Visual Saliency Based on Multiscale Deep Features

Abstract: Visual saliency is a fundamental problem in both cognitive and computational sciences, including computer vision. In this CVPR 2015 paper, we discover that a high-quality visual saliency model can be trained with multiscale features extracted using a popular deep learning architecture, convolutional neural networks (CNNs), which have had many successes in visual recognition tasks. For learning such saliency models, we introduce a neural network architecture, which has fully connected layers on top of CNNs responsible for extracting features at three different scales. We then propose a refinement method to enhance the spatial coherence of our saliency results. Finally, aggregating multiple saliency maps computed for different levels of image segmentation can further boost the performance, yielding saliency maps better than those generated from a single segmentation. To promote further research and evaluation of visual saliency models, we also construct a new large database of 4447 challenging images and their pixelwise saliency annotation. Experimental results demonstrate that our proposed method is capable of achieving state-of-the-art performance on all public benchmarks, improving the F-Measure by 5.0% and 13.2% respectively on the MSRA-B dataset and our new dataset (HKU-IS), and lowering the mean absolute error by 5.7% and 35.1% respectively on these two datasets.

The Secrets of Salient Object Segmentation

Abstract: In this paper we provide an extensive evaluation of fixation prediction and salient object segmentation algorithms as well as statistics of major datasets. Our analysis identifies serious design flaws of existing salient object benchmarks, called the dataset design bias, by over emphasizing the stereotypical concepts of saliency. The dataset design bias does not only create the discomforting disconnection between fixations and salient object segmentation, but also misleads the algorithm designing. Based on our analysis, we propose a new high quality dataset that offers both fixation and salient object segmentation ground-truth. With fixations and salient object being presented simultaneously, we are able to bridge the gap between fixations and salient objects, and propose a novel method for salient object segmentation. Finally, we report significant benchmark progress on three existing datasets of segmenting salient objects

Statistics of relevant SOD datasets.`#Images' indicates the number of images in a dataset.

Dataset and data augmentation.
We uniformly train our model and competitors on the MSRA-B {{cite:38d9fbc}}
training set for a fair comparison.
The MSRA-B dataset with 5000 images in total is equally split into training/testing
subsets.
We test the trained models on 5 other SOD datasets:
ECSSD {{cite:e8dfda2}},
HKU-IS {{cite:8d32e9b}},
PASCALS {{cite:c9c6256}},
SOD {{cite:c9ed9d3}},
and DUT-OMRON {{cite:c9ed9d3}}.
More statistics of these datasets are shown in Tab. {{table:9a00bb78-eccf-42e0-948c-f0f7b04127ee}} .
It's worth mentioning that the challenging degree of a dataset is determined by many factors
such as the number of images, the number of objects in one image,
the contrast of salient objects w.r.t the background,
the complexity of salient object structures, the center bias of salient objects and
the size variance of images etc.
Analysing these details is out of the scope of this paper,
we refer the readers to  {{cite:fb0e37e}} for more analysis of datasets.


Adversarial attack on malware detection using raw bytes

Explainable technique for efficient adversarial generation

Test existing methods on production-scale dataset and
compare effectiveness of different strategies

* Optimizing one byte at a time using gradient descent * Embedded layer to tackle non-differentiable MalConv architecture *Gradient calculation of objective function with respect to embedded representation

* Feature attribution to determine most influential feature * Perturbation generation using gradient of classification function with respect to embedding layer * Bytes modification in file header

* Random, gradient based and fast gradient perturbation * End of file append and slack region insertion * Transferability test across full, EMBER {{cite:9de068c}} and mini dataset

Bytes are padded only at the end of file

Padding bytes at the end and in the slack regions

* Byte padding only at the end * Padding byte closest to embedded byte is chosen

* MZ magic number and offset at 0x3C are not modified

* Slackindexes calculated before adversarial payload insertion * Updates only at the end or in slack regions

Adversarial Malware Binaries: Evading Deep Learning for Malware Detection in Executables

Abstract: Machine-learning methods have already been exploited as useful tools for detecting malicious executable files. They leverage data retrieved from malware samples, such as header fields, instruction sequences, or even raw bytes, to learn models that discriminate between benign and malicious software. However, it has also been shown that machine learning and deep neural networks can be fooled by evasion attacks (also referred to as adversarial examples), i.e., small changes to the input data that cause misclassification at test time. In this work, we investigate the vulnerability of malware detection methods that use deep networks to learn from raw bytes. We propose a gradient-based attack that is capable of evading a recently-proposed deep network suited to this purpose by only changing few specific bytes at the end of each malware sample, while preserving its intrusive functionality. Promising results show that our adversarial malware binaries evade the targeted network with high probability, even though less than 1% of their bytes are modified.

Explaining Vulnerabilities of Deep Learning to Adversarial Malware Binaries

Abstract: Recent work has shown that deep-learning algorithms for malware detection are also susceptible to adversarial examples, i.e., carefully-crafted perturbations to input malware that enable misleading classification. Although this has questioned their suitability for this task, it is not yet clear why such algorithms are easily fooled also in this particular application domain. In this work, we take a first step to tackle this issue by leveraging explainable machine-learning algorithms developed to interpret the black-box decisions of deep neural networks. In particular, we use an explainable technique known as feature attribution to identify the most influential input features contributing to each decision, and adapt it to provide meaningful explanations to the classification of malware binaries. In this case, we find that a recently-proposed convolutional neural network does not learn any meaningful characteristic for malware detection from the data and text sections of executable files, but rather tends to learn to discriminate between benign and malware samples based on the characteristics found in the file header. Based on this finding, we propose a novel attack algorithm that generates adversarial malware binaries by only changing few tens of bytes in the file header. With respect to the other state-of-the-art attack algorithms, our attack does not require injecting any padding bytes at the end of the file, and it is much more efficient, as it requires manipulating much fewer bytes.

Exploring Adversarial Examples in Malware Detection

Abstract: The convolutional neural network (CNN) architecture is increasingly being applied to new domains, such as malware detection, where it is able to learn malicious behavior from raw bytes extracted from executables. These architectures reach impressive performance with no feature engineering effort involved, but their robustness against active attackers is yet to be understood. Such malware detectors could face a new attack vector in the form of adversarial interference with the classification model. Existing evasion attacks intended to cause misclassification on test-time instances, which have been extensively studied for image classifiers, are not applicable because of the input semantics that prevents arbitrary changes to the binaries. This paper explores the area of adversarial examples for malware detection. By training an existing model on a production-scale dataset, we show that some previous attacks are less effective than initially reported, while simultaneously highlighting architectural weaknesses that facilitate new attack strategies for malware classification. Finally, we explore how generalizable different attack strategies are, the trade-offs when aiming to increase their effectiveness, and the transferability of single-step attacks.

A gradient based approaches.

Table {{table:f89ec6fd-e288-49ad-8447-42f531130d4a}}  presents comparative study of adversarial attacks using gradient of cost function against Windows malware. Since Anderson et al.{{cite:cf19f2b}} proposed possibility of manipulating different sections of Windows PE malware to form adversarial, various researches have been conducted to bypass malware detector using malware PE files. Authors {{cite:cf19f2b}} used random actions from action space to modify PE files resulting in very low accuracy. To reduce the randomness of payloads, Kolosnjaji et al. {{cite:652374d}} proposed appending optimized padding bytes using gradient descent, originally proposed by Biggio et al. {{cite:34dbce0}}. Gradient based approaches are carried out using either append or insertion method for perturbation generated using gradient of cost function as shown in Figure {{figure:d7becf12-ee1b-4652-a3c1-ccd2693883c6}} . One-hot represented vector of malware is combined with gradient generated perturbation to bypass the malware detector. Making complex changes in architecture of file requires precise knowledge and could destroy file integrity as well. Kolosnjaji et al. {{cite:652374d}} choose to append bytes only at the end of file by optimizing one padding byte at a time. In this case, attacker's goal is to minimize the confidence of malicious class, limiting the maximum perturbation to {{formula:5101738c-41bb-4a2a-9c0f-7ca133cdef59}} . Appending {{formula:2f0a3157-8acf-42de-9e62-7d20a0e27b72}}  bytes to input size {{formula:cd15fd27-4efe-4df3-9a83-a87c129c18b5}}  should satisfy {{formula:9edea7c1-5086-489f-9807-613cd7cac3a2}} , where k is the number of informative bytes and d is fixed input size to detector. Due to non-differentiability issue of embedded layer in MalConv, negative gradient of loss function is calculated with respect to embedded representation. Embedding layer is a lookup table that contains mapping for each input {{formula:239c40e2-70f7-46ae-8dde-3797c700d730}}  to a 8-dimensional vector {{formula:fda22dd3-9310-4cd9-b849-7e1e3ee822ba}}  while optimizing one padding bytes at a time. Byte {{formula:5cfea5aa-5512-4608-9343-9c39c13741e3}}  is replaced by optimal padding byte corresponding to embedded byte {{formula:d3e11921-8c6d-4506-a64f-17651dd1e0ba}}  closest to line {{formula:1f14a80c-87cf-405f-8fe8-b21526ebf00f}} , defined parallel to negative gradient descent {{formula:943f571f-f302-4644-be5e-8711d17aa490}}  passing through embedded representation {{formula:ed751769-dc9e-41cd-86b4-affb19085dec}}  as shown in Figure {{figure:ba41eaad-d07d-483e-a095-5c0474a02897}} . Authors were able to achieve evasion rate up to 60% by only modifying 1% of bytes in PE file.


