical representation of the papers in question (which is surprisingly easy-- the Hero's Journey from Joseph Campbell[4]'s exegesis is basically about differential equations anyways), which I will then craft into a compelling mythology and teach to the local youths. Hopefully this will ensure that the citations are preserved via oral tradition even in the wake of cataclysmic change. Figuring out the BibTeX for this archival format will be pretty tricky, though.
But yeah, unless you have some extra aluminum lying around, `archivenow` or whatever's built-in to your reference manager should do the trick.
---
0. github.com/oduwsdl/archivenow
1. github.com/webrecorder/pywb
2. After stripping most of the markup removing images using `pandoc`, as aluminum is expensive.
3. https://www.bloomberg.com/features/2018-rich-new-zealand-doo...
4. https://en.wikipedia.org/wiki/Joseph_Campbell
That New Zealand thing was an amusing read. I'm not actually as concerned with archiving itself as I am with having an offline cache of the data in my library for convenience. Also having an immutable snapshot (not necessarily static) seems important somehow.
That's going to be one HUUUUUGE mythology... I'm looking forward to it!
That's going to be one HUUUUUGE mythology... I'm looking forward to it!
Someone on the machine learning reddit asked me this:
> Question: How does copyright work for GAN output? If I input 300,000 copyright protected photos of celebrities and generate images of new celebrities that do not exist, are the generated images public domain or would there be copyright issues?
AFAIK, this is not a settled issue, but I'd be really interested hear what an actual lawyer thinks about this?
> Question: How does copyright work for GAN output? If I input 300,000 copyright protected photos of celebrities and generate images of new celebrities that do not exist, are the generated images public domain or would there be copyright issues?
AFAIK, this is not a settled issue, but I'd be really interested hear what an actual lawyer thinks about this?
I am not a lawyer, but like many Internet entrepreneurs, I’ve had to learn a bit about copyright. There are two cases in the 9th Circuit that speak to this: Perfect 10 vs Amazon and Kelly vs Arriba Soft.
As I understand it, the cases established a multi-part test for whether a particular use of images is infringing. One of the key parts is whether the use is “transformational”—I would argue that most GAN output would fall under this fair use exception for transformational use and thus would be ok (at least here in Calif).
In the aforementioned cases, thumbnailing a la Google images was sufficiently transformational so synthesizing whole new images certainly should be. The tests do, however, depend on the use so I wouldn’t say that re-synthesizing similar-but-different images with a NN is always and automatically fair use.
As I understand it, the cases established a multi-part test for whether a particular use of images is infringing. One of the key parts is whether the use is “transformational”—I would argue that most GAN output would fall under this fair use exception for transformational use and thus would be ok (at least here in Calif).
In the aforementioned cases, thumbnailing a la Google images was sufficiently transformational so synthesizing whole new images certainly should be. The tests do, however, depend on the use so I wouldn’t say that re-synthesizing similar-but-different images with a NN is always and automatically fair use.
The main question is that of whether the produced image is a derivative work. The interesting requirement is that the derivative work has originality. I can't tell whether there's a legal definition of originality, or if it's an "I know it when I see it" kind of thing.
What's so interesting with ML is that there's a dense spectrum between memorization and originality. I hope in the future people start checking how much their models are memorizing.
My favorite case is Google's facts, like when you google "golden retriever weight." From other people going out, measuring it, writing it up, and publishing that info to the web, Google can extract the info and never direct traffic to those sites. I still don't know whether I think it's okay.
What's so interesting with ML is that there's a dense spectrum between memorization and originality. I hope in the future people start checking how much their models are memorizing.
My favorite case is Google's facts, like when you google "golden retriever weight." From other people going out, measuring it, writing it up, and publishing that info to the web, Google can extract the info and never direct traffic to those sites. I still don't know whether I think it's okay.
GAN images are, I think, as far as humans go, pretty creative. It's easy to look at them knowing what they are and dismiss them (especially if you focus on the worst samples), but if you didn't know...
One of the things that has most amused me about creating https://www.thiswaifudoesnotexist.net is watching the reactions to images being posted elsewhere, especially without (initial) attribution: not a few people like the faces enough to request info about the character or artist, or say that it looks a bit machine-learning-like but is obviously too good to actually be ML-generated, or compliment OP on their illustration! People have begun casually using them as avatars, and there's one account on Pixiv for just uploading TWDNE or other faces generated by my StyleGAN models.
One of the things that has most amused me about creating https://www.thiswaifudoesnotexist.net is watching the reactions to images being posted elsewhere, especially without (initial) attribution: not a few people like the faces enough to request info about the character or artist, or say that it looks a bit machine-learning-like but is obviously too good to actually be ML-generated, or compliment OP on their illustration! People have begun casually using them as avatars, and there's one account on Pixiv for just uploading TWDNE or other faces generated by my StyleGAN models.
