• An important preprocessing step in most data analysis pipelines aims to extract a small set of sources that explain most of the data. Currently used algorithms for blind source separation (BSS), however, often fail to extract the desired sources and need extensive cross-validation. In contrast, their rarely used probabilistic counterparts can get away with little cross-validation and are more accurate and reliable but no simple and scalable implementations are available. Here we present a novel probabilistic BSS framework (DECOMPOSE) that can be flexibly adjusted to the data, is extensible and easy to use, adapts to individual sources and handles large-scale data through algorithmic efficiency. DECOMPOSE encompasses and generalises many traditional BSS algorithms such as PCA, ICA and NMF and we demonstrate substantial improvements in accuracy and robustness on artificial and real data.
  • Even todays most advanced machine learning models are easily fooled by almost imperceptible perturbations of their inputs. Foolbox is a new Python package to generate such adversarial perturbations and to quantify and compare the robustness of machine learning models. It is build around the idea that the most comparable robustness measure is the minimum perturbation needed to craft an adversarial example. To this end, Foolbox provides reference implementations of most published adversarial attack methods alongside some new ones, all of which perform internal hyperparameter tuning to find the minimum adversarial perturbation. Additionally, Foolbox interfaces with most popular deep learning frameworks such as PyTorch, Keras, TensorFlow, Theano and MXNet and allows different adversarial criteria such as targeted misclassification and top-k misclassification as well as different distance measures. The code is licensed under the MIT license and is openly available at https://github.com/bethgelab/foolbox . The most up-to-date documentation can be found at http://foolbox.readthedocs.io .
  • Many machine learning algorithms are vulnerable to almost imperceptible perturbations of their inputs. So far it was unclear how much risk adversarial perturbations carry for the safety of real-world machine learning applications because most methods used to generate such perturbations rely either on detailed model information (gradient-based attacks) or on confidence scores such as class probabilities (score-based attacks), neither of which are available in most real-world scenarios. In many such cases one currently needs to retreat to transfer-based attacks which rely on cumbersome substitute models, need access to the training data and can be defended against. Here we emphasise the importance of attacks which solely rely on the final model decision. Such decision-based attacks are (1) applicable to real-world black-box models such as autonomous cars, (2) need less knowledge and are easier to apply than transfer-based attacks and (3) are more robust to simple defences than gradient- or score-based attacks. Previous attacks in this category were limited to simple models or simple datasets. Here we introduce the Boundary Attack, a decision-based attack that starts from a large adversarial perturbation and then seeks to reduce the perturbation while staying adversarial. The attack is conceptually simple, requires close to no hyperparameter tuning, does not rely on substitute models and is competitive with the best gradient-based attacks in standard computer vision tasks like ImageNet. We apply the attack on two black-box algorithms from Clarifai.com. The Boundary Attack in particular and the class of decision-based attacks in general open new avenues to study the robustness of machine learning models and raise new questions regarding the safety of deployed machine learning systems. An implementation of the attack is available as part of Foolbox at https://github.com/bethgelab/foolbox .
  • A recent paper suggests that Deep Neural Networks can be protected from gradient-based adversarial perturbations by driving the network activations into a highly saturated regime. Here we analyse such saturated networks and show that the attacks fail due to numerical limitations in the gradient computations. A simple stabilisation of the gradient estimates enables successful and efficient attacks. Thus, it has yet to be shown that the robustness observed in highly saturated networks is not simply due to numerical limitations.
  • A key question in neuroscience is at which level functional meaning emerges from biophysical phenomena. In most vertebrate systems, precise functions are assigned at the level of neural populations, while single-neurons are deemed unreliable and redundant. Here we challenge this view and show that many single-neuron quantities, including voltages, firing thresholds, excitation, inhibition, and spikes, acquire precise functional meaning whenever a network learns to transmit information parsimoniously and precisely to the next layer. Based on the hypothesis that neural circuits generate precise population codes under severe constraints on metabolic costs, we derive synaptic plasticity rules that allow a network to represent its time-varying inputs with maximal accuracy. We provide exact solutions to the learnt optimal states, and we predict the properties of an entire network from its input distribution and the cost of activity. Single-neuron variability and tuning curves as typically observed in cortex emerge over the course of learning, but paradoxically coincide with a precise, non-redundant spike-based population code. Our work suggests that neural circuits operate far more accurately than previously thought, and that no spike is fired in vain.
  • Here we demonstrate that the feature space of random shallow convolutional neural networks (CNNs) can serve as a surprisingly good model of natural textures. Patches from the same texture are consistently classified as being more similar then patches from different textures. Samples synthesized from the model capture spatial correlations on scales much larger then the receptive field size, and sometimes even rival or surpass the perceptual quality of state of the art texture models (but show less variability). The current state of the art in parametric texture synthesis relies on the multi-layer feature space of deep CNNs that were trained on natural images. Our finding suggests that such optimized multi-layer feature spaces are not imperative for texture modeling. Instead, much simpler shallow and convolutional networks can serve as the basis for novel texture synthesis algorithms.
  • Neurons in higher cortical areas, such as the prefrontal cortex, are known to be tuned to a variety of sensory and motor variables. The resulting diversity of neural tuning often obscures the represented information. Here we introduce a novel dimensionality reduction technique, demixed principal component analysis (dPCA), which automatically discovers and highlights the essential features in complex population activities. We reanalyze population data from the prefrontal areas of rats and monkeys performing a variety of working memory and decision-making tasks. In each case, dPCA summarizes the relevant features of the population response in a single figure. The population activity is decomposed into a few demixed components that capture most of the variance in the data and that highlight dynamic tuning of the population to various task parameters, such as stimuli, decisions, rewards, etc. Moreover, dPCA reveals strong, condition-independent components of the population activity that remain unnoticed with conventional approaches.
  • Baryons in the large N limit of two-dimensional Gross-Neveu models are reconsidered. The time-dependent Dirac-Hartree-Fock approach is used to boost a baryon to any inertial frame and shown to yield the covariant energy-momentum relation. Momentum distributions are computed exactly in arbitrary frames and used to interpolate between the rest frame and the infinite momentum frame, where they are related to structure functions. Effects from the Dirac sea depend sensitively on the occupation fraction of the valence level and the bare fermion mass and do not vanish at infinite momentum. In the case of the kink baryon, they even lead to divergent quark and antiquark structure functions at x=0.
  • We construct twisted instanton solutions of CP(n) models. Generically a charge-k instanton splits into k(n+1) well-separated and almost static constituents carrying fractional topological charges and being ordered along the noncompact direction. The locations, sizes and charges of the constituents are related to the moduli parameters of the instantons. We sketch how solutions with fractional total charge can be obtained. We also calculate the fermionic zero modes with quasi-periodic boundary conditions in the background of twisted instantons for minimally and supersymmetrically coupled fermions. The zero modes are tracers for the constituents and show a characteristic hopping. The analytical findings are compared to results extracted from Monte-Carlo generated and cooled configurations of the corresponding lattice models. Analytical and numerical results are in full agreement and it is demonstrated that the fermionic zero modes are excellent filters for constituents hidden in fluctuating lattice configurations.