2021

[1,2]Samuel C. Peet

1]Royal Brisbane and Women’s Hospital, Herston, 4029, QLD, Australia
2]Queensland University of Technology, Brisbane, 4001, QLD, Australia
3]University of Queensland, Brisbane, 4072, QLD, Australia

# A Publicly Available Dataset of Out-of-Field Dose Profiles of a 6 MV Linear
Accelerator

<EMAIL_ADDRESS>Naasiha Cassim  Tanya Kairn  Jamie V. Trapp
Scott B. Crowe  [  [  [

###### Abstract

An increase in radiotherapy-induced secondary malignancies has led to recent
developments in analytical modelling of out-of-field dose. These models must
be validated against measurements, but currently available datasets are
outdated or limited in scope. This study aimed to address these shortcomings
by producing a large dataset of out-of-field dose profiles measured with
modern equipment. A novel method was developed with the intention of allowing
physicists in all clinics to perform these measurements themselves using
commonly available dosimetry equipment. A standard 3D scanning water tank was
used to collect 36 extended profiles. Each profile was measured in two
sections, with the inner section measured with the beam directly incident on
the tank, and the outer section with the beam incident on a water-equivalent
phantom abutted next to the tank. The two sections were then stitched using a
novel feature-matching approach. The profiles were compared against linac
commissioning data and manually inspected for discontinuities in the overlap
region. The dataset is presented as a publicly accessible comma separated
variable file containing off-axis ratios at a range of off-axis distances.
This dataset may be applied to the development and validation of analytical
models of out-of-field dose. Additionally, it may be used to inform dose
estimates to radiosensitive implants and anatomy. Physicists are encouraged to
perform these out-of-field measurements in their own clinics and share their
results with the community.

###### keywords:

Out-of-field dose, peripheral dose, linear accelerator, dose profiles

##  1 Introduction

Improvements in diagnostic and treatment technologies have resulted in overall
cancer survival rates increasing in recent times miller2019 . However, this
increase in radiation therapy survivorship has coincided with a commensurate
increase in the rate of radiation induced secondary malignancies later in life
dracham2018 . In response, there has been increasing effort to better
understand out-of-field doses delivered during radiation therapy treatments
kry2017 . Beyond secondary cancer induction, accurate out-of-field dose
estimates are also necessary for assessing doses to radiosensitive implants
such as cardiac devices miften2019 ; peet2016  and radiosensitive anatomy as
in the case of pregnant patients stovall1995 ; peet2021 . There is also a need
for increasingly accurate out-of-field dose estimates to inform
epidemiological studies harrison2017 .

Methods of estimating out-of-field doses include consulting simple reference
data in the literature stovall1995 ; mutic1999 ; ruben2011 ; miljanic2014 ,
Monte Carlo simulations kry2006 ; kry2007 ; bednarz2009 , and increasingly
refined analytical models benadjaoud2012 ; taddei2013 ; schneider2019 ;
wilson2020 . These models may need to consider the physical geometry of
clinical linacs, including jaws, primary collimator, MLC leaves and carriage,
and the arrangement of additional head shielding. This is further complicated
by the relative positions of the linac treatment head and patient, such as
during non-coplanar cranial radiotherapy kairn2019 . Modelling and verifying
the effects of these factors would require the measurement of a large number
of out-of-field profiles with many collimator orientations. As out-of-field
dose modelling matures, it is also reasonable to expect that computational
models will augment traditional dose calculation algorithms in commercial
treatment planning systems. Commissioning these models may require the
measurement of profiles much farther outside the field than physicists are
currently accustomed.

Available datasets in the literature generally contain older model linacs and
MLCs that are rarely seen today stovall1995 ; mutic1999  and present coarse
resolution dose profiles in a limited set of collimator orientations.
Physicists wishing to use these profiles are forced to interpolate values from
the printed figures by hand. This is a sub-optimal approach, and a
contemporary solution using modern dosimetry equipment should achieve much
greater spatial resolution while also presenting the data digitally in a
manner that is computationally digestible.

In this article we establish a method of measuring high-quality out-of-field
dose profiles using typically available clinical physics equipment. This
method is then followed to produce a comprehensive and publicly available
dataset of out-of-field dose profiles of our clinical linac.

##  2 Methods

###  2.1 Equipment

The linac under investigation in this study was a Varian Clinac iX (Varian
Medical Systems, Palo Alto, USA) with a Millennium 120 MLC. All measurements
were performed using the 6 MV photon energy with 600 MU/min dose rate and
flattening filter. A PTW Semiflex 0.3 cm3 31013 (PTW-Freiburg, Freiburg,
Germany) ionisation chamber was used for all profile scans. The dimensions of
this chamber afforded lower volume averaging compared to larger thimble
chambers, while still maintaining the sensitivity necessary for far out-of-
field measurements. The chamber was affixed to a PTW BEAMSCAN water tank using
the TRUFIX chamber positioning system and steered with version 4.3 of the
control software. The BEAMSCAN water tank had a usable scanning range of 500
mm (horiz.) $\times$ 500 mm (horiz.) $\times$ 415 mm (vert.), and 15 mm thick
PMMA walls. A PTW Semiflex 3D 0.07 cm3 31021 ionisation chamber was used as a
reference to correct for fluctuations in the beam output during each scan. The
chamber voltages were set to 400 V as per manufacturer recommendations, and
the integrated water tank electrometer was set to low range. The control
software was programmed to measure profiles in continuous scanning mode with a
chamber speed of 5 mm/s and data points reported every 2 mm. A 30 $\times$ 30
$\times$ 40 cm3 stack of Virtual Water (Standard Imaging, Middleton, USA) was
used as additional scattering material.

###  2.2 Measurement Setup

Each profile was measured as a piece-wise combination of two scans to
construct a much longer profile measurement than a typical water tank would
allow. The first section acquired the in-field and near out-of-field region of
each profile, while the second section captured the far out-of-field region.
An overlap area of approximately 15 cm was included in each pair of profile
sections.

The first measurement geometry can be seen in Figure 1a. To begin, the tank
was positioned such that the long axis of the chamber was orthogonal to the
scanning direction, with a source to surface distance of 90 cm. The tank was
then translated such that the central axis of the beam was 15 cm from the
maximum chamber travel position on one side, and 35 cm from the maximum
chamber travel position on the opposite side. This allowed the inner section
of each profile to be collected out to 35 cm from the central axis while still
allowing adequate scatter around the field.

The measurement geometry was then altered to capture the far out-of-field
section of each profile, as seen in Figure 1b. The tank was translated 31.5 cm
in the direction of the profile, and a stack of Virtual Water was positioned
in the field at 90 cm source to surface distance to re-establish full
scattering conditions. Care was taken to ensure that the Virtual Water was
abutted firmly against the tank wall with minimal air gaps.

Figure 1: Equipment setup for the measurement of profiles in this study. (a)
Inner profile section: The field is directed into the tank near the wall. (b)
Outer profile section: The tank is shifted outside of the field and abutted to
a stack of Virtual Water to ensure full scattering conditions.

###  2.3 Post-processing

The two sections of each profile were stitched together to create a whole.
This was non-trivial, as the overlap regions did not necessarily coincide due
to small air gaps between the Virtual Water and the tank wall, the non-water-
equivalence of the tank wall, and positioning errors in the tank. To overcome
this issue, each overlap region was searched for a prominent feature common to
both sections of the profile. The far out-of-field section was then
progressively shifted in 1 mm increments and re-scaled until the identified
feature matched the inner profile section as well as possible. The two
sections were then combined into one full profile, with an average being taken
in the overlap region. A visual example of this process can be seen in Figure
2. No additional smoothing or filtering was applied. The full profiles were
validated by comparisons with commissioning data and visual inspections for
any discontinuities.

Figure 2: The process of stitching two profile sections to make a whole. (a)
The two raw profile sections with a strong feature for matching. (b) The outer
section shifted such that the features overlap. (c) The two sections
conjoined, with the average value taken in the overlap region.

###  2.4 Summary of Collected Profiles

In total, 36 profiles were collected (see summary in Table 1). Profiles were
gathered at three nominal field sizes: 5 $\times$ 5 cm2, 10 $\times$ 10 cm2,
and 15 $\times$ 15 cm2. Profiles in both the X and Y directions were measured
with the jaws defining the field and the MLC in a ’parked’ state (leaf tips
fully retracted to approximately 21 cm off axis). These were repeated with the
MLC defining the field and the jaws at the Varian recommended positions (X
jaws 8 mm retracted from nominal field edge, Y jaws 2 mm retracted from
nominal field edge). All profiles were measured with a source to surface
distance of 90 cm and depth of 10 cm, except for the 10 $\times$ 10 cm2 MLC
defined profiles which were additionally measured at depths of 15, 20, and 25
cm. Every profile was measured twice: once aligning with the radial (gun-
target) direction and once aligning with the transverse (left-right)
direction. The collimator angle was set appropriately to achieve this, for
example, a transverse X profile required collimator 0∘, while a radial X
profile required collimator 90∘ (or 270∘). The radial direction corresponds to
the cranio-caudal axis of a patient receiving an coplanar treatment with no
couch rotation and the transverse direction corresponds to the cranio-caudal
axis of a patient receiving a treatment with a 90∘ couch rotation. The radial
and transverse profiles were collected in two separate measurement sessions as
they required a complete reorientation of the tank. In total, the measurement
time was approximately eight hours, including equipment setup/cleanup and data
collection.

