Examples are five RAP-150 benchmark cases reproduced from their exact prompts

- examples/<case>/: paper.pdf, our poster (PNG + self-contained HTML), prompt.json (exact test prompt),
thumbnails/ and full-resolution assets/; meta.json carries the exact instruction, layout spec and canvas size
- picking a card fills PDF, instruction, spec and canvas; Generate feeds the stored prompt verbatim when the PDF,
instruction and spec are unchanged (matched by PDF hash), otherwise the regular parser runs
- canvas accepts exact WxH sizes; replaced NExT-GPT / ConforMix with Deep Ensembles (ICML 2025) and Theory of Mind (ICLR 2023)

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

.gitattributes

@@ -1,3 +1,4 @@
 *.zip filter=lfs diff=lfs merge=lfs -text
 *.pdf filter=lfs diff=lfs merge=lfs -text
 *.png filter=lfs diff=lfs merge=lfs -text
+*.jpg filter=lfs diff=lfs merge=lfs -text

README.md

@@ -25,7 +25,10 @@ and writes the poster as standalone HTML; the Space renders it to PNG.
   to finish a poster. The demo asks for a 10-minute GPU step first and falls back to shorter steps.
 - API: call `/analyze` once (PDF + settings), then `/step` repeatedly until the status starts with
   `Done`, `Paused` or `Stopped`; each step is its own request so the ZeroGPU token stays valid.
-- The examples on the page were generated by the same checkpoint with the default instruction and settings.
+- The example cards are five cases of the RAP-150 benchmark. Picking one loads the paper, the exact instruction and
+  layout specification used in the paper's evaluation and the canvas size of the reference poster; **Generate poster**
+  then runs the model on the very prompt we evaluated, so the result should match the shown poster. Editing any field
+  switches back to the regular pipeline (your PDF is parsed and a layout specification is derived automatically).
 - Research demo: scanned PDFs are not supported, uploads are temporary, and every statement,
   number and caption should be checked before a poster is used.
 

demo_ui.py

@@ -35,22 +35,65 @@ footer {display: none !important;}
 '''
 
 def load_examples():
-    """examples/<name>/meta.json + paper.pdf + poster.png (+ poster.html, poster_bundle.zip)."""
+    """examples/<name>/: meta.json, paper.pdf, poster.png, poster.html, prompt.json (the exact benchmark prompt),
+    thumbnails/ (what the model sees) and assets/ (full-resolution crops for rendering)."""
+    import hashlib
     out = []
     for d in sorted((ROOT / 'examples').glob('*/')):
         meta = d / 'meta.json'
         if not meta.exists() or not (d / 'poster.png').exists() or not (d / 'paper.pdf').exists():
             continue
         m = json.loads(meta.read_text(encoding='utf-8'))
-        out.append({'dir': d, 'title': m.get('title', d.name), 'short': m.get('short', m.get('title', d.name))[:40], 'venue': m.get('venue', ''), 'instruction': m.get('instruction', DEFAULT_INSTRUCTION),
-                    'canvas': m.get('canvas', 'Landscape · 3:2'), 'columns': m.get('columns', 3), 'accent': m.get('accent', '#584287')})
+        out.append({'dir': d, 'title': m.get('title', d.name), 'short': m.get('short', m.get('title', d.name))[:40], 'venue': m.get('venue', ''),
+                    'paper_id': m.get('paper_id', d.name), 'instruction': m.get('instruction', DEFAULT_INSTRUCTION), 'spec': m.get('spec', ''),
+                    'canvas': m.get('canvas', 'Landscape · 3:2'), 'columns': m.get('columns', 3), 'accent': m.get('accent', '#584287'),
+                    'prompt': d / 'prompt.json' if (d / 'prompt.json').exists() else None,
+                    'pdf_sha': hashlib.sha256((d / 'paper.pdf').read_bytes()).hexdigest()})
     return out
 
 def fileout(path):
     return gr.update(value=str(path), visible=True) if path else gr.update(value=None, visible=False)
 
 def build(model, processor):
+    def match_example(pdf, instruction, custom_spec):
+        """The exact benchmark prompt is used when the PDF is one of the examples and instruction + spec are unchanged."""
+        import hashlib
+        try:
+            sha = hashlib.sha256(Path(pdf).read_bytes()).hexdigest()
+        except OSError:
+            return None
+        for ex in examples:
+            if ex['prompt'] and ex['pdf_sha'] == sha and instruction.strip() == ex['instruction'].strip() and custom_spec.strip() == ex['spec'].strip():
+                return ex
+        return None
+
+    def analyze_example(ex):
+        """Reproduce a benchmark case: the stored prompt (paper text, asset list, thumbnails, instruction, layout spec)."""
+        d = ex['dir']; pr = json.loads((d / 'prompt.json').read_text(encoding='utf-8'))
+        system, user = pr['messages'][0]['content'], pr['messages'][1]['content']
+        parts = user.split('<image>'); images = [str(d / im) for im in pr['images']]
+        content = []
+        for k, text in enumerate(parts):
+            if text: content.append({'type': 'text', 'text': text})
+            if k < len(images): content.append({'type': 'image', 'image': images[k]})
+        messages = [{'role': 'system', 'content': [{'type': 'text', 'text': system}]}, {'role': 'user', 'content': content}]
+        assets = []
+        for im in pr['images']:
+            aid = Path(im).stem; f = d / 'assets' / f'{aid}.png'
+            kind = aid.rsplit('_', 1)[0]
+            assets.append({'id': aid, 'kind': kind, 'file': str(f if f.exists() else d / im), 'thumb': str(d / im), 'page': None})
+        w, h = (int(v) for v in re.match(r'(\d+)x(\d+)', ex['canvas']).groups()) if re.match(r'\d+x\d+', ex['canvas']) else CANVASES.get(ex['canvas'], (2400, 1600))
+        job = Path(tempfile.mkdtemp(prefix='example_', dir=ARTIFACTS))
+        return {'title': ex['title'], 'authors': '', 'assets': assets, 'instruction': ex['instruction'], 'spec': ex['spec'], 'canvas': [w, h],
+                'messages_pre': messages, 'job': str(job), 'example': ex['paper_id'], 'sections': [], 'body': ''}
+
     def analyze(pdf, instruction, canvas, accent, columns, custom_spec):
+        ex = match_example(pdf, instruction, custom_spec)
+        if ex is not None:
+            p = analyze_example(ex)
+            inputs = processor.apply_chat_template(chat(p), tokenize=True, add_generation_prompt=True, enable_thinking=False, return_dict=True, return_tensors='pt')
+            p['input_tokens'] = int(inputs['input_ids'].shape[1]); p['continuation_ids'] = []; p['raw'] = ''; p['done'] = False
+            return p
         job = Path(tempfile.mkdtemp(prefix='paper_', dir=ARTIFACTS))
         p = prepare(pdf, job, instruction, canvas, accent, columns, custom_spec)
         budget = 22000
@@ -103,7 +146,7 @@ def build(model, processor):
     HIDE = gr.update(value=None, visible=False)
 
     def gallery_of(p):
-        return [(a['thumb'], f"{a['id']} · page {a['page']}") for a in p['assets']]
+        return [(a['thumb'], f"{a['id']} · page {a['page']}" if a.get('page') else a['id']) for a in p['assets']]
 
