Lecture 16: VAEs + GANs + Adversarial examples

• Today we’re finishing VAEs, then we’ll go through most of GANs, and maybe touch on
adversarial examples (time permitting).

• Projects due March 20, Monday of finals week. Each team should have just one person
submit the project report PDF and link their teammates in the Gradescope submission
portal.

• Please submit your code (.py, .ipynb) files to Bruin Learn (submission portal to be
e n

setup). This is for us to verify your implementations. Do not submit your report PDF to
=>

Bruin Learn.

• I will send out a couple of optional surveys, with your feedback much appreciated.

discussions
·
Diff- schedule
for week 10 -
see B.L.

Prof J.C. Kao, UCLA ECE

Lecture 16: VAEs + GANs + Adversarial examples

Prof J.C. Kao, UCLA ECE

 a

p(zIX)

zwN(0,1)

193072x3072
Prof J.C. Kao, UCLA ECE
We need the posterior to arrive at an expression

Prof J.C. Kao, UCLA ECE

We need the posterior to arrive at an expression

Y(z) -N(0,e)

Prof J.C. Kao, UCLA ECE

 We need the posterior to arrive at an expression

zEIB
p(z) N(0,2)
=

How are q(z|x) and p(z) related?

at
9121x
⑧

↑
z2

q(z)x 7)
=

⑲911x 1)
=

Z1
p(x/z) Prof J.C. Kao, UCLA ECE
 When we take approximations, we need a way to see how good it is

Whenever we make approximations of a function (or distribution), it’s important

that we quantify how good it is. The common way to do this in machine
learning is to use something called the KL divergence.

Prof J.C. Kao, UCLA ECE

 Intuition of VAE

Red Generating.
Dim

Prof J.C. Kao, UCLA ECE

 Deriving the ELBO

-
Gr
I
=

q(z/X). log pox)

=log po(x). ([9(z1x)]

I
-log po(x).
Prof J.C. Kao, UCLA ECE
 Deriving the ELBO

↑
zuq(zIx) (Malz),
~10.
[o(z)
I(

↑- -VAE

-
i n tractabl e s, so it

p(x)z) -N ⑳00
to calc. 08
easy
-

p(z) e N -

- -
>0
eN
q(z/x) - --

q(zIX)
- v
-
P
is
p(zIX)
intractable

Prof J.C. Kao, UCLA ECE

Deriving the ELBO

Prof J.C. Kao, UCLA ECE

Calculating the ELBO and its gradients

L
I re Prof J.C. Kao, UCLA ECE
 Calculating the ELBO and its gradients

~N(0,1)

z-N(My(x),2p(x))
& L -
b cs
=
d
+

b-N(d,c3)
s-N(0,1)
- >

Prof J.C. Kao, UCLA ECE

Calculating the ELBO and its gradients

e Prof J.C. Kao, UCLA ECE

Calculating the ELBO and its gradients

Prof J.C. Kao, UCLA ECE

 Lecture 16: Generative adversarial networks

In this lecture, we’ll talk about a generative model that does even better (at
least subjectively) at generating images. It’s based on a completely different
idea, where no probability density has to be estimated. It does this through
game theory, pitting two “adversary” neural networks against each other.

Refer to Goodfellow et al., 2014; as well as the tutorial by Goodfellow, 2016.

Prof J.C. Kao, UCLA ECE

 Generative models

VAE’s were able to sample from an inferred distribution to generate images

with the statistics of the training set.

However, these images aren’t great. We could tell that they’re not real faces,
and they’re quite blurred in several places.

Prof J.C. Kao, UCLA ECE

 Generative models

There are fundamentally different approaches to make generative models.

We’re going to talk about one that substantially improves on the VAE (at least
subjectively in generating images.) This is the generative adversarial network
(GAN).

Prof J.C. Kao, UCLA ECE

VAE generating samples from CIFAR-10

Prof J.C. Kao, UCLA ECE

GANs generating samples from CIFAR-10

2015
Radford,

Prof J.C. Kao, UCLA ECE

 GAN examples

Predicting the future

Lotter et al., 2016

Prof J.C. Kao, UCLA ECE

 GAN examples

Super-resolution:

Ledig et al., 2016

Prof J.C. Kao, UCLA ECE

 GAN examples

Super-resolution:

Ledig et al., 2016

Prof J.C. Kao, UCLA ECE

 GAN examples

Super-resolution:

Ledig et al., 2016

Prof J.C. Kao, UCLA ECE

 GAN examples

Image to image translation

Isola et al., 2017

Prof J.C. Kao, UCLA ECE

 GAN examples

DCGAN generates images that could fool us.