Table 1: Field configurations measured in this study. For each row in the table, X and Y profiles were gathered in both the radial and transverse orientations Field Size (cm2) | MLC State | Symmetric Jaw Apertures (cm) | Depth (cm)
---|---|---|---
5 $\times$ 5 | Retracted | (X = 5, Y = 5) | 10
5 $\times$ 5 | Defining field | (X = 6.6, Y = 5.4) | 10
10 $\times$ 10 | Retracted | (X = 10, Y = 10) | 10
10 $\times$ 10 | Defining field | (X = 11.6, Y = 10.4) | 10
10 $\times$ 10 | Defining field | (X = 11.6, Y = 10.4) | 15
10 $\times$ 10 | Defining field | (X = 11.6, Y = 10.4) | 20
10 $\times$ 10 | Defining field | (X = 11.6, Y = 10.4) | 25
15 $\times$ 15 | Retracted | (X = 15, Y = 15) | 10
15 $\times$ 15 | Defining field | (X = 16.6, Y = 15.4) | 10

##  3 Results

###  3.1 Dataset Accessibility and Usage Notes

The dataset had been made publicly accessible through the Zenodo platform and
released under a Creative Commons Attribution 4.0 licence peet2021dataset .
The dataset consists of a single comma separated variable (CSV) file
containing 37 columns, with the first column storing the off-axis distance of
each measurement point, and the remaining 36 columns storing the off-axis
ratios at these points for each profile. The first row contains a label for
each profile with the format ‘[$field\\_size$] [$mlc\\_state$] [$depth$]
[$direction$] [$orientation$]’ where

  * •

$field\\_size$ is the nominal field size at the isocentre,

  * •

$mlc\\_state$ designates the position of the MLC, taking the value ‘MLC
defined’ when the MLC defines the field, and ‘MLC parked’ when the MLC is
fully retracted,

  * •

$depth$ is the depth of measurement,

  * •

$direction$ indicates the direction of the profile, either X or Y, and

  * •

$orientation$ indicates whether the measurement orientation was radial (GT) or
transverse (LR).

For example, a profile under the Y jaw of a 10 $\times$ 10 cm2 MLC defined
field measured at a depth of 10 cm in the radial direction would have the
label ’10 x 10 MLC defined Y d10cm (GT)’. Each profile was normalised to the
value at the central axis at the time of measurement so no further processing
is needed to recover off-axis ratios. Users should be aware that the profiles
are of unequal length, depending on whether they were acquired in the radial
or transverse measurement orientation. An exploration of the dataset will be
undertaken in the Discussion section.

###  3.2 Dataset Validation

In order to establish that the irradiation conditions and measurement setup
were representative of normal practice, the inner component of the 10 $\times$
10 cm2 X and Y profiles were compared against the same profiles gathered
during commissioning of the linac. A gamma comparison of the in-field
sections, bounded by the 50% isodose lines, showed 100% agreement with
criteria of 1% dose difference (local normalisation) and 1 mm distance-to-
agreement. This gave good confidence that the measurement equipment was set up
correctly, that the linac was behaving nominally, and that ultimately the data
gathered in the session was representative of clinical practice.

During the post-processing step, the outer section of each profile was shifted
to coincide with the inner section of the profile. Given that the equipment
was not moved during the measurement of all outer profile sections within a
given orientation (radial or transverse), it follows that the ideal shift
should be the same across all profiles. This was indeed found to be the case
with the largest difference in ideal shifts being 1 mm. After combining the
profile halves and taking the average in the overlap region, all full profiles
were then manually inspected to ensure that there were no obvious
discontinuities in the overlap region. None were found.

##  4 Discussion

###  4.1 An Exploration of Dose Outside the Treatment Field

This investigation produced a large dataset with many curious features. In
this section we compare and contrast a number of profiles that illuminate the
underlying geometry and radiation interactions. However, these are just a
representative selection of the profiles, and we encourage interested readers
to further examine the dataset for themselves.

Figure 3 presents two 10 $\times$ 10 cm2 X profiles, one of which is defined
by the MLC, and the other is defined by the jaw (MLC retracted). Both profiles
were measured in the transverse direction. Feature A corresponds to a sharp
decrease in relative dose in the jaw defined profile due to the combined
effect of the primary collimator and the MLC leaves being retracted to this
position. This feature is not seen in the MLC defined profile. Feature B
denotes a large difference in the profiles very far out-of-field. This may be
explained by this region being shielded by the tails of the MLC leaves when
they are fully retracted, but not shielded when the leaves are moved in to
define the field.

Figure 3: Two 10 $\times$ 10 cm2 X profiles, one MLC defined, and one jaw
defined (MLC fully retracted). Marked features are explained in the article
text.

Two 10 $\times$ 10 cm2 Y profiles, one of which is defined by the jaw (MLC
retracted), and the other is defined by the MLC, are shown in Figure 4. Both
of these profiles were collected in the radial direction. Notably, the Y jaw
defined profile is the only field arrangement giving a pure jaw profile
uncoupled from additional MLC shielding effects. Three features are marked in
the figure. Feature A denotes a sharp increase in relative dose at
approximately 20 cm off axis, due to the finite lateral extent of the MLC.
This feature has been observed in an earlier study ruben2011 . This is
immediately followed by a decrease in relative dose due to the primary
collimator, which can also be seen on the jaw defined profile. Feature B
denotes an area in which the two profiles have the same shielding conditions
(jaw, primary collimator, no MLC) and yet have different relative doses. This
may be explained by a difference in lateral phantom scatter from leakage more
centrally in the field. The profile with both the jaw and MLC shielding the
beam has less leakage relative to the jaw only profile, and therefore also has
less lateral phantom scatter from this leakage. This is supported by the
profiles coming into agreement in region C very far out-of-field. By this
point most of the phantom scatter has been attenuated, leaving only leakage
through the primary collimator and head shielding.

Figure 4: Two 10 $\times$ 10 cm2 Y profiles, one MLC defined, and one jaw
defined. Marked features are explained in the article text.

The 10 $\times$ 10 cm2 MLC defined profiles were measured at depths of 10, 15,
20, and 25 cm to investigate the variation of off-axis ratio with depth.
Figure 5 displays the X profiles normalised to the central axis dose of the
profile at 10 cm depth. Remarkably, the out-of-field dose differs only
marginally between depths. This indicates that out-of-field doses are largely
independent of depth, at least at the distances and depths measured in this
study. This finding is in line with earlier studies stovall1995 , but may not
hold closer to the surface due to electrons scattered from the treatment head
kry2006 .

Figure 5: 10 $\times$ 10 cm2 MLC defined X profiles measured at four different
depths. All four profiles have been normalised to the central axis value of
the 10 cm depth profile.

As shown in Figures 3 and 4, many features in the out-of-field dose are
related to the MLC. Figure 6 shows X and Y profiles for a 5 $\times$ 5 cm2 MLC
defined field. The two features A and B have been seen earlier (the former
related to the limited extent of the MLC bank in the Y direction exemplified
in figure 4, and the latter related to the finite length of the MLC leaves
exemplified in figure 3), however, the magnitude of the features relative to
the central axis are larger for the smaller field compared to the 10 $\times$
10 or 15 $\times$ 15 cm2 fields. Due to the smaller field size, there is less
phantom and collimator scatter to wash out these features in the relative
dose.

Figure 7 presents the 10 $\times$ 10 cm2 X profile where the MLC is fully
retracted with the 10 $\times$ 10 cm2 Y profile in which there is no MLC
present. From the central axis to approximately 21 cm off-axis, denoted
feature A, there is a small difference in the relative dose likely due to the
difference in vertical position of the X and Y jaws. Beyond 21 cm from the
central axis (feature B), the presence of the retracted MLC reduces the X
profile out-of-field dose to about 50% to 75% of the Y profile with no MLC
present. This demonstrates the substantial effect that the MLC can have on
shielding radiation far out-of-field, as noted by other authors mutic1999 .

Figure 6: X and Y profile of the 5 $\times$ 5 cm2 MLC defined field. Marked
features are explained in the article text. Figure 7: Comparison of a 10
$\times$ 10 cm2 jaw defined Y profile with an MLC defined X profile. Marked
features are explained in the article text.

All profiles were measured in both the radial and transverse directions.
Differences were only noted very far out-of-field. In all cases, the general
shape of the relative dose out-of-field was similar between radial and
transverse measurements, however, the transverse relative doses were of
greater magnitude. This was best exemplified in the 5 $\times$ 5 cm2 MLC
defined configuration, shown in Figure 8 (feature A). This effect may be
explained by an asymmetry in the linac head shielding.

Figure 8: Comparison of a 5 $\times$ 5 cm2 MLC defined X profile measured in
both the radial (GT) and transverse (LR) orientations. Marked features are
explained in the article text.

###  4.2 Limitations

Many aspects of the above discussion involve observing features in out-of-
field dose profiles and relating those features to the internal geometry of
the linac head. There are many assumed relationships that cannot be
stringently verified without Monte Carlo simulations that include a high-
fidelity reproduction of the linac head, including the dimensions and
locations of shielding blocks. Linac vendors would need to be willing to share
detailed 3D models to facilitate this as the phase spaces and simplified
geometries commonly shared would not be suitable for modelling complex
interactions in the head shielding. Such an arrangement has been possible in
the past kry2006 ; kry2007 ; bednarz2009 , and we encourage all vendors to be
open to sharing this information into the future.