     def analyze_evt(pdf, instruction, canvas, accent, columns, custom_spec, progress=gr.Progress()):
         """Request 1 of a run: parse the PDF on CPU. GPU steps run in their own requests (see step)."""
@@ -115,7 +158,9 @@ def build(model, processor):
         except (ValueError, RuntimeError) as e:
             raise gr.Error(str(e)) from None
         p = dict(p, step=0, paused=False)
-        return (p, f"Parsed **{p['title'][:90]}** · {len(p['assets'])} figures/tables found · generating (step 1)…",
+        head = (f"Benchmark case **{p['title'][:80]}** · exact test prompt, {len(p['assets'])} figures/tables" if p.get('example')
+                else f"Parsed **{p['title'][:90]}** · {len(p['assets'])} figures/tables found")
+        return (p, f"{head} · generating (step 1)…",
                 None, HIDE, HIDE, gallery_of(p), p['spec'], '', gr.update(visible=False))
 
     def step(p, progress=gr.Progress()):
@@ -166,8 +211,8 @@ def build(model, processor):
     def pick_example(evt: gr.SelectData):
         ex = examples[evt.index]; d = ex['dir']
         html = d / 'poster.html'; archive = d / 'poster_bundle.zip'
-        return (str(d / 'paper.pdf'), ex['instruction'], ex['canvas'], ex['accent'], ex['columns'],
-                f"Example · {ex['title']}" + (f" ({ex['venue']})" if ex['venue'] else ''),
+        return (str(d / 'paper.pdf'), ex['instruction'], ex['canvas'], ex['accent'], ex['columns'], ex['spec'],
+                f"Benchmark case · {ex['title']}" + (f" ({ex['venue']})" if ex['venue'] else '') + ' · click **Generate poster** to reproduce it',
                 str(d / 'poster.png'), fileout(html if html.exists() else None), fileout(archive if archive.exists() else None))
 
     with gr.Blocks(title='RAP · Paper to Poster', css=CSS, delete_cache=(3600, 86400),
@@ -182,11 +227,11 @@ def build(model, processor):
                 pdf = gr.File(label='Paper PDF', file_types=['.pdf'], type='filepath', height=110)
                 instruction = gr.Textbox(label='Instruction', value=DEFAULT_INSTRUCTION, lines=3)
                 with gr.Row():
-                    canvas = gr.Dropdown(list(CANVASES), value='Landscape · 3:2', label='Canvas', scale=2)
+                    canvas = gr.Dropdown(list(CANVASES), value='Landscape · 3:2', label='Canvas (preset or WxH)', allow_custom_value=True, scale=2)
                     columns = gr.Slider(1, 4, value=3, step=1, label='Columns', scale=2)
                     accent = gr.ColorPicker(value='#584287', label='Accent', scale=1)
                 with gr.Accordion('Custom layout specification (optional)', open=False):
-                    custom_spec = gr.Textbox(show_label=False, placeholder='Leave empty to let the demo plan the layout.', lines=4)
+                    custom_spec = gr.Textbox(show_label=False, placeholder='Leave empty to let the demo plan the layout. Benchmark cases fill in their exact layout specification here.', lines=4)
                 run_btn = gr.Button('Generate poster', variant='primary', size='lg')
                 cont_btn = gr.Button('Continue generation', variant='secondary', visible=False)
                 gr.Markdown('<small>Generation runs in ZeroGPU steps of up to 120 s; a full poster usually takes 3–6 steps. '
@@ -221,5 +266,5 @@ def build(model, processor):
         for _ in range(MAX_STEPS):
             ev = ev.then(step, [state], outs, api_name=False, concurrency_limit=1)
         if examples:
-            ex_gallery.select(pick_example, None, [pdf, instruction, canvas, accent, columns, status, poster, html_download, bundle], api_name=False)
+            ex_gallery.select(pick_example, None, [pdf, instruction, canvas, accent, columns, custom_spec, status, poster, html_download, bundle], api_name=False)
     return demo, ARTIFACTS

examples/01_iclr_2023_11250/meta.json

@@ -1,10 +1,11 @@
 {
- "title": "MAESTRO: Open-Ended Environment Design for Multi-Agent Reinforcement Learning",
+ "title": "MAESTRO: OPEN-ENDED ENVIRONMENT DESIGN FOR MULTI-AGENT REINFORCEMENT LEARNING",
  "short": "MAESTRO · ICLR 2023",
  "venue": "ICLR 2023",
  "paper_id": "ICLR_2023_11250",
- "instruction": "Create a clear academic poster with a strong title, a short motivation, the main method, key quantitative results, and takeaways. Prioritize the most informative figures. Use concise text, readable fonts, and generous spacing. Do not invent results.",
- "canvas": "Landscape · 3:2",
+ "instruction": "Design spec: canvas 2500x1666px; visuals should dominate and accent colour #FFD700.",
+ "spec": "Canvas 2500x1666 landscape, 3 columns (21% | 54% | 21%), balanced (31 blocks). Header band (30% tall): title 84px #FFFFFF, authors line, 2 logo slots. Column 1: [top 26%; 1 text; h 4%] -> Goal - Provide a sequence of levels and co-players to (top 31%; 3 text; h 24%) -> Why this matters? (top 55%; 2 text; h 40%) -> MAESTRO (top 63%; 4 text; h 27%). Column 2: [top 28%; figure_1 (w 84%); h 31%] -> Emerging Complexity in LaserTag and Multi-Car Racing (top 61%; figure_2 (full column) -> 1 figure slot, 1 logo slot; boxed; h 38%). Column 3: Evaluation Against Specialist Agents (top 33%; figure_5 (full column); h 9%) -> Emergent Curriculum Analysis (top 45%; figure_6 (full column) -> 2 text -> figure_7 (w 89%) -> 1 text; h 42%). Figures used: figure_3, figure_1, figure_5, figure_6, figure_2, figure_7. Style: #1A1A2E background, Helvetica Neue, headers #FFFFFF 24px, body 19px; 1 panels: rgba(255,255,255,0.3) x1 (rule).",
+ "canvas": "2500x1666",
  "columns": 3,
  "accent": "#584287"
 }

