text:
\section{Appendix}

\subsection{Importance of Speed: Adversarial Training for Large Scale Learning}

As discussed in the introduction, one of the motivations
of using adversarial attacks is that multiple recent studies have shown superior results when adversarial data
is injected during training~\cite{robust,sankaranarayanan2017regularizing,yao2018hessian,yao2018large}.
However, the overhead of computing an adversarial noise needs to be small, specially for large
scale training.
Here, the speed with which the adversarial noise is computed becomes important, so as not
to slow down the training time significantly.
To illustrate the efficiency of TR attacks, we
perform adversarial training using the Adaptive Batch Size Adversarial Training (ABSA) method introduced by~\cite{yao2018hessian,yao2018large} for large scale training.
We test ResNet-18 on Cifar-10 which achieves a baseline accuracy of $\bf83.50\%$ (with a batch size of 128 using the setup as in~\cite{yao2018large}).
If we use the TR $L_\infty$ attack, the final accuracy increases to $\bf87.79\%$ (actually
for the hardest with batch size of 16K).
If we instead use FGSM, the final accuracy only increases to $\bf84.32\%$ (for the same batch size of 16K).
It is important to note that it is computationally infeasible to use CW in this sort of training, as it is about $15\times$  slower than TR/FGSM.
This result shows that a stronger attack that is fast may be very useful for adversarial training.
We emphasize that the goal of this test is simply to illustrate the importance of a fast and stronger adversarial attack, which could make TR to be a useful tool for adversarial training research.  More thorough testing (left for future work) is required to understand how stronger attacks such as TR could be used in the context of adversarial training.

\subsection{Visual Examples}
Here we provide more visual examples for different neural networks on ImageNet.
We show the original image along with adversarially perturbed ones using the
three methods of DeepFool, CW, and ours (TR). We also provide
two heat maps for the adversarial perturbations. The first one is calibrated
based on DeepFool's maximum perturbation magnitude, and the second one is calibrated for each of the individual method's maximum perturbation.
This allows a better visualization of the adversarial perturbation of each method.

\begin{figure*}[!b]
\centering
\includegraphics[width=0.5\textwidth]{figures/cifar_average.pdf}\\
\includegraphics[width=0.5\textwidth]{figures/cifar_worst.pdf}
\caption{ The figures show various neural networks, the corresponding
time to compute the adversarial attack (x-axis) and the perturbations a particular
attack method needs to fool an image (detailed results in~\tref{tab:cifar}).
The results are obtained for the Cifar-10 dataset (for ImageNet results please see~\fref{f:efficient}).
On the
left we report the average perturbation
and on the right we report the worst perturbation.
In particular,  different colors represent different models, and different markers
illustrate the different attack methods.
Notice that, our TR and TR Adap achieve similar perturbations as CW but with
significantly less time (up to $\bf14.5\btimes$).
}
\label{f:efficient_cifar}
\end{figure*}

\begin{figure*}[!htbp]
\centering
\includegraphics[width=0.9\textwidth, trim={5cm 1.7cm 2cm 1.7cm},clip]{resnet/135png.png}\\
\includegraphics[width=0.9\textwidth, trim={5cm 1.7cm 2cm 1.7cm},clip]{resnet/150png.png}
\caption{ ResNet-50 adversarial examples; row 1: original and adversarial
images with ImageNet labels as titles; row 2: perturbation heat map with same
colorbar scale; row 3: perturbations with colorbar scale adjusted to each
method for better visualization. TR attack obtains similar perturbation as CW, but $\bf26.4\btimes$ faster~\fref{f:efficient}.
}
\label{f:resnet_eg1}
\end{figure*}

\begin{figure*}[!htbp]
\centering
\includegraphics[width=0.9\textwidth, trim={5cm 1.7cm 2cm 1.7cm},clip]{resnet/201png.png}\\
\includegraphics[width=0.9\textwidth, trim={5cm 1.7cm 2cm 1.7cm},clip]{resnet/233png.png}
\caption{ ResNet-50 adversarial examples; row 1: original and adversarial
images with ImageNet labels as titles; row 2: perturbation heat map with same
colorbar scale; row 3: perturbations with colorbar scale adjusted to each
method for better visualization. TR attack obtains similar perturbation as CW, but $\bf26.4\btimes$ faster~\fref{f:efficient}.
}
\label{f:resnet_eg2}
\end{figure*}