The measurements reported in this study were performed in a radiotherapy
treatment clinic with a single model of linac, and so the extent to which this
dataset can be extrapolated to other linac models is not obvious. It is
reasonable to expect that the near out-of-field results may align with other
models with similar tertiary collimation systems, such as the Varian Truebeam
with Millennium 120 MLC. However, far out-of-field the results are more likely
to depend on the exact head shielding arrangements, and so the similarity
between systems in unclear.

Linacs with markedly different collimation systems, such as those produced by
Elekta (Stockholm, Sweden), may have substantially different out-of-field
features. Ultimately, we recommend that clinics gather their own dataset using
the techniques presented in this study. We note however that our method would
need substantial modification for use with cylindrical water tanks such as the
3D SCANNER (Sun Nuclear Corporation, Melbourne, USA), but should be directly
transferable to other square tanks.

###  4.3 Recommendations

We recommend that this dataset is used to further investigate and understand
features of out-of-field dose distributions, particularly by assisting in the
creation and validation of computational models. Furthermore, we encourage
readers to perform their own measurements and compare and contrast them with
this dataset.

When planning the tank shift, we recommend that the overlap region of the
inner and outer profile sections be centred around 20 cm from the central
axis. This region contains several strong features, such as the beginning of
the primary collimator, which allows the profiles to be stitched with
confidence.

For clinics wishing to save time by collecting a more limited dataset for
radiation protection calculations, we recommend collecting a single profile
for a variety of field sizes. We believe the ideal profile is under the Y jaw,
with the MLC fully retracted, in the radial orientation. This specific profile
is compared against all others in Figure 9. From the figure it can seen that
this profile represents an upper bound of the out-of-field dose for much of
the range covered in this study, and can therefore be used as a conservative
estimate of the dose across this range. Being in the radial direction, it is
also representative of the majority of radiotherapy treatments.

We also make the suggestion that this same profile may be a good candidate for
aiding in the development of out-of-field dose calculation models. It is a
good basic test case as it is the only profile uncoupled from extra MLC
shielding. MLC shielding may then be added as a second order effect.

Figure 9: The jaw defined Y profiles for the three field sizes in this study
(solid lines). The shaded areas correspond to the complete range of profiles
measured for each field size.

##  5 Conclusion

This article has presented a comprehensive dataset of dose profiles outside of
the treatment field. These profiles were collected in a non-academic
radiotherapy treatment centre, with standard equipment, using a technique that
should be repeatable elsewhere. Ultimately, we encourage other clinics to
collect their own datasets and make them freely available to the community.
Access to high-quality collections of out-of-field profiles for a range of
contemporary linacs would be extremely useful for risk assessments, radiation
protection studies, and the development and commissioning of out-of-field dose
calculation models.

Acknowledgements

The authors would like to thank Steven R. Sylvander for his helpful insights
during the planning of this study.

## Declarations

  * •

Funding:
N/A

  * •

Conflict of interest:
All authors declare that they have no conflicts of interest.

  * •

Ethics approval:
This article does not contain any studies with human participants performed by
any of the authors.

## References

  *   * (1) Miller, K.D., Nogueira, L., Mariotto, A.B., Rowland, J.H., Yabroff, K.R., Alfano, C.M., Jemal, A., Kramer, J.L., Siegel, R.L.: Cancer treatment and survivorship statistics, 2019. CA: a cancer journal for clinicians 69(5), 363–385 (2019)
  * (2) Dracham, C.B., Shankar, A., Madan, R.: Radiation induced secondary malignancies: a review article. Radiation oncology journal 36(2), 85 (2018)
  * (3) Kry, S.F., Bednarz, B., Howell, R.M., Dauer, L., Followill, D., Klein, E., Paganetti, H., Wang, B., Wuu, C.-S., George Xu, X.: Aapm tg 158: measurement and calculation of doses outside the treated volume from external-beam radiation therapy. Medical physics 44(10), 391–429 (2017)
  * (4) Miften, M., Mihailidis, D., Kry, S.F., Reft, C., Esquivel, C., Farr, J., Followill, D., Hurkmans, C., Liu, A., Gayou, O., et al.: Management of radiotherapy patients with implanted cardiac pacemakers and defibrillators: A report of the aapm tg-203. Medical physics 46(12), 757–788 (2019)
  * (5) Peet, S.C., Wilks, R., Kairn, T., Crowe, S.B.: Measuring dose from radiotherapy treatments in the vicinity of a cardiac pacemaker. Physica Medica 32(12), 1529–1536 (2016)
  * (6) Stovall, M., Blackwell, C.R., Cundiff, J., Novack, D.H., Palta, J.R., Wagner, L.K., Webster, E.W., Shalek, R.J.: Fetal dose from radiotherapy with photon beams: report of aapm radiation therapy committee task group no. 36. Medical physics 22(1), 63–82 (1995)
  * (7) Peet, S.C., Kairn, T., Lancaster, C.M., Trapp, J.V., Sylvander, S.R., Crowe, S.B.: Measuring foetal dose from tomotherapy treatments. Medical Dosimetry in press (2021)
  * (8) Harrison, R.: Out-of-field doses in radiotherapy: Input to epidemiological studies and dose-risk models. Physica Medica 42, 239–246 (2017)
  * (9) Mutic, S., Klein, E.E.: A reduction in the aapm tg-36 reported peripheral dose distributions with tertiary multileaf collimation. International Journal of Radiation Oncology* Biology* Physics 44(4), 947–953 (1999)
  * (10) Ruben, J.D., Lancaster, C.M., Jones, P., Smith, R.L.: A comparison of out-of-field dose and its constituent components for intensity-modulated radiation therapy versus conformal radiation therapy: implications for carcinogenesis. International Journal of Radiation Oncology* Biology* Physics 81(5), 1458–1464 (2011)
  * (11) Miljanić, S., Bordy, J.-M., d’Errico, F., Harrison, R., Olko, P.: Out-of-field dose measurements in radiotherapy–an overview of activity of eurados working group 9: Radiation protection in medicine. Radiation measurements 71, 270–275 (2014)
  * (12) Kry, S.F., Titt, U., Pönisch, F., Followill, D., Vassiliev, O.N., Allen White, R., Mohan, R., Salehpour, M.: A monte carlo model for calculating out-of-field dose from a varian beam. Medical physics 33(11), 4405–4413 (2006)
  * (13) Kry, S.F., Titt, U., Followill, D., Pönisch, F., Vassiliev, O.N., White, R.A., Stovall, M., Salehpour, M.: A monte carlo model for out-of-field dose calculation from high-energy photon therapy. Medical physics 34(9), 3489–3499 (2007)
  * (14) Bednarz, B., Xu, X.G.: Monte carlo modeling of a 6 and 18 mv varian clinac medical accelerator for in-field and out-of-field dose calculations: development and validation. Physics in Medicine & Biology 54(4), 43 (2009)
  * (15) Benadjaoud, M.A., Bezin, J., Veres, A., Lefkopoulos, D., Chavaudra, J., Bridier, A., de Vathaire, F., Diallo, I.: A multi-plane source model for out-of-field head scatter dose calculations in external beam photon therapy. Physics in Medicine & Biology 57(22), 7725 (2012)
  * (16) Taddei, P.J., Jalbout, W., Howell, R.M., Khater, N., Geara, F., Homann, K., Newhauser, W.D.: Analytical model for out-of-field dose in photon craniospinal irradiation. Physics in Medicine & Biology 58(21), 7463 (2013)
  * (17) Schneider, C.W., Newhauser, W.D., Wilson, L.J., Kapsch, R.-P.: A physics-based analytical model of absorbed dose from primary, leakage, and scattered photons from megavoltage radiotherapy with mlcs. Physics in Medicine & Biology 64(18), 185017 (2019)
  * (18) Wilson, L.J., Newhauser, W.D., Schneider, C.W., Kamp, F., Reiner, M., Martins, J.C., Landry, G., Giussani, A., Kapsch, R.-P., Parodi, K.: Method to quickly and accurately calculate absorbed dose from therapeutic and stray photon exposures throughout the entire body in individual patients. Medical physics 47(5), 2254–2266 (2020)
  * (19) Kairn, T., Crowe, S., Peet, S.C.: Linac leakage dose received by patients treated using non-coplanar radiotherapy beams. In: World Congress on Medical Physics and Biomedical Engineering 2018, pp. 549–551 (2019). Springer
  * (20) Peet, S.C.: Varian iX 6 MV Extended Profiles [Data Set]. Zenodo (2021). https://doi.org/10.5281/zenodo.4722077


# RPAttack: Refined Patch Attack on General Object Detectors

###### Abstract

Nowadays, general object detectors like YOLO and Faster R-CNN as well as their
variants are widely exploited in many applications. Many works have revealed
that these detectors are extremely vulnerable to adversarial patch attacks.
The perturbed regions generated by previous patch-based attack works on object
detectors are very large which are not necessary for attacking and perceptible
for human eyes. To generate much less but more efficient perturbation, we
propose a novel patch-based method for attacking general object detectors.
Firstly, we propose a patch selection and refining scheme to find the pixels
which have the greatest importance for attack and remove the inconsequential
perturbations gradually. Then, for a stable ensemble attack, we balance the
gradients of detectors to avoid over-optimizing one of them during the
training phase. Our RPAttack can achieve an amazing missed detection rate of
100% for both Yolo v4 and Faster R-CNN while only modifies 0.32% pixels on VOC
2007 test set. Our code is available at https://github.com/VDIGPKU/RPAttack.

Index Terms—  Adversarial Examples, General Object Detector, Patch Selection
and Refining

††footnotetext: This work was supported by National Key R&D Program of China
No. 2019YFB1406302. This work was also a research achievement of Key
Laboratory of Science, Technology and Standard in Press Industry (Key
Laboratory of Intelligent Press Media Technology).