examples/01_iclr_2023_11250/prompt.json

@@ -0,0 +1 @@
+{"messages": [{"role": "system", "content": "You are an expert academic poster designer. Given a paper and a design instruction, produce the poster as a standalone HTML document: a <style> block, then a fixed-size <div id=\"canvas\"> containing optional decorative <div class=\"deco\"> panels followed by absolutely positioned <div class=\"block\"> elements (text-like or image-like) in reading order, each with explicit left/top/width/height in px. Place a figure with <img src=\"ASSET_ID\"/> using exactly the asset ids offered; never invent ids."}, {"role": "user", "content": "<paper>\ntitle: MAESTRO: OPEN-ENDED ENVIRONMENT DESIGN FOR MULTI-AGENT REINFORCEMENT LEARNING\nvenue: ICLR 2023\nauthors: Mikayel Samvelyan Akbir Khan Michael Dennis Minqi Jiang Jack Parker-Holder Jakob Foerster Roberta Raileanu Tim Rocktäschel; Meta AI University College London UC Berkeley University of Oxford\nbody:\n## [introduction] 1 INTRODUCTION\n\nThe past few years have seen a series of remarkable achievements in producing deep reinforcement learning (RL) agents with expert (Vinyals et al., 2019; Berner et al., 2019; Wurman et al., 2022) and superhuman (Silver et al., 2016; Schrittwieser et al., 2020) performance in challenging competitive games. Central to these successes are adversarial training processes that result in curricula creating new challenges at the frontier of an agent’s capabilities (Leibo et al., 2019; Yang et al., 2021). Such automatic curricula, or autocurricula, can improve the sample efficiency and generality of trained policies (Open Ended Learning Team et al., 2021), as well as induce an open-ended learning process (Balduzzi et al., 2019; Stanley et al., 2017) that continues to endlessly robustify an agent.\n\nAutocurricula have been effective in multi-agent RL for adapting to different co-players in competitive games (Leibo et al., 2019; Garnelo et al., 2021; Baker et al., 2019; Bansal et al., 2018; Feng et al., 2021), where it is crucial to play against increasingly stronger opponents (Silver et al., 2018) and avoid being exploited by other agents (Vinyals et al., 2019). Here, algorithms such as self-play (Silver et al., 2018; Tesauro, 1995) and fictitious self-play (Brown, 1951; Heinrich et al., 2015) have proven especially effective. Similarly, in single-agent RL, autocurricula methods based on Unsupervised Environment Design (UED, Dennis et al., 2020) have proven effective in producing agents robust to a wide distribution of environments (Wang et al., 2019; 2020; Jiang et al., 2021a; Parker-Holder et al., 2022). UED seeks to adapt distributions over environments to maximise some metrics of interest. Minimax-regret UED seeks to maximise the regret of the learning agent, viewing this process as a game between a teacher that proposes challenging environments and a student that learns to solve them. At a Nash equilibrium of such games, the student policy provably reaches a minimax-regret policy over the set of possible environments, thereby providing a strong robustness guarantee.\n\nHowever, prior works in UED focus on single-agent RL and do not address the dependency between the environment and the strategies of other agents within it. In multi-agent domains, the behaviour of other agents plays a critical role in modulating the complexity and diversity of the challenges faced by a learning agent. For example, an empty environment that has no blocks to hide behind might be most\n\nchallenging when playing against opponent policies that attack head-on, whereas environments that are full of winding hallways might be difficult when playing against defensive policies. Robust RL agents should be expected to interact successfully with a wide assortment of other rational agents in their environment (Yang et al., 2021; Mahajan et al., 2022). Therefore, to become widely applicable, UED must be extended to include multi-agent dynamics as part of the environment design process.\n\nWe formalise this novel problem as an Underspecified Partially-Observable Stochastic Game (UP- OSG), which generalises UED to multi-agent settings. We then introduce Multi-Agent Environment Design Strategist for Open-Ended Learning (MAESTRO), the first approach to train generally capable agents in two-player UPOSGs such that they are robust to changes in the environment and co-player policies. MAESTRO is a replay-guided approach that explicitly considers the dependence between agents and environments by jointly sampling over environment/co-player pairs using a regret-based curriculum and population learning (see Figure 1). In partially observable two-player zero-sum games, we show that at equilibrium, the MAESTRO student policy reaches a Bayes-Nash Equilibrium with respect to a regret-maximising distribution over environments. Furthermore, in fully observable settings, it attains a Nash-Equilibrium policy in every environment against every rational agent.\n\nWe assess the curricula induced by MAESTRO and a variety of strong baselines in two competitive two-player games, namely a sparse-reward grid-based LaserTag environment with discrete actions (Lanctot et al., 2017) and a dense-reward pixel-based MultiCarRacing environment with continuous actions (Schwarting et al., 2021). In both cases, MAESTRO produces more robust agents than baseline autocurriculum methods on out-of-distribution (OOD) human-designed environment instances against unseen co-players. Furthermore, we show that MAESTRO agents, trained only on randomised environments and having never seen the target task, can significantly outperform specialist agents trained directly on the target environment. Moreover, in analysing how the student’s regret varies across environments and co-players, we find that a joint curriculum, as produced by MAESTRO, is indeed required for finding the highest regret levels, as necessitated by UED.\n\nIn summary, we make the following core contributions: (i) we provide the first formalism for multiagent learning in underspecified environments, (ii) we introduce MAESTRO, a novel approach to jointly learn autocurricula over environment/co-player pairs, implicitly modelling their dependence, (iii) we prove MAESTRO inherits the theoretical property from the single-agent setting of implementing a minimax-regret policy at equilibrium, which corresponds to a Bayesian Nash or Nash equilibrium in certain settings, and (iv) by rigorously analysing the curriculum induced by MAESTRO and evaluating MAESTRO agents against strong baselines, we empirically demonstrate the importance of the joint curriculum over the environments and co-players.\n\n## [background] 2 PROBLEM STATEMENT AND PRELIMINARIES\n\nIn single-agent domains, the problem of Unsupervised Environment Design (UED) is cast in the framework of an underspecified POMDP (Dennis et al., 2020), which explicitly augments a standard POMDP with a set of free parameters controlling aspects of the environment subject to the design process. We extend this formalism to the multi-agent setting using stochastic games (Shapley, 1953). […]\n\n### 2.1 UED APPROACHES IN SINGLE-AGENT RL\n\nA curriculum over the environment parameters θ can arise from a teacher maximising a utility function Ut(π, θ) based on the student’s policy π. The most naive form of UED is domain randomisation (DR, Jakobi, 1997; Sadeghi & Levine, 2017), whereby environments are sampled uniformly at random, corresponding to a constant utility U U t (π, θ) = C. […]\n\n### 2.2 CO-PLAYER AUTOCURRICULA IN COMPETITIVE MULTI-AGENT RL\n\n2.2 CO-PLAYER AUTOCURRICULA IN COMPETITIVE MULTI-AGENT RL\n\nThe choice of co-players plays a crucial role for training agents in multi-agent domains (Leibo et al., 2019). A simple but effective approach is self-play (SP, Silver et al., 2018), whereby the agent always plays with copies of itself. In competitive two-player games, SP produces a curriculum in which opponents match each other in skill level. […]\n\n## [method] 3 METHOD\n\n### 3.1 AN ILLUSTRATIVE EXAMPLE\n\nTo highlight the importance of curricula over the joint space of environments and co-players, we provide an illustrative example of a simple two-player game in Table 1. Here, the goal of the regret-maximising teacher is to select an environment/co-player pair for the student. Ignoring the co-player and selecting the highest regret environment leads to choosing θ3. Similarly, ignoring environments and selecting the highest regret co-player leads to πC. This yields a suboptimal pair (θ3, πC) with REGRET(θ3, πC) = 0.4, whereas a teacher over the joint space yields the optimal pair (θ1, πA) with\n\nTable 1: An illustrative two-player game. Rows correspond to co-player policies and Π = {πA, πB, πC}. Columns indicate different environments and Θ = {θ1, θ2, θ3, θ4}. The payoff matrix represents the regret of the student on pair (θ, π).