Search

Recent works have explored how individual components of the CLIP-ViT model contribute to the final representation by leveraging the shared image-text representation space of CLIP. These components, such as attention heads and MLPs, have been shown to capture distinct image features like shape, color or texture. However, understanding the role of these components in arbitrary vision transformers (ViTs) is challenging. To this end, we introduce a general framework which can identify the roles of various components in ViTs beyond CLIP. Specifically, we (a) automate the decomposition of the final representation into contributions from different model components, and (b) linearly map these contributions to CLIP space to interpret them via text. Additionally, we introduce a novel scoring function to rank components by their importance with respect to specific features. Applying our framework to various ViT variants (e.g. DeiT, DINO, DINOv2, Swin, MaxViT), we gain insights into the roles of different components concerning particular image features.These insights facilitate applications such as image retrieval using text descriptions or reference images, visualizing token importance heatmaps, and mitigating spurious correlations., Comment: 22 pages, 15 figures

Recent text-to-image generative models such as Stable Diffusion are extremely adept at mimicking and generating copyrighted content, raising concerns amongst artists that their unique styles may be improperly copied. Understanding how generative models copy "artistic style" is more complex than duplicating a single image, as style is comprised by a set of elements (or signature) that frequently co-occurs across a body of work, where each individual work may vary significantly. In our paper, we first reformulate the problem of "artistic copyright infringement" to a classification problem over image sets, instead of probing image-wise similarities. We then introduce ArtSavant, a practical (i.e., efficient and easy to understand) tool to (i) determine the unique style of an artist by comparing it to a reference dataset of works from 372 artists curated from WikiArt, and (ii) recognize if the identified style reappears in generated images. We leverage two complementary methods to perform artistic style classification over image sets, includingTagMatch, which is a novel inherently interpretable and attributable method, making it more suitable for broader use by non-technical stake holders (artists, lawyers, judges, etc). Leveraging ArtSavant, we then perform a large-scale empirical study to provide quantitative insight on the prevalence of artistic style copying across 3 popular text-to-image generative models. Namely, amongst a dataset of prolific artists (including many famous ones), only 20% of them appear to have their styles be at a risk of copying via simple prompting of today's popular text-to-image generative models.

Despite the remarkable success of deep neural networks in a myriad of settings, several works have demonstrated their overwhelming sensitivity to near-imperceptible perturbations, known as adversarial attacks. On the other hand, prior works have also observed that deep networks can be under-sensitive, wherein large-magnitude perturbations in input space do not induce appreciable changes to network activations. In this work, we study in detail the phenomenon of under-sensitivity in vision models such as CNNs and Transformers, and present techniques to study the geometry and extent of "equi-confidence" level sets of such networks. We propose a Level Set Traversal algorithm that iteratively explores regions of high confidence with respect to the input space using orthogonal components of the local gradients. Given a source image, we use this algorithm to identify inputs that lie in the same equi-confidence level set as the source image despite being perceptually similar to arbitrary images from other classes. We further observe that the source image is linearly connected by a high-confidence path to these inputs, uncovering a star-like structure for level sets of deep networks. Furthermore, we attempt to identify and estimate the extent of these connected higher-dimensional regions over which the model maintains a high degree of confidence. The code for this project is publicly available at https://github.com/SriramB-98/blindspots-neurips-sub, Comment: 25 pages, 20 figures, Accepted at NeurIPS 2023 (spotlight)

Let $\mathcal E$ denote the set of all unital entanglement breaking (UEB) linear maps defined on an operator system $\mathcal S \subset M_d$ and, mapping into $M_n$. As it turns out, the set $\mathcal E$ is not only convex in the classical sense but also in a quantum sense, namely it is $C^*$-convex. The main objective of this article is to describe the $C^*$-extreme points of this set $\mathcal E$. By observing that every EB map defined on the operator system $\mathcal S$ dilates to a positive map with commutative range and also extends to an EB map on $M_d$, we show that the $C^*$-extreme points of the set $\mathcal E$ are precisely the UEB maps that are maximal in the sense of Arveson (\cite{A} and \cite{A69}) and that they are also exactly the linear extreme points of the set $\mathcal E$ with commutative range. We also determine their explicit structure, thereby obtaining operator system generalizations of the analogous structure theorem and the Krein-Milman type theorem given in \cite{BDMS}. As a consequence, we show that $C^*$-extreme (UEB) maps in $\mathcal E$ extend to $C^*$-extreme UEB maps on the full algebra. Finally, we obtain an improved version of the main result in \cite{BDMS}, which contains various characterizations of $C^*$-extreme UEB maps between the algebras $M_d$ and $M_n$., Comment: To appear in LAA