##  1 Introduction

Object detection is a fundamental computer vision task which needs to predict
the category and location of the object simultaneously. With the great
development of deep learning, object detectors are successfully integrated
into more and more real-world application systems. Hence, ensuring the safe
usage of object detectors becomes a very important problem to be tackled.

Many works[1, 2] have revealed the vulnerability of general object detectors
by generating adversarial perturbations on the whole image. Though these
perturbations are invisible for human eyes, they can not be performed in real-
world cases, since it is impossible to attack the whole scene shown in the
image. On the other hand, patch-based attack methods[3, 4, 5, 6] could be
exploited for real-world attacks that only modify some patches rather than the
whole image. However, the adversarial patches generated by these methods are
so large thus are noticeable for human eyes. Besides, some patch-based methods
like DPATCH[4] is not efficient enough which needs to train 200k iterations to
generate an adversarial patch.

Fig. 1: Illustration of an example. Boxes with red lines and white lines are
predicted by YOLO v4[7] and Faster R-CNN [8] respectively. We show adversarial
images generated by RPAttack (ours), DPATCH and DPAttack. Noticeably, the
proposed RPAttack has generated the least perturbations. We also show some
local perturbation clearly for comparison with DPAttack. Moreover, no object
can be detected from the adversarial image generated by our RPAttack, for both
YOLO v4 and Faster R-CNN.

Obviously, for an attack, it is better that less area of the image are
perturbed while the attack effect doesn’t degenerate. Moreover, we empirically
observe that the importance of different pixels in an image or a patch varies
greatly for adversarial attacking. To this light, we try to find the pixels
which have the greatest importance for the attack, which we call key-pixels.
We propose a patch selection and refining scheme to gradually achieve this
goal since we learn that at the beginning of the training process, the key-
pixels are extremely difficult to be identified and would be changed when we
update the perturbations. Specifically, we adaptively find the patches for
attack based on the gradients and gradually remove the inconsequential pixels
in each patch until the attack process gets stable. Experiments show that our
proposed method is very effective and efficient, that is, it can decrease the
detection accuracy (i.e., mAP) of both YOLO v4 and Faster R-CNN to 0 within
only 2k training iterations. Besides, most recent works[4, 2] can only attack
a specific detector while our proposed ensemble RPAttack can attack YOLO v4[7]
and Faster R-CNN[8], i.e., two detectors with different architectures, at the
same time. Specifically, we balance the gradients of both detectors to avoid
over-optimizing one of them during the training phase. Figure 1 illustrates
one example, and one can observe that the perturbations for this example
generated by our proposed RPAttack are negligible while successfully fool both
two detectors, that is, no object has been detected by them. To sum up, the
contributions of this work are threefold:

  * •

We propose a novel method for attacking general object detectors and achieve
an amazing missed detection rate of 100% for both Yolo v4 and Faster R-CNN
while only modify 0.32% pixels on VOC 2007 test set.

  * •

We first propose a patch selection and refining scheme for finding key-pixels
dynamically and gradually remove the inconsequential perturbations.

  * •

We further propose ensemble attacks on YOLO v4 and Faster R-CNN simultaneously
by balancing the gradients of both detectors to avoid over-optimizing one of
them during the training phase.

##  2 Related Work

###  2.1 General Object Detection

In recent years, there has been great progress in the field of general object
detection. Deep learning methods[7, 8] have greatly improved the performance
in object detection. The mainstream methods based on deep learning can be
roughly divided into one-stage methods like YOLO[9] and two-stage methods like
Faster R-CNN[8].

In this paper, we attack two detectors, i.e., YOLO v4, and Faster R-CNN, which
are the most representative ones of one-stage detectors and two-stage
detectors respectively. Specifically, YOLO v4 regresses bounding boxes and
predicts the class probabilities directly after a single pass of input, while
Faster R-CNN first produces proposals with a region proposal network (RPN) and
then classifies and re-regresses these proposals with a detection head.

###  2.2 Adversarial Examples and Patches

The adversarial examples are first proposed in [10], revealing the
vulnerability of classification neural networks. Adversarial examples of
networks are the input data with deliberate perturbations. Although the
perturbations are too small to be noticeable by human eyes, it can
successfully mislead various deep learning-based models. [3] first advances
the adversarial patches, which can also fool the classification networks. The
previous works on adversarial patches mainly concentrate on classification
tasks, thus not suitable for the object detection task which needs to predict
the category and location of the object instances simultaneously. DPATCH[4]
proposes adversarial patches to disable object detectors, which can decrease
the mAP greatly on YOLO[9] and Faster R-CNN. However, the adversarial patches
produced by it are usually very large in size, which are inefficient and
noticeable for human eyes. DPAttack[6] designs a diffused patch of asteroid-
shaped or grid-shaped based on the detected results and pays more attention to
unsuccessfully attacked proposals. Object Hider[5] uses a heatmap-based and
consensus-based algorithm to select patches for the attack. Compared with
these two relevant works, our RPAttack can generate patches with much less
perturbation while achieving better attack performance.

Fig. 2: The pipeline of the proposd RPAttack.

##  3 Method

In this section, we introduce our RPAttack in detail. Firstly, we give the
problem formulation in Section 3.1. After that, the process of RPAttack is
presented in Section 3.2. Then, we describe a novel patch selection and
refining scheme in Section 3.3. Finally, in Section3.4, we discuss how to
balance the gradients from different detectors to stabilize the ensemble
attack.

###  3.1 Problem Formulation

In this work, we attack two detectors of different architectures, Faster R-CNN
and YOLO v4, and try to hide all the objects from these two detectors. One-
stage detectors like YOLO v4 directly regress the bounding boxes with the
confidence scores, and two-stage detectors like Faster R-CNN use RPN to get
bounding boxes of proposals with the confidence scores. We use ${b_{i},c_{i}}$
to denote the bounding box and the confidence score. Our goal is to hide all
the objects from these two detectors with the least perturbation, which can be
formulated as

$\displaystyle\min_{P^{j}}\sum_{j}^{m}\sum_{i}^{n}D_{i}(x_{j}+{{P^{j}}})+\sum_{j}^{m}Area(P^{j}),$
(1)

where $x_{j}$ is the $j$th image, $D_{i}(x)$ represents the bounding box
number of image $x$ detected by $i$th detector, ${P^{j}}$ is the perturbation
we add to the $j$th image, and $Area(P^{j})$ is the area of perturbation in
$j$th image.

###  3.2 Attack on General Object Detectors

In this section, we introduce the detailed attack process of our RPAttack. To
hide the objects from different detectors, we need to reduce the confidence
score $c_{i}$ of each bounding box. Based on this, we define the loss function
as:

$\displaystyle J(c)=-\frac{1}{k}\cdot\sum_{i}^{k}L(c_{i},0),$ (2)

where $L(\cdot,\cdot)$ is the Mean Square Error (MSE), $c_{i}$ is the
confidence score of $i$th bounding box.

Fig. 3: Illustration of the process to generate initial key-pixels.

We attack Faster R-CNN and YOLO v4 at the same time, and the whole attack
pipeline is shown in the Figure 2. Firstly, we input the image to two
detectors and get the bounding boxes with confidence scores. Then, we perform
an instance-level attack which means we can modify all pixels in the bounding
boxes. The gradient at one iteration does not reveal the location of key-
pixels accurately so we repeat instance-level attack until all detectors can
not detect any object for a stable and credible gradient heat map to find
initial key-pixels. Next, we attack the original image with the initial key-
pixels obtained from the cumulative gradient heat map. Then, we perform an
ensemble attack in which we adaptively find the most suitable location to
modify in every $A_{k}$ iteration and remove the inconsequential perturbations
when the attack gets stable. Finally, for generating less perturbed pixels, we
perform points-removal to further remove the perturbed pixels which have no
effect on the final results. After the above attack process, we can get an
adversarial image with much less perturbation and better performance.

Fig. 4: Illustration of the proposed patch selection and refining scheme.

The initial key-pixels are determined by the cumulative gradient, as shown in
Figure 3. Specifically, we divide each $H\times W$ instance box predicted from
the original image into an $\lceil H/m\rceil\times\lceil W/m\rceil$ grid of
cells(the size of each is $m\times m$). Then, we sum the absolute gradient
values in every cell of all instance boxes and select top $K$(we set $K$=5 in
our experiments) cells. As the adversarial patches of grid shape can
successfully attack an image with the least perturbed pixels area in our
experiments, we transfer the top $K$ cells to grid shaped ones and regard the
pixels on the grid lines as initial key-pixels.

Our RPAttack is based on the Iterative Fast Gradient Sign Method (I-FGSM)[11],
iteratively applies FGSM[12] with a small step size $\alpha$. Moreover, to
stabilize the ensemble attack process, we introduce extra parameters that
balance gradients of different detectors to I-FGSM, and the details are
presented in Section 3.4.

###  3.3 Patch Selection and Refining

To find key-pixels for attack and remove the inconsequential perturbations, we
propose a novel patch selection and refining scheme as Figure 4 shows.

Though we can get the initial location of key-pixels based on the cumulative
gradient heat map, the key-pixels will be changed when we update the
perturbations. Besides, the initial perturbations may not include all key-
pixels. An adaptive method is proposed to solve these problems, that is, we
add an adversarial patch to the image based on the current gradient in every
$A_{k}$ iterations. In this way, we can find the new key-pixels which are the
most suitable ones in the current iteration.