Facts are not copyrightable
Link: http://www.dmlp.org/legal-guide/works-not-covered-copyright#...
Link: http://www.dmlp.org/legal-guide/works-not-covered-copyright#...
Legal question aside, it's still can't decide if I feel like it's dickish.
Even that has a spectrum, from "What is harry potter book is first?" to "What is the first line of harry potter?" to "What is the text of the first harry potter book?"
Even that has a spectrum, from "What is harry potter book is first?" to "What is the first line of harry potter?" to "What is the text of the first harry potter book?"
That does depend on jurisdiction and the definition of fact
(for an extreme version the other way round: for a long time a UK copyright troll called Football DataCo claimed copyright of lists of UK football scores and demanded license fees - even where publishers actually obtained the scores from sending their own journalists to grounds. This was eventually overruled by the European Court of Justice, so it might be back again in future...)
A lot of Google's answers to questions veer towards being written opinions and original definitions anyway
A lot of Google's answers to questions veer towards being written opinions and original definitions anyway
Take a look here "Why Is AI Art Copyright So Complicated?":
https://www.artnome.com/news/2019/3/27/why-is-ai-art-copyrig...
> Claims that AI is creating art on its own and that machines are somehow entitled to copyright for this art are simply naive or overblown, and they cloud real concerns about authorship disputes between humans. The introduction of machine learning as an art tool is ironically increasing human involvement, not decreasing it. Specifically, the number of people who can potentially be credited as coauthors of an artwork has skyrocketed. This is because machine learning tools are typically built on a stack of software solutions, each layer having been designed by individual persons or groups of people, all of whom are potential candidates for authorial credit.
https://www.artnome.com/news/2019/3/27/why-is-ai-art-copyrig...
> Claims that AI is creating art on its own and that machines are somehow entitled to copyright for this art are simply naive or overblown, and they cloud real concerns about authorship disputes between humans. The introduction of machine learning as an art tool is ironically increasing human involvement, not decreasing it. Specifically, the number of people who can potentially be credited as coauthors of an artwork has skyrocketed. This is because machine learning tools are typically built on a stack of software solutions, each layer having been designed by individual persons or groups of people, all of whom are potential candidates for authorial credit.
Really interesting question, and one that won't be settled until it's explicitly legislated (or taken to court).
I have a background as a lawyer (albeit not in IP) and currently working with ML, and I can see a case being made either way.
I have a background as a lawyer (albeit not in IP) and currently working with ML, and I can see a case being made either way.
Good question, IANAL but how is a human artist drawing a face (based on their learned reality of what a face looks like) any different than a GAN drawing a face (based on the GAN learned reality)?
> IANAL but how is a human artist drawing a face (based on their learned reality of what a face looks like) any different than a GAN drawing a face (based on the GAN learned reality)?
A human artist is a legal person, a GAN is not. That's a fairly substantial legal difference.
A human artist is a legal person, a GAN is not. That's a fairly substantial legal difference.
Reminds me of Bicentennial Man: https://m.imdb.com/title/tt0182789/
but the person who executed the GAN is a human, they are an artist who's tools are just different
But the output result is the same (i.e. human can produce a drawing of a face, GAN can produce a new drawing of a face).
If another animal such as chimp draws a human face what do you think would be the outcome? Would a chimp drawing a face be any different to a human drawing a face?
If another animal such as chimp draws a human face what do you think would be the outcome? Would a chimp drawing a face be any different to a human drawing a face?
> But the output result is the same
Law is only extremely rarely concerned with only output results and not process, status of actors, etc.
> Would a chimp drawing a face be any different to a human drawing a face?
Yes, legally, the outcome wouldd be different (whether it was original, a direct copy, or something made by copying elements but with some new content) because chimps are neither legal actors that can create a copyright through authorship nor ones who can violate copyright.
Law is only extremely rarely concerned with only output results and not process, status of actors, etc.
> Would a chimp drawing a face be any different to a human drawing a face?
Yes, legally, the outcome wouldd be different (whether it was original, a direct copy, or something made by copying elements but with some new content) because chimps are neither legal actors that can create a copyright through authorship nor ones who can violate copyright.
Interesting, also what do you mean by "status of actors"?
There’s a really interesting adjacent problem - the so-called “monkey selfie” which was recently settled by stating that works created by a non human we’re not copyrightable.
See https://en.m.wikipedia.org/wiki/Monkey_selfie_copyright_disp...
See https://en.m.wikipedia.org/wiki/Monkey_selfie_copyright_disp...