The unregulated use of LLMs can potentially lead to malicious consequences such as plagiarism, generating fake news, spamming, etc. Therefore, reliable detection of AI-generated text can be critical to ensure the responsible use of LLMs. Recent works attempt to tackle this problem either using certain model signatures present in the generated text outputs or by applying watermarking techniques that imprint specific patterns onto them. In this paper, we show that these detectors are not reliable in practical scenarios. In particular, we develop a recursive paraphrasing attack to apply on AI text, which can break a whole range of detectors, including the ones using the watermarking schemes as well as neural network-based detectors, zero-shot classifiers, and retrieval-based detectors. Our experiments include passages around 300 tokens in length, showing the sensitivity of the detectors even in the case of relatively long passages. We also observe that our recursive paraphrasing only degrades text quality slightly, measured via human studies, and metrics such as perplexity scores and accuracy on text benchmarks. Additionally, we show that even LLMs protected by watermarking schemes can be vulnerable against spoofing attacks aimed to mislead detectors to classify human-written text as AI-generated, potentially causing reputational damages to the developers. In particular, we show that an adversary can infer hidden AI text signatures of the LLM outputs without having white-box access to the detection method. Finally, we provide a theoretical connection between the AUROC of the best possible detector and the Total Variation distance between human and AI text distributions that can be used to study the fundamental hardness of the reliable detection problem for advanced language models. Our code is publicly available at https://github.com/vinusankars/Reliability-of-AI-text-detectors.

The ability to remove features from the input of machine learning models is very important to understand and interpret model predictions. However, this is non-trivial for vision models since masking out parts of the input image typically causes large distribution shifts. This is because the baseline color used for masking (typically grey or black) is out of distribution. Furthermore, the shape of the mask itself can contain unwanted signals which can be used by the model for its predictions. Recently, there has been some progress in mitigating this issue (called missingness bias) in image masking for vision transformers. In this work, we propose a new masking method for CNNs we call layer masking in which the missingness bias caused by masking is reduced to a large extent. Intuitively, layer masking applies a mask to intermediate activation maps so that the model only processes the unmasked input. We show that our method (i) is able to eliminate or minimize the influence of the mask shape or color on the output of the model, and (ii) is much better than replacing the masked region by black or grey for input perturbation based interpretability techniques like LIME. Thus, layer masking is much less affected by missingness bias than other masking strategies. We also demonstrate how the shape of the mask may leak information about the class, thus affecting estimates of model reliance on class-relevant features derived from input masking. Furthermore, we discuss the role of data augmentation techniques for tackling this problem, and argue that they are not sufficient for preventing model reliance on mask shape. The code for this project is publicly available at https://github.com/SriramB-98/layer_masking, Comment: 29 pages, 19 figures. Accepted at ICCV 2023

Matrix-valued polynomials in any finite number of freely noncommuting variables that enjoy certain canonical partial convexity properties are characterized, via an algebraic certificate, in terms of Linear Matrix Inequalities and Bilinear Matrix Inequalities., Comment: Comments welcome

Simulating physical network paths (e.g., Internet) is a cornerstone research problem in the emerging sub-field of AI-for-networking. We seek a model that generates end-to-end packet delay values in response to the time-varying load offered by a sender, which is typically a function of the previously output delays. The problem setting is unique, and renders the state-of-the-art text and time-series generative models inapplicable or ineffective. We formulate an ML problem at the intersection of dynamical systems, sequential decision making, and time-series modeling. We propose a novel grey-box approach to network simulation that embeds the semantics of physical network path in a new RNN-style model called RBU, providing the interpretability of standard network simulator tools, the power of neural models, the efficiency of SGD-based techniques for learning, and yielding promising results on synthetic and real-world network traces., Comment: Accepted in AAAI 2023, 19 pages, 14 figures