Test existing methods on production-scale dataset and
Compare effectiveness of different strategies

* Optimizing one byte at a time using gradient descent * Embedded layer to tackle non-differentiable MalConv architecture * Gradient calculation of objective function with respect to embedded representation

* Random, gradient based and fast gradient perturbation * End of file append and slack region insertion * Transferability test across full, EMBER and mini dataset

Abstract: Machine learning has already been exploited as a useful tool for detecting malicious executable files. Data retrieved from malware samples, such as header fields, instruction sequences, or even raw bytes, is leveraged to learn models that discriminate between benign and malicious software. However, it has also been shown that machine learning and deep neural networks can be fooled by evasion attacks (also known as adversarial examples), i.e., small changes to the input data that cause misclassification at test time. In this work, we investigate the vulnerability of malware detection methods that use deep networks to learn from raw bytes. We propose a gradient-based attack that is capable of evading a recently-proposed deep network suited to this purpose by only changing few specific bytes at the end of each mal ware sample, while preserving its intrusive functionality. Promising results show that our adversarial malware binaries evade the targeted network with high probability, even though less than 1 % of their bytes are modified.

Gradient Based Approaches

All previous works based on gradient, initialized perturbations with random noises and then iteratively updated using gradient of the model. Role of initializing perturbation in the success rate of adversarial generation can not be disregarded and Chen et al. {{cite:63b70b8}} proposed use of saliency vector to select initializing perturbations from benign files. Author regards issue of accuracy and inefficiency in the work of Kreuk et al. {{cite:5e8bdaf}} and Suciu et al. {{cite:abc87d5}} as a result of random perturbation initialization before gradient driven iterative modification. Benign feature append method was carried out by debugging victim model once for generating saliency vectors whereas continuous debugging of model is required while incorporating FGSM algorithm. Saliency vector assigns values to benign and malicious regions of file with higher values linked to more significant features. In white box environment, BFA attack appends perturbation at the end of malicious files, selected using saliency vectors while enhanced-BFA attack uses most significant benign blocks for initialization. Avoiding random initialization helps model to obtain back propagation gradients and, gradient based algorithms can be implemented more effectively. Benign bytes form saliency vector also helps in mapping between adversarial from continuous space to discrete space avoiding random perturbations which can not be mapped back to valid raw-byte perturbations. Authors also performed black box attack to malware detectors using random benign append and perturbations obtained by summarizing the successful trajectories of random attacks. Research was successful to increase the accuracy of gradient based adversarial generation techniques just by replacing random initialization. Table {{table:5f759761-af6e-4539-b583-4d6470169594}}  presents comparative study of all adversarial generation approaches using gradient of cost function against windows malware.


Attack against RNN processing sequential data

Use of explainable machine learning for adversarial generation

Targetted and Untargetted misclassification on windows and IoT malware dataset

Bidirectional RNN with attention mechanism

Integrated Gradient, LRP, DeepLIFT, SHAP

[leftmargin=*]
Substitute RNN approximates victim RNN

Generative RNN gives sequential adversarial example

Irrelevant API sequence generated and inserted in vulnerabilities of original sequence

[leftmargin=*]
Unearthing most impactful features using explainability algorithm

Manual selection of easily modifiable features

Feature by feature modification without harming functionality and interdependent features

[leftmargin=*]
Adversarial generation using different algorithms

Conversion of adversarial dimension, same as of original image

Appending pixels at the end or injecting

Black-Box Attacks against RNN based Malware Detection Algorithms

Abstract: Recent researches have shown that machine learning based malware detection algorithms are very vulnerable under the attacks of adversarial examples. These works mainly focused on the detection algorithms which use features with fixed dimension, while some researchers have begun to use recurrent neural networks (RNN) to detect malware based on sequential API features. This paper proposes a novel algorithm to generate sequential adversarial examples, which are used to attack a RNN based malware detection system. It is usually hard for malicious attackers to know the exact structures and weights of the victim RNN. A substitute RNN is trained to approximate the victim RNN. Then we propose a generative RNN to output sequential adversarial examples from the original sequential malware inputs. Experimental results showed that RNN based malware detection algorithms fail to detect most of the generated malicious adversarial examples, which means the proposed model is able to effectively bypass the detection algorithms.

Generating End-to-End Adversarial Examples for Malware Classifiers Using Explainability

Abstract: In recent years, the topic of explainable machine learning (ML) has been extensively researched. Up until now, this research focused on regular ML users use-cases such as debugging a ML model. This paper takes a different posture and show that adversaries can leverage explainable ML to bypass multi-feature types malware classifiers. Previous adversarial attacks against such classifiers only add new features and not modify existing ones to avoid harming the modified malware executable's functionality. Current attacks use a single algorithm that both selects which features to modify and modifies them blindly, treating all features the same. In this paper, we present a different approach. We split the adversarial example generation task into two parts: First we find the importance of all features for a specific sample using explainability algorithms, and then we conduct a feature-specific modification, feature-by-feature. In order to apply our attack in black-box scenarios, we introduce the concept of transferability of explainability, that is, applying explainability algorithms to different classifiers using different features subsets and trained on different datasets still result in a similar subset of important features. We conclude that explainability algorithms can be leveraged by adversaries and thus the advocates of training more interpretable classifiers should consider the trade-off of higher vulnerability of those classifiers to adversarial attacks.

COPYCAT: Practical Adversarial Attacks on Visualization-Based Malware Detection

Abstract: Despite many attempts, the state-of-the-art of adversarial machine learning on malware detection systems generally yield unexecutable samples. In this work, we set out to examine the robustness of visualization-based malware detection system against adversarial examples (AEs) that not only are able to fool the model, but also maintain the executability of the original input. As such, we first investigate the application of existing off-the-shelf adversarial attack approaches on malware detection systems through which we found that those approaches do not necessarily maintain the functionality of the original inputs. Therefore, we proposed an approach to generate adversarial examples, COPYCAT, which is specifically designed for malware detection systems considering two main goals; achieving a high misclassification rate and maintaining the executability and functionality of the original input. We designed two main configurations for COPYCAT, namely AE padding and sample injection. While the first configuration results in untargeted misclassification attacks, the sample injection configuration is able to force the model to generate a targeted output, which is highly desirable in the malware attribution setting. We evaluate the performance of COPYCAT through an extensive set of experiments on two malware datasets, and report that we were able to generate adversarial samples that are misclassified at a rate of 98.9% and 96.5% with Windows and IoT binary datasets, respectively, outperforming the misclassification rates in the literature. Most importantly, we report that those AEs were executable unlike AEs generated by off-the-shelf approaches. Our transferability study demonstrates that the generated AEs through our proposed method can be generalized to other models.

RNN, Explainable ML and visualization based adversarial

COPYCAT approach proposed by Khormali et al. {{cite:0ca9a9e}} are able to produce both targeted and untargetted misclassification on windows and IoT malware dataset. Author in this work followed two approaches: AE padding and sample injection to produce adversarial malware for visualization based detector. For padding method, COPYCAT generated adversarial {{formula:aaac9fc8-868c-4db0-982c-9655806d3824}}  using five different attack methods namely: FGSM {{cite:2b1838f}}, C&W {{cite:369a784}}, DeepFool {{cite:be3ac16}}, Momentum Iterative Method(MIM) {{cite:4cd7664}} and Projection Gradient Descent(PGD)  {{cite:019dc06}}. The generated adversarial needs to be converted to the dimensions same as that of original image before appending at the end of image. Appending pixels at the end is equivalent to appending code section into a non-reachable region which will not affect the executability of program. Sample injection deals with injecting binaries of a sample from targeted class into a unreachable area of target sample. The approach of this work is inspired from the work of Cha et al. {{cite:8b23229}}, where binaries of an application with certain architecture are padded into an application from other architecture to change behaviour depending on the system underneath. Above Table {{table:188073fc-0ac7-4ecd-b5fa-f7aeca109ac9}}  provides brief comparison among RNN, explainable ML and malware visualization based adversarial generation techniques.


Wasserstein Fair Classification

Abstract: We propose an approach to fair classification that enforces independence between the classifier outputs and sensitive information by minimizing Wasserstein-1 distances. The approach has desirable theoretical properties and is robust to specific choices of the threshold used to obtain class predictions from model outputs. We introduce different methods that enable hiding sensitive information at test time or have a simple and fast implementation. We show empirical performance against different fairness baselines on several benchmark fairness datasets.

Fair Regression: Quantitative Definitions and Reduction-based Algorithms

Abstract: In this paper, we study the prediction of a real-valued target, such as a risk score or recidivism rate, while guaranteeing a quantitative notion of fairness with respect to a protected attribute such as gender or race. We call this class of problems \emph{fair regression}. We propose general schemes for fair regression under two notions of fairness: (1) statistical parity, which asks that the prediction be statistically independent of the protected attribute, and (2) bounded group loss, which asks that the prediction error restricted to any protected group remain below some pre-determined level. While we only study these two notions of fairness, our schemes are applicable to arbitrary Lipschitz-continuous losses, and so they encompass least-squares regression, logistic regression, quantile regression, and many other tasks. Our schemes only require access to standard risk minimization algorithms (such as standard classification or least-squares regression) while providing theoretical guarantees on the optimality and fairness of the obtained solutions. In addition to analyzing theoretical properties of our schemes, we empirically demonstrate their ability to uncover fairness--accuracy frontiers on several standard datasets.

Disciplined Convex-Concave Programming

Abstract: In this paper we introduce disciplined convex-concave programming (DCCP), which combines the ideas of disciplined convex programming (DCP) with convex-concave programming (CCP). Convex-concave programming is an organized heuristic for solving nonconvex problems that involve objective and constraint functions that are a sum of a convex and a concave term. DCP is a structured way to define convex optimization problems, based on a family of basic convex and concave functions and a few rules for combining them. Problems expressed using DCP can be automatically converted to standard form and solved by a generic solver; widely used implementations include YALMIP, CVX, CVXPY, and Convex.jl. In this paper we propose a framework that combines the two ideas, and includes two improvements over previously published work on convex-concave programming, specifically the handling of domains of the functions, and the issue of nondifferentiability on the boundary of the domains. We describe a Python implementation called DCCP, which extends CVXPY, and give examples.