I’m curious as well. I imagine the definition of “derivative work” might be an interesting sub-problem to resolve while trying to answer the original question.
So if you wave your hands enough, it seems like maybe there's an argument to be made that the weights of a trained GAN somehow correspond to a 'compilation' of the training data as it's defined in this doc: https://www.copyright.gov/circs/circ14.pdf
With a compilation, you are able to find the original sources, but with a GAN is it even possible to find the original sources based on an output result alone?
How would you even prove “derivative work”? My understanding is that in proving derivative work you would need to show the original, but in a GAN output which could be made up of 20MM nodes you would not even be able to confirm which 200K image(s) where used in the production of the output result
This actually might have interesting connections to ideas from differential privacy.
Maybe the work is derivative of a particular training image if we can easily predict the presence or absence of that training image given only the trained model?
Maybe the work is derivative of a particular training image if we can easily predict the presence or absence of that training image given only the trained model?
If you load 50k celebrity images into a tensor of size (500000, 28, 28, 3) and then generate a resulting tensor that results in a (28, 28, 3) tensor where each of the pixel locations is merged to form an average face image (similar to https://www.dailymail.co.uk/femail/article-1355521/Average-f... ), then although the trained model contains all the images; I would have thought the output average face image is an entirely new creative work?
Hey, I wrote this! Happy to answer questions.
So let's say I'm in a regime where I'd like to train something like a language model RNN on a private text dataset. If I train the RNN directly on the data then I'm essentially leaking private data to the output. Do you know of any approaches to generate fake data using GANs, train a language model on that fake data and still get a good classifier that does well on test data while still quantifying how much private data is being leaked?
Related: do GANs work well as a data augmentation technique and can their exact contribution to how much a model could potentially be improved be quantified.
EDIT: Added some clarifications
Related: do GANs work well as a data augmentation technique and can their exact contribution to how much a model could potentially be improved be quantified.
EDIT: Added some clarifications
You could train your classifier on a labeled private dataset, use it to classify unlabeled samples from a public dataset, then throw away your original classifier and use its classifications on the public dataset to train a replacement. That new classifier will only leak information that could also have been derived from the public dataset, if it had been labeled.
I can think of two ways that procedure can fail:
1. If some aspects of the private data aren't represented in the public dataset (e.g. codewords in classified documents), the final classifier won't recognize them. On the other hand, I'm not sure whether there's an actual use case for making a classifier public that's required to work on data that can only be obtained from a non-public source.
2. If some aspects of your labels are sensitive (e.g. which political opinions you agree with) then labeling the public dataset retains that information. In that case, you'd likely need to apply techniques similar to those studied for removing racial or gender bias from a model.
I can think of two ways that procedure can fail:
1. If some aspects of the private data aren't represented in the public dataset (e.g. codewords in classified documents), the final classifier won't recognize them. On the other hand, I'm not sure whether there's an actual use case for making a classifier public that's required to work on data that can only be obtained from a non-public source.
2. If some aspects of your labels are sensitive (e.g. which political opinions you agree with) then labeling the public dataset retains that information. In that case, you'd likely need to apply techniques similar to those studied for removing racial or gender bias from a model.
You can train rnn on encrypted data
Sure but the output would still leak data. E.g: You give the RNN the phrase "Chase Bank" and it outputs "Sell the stock".
Encrypting the data secures the data loading part but it's not like your model didn't learn anything.
Encrypting the data secures the data loading part but it's not like your model didn't learn anything.
The output would be encrypted of course. You’d decrypt it on your end. Whoever hosts the model can’t know what it learned, without breaking your encryption.
Unless you use fully homomorphic encryption (way too expensive for machine learning), the model can't learn anything without breaking your encryption. So you fixed the leak only at the cost of making the model completely useless.
Source? Unless the encryption actually destroys information I don’t see why it would necessarily make the job harder for the rnn.
If you want to learn the function y = f(x), but present x and y as encrypted data x' and y', the problem becomes finding g such that g(x') = y' = encrypt(y) = encrypt(f(x)) = encrypt(f(decrypt(x'))), so the model doesn't just have to learn f, it also has to solve for the decryption and encryption routines.
You look at this as a human, but for an rnn this would be the same as learning to map x to y where both x and y are in a different language. It wouldn't need to also learn how to translate that language into ours.
There might be encryption schemes which make learning such a "language" harder for an rnn, but it does not necessarily mean these methods are harder to break. So it might be possible to find/design an encryption method which is easy to learn (map x to y), but hard to break. I don't know much about encryption though, so I might be wrong.
There might be encryption schemes which make learning such a "language" harder for an rnn, but it does not necessarily mean these methods are harder to break. So it might be possible to find/design an encryption method which is easy to learn (map x to y), but hard to break. I don't know much about encryption though, so I might be wrong.