\begin{figure*}[!htbp]
\centering
\includegraphics[width=0.9\textwidth, trim={5cm 1.7cm 2cm 1.7cm},clip]{alexnet/13png.png}\\
\includegraphics[width=0.9\textwidth, trim={5cm 1.7cm 2cm 1.7cm},clip]{alexnet/14png.png}
\caption{AlexNet adversarial examples; row 1: original and adversarial
images with ImageNet labels as titles; row 2: perturbation heat map with same
colorbar scale; row 3: perturbations with colorbar scale adjusted to each
method for better visualization.
TR attack obtains similar perturbation as CW, but $\bf15\btimes$ faster~\fref{f:efficient}.
}
\label{f:alex_eg1}
\end{figure*}

\begin{figure*}[!htbp]
\centering
\includegraphics[width=0.9\textwidth, trim={5cm 1.7cm 2cm 1.7cm},clip]{alexnet/33png.png}\\
\includegraphics[width=0.9\textwidth, trim={5cm 1.7cm 2cm 1.7cm},clip]{alexnet/54png.png}
\caption{ AlexNet adversarial examples; row 1: original and adversarial
images with ImageNet labels as titles; row 2: perturbation heat map with same
colorbar scale; row 3: perturbations with colorbar scale adjusted to each
method for better visualization. TR attack obtains similar perturbation as CW, but $\bf15\btimes$ faster~\fref{f:efficient}.
}
\label{f:alex_eg2}
\end{figure*}

\begin{figure*}[!htbp]
\centering
\includegraphics[width=0.9\textwidth, trim={5cm 1.7cm 2cm 1.7cm},clip]{alexnet/8png.png}
\caption{ AlexNet adversarial examples; row 1: original and adversarial
images with ImageNet labels as titles; row 2: perturbation heat map with same
colorbar scale; row 3: perturbations with colorbar scale adjusted to each
method for better visualization. TR attack obtains similar perturbation as CW, but $15\times$ faster~\fref{f:efficient}.
}
\label{f:alex_eg3}
\end{figure*}

\begin{figure*}[!htbp]
\centering
\includegraphics[width=0.9\textwidth, trim={5cm 1.7cm 2cm 1.7cm},clip]{densenet/139png.png}\\
\includegraphics[width=0.9\textwidth, trim={5cm 1.7cm 2cm 1.7cm},clip]{densenet/220png.png}
\caption{ DenseNet-121 adversarial examples; row 1: original and adversarial
images with ImageNet labels as titles; row 2: perturbation heat map with same
colorbar scale; row 3: perturbations with colorbar scale adjusted to each
method for better visualization.  TR attack obtains similar perturbation as CW, but $\bf26.8\btimes$ faster~\fref{f:efficient}.
}
\label{f:densenet_eg1}
\end{figure*}

\begin{figure*}[!htbp]
\centering
\includegraphics[width=0.9\textwidth, trim={5cm 1.7cm 2cm 1.7cm},clip]{densenet/247png.png}
\caption{ DenseNet-121 adversarial examples; row 1: original and adversarial
images with ImageNet labels as titles; row 2: perturbation heat map with same
colorbar scale; row 3: perturbations with colorbar scale adjusted to each
method for better visualization.  TR attack obtains similar perturbation as CW, but $\bf 26.8\btimes$ faster~\fref{f:efficient}.
}
\label{f:densenet_eg2}
\end{figure*}

\section{Conclusions}\label{sec:conclusion}
We have considered various TR based methods for adversarial attacks on neural networks.
We presented the formulation for the TR method along with results for our first/second-order attacks.
We considered multiple models on Cifar-10 and ImageNet datasets, including variants of residual and densely connected networks.
Our method requires significantly smaller perturbation (up to $3.9\times$), as compared to DeepFool.
Furthermore, we achieve similar results (in terms of
average/worst perturbation magnitude to fool the network), as compared to the CW attack, but with significant speed up of up to $37.5\times$.
For all the models considered, our attack method can bring down the model accuracy to less than $0.1\%$ with relative small perturbation (in $L_2/L_\infty$ norms) of the input image.
Meanwhile, we also tested the second order TR attack by backpropogating the Hessian information through the neural network, showing that it can find a stronger attack direction, as compared to the first order variant.