Fairness Without Demographics in Repeated Loss Minimization

Abstract: Machine learning models (e.g., speech recognizers) are usually trained to minimize average loss, which results in representation disparity---minority groups (e.g., non-native speakers) contribute less to the training objective and thus tend to suffer higher loss. Worse, as model accuracy affects user retention, a minority group can shrink over time. In this paper, we first show that the status quo of empirical risk minimization (ERM) amplifies representation disparity over time, which can even make initially fair models unfair. To mitigate this, we develop an approach based on distributionally robust optimization (DRO), which minimizes the worst case risk over all distributions close to the empirical distribution. We prove that this approach controls the risk of the minority group at each time step, in the spirit of Rawlsian distributive justice, while remaining oblivious to the identity of the groups. We demonstrate that DRO prevents disparity amplification on examples where ERM fails, and show improvements in minority group user satisfaction in a real-world text autocomplete task.

Paper Matching with Local Fairness Constraints

Abstract: Automatically matching reviewers to papers is a crucial step of the peer review process for venues receiving thousands of submissions. Unfortunately, common paper matching algorithms often construct matchings suffering from two critical problems: (1) the group of reviewers assigned to a paper do not collectively possess sufficient expertise, and (2) reviewer workloads are highly skewed. In this paper, we propose a novel local fairness formulation of paper matching that directly addresses both of these issues. Since optimizing our formulation is not always tractable, we introduce two new algorithms, FairIR and FairFlow, for computing fair matchings that approximately optimize the new formulation. FairIR solves a relaxation of the local fairness formulation and then employs a rounding technique to construct a valid matching that provably maximizes the objective and only compromises on fairness with respect to reviewer loads and papers by a small constant. In contrast, FairFlow is not provably guaranteed to produce fair matchings, however it can be 2x as efficient as FairIR and an order of magnitude faster than matching algorithms that directly optimize for fairness. Empirically, we demonstrate that both FairIR and FairFlow improve fairness over standard matching algorithms on real conference data. Moreover, in comparison to state-of-the-art matching algorithms that optimize for fairness only, FairIR achieves higher objective scores, FairFlow achieves competitive fairness, and both are capable of more evenly allocating reviewers.

Counterfactual fairness: removing direct effects through regularization

Abstract: Building machine learning models that are fair with respect to an unprivileged group is a topical problem. Modern fairness-aware algorithms often ignore causal effects and enforce fairness through modifications applicable to only a subset of machine learning models. In this work, we propose a new definition of fairness that incorporates causality through the Controlled Direct Effect (CDE). We develop regularizations to tackle classical fairness measures and present a causal regularization that satisfies our new fairness definition by removing the impact of unprivileged group variables on the model outcomes as measured by the CDE. These regularizations are applicable to any model trained using by iteratively minimizing a loss through differentiation. We demonstrate our approaches using both gradient boosting and logistic regression on: a synthetic dataset, the UCI Adult (Census) Dataset, and a real-world credit-risk dataset. Our results were found to mitigate unfairness from the predictions with small reductions in model performance.

A Convex Framework for Fair Regression

Abstract: We introduce a flexible family of fairness regularizers for (linear and logistic) regression problems. These regularizers all enjoy convexity, permitting fast optimization, and they span the rang from notions of group fairness to strong individual fairness. By varying the weight on the fairness regularizer, we can compute the efficient frontier of the accuracy-fairness trade-off on any given dataset, and we measure the severity of this trade-off via a numerical quantity we call the Price of Fairness (PoF). The centerpiece of our results is an extensive comparative study of the PoF across six different datasets in which fairness is a primary consideration.

Fairness through awareness

Abstract: We study fairness in classification, where individuals are classified, e.g., admitted to a university, and the goal is to prevent discrimination against individuals based on their membership in some group, while maintaining utility for the classifier (the university). The main conceptual contribution of this paper is a framework for fair classification comprising (1) a (hypothetical) task-specific metric for determining the degree to which individuals are similar with respect to the classification task at hand; (2) an algorithm for maximizing utility subject to the fairness constraint, that similar individuals are treated similarly. We also present an adaptation of our approach to achieve the complementary goal of "fair affirmative action," which guarantees statistical parity (i.e., the demographics of the set of individuals receiving any classification are the same as the demographics of the underlying population), while treating similar individuals as similarly as possible. Finally, we discuss the relationship of fairness to privacy: when fairness implies privacy, and how tools developed in the context of differential privacy may be applied to fairness.

Counterfactual Fairness

Abstract: Machine learning can impact people with legal or ethical consequences when it is used to automate decisions in areas such as insurance, lending, hiring, and predictive policing. In many of these scenarios, previous decisions have been made that are unfairly biased against certain subpopulations, for example those of a particular race, gender, or sexual orientation. Since this past data may be biased, machine learning predictors must account for this to avoid perpetuating or creating discriminatory practices. In this paper, we develop a framework for modeling fairness using tools from causal inference. Our definition of counterfactual fairness captures the intuition that a decision is fair towards an individual if it is the same in (a) the actual world and (b) a counterfactual world where the individual belonged to a different demographic group. We demonstrate our framework on a real-world problem of fair prediction of success in law school.

Maxmin-Fair Ranking: Individual Fairness under Group-Fairness Constraints

Abstract: We study a novel problem of fairness in ranking aimed at minimizing the amount of individual unfairness introduced when enforcing group-fairness constraints. Our proposal is rooted in the distributional maxmin fairness theory, which uses randomization to maximize the expected satisfaction of the worst-off individuals. We devise an exact polynomial-time algorithm to find maxmin-fair distributions of general search problems (including, but not limited to, ranking), and show that our algorithm can produce rankings which, while satisfying the given group-fairness constraints, ensure that the maximum possible value is to individuals.

A summary of explicit mitigation methods.

Explicit bias mitigation can be achieved by explicitly adding fairness regularizers or constraints to the objective functions of machine learning models. The high-level ideas are illustrated in Figure {{figure:d53aa515-0bed-4c0f-a115-609fab33feec}} . In this section, we summarize different explicit mitigation methods according to whether they tackle disparate impact or disparate treatment. Additionally, researchers have also studied hybrid methods that address both of them. A summary of the surveyed explicit mitigation methods is provided in Table {{table:a4579daf-c123-4354-a770-e5b6f4e79232}} .


Mitigating Unwanted Biases with Adversarial Learning

Abstract: Machine learning is a tool for building models that accurately represent input training data. When undesired biases concerning demographic groups are in the training data, well-trained models will reflect those biases. We present a framework for mitigating such biases by including a variable for the group of interest and simultaneously learning a predictor and an adversary. The input to the network X, here text or census data, produces a prediction Y, such as an analogy completion or income bracket, while the adversary tries to model a protected variable Z, here gender or zip code. The objective is to maximize the predictor's ability to predict Y while minimizing the adversary's ability to predict Z. Applied to analogy completion, this method results in accurate predictions that exhibit less evidence of stereotyping Z. When applied to a classification task using the UCI Adult (Census) Dataset, it results in a predictive model that does not lose much accuracy while achieving very close to equality of odds (Hardt, et al., 2016). The method is flexible and applicable to multiple definitions of fairness as well as a wide range of gradient-based learning models, including both regression and classification tasks.

Achieving Fairness through Adversarial Learning: an Application to Recidivism Prediction

Abstract: Recidivism prediction scores are used across the USA to determine sentencing and supervision for hundreds of thousands of inmates. One such generator of recidivism prediction scores is Northpointe's Correctional Offender Management Profiling for Alternative Sanctions (COMPAS) score, used in states like California and Florida, which past research has shown to be biased against black inmates according to certain measures of fairness. To counteract this racial bias, we present an adversarially-trained neural network that predicts recidivism and is trained to remove racial bias. When comparing the results of our model to COMPAS, we gain predictive accuracy and get closer to achieving two out of three measures of fairness: parity and equality of odds. Our model can be generalized to any prediction and demographic. This piece of research contributes an example of scientific replication and simplification in a high-stakes real-world application like recidivism prediction.

Censoring Representations with an Adversary

Abstract: In practice, there are often explicit constraints on what representations or decisions are acceptable in an application of machine learning. For example it may be a legal requirement that a decision must not favour a particular group. Alternatively it can be that that representation of data must not have identifying information. We address these two related issues by learning flexible representations that minimize the capability of an adversarial critic. This adversary is trying to predict the relevant sensitive variable from the representation, and so minimizing the performance of the adversary ensures there is little or no information in the representation about the sensitive variable. We demonstrate this adversarial approach on two problems: making decisions free from discrimination and removing private information from images. We formulate the adversarial model as a minimax problem, and optimize that minimax objective using a stochastic gradient alternate min-max optimizer. We demonstrate the ability to provide discriminant free representations for standard test problems, and compare with previous state of the art methods for fairness, showing statistically significant improvement across most cases. The flexibility of this method is shown via a novel problem: removing annotations from images, from unaligned training examples of annotated and unannotated images, and with no a priori knowledge of the form of annotation provided to the model.

Learning Adversarially Fair and Transferable Representations

Abstract: In this paper, we advocate for representation learning as the key to mitigating unfair prediction outcomes downstream. Motivated by a scenario where learned representations are used by third parties with unknown objectives, we propose and explore adversarial representation learning as a natural method of ensuring those parties act fairly. We connect group fairness (demographic parity, equalized odds, and equal opportunity) to different adversarial objectives. Through worst-case theoretical guarantees and experimental validation, we show that the choice of this objective is crucial to fair prediction. Furthermore, we present the first in-depth experimental demonstration of fair transfer learning and demonstrate empirically that our learned representations admit fair predictions on new tasks while maintaining utility, an essential goal of fair representation learning.