The pixels we modified are not all playing a key role in an attack. However,
removing some of them after the attack process may cause a decrease in attack
performance because other key-pixels haven’t been modified sufficiently.
Removing the inconsequential perturbation during the attack process and
keeping the attack process, can modify the remaining key-pixels sufficiently.
In our work, when the attack gets stable (the number of bounding boxes reaches
the minimum at least $D_{k}$ times), we remove the perturbations where the
value of pixels changed is less than the average changed value divided by 3.
We repeat the process until reaching the maximum number of iterations $I$.

Algorithm 1 Patch Selection and Refining Scheme

0: $A_{k}$(the frequency of adding perturbation), $D_{k}$(the threshold of
decreasing perturbation), $I$(maximum iterations), $P$(adversarial
perturbation), $x_{k}^{*}$(an adversarial image); $PN$(the number of patches),
$Attack$(attack method which returns new perturbations and the number of
bounding boxes), $MP$(max number of patches).

0: adversarial perturbation $P$

1: $state\\_add\Leftarrow false,state\\_decrease\Leftarrow false$

2: $a_{k},\Leftarrow 0,d_{k}\Leftarrow 0,min\\_bb\\_num\Leftarrow INF$

3: for each $i\in[1,I]$ do

4: $P,N\Leftarrow Attack(P,x_{k}^{*})$

5: if $N>0$ then

6: $a\\_k\Leftarrow a\\_k+1$

7: if $a_{k}\%A_{k}=0\ and\ PN<MP$ then

8: $P\Leftarrow add\ patch(P),PN\Leftarrow PN+1$

9: end if

10: end if

11: if $N<min\\_bb\\_num$ then

12: $min\\_bb\\_num\Leftarrow N$

13: end if

14: if $N=min\\_bb\\_num$ then

15: $d_{k}\Leftarrow d_{k}+1$

16: if $d_{k}\%D_{k}=0$ then

17: $state\\_decrease\Leftarrow true$

18: end if

19: if $state\\_decrease$ then

20: $P\Leftarrow decrease\ perturbation(P)$

21: end if

22: end if

23: end for

The details of the scheme can be referred to Algorithm 1. With the help of
this scheme, the key-pixels can be found adaptively, and inconsequential
perturbation can be removed. It not only greatly improves the performance of
our RPAttack but also generates much less perturbation than [4, 5, 6].

###  3.4 Stabilize Ensemble Attack

Most recent works can only attack a specific detector while our RPAttack aims
to attack YOLO v4 and Faster R-CNN simultaneously. However, the gradient
produced by each detector will affect the other. To stabilize the ensemble
attack and avoid over-optimizing a specific detector, we use the following
method to modify images,

$\displaystyle
x^{*}_{k+1}=x^{*}_{k}+\sum_{i=1}^{N}w_{i}\cdot\alpha\cdot\mathrm{sign}(\nabla_{x}J_{i}(x^{*}_{k},y))),$
(3) $\displaystyle w_{i}=max(1,D_{i}(x^{*})-D_{i}(x)),$ (4)

where $x^{*}_{k}$ is adversarial example in $k$th iteration, $J_{i}$ is the
loss function we use to attack $i$th detector, $\alpha$ is the updated step,
the weight $w_{i}$ is the parameter of balancing gradients and $D_{i}(x)$ is
the number of instances in $x$ detected by $i$th detector.

##  4 Experiment

In this section, we first describe the datasets as well as our implementation
details. Then we present experimental results of our RPAttack. Finally, we
conduct ablation studies to demonstrate the effectiveness of our methods in
detail.

Table 1: The RPAttack Results on VOC2007. $Y\overline{BS}$ and $F\overline{BS}$ denote the $\overline{BS}$ of attacking YOLO v4 and Faster R-CNN respectively.. Methods | $\overline{AS}$ |  Y $\overline{BS}$ |  F $\overline{BS}$ | $\overline{OS}$ | mAP
---|---|---|---|---|---
RPAttack | 1.776 | 1.000 | 1.000 | 3.553 | 0.00
RPAttack+points-removal | 1.839 | 1.000 | 1.000 | 3.679 | 0.00
Table 2: Comparison on Ali-Attack-Data, RPAttack($<=$10) means we limit the number of perturbed regions to no more than 10. $Y\overline{OS}$ and $F\overline{OS}$ denote the $\overline{OS}$ of attacking YOLO v4 and Faster R-CNN respectively. Methods |  Y $\overline{OS}$ |  F $\overline{OS}$ | $\overline{OS}$
---|---|---|---
Object Hider[5] | - | - | 2.760
DPAttack[6] | 1.563 | 1.436 | 2.999
RPAttack($<=$10) | 1.615 | 1.512 | 3.127
RPAttack($<=$10)+points-removal | 1.627 | 1.522 | 3.149
RPAttack | 1.723 | 1.721 | 3.444
RPAttack+points-removal | 1.789 | 1.784 | 3.573
Table 3: Detailed comparison of CAP, DPATCH, and RPAttack on VOC 2007 test
set. All methods attack Faster R-CNN with ResNet101.

Methods | aero | bike | bird | boat | bottle | bus | car | cat | chair | cow | table | dog | horse | mbike | person | plant | sheep | sofa | train | tv
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---
No Patch | 88.80 | 84.60 | 84.80 | 71.00 | 80.40 | 88.70 | 83.20 | 87.20 | 67.60 | 87.80 | 67.00 | 85.00 | 89.00 | 87.40 | 87.00 | 57.00 | 87.40 | 79.00 | 85.50 | 84.70
CAP[2] | 0.00 | 9.10 | 0.00 | 0.00 | 0.00 | 0.00 | 1.50 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 3.00 | 9.10 | 0.00 | 0.00 | 0.00 | 9.10 | 0.00
DPATCH[4] | 0.02 | 0.00 | 0.00 | 0.00 | 0.00 | 0.53 | 0.08 | 0.61 | 0.00 | 0.02 | 0.00 | 9.09 | 0.16 | 0.00 | 9.09 | 0.16 | 0.00 | 9.09 | 0.00 | 0.00
RPAttack(ours) | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00

###  4.1 Datasets and Implementation Details

We use two datasets in our experiments: VOC2007[13] test set, and the dataset
in Alibaba-Tsinghua Adversarial Challenge on Object Detection which sample
1000 images from MS COCO 2017 test set[14]. We call the latter Ali-Attack-Data
for simplicity. As for the parameter setting of our method, we set the maximum
iteration number $I=2k$ for VOC2007 and $I=4k$ for Ali-Attack-Data, the
frequency of adding perturbation $A_{k}=100$, the threshold of decreasing
perturbation $D_{k}=25$, the size of the patch is 70*70, the $P_{limit}$ is
0.02 and the backbone of Faster R-CNN is ResNet101.

In order to clearly show the performance of our algorithm, we introduce the
following metrics:

$\displaystyle
AS=\begin{cases}\sum_{j}^{m}(2-\frac{{P^{j}}_{rate}}{P_{limit}}),&{P^{j}}_{rate}\leq
P_{limit},\\\ 0,&\text{otherwise,}\\\ \end{cases}$ (5) $\displaystyle
BS=\sum_{j}^{m}\sum_{i}^{n}max(D_{i}(x_{j})-D_{i}(x_{j}+{P^{j}}),0),$ (6)
$\displaystyle OS=\sum_{j}^{m}\sum_{i}^{n}AS_{j}\cdot BS_{ij},$ (7)

where $P_{limit}$ is the upper bound of the perturbation rate,
${P^{j}}_{rate}$ is the perturbation rate in $j$th adversarial image. AS shows
the area score of perturbation. Specially, if the ${P^{j}}_{rate}>P_{limit}$,
$AS_{j}=0$. BS is the difference between the number of bounding boxes
predicted in original images and in adversarial images. OS shows the overall
performance. Obviously, to achieve a high socre of $OS$, we need to add less
perturbation while decrease more bounding boxes. Due to the different size of
datasets, we use $\overline{AS}$, $\overline{BS}$ and $\overline{OS}$ to
represent the average score per image in our results. Besides, to compare with
some previous works, the decrease of $mAP$ is also used as an evaluation
metric.

###  4.2 The Results of RPAttack

We show the results of RPAttack on VOC 2007 test set in Table 1. Our RPAttack
can hide all objects from YOLO v4 and Faster R-CNN but only modify
0.45%(average) pixels on VOC 2007 test set. After points-removal, the rate of
modified pixels can drop to 0.32%. These results reveal that modifying very
few pixels can disable the SOTA detectors completely. Obviously, all objects
are hidden so mAP drops from 81.7 to 0.

We noticed that some recent patch-based works[5, 6] are also dedicated to
decreasing the area of perturbation. They use clever strategies and achieve
good performance in Ali-Attack-Data. These two works have the same task as
ours but limit the connected regions of perturbed pixels to no more than 10.
To compare with these works fairly, we follow their experimental settings and
also limit the number of connected perturbed regions generated by our RPAttack
to no more than 10. Despite adding such constraint, the experimental results
show that the proposed RPAttack performs better and generates less
perturbation compared with [5, 6], as shown in Table 2. Moreover, if we remove
this constraint, we can achieve even more exciting results that we
successfully hide 99.9% objects from YOLO v4 and 99.6% objects from Faster
R-CNN with only 0.42% perturbation.