If an encryption scheme is easy to learn in the sense that if f is learnable, then so is g, then it is also easy to break.
Proof: You can easily train an RNN to return the n-th letter of its input and ignore everything else. Take that function to be f_n. Then g_n is the function that takes the encrypted input and returns the n-th letter, encrypted. If the encryption scheme is learnable in the above sense, then you can also train an RNN to perform that task. You can use multiple of those RNNs to extract an encryption of each individual letter in the input, which is equivalent to having the input encrypted with a substitution cipher. Substitution ciphers are so easy to break with frequency analysis that people have been doing it by hand for more than a thousand years.
Conversely, if you have a secure encryption scheme, then all statistical regularities in the input should be obfuscated so that they cannot be exploited by an RNN.
Proof: You can easily train an RNN to return the n-th letter of its input and ignore everything else. Take that function to be f_n. Then g_n is the function that takes the encrypted input and returns the n-th letter, encrypted. If the encryption scheme is learnable in the above sense, then you can also train an RNN to perform that task. You can use multiple of those RNNs to extract an encryption of each individual letter in the input, which is equivalent to having the input encrypted with a substitution cipher. Substitution ciphers are so easy to break with frequency analysis that people have been doing it by hand for more than a thousand years.
Conversely, if you have a secure encryption scheme, then all statistical regularities in the input should be obfuscated so that they cannot be exploited by an RNN.
Good point. I didn't realize the goal of a good cipher is to remove statistical regularities (i.e. make it indistinguishable from random noise).
You mention possible score functions in Problem 5, so I have a query about that.
This has been bugging me for a bit-- is there a characterization of applicable loss functions for GANs?
I'm curious about their effects on the results, but also if there's room for different losses.
Or do we capture most desirable behavior using the listed score functions?
Hmm, I'm not sure what you mean by applicable loss functions?
I'll answer what I think you're asking and you can tell me if I got it wrong:
There's been a lot of effort spent on coming up with different loss functions for GANs, but https://arxiv.org/abs/1711.10337 shows that, according to the metrics in problem 5, they don't really improve results compared to the original GAN loss function.
There's something called a Wasserstein GAN https://arxiv.org/abs/1701.07875 that you may have heard about, but IMO the useful thing to take away from that paper is their 'gradient penalty' technique and not the new loss function.
I'll answer what I think you're asking and you can tell me if I got it wrong:
There's been a lot of effort spent on coming up with different loss functions for GANs, but https://arxiv.org/abs/1711.10337 shows that, according to the metrics in problem 5, they don't really improve results compared to the original GAN loss function.
There's something called a Wasserstein GAN https://arxiv.org/abs/1701.07875 that you may have heard about, but IMO the useful thing to take away from that paper is their 'gradient penalty' technique and not the new loss function.
I'm interested in using GAN as a method to make authorship attribution more robust.
Using complex NN models (let's say, LSTM) doesn't give much better results than simple neurons with deep layers. Seems that the model extraction (how to represent some author style) is the only point that matters, and it then easily forged (i.e., not hard to reproduce the desired style on purpose).
I'm trying to use GAN as a mean of desconstruction, of removal of the ease patterns to see if some NN can use subtle characteristics to identify the author.
Using complex NN models (let's say, LSTM) doesn't give much better results than simple neurons with deep layers. Seems that the model extraction (how to represent some author style) is the only point that matters, and it then easily forged (i.e., not hard to reproduce the desired style on purpose).
I'm trying to use GAN as a mean of desconstruction, of removal of the ease patterns to see if some NN can use subtle characteristics to identify the author.
So you are worried that your existing attribution method is too focused on 'obvious' attributes and you want to see if you can make it focus on less obvious things?
IIUC, that's something that's been looked at in the ML Fairness literature. See this paper for example: http://www.aies-conference.com/wp-content/papers/main/AIES_2...
IIUC, that's something that's been looked at in the ML Fairness literature. See this paper for example: http://www.aies-conference.com/wp-content/papers/main/AIES_2...
Off-topic but I love the design of this blog article. Everyone is copying Medium these days so it's refreshing to see a smaller-typed and denser design for once.
Regular journal articles are published as PDF files, which make a decent electronic analog of physical paper. In the case of Distill, there's the usual DOI, volume, and issue, but the page itself isn't static. I did find a seemingly undocumented feature referenced in a GitHub issue - you can append "index.archive.html" to the url to get a supposedly standalone html archive of the page. However, when I tried this with a number of recent publications there were missing images and broken formatting all over the place, seemingly due to the authors having linked in external resources (primarily for a number of the figures).
Does anyone know how to do this or have any ideas?