We evaluate named entity representations of BERT-based NLP models by investigating their robustness to replacements from the same typed class in the input. We highlight that on several tasks while such perturbations are natural, state of the art trained models are surprisingly brittle. The brittleness continues even with the recent entity-aware BERT models. We also try to discern the cause of this non-robustness, considering factors such as tokenization and frequency of occurrence. Then we provide a simple method that ensembles predictions from multiple replacements while jointly modeling the uncertainty of type annotations and label predictions. Experiments on three NLP tasks show that our method enhances robustness and increases accuracy on both natural and adversarial datasets., Comment: Accepted at RepL4NLP, ACL2020

This article contains a characterization of operator systems $\cS$ with the property that every positive map $\phi:\cS \rightarrow M_n$ is decomposable, as well as an alternate and a more direct proof of a characterization of decomposable maps due to E. St\o rmer., Comment: 8 Pages. NYJM

Versions of well known function theoretic operator theory results of Szego and Widom are established for the Neil algebra. The Neil algebra is the subalgebra of the algebra of bounded analytic functions on the unit disc consisting of those functions whose derivative vanishes at the origin., Comment: 11 pages, Version 3

Subsets of the set of $g$-tuples of matrices that are closed with respect to direct sums and compact in the free topology are characterized. They are, in a dilation theoretic sense, contained in the hull of a single point., Comment: 4 pages, Version 2, Corrections made in the abstract and the main theorem

In a recent work, Moslehian and Rajic have shown that the Gruss inequality holds for unital n-positive linear maps $\phi:\mathcal A \rightarrow B(H)$, where $\mathcal A$ is a unital C*-algebra and H is a Hilbert space, if $n \ge 3$. They also demonstrate that the inequality fails to hold, in general, if $n = 1$ and question whether the inequality holds if $n=2$. In this article, we provide an affirmative answer to this question., Comment: 7 Pages

The well known Douglas Lemma says that for operators $A,B$ on Hilbert space that $AA^*-BB^*\succeq 0$ implies $B=AC$ for some contraction operator $C$. The result carries over directly to classical operator-valued Toeplitz operators by simply replacing operator by Toeplitz operator. Free functions generalize the notion of free polynomials and formal power series and trace back to the work of J. Taylor in the 1970s. They are of current interest, in part because of their connections with free probability and engineering systems theory. For free functions $a$ and $b$ on a free domain $\cK$ defined free polynomial inequalities, a sufficient condition on the difference $aa^*-bb^*$ to imply the existence a free function $c$ taking contractive values on $\cK$ such that $a=bc$ is established. The connection to recent work of Agler and McCarthy and their free Toeplitz Corona Theorem is exposited., Comment: 12 Pages

We obtain an extended Reich fixed point theorem for the setting of generalized cone rectangular metric spaces without assuming the normality of the underlying cone. Our work is a generalization of the main result in \cite{AAB} and \cite{JS}., Comment: Includes corrected proofs. Not the version for publication

Let $\Rx$ denote the ring of polynomials in $g$ freely non-commuting variables $x=(x_1,...,x_g)$. There is a natural involution * on $\Rx$ determined by $x_j^*=x_j$ and $(pq)^*=q^* p^*$ and a free polynomial $p\in\Rx$ is symmetric if it is invariant under this involution. If $X=(X_1,...,X_g)$ is a $g$ tuple of symmetric $n\times n$ matrices, then the evaluation $p(X)$ is naturally defined and further $p^*(X)=p(X)^*$. In particular, if $p$ is symmetric, then $p(X)^*=p(X)$. The main result of this article says if $p$ is symmetric, $p(0)=0$ and for each $n$ and each symmetric positive definite $n\times n$ matrix $A$ the set ${X:A-p(X)\succ 0}$ is convex, then $p$ has degree at most two and is itself convex, or $-p$ is a hermitian sum of squares.

We prove a Caratheodory-Fejer type interpolation theorem for certain matrix convex sets in $\C^d$ using the Blecher-Ruan-Sinclair characterization of abstract operator algebras. Our results generalize the work of Dmitry S. Kalyuzhnyi-Verbovetzkii for the d-dimensional non-commutative polydisc., Comment: 21 pages