
An important preprocessing step in most data analysis pipelines aims to
extract a small set of sources that explain most of the data. Currently used
algorithms for blind source separation (BSS), however, often fail to extract
the desired sources and need extensive crossvalidation. In contrast, their
rarely used probabilistic counterparts can get away with little
crossvalidation and are more accurate and reliable but no simple and scalable
implementations are available. Here we present a novel probabilistic BSS
framework (DECOMPOSE) that can be flexibly adjusted to the data, is extensible
and easy to use, adapts to individual sources and handles largescale data
through algorithmic efficiency. DECOMPOSE encompasses and generalises many
traditional BSS algorithms such as PCA, ICA and NMF and we demonstrate
substantial improvements in accuracy and robustness on artificial and real
data.

Even todays most advanced machine learning models are easily fooled by almost
imperceptible perturbations of their inputs. Foolbox is a new Python package to
generate such adversarial perturbations and to quantify and compare the
robustness of machine learning models. It is build around the idea that the
most comparable robustness measure is the minimum perturbation needed to craft
an adversarial example. To this end, Foolbox provides reference implementations
of most published adversarial attack methods alongside some new ones, all of
which perform internal hyperparameter tuning to find the minimum adversarial
perturbation. Additionally, Foolbox interfaces with most popular deep learning
frameworks such as PyTorch, Keras, TensorFlow, Theano and MXNet and allows
different adversarial criteria such as targeted misclassification and topk
misclassification as well as different distance measures. The code is licensed
under the MIT license and is openly available at
https://github.com/bethgelab/foolbox . The most uptodate documentation can be
found at http://foolbox.readthedocs.io .

Many machine learning algorithms are vulnerable to almost imperceptible
perturbations of their inputs. So far it was unclear how much risk adversarial
perturbations carry for the safety of realworld machine learning applications
because most methods used to generate such perturbations rely either on
detailed model information (gradientbased attacks) or on confidence scores
such as class probabilities (scorebased attacks), neither of which are
available in most realworld scenarios. In many such cases one currently needs
to retreat to transferbased attacks which rely on cumbersome substitute
models, need access to the training data and can be defended against. Here we
emphasise the importance of attacks which solely rely on the final model
decision. Such decisionbased attacks are (1) applicable to realworld
blackbox models such as autonomous cars, (2) need less knowledge and are
easier to apply than transferbased attacks and (3) are more robust to simple
defences than gradient or scorebased attacks. Previous attacks in this
category were limited to simple models or simple datasets. Here we introduce
the Boundary Attack, a decisionbased attack that starts from a large
adversarial perturbation and then seeks to reduce the perturbation while
staying adversarial. The attack is conceptually simple, requires close to no
hyperparameter tuning, does not rely on substitute models and is competitive
with the best gradientbased attacks in standard computer vision tasks like
ImageNet. We apply the attack on two blackbox algorithms from Clarifai.com.
The Boundary Attack in particular and the class of decisionbased attacks in
general open new avenues to study the robustness of machine learning models and
raise new questions regarding the safety of deployed machine learning systems.
An implementation of the attack is available as part of Foolbox at
https://github.com/bethgelab/foolbox .

A recent paper suggests that Deep Neural Networks can be protected from
gradientbased adversarial perturbations by driving the network activations
into a highly saturated regime. Here we analyse such saturated networks and
show that the attacks fail due to numerical limitations in the gradient
computations. A simple stabilisation of the gradient estimates enables
successful and efficient attacks. Thus, it has yet to be shown that the
robustness observed in highly saturated networks is not simply due to numerical
limitations.

A key question in neuroscience is at which level functional meaning emerges
from biophysical phenomena. In most vertebrate systems, precise functions are
assigned at the level of neural populations, while singleneurons are deemed
unreliable and redundant. Here we challenge this view and show that many
singleneuron quantities, including voltages, firing thresholds, excitation,
inhibition, and spikes, acquire precise functional meaning whenever a network
learns to transmit information parsimoniously and precisely to the next layer.
Based on the hypothesis that neural circuits generate precise population codes
under severe constraints on metabolic costs, we derive synaptic plasticity
rules that allow a network to represent its timevarying inputs with maximal
accuracy. We provide exact solutions to the learnt optimal states, and we
predict the properties of an entire network from its input distribution and the
cost of activity. Singleneuron variability and tuning curves as typically
observed in cortex emerge over the course of learning, but paradoxically
coincide with a precise, nonredundant spikebased population code. Our work
suggests that neural circuits operate far more accurately than previously
thought, and that no spike is fired in vain.

Here we demonstrate that the feature space of random shallow convolutional
neural networks (CNNs) can serve as a surprisingly good model of natural
textures. Patches from the same texture are consistently classified as being
more similar then patches from different textures. Samples synthesized from the
model capture spatial correlations on scales much larger then the receptive
field size, and sometimes even rival or surpass the perceptual quality of state
of the art texture models (but show less variability). The current state of the
art in parametric texture synthesis relies on the multilayer feature space of
deep CNNs that were trained on natural images. Our finding suggests that such
optimized multilayer feature spaces are not imperative for texture modeling.
Instead, much simpler shallow and convolutional networks can serve as the basis
for novel texture synthesis algorithms.

Neurons in higher cortical areas, such as the prefrontal cortex, are known to
be tuned to a variety of sensory and motor variables. The resulting diversity
of neural tuning often obscures the represented information. Here we introduce
a novel dimensionality reduction technique, demixed principal component
analysis (dPCA), which automatically discovers and highlights the essential
features in complex population activities. We reanalyze population data from
the prefrontal areas of rats and monkeys performing a variety of working memory
and decisionmaking tasks. In each case, dPCA summarizes the relevant features
of the population response in a single figure. The population activity is
decomposed into a few demixed components that capture most of the variance in
the data and that highlight dynamic tuning of the population to various task
parameters, such as stimuli, decisions, rewards, etc. Moreover, dPCA reveals
strong, conditionindependent components of the population activity that remain
unnoticed with conventional approaches.

Baryons in the large N limit of twodimensional GrossNeveu models are
reconsidered. The timedependent DiracHartreeFock approach is used to boost a
baryon to any inertial frame and shown to yield the covariant energymomentum
relation. Momentum distributions are computed exactly in arbitrary frames and
used to interpolate between the rest frame and the infinite momentum frame,
where they are related to structure functions. Effects from the Dirac sea
depend sensitively on the occupation fraction of the valence level and the bare
fermion mass and do not vanish at infinite momentum. In the case of the kink
baryon, they even lead to divergent quark and antiquark structure functions at
x=0.

We construct twisted instanton solutions of CP(n) models. Generically a
chargek instanton splits into k(n+1) wellseparated and almost static
constituents carrying fractional topological charges and being ordered along
the noncompact direction. The locations, sizes and charges of the constituents
are related to the moduli parameters of the instantons. We sketch how solutions
with fractional total charge can be obtained. We also calculate the fermionic
zero modes with quasiperiodic boundary conditions in the background of twisted
instantons for minimally and supersymmetrically coupled fermions. The zero
modes are tracers for the constituents and show a characteristic hopping. The
analytical findings are compared to results extracted from MonteCarlo
generated and cooled configurations of the corresponding lattice models.
Analytical and numerical results are in full agreement and it is demonstrated
that the fermionic zero modes are excellent filters for constituents hidden in
fluctuating lattice configurations.