Radford et al., 2015

Prof J.C. Kao, UCLA ECE

 GAN examples

Interpolating between bedrooms; intermediate images are plausible

bedrooms.
z - NI0,1)

Radford et al., 2015

m
Prof J.C. Kao, UCLA ECE
 GAN examples

Doing vector arithmetic:

MaAN MGAN ↑GAN ↑GAN Radford et al., 2015

Z, EIR
- 22 + Es =
24

Prof J.C. Kao, UCLA ECE

 GAN examples

Doing vector arithmetic:

Radford et al., 2015

Prof J.C. Kao, UCLA ECE

 How do GANs work?

GANs are a completely different approach to generate samples. They don’t

require any probabilistic learning.

GAN
VAE -

zWN(0,I)
zuN(0,1)

↓ ↓ GAN

q(x(z) X

Prof J.C. Kao, UCLA ECE

 GAN setup

GANs have two networks: a generator network that generates samples that
look like your training set, and a discriminator network that looks at both real
and fake samples and decides if they are real or fake.

- -
-

0 0
⑧ I I I

x
model
-

NN

~
N10,I)
cs231n.stanford.edu

Prof J.C. Kao, UCLA ECE

 I
TWO NNS
One NN
GAN setup 0(a) &(D)
O

21073 - Two

(a)
loss
frs:(a)
I I

-> Pmodel(x)
p(x) Poata (X)
->

Prof J.C. Kao, UCLA ECE

GAN setup

Prof J.C. Kao, UCLA ECE

GAN setup

Prof J.C. Kao, UCLA ECE

 GAN setup
Both G and know
I each other's
equilibrium strategy.
anything (improve
their loss)
Neither
player can
gain
by changing its strategy.

(X)
P data

Prof J.C. Kao, UCLA ECE

 e1 if real
D(x) Discriminator setup
T 0
if fake pdata
x -

X G(z) =

X Pmodal

D(x) 0
=

if
if
D(x)
'10g4(x)
=

log(1 D(Y))
I
0
=

-
=

0
- en

- -

discriminator
ente

Prof J.C. Kao, UCLA ECE

 Discriminator setup

-
Real -> Fake

Prof J.C. Kao, UCLA ECE

Ex-p(x)[f(x) (p(x).f(x)dX
Discriminator setup
=

--

-
I O

Prof J.C. Kao, UCLA ECE

 Discriminator setup

The
↳ -> (Goodfellow
NewRIPS 2014)

O
(D)
E
discriminator.
the
The
opt, strategy of

Prof J.C. Kao, UCLA ECE

 Discriminator setup

Pdata
=
↳
⑧

Pmodel
--

--
-
D(x)
=

+pdatax
atas
D(x) =

s0000
↓

G(z)

~N10,13

Goodfellow et al., 2014

-mining
Prof J.C. Kao, UCLA ECE
Solution to the game

Prof J.C. Kao, UCLA ECE

Solution to the game

Prof J.C. Kao, UCLA ECE

Zero sum game

-e

Prof J.C. Kao, UCLA ECE

Minimax optimization

2(4)
-

generator
-

Prof J.C. Kao, UCLA ECE

Minimax optimization

Prof J.C. Kao, UCLA ECE

Minimax optimization

Prof J.C. Kao, UCLA ECE

What about the loss?

G
-

I a z

Prof J.C. Kao, UCLA ECE

 Minimax optimization

- -

·2 see
-

when G bad,
is
D((z)) = 0

Prof J.C. Kao, UCLA ECE

Minimax optimization

Prof J.C. Kao, UCLA ECE

Minimax optimization

Prof J.C. Kao, UCLA ECE

Minimax optimization

Prof J.C. Kao, UCLA ECE

Minimax optimization
:
do

Prof J.C. Kao, UCLA ECE

Training GANs

Prof J.C. Kao, UCLA ECE

Training GANs

Prof J.C. Kao, UCLA ECE

 Lecture 17: Adversarial examples

In this last topic of lecture, we’ll discuss adversarial examples and neural
network susceptibility to them.

- We’ve heard a lot of success stories of neural networks.