Counterfactual Fairness with Disentangled Causal Effect Variational Autoencoder

Abstract: The problem of fair classification can be mollified if we develop a method to remove the embedded sensitive information from the classification features. This line of separating the sensitive information is developed through the causal inference, and the causal inference enables the counterfactual generations to contrast the what-if case of the opposite sensitive attribute. Along with this separation with the causality, a frequent assumption in the deep latent causal model defines a single latent variable to absorb the entire exogenous uncertainty of the causal graph. However, we claim that such structure cannot distinguish the 1) information caused by the intervention (i.e., sensitive variable) and 2) information correlated with the intervention from the data. Therefore, this paper proposes Disentangled Causal Effect Variational Autoencoder (DCEVAE) to resolve this limitation by disentangling the exogenous uncertainty into two latent variables: either 1) independent to interventions or 2) correlated to interventions without causality. Particularly, our disentangling approach preserves the latent variable correlated to interventions in generating counterfactual examples. We show that our method estimates the total effect and the counterfactual effect without a complete causal graph. By adding a fairness regularization, DCEVAE generates a counterfactual fair dataset while losing less original information. Also, DCEVAE generates natural counterfactual images by only flipping sensitive information. Additionally, we theoretically show the differences in the covariance structures of DCEVAE and prior works from the perspective of the latent disentanglement.

On the Fairness of Disentangled Representations

Abstract: Recently there has been a significant interest in learning disentangled representations, as they promise increased interpretability, generalization to unseen scenarios and faster learning on downstream tasks. In this paper, we investigate the usefulness of different notions of disentanglement for improving the fairness of downstream prediction tasks based on representations. We consider the setting where the goal is to predict a target variable based on the learned representation of high-dimensional observations (such as images) that depend on both the target variable and an \emph{unobserved} sensitive variable. We show that in this setting both the optimal and empirical predictions can be unfair, even if the target variable and the sensitive variable are independent. Analyzing the representations of more than \num{12600} trained state-of-the-art disentangled models, we observe that several disentanglement scores are consistently correlated with increased fairness, suggesting that disentanglement may be a useful property to encourage fairness when sensitive variables are not observed.

FairFil: Contrastive Neural Debiasing Method for Pretrained Text Encoders

Abstract: Pretrained text encoders, such as BERT, have been applied increasingly in various natural language processing (NLP) tasks, and have recently demonstrated significant performance gains. However, recent studies have demonstrated the existence of social bias in these pretrained NLP models. Although prior works have made progress on word-level debiasing, improved sentence-level fairness of pretrained encoders still lacks exploration. In this paper, we proposed the first neural debiasing method for a pretrained sentence encoder, which transforms the pretrained encoder outputs into debiased representations via a fair filter (FairFil) network. To learn the FairFil, we introduce a contrastive learning framework that not only minimizes the correlation between filtered embeddings and bias words but also preserves rich semantic information of the original sentences. On real-world datasets, our FairFil effectively reduces the bias degree of pretrained text encoders, while continuously showing desirable performance on downstream tasks. Moreover, our post-hoc method does not require any retraining of the text encoders, further enlarging FairFil's application space.

Fairness-Aware Node Representation Learning

Abstract: Node representation learning has demonstrated its effectiveness for various applications on graphs. Particularly, recent developments in contrastive learning have led to promising results in unsupervised node representation learning for a number of tasks. Despite the success of graph contrastive learning and consequent growing interest, fairness is largely under-explored in the field. To this end, this study addresses fairness issues in graph contrastive learning with fairness-aware graph augmentation designs, through adaptive feature masking and edge deletion. In the study, different fairness notions on graphs are introduced, which serve as guidelines for the proposed graph augmentations. Furthermore, theoretical analysis is provided to quantitatively prove that the proposed feature masking approach can reduce intrinsic bias. Experimental results on real social networks are presented to demonstrate that the proposed augmentations can enhance fairness in terms of statistical parity and equal opportunity, while providing comparable classification accuracy to state-of-the-art contrastive methods for node classification.

Compositional Fairness Constraints for Graph Embeddings

Abstract: Learning high-quality node embeddings is a key building block for machine learning models that operate on graph data, such as social networks and recommender systems. However, existing graph embedding techniques are unable to cope with fairness constraints, e.g., ensuring that the learned representations do not correlate with certain attributes, such as age or gender. Here, we introduce an adversarial framework to enforce fairness constraints on graph embeddings. Our approach is compositional---meaning that it can flexibly accommodate different combinations of fairness constraints during inference. For instance, in the context of social recommendations, our framework would allow one user to request that their recommendations are invariant to both their age and gender, while also allowing another user to request invariance to just their age. Experiments on standard knowledge graph and recommender system benchmarks highlight the utility of our proposed framework.

A summary of implicit mitigation methods.

Implicit bias mitigation refers to the algorithms which detect and eliminate discrimination via representations. Intuitively, if the learned representations are not biased towards a sensitive group, then the resulting predictions will become unbiased. These approaches are mainly designed for deep models, where learning representations is crucial. Figure {{figure:e8a4ec49-4109-4774-b143-bc36c49134f1}}  illustrates some representative techniques for implicit mitigation of bias, which can be grouped into impact-driven debiasing, treatment-driven debiasing. Some representative techniques for impact-driven debiasing include adversarial learning and disentangled representation learning, where the former uses an adversary to remove the sensitive information from the representations, and the latter decorrelates the sensitive and non-sensitive information to preserve fair representations for downstream applications. Alternatively, contrastive learning achieves treatment-driven debiasing by enforcing similar representations for positive and negative sample pairs. In addition, some hybrid methods have been proposed to tackle both disparate impact and disparate treatment. A summary of the implicit mitigation methods is tabulated in Table {{table:4365bdd7-1854-4c0a-9e12-d6d014b20ec7}} .


Dissecting Person Re-identification from the Viewpoint of Viewpoint

Abstract: Variations in visual factors such as viewpoint, pose, illumination and background, are usually viewed as important challenges in person re-identification (re-ID). In spite of acknowledging these factors to be influential, quantitative studies on how they affect a re-ID system are still lacking. To derive insights in this scientific campaign, this paper makes an early attempt in studying a particular factor, viewpoint. We narrow the viewpoint problem down to the pedestrian rotation angle to obtain focused conclusions. In this regard, this paper makes two contributions to the community. First, we introduce a large-scale synthetic data engine, PersonX. Composed of hand-crafted 3D person models, the salient characteristic of this engine is "controllable". That is, we are able to synthesize pedestrians by setting the visual variables to arbitrary values. Second, on the 3D data engine, we quantitatively analyze the influence of pedestrian rotation angle on re-ID accuracy. Comprehensively, the person rotation angles are precisely customized from 0 to 360, allowing us to investigate its effect on the training, query, and gallery sets. Extensive experiment helps us have a deeper understanding of the fundamental problems in person re-ID. Our research also provides useful insights for dataset building and future practical usage, e.g., a person of a side view makes a better query.

Person Transfer GAN to Bridge Domain Gap for Person Re-identification

Abstract: Although the performance of person Re-Identification (ReID) has been significantly boosted, many challenging issues in real scenarios have not been fully investigated, e.g., the complex scenes and lighting variations, viewpoint and pose changes, and the large number of identities in a camera network. To facilitate the research towards conquering those issues, this paper contributes a new dataset called MSMT171 with many important features, e.g., 1) the raw videos are taken by an 15-camera network deployed in both indoor and outdoor scenes, 2) the videos cover a long period of time and present complex lighting variations, and 3) it contains currently the largest number of annotated identities, i.e., 4,101 identities and 126,441 bounding boxes. We also observe that, domain gap commonly exists between datasets, which essentially causes severe performance drop when training and testing on different datasets. This results in that available training data cannot be effectively leveraged for new testing domains. To relieve the expensive costs of annotating new training samples, we propose a Person Transfer Generative Adversarial Network (PTGAN) to bridge the domain gap. Comprehensive experiments show that the domain gap could be substantially narrowed-down by the PTGAN.

Large-Scale Spatio-Temporal Person Re-identification: Algorithms and Benchmark

Abstract: Person re-identification (re-ID) in the scenario with large spatial and temporal spans has not been fully explored. This is partially because that, existing benchmark datasets were mainly collected with limited spatial and temporal ranges, e.g., using videos recorded in a few days by cameras in a specific region of the campus. Such limited spatial and temporal ranges make it hard to simulate the difficulties of person re-ID in real scenarios. In this work, we contribute a novel Large-scale Spatio-Temporal LaST person re-ID dataset, including 10,862 identities with more than 228k images. Compared with existing datasets, LaST presents more challenging and high-diversity re-ID settings, and significantly larger spatial and temporal ranges. For instance, each person can appear in different cities or countries, and in various time slots from daytime to night, and in different seasons from spring to winter. To our best knowledge, LaST is a novel person re-ID dataset with the largest spatio-temporal ranges. Based on LaST, we verified its challenge by conducting a comprehensive performance evaluation of 14 re-ID algorithms. We further propose an easy-to-implement baseline that works well on such challenging re-ID setting. We also verified that models pre-trained on LaST can generalize well on existing datasets with short-term and cloth-changing scenarios. We expect LaST to inspire future works toward more realistic and challenging re-ID tasks. More information about the dataset is available at https://github.com/shuxjweb/last.git.

Introduction and comparison of datasets we used.

Datasets and Evaluation. We evaluate the proposed MCL method on multiple ReID benchmarks (from small to large scale): PersonX (PX) {{cite:aca229c}}, Market1501 (Ma) {{cite:e270315}}, MSMT17 (MT) {{cite:0e0d652}}, and the largest public ReID dataset (so far) LaST (LS) {{cite:1de2294}}. To further show the superiority of MCL in the large-scale data setting, we also conduct experiments on the mixed datasets, e.g., training on multiple datasets PX+Ma+MT+LS while testing on unseen test set of MT. The details about datasets are shown in Table {{table:685deeea-c9a0-4c2f-8116-349f975dbab2}} .