\n\nj p y p p ( 1, A) REGRET(θ1, πA) = 0.6. Thus, naively treating the environment and co-player as independent can yield a sub-optimal curriculum. Such overspecialisation toward a subset of environmental challenges at the expense of overall robustness commonly emerges in multi-agent settings (Garnelo et al., 2021).\n\n3.2 MULTI-AGENT ENVIRONMENT DESIGN STRATEGIST FOR OPEN-ENDED LEARNING\n\nIn this section, we describe a new multiagent UED approach called Multi-Agent Environment Design Strategist for Open- Ended Learning (MAESTRO) which induces a regret-based autocurricula jointly over environments and co-players.\n\nMAESTRO is a replay-guided approach (Jiang et al., 2021a) that relies on an environment generator to continuously create new environment instances. Rather than storing a single environment buffer, as done by PLR, MAESTRO maintains a population of policies B with each policy assigned its own environment buffer. In each environment θ produced by the generator, MAESTRO evaluates the student’s performance against a non-uniform mixture of co-player policies in B. High-regret environment/co-player pairs are\n\ng p y p then stored, along with the student agent’s regret estimate for that pair, in the corresponding co-player’s environment buffer.\n\nMAESTRO maintains a dynamic population of co-players of various skill levels throughout training (Czarnecki et al., 2020). Figure 1 presents the overall training paradigm of MAESTRO and Algorithm 1 provides its pseudocode. We note that when applied to a fixed singleton environment, MAESTRO becomes a variation of PFSP (Vinyals et al., 2019), where the mixture of policies from the population is computed based on the agent’s regret estimate, rather than the probability of winning.\n\n#### 3.2.1 MAINTAINING A POPULATION OF CO-PLAYERS\n\nA key issue of using replay-guided autocurricula for multi-agent settings is nonstationarity. Specifically, using PLR with SP results in inaccurate regret estimates over environment/co-player pairs, as the co-player policies evolve over training. MAESTRO overcomes this issue by maintaining a population of past policies (Lanctot et al., 2017). This approach confers several key benefits. First, re-encountering past agents helps avoid cycles in strategy space (Balduzzi et al., 2019; Garnelo et al., 2021). Second, MAESTRO maintains accurate regret estimates in the face of nonstationarity by employing a separate environment buffer for each policy in the population. Third, MAESTRO always optimises a single policy throughout training, rather than a set of distinct policies which can be computationally expensive.\n\n#### 3.2.2 CURATING THE ENVIRONMENT/CO-PLAYER PAIRS\n\nTo optimise for the global regret over the joint environment/co-player space, a MAESTRO student is trained to best respond to a non-uniform mixture of policies from a population by prioritising training against co-players with high-regret environments in their buffers:\n\nwhere B is the co-player population, Λ(π′) is the environment buffer of agent π′, and ^ Regret is the estimated regret of student for the pair (θ, π′). To ensure that the student learns to best respond to high-regret co-players as well as to the entire population B, we enforce all members of B to be assigned a minimum probability λ N . For instance, if Equation (1) returns a single highest-regret co-player, then the resulting prioritised distribution assigns a weight of N−λ(N−1) N to the highest-regret co-player and weight of λ N to the remaining co-players. For each co-player π′ ∈B, MAESTRO maintains a PLR environment buffer Λ(π′) with the top-K high-regret levels. Once the co-player is sampled, we make a replay decision: with probability p, we use a bandit to sample a training environment from Λ(π′),2 and with probability 1 −p, we sample a new environment for evaluation from the environment generator. Similar to Robust PLR (Jiang et al., 2021a), we only update the student policy on environments sampled from the environment buffer. This provides MAESTRO with strong robustness guarantees, which we discuss in Section 3.3.\n\n### 3.3 ROBUSTNESS GUARANTEES OF MAESTRO\n\nWe analyse the expected behaviour of MAESTRO if the system reaches equilibrium: does MAESTRO produce a regret-maximising distribution over environments and co-players and is the policy optimal with respect to these distributions? We cast this problem in terms of Bayesian Nash equilibrium (BNE) behaviour in individual environments. BNE is an extension of Nash equilibrium (NE) where each co-player j has an unknown type parameter θj, which affects the dynamics of the game and is only known to that player. The distribution over these parameters ˜ΘN is assumed to be common knowledge. Equilibria are then defined as the set of policies, conditioned on their unknown type, each being a best response to the policies of the other players. That is, for policy πj of any player j,\n\nIn MAESTRO, we can assume each co-player is effectively omniscient, as each is co-evolved for maximal performance against the student in the environments it is paired with in its high-regret environment buffer. In contrast, the student has conferred no special advantages and has access to only the standard observations. We formalise this setting as a −i-knowing game. This game corresponds to the POSG with the same set of players, action space, rewards, and states as the original UPOSG, but with θ sampled at the first time step and provided to co-players −i as part of their observation.\n\nDefinition 1. The -i-knowing-game of an UPOSG M = ⟨n, A, O = ×i∈NOi, Θ, S, T , I = ×i∈NIi, R = ×i∈NRi, γ⟩with parameter distribution ˜θ is defined to be the POSG K = ⟨n′ = n, A′ = A, O′ i = Oi + {Θ if i ∈−i}, S′ = S, T ′ = T (θ), I′ i = Ii + {θ if ∈−i}, R′ i = Ri, γ⟩ where θ is sampled from the distribution ˜θ on the first time step.\n\nWe thus arrive at our main theorem, followed by a convenient and natural corollary for fully observable settings. We include the full proofs in Appendix A.\n\nTheorem 1. In two-player zero-sum settings, the MAESTRO student at equilibrium implements a Bayesian Nash equilibrium of the −i-knowing game, over a regret-maximising distribution of levels.\n\nCorollary 1. In fully-observable two-player zero-sum settings, the MAESTRO student at equilibrium implements a Nash equilibrium in each environment in the support of the environment distribution.\n\nInformally, the proof of the Corollary 1 follows from the observation that the −i-knowing game in a fully observable setting is equivalent to the original distribution of environments, as there is no longer an information asymmetry between the student and co-players. Moreover, the NE strategy on this distribution of environment instances would be a NE strategy on each instance individually, given that they are fully observable. This argument is formalised in Appendix A.\n\n## [experiments] 4 EXPERIMENTAL SETTING\n\nOur experiments aim to understand (1) the interaction between autocurricula over environments and co-players in multi-agent UED, (2) its impact on zero-shot transfer performance of student policies to unseen environments and co-players, and (3) the emergent complexity of the environments provided to the student agent under autocurricula. To this end, we evaluate methods in two distinct domains: discrete control with sparse rewards, and continuous control with dense rewards. We assess student robustness in OOD human-designed environments against previously unseen opponents. Given its strong performance and usage in related works, PPO (Schulman et al., 2017) serves as the base RL algorithm in our experiments. We provide full environment descriptions in Appendix B and detail our model architecture and hyperparameter choices in Appendix C.\n\nBaselines and Ablations We compare MAESTRO against two key baselines methods producing autocurricula over environments: domain randomization (DR; Jakobi, 1997), and (Robust) PLR (Jiang et al., 2021a), a state-of-the-art UED baseline. For co-player curricula, we consider SP, FSP, and PFSP, popular methods that underlie breakthroughs such as AlphaGo (Silver et al., 2016) and AlphaStar (Vinyals et al., 2019). Since these baselines independently produce curricula either over environments or over co-players, our choice of baselines results in a combination of 6 joint curriculum baselines over the environment/co-player space. We present further ablations investigating the importance of MAESTRO’s co-player selection mechanism in Appendix D.