DPATCH[4] and CAP[2] are representative patch-based and full-image-based
attacks, respectively. The task of these methods is minimizing mAP by add
patch-based or full-image-based perturbation. Any change in category or
bounding box will cause the mAP to drop, making the task very simple compared
to ours(hiding all objects). Hiding the objects will lead the detectors
outputs nothing, which can decrease mAP though it is not our major goal. We
are excited to discover that compared to DPATCH[4] and CAP[2], we can decrease
mAP even more as Table 3 shows.

###  4.3 Ablation Study

Table 4: Ablation Study on VOC2007 test set (unconstrained) Random Location | $\surd$ |  |  |  |  |
---|---|---|---|---|---|---
Center BBOX Location |  | $\surd$ |  |  |  |
Gradient-based Location |  |  | $\surd$ | $\surd$ | $\surd$ | $\surd$
Patch Selection and Refining |  |  |  | $\surd$ |  | $\surd$
Stabilizing gradient |  |  |  |  | $\surd$ | $\surd$
Y $\overline{BS}$ | 0.985 | 0.980 | 0.943 | 1.000 | 0.952 | 1.000
F $\overline{BS}$ | 0.877 | 0.729 | 0.892 | 1.000 | 0.896 | 1.000
$\overline{AS}$ | 1.000 | 1.000 | 1.000 | 1.834 | 1.000 | 1.835
$\overline{OS}$ | 1.862 | 1.709 | 1.835 | 3.670 | 1.848 | 3.671
Table 5: Ablation Study on VOC2007 test set (constrained) Random Location | $\surd$ |  |  |  |  |
---|---|---|---|---|---|---
Center BBOX Location |  | $\surd$ |  |  |  |
Gradient-based Location |  |  | $\surd$ | $\surd$ | $\surd$ | $\surd$
Patch Selection and Refining |  |  |  | $\surd$ |  | $\surd$
Stabilizing gradient |  |  |  |  | $\surd$ | $\surd$
Y $\overline{BS}$ | 0.874 | 0.987 | 0.989 | 0.996 | 0.999 | 0.997
F $\overline{BS}$ | 0.604 | 0.816 | 0.950 | 0.983 | 0.950 | 0.984
$\overline{AS}$ | 1.000 | 1.000 | 1.000 | 1.689 | 1.000 | 1.692
$\overline{OS}$ | 1.478 | 1.803 | 1.939 | 3.348 | 1.949 | 3.351

In this section, we demonstrate the effectiveness of our methods under both
unconstrained and constrained conditions on VOC2007 test set(only using the
images with the category of sheep) and report the results in Table 4 and 5.
For these two cases, we use two baselines: randomly selecting 2% of the
perturbed pixels and selecting the perturbations in the center of the instance
boxes.

For the case without the constraint about the number of the connected
perturbed regions, whether the initial locations of perturbations are
selected, the final results are not much different. This also proves that key-
pixels cannot be accurately found at the beginning of the attack process. On
the contrary, our patch selection and refining scheme improves the performance
and removes the inconsequential perturbations gradually which greatly improves
the OS. Moreover, stabilizing gradient in an unconstrained condition also
slightly improves the OS. Further, using both of them can hide 100% objects
from YOLO v4 and Faster R-CNN.

As for the case with the constraint about the number of the connected
perturbed regions, the adversarial patches determined by gradient heat map
achieve better performance, especially when attacking Faster R-CNN. Moreover,
the proposed scheme and stabilizing gradient all improve BS and the former
also removes a lot of inefficient perturbation. Combining them can hide 99.7%
objects from YOLO v4 and 98.4% objects from Faster R-CNN within 10 patches.
These results further demonstrate the effectiveness of the proposed method.

##  5 Conclusion

In this paper, we propose a novel refined patch-based attack method named
RPAttack on general object detectors which can generate patches with much less
perturbation, performs better than other works. In order to find the key-
pixels for attack and remove inconsequential perturbation, we introduce a
novel patch selection and refining scheme. To our knowledge, this is the first
method to select key-pixels based on gradient adaptively. For a stable
ensemble attack, we balance the gradients from detectors with different
architectures to avoid over-optimizing one of them. Our RPAttack can achieve
an amazing missed detection rate of 100% for both Yolo v4 and Faster R-CNN,
while only modifies 0.32% pixels on VOC 2007 test set. The experimental
results show the deep learning based detectors are extremely vulnerable to the
adversarial patch attack, even if only very few pixels are modified. We hope
our work can arouse more attention to the potential threats of the adversarial
patch attack.

## References

  * [1] Cihang Xie, Jianyu Wang, Zhishuai Zhang, Yuyin Zhou, Lingxi Xie, and Alan L. Yuille,  “Adversarial examples for semantic segmentation and object detection,”  in IEEE International Conference on Computer Vision, ICCV 2017, Venice, Italy, October 22-29, 2017. 2017, pp. 1378–1387, IEEE Computer Society.
  * [2] Hantao Zhang, Wengang Zhou, and Houqiang Li,  “Contextual adversarial attacks for object detection,”  in IEEE International Conference on Multimedia and Expo, ICME 2020, London, UK, July 6-10, 2020. 2020, pp. 1–6, IEEE.
  * [3] Tom B. Brown, Dandelion Mané, Aurko Roy, Martín Abadi, and Justin Gilmer,  “Adversarial patch,”  CoRR, vol. abs/1712.09665, 2017.
  * [4] Xin Liu, Huanrui Yang, Ziwei Liu, Linghao Song, Yiran Chen, and Hai Li,  “DPATCH: an adversarial patch attack on object detectors,”  in Workshop on Artificial Intelligence Safety 2019 co-located with the Thirty-Third AAAI Conference on Artificial Intelligence 2019 (AAAI-19), Honolulu, Hawaii, January 27, 2019. 2019, vol. 2301 of CEUR Workshop Proceedings, CEUR-WS.org.
  * [5] Yusheng Zhao, Huanqian Yan, and Xingxing Wei,  “Object hider: Adversarial patch attack against object detectors,”  CoRR, vol. abs/2010.14974, 2020.
  * [6] Shudeng Wu, Tao Dai, and Shu-Tao Xia,  “Dpattack: Diffused patch attacks against universal object detection,”  CoRR, vol. abs/2010.11679, 2020.
  * [7] Alexey Bochkovskiy, Chien-Yao Wang, and Hong-Yuan Mark Liao,  “Yolov4: Optimal speed and accuracy of object detection,”  CoRR, vol. abs/2004.10934, 2020.
  * [8] Shaoqing Ren, Kaiming He, Ross B. Girshick, and Jian Sun,  “Faster R-CNN: towards real-time object detection with region proposal networks,”  IEEE Trans. Pattern Anal. Mach. Intell., vol. 39, no. 6, pp. 1137–1149, 2017.
  * [9] Joseph Redmon, Santosh Kumar Divvala, Ross B. Girshick, and Ali Farhadi,  “You only look once: Unified, real-time object detection,”  in 2016 IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2016, Las Vegas, NV, USA, June 27-30, 2016. 2016, pp. 779–788, IEEE Computer Society.
  * [10] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfellow, and Rob Fergus,  “Intriguing properties of neural networks,”  in 2nd International Conference on Learning Representations, ICLR 2014, Banff, AB, Canada, April 14-16, 2014, Conference Track Proceedings, Yoshua Bengio and Yann LeCun, Eds., 2014.
  * [11] Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio,  “Adversarial examples in the physical world,”  in 5th International Conference on Learning Representations, ICLR 2017, Toulon, France, April 24-26, 2017, Workshop Track Proceedings. 2017, OpenReview.net.
  * [12] Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy,  “Explaining and harnessing adversarial examples,”  in 3rd International Conference on Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceedings, 2015.
  * [13] M. Everingham, L. Van Gool, C. K. I. Williams, J. Winn, and A. Zisserman,  “The pascal visual object classes (voc) challenge,”  International Journal of Computer Vision, vol. 88, no. 2, pp. 303–338, June 2010.
  * [14] Tsung-Yi Lin, Michael Maire, Serge J. Belongie, Lubomir D. Bourdev, Ross B. Girshick, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C. Lawrence Zitnick,  “Microsoft COCO: common objects in context,”  CoRR, vol. abs/1405.0312, 2014.


#  Cornet: Learning Spreadsheet Formatting Rules By Example

Mukul Singh  MicrosoftDelhiIndia43017-6221<EMAIL_ADDRESS>,  José
Cambronero Sanchez  MicrosoftRedmondUSA<EMAIL_ADDRESS>,  Sumit
Gulwani  MicrosoftRedmondUSA<EMAIL_ADDRESS>,  Vu Le
MicrosoftRedmondUSA<EMAIL_ADDRESS>,  Carina Negreanu  Microsoft
ResearchCambridgeUK<EMAIL_ADDRESS>and  Gust Verbruggen
MicrosoftRedmondUSA<EMAIL_ADDRESS>
###### Abstract.

Data management and analysis tasks are often carried out using spreadsheet
software. A popular feature in most spreadsheet platforms is the ability to
define data-dependent formatting rules. These rules can express actions such
as _“color red all entries in a column that are negative”_ or _“bold all rows
not containing error or failure”_. Unfortunately, users who want to exercise
this functionality need to manually write these conditional formatting (CF)
rules. We introduce Cornet, a system that automatically learns such
conditional formatting rules from user examples. Cornet takes inspiration from
inductive program synthesis and combines symbolic rule enumeration, based on
semi-supervised clustering and iterative decision tree learning, with a neural
ranker to produce accurate conditional formatting rules. In this
demonstration, we show Cornet in action as a simple add-in to Microsoft’s
Excel. After the user provides one or two formatted cells as examples, Cornet
generates formatting rule suggestions for the user to apply to the
spreadsheet.

