Identifying GAN Samples

Fake samples generated with the GAN framework have fooled humans and machines into believing that they are indistinguishable from real samples. Although this might be true for the naked eye and the discriminator fooled by the generator, it is unlikely that fake samples are numerically indistinguishable from real samples. Inspired by formal methods, we focus on the evaluation of fake samples with respect to statistical summaries and formal specifications computed on the real data.

Quantitative evaluation of GAN output

Since the paper on GANs (Goodfellow et al., 2014), most GAN-related publications use a grid of image samples to accompany theoretical and empirical results. Unlike VAEs and other models, most of the evaluation of the output of GAN-trained generators is qualitative: authors normally list higher sample quality as one of the advantages of their method over other methods. Although numerical measures such as the inception score are used to evaluate GAN samples (Salimans et al., 2016), interestingly, little is mentioned about the numerical properties of fake samples and how these properties compare to real samples.

In the context of “Verified Artificial Intelligence” (Seshia and Sadigh, 2016), it is hard to systematically verify that the output of a model satisfies the specifications of the data it was trained on, especially when verification depends on the existence of perceptually meaningful features. For example, consider a model that generates images of humans: although it is possible to compare color histograms of real and fake samples, we do not yet have robust algorithms to verify whether an image follows specifications derived from anatomy.

Sensitivity to perturbations

In their very interesting paper, “Intriguing Properties of Neural Networks,” Szegedy et al. showed that neural networks can be sensitive to perturbations to an image that are hardly perceptible to humans. The following imageAdversarial examples generated for AlexNet. Source: Intriguing Properties of Neural Networks (https://arxiv.org/abs/1312.6199) is one example of this, where, after applying the perturbation on the middle column on the image on the first column, the network classifies every perturbed image on the third column as an ostrich: