Goodfellow, Ian

co-author of the Deep Learning textbook; inventor of Generative Adversarial Networks; then at Google Brain, later Apple director of machine learning

Ian Goodfellow: Generative Adversarial Networks (GANs)

Lex Fridman Podcast · Apr 18, 2019

• Ian Goodfellow
• Generative Adversarial Networks
• GANs
• deep learning definition
• adversarial examples
• semi-supervised learning
• domain-adversarial learning
• algorithmic fairness
• differential privacy
• deepfakes and authentication

Core ideas

Goodfellow identifies deep learning's biggest current limitation as its dependence on very large amounts of (often labeled) data or, for reinforcement learning, huge numbers of experienced episodes — in contrast to how humans learn tasks like Pong without millions of failed attempts — framing generalization ability as the field's central bottleneck. He notes that no one seriously proposes deep learning alone as the full ingredient of intelligence; it typically functions as a component (e.g., a value-function estimator inside AlphaGo) within a larger system. He reconceives deep learning not as hierarchical feature abstraction (the older "edges then corners then grandmother cells" story from 2006-era deep belief networks) but as a multi-step program: depth represents sequential computation steps, width represents parallel ones, and what actually matters is having several computational steps run in series — comparable to a form of non-deductive reasoning where a representation is iteratively refined rather than replaced. He extends this framing to argue that self-modeling reinforcement learning agents already exhibit a limited form of self-awareness (since RL algorithms must model the agent's own effect on its environment), while treating "hard problem" style consciousness/qualia questions as currently unformalizable and untestable, akin to the philosophical zombie thought experiment.

He expresses optimism that scaling data, compute, and (crucially) multimodal, integrated datasets — rather than today's typical single-modality training — could produce systems exhibiting much richer, more human-like cognition without requiring fundamentally new algorithms. On adversarial examples specifically, Goodfellow describes his own view evolving from framing them primarily as evidence of a "gap" between machine and human robustness toward viewing them more as a practical security liability; he notes that adversarial training initially seemed to also improve clean-data accuracy (as in his original 2014 MNIST results) but that this benefit hasn't reliably replicated on other datasets or against stronger adversaries, where robustness against strong attacks tends to trade off against ordinary accuracy. He discusses concrete adversarial-example threats already demonstrated against speech recognition systems (citing the 2016 "Hidden Voice Commands" paper, and later work producing audio that sounds like ordinary background noise to humans but is transcribed as an attacker-chosen sentence) as a template for how adversarial robustness matters wherever a system's decisions have real economic or safety stakes (he also cites obfuscated trading algorithms in finance as a related concern).

On writing the deep learning chapter for the 4th edition of Russell and Norvig's Artificial Intelligence: A Modern Approach, Goodfellow describes deliberately favoring durable, time-tested concepts (some dating back to the 1980s) over exhaustively cataloguing rapidly-changing state-of-the-art results, and explicitly avoiding claims about which specific "learning to learn" architecture is currently best, since such specifics age quickly. Pressed for a definition of deep learning, he defines it structurally as any machine learning approach involving multiple sequential (not merely parallel) parameter-learning steps — a definition orthogonal to whether training uses gradient descent, since he considers Boltzmann machines (non-differentiable, pre-backpropagation) a legitimate example of "deep" learning by virtue of their multi-step inference process, distinguishing the model (architecture), the optimization algorithm (e.g., gradient descent), and the dataset as three separable components of any learning system. He predicts backpropagation and gradient descent will remain useful (much as logistic regression persists in niche high-value uses like finance and noisy medical data) without necessarily being sufficient alone for human-level AI, expressing particular interest in mechanisms like the Neural Turing Machine's writable memory as a more promising route to genuinely fast, one-shot factual memory (contrasting this with how an LSTM currently needs repeated gradient steps to "learn" a fact a human would simply remember after hearing it once) — and voices openness to reintroducing 1980s-style symbolic/knowledge-base ideas in hybrid form, such as a "differentiable knowledge base" that could inject structural priors (e.g., faces are approximately symmetric) into generative models without requiring them to rediscover such facts purely from data.

Recounting GANs' origin story, Goodfellow describes the idea arising during a bar conversation where friends were skeptical that training two neural networks against each other (an inner-loop discriminator training within an outer-loop generator) could be made to converge — a concern rooted in his lab's contemporaneous struggles getting deep Boltzmann machines' dual positive/negative training phases to stay synchronized at scales beyond MNIST. He implemented and tested the idea that same night and found it worked, while candidly noting that even years later there's no fully satisfying theoretical explanation for why GANs succeed at photorealistic image generation where Boltzmann machines failed — existing convergence proofs apply only under restrictive theoretical settings that don't fully explain empirical results.

He defines GANs as one family among generative models — models trained on data (e.g., cat photos) to either estimate a likelihood/density function or generate new, realistic samples — with GANs specifically optimized for generation via a two-player minimax game: a generator producing candidate outputs (starting as random noise) and a discriminator trying to distinguish real training examples from generator outputs, with a theoretical Nash equilibrium where the generator's distribution exactly matches the true data distribution and the discriminator can do no better than chance. He highlights a genuinely puzzling open question: since a generative model that perfectly "wins" the training game would in principle just memorize training examples, and yet GANs instead produce novel, compelling images, there must be some other explanation — he cites his former intern Vaishnav Nagarajan's statistical-learning-theory work showing memorization is actually computationally hard for the generator to achieve, and a separate "Deep Image Prior" paper showing that convolutional architectures alone (without any learned weights) are useful for tasks like image inpainting — suggesting some of GANs' apparent generalization ability for images specifically may stem from convolutional architecture capturing visual structure inherently (a property that may not transfer as readily to other domains like biological microarray data).

He surveys the generative-model landscape, contrasting most likelihood-based models (which must be carefully architected for tractable density estimation, such as autoregressive pixel-by-pixel models like PixelCNN, which parallelize probability estimation but must generate sequentially and can be slow) against GANs' focus on realistic sample generation over exact density estimation, while cautioning that whether GANs are winning on raw image quality partly reflects which research communities (e.g., graphics/art specialists) have concentrated effort there, making causal attribution to the algorithm itself uncertain. Giving a brief technical history, he traces GANs from unrecognizable 2014-era CIFAR-10 samples (with the Toronto Face Database yielding the first recognizable GAN faces) through LAPGAN's coarse-to-fine multi-stage approach at Facebook AI Research, to DCGAN (2015, Radford/Metz/Chintala) as the single-model architecture that triggered a "Cambrian explosion" of GAN variants used as a common baseline ever since.

Beyond raw image generation, Goodfellow describes several substantive GAN applications: semi-supervised learning (his colleague Tim Salimans's work repurposing the GAN discriminator as a classifier, reducing MNIST's labeled-example requirement from ~60,000 to just 100 for sub-1% error); a Brain Zurich follow-up to DeepMind's BigGAN showing comparable image quality with only ~10% of ImageNet's labels via discriminator-driven clustering; domain-adversarial learning (a closely related but independently-invented technique for domain adaptation, where a feature extractor is trained against a "domain recognizer" so extracted features generalize across, e.g., clean training images versus users' noisy phone photos); algorithmic fairness (citing Amos Storkey's lab's technique for preventing a model from internally reconstructing a sensitive variable like gender from correlated features such as a name, using an adversarial "feature analyzer," and separately proposing CycleGAN-style demographic transformation as a potential fairness-auditing tool, while cautioning this application isn't yet practically mature); and differential privacy (citing Casey Greene's lab's work training GANs under differential-privacy guarantees to generate synthetic patient data other researchers can use without exposing real individuals' medical records). He also connects the well-known "horse→zebra" CycleGAN artifact (zebras tend to appear on drier terrain than horses' typical grassy backgrounds, causing spurious color/terrain correlations) to a broader point about generative models absorbing dataset biases like background co-occurrence statistics.

On deepfakes, Goodfellow expresses more concern about the near-term "bumpy cultural transition" than about a 20-year horizon, predicting society will eventually adapt by expecting cryptographic provenance verification (citing the startup TruePic) rather than trusting raw pixel content, and arguing pixel-level fake-detection alone will likely remain fundamentally unreliable (and potentially dangerous, since a fooled fake-detector lends false credibility) — favoring hardware-embedded cryptographic signing (e.g., phones signing photos with embedded private keys) as a more robust long-term direction, while acknowledging well-resourced adversaries (like state security agencies) could still compromise such hardware.

Reflecting on the pace of research, Goodfellow doubts that GAN-scale breakthroughs achievable in a single evening are still common in core machine learning (proving a comparably good idea today would require expensive, large-scale experiments rather than a quick MNIST demo), but identifies fairness and interpretability as areas ripe for fast, low-resource conceptual progress — arguing, by analogy to Cynthia Dwork's differential privacy definition (which quickly enabled concrete privacy-preserving algorithms once a rigorous mathematical definition existed), that the field currently lacks even a clear, measurable definition of "interpretability," and that supplying one could unlock rapid algorithmic progress without requiring new experiments first. On AGI, he argues the necessary ingredients include much richer, more diverse simulated training environments (since he doesn't believe fixed datasets or single-environment RL training can get there) and substantially more compute, and proposes a concrete practical benchmark for "understanding": an agent that, given only a URL or task description, can autonomously assemble its own data pipeline (download, parse, preprocess) and solve a task like CIFAR-10 classification without a human engineer hand-building every step — arguing this kind of self-directed pipeline construction would be hard to distinguish from genuine task understanding, regardless of formal philosophical definitions of intelligence.

Closing on his own research priorities, Goodfellow names adversarial robustness as one of the most important problems for the field to solve, expressing particular concern not about known domains like images but about future, currently unanticipated applications of AI (drawing an analogy to how unpredictable smartphone use cases were in 2002) — and highlights dynamic, continuously-updating models (which change their decision rule over time rather than freezing after training) as a promising general defensive strategy, since a static, frozen model is a "sitting duck" for adversaries who can repeatedly probe it for a fixed exploitable weakness.

Excerpts