Learning 3D Human Dynamics from Video

Abstract: From an image of a person in action, we can easily guess the 3D motion of the person in the immediate past and future. This is because we have a mental model of 3D human dynamics that we have acquired from observing visual sequences of humans in motion. We present a framework that can similarly learn a representation of 3D dynamics of humans from video via a simple but effective temporal encoding of image features. At test time, from video, the learned temporal representation give rise to smooth 3D mesh predictions. From a single image, our model can recover the current 3D mesh as well as its 3D past and future motion. Our approach is designed so it can learn from videos with 2D pose annotations in a semi-supervised manner. Though annotated data is always limited, there are millions of videos uploaded daily on the Internet. In this work, we harvest this Internet-scale source of unlabeled data by training our model on unlabeled video with pseudo-ground truth 2D pose obtained from an off-the-shelf 2D pose detector. Our experiments show that adding more videos with pseudo-ground truth 2D pose monotonically improves 3D prediction performance. We evaluate our model, Human Mesh and Motion Recovery (HMMR), on the recent challenging dataset of 3D Poses in the Wild and obtain state-of-the-art performance on the 3D prediction task without any fine-tuning. The project website with video, code, and data can be found at https://akanazawa.github.io/human_dynamics/.

Learning to Reconstruct 3D Human Pose and Shape via Model-Fitting in the Loop

Abstract: Model-based human pose estimation is currently approached through two different paradigms. Optimization-based methods fit a parametric body model to 2D observations in an iterative manner, leading to accurate image-model alignments, but are often slow and sensitive to the initialization. In contrast, regression-based methods, that use a deep network to directly estimate the model parameters from pixels, tend to provide reasonable, but not pixel accurate, results while requiring huge amounts of supervision. In this work, instead of investigating which approach is better, our key insight is that the two paradigms can form a strong collaboration. A reasonable, directly regressed estimate from the network can initialize the iterative optimization making the fitting faster and more accurate. Similarly, a pixel accurate fit from iterative optimization can act as strong supervision for the network. This is the core of our proposed approach SPIN (SMPL oPtimization IN the loop). The deep network initializes an iterative optimization routine that fits the body model to 2D joints within the training loop, and the fitted estimate is subsequently used to supervise the network. Our approach is self-improving by nature, since better network estimates can lead the optimization to better solutions, while more accurate optimization fits provide better supervision for the network. We demonstrate the effectiveness of our approach in different settings, where 3D ground truth is scarce, or not available, and we consistently outperform the state-of-the-art model-based pose estimation approaches by significant margins. The project website with videos, results, and code can be found at https://seas.upenn.edu/~nkolot/projects/spin.

Illustration of different protocols for data preprocessing on the 3DPW dataset, which have great impacts on the final resuls. #PV/#PS use the SMPL annotations from the original 3DPW, while #PH uses the fitted neutral labels excluding all gender information.

Evaluation details.
We use multiple evaluation metrics on the target datasets, including MPJPE, PA-MPJPE, PVE, PCK, and AUC. More details can be found in the Supplementary Materials.
Particularly on the 3DHP dataset, we follow the existing approaches {{cite:cf1ddd2}}, {{cite:0f969de}} to evaluate the reconstruction results at the 17 body joints.
On the 3DPW dataset, we adopt the data preprocessing protocols (i.e., #PH, #PV, and #PS) from HMMR {{cite:ef9d7e2}}, VIBE {{cite:81a91cb}}, and SPIN {{cite:cf1ddd2}}.
The protocols differ in two aspects (see Table {{table:57cea709-ee76-412c-a6d8-6eb3a4479585}} ). First, unlike #PS and #PV that adopt the original SMPL labels, #PH uses the fitted neutral meshes as the ground truth, which are generated by minimizing the Euclidean vertex error between the fitted meshes and the original meshes. Second, the protocols have different criteria to select valid frames, resulting in different numbers of test frames.
We find that the use of different preprocessing protocols has a significant impact on the final results (see Table {{table:bf74ebd7-38b0-4cd3-9d87-56de1b52a25b}} ). Therefore, we present results under all three protocols and compare them with those of the state-of-the-art methods under the corresponding protocols.


Implicit unfairness mitigation refers to the algorithms which detect and eliminate discrimination via representations. These approaches are mainly designed for deep models, where learning representations is crucial. They seek to remove bias from the learned representations such that the resulting predictions will also be less biased. Note that, as discussed in Section , an unbiased prediction may not necessarily be fair. Nevertheless, in most cases, it has been reported in many implicit mitigation methods that removing bias aligns with the common fairness goals {{cite:7fd4a81}}, {{cite:b792ada}}, {{cite:ba379b7}}.  Figure {{figure:1caac317-f818-4a65-9f8c-280d515b2991}}  illustrates some representative techniques for implicit mitigations, which can be grouped into impact-driven methods and treatment-driven methods. Some representative techniques for impact-driven methods include adversarial learning and disentangled representation learning, where the former uses an adversary to remove the sensitive information from the representations, and the latter decorrelates the sensitive and non-sensitive information to preserve unbiased representations for downstream applications. Alternatively, contrastive learning achieves treatment-driven debiasing by enforcing similar representations for positive and negative sample pairs. In addition, some hybrid methods have been proposed to tackle both disparate impact and disparate treatment. A summary of the implicit mitigation methods is tabulated in Table {{table:2cfb7b6a-225f-48f0-957d-a2688ec0ff50}} .


Big Transfer (BiT): General Visual Representation Learning

Abstract: Transfer of pre-trained representations improves sample efficiency and simplifies hyperparameter tuning when training deep neural networks for vision. We revisit the paradigm of pre-training on large supervised datasets and fine-tuning the model on a target task. We scale up pre-training, and propose a simple recipe that we call Big Transfer (BiT). By combining a few carefully selected components, and transferring using a simple heuristic, we achieve strong performance on over 20 datasets. BiT performs well across a surprisingly wide range of data regimes -- from 1 example per class to 1M total examples. BiT achieves 87.5% top-1 accuracy on ILSVRC-2012, 99.4% on CIFAR-10, and 76.3% on the 19 task Visual Task Adaptation Benchmark (VTAB). On small datasets, BiT attains 76.8% on ILSVRC-2012 with 10 examples per class, and 97.0% on CIFAR-10 with 10 examples per class. We conduct detailed analysis of the main components that lead to high transfer performance.

An Image is Worth 16x16 Words: Transformers for Image Recognition at Scale

Abstract: While the Transformer architecture has become the de-facto standard for natural language processing tasks, its applications to computer vision remain limited. In vision, attention is either applied in conjunction with convolutional networks, or used to replace certain components of convolutional networks while keeping their overall structure in place. We show that this reliance on CNNs is not necessary and a pure transformer applied directly to sequences of image patches can perform very well on image classification tasks. When pre-trained on large amounts of data and transferred to multiple mid-sized or small image recognition benchmarks (ImageNet, CIFAR-100, VTAB, etc.), Vision Transformer (ViT) attains excellent results compared to state-of-the-art convolutional networks while requiring substantially fewer computational resources to train.

Training data-efficient image transformers & distillation through attention

Abstract: Recently, neural networks purely based on attention were shown to address image understanding tasks such as image classification. However, these visual transformers are pre-trained with hundreds of millions of images using an expensive infrastructure, thereby limiting their adoption. In this work, we produce a competitive convolution-free transformer by training on Imagenet only. We train them on a single computer in less than 3 days. Our reference vision transformer (86M parameters) achieves top-1 accuracy of 83.1% (single-crop evaluation) on ImageNet with no external data. More importantly, we introduce a teacher-student strategy specific to transformers. It relies on a distillation token ensuring that the student learns from the teacher through attention. We show the interest of this token-based distillation, especially when using a convnet as a teacher. This leads us to report results competitive with convnets for both Imagenet (where we obtain up to 85.2% accuracy) and when transferring to other tasks. We share our code and models.

Comparison of popular ResNet and ViT models. The difference in model robustness can not be blindly attributed to the model architectures. It can be caused by different training settings. WS, GN and WD correspond to Weight Standardization, Group Normalization and Weight Decay, respectively.

Experimental Settings to Compare ViT and ResNet

Fair Base Models. We list the state-of-the-art ResNet and ViT models and part of their training settings in Tab. {{table:7b2269f9-d715-42f2-ae74-2343cb39a44e}} . The techniques applied to boost different models are different, e.g., pretraining. A recent work {{cite:c547567}} points out the necessity of a fair setting. Our investigation finds weight standardization and group normalization also have a significant impact on model robustness (More in Appendix A). This indicates that the difference in model robustness can not be blindly attributed to the model architectures if models are trained with different settings. Hence, we build fair models to compare ViT and ResNet as follows.


DOTA: A Large-Scale Dataset for Object Detection in Aerial Images

Abstract: Object detection is an important and challenging problem in computer vision. Although the past decade has witnessed major advances in object detection in natural scenes, such successes have been slow to aerial imagery, not only because of the huge variation in the scale, orientation and shape of the object instances on the earth's surface, but also due to the scarcity of well-annotated datasets of objects in aerial scenes. To advance object detection research in Earth Vision, also known as Earth Observation and Remote Sensing, we introduce a large-scale Dataset for Object deTection in Aerial images (DOTA). To this end, we collect 2806 aerial images from different sensors and platforms. Each image is of the size about 4000 Ã— 4000 pixels and contains objects exhibiting a wide variety of scales, orientations, and shapes. These DOTA images are then annotated by experts in aerial image interpretation using 15 common object categories. The fully annotated DOTA images contains 188, 282 instances, each of which is labeled by an arbitrary (8 d.o.f.) quadrilateral. To build a baseline for object detection in Earth Vision, we evaluate state-of-the-art object detection algorithms on DOTA. Experiments demonstrate that DOTA well represents real Earth Vision applications and are quite challenging.