\n\n### 4.1 ENVIRONMENTS\n\nLaserTag is a grid-based, two-player zero-sum game proposed by Lanctot et al. (2017) where agents aim to tag each other with laser beams. Success in LaserTag requires agents to master sophisticated behaviours, including chasing opponents, hiding behind walls, keeping clear of long corridors, and maze-solving. Each agent observes the 5 × 5 grid area in front of it and can turn right or left, move forward, and shoot. Upon tagging an opponent, the agent and the opponent receive a reward of 1 and −1, respectively, and the episode terminates. LaserTag training environments are generated by randomly sampling grid size, wall locations, and the initial locations and directions of agents.\n\nMultiCarRacing (MCR, Schwarting et al., 2021) is a high-dimensional, pixel-based continuous control environment with dense rewards. Two agents compete by driving a full lap around the track. Each track consists of n tiles. Agents receive a reward of 1000/n or 500/n for reaching a tile first or second, respectively. Agents receive a top-down, egocentric 96 × 96 × 3 partial observation and can collide, push, or block each other, allowing for complex emergent behaviour and non-transitive dynamics. The action space is 3-dimensional, controlling changes in acceleration, braking, and steering. All training tracks used for training agents are generated by sampling 12 random control points defining a Bézier curve forming the track.\n\nFigure 2 shows example LaserTag and MCR environments, including human-designed OOD test environments. MCR test environments are the Formula 1 CarRacing tracks from (Jiang et al., 2021a).\n\n## [conclusion] 5 RESULTS AND DISCUSSION\n\n### 5.1 CROSS-PLAY RESULTS\n\nTo assess the robustness of the approaches, we evaluate all pairs of methods in cross-play on OOD human-designed environments (13 LaserTag levels and 21 F1 tracks for MCR). For each pair of methods, we perform cross-play between all pairs of random seeds (10 × 10 for LaserTag and 5 × 5 for MCR) on all environments. Full results are included in Appendix E.2. […]\n\n### 5.3 EVALUATION AGAINST SPECIALIST AGENTS\n\nWhile we show that MAESTRO outperforms baselines trained on a large number of environments, we are also interested in evaluating MAESTRO against specialist agents trained only on single, fixed environments. […]\n\n### 5.4 EMERGENT CURRICULUM ANALYSIS\n\nWe analyse the curriculum over environments induced by MAESTRO and compare it with the curricula generated by the baselines. Figure 7 demonstrates that, as training progresses, MAESTRO provides agents with LaserTag environments with an increasing density of walls, which contributes to a gradual increase in environment complexity. […]\n\n## [conclusion] 7 CONCLUSION AND FUTURE WORK\n\nIn this paper, we provided the first formalism for multi-agent learning in underspecified environments. We introduced MAESTRO, an approach for producing an autocurriculum over the joint space of environments and co-players. Moreover, we proved that MAESTRO attains minimax-regret robustness guarantees at Nash equilibrium. Empirically MAESTRO produces agents that are more robust to the environment and co-player variations than a number of strong baselines in two challenging domains. MAESTRO agents even outperform specialist agents in these domains. Our work opens up many interesting directions for future work. MAESTRO could be extended to n-player games, as well as cooperative and mixed settings. Furthermore, MAESTRO could be combined with search-based methods in order to further improve sample efficiency and generalisation. […]\n</paper>\n\n<assets>\n  figure_1 (figure, aspect 2.3, page 2, in section \"1 INTRODUCTION\" [introduction]) - Figure 1: A diagram of MAESTRO. MAESTRO maintains a population of co-players, each having an individual buffer of high-regret environments. When new environments are sampled, the student’s regret is calculated with respect to the corresponding co-player and added to the co-player’s buffer. MAESTRO…\n  figure_2 (figure, aspect 3.75, page 3, in section \"4 EXPERIMENTAL SETTING\" [experiments]) - Figure 2: Emergent complexity of autocurricula induced by MAESTRO. Examples of partially observable environments provided to the MAESTRO student agent at the (a) start, (b) middle, and (c) end of training. Levels become more complex over time. LaserTag levels (top row) increase in wall density and…\n  figure_3 (figure, aspect 3.62, page 7, in section \"5 RESULTS AND DISCUSSION\" [conclusion]) - Figure 4: MultiCarRacing Cross-Play Results. (Left) RR returns (Middle) Cross-play win rate and (Right) grass time between MAESTRO and baselines (mean and standard error over 5 seeds).\n  figure_4 (figure, aspect 3.62, page 7, in section \"5 RESULTS AND DISCUSSION\" [conclusion]) - Figure 3: LaserTag Cross-Play Results. (Left) normalised and (Middle) unnormalised RR returns during training. (Right) RR returns at the end of training (mean and standard error over 10 seeds).\n  figure_5 (figure, aspect 4.86, page 8, in section \"5 RESULTS AND DISCUSSION\" [conclusion]) - Figure 6: Cross-Play vs Specialists. Evaluation against specialist agents trained directly on the target task. We use different specialist agents for each fixed environment. Shown are averaged metrics across 4 target LaserTag levels and 3 Formula 1 tracks. Full results on individual environments are…\n  figure_6 (figure, aspect 3.88, page 8, in section \"5 RESULTS AND DISCUSSION\" [conclusion]) - Figure 7: Characteristics of emergent autocurricula in LaserTag and MultiCarRacing.\n  figure_7 (figure, aspect 3.62, page 8, in section \"5 RESULTS AND DISCUSSION\" [conclusion]) - Figure 5: Regret landscapes on LaserTag and MultiCarRacing. Shown are regret estimates of the student on 16 random environment (columns) against each policy from MAESTRO’s co-player population (rows). Highlighted in red are the regret estimates of the co-player and environment with the highest mean…\n  table_1 (table, aspect 1.1, page 4, in section \"3 METHOD\" [method]) - Table 1: An illustrative two-player game. Rows correspond to co-player policies and Π = { π A , π B , π C } . Columns indicate different environments and Θ = { θ 1 , θ 2 , θ 3 , θ 4 } . The payoff matrix represents the regret of the student on pair ( θ, π ) .\n  table_2 (table, aspect 3.2, page 4, in section \"3 METHOD\" [method]) - Table 1: An illustrative two-player game. Rows correspond to co-player policies and Π = {πA, πB, πC}. Columns indicate different environments and Θ = {θ1, θ2, θ3, θ4}. The payoff matrix represents the regret of the student on pair (θ, π).\n  formula_1 (formula, aspect 9.5, page 5, in section \"3 METHOD\" [method])\n  formula_2 (formula, aspect 10.5, page 5, in section \"3 METHOD\" [method])\n</assets>\n<image><image><image><image><image><image><image><image><image><image><image>\n\n<instruction>\nDesign spec: canvas 2500x1666px; visuals should dominate and accent colour #FFD700.\n</instruction>\n\n<layout_spec>\nCanvas 2500x1666 landscape, 3 columns (21% | 54% | 21%), balanced (31 blocks). Header band (30% tall): title 84px #FFFFFF, authors line, 2 logo slots. Column 1: [top 26%; 1 text; h 4%] -> Goal - Provide a sequence of levels and co-players to (top 31%; 3 text; h 24%) -> Why this matters? (top 55%; 2 text; h 40%) -> MAESTRO (top 63%; 4 text; h 27%). Column 2: [top 28%; figure_1 (w 84%); h 31%] -> Emerging Complexity in LaserTag and Multi-Car Racing (top 61%; figure_2 (full column) -> 1 figure slot, 1 logo slot; boxed; h 38%). Column 3: Evaluation Against Specialist Agents (top 33%; figure_5 (full column); h 9%) -> Emergent Curriculum Analysis (top 45%; figure_6 (full column) -> 2 text -> figure_7 (w 89%) -> 1 text; h 42%). Figures used: figure_3, figure_1, figure_5, figure_6, figure_2, figure_7. Style: #1A1A2E background, Helvetica Neue, headers #FFFFFF 24px, body 19px; 1 panels: rgba(255,255,255,0.3) x1 (rule).\n</layout_spec>"}], "images": ["thumbnails/figure_1.jpg", "thumbnails/figure_2.jpg", "thumbnails/figure_3.jpg", "thumbnails/figure_4.jpg", "thumbnails/figure_5.jpg", "thumbnails/figure_6.jpg", "thumbnails/figure_7.jpg", "thumbnails/table_1.jpg", "thumbnails/table_2.jpg", "thumbnails/formula_1.jpg", "thumbnails/formula_2.jpg"]}