\section{Introduction}\label{sec:intro}

\begin{figure}
\begin{center}
  \includegraphics[width=.47\textwidth]{figures/l2.pdf}
\end{center}
\caption{
An example of DeepFool, CW, and our TR attack on AlexNet, with $L_2$ norm.
Both CW and TR perturbations are smaller in magnitude and more targeted than DeepFool's ($2\times$ smaller here).
TR attack obtains similar perturbation as CW, but $\bf 15\btimes$ faster.
In the case of the VGG-16 network, we achieve an even higher speedup of $\bf
37.5\btimes$ (please see~\fref{f:efficient} for timings).
}
\label{f:adv_example1}
\end{figure}

Deep Neural Networks (DNNs) have achieved impressive results in many research areas, such as classification,
object detection, and natural language processing.
However, recent studies have shown that DNNs are often not robust to adversarial perturbation of the input data~\cite{szegedy2013intriguing,fgsm}.
This has become a major challenge for DNN deployment, and significant research has been performed to address this.
These efforts can be broadly classified in three categories:
(i) research into finding strategies to defend against adversarial inputs (which has so far been largely unsuccessful);
(ii) new attack methods that are stronger and can break the proposed defense mechanisms; and
(iii) using attack methods as form of implicit adversarial regularization for training neural networks~\cite{yao2018large,robust,yao2018hessian}.
Our interest here is mainly focused on finding more effective attack methods that could be used in the latter two directions.
Such adversarial attack methods can be broadly classified into two categories:
white-box attacks, where the model architecture is known; and
black-box attacks, where the adversary can only perform a finite number of queries and observe the model behaviour.
In practice, white-box attacks are often not feasible, but recent work has shown that some adversarial attacks
can actually transfer from one model to the other~\cite{moosavi2017universal}.
Therefore, precise knowledge of the target DNN  may actually not be essential.
Another important finding in this direction is the existence of an \textit{adversarial patch}, i.e., a small set of pixels which, if added to an image, can fool the network.
This has raised  important security concerns for applications such as autonomous driving, where addition of such an adversarial patch to traffic signs could fool the~system~\cite{brown2017adversarial}.

Relatedly, finding more \textit{efficient} attack methods is important for evaluating defense strategies, and this is the main focus of our paper.
For instance, the seminal work of~\cite{carlini2017towards} introduced a new type of optimization based attack, commonly referred to as CW (Carlini-Wagner) attack, which illustrated that defensive distillation~\cite{papernot2016distillation} can be broken with its stronger attack.
The latter approach had shown significant robustness to the fast gradient sign attack method~\cite{fgsm}, but not when tested against the stronger CW attack.
Three metrics for an \textit{efficient attack} are the speed with which such a perturbation can be computed,
the magnitude or norm of the perturbation that needs to be added to the input to fool the network, and the transferability of the attack to other networks.
Ideally (from the perspective of the attacker), a stronger attack with a smaller perturbation magnitude is desired, so that it could be undetectable (e.g. an adversarial patch that is harder to detect by~humans).

\begin{figure*}[!htbp]
\begin{center}
  \includegraphics[width=.9\textwidth]{figures/example2.png}
\end{center}
\caption{
An example of DeepFool and TR attack on VGG-16, with $L_\infty$ norm.
The first pattern is the original image.
The second pattern is the image after TR attack.
The final two patterns are the perturbations generated by DeepFool and TR.
The TR perturbation is smaller than DeepFool's ($1.9\times$ smaller).
Also, the TR perturbation is more concentrated around the butterfly
}
\label{f:adv_example2}
\end{figure*}

In this work, we propose a novel trust region based attack method.
Introduced in~\cite{steihaug1983conjugate},
trust region (TR) methods form a family of numerical optimization methods for solving non-convex optimization problems~\cite{NW06}.
The basic TR optimization method works by first defining a region, commonly referred to as \textit{trust region}, around the current point in the optimization landscape, in which a (quadratic) model approximation is used to find a descent/ascent direction.
The idea of using this confined region is due to the model approximation error.
In particular, the trust region method is designed to improve upon vanilla first-order and second-order methods, especially in the presence of non-convexity.

