Neural network representations contain structure beyond what was present in
the training labels. For instance, representations of images that are visually
or semantically similar tend to lie closer to each other than to dissimilar
images, regardless of their labels. Clustering these representations can thus
provide insights into dataset properties as well as the network internals. In
this work, we study how the many design choices involved in neural network
training affect the clusters formed in the hidden representations. To do so, we
establish an evaluation setup based on the BREEDS hierarchy, for the task of
subclass clustering after training models with only superclass information. We
isolate the training dataset and architecture as important factors affecting
clusterability. Datasets with labeled classes consisting of unrelated
subclasses yield much better clusterability than those following a natural
hierarchy. When using pretrained models to cluster representations on
downstream datasets, models pretrained on subclass labels provide better
clusterability than models pretrained on superclass labels, but only when there
is a high degree of domain overlap between the pretraining and downstream data.
Architecturally, we find that normalization strategies affect which layers
yield the best clustering performance, and, surprisingly, Vision Transformers
attain lower subclass clusterability than ResNets.

研究探讨神经网络训练中的设计选择如何影响隐藏表示中形成的聚类，发现数据集的属性以及网络内部结构对聚类性能有重要影响，而使用预训练模型进行聚类时，预先训练于子类标签的模型表现出更好的聚类性能，而比较意外的是，视觉变换器的子类聚类能力比 ResNet 低。

神经网络表示中的聚类探测

Probing clustering in neural network representations

Wide adoption of artificial neural networks in various domains has led to an
increasing interest in defending adversarial attacks against them.
Preprocessing defense methods such as pixel discretization are particularly
attractive in practice due to their simplicity, low computational overhead, and
applicability to various systems. It is observed that such methods work well on
simple datasets like MNIST, but break on more complicated ones like ImageNet
under recently proposed strong white-box attacks. To understand the conditions
for success and potentials for improvement, we study the pixel discretization
defense method, including more sophisticated variants that take into account
the properties of the dataset being discretized. Our results again show poor
resistance against the strong attacks. We analyze our results in a theoretical
framework and offer strong evidence that pixel discretization is unlikely to
work on all but the simplest of the datasets. Furthermore, our arguments
present insights why some other preprocessing defenses may be insecure.

本文探讨像素离散化这种预处理防御方法在对抗攻击下的表现。通过实验，得出此方法只适用于简单数据集而在更复杂的数据集像 ImageNet 上的效果不佳，并分析了其原因及其他预处理防御方法的不足。

探究像素离散化对抗攻击的局限性

Towards Understanding Limitations of Pixel Discretization Against  Adversarial Attacks

We aim to study the modeling limitations of the commonly employed boosted
decision trees classifier. Inspired by the success of large, data-hungry visual
recognition models (e.g. deep convolutional neural networks), this paper
focuses on the relationship between modeling capacity of the weak learners,
dataset size, and dataset properties. A set of novel experiments on the Caltech
Pedestrian Detection benchmark results in the best known performance among
non-CNN techniques while operating at fast run-time speed. Furthermore, the
performance is on par with deep architectures (9.71% log-average miss rate),
while using only HOG+LUV channels as features. The conclusions from this study
are shown to generalize over different object detection domains as demonstrated
on the FDDB face detection benchmark (93.37% accuracy). Despite the impressive
performance, this study reveals the limited modeling capacity of the common
boosted trees model, motivating a need for architectural changes in order to
compete with multi-level and very deep architectures.

该研究旨在研究现有的提升决策树分类器的建模局限性，通过实验发现，恰当的数据集大小和属性可以将模型模拟得更好，但模型有其局限性，需要进行架构改变来与深度架构竞争。