examples/02_iclr_2022_6934/meta.json

@@ -1,10 +1,11 @@
 {
- "title": "Bayesian Framework for Gradient Leakage",
+ "title": "BAYESIAN FRAMEWORK FOR GRADIENT LEAKAGE",
  "short": "Gradient Leakage · ICLR 2022",
  "venue": "ICLR 2022",
  "paper_id": "ICLR_2022_6934",
- "instruction": "Create a clear academic poster with a strong title, a short motivation, the main method, key quantitative results, and takeaways. Prioritize the most informative figures. Use concise text, readable fonts, and generous spacing. Do not invent results.",
- "canvas": "Landscape · 3:2",
- "columns": 3,
+ "instruction": "Design spec: canvas 3840x2880px; dense, content-rich; lots of figures; #FFFFFF background; set headings in bold caps; solid square-cornered borders on the panels; a cool colour scheme; four-column layout.",
+ "spec": "Canvas 3840x2880 landscape, 4 columns (30% | 29% | 30% | 12%), balanced (42 blocks). Header band (16% tall): title 74px #ffffff on #0d1b2a band, authors line, 1 logo slot. Column 1: Problem setting (top 21%; 1 text, 3 figure slots; boxed; h 18%) -> Reconstruction attack (top 42%; figure_1 (w 71%); h 22%) -> Reconstruction attack (top 42%) -> Adversarial risk (top 67%; 1 text -> formula_5 (w 57%); h 27%). Column 2: Bayes optimal adversary as an optimization problem (top 21%; 1 text -> formula_4 (w 62%); h 25%) -> Approximating Bayes optimal adversary (top 48%; 1 text -> 1 figure slot, figure_3 (full column) -> 3 text -> table_2 (w 92%); boxed; h 48%). Column 3: Evaluating existing defenses (top 21%; 1 text -> figure_2 (w 39%) -> 1 text -> figure_3 (w 43%) -> 1 text, 2 bullets; h 53%) -> Bayes optimal adversary compared to other adversaries (top 76%; 1 text -> table_3 (full column); h 21%). Column 4: [top 29%; figure_2 (w 86%) -> figure_3 (full column) -> figure_5 (full column); h 28%]. Figures used: figure_2, formula_4, figure_1, figure_3, figure_5, formula_5, table_3, table_2. Style: #1a1a2e background, Helvetica Neue, headers #1a4a7a 43px, body 36px; 14 panels: #d6e8f7 x7, #ffffff x4 (bordered), linear-gradient(135deg, #2c5f8a, #4a90d9) x3.",
+ "canvas": "3840x2880",
+ "columns": 4,
  "accent": "#584287"
 }