COCO-Stuff: Thing and Stuff Classes in Context

Abstract: Semantic classes can be either things (objects with a well-defined shape, e.g. car, person) or stuff (amorphous background regions, e.g. grass, sky). While lots of classification and detection works focus on thing classes, less attention has been given to stuff classes. Nonetheless, stuff classes are important as they allow to explain important aspects of an image, including (1) scene type; (2) which thing classes are likely to be present and their location (through contextual reasoning); (3) physical attributes, material types and geometric properties of the scene. To understand stuff and things in context we introduce COCO-Stuff1, which augments all 164K images of the COCO 2017 dataset with pixel-wise annotations for 91 stuff classes. We introduce an efficient stuff annotation protocol based on superpixels, which leverages the original thing annotations. We quantify the speed versus quality trade-off of our protocol and explore the relation between annotation time and boundary complexity. Furthermore, we use COCO-Stuff to analyze: (a) the importance of stuff and thing classes in terms of their surface cover and how frequently they are mentioned in image captions; (b) the spatial relations between stuff and things, highlighting the rich contextual relations that make our dataset unique; (c) the performance of a modern semantic segmentation method on stuff and thing classes, and whether stuff is easier to segment than things.

Statistics of semantic segmentation datasets composing GV-D{{formula:6e9085e6-9c61-46e5-8dd4-85dd3b69e69a}} -143K for learning Up-E (S).

We train our semantic segmentation expert Up-E (S) on four benchmark datasets: Cityscapes {{cite:6dc011d}}, ADE20k {{cite:139b926}}, DOTA {{cite:e444f9b}}, {{cite:f8ae314}} and COCO-Stuff {{cite:a1acebb}}, as listed in Tab. {{table:9abc42a1-2460-4de8-8475-a2e034402230}} . We select these datasets for their popularity, scales and diverse distribution.


Fine-Grained Visual Classification of Aircraft

Abstract: This paper introduces FGVC-Aircraft, a new dataset containing 10,000 images of aircraft spanning 100 aircraft models, organised in a three-level hierarchy. At the finer level, differences between models are often subtle but always visually measurable, making visual recognition challenging but possible. A benchmark is obtained by defining corresponding classification tasks and evaluation protocols, and baseline results are presented. The construction of this dataset was made possible by the work of aircraft enthusiasts, a strategy that can extend to the study of number of other object classes. Compared to the domains usually considered in fine-grained visual classification (FGVC), for example animals, aircraft are rigid and hence less deformable. They, however, present other interesting modes of variation, including purpose, size, designation, structure, historical style, and branding.

Describing Textures in the Wild

Abstract: Patterns and textures are key characteristics of many natural objects: a shirt can be striped, the wings of a butterfly can be veined, and the skin of an animal can be scaly. Aiming at supporting this dimension in image understanding, we address the problem of describing textures with semantic attributes. We identify a vocabulary of forty-seven texture terms and use them to describe a large dataset of patterns collected "in the wild". The resulting Describable Textures Dataset (DTD) is a basis to seek the best representation for recognizing describable texture attributes in images. We port from object recognition to texture recognition the Improved Fisher Vector (IFV) and Deep Convolutional-network Activation Features (DeCAF), and show that surprisingly, they both outperform specialized texture descriptors not only on our problem, but also in established material recognition datasets. We also show that our describable attributes are excellent texture descriptors, transferring between datasets and tasks, in particular, combined with IFV and DeCAF, they significantly outperform the state-of-the-art by more than 10% on both FMD and KTH-TIPS-2b benchmarks. We also demonstrate that they produce intuitive descriptions of materials and Internet images.

Summary of small-scale datasets.

Besides ImageNet-1k, we also evaluate UP-ViTs on downstream small-scale datasets. Table {{table:74bba000-7445-4c1c-890d-e821b39b3d97}}  summarizes the information of these datasets, including training and validation sizes, and the number of categories.


Generalization and Representational Limits of Graph Neural Networks

Abstract: We address two fundamental questions about graph neural networks (GNNs). First, we prove that several important graph properties cannot be computed by GNNs that rely entirely on local information. Such GNNs include the standard message passing models, and more powerful spatial variants that exploit local graph structure (e.g., via relative orientation of messages, or local port ordering) to distinguish neighbors of each node. Our treatment includes a novel graph-theoretic formalism. Second, we provide the first data dependent generalization bounds for message passing GNNs. This analysis explicitly accounts for the local permutation invariance of GNNs. Our bounds are much tighter than existing VC-dimension based guarantees for GNNs, and are comparable to Rademacher bounds for recurrent neural networks.

What graph neural networks cannot learn: depth vs width

Abstract: This paper studies the expressive power of graph neural networks falling within the message-passing framework (GNNmp). Two results are presented. First, GNNmp are shown to be Turing universal under sufficient conditions on their depth, width, node attributes, and layer expressiveness. Second, it is discovered that GNNmp can lose a significant portion of their power when their depth and width is restricted. The proposed impossibility statements stem from a new technique that enables the repurposing of seminal results from distributed computing and leads to lower bounds for an array of decision, optimization, and estimation problems involving graphs. Strikingly, several of these problems are deemed impossible unless the product of a GNNmp's depth and width exceeds a polynomial of the graph size; this dependence remains significant even for tasks that appear simple or when considering approximation.

Random Features Strengthen Graph Neural Networks

Abstract: Graph neural networks (GNNs) are powerful machine learning models for various graph learning tasks. Recently, the limitations of the expressive power of various GNN models have been revealed. For example, GNNs cannot distinguish some non-isomorphic graphs and they cannot learn efficient graph algorithms. In this paper, we demonstrate that GNNs become powerful just by adding a random feature to each node. We prove that the random features enable GNNs to learn almost optimal polynomial-time approximation algorithms for the minimum dominating set problem and maximum matching problem in terms of approximation ratios. The main advantage of our method is that it can be combined with off-the-shelf GNN models with slight modifications. Through experiments, we show that the addition of random features enables GNNs to solve various problems that normal GNNs, including the graph convolutional networks (GCNs) and graph isomorphism networks (GINs), cannot solve.

On the equivalence between graph isomorphism testing and function approximation with GNNs

Abstract:
Graph neural networks (GNNs) have achieved lots of success on graph-structured data. In the light of this, there has been increasing interest in studying their representation power. One line of work focuses on the universal approximation of permutation-invariant functions by certain classes of GNNs, and another demonstrates the limitation of GNNs via graph isomorphism tests.
Our work connects these two perspectives and proves their equivalence. We further develop a framework of the representation power of GNNs with the language of sigma-algebra, which incorporates both viewpoints. Using this framework, we compare the expressive power of different classes of GNNs as well as other methods on graphs. In particular, we prove that order-2 Graph G-invariant networks fail to distinguish non-isomorphic regular graphs with the same degree. We then extend them to a new architecture, Ring-GNNs, which succeeds on distinguishing these graphs and provides improvements on real-world social network datasets.

Synthetic dataset statistics and properties.

For the synthetic benchmarks (Limits 1, Limits 2, 4-Cycles, LCC, Triangles, Skip-Circles) we use a GIN model with 4 convolutional layers (+ 1 input layer), sum as aggregation, {{formula:2ce4617f-89a9-44ea-a750-81513a3ce199}}  and for simplicity do not use dropout on the final Readout layer, while the final layer dropout is treated as a hyper-parameter in the original model. For synthetic node classification tasks (Limits 1, Limits 2, LCC, and Triangles) we use the same readout head as the original GIN model but skip the graph aggregation step. In all cases, except the SkipCircles dataset, 16 hidden units are used for synthetic tasks. For the SkipCircles dataset we use a GIN model with 9 convolutional layers (+ 1 input layer) with 32 hidden units as this dataset has cycles of up to 17 hops and requires long-range information propagation to solve the task. For the DropGIN variant, mean aggregation is used to aggregate node representations from different runs. When the GIN model is augmented with ports, which introduce edge features, we use modified GIN convolutions that include edge features {{cite:1a320f1}}. In synthetic benchmarks, we always generate the same number of graphs for training and test sets (generate a new copy of the dataset for testing) and for each random seed, we re-generate the datasets. We always feed in the whole dataset as one batch. Limits 1, Limits 2 and Skip-Circles datasets are always comprised of graphs with the same structure, just with permuted node IDs for each dataset initialization, the remaining datasets have random graph structure, which changes when the datasets are regenerated. You can see the synthetic dataset structure type and statistics in Table {{table:2404947a-b181-4e26-a344-7755bed91881}} . All nodes in these datasets have the same degree.


Language model pretraining, Supervised pretraining

Neural Adaptation Layers for Cross-domain Named Entity Recognition

Abstract: Recent research efforts have shown that neural architectures can be effective in conventional information extraction tasks such as named entity recognition, yielding state-of-the-art results on standard newswire datasets. However, despite significant resources required for training such models, the performance of a model trained on one domain typically degrades dramatically when applied to a different domain, yet extracting entities from new emerging domains such as social media can be of significant interest. In this paper, we empirically investigate effective methods for conveniently adapting an existing, well-trained neural NER model for a new domain. Unlike existing approaches, we propose lightweight yet effective methods for performing domain adaptation for neural models. Specifically, we introduce adaptation layers on top of existing neural architectures, where no re-training using the source domain data is required. We conduct extensive empirical studies and show that our approach significantly outperforms state-of-the-art methods.

Online Updating of Word Representations for Part-of-Speech Tagging

Abstract: We propose online unsupervised domain adaptation (DA), which is performed incrementally as data comes in and is applicable when batch DA is not possible. In a part-of-speech (POS) tagging evaluation, we find that online unsupervised DA performs as well as batch DA.