- But one notable area where results are more discouraging (hence, an
active area of research) is that of handling adversarial examples.
- In short, it’s not difficult to attack or fool a neural network into
misclassifying results.
- And there are some characteristics of these attacks that are especially
worrying.

Prof J.C. Kao, UCLA ECE

Adversarial examples

Prof J.C. Kao, UCLA ECE

 Adversarial examples

Szegedy et al., 2013, was one of the early papers to describe adversarial
examples in neural networks.

In these figures below, the experiment was to slowly turn an object into an
airplane and see how the network would change the image.

Goodfellow, http://cs231n.stanford.edu/slides/2017/cs231n_2017_lecture16.pdf

Prof J.C. Kao, UCLA ECE

 Adversarial examples

Adversarial noise can be designed in such a way that it can add

imperceptible noise at the input, but completely alter the network output. Note
also that the network is extremely confident that the panda is a gibbon.

Prof J.C. Kao, UCLA ECE

 Adversarial examples

An aside: does the brain have adversarial examples?

Prof J.C. Kao, UCLA ECE

 Adversarial examples

This seems like really bad news.

As if that wasn’t enough, it gets worse. But before we get there, let’s build
some intuition for why these examples occur.

Prof J.C. Kao, UCLA ECE

 Fooling a linear binary classifier

onlinepoll.ucla.edu, search for 239as_0311_2

Prof J.C. Kao, UCLA ECE

Fooling a linear binary classifier

Prof J.C. Kao, UCLA ECE

Fooling a linear binary classifier

Prof J.C. Kao, UCLA ECE

The fast sign gradient method

Prof J.C. Kao, UCLA ECE

The fast sign gradient method

Prof J.C. Kao, UCLA ECE

The fast sign gradient method

Prof J.C. Kao, UCLA ECE

The Potemkin village

Prof J.C. Kao, UCLA ECE

 Is this really a problem?

At this point, you may be thinking, is this really a problem? The thought goes
as follows:

- Sure, we can trick neural networks, but we need to know their parameters,
and do this extremely precise perturbation to add this noise vector.

- In real life applications, people can’t add such precise noise to objects
(e.g., a stop sign).

- Further, if people don’t know the parameters (W) of my neural network, how
can they design the attack?

- Thus, this seems like mostly an academic exercise.

It turns out that this line of reasoning is incorrect.

Prof J.C. Kao, UCLA ECE

Even scarier news

Prof J.C. Kao, UCLA ECE

 Even scarier news

Transferability between different algorithms (!)

Papernot et al., 2016

Prof J.C. Kao, UCLA ECE

 Even scarier news

Transferability between DNN’s

Papernot et al., 2016

Prof J.C. Kao, UCLA ECE

 Even scarier news

Transferability between DNN’s

Liu et al., 2016

Prof J.C. Kao, UCLA ECE

 Even scarier news

Getting adversarial examples from ensemble models… really bad.

Liu et al., 2016

Prof J.C. Kao, UCLA ECE

Even scarier news

Kurakin et al., 2016

Prof J.C. Kao, UCLA ECE

 Why do adversarial examples occur?

Why do adversarial examples occur? Let’s look at two hypotheses:

The overfitting hypothesis: The linear hypothesis:

classify o
classify x
o
o
o o
x x o
x o
x o
x
x
x x o
x

cs231n, http://cs231n.stanford.edu/slides/2016/winter1516_lecture9.pdf

onlinepoll.ucla.edu, search for 239q9.

Prof J.C. Kao, UCLA ECE
Why do adversarial examples occur?

Prof J.C. Kao, UCLA ECE

Why do adversarial examples occur?

Prof J.C. Kao, UCLA ECE

Why do adversarial examples occur?

Prof J.C. Kao, UCLA ECE

Why do adversarial examples occur?

Prof J.C. Kao, UCLA ECE

Why do adversarial examples occur?

Goodfellow, 2016

Prof J.C. Kao, UCLA ECE

Why do adversarial examples occur?

Goodfellow, 2016

Prof J.C. Kao, UCLA ECE

Why do adversarial examples occur?

Prof J.C. Kao, UCLA ECE

Adversarial training

Prof J.C. Kao, UCLA ECE

Adversarial training

Goodfellow, 2016

Prof J.C. Kao, UCLA ECE

 An active area of research

In this paper we evaluate ten proposed defenses and demonstrate that none
of them are able to withstand a white-box attack.

(Carlini & Wagner, 2017).

Prof J.C. Kao, UCLA ECE