PVLDB Reference Format:
PVLDB, 16(12): 4058 - 4061, 2023.
doi:10.14778/3611540.3611620 ††This work is licensed under the Creative
Commons BY-NC-ND 4.0 International License. Visit
https://creativecommons.org/licenses/by-nc-nd/4.0/ to view a copy of this
license. For any use beyond those covered by this license, obtain permission
by emailing<EMAIL_ADDRESS>Copyright is held by the owner/author(s).
Publication rights licensed to the VLDB Endowment.
Proceedings of the VLDB Endowment, Vol. 16, No. 12 ISSN 2150-8097.
doi:10.14778/3611540.3611620

##  1\. Introduction

Millions of users (N., 2022) perform their data management and analysis in
spreadsheet software. Most popular spreadsheet platforms, such as Microsoft’s
Excel, allow users to define data-dependent formatting rules. These rules can
express actions such as _“color red all entries in a column that are
negative”_ or _“bold all rows not containing error or failure”_. These rules
are typically called _conditional formatting rules_ (CF rules). Unfortunately,
users have to write conditional formatting rules manually, which requires both
programming expertise and familiarity with the particular data platform and
its rule language.

A search on the Excel tech help community (Microsoft, 2022) reveals more than
10,000 questions on conditional formatting as of March 2023. We find that
these posts tend to share three key struggles, preventing users from
effectively using conditional formatting. First, many users are unaware of CF
rules and instead manually format their spreadsheets. Second, when a user does
enter a CF rule, they can fail to do so correctly (because of invalid syntax
or incorrect logic) and end up manually formatting the sheet. Third, even when
a user writes a valid rule that matches their desired formatting, these rules
can be unnecessarily complex (and candidates for simplification) or not
generalizable (may deviate from the desired behavior when data in the column
changes or new data is added to the column).

Figure 1. Example of an incorrect CF rule manually written by a user.
\raisebox{-0.8pt}{1}⃝ A user defined a custom rule that always evaluates to
false (as it compares the cell contents to the string “5” instead of the
numeric literal 5). \raisebox{-0.8pt}{2}⃝ Because the rule does not format any
cell, the user had to manually format the sheet as reflected in this figure.
\raisebox{-0.8pt}{3}⃝ The correct CF rule, which can be learned by Cornet from
2 examples.  Figure 2. Cornet’s architecture illustrated through an example
case: \raisebox{-0.8pt}{0}⃝ input table with a single user example (partial
formatting), \raisebox{-0.8pt}{1}⃝ predicate generation for all cells in the
table, \raisebox{-0.8pt}{2}⃝ semi-supervised clustering using examples and
positional information to address the challenge of unlabeled cells,
\raisebox{-0.8pt}{3}⃝ enumerating rules over the clustered column using
multiple decision trees, \raisebox{-0.8pt}{4}⃝ neural ranker to score
generated rules, and \raisebox{-0.8pt}{5}⃝ final learned conditional
formatting rule.

Some of these struggles are reinforced by the need to write custom formulas.
For example, in Excel CF rules that require logical operations like or and and
must be written as custom formulas. Additionally, there is no validation for
data types in the standard CF interface, causing surprising results. For
example, a rule can (incorrectly) compare a text column to a numeric constant.

###### Example 1.1.

Figure 1 shows a public spreadsheet where the user wanted to highlight cells
with value less than 5. Unfortunately, they wrote a rule that incorrectly uses
the string “5” instead of the number. Ultimately, they manually formatted the
sheet.

In this paper we present a demonstration of Cornet 111The full paper can be
accessed at https://arxiv.org/abs/2208.06032. (Conditional ORNamentation by
Examples in Tables), a system that allows users to automatically generate a
conditional formatting rule from examples, thus mitigating the challenges
previously outlined. Cornet takes a small number of user formatted cells as
input to learn the most likely formatting rule that generalizes to other
cells. Cornet explores possible predicates for the target column, hypothesizes
cell grouping via semi-supervised clustering and then learns candidate rules
by employing an iterative tree learning procedure. Since multiple rules may
result from this procedure, we train a neural ranker to return the most likely
CF rule, given the spreadsheet data, user examples, and candidate rules’
execution on the data.

###### Example 1.2.

Consider the example shown in Figure 2, the user wants to color all IDs that
start with ”GW” but don’t contain ”-F” or ”-T” at the end. To accomplish this
via the Microsoft Excel GUI, the user will have to navigate 2 dialog boxes, 3
dropdown menus, perform 9 clicks, and then write the Excel formula
AND(LEFT(A2,2)="GW", NOT(OR(RIGHT(A2,2)="-F", RIGHT(A2
,2)="-T"))). With Cornet, the user can simply color the fourth cell in Figure
2 \raisebox{-0.8pt}{0}⃝, and Cornet learns and applies the correct rule.

In our demonstration, we will show an implementation of a lightweight
interface in Microsoft Excel that exercises Cornet and can successfully learn
the rule in Example 1.2 and more complex scenarios. Our interface first allows
users to provide one or two examples of their desired formatting. 222Text
rules can be learnt accurately by providing just one or two examples. Numeric
columns typically require more examples because of their large search space.
They can then invoke Cornet, which will learn a symbolic rule that covers the
examples and generalizes to the rest of the column. Finally, Cornet applies
the rule learned to format the spreadsheet. We show how both novice and
experienced spreadsheet users can use Cornet.

In the remainder of this paper, we present a high-level description of Cornet
and provide an outline of our proposed demonstration.

Figure 3. The Cornet user interface. \raisebox{-0.8pt}{1}⃝ Spreadsheet in
Excel where the user has formatted a few cells as examples.
\raisebox{-0.8pt}{2}⃝ Cornet UI in Excel ribbon as an Add-In listed under tab
named Smart Format. Learn and Apply learns and applies the top rule on the
selected column. \raisebox{-0.8pt}{3}⃝ Detect Formatting lists the top 3 rules
for the current column. \raisebox{-0.8pt}{4}⃝ The final sheet after applying
the rules.

##  2\. Solution Sketch

A core challenge in Cornet is to learn from few user-provided examples—often
just one. Traditional programming-by-example (PBE) systems (Gulwani, 2011; Le
and Gulwani, 2014) can carry out an efficient search because they can derive
constraints by relating the inputs and outputs for their task. In conditional
formatting, however, the output provides a relatively weak binary signal
(whether a row is formatted or not). The design of Cornet is meant to mitigate
this challenge by \raisebox{-0.8pt}{1}⃝ generating predicates that
characterize values in the target formatting column, \raisebox{-0.8pt}{2}⃝
hypothesizing labels for the entire column by clustering over the generated
predicates, \raisebox{-0.8pt}{3}⃝ synthesizing many rules that satisfy the
hypothesized groups, and \raisebox{-0.8pt}{4}⃝ using a dedicated ranker that
furthers refines the likelihood of generated rules. Figure 2 shows an overview
of these steps, which we describe in following sections.

###  2.1. Predicate Generation

Cornet computes properties of cell values in the form of boolean predicates—a
boolean-valued function that takes a cell $c$, zero or more arguments and
returns true if the property that it describes holds for $c$. To avoid type
errors, all predicates are assigned a type $t$ and they only match cells of
their type. Mixed-type columns are assigned _Text_ type. We chose predicates,
shown in Table 1, based on the operations supported by popular spreadsheet
platforms.

Table 1. Supported predicates and their arguments for each data type. $c$ corresponds to a cell value, $n$ is a numeric literal, $d$ is a datetime literal, and $s$ is a string literal. Cornet uses type-specific generators to instantiate $n$, $d$, and $s$, as necessary. Numeric | Datetime | Text
---|---|---
greater($c$, $n$) | greater($c$, $n$, $d$) | equals($c$, $s$)
greaterEquals($c$, $n$) | greaterEquals($c$, $n$, $d$) | contains($c$, $s$)
less($c$, $n$) | less($c$, $n$, $d$) | startsWith($c$, $s$)
lessEquals($c$, $n$) | lessEquals($c$, $n$, $d$) | endsWith($c$, $s$)
between($c$, $n_{1}$, $n_{2}$) | between($c$, $n_{1}$, $n_{2}$, $d$) |

Given a column of cells and a predicate, the goal is to initialize each
additional argument to a constant value such that the predicate returns true
for a strict subset of the column. We use different generators for each
predicate type. For example, contains uses tokens obtained by splitting on
non-alphanumeric delimiters and also tokens from a prefix trie. For numeric
predicates, constants are generated from cell values, column statistics (mean,
percentiles, min, max) and popular constants (0, 1, 100). These predicates are
then used for both clustering and constructing formatting rules. We generate
these predicates only for the column the user is currently formatting to
prevent the predicate space from exploding.

###  2.2. Semi-supervised Clustering

Because the user has provided few examples, rule generation at this stage
would only reflect the properties of these positive examples, but may not
generalize to the full column. To address this shortcoming, we first predict
the expected output of the rule on the remainder of the unformatted cells. We
exploit positional information to constrain this problem: we assume users
annotated their column top-down. Any cells above (and between) formatted
examples are intended to have no formatting, while any cells after the last
formatted example are true unassigned cells.

We perform iterative clustering over our predicates to produce $k$ clusters,
where $k$ is the number of unique formats in the column plus one cluster for
unassigned cells. Formatted examples and intentionally unformatted rows are
never reassigned. Unassigned cells are reassigned at each iteration based on
the sum of minimum and maximum distance to any cluster element, where distance
is computed as the symmetric difference between sets of predicates.