We first consider a first-order TR method, which uses gradient information for attacking the target DNN model and adaptively adjusts the trust region.
The main advantage of first-order attacks is their computational efficiency and ease of implementation.
We show that our first-order TR method significantly reduces the over-estimation problem (i.e. requiring very large perturbation to fool the network),
resulting in up to $3.9\times$ reduction in the perturbation magnitude, as compared to DeepFool~\cite{moosavi2016deepfool}.
Furthermore, we show TR is significantly faster than the CW attack (up to $37\times$), while achieving similar attack performance.
We then propose an adaptive TR method, where we adaptively choose the TR radius based on the model approximation to further speed up the
attack process.
Finally, we present the formulation for how our basic TR method could be extended to a second-order TR method, which could be useful for cases with significant non-linear decision boundaries, e.g., CNNs with Swish activation function~\cite{ramachandran2018searching}.
In more detail, our main contributions are the following:

\begin{itemize}
\item
We cast the adversarial attack problem into the optimization framework of TR methods.
This enables several new attack schemes, which are easy to implement and are significantly more
effective than existing attack methods (up to $3.9\times$, when compared to DeepFool).
Our method requires a similar perturbation magnitude, as compared to CW, but it can compute the perturbation significantly faster (up to $37\times$), as it does not require
extensive hyper-parameter tuning.
\item  Our TR-based attack methods can adaptively choose the perturbation magnitude in every iteration.
This removes the need for expensive hyper-parameter tuning, which is a major issue with the existing optimization based methods.
\item
Our method can easily be extended to second-order TR attacks, which could be useful for non-linear activation functions.
With fewer iterations, our second-order attack method outperforms the first-order attack method.
\end{itemize}

\textbf{Limitations.}
We believe that it is important for every work to state its limitations (in general, but in particular in this area).
We paid special attention to repeat the experiments multiple times, and we considered multiple different DNNs on different datasets to make sure the results are general.
One important limitation of our approach is that a na\"{\i}ve implementation of our second-order method requires computation of Hessian matvec backpropogation, which is very expensive for DNNs.  Although the second-order TR attack achieves better results, as compared to the first-order TR attack, this additional computational cost could limit its usefulness in certain applications.
Moreover, our method achieves similar results as CW attack, but significantly faster. However, if we ignore the strength of the attack, then the DeepFool attack
is faster than our method (and CW's for that matter).
Although such comparison may not be fair, as our attack is stronger.
However, this may be an important point for certain applications
where maximum speed is needed.

\section{#1}\vspace{-4pt}}
\newcommand{\msubsection}[1]{\vspace*{-5pt}\subsection{#1}\vspace{-4pt}}

\definecolor{light-gray}{gray}{0.80}

\newcommand{\mcol}[2]{\multicolumn{#1}{r}{#2}}
\newcommand{\mrow}[2]{\multirow{#1}{*}{#2}}
\newcommand{\mrowrot}[2]{
\parbox[t]{2mm}{\multirow{#1}{*}{\rotatebox[origin=c]{90}{#2}}}
}

\newcommand{\algcolor}[2]{\colorbox{#1}{\parbox{\linewidth}{#2}}}
\newcommand{\algemph}[1]{\algcolor{light-gray}{#1}}

\newcommand{\algcmt}[1]{\hfill {\footnotesize\ttfamily\textcolor{blue}{/* {#1} */}}}
\newcommand{\algcc}[1]{\hfill {\footnotesize\ttfamily\textcolor{blue}{//{#1}}}}

\let\oldparagraph\paragraph
\renewcommand\paragraph{\subsubsection*}

\newcommand\btimes{{\bm{\times}}}
\newcommand{\bfeval}[1]{
  \textcolor{black}{\textbf{\eval{#1}}}
}
\newcommand\aref{Algorithm \ref}
\newcommand\eref{Eq.~\ref}

\newcommand\fref{Fig.~\ref}

\newcommand\tref{Table~\ref}
\SetKwInOut{Parameter}{parameter}
\newcommand\cmt[1]{\tcp*[r]{\scriptsize \color{gray!80!black}#1}}
\newcommand{\red}[1]{{\color{red} #1}}
\newcommand{\blue}[1]{{\color{blue} #1}}
\newcommand{\bluem}[1]{{\bf\color{blue} #1}}
\newcommand\ha{ \rowcolor{orange!0}}
\newcommand\hb{ \rowcolor{orange!15}}
\newcommand\hc{ \rowcolor{orange!40}}
\newcommand\hd{ \rowcolor{orange!45}}
\newcommand\he{ \rowcolor{orange!60}}
\newcommand\hf{ \rowcolor{orange!75}}
\newcommand\hg{ \rowcolor{orange!90}}

\newcommand\eps{ \epsilon}
\newcommand\MS{{\mathcal{M}}}
\def{\bf x}{{\bf x}}
\def{\bf H}{{\bf H}}
\def{\bf g}{{\bf g}}
\def{\bf Hg}{{\bf Hg}}
\def{\bf 0}{{\bf 0}}
\def{\bf s}{{\bf s}}
\def{\bf t}{{\bf t}}
\def{\bf p}{{\bf p}}

\def{\bf v}{{\bf v}}

\def{\bf R}{{\mathbb R}}

\def{\mathcal{A}}{{\mathcal{A}}}

\section{Trust Region Adversarial Attack}\label{sec:method}
Let us denote the output of the DNN before the softmax function to be ${\bf z}={\bf Z}({\bf x};\theta)\in\RR^c$. Therefore, we will have:
\[
\mathcal M({\bf x};\theta)=softmax\big({\bf Z}({\bf x}; \theta)\big)=\hat {\bf y}.
\]

\noindent Denote ${\bf y}_t$ to be the true label of ${\bf x}$, and ${\bf z}_t = \arg\max {\bf z}$ to be the prediction output of $\mathcal M({\bf x};\theta)$.
For clarification, note that ${\bf z}_t$ is only the same as ${\bf y}_t$ if the
neural network makes the correct classification.
An adversarial attack seeks to find  $\Delta {\bf x}$ that fools the DNN, that is:
\begin{equation}\label{eqn:basic_prob}
\arg\min_{\|\Delta {\bf x}\|_p} \arg\max {\bf Z}({\bf x}+\Delta{\bf x}; \theta) \not={\bf y}_t,
\end{equation}

\begin{figure}
\centering
\includegraphics[width=0.30\textwidth]{figures/decision_boundary.pdf}
\caption{Schematic illustration of the decision boundaries for a classification problem. Points mapped to the hashed region, are classified with the same label.
}
\label{f:decision_boundary}
\end{figure}

\input algo.tex

\begin{figure*}[!htbp]
\centering
\includegraphics[width=0.45\textwidth]{figures/efficient_2.pdf}
\includegraphics[width=0.45\textwidth]{figures/efficient_w_2.pdf}
\caption{The two subfigures show, for various neural networks, the time to compute the adversarial attack (x-axis) and the perturbation needed by that attack method to fool an image (y-axis), corresponding to ImageNet results in~\tref{tab:imagenet}.
On the left, the y-axis is plotted for average perturbation; and on the right, for the worst case perturbation.
An attack that achieves smaller perturbation in shorter time is preferred.
Different colors represent different models, and different markers illustrate the different attack methods.
Observe that our TR and TR Adap methods achieve similar perturbations as CW but with significantly less time (up to $\bf 37.5\btimes$).
}
\label{f:efficient}
\end{figure*}

\noindent
where $\|\cdot\|_p$ denotes the $L_p$ norm of a vector.
It is often computationally infeasible to solve \eqref{eqn:basic_prob} exactly.
Therefore, a common approach is to approximately solve
\eqref{eqn:basic_prob}~\cite{carlini2017towards,fgsm,szegedy2013intriguing}.
To do so, the problem can be formulated as follows:
\begin{equation}\label{eqn:max_perturb}
  \max_{\|\Delta {\bf x}\|_p\leq\epsilon} \mathcal{J}({\bf x}+\Delta{\bf x},\theta,{\bf y}),
\end{equation}
\noindent where $\epsilon$ constrains the perturbation magnitude, and $\mathcal{J}$ can be either
the loss function ($\mathcal{L}$) or more generally another kernel~\cite{carlini2017towards}.
In the case of DeepFool (DF) attack, this
problem is solved by approximating the decision boundary by a linear affine transformation.
For such a decision boundary, the perturbation magnitude could be analytically computed by
just evaluating the gradient at the current point. However, for neural networks this approximation
could be very inaccurate, that is it could lead to over/under-estimation of the perturbation
along a sub-optimal direction. The smallest direction would be orthogonal to the decision boundary, and this cannot
be computed by a simple affine transformation, as the decision boundary is non-linear (see Fig.~\ref{f:decision_boundary} for illustration).
This is obvious for non-linear activation functions, but even in the case of ReLU, the model behaves like a piece-wise linear function (before the softmax layer, and
actually non-linear afterwards).
This approach cannot correctly find the orthogonal direction, even if we ignore the non-linearity of the softmax layer.

To address this limitation, we instead use TR methods, which are well-known for solving non-convex optimization problems~\cite{steihaug1983conjugate}.
The problem of finding adversarial perturbation using TR is defined as follows:

\begin{equation}\label{eqn:tr_prob_adv}
\max_{\|\Delta{\bf x}^j\|_p\leq\eps^j} m^j(\Delta{\bf x}^j) =
\langle\Delta{\bf x}^j, {\bf g}^j_{t,i}\rangle + \frac12\langle\Delta{\bf x}^j, {\bf H}^j_{t,i}\Delta{\bf x}^j\rangle,
\end{equation}

\noindent
where $\eps^j$ is the TR radius at $j^{th}$ iteration,
$m^j$ is the approximation of the kernel function of $f({\bf x}^{j-1})=({\bf z}_t^{j-1}-{\bf z}^{j-1}_i)$ with
${\bf g}^j_{t,i}$ and ${\bf H}^j_{t,i}$ denoting the corresponding gradient and Hessian,
and ${\bf x}^j = {\bf x} + \sum_{i=1}^{j-1}\Delta{\bf x}^i$.
The main idea of the TR method is to iteratively select the trusted radius $\eps^j$ to find the adversarial perturbation within this region such that the probability of an incorrect class becomes maximum.
TR adjusts this radius
by measuring the approximation of the local model
$m^j({\bf s}^j)$ to the actual function value $f({\bf x}^{j+1})-f({\bf x}^j)$.
In particular, we increase the trusted radius if
the approximation of the function is accurate (measured by $\frac{f({\bf x}^{j+1})-f({\bf x}^j)}{m^j({\bf s}^j)}>\sigma_1$ with
a typical value of $\sigma_1=0.9$).
In such a case, the trusted radius is increased for the next iterations
 by a factor of $\eta>1$
($\eps^{j+1}=\eta\eps^t$). However, when the local model $m^j({\bf s}^j)$ is a
poor approximation of $f({\bf x}^{j+1})-f({\bf x}^j)$, i.e.,
$\frac{f({\bf x}^{j+1})-f({\bf x}^j)}{m^j({\bf s}^j)}<\sigma_2$ (with a typical $\sigma_2=0.5$), we decrease the trusted radius for the next iteration
$\eps^{j+1}=\eps^t/\eta$.
Otherwise, we keep the same $\eps^j$ for $\eps^{j+1}$.
Typically, a threshold is also used for lower and upper bounds of $\eps^j$.
Using this approach, the TR attack can iteratively find an adversarial perturbation to fool the network.
See Alg.~\ref{alg:1} for details.

Note that for cases where all the activations of the DNN are ReLU, the Hessian is
zero almost everywhere~\cite[Theorem 1]{yao2018hessian}, and we actually do not need the Hessian.
This means the landscape of ${\bf z}_t-{\bf z}_i$ is piece-wise linear, i.e., we could omit ${\bf H}^j_{t,i}$ in \eqref{eqn:tr_prob_adv}.
However, for non-linear activation functions, we need to keep the Hessian term (since when the NN has smooth activation functions, the Hessian is not zero).
For these cases, the problem of finding the adversarial perturbation becomes a Quadratic Constrained Quadratic Programming (QCQP) problem.
It is quadratic constraint due to the fact that the norm of the perturbation is limited by the TR radius, $\eta^j$, and
the quadratic programming arises from the non-zero Hessian term. We use Lanczos algorithm to solve the QCQP problem. In
this approach, the solution is iteratively found in a Krylov subspace formed by the Hessian operator.

\section{Background}
In this section, we review related work on adversarial attacks.
Consider ${\bf x}\in\RR^n$ as input image, and ${\bf y}\in\RR^c$ the corresponding label.
Suppose $\mathcal M({\bf x};\theta)=\hat {\bf y}$ is the DNN's prediction probabilities, with $\theta$ the model parameters and $\hat{{\bf y}}\in\RR^c$ the vector of probabilities.
We denote the loss function of a DNN as $\mathcal{L}({\bf x},\theta,{\bf y})$.
Then, an adversarial attack is aimed to find a (small) perturbation, $\Delta {\bf x}$, such that:
\begin{equation*}
    \argmax(\mathcal M({\bf x}+\Delta {\bf x};\theta))=\argmax(\hat {\bf y}) \not= \argmax({\bf y}).
\end{equation*}

There is no closed form solution to analytically compute such a perturbation. However, several different
approaches have been proposed by solving auxiliary optimization or analytical approximations to solve
for the perturbation. For instance,
the Fast Gradient Sign Method (FGSM)~\cite{fgsm} is a simple
adversarial attack scheme that works by directly maximizing the loss function $\mathcal{L}({\bf x},\theta,{\bf y})$.
It was subsequently extended to an iterative FGSM~\cite{fgsm10}, which performs multiple gradient ascend steps to compute the adversarial perturbation, and is often more effective than FGSM in attacking the network.
Another interesting work in this direction us DeepFool, which uses an approximate analytical
method.
DeepFool assumes that the neural network behave as an affine multiclass classifier, which allows
one to find a closed form solution.
DeepFool is based on ``projecting'' perturbed inputs to cross the decision boundary (schematically shown in~\fref{f:decision_boundary}), so that its classification is changed, and this was shown to outperform FGSM.
However, the landscape of the decision boundary of a neural network is not linear.
This is the case even for ReLU networks with the softmax layer.
Even before the softmax layer, the landscape is \emph{piece-wise linear}, but this cannot be approximated
with a simple affine transformation.
Therefore, if we use the local information, we can overestimate/underestimate the adversarial perturbation needed to fool
the network.

The seminal work of~\cite{carlini2017towards} introduced the so-called CW attack, a more sophisticated way to directly solve for the $\Delta {\bf x}$ perturbation.
Here, the problem is cast as an optimization problem, where we seek to minimize the distance between the original
image and the perturbed one, subject to the constraint that the perturbed input
would be misclassified by the neural network.
This work also clearly showed that defensive distillation, which at the time was believed to be a robust method to defend against adversaries, is not robust to stronger attacks.
One major disadvantage of the CW attack is that it is very sensitive to hyper-parameter tuning.
This is an important problem in applications where speed is important, as finding a good/optimal adversarial perturbation for a given input is very time consuming.
Addressing this issue, without sacrificing attack strength, is a goal of our work.

On another direction, adversarial training has been used as a defense method against adversarial attacks~\cite{robust}.
In particular, by using adversarial examples during training, one can obtain models that are more robust to attacks (but still not foolproof).
This adversarial training was further extended to ensemble adversarial training~\cite{tramer2017ensemble},
with the goal of making the model more robust to black box attacks.
Other approaches have also been proposed to detect/defend against adversarial attacks~\cite{papernot2016distillation,metzen2017detecting}.
However, it has recently been shown that, with a stronger attack method, defense schemes such as distillation or obfuscated gradients can be broken~\cite{carlini2017adversarial, carlini2017towards,athalye2018obfuscated}.

A final important application of adversarial attacks is to train neural networks to obtain improved generalization, even in non-adversarial environments.
Multiple recent works have shown that adversarial training (specifically, training with mixed adversarial and clean data) can be used to train a neural network from scratch in order to achieve a better final \emph{generalization} performance~\cite{robust,sankaranarayanan2017regularizing,yao2018large,yao2018hessian}.
In particular, the work of~\cite{yao2018hessian} empirically showed that using adversarial training would result in finding
areas with ``flatter'' curvature.
This property has recently been argued to be an important parameter for generalization performance~\cite{keskar2016large}.
Here, the speed with which adversarial perturbations can be computed is very important since it appears in the inner loop of the training process, and the training needs to be performed for many epochs.

\section{Performance of the Method}
\label{sec:results}

To test the efficacy of the TR attack method and to compare its performance with other approaches, we perform multiple experiments using different models on Cifar-10~\cite{krizhevsky2009learning} and ImageNet~\cite{deng2009imagenet} datasets.
In particular, we compare to DeepFool~\cite{moosavi2016deepfool}, iterative FGSM~\cite{fgsm,fgsm10}, and the Carlini-Wagner (CW) attack~\cite{carlini2017towards}.