examples/02_iclr_2022_6934/prompt.json

@@ -0,0 +1 @@
+{"messages": [{"role": "system", "content": "You are an expert academic poster designer. Given a paper and a design instruction, produce the poster as a standalone HTML document: a <style> block, then a fixed-size <div id=\"canvas\"> containing optional decorative <div class=\"deco\"> panels followed by absolutely positioned <div class=\"block\"> elements (text-like or image-like) in reading order, each with explicit left/top/width/height in px. Place a figure with <img src=\"ASSET_ID\"/> using exactly the asset ids offered; never invent ids."}, {"role": "user", "content": "<paper>\ntitle: BAYESIAN FRAMEWORK FOR GRADIENT LEAKAGE\nvenue: ICLR 2022\nauthors: Mislav Balunovi´c, Dimitar I. Dimitrov, Robin Staab, Martin Vechev Department of Computer Science ETH Zurich\nbody:\n## [introduction] 1 INTRODUCTION\n\nFederated learning (McMahan et al., 2017) has become a standard paradigm for enabling users to collaboratively train machine learning models. In this setting, clients compute updates on their own devices, send the updates to a central server which aggregates them and updates the global model. Because user data is not shared with the server or other users, this framework should, in principle, offer more privacy than simply uploading the data to a server. However, this privacy benefit has been increasingly questioned by recent works (Melis et al., 2019; Zhu et al., 2019; Geiping et al., 2020; Yin et al., 2021) which demonstrate the possibility of reconstructing the original input from shared gradient updates. The reconstruction works by optimizing a candidate image with respect to a loss function that measures the distance between the shared and candidate gradients. The attacks typically differ in their loss function, their regularization, and how they solve the optimization problem. Importantly, the success of these attacks raises the following key questions: (i) what is the theoretically worst-case attack?, and (ii) how do we evaluate defenses against gradient leakage?\n\nThis work In this work, we study and address these two questions from both theoretical and practical perspective. Specifically, we first introduce a theoretical framework which allows us to measure the expected risk an adversary has in reconstructing an input, given the joint probability distribution of inputs and their gradients. We then analyze the Bayes optimal adversary, which minimizes this risk and show that it solves a specific optimization problem involving the joint distribution. Further, we phrase existing attacks (Zhu et al., 2019; Geiping et al., 2020; Yin et al., 2021) as approximations of this optimal adversary, where each attack can be interpreted as implicitly making different assumptions on the distribution of gradients and inputs, in turn yielding different loss functions for the optimization. In our experimental evaluation, we compare the Bayes optimal adversary with other attacks, those which do not leverage the probability distribution of gradients, and we find that the Bayes optimal adversary performs better, as explained by the theory. […]\n\n### Main contributions Our main contributions are:\n\n• Formulation of the gradient leakage problem in a Bayesian framework which enables phrasing Bayes optimal adversary as an optimization problem. • Interpretation of several prior attacks as approximations of the Bayes optimal adversary, each using different assumptions for the distributions of inputs and their gradients. • Practical implementation of the Bayes optimal adversary for several defenses, showing higher reconstruction success than previous attacks, confirming our theoretical results. We make our code publicly available at https://github.com/eth-sri/ bayes-framework-leakage. […]\n\n## [background] 3 BACKGROUND\n\nLet X ⊆Rd be an input space, and let hθ : X →Y be a neural network with parameters θ classifying an input x to a label y in the label space Y. We assume that inputs (x, y) are coming from a distribution D with a marginal distribution p(x). In standard federated learning, there are n clients with loss functions l1, ..., ln, who are trying to jointly solve the optimization problem:\n\nTo ease notation, we will assume a single client throughout the paper, but the same reasoning can be applied to the general n-client case. Additionally, each client could have a different distribution D, but the approach is again easy to generalize to this case. In a single training step, each client i first computes ∇θli(hθ(xi), yi) on a batch of data (xi, yi), then sends these to the central server that performs a gradient descent step to obtain the new parameters θ′ = θ −α n Pn i=1 ∇θli(hθ(xi), yi), where α is a learning rate. We will consider a scenario where each client reports, instead of the true gradient ∇θli(hθ(xi), yi), a noisy gradient g sampled from a distribution p(g|x), which we call a defense mechanism. […]\n\n## [method] 4 BAYESIAN ADVERSARIAL FRAMEWORK\n\nHere we describe our theoretical framework for gradient leakage in federated learning. As we show, our problem setting captures many commonly used defenses such as DP-SGD (Abadi et al., 2016) and many attacks from prior work (Zhu et al., 2019; Geiping et al., 2020).\n\nAdversarial risk We first define the adversarial risk for gradient leakage and then derive the Bayes optimal adversary that minimizes this risk. The adversary can only observe the gradient g and tries to reconstruct the input x that produced g. Formally, the adversary is a function f : Rk →X mapping gradients to inputs. Given some (x, g) sampled from the joint distribution p(x, g), the adversary outputs the reconstruction f(g) and incurs loss L(x, f(g)), which is a function L : X × X →R. Typically, we will consider a binary loss that evaluates to 0 if the adversary’s output is close to the original input, and 1 otherwise. If the adversary wants to reconstruct the exact input x, we can define the loss to be L(x, x′) := 1x̸=x′, denoting with 1 the indicator function. If the adversary only wants to get to some δ-neighbourhood of the input x in the input space, a more appropriate definition of the loss is L(x, x′) := 1d(x,x′)>δ. In this section, we will assume that the distance d is the ℓ2-distance, but the approach can be generalized to other notions as well. This definition is well suited for image data, where ℓ2 distance captures our perception of visual closeness, and for which the adversary can often obtain a reconstruction that is very close to the original image, both visually and in the ℓ2 space. Note that if we let δ approach 0 in our second definition of the loss, we essentially recover the first loss. We can now define the risk R(f) of the adversary f as\n\nBayes optimal adversary We consider white-box adversary who knows the joint distribution p(x, g), as opposed to the weaker alternative based on security through obscurity, where adversary does not know what defense is used, and therefore does not have a good estimate of p(x, g). We also do not consider adversaries that can exploit other vulnerabilities in the system to obtain extra information. Let us consider the second definition of the loss for which L(x, f(g)) := 1||x−f(g)||2>δ.\n\nFigure 1: Example of a gradient leakage attack. Bayes optimal adversary randomly initializes image x(1) and then optimizes for the image with the highest log p(g|x) + log p(x) in its δ-neighborhood. The adversary has loss 1 if the final reconstruction is outside the ball B(xorig, δ), and 0 otherwise.\n\nWe can then rewrite the definition of the risk as follows: […]\n\n### Existing attacks as approximations of the Bayes optimal adversary\n\nof the Bayes optimal adversary We now describe how existing attacks can be viewed as different approximations of the Bayes optimal adversary. Recall that the optimal adversary f searches for the δ-ball with the maximum value for the integral of log p(g|x) + log p(x). Next we show previously proposed attacks can in fact be recovered by plugging in different approximations for log p(g|x) and log p(x) into Algorithm 1 estim\n\nand log p(x) into Algorithm 1, estimating the integral using k = 1 samples located at the center of the ball. For example, suppose that the defense mechanism adds Gaussian noise to the gradient, which corresponds to the conditional probability p(g|x) = N(∇θl(hθ(x), y), σ2I). This implies log p(g|x) = C − 1 2σ2 ||g −∇θl(hθ(x), y)||2 2, where C is a constant. Assuming a uniform prior (where log p(x) is constant), the problem in Eq. (2) simplifies to minimizing the ℓ2 distance between g and ∇θl(hθ(x), y), recovering exactly the optimization problem solved by Deep Leakage from Gradients (DLG) (Zhu et al., 2019). Inverting Gradients (Geiping et al., 2020) uses a total variation (TV) image prior for log p(x) and cosine similarity instead of ℓ2 to measure similarity between gradients. Cosine similarity corresponds to the distribution log p(g|x) = C − gT ∇θl(hθ(x),y) ||g||2||∇θl(hθ(x),y)||2 which also requires the support of the distribution to be bounded. This happens, e.g., when gradients are clipped. GradInversion (Yin et al., 2021) introduces a more complex prior based on a combination of the total variation, ℓ2 norm of the image, and a DeepInversion prior while using l2 norm to measure distance between gradients, which corresponds to Gaussian noise, as observed before. Note that we can work with unnormalized densities, as multiplying by the normalization constant does not change the argmax in Eq. (2). We summarize these observations in Table 1, showing the respective conditional and prior probabilities for each of the discussed attacks.\n\nIn this section we provide practical attacks against three recent defenses, showing they are not able to withstand stronger adversaries early in training. While in Section 4 we have shown that Bayes optimal adversary is the optimal attack for any defense (each with different p(g|x)), we now show how practical approximations of this attack can be used to attack existing defenses (more details in Appendix A.5). In Section 6 we show experimental results obtained using our attacks, demonstrating the need to evaluate defenses against closest possible approximation to the optimal attack.\n\nSoteria The Soteria defense (Sun et al., 2021) perturbs the intermediate representation of the input at a chosen defended layer l of the attacked neural network H : Rn0 →RnL with L layers of size n1, . . . , nL and input size n0. Let X and X′ ∈Rn0 denote the original and reconstructed images on H and hi,j : Rni →Rnj denote the function between the input of the ith layer of H and the output of the jth. For the chosen layer l, Sun et al. (2021) denotes the inputs to that layer for the images X and X′ with r = h0,l−1(X) and r′ = h0,l−1(X′), respectively, and aims to solve\n\nIntuitively, Eq. (4) is searching for a minimal perturbation of the input to layer l that results in maximal perturbation of the respective reconstructed input X′. Despite the optimization being over the intermediate representation r′, for an attacker who observes neither r nor r′ the defense amounts to a perturbed gradient at layer l. In particular let ∇W = {∇W1, ∇W2, . . . ∇WL} be the set of gradients for the variables in the different layers of H. Sun et al. (2021) first solves Eq. (4) to obtain r′. […]\n\n## [experiments] 6 EXPERIMENTAL EVALUATION\n\nWe now evaluate existing defenses against strong approximations of the Bayes optimal adversary.