An instance of natural occurrences of such constraints is when mixed strategies are used, which correspond to a probability simplex constraint.

Thanks totheir scalability and lowmemory requirements, first-order methods are especially popular inthis setting (Bottouetal., 2018).

Figure 1: Fourteen queries used in the experiments. They do not contain personally identifiable information or offensive content. All the models are implemented in Pytorch [5] and based on the official implementation of BETAE [6]2 for a fair comparison. Forall the modules using multi-layer perceptron (MLP), we use a three-layer MLP with 1600 hidden neurons and ReLU activation. We apply dropout to the min function inCardMin and search the dropout rate in{0.05,0.10,0.15,0.20}.

However, implementing this approach is not straightforward since it requires a representation of the Hessian that allows its analysis.

For each word, we use WordNet [7] to find its synonyms and build a list of word sets. Inaddition, toavoidreplacement clash, wedonotallowanyword to appear in more than word set. Eventually, top 50 semantically matching pairs are retained for CATER. Since the training data of the victim model is unknown to the malicious users, we randomly select 5M sentences from common crawl data as thebenigncorpus. Numbers in parentheses are resultsofcleandata.

We first generalize existing algebraic characterizations of acyclicity to a class of matrix polynomials.