Supervised Learning of Universal Sentence Representations from Natural Language Inference Data

Abstract: Many modern NLP systems rely on word embeddings, previously trained in an unsupervised manner on large corpora, as base features. Efforts to obtain embeddings for larger chunks of text, such as sentences, have however not been so successful. Several attempts at learning unsupervised representations of sentences have not reached satisfactory enough performance to be widely adopted. In this paper, we show how universal sentence representations trained using the supervised data of the Stanford Natural Language Inference datasets can consistently outperform unsupervised methods like SkipThought vectors on a wide range of transfer tasks. Much like how computer vision uses ImageNet to obtain features, which can then be transferred to other tasks, our work tends to indicate the suitability of natural language inference for transfer learning to other NLP tasks. Our encoder is publicly available.

Examples of methods from each category, and papers studying these methods. These lists are non-exhaustive. In interest of replicability, the coding for all papers will be released on publication.

Hybrid approaches contain two fine subcategories that cannot be classified as model-centric or data-centric because they involve manipulation of the data distribution, but can also be viewed as loss-centric approaches that edit the training loss. Instance weighting approaches assign weights to target examples based on similarity to source data. Conversely, data selection approaches filter target data based on similarity to source data. Table {{table:91fd3ec4-6a5c-4ec2-a973-278005b43a0a}}  lists example adaptation methods for each fine category and example studies from our meta-analysis subset that use these methods.


Source-target distance minimized using two loss penalties (LA)

Weakly supervised data creation by aggregating labels from rule-based or trained labeling functions (PL)

Positive transfer to medical and Twitter data

Positive transfer to financial text and Twitter

Label-Aware Double Transfer Learning for Cross-Specialty Medical Named Entity Recognition

Abstract: We study the problem of named entity recognition (NER) from electronic medical records, which is one of the most fundamental and critical problems for medical text mining. Medical records which are written by clinicians from different specialties usually contain quite different terminologies and writing styles. The difference of specialties and the cost of human annotation makes it particularly difficult to train a universal medical NER system. In this paper, we propose a label-aware double transfer learning framework (La-DTL) for cross-specialty NER, so that a medical NER system designed for one specialty could be conveniently applied to another one with minimal annotation efforts. The transferability is guaranteed by two components: (i) we propose label-aware MMD for feature representation transfer, and (ii) we perform parameter transfer with a theoretical upper bound which is also label aware. We conduct extensive experiments on 12 cross-specialty NER tasks. The experimental results demonstrate that La-DTL provides consistent accuracy improvement over strong baselines. Besides, the promising experimental results on non-medical NER scenarios indicate that La-DTL is potential to be seamlessly adapted to a wide range of NER tasks.

Named Entity Recognition without Labelled Data: A Weak Supervision Approach

Abstract: Named Entity Recognition (NER) performance often degrades rapidly when applied to target domains that differ from the texts observed during training. When in-domain labelled data is available, transfer learning techniques can be used to adapt existing NER models to the target domain. But what should one do when there is no hand-labelled data for the target domain? This paper presents a simple but powerful approach to learn NER models in the absence of labelled data through weak supervision. The approach relies on a broad spectrum of labelling functions to automatically annotate texts from the target domain. These annotations are then merged together using a hidden Markov model which captures the varying accuracies and confusions of the labelling functions. A sequence labelling model can finally be trained on the basis of this unified annotation. We evaluate the approach on two English datasets (CoNLL 2003 and news articles from Reuters and Bloomberg) and demonstrate an improvement of about 7 percentage points in entity-level F1 scores compared to an out-of-domain neural NER model.

Model and performance details for studies testing on high-expertise and non-narrative domains

Which Properties Help Adaptation Methods Improve Performance On Long Tail Dimensions?

To specifically identify techniques that work on long tail domains, we look at categories of methods evaluated on high-expertise domains or non-narrative domains (or both). Figures {{figure:9d9505ec-c650-45d9-b885-6ea9076190da}} , {{figure:9d9505ec-c650-45d9-b885-6ea9076190da}}  and {{figure:9d9505ec-c650-45d9-b885-6ea9076190da}}  present the distributions of fine method categories tested on high-expertise domains, non-narrative domains and both domain types respectively. While feature augmentation techniques remain the most explored category for high-expertise domains, we see a change in trend for non-narrative domains. Loss augmentation and pretraining are more commonly explored categories. The difference in dominant model categories can be partly attributed to easy availability of large-scale unlabeled data and weak signals (e.g., likes, shares etc.), particularly for social media. Such user-generated content (called “fortuitous data” by DBLP:conf/konvens/Plank16) is leveraged well by pretraining or multi-task learning techniques, making them popular choices for non-narrative domains. In contrast, high-expertise domains (e.g, literature, security and defense reports, finance, etc.) often lack fortuitous data, with methods developed for them focusing on learning shared feature spaces.
10 studies in our meta-analysis sample evaluate on both domain types. Table {{table:594d01ca-8d59-4c38-87c1-0b740a39d2ff}}  gives a brief description of methods explored in these studies and their performance.More details provided in appendix  From these studies, we identify two interesting properties that seem to improve adaptation performance but remain relatively under-explored in the context of recent methods such as pretraining:

Open Issues: Interestingly many studies from our sample do not analyze failures, i.e., source-target pairs on which adaptation methods do not improve performance. For some studies in table {{table:594d01ca-8d59-4c38-87c1-0b740a39d2ff}} , adaptation methods do not improve performance on all source-target pairs. But failures are not investigated, presenting the question: do we know blind spots for current adaptation methods? Answering this is essential to develop a complete picture of the generalization capabilities of adaptation methods. Studies that present negative transfer results (e.g., {{cite:d67e89a}}) are rare, but should be encouraged to develop a sound understanding of adaptation techniques. Analyses should also study ties between datasets used and methods applied, highlighting dimensions of variation between source-target domains and how adaptation methods bridge these variations {{cite:0463ae1}}, {{cite:63feca0}}. Such analyses can uncover important lessons about generalizability of adaptation methods and the kinds of source-target settings they can be expected to improve performance on.

Domain Variation: {{cite:7fd0077}} and {{cite:f1a3977}} incorporate human understanding of domain variation in discrete and continuous feature spaces respectively, with some success (table {{table:594d01ca-8d59-4c38-87c1-0b740a39d2ff}} ). Structural correspondence learning {{cite:d9b6b77}} relies on manually defined pivot features common to source and target domains, and shows performance improvements.


Source-target distance minimized using two loss penalties: (i) minimizing maximum mean discrepancy between tokens with same labels from different domains, and (ii) minimizing KL divergence between source and target CRF emission and transition distributions (LA)

Weakly supervised training data created using multiple rule-based or trained labeling functions for each instance, multiple labels aggregated using a Hidden Markov Model (PL)

Performance improvements on various medical and Twitter data sources

Performance improvements on both financial text and Twitter

Model and performance details for studies that test on both high-expertise and non-narrative domains

Table {{table:0398639f-f7f0-462f-91cc-779ad0fb167b}}  lists studies that evaluate on multiple long tail domains, detailing methods explored in them and their performance. The draft contains an abridged version (table 4).


Proximal Policy Optimization Algorithms

Abstract: We propose a new family of policy gradient methods for reinforcement learning, which alternate between sampling data through interaction with the environment, and optimizing a "surrogate" objective function using stochastic gradient ascent. Whereas standard policy gradient methods perform one gradient update per data sample, we propose a novel objective function that enables multiple epochs of minibatch updates. The new methods, which we call proximal policy optimization (PPO), have some of the benefits of trust region policy optimization (TRPO), but they are much simpler to implement, more general, and have better sample complexity (empirically). Our experiments test PPO on a collection of benchmark tasks, including simulated robotic locomotion and Atari game playing, and we show that PPO outperforms other online policy gradient methods, and overall strikes a favorable balance between sample complexity, simplicity, and wall-time.

Soft Actor-Critic: Off-Policy Maximum Entropy Deep Reinforcement Learning with a Stochastic Actor

Abstract: Model-free deep reinforcement learning (RL) algorithms have been demonstrated on a range of challenging decision making and control tasks. However, these methods typically suffer from two major challenges: very high sample complexity and brittle convergence properties, which necessitate meticulous hyperparameter tuning. Both of these challenges severely limit the applicability of such methods to complex, real-world domains. In this paper, we propose soft actor-critic, an off-policy actor-critic deep RL algorithm based on the maximum entropy reinforcement learning framework. In this framework, the actor aims to maximize expected reward while also maximizing entropy. That is, to succeed at the task while acting as randomly as possible. Prior deep RL methods based on this framework have been formulated as Q-learning methods. By combining off-policy updates with a stable stochastic actor-critic formulation, our method achieves state-of-the-art performance on a range of continuous control benchmark tasks, outperforming prior on-policy and off-policy methods. Furthermore, we demonstrate that, in contrast to other off-policy algorithms, our approach is very stable, achieving very similar performance across different random seeds.

Relative Entropy Regularized Policy Iteration

Abstract: We present an off-policy actor-critic algorithm for Reinforcement Learning (RL) that combines ideas from gradient-free optimization via stochastic search with learned action-value function. The result is a simple procedure consisting of three steps: i) policy evaluation by estimating a parametric action-value function; ii) policy improvement via the estimation of a local non-parametric policy; and iii) generalization by fitting a parametric policy. Each step can be implemented in different ways, giving rise to several algorithm variants. Our algorithm draws on connections to existing literature on black-box optimization and 'RL as an inference' and it can be seen either as an extension of the Maximum a Posteriori Policy Optimisation algorithm (MPO) [Abdolmaleki et al., 2018a], or as an extension of Trust Region Covariance Matrix Adaptation Evolutionary Strategy (CMA-ES) [Abdolmaleki et al., 2017b; Hansen et al., 1997] to a policy iteration scheme. Our comparison on 31 continuous control tasks from parkour suite [Heess et al., 2017], DeepMind control suite [Tassa et al., 2018] and OpenAI Gym [Brockman et al., 2016] with diverse properties, limited amount of compute and a single set of hyperparameters, demonstrate the effectiveness of our method and the state of art results. Videos, summarizing results, can be found at goo.gl/HtvJKR .

Mastering Atari with Discrete World Models

Abstract: Intelligent agents need to generalize from past experience to achieve goals in complex environments. World models facilitate such generalization and allow learning behaviors from imagined outcomes to increase sample-efficiency. While learning world models from image inputs has recently become feasible for some tasks, modeling Atari games accurately enough to derive successful behaviors has remained an open challenge for many years. We introduce DreamerV2, a reinforcement learning agent that learns behaviors purely from predictions in the compact latent space of a powerful world model. The world model uses discrete representations and is trained separately from the policy. DreamerV2 constitutes the first agent that achieves human-level performance on the Atari benchmark of 55 tasks by learning behaviors inside a separately trained world model. With the same computational budget and wall-clock time, DreamerV2 reaches 200M frames and exceeds the final performance of the top single-GPU agents IQN and Rainbow.

Algorithms analyzed in conjunction with Bernoulli policies.

We consider Proximal Policy Optimization (PPO) {{cite:ca1cd0c}}, Soft Actor Critic (SAC) {{cite:d30ab7f}}, Maximum A Posteriori Policy Optimization (MPO) {{cite:e8d17a9}} and DreamerV2 {{cite:0f00e2c}} as our baseline algorithms. These approaches differ widely in their learning method, optimization strategy, and input signals. A brief comparison of their characteristics is provided in Table {{table:e9f410f7-387e-4a40-9288-230ceb430eee}}  with additional description in Appendix .
We investigate the effects of replacing the commonly used Gaussian with a Bernoulli distribution and provide both qualitative and quantitative comparisons of the learned controllers.
For approaches requiring reparameterization of Bernoulli policies we leverage the biased straight-through gradient estimator {{cite:5263756}} (Appendix ).
We place particular focus on MPO as a robust off-policy method which does not require gradient reparameterization and avoids introducing additional estimation errors.

Solving Continuous Control Problems with Bang-Bang Policies

We investigate performance of Bang-Bang policies on several continuous control problems from the DeepMind Control Suite. Figure {{figure:8810bbea-b3d5-49a7-83bd-cb9b4cc8a6ab}}  provides learning curves for PPO, SAC, MPO, and DreamerV2.
We note that restricting agents to only select minimum or maximum actions generally does not prevent learning on the tasks and even yields competitive performance.
This applies across several domains and distinct algorithm designs (see Table {{table:e9f410f7-387e-4a40-9288-230ceb430eee}} ).


Constraint Optimization of cause maximal voltage deviation with an attack at one node in the finite time interval

Power Injection Attacks in Smart Distribution Grids with Photovoltaics

Abstract: In order to protect smart distribution grids from intrusions, it is important to understand possible risks and impacts of attacks. We study the worst-case attack strategy of a power injection attack against the physical layer of a smart distribution grid with a high penetration of photovoltaic resources. We derive both the worst attack signal and worst attack location: The worst attack signal is a step function which switches its sign at the final stage, and the worst attack location is the node with the largest impedance to the grid substation. Numerical examples on a European benchmark model verify the developed results. Finally, both theoretical and numerical results are used to discuss feasible defense strategies against power injection attacks.

False Data Injection Threats in Active Distribution Systems: A Comprehensive Survey

Abstract: With the proliferation of smart devices and revolutions in communications, electrical distribution systems are gradually shifting from passive, manually-operated and inflexible ones, to a massively interconnected cyber-physical smart grid to address the energy challenges of the future. However, the integration of several cutting-edge technologies has introduced several security and privacy vulnerabilities due to the large-scale complexity and resource limitations of deployments. Recent research trends have shown that False Data Injection (FDI) attacks are becoming one of the most malicious cyber threats within the entire smart grid paradigm. Therefore, this paper presents a comprehensive survey of the recent advances in FDI attacks within active distribution systems and proposes a taxonomy to classify the FDI threats with respect to smart grid targets. The related studies are contrasted and summarized in terms of the attack methodologies and implications on the electrical power distribution networks. Finally, we identify some research gaps and recommend a number of future research directions to guide and motivate prospective researchers.

Comparative View of threats on End-User Level - Energy Management

The increase in complexity along with the bi-directional communication provoked by renewable energy management systems and advanced metering infrastructure at the end-user level opens up several security vulnerabilities within ADSs {{cite:052e236}}. In this view, we present the FDI threats on end-user level as in Tables {{table:4f61ad03-45e0-4cfc-af38-8deaabb69ab4}}  and .{{table:48a51c72-abba-4f2e-ac68-9f47d0011996}} .


Fine-tuned face recog. features - Deep Learning

Biometric Face Presentation Attack Detection With Multi-Channel Convolutional Neural Network

Abstract: Face recognition is a mainstream biometric authentication method. However, the vulnerability to presentation attacks (a.k.a. spoofing) limits its usability in unsupervised applications. Even though there are many methods available for tackling presentation attacks (PA), most of them fail to detect sophisticated attacks such as silicone masks. As the quality of presentation attack instruments improves over time, achieving reliable PA detection with visual spectra alone remains very challenging. We argue that analysis in multiple channels might help to address this issue. In this context, we propose a multi-channel Convolutional Neural Network-based approach for presentation attack detection (PAD). We also introduce the new Wide Multi-Channel presentation Attack (WMCA) database for face PAD which contains a wide variety of 2D and 3D presentation attacks for both impersonation and obfuscation attacks. Data from different channels such as color, depth, near-infrared, and thermal are available to advance the research in face PAD. The proposed method was compared with feature-based approaches and found to outperform the baselines achieving an ACER of 0.3% on the introduced dataset. The database and the software to reproduce the results are made available publicly.

DeepFakesON-Phys: DeepFakes Detection based on Heart Rate Estimation

Abstract: This work introduces a novel DeepFake detection framework based on physiological measurement. In particular, we consider information related to the heart rate using remote photoplethysmography (rPPG). rPPG methods analyze video sequences looking for subtle color changes in the human skin, revealing the presence of human blood under the tissues. In this work we investigate to what extent rPPG is useful for the detection of DeepFake videos. The proposed fake detector named DeepFakesON-Phys uses a Convolutional Attention Network (CAN), which extracts spatial and temporal information from video frames, analyzing and combining both sources to better detect fake videos. This detection approach has been experimentally evaluated using the latest public databases in the field: Celeb-DF and DFDC. The results achieved, above 98% AUC (Area Under the Curve) on both databases, outperform the state of the art and prove the success of fake detectors based on physiological measurement to detect the latest DeepFake videos.

Learning One Class Representations for Face Presentation Attack Detection using Multi-channel Convolutional Neural Networks

Abstract: Face recognition has evolved as a widely used biometric modality. However, its vulnerability against presentation attacks poses a significant security threat. Though presentation attack detection (PAD) methods try to address this issue, they often fail in generalizing to unseen attacks. In this work, we propose a new framework for PAD using a one-class classifier, where the representation used is learned with a Multi-Channel Convolutional Neural Network (MCCNN). A novel loss function is introduced, which forces the network to learn a compact embedding for bonafide class while being far from the representation of attacks. A one-class Gaussian Mixture Model is used on top of these embeddings for the PAD task. The proposed framework introduces a novel approach to learn a robust PAD system from bonafide and available (known) attack classes. This is particularly important as collecting bonafide data and simpler attacks are much easier than collecting a wide variety of expensive attacks. The proposed system is evaluated on the publicly available WMCA multi-channel face PAD database, which contains a wide variety of 2D and 3D attacks. Further, we have performed experiments with MLFP and SiW-M datasets using RGB channels only. Superior performance in unseen attack protocols shows the effectiveness of the proposed approach. Software, data, and protocols to reproduce the results are made available publicly.

TransRPPG: Remote Photoplethysmography Transformer for 3D Mask Face Presentation Attack Detection

Abstract: 3D mask face presentation attack detection (PAD) plays a vital role in securing face recognition systems from emergent 3D mask attacks. Recently, remote photoplethysmography (rPPG) has been developed as an intrinsic liveness clue for 3D mask PAD without relying on the mask appearance. However, the rPPG features for 3D mask PAD are still needed expert knowledge to design manually, which limits its further progress in the deep learning and big data era. In this letter, we propose a pure rPPG transformer (TransRPPG) framework for learning intrinsic liveness representation efficiently. At first, rPPG-based multi-scale spatial-temporal maps (MSTmap) are constructed from facial skin and background regions. Then the transformer fully mines the global relationship within MSTmaps for liveness representation, and gives a binary prediction for 3D mask detection. Comprehensive experiments are conducted on two benchmark datasets to demonstrate the efficacy of the TransRPPG on both intra- and cross-dataset testings. Our TransRPPG is lightweight and efficient (with only 547 K parameters and 763 M FLOPs), which is promising for mobile-level applications.

Selection of relevant works in software-based face PAD.

Software-based PAD methods are convinient in most of the cases since they allow to upgrade the countermeasures in existing systems without needing new pieces of hardware and permitting authentication to be done in real time without extra user interaction. Table {{table:d19edc5a-5521-400f-99ac-5efad3a2d143}}  shows a selection of relevant PAD works based on software techniques, including information about the type of images they use, the databases in which they are evaluated, and the types of features they analyze. The table also illustrates the current dominance of deep learning among PAD methods, since like in many other research areas, during the last years most state-of-the-art face PAD works have changed from methods based on hand-crafted features to deep learning approaches based on architectures like Convolutional Neural Networks and Generative Adversarial Networks.