###  2.3. Candidate Rule Enumeration

Cornet supports rules that can be built as a propositional formula in
disjunctive normal form over predicates. In other words, every rule is of the
form

$\boldsymbol{\left(\right.}p_{1}(c)\wedge
p_{2}(c)\wedge\ldots\boldsymbol{\left.\right)}\vee\boldsymbol{\left(\right.}p_{j}(c)\wedge
p_{j+1}(c)\wedge\ldots\boldsymbol{\left.\right)}\vee\ldots$

with $p_{i}$ a generated predicate or its negation. Our goal is to strike a
balance between expressiveness and simplicity.

We greedily enumerate promising candidates by iteratively learning decision
trees, which use our predicates as features to classify cells into the
groupings produced by our semi-supervised clustering. Each decision tree then
corresponds to a rule in disjunctive normal form (Blockeel and De Raedt,
1998). We identify and address three challenges: variety in rules, simplicity
of rules, and coping with noisy labels. To ensure variety, the root feature is
removed from the set of candidate splits after each iteration. To ensure
simplicity, we only accept decision trees with $\lambda_{n}$ or fewer nodes
($\lambda_{n}$=10 as a default). To deal with noisy labels, we only require
decision trees to have perfect accuracy on user examples. In our greedy tree
learning approach we consider labeled cells to be twice as important as
unlabeled ones and we stop learning rules once accuracy falls below
$\lambda_{t}$ ($\lambda_{t}=0.8$ as a default).

###  2.4. Candidate Rule Ranking

Because the rule learning step by construction produces multiple candidate
rules, Cornet reorders candidates and returns the top rule to the user. To
perform this ranking, Cornet uses a neural ranker that considers, features of
the data, the rule execution on that data (Natarajan et al., 2019) and
intrinsic properties of the rule (Ellis and Gulwani, 2017), such as what
predicates and literals are used. Information about the column is captured by
turning the column data into a sequence of words and using a pre-trained
language model (Devlin et al., 2019) to obtain cell-level embeddings. These
embeddings are augmented with information about the execution of the rule
through cross-attention (Lee et al., 2018). Information about the rule is
captured by handpicked features. We then concatenate the vectors of handpicked
features and the vector capturing the column data and rule execution. Finally,
we learn a linear weight vector to reduce this feature vector to a single
ranking score. 333We also designed a heuristic based symbolic ranker that
performs slightly worse than the neural ranker. More details about the
symbolic ranker are included in full paper.

##  3\. Demonstration

The participants can use Cornet on any workbook of their choice. For this
demonstration we use the Work Orders workbook from a public internet tutorial
(Excel, 2023). The dataset contains information about work orders for a
hypothetical services company. The data has 1000 rows and 22 attributes
including order ID, district, number of technicians, service date and service
type. We implemented a simple add-in for Microsoft Excel (called _Smart
Format_) to demonstrate Cornet. Figures 3 and 4 show a screenshot of this add-
in.

We will demonstrate two scenarios: a workflow where the user requests a rule
from Cornet after providing a few formatting examples, and a workflow where
Cornet, running in the background, can hand-raise and suggest a rule without
prompting. The two workflows are designed to address different users’ Excel
expertise. An experienced user performing sophisticated formatting tasks might
prefer selecting rules themselves, exerting more influence over Cornet. A
novice user, on the other hand, might be unaware of CF and benefit from
proactive suggestions for feature discovery.

###  3.1. User Requested Suggestion

For this demonstration, we will guide the participants through four steps. We
use Figure 3 to guide the demonstration.

Step \raisebox{-0.8pt}{1}⃝ (Providing Examples): The user colors a few cells
as examples for each column that needs to be formatted. For our scenario, the
user wants to format ID, District, Service and Rush column, so they color one
cell in each such column. Their intent for each column is as follows:

  1. (1)

_Service_ – Fill yellow for all services that are delivery related.

  2. (2)

_WO_ – IDs starting with “G” or “AN” and not ending with “T”.

  3. (3)

_District_ – Bold and fill green for North and South districts.

  4. (4)

_Rush_ – Fill magenta for missing value cells denoted by ”_”.

Step \raisebox{-0.8pt}{2}⃝ (Learning Formatting Rules): To learn and apply
rules, the user has 2 options. (1) The user can select which rule to apply by
clicking on “Detect Formatting” which opens a drop-down list of the top 3
rules that Cornet learned for the column that is currently active. (2) The
user can also choose to directly learn and apply the top ranked rule by
selecting the desired columns and clicking “Learn and Apply”. Option (2)
allows for an in-context experience, as it can be triggered via a keyboard
hotkey (Ctrl+Shift+O).

Step \raisebox{-0.8pt}{4}⃝ (Updating Rules): Like with other PBE systems, the
user can improve the rules learned by Cornet by providing more examples. For
example, the user can give one example and learn the rule and if it is
incorrect, the user can uncolor some cells or color new cells and relearn the
rule. For this demonstration, lets consider the user wants to also color cells
starting with ”AN” in the _WO_ column. The user colors the second cell
(”AN47603-F”) and then detects formatting rule. The user can now choose
AND(OR(Begins("GW"),Begins("AN")),NOT(EndsWith("T"))). 444The user can also
manually update the rule from the Conditional Formatting menu.

Figure 4. Interactive formatting rule suggestion by Cornet. The user edits the
spreadsheet as usual and Cornet learns rules in the background, surfacing them
after three examples have been provided. Cornet can help users who are unaware
of conditional formatting rules in spreadsheet platforms.

###  3.2. Background Suggestion

We now describe the hand-raise workflow of Cornet where the user edits the
spreadsheet as normal and Cornet proactively suggests the top-ranked
formatting rule to the user. This workflow can help novice users who may be
unfamiliar with Cornet or conditional formatting in general. For this
demonstration, we will guide the participants through three steps that
exercise this proactive workflow. We use Figure 4 to guide the demonstration.

Step \raisebox{-0.8pt}{1}⃝ (Opening Reference Data): Similar to the first
demonstration, the user opens the desired workbook in Excel. For this
demonstration, we use the same Work Orders workbook as before.

Step \raisebox{-0.8pt}{2}⃝ (Normal Editing): The user edits the spreadsheet to
format the _District_ column based on the intent described earlier. In this
scenario, the user wants to format “North” and “South” districts. The user
starts editing the sheet and formats the first 2 cells in the district column
that are either “North” or “South”.

Step \raisebox{-0.8pt}{3}⃝ (Rule Suggestion): Cornet can learn rules in the
background as users are normally editing their spreadsheet. After three
examples, Cornet is able to learn a rule in the background and can suggest
this to the user, as shown in Figure 4, without any prompting from their end.
Similarly to the prior scenario, the user can then decide to either accept the
suggested rule, modify parameters, or give more examples to learn a better
rule. The user accepts this rule and its application automatically formats the
entire column as intended.

## References

  * (1)
  * Blockeel and De Raedt (1998) Hendrik Blockeel and Luc De Raedt. 1998.  Top-down induction of first-order logical decision trees.  _Artificial intelligence_ 101, 1-2 (1998), 285–297.
  * Devlin et al. (2019) Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2019.  BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding. In _Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics_. Association for Computational Linguistics, 4171–4186.  https://doi.org/10.18653/v1/n19-1423
  * Ellis and Gulwani (2017) Kevin Ellis and Sumit Gulwani. 2017.  Learning to Learn Programs from Examples: Going Beyond Program Structure. In _IJCAI 2017_ (ijcai 2017 ed.).  https://www.microsoft.com/en-us/research/publication/learning-learn-programs-examples-going-beyond-program-structure/
  * Excel (2023) Microsoft Excel. 2023\.  Sample Excel Wrkbooks.  https://www.contextures.com/xlsampledata01.html#wos.  Last Accessed: 2023-03-24.
  * Gulwani (2011) Sumit Gulwani. 2011\.  Automating String Processing in Spreadsheets using Input-Output Examples. In _PoPL’11, January 26-28, 2011, Austin, Texas, USA_.  https://www.microsoft.com/en-us/research/publication/automating-string-processing-spreadsheets-using-input-output-examples/
  * Le and Gulwani (2014) Vu Le and Sumit Gulwani. 2014.  FlashExtract: a framework for data extraction by examples. In _Programming Language Design and Implementation_. ACM, 542–553.
  * Lee et al. (2018) Kuang-Huei Lee, Xi Chen, Gang Hua, Houdong Hu, and Xiaodong He. 2018.  Stacked Cross Attention for Image-Text Matching. In _Computer Vision – ECCV 2018_ , Vittorio Ferrari, Martial Hebert, Cristian Sminchisescu, and Yair Weiss (Eds.). Springer International Publishing, Cham, 212–228.
  * Microsoft (2022) Microsoft. 2022\.  Excel Help Forum.  techcommunity.microsoft.com/t5/forums/searchpage/tab/message?q=conditional%20formatting.  Accessed: 2022-06-30.
  * N. (2022) Joseph N. 2022.  Number of Google Sheets and Excel Users Worldwide.  https://askwonder.com/research/number-google-sheets-users-worldwide-eoskdoxav.  Last Accessed: 2022-07-30.
  * Natarajan et al. (2019) N Natarajan, D Simmons, N Datha, P Jain, and S Gulwani. 2019.  Learning Natural Programs from a Few Examples in Real-Time. In _AIStats_.  https://www.microsoft.com/en-us/research/uploads/prod/2019/01/AIStats19.pdf