\n\nEvaluating existing defenses In this experiment, we evaluate the three recently proposed defenses described in Section 5, Soteria, ATS and PRECODE, on the CIFAR-10 dataset (Krizhevsky, 2009). For ATS and Soteria, we use the code from their respective papers. In particular, we evaluated ATS on their ConvNet implementation, a network with 7 convolutional layers, batch-norm, and ReLU activations followed by a single linear layer. We consider 2 different augmentation strategies for ATS, as well as a hybrid strategy. For Soteria, we evaluate our own network architecture with 2 convolutional and 3 linear layers. The defense is applied on the largest linear layer, directly after the convolutions. Both attacks are implemented using the code from Geiping et al. (2020), and using cosine similarity between gradients, the Adam optimizer (Kingma & Ba, 2015) with a learning rate of 0.1, a total variation regularization of 10−5 for ATS and 4×10−4 for Soteria, as well as 2000 and 4000 attack iterations respectively. We perform the attack on both networks using batch size 1. For PRECODE, which has no public code, we use our own implementation. We use MLP architecture consisting of 5 layers with 500 neurons each and ReLU activations. Following Scheliga et al. (2021) we apply the variational bottleneck before the last fully connected layer of the network.\n\nThe results of this experiment are shown in Fig. 2. We attack ATS for the first 1000 steps of training and Soteria for the first 10 epochs, measuring peak signal-to-noise ratio (PSNR) of the reconstruction obtained using our attack at every step. In all of our PRECODE experiments we obtain perfect reconstruction with PSNR values > 150 so we do not show PRECODE on the plot. We can observe that, generally, each network becomes less susceptible to the attack with the increased number of training steps. However, early in training, networks are very vulnerable, and images can be reconstructed almost perfectly. Fig. 3 visualizes the first 40 reconstructed images obtained using our attacks on Soteria, ATS and PRECODE. We can see that for all defenses, our reconstructions are very close to their respective inputs. This indicates that proposed defenses do not reliably protect privacy under gradient leakage, especially in the earlier stages of training. Our findings suggest that creating effective defenses and properly evaluating them remains a key challenge.\n\nTable 2: PSNR of reconstructed images using approximate Bayes optimal attack, and attacks based on ℓ2, ℓ1, and cosine distance between the gradients. We confirm our theoretical results that Bayes optimal attack performs significantly better when it knows probability distribution of the gradients.\n\nBayes optimal adversary in practice In the following experiment, we compare the approximation of Bayes optimal adversary described in Section 4 with three variants of Inverting Gradients attack (Geiping et al., 2020), based on ℓ2, ℓ1, and cosine distance, on the MNIST (Lecun et al., 1998) and CIFAR-10 datasets. Recall from Table 1 that the ℓ2, ℓ1 and cosine attacks make different assumptions on the probability distribution of the gradients, which are not optimal for every defense. To this end, we evaluate the performance of these attacks on a diverse set of defenses. For both MNIST and CIFAR-10, we train a CNN with ReLU activations, and attack gradients created on image batches of size 1 both at the initialization and step 500 of the training. For all attacks, we use anisotropic total variation image prior, and we initialize the images with random Gaussian noise. Further experiments using prior based on pixel value range are presented in Appendix A.4. We optimize the loss using Adam (Kingma & Ba, 2015) with exponential learning rate decay. For this experiment, we modified Eq. (3) to add an additional weighting parameter β for the prior as 1 k Pk i=1 log p(g|xi) + β log p(xi) which compensates for the imperfect image prior selected.\n\nExperimentally, we observed that the success of the different attacks is very sensitive to the choice of their parameters. Therefore, to accurately compare the attacks, we use grid search that selects the optimal parameters for each of them individually. In particular, for all attacks we tune their initial learning rates and learning rate decay factors as well as the weighting parameter β. Further, for the ℓ2, ℓ1 and cosine attacks the grid search also selects whether exponential layer weighting, introduced by Geiping et al. (2020), is applied on the gradient reconstruction loss. In this experiment, the approximation of the Bayes optimal adversary uses k = 1 Monte Carlo samples. Further ablation study on the effects of k is provided in Appendix A.6. Our grid search explores 480 combinations of parameters for the ℓ2, ℓ1 and cosine attacks, and 540 combinations for the Bayesian attacks, respectively. We provide more details on this parameter search in Appendix A.3.\n\nFor this experiment, we consider defenses for which we can exactly compute conditional probability distribution of the gradients for a given input, denoted earlier as p(g|x). First we consider two defenses which add Gaussian noise with standard deviation σ = 0.1 and Laplacian noise of scale b = 0.1 to the original gradients, thus corresponding to the probability distributions p(g|x) = N(g −∇θl(hθ(x), y), σ2I) and p(g|x) = Lap(g −∇θl(hθ(x), y), bI), respectively. Note that the Gaussian defense with additional gradient clipping corresponds to the well known DP-SGD algorithm (Abadi et al., 2016). We also consider defenses based on soft pruning that set random 50% entries of the gradient to 0, and then add Gaussian or Laplacian noise as in previous defenses. […]\n\n## [conclusion] 7 CONCLUSION\n\nWe proposed a theoretical framework to formally analyze the problem of gradient leakage, which has recently emerged as an important privacy issue for federated learning. Our framework enables us to analyze the Bayes optimal adversary for this setting and phrase it as an optimization problem. We interpreted several previously proposed attacks as approximations of the Bayes optimal adversary, each approximation implicitly using different assumptions on the distribution over inputs and gradients. Our experimental evaluation shows that the Bayes optimal adversary is effective in practical scenarios in which it knows the underlying distributions. We additionally experimented with several proposed defenses based on heuristics and found that they do not offer effective protection against stronger attacks. Given our findings, we believe that formulating an effective defense that balances accuracy and protection against gradient leakage during all stages of training remains an exciting open challenge.\n</paper>\n\n<assets>\n  figure_1 (figure, aspect 1.9, page 4, in section \"4 BAYESIAN ADVERSARIAL FRAMEWORK\" [method]) - Figure 1: Example of a gradient leakage attack. Bayes optimal adversary randomly initializes image x (1) and then optimizes for the image with the highest log p ( g | x ) + log p ( x ) in its δ -neighborhood. The adversary has loss 1 if the final reconstruction is outside the ball B ( x orig , δ ) ,…\n  figure_2 (figure, aspect 3.0, page 7, in section \"6 EXPERIMENTAL EVALUATION\" [experiments]) - Figure 2: PSNR obtained by reconstruction attacks on ATS and Soteria during the first 1000 steps and 10 epochs, respectively, demonstrating high gradient leakage early in training.\n  figure_3 (figure, aspect 2.4, page 8, in section \"6 EXPERIMENTAL EVALUATION\" [experiments]) - Figure 3: Images obtained by running attacks on Soteria, ATS, and PRECODE on the CIFAR-10 dataset after the 10th training step. We can observe that reconstructed images are very close to the original ones, meaning that these defenses do not protect privacy early in the training.\n  figure_4 (figure, aspect 1.5, page 9, in section \"6 EXPERIMENTAL EVALUATION\" [experiments]) - Figure 4: Ablation with the Bayes attack.\n  figure_5 (figure, aspect 1.07, page 12, in section \"7 CONCLUSION\" [conclusion]) - (c) Our attack on the defended largest layer\n  figure_6 (figure, aspect 1.07, page 12, in section \"7 CONCLUSION\" [conclusion]) - (d) Our attack on a defended second largest layer\n  table_1 (table, aspect 2.67, page 5, in section \"4 BAYESIAN ADVERSARIAL FRAMEWORK\" [method])\n  table_2 (table, aspect 6.33, page 5, in section \"4 BAYESIAN ADVERSARIAL FRAMEWORK\" [method]) - Table 1: Several existing attacks can be interpreted as instances of our Bayesian framework. We show prior and conditional distribution for corresponding losses that each attack uses.\n  table_3 (table, aspect 2.91, page 8, in section \"6 EXPERIMENTAL EVALUATION\" [experiments]) - Table 2: PSNR of reconstructed images using approximate Bayes optimal attack, and attacks based on ℓ2, ℓ1, and cosine distance between the gradients. We confirm our theoretical results that Bayes optimal attack performs significantly better when it knows probability distribution of the gradients.\n  table_4 (table, aspect 2.46, page 12, in section \"7 CONCLUSION\" [conclusion]) - Table 3: ConvBig architecture.\n  formula_4 (formula, aspect 1.56, page 4, in section \"4 BAYESIAN ADVERSARIAL FRAMEWORK\" [method])\n  formula_5 (formula, aspect 1.4, page 4, in section \"4 BAYESIAN ADVERSARIAL FRAMEWORK\" [method])\n  formula_7 (formula, aspect 11.67, page 5, in section \"4 BAYESIAN ADVERSARIAL FRAMEWORK\" [method])\n</assets>\n<image><image><image><image><image><image><image><image><image><image><image><image><image>\n\n<instruction>\nDesign spec: canvas 3840x2880px; dense, content-rich; lots of figures; #FFFFFF background; set headings in bold caps; solid square-cornered borders on the panels; a cool colour scheme; four-column layout.\n</instruction>\n\n<layout_spec>\nCanvas 3840x2880 landscape, 4 columns (30% | 29% | 30% | 12%), balanced (42 blocks). Header band (16% tall): title 74px #ffffff on #0d1b2a band, authors line, 1 logo slot. Column 1: Problem setting (top 21%; 1 text, 3 figure slots; boxed; h 18%) -> Reconstruction attack (top 42%; figure_1 (w 71%); h 22%) -> Reconstruction attack (top 42%) -> Adversarial risk (top 67%; 1 text -> formula_5 (w 57%); h 27%). Column 2: Bayes optimal adversary as an optimization problem (top 21%; 1 text -> formula_4 (w 62%); h 25%) -> Approximating Bayes optimal adversary (top 48%; 1 text -> 1 figure slot, figure_3 (full column) -> 3 text -> table_2 (w 92%); boxed; h 48%). Column 3: Evaluating existing defenses (top 21%; 1 text -> figure_2 (w 39%) -> 1 text -> figure_3 (w 43%) -> 1 text, 2 bullets; h 53%) -> Bayes optimal adversary compared to other adversaries (top 76%; 1 text -> table_3 (full column); h 21%). Column 4: [top 29%; figure_2 (w 86%) -> figure_3 (full column) -> figure_5 (full column); h 28%]. Figures used: figure_2, formula_4, figure_1, figure_3, figure_5, formula_5, table_3, table_2. Style: #1a1a2e background, Helvetica Neue, headers #1a4a7a 43px, body 36px; 14 panels: #d6e8f7 x7, #ffffff x4 (bordered), linear-gradient(135deg, #2c5f8a, #4a90d9) x3.\n</layout_spec>"}], "images": ["thumbnails/figure_1.jpg", "thumbnails/figure_2.jpg", "thumbnails/figure_3.jpg", "thumbnails/figure_4.jpg", "thumbnails/figure_5.jpg", "thumbnails/figure_6.jpg", "thumbnails/table_1.jpg", "thumbnails/table_2.jpg", "thumbnails/table_3.jpg", "thumbnails/table_4.jpg", "thumbnails/formula_4.jpg", "thumbnails/formula_5.jpg", "thumbnails/formula_7.jpg"]}