As mentioned above, the original TR method adaptively selects the perturbation magnitude.
Here, to test how effective the adaptive method performs, we also experiment with a case where we set the TR radius to be a fixed small value and compare the results with the original adaptive version.
We refer to the fixed radius version as "TR Non-Adap" and the adaptive version as "TR Adap".
Furthermore, the metric that we use for performance of the attack is the relative perturbation, defined as follows:
\begin{equation}\label{eqn:rel_per}
\rho_p = \frac{\|\Delta{\bf x}\|_p}{\|{\bf x}\|_p},
\end{equation}
where $\Delta{\bf x}$ is the perturbation needed to fool the testing example.
The perturbation is chosen such that the accuracy of the model is reduced
to less than $0.1\%$. We report both the average perturbation as well as the highest
perturbation required to fool a testing image. To clarify this, the highest
perturbation is computed after all of testing images (50K in ImageNet and 10K in Cifar-10) and then finding the
the highest perturbation magnitude that was needed to fool a correctly classified example. We refer to this case
as \textit{worst case} perturbation. Ideally we would like this worst case
perturbation to be bounded and close to the average cases.

\begin{table}[!htbp]
\caption{ Average perturbations / worst case perturbations
are reported of different models on Cifar-10 for hardest class attack.
Lower values are better.
The first set of rows show $L_2$ attack and the second shows $L_\infty$ attack.
}
\label{tab:cifar_worst}
\small
\setlength\tabcolsep{2.85pt}
\centering
\begin{tabular}{lc|c|ccccccccccc} \toprule
                   &DeepFool   &TR Non-Adap      &TR Adap\\
\midrule
     Model           &  {$\rho_2$}       &  {$\rho_2$}   &  {$\rho_2$}         \\
    \midrule
\Gc  AlexLike            & 4.36\% /18.9\%  & 2.47\% /13.4\%  & 2.47\% /13.4\%         \\
\Ga  AlexLike-S          & 4.70\% /17.7\%  & 2.63\% /14.4\%  & 2.62\% /14.2\%       \\
\Gc  ResNet              & 1.71\% /8.01\%  & 0.99\% /4.76\%  & 0.99\% /4.90\%         \\
\Ga  WResNet             & 1.80\% /8.74\%  & 1.05\% /6.23\%  & 1.08\% /6.23\%        \\
     \midrule
     Model            &  {$\rho_\infty$}        &  {$\rho_\infty$}     &  {$\rho_\infty$}           \\
    \midrule
\Gc  AlexLike     & 2.96\% /12.6\%         & 1.92\% /9.99\%    & 1.86\% /10.0\%           \\
\Ga  AlexLike-S   & 3.12\% /12.2\%         & 1.98\% /8.19\%    & 1.92\% /8.17\%           \\
\Gc  ResNet       & 1.34\% /9.65\%         & 0.77\% /4.70\%    & 0.85\% /5.44\%           \\
\Ga  WResNet      & 1.35\% /6.49\%         & 0.81\% /3.77\%    & 0.89\% /3.90\%      \\
\bottomrule
\end{tabular}
\end{table}
\begin{table*}[!htbp]
\caption{ Average perturbations / worst case perturbations
are reported of different models on ImageNet.
Lower values are better.
The first set of rows show $L_2$ attack and the second shows $L_\infty$ attack.
}
\label{tab:imagenet}
\centering
\small
\setlength\tabcolsep{4.1pt}
\begin{tabular}{lcc|c|c|ccccccccccc}
\toprule
             &                      &DeepFool        & CW               &TR Non-Adap              &TR Adap \\
             \cmidrule{3-6}
     Model           & Accuracy       &  {$\rho_2$}           &  {$\rho_2$}        &  {$\rho_2$}  &  {$\rho_2$}           \\
\midrule
\Ga  AlexNet          & 56.5   & 0.20\% / 4.1\%  & 0.31\% / 1.8\%  & 0.17\% / 2.5\%     & 0.18\% / 3.3\%     \\
\Gc  VGG16            & 71.6   & 0.14\% / 4.4\%  & 0.16\% / 1.1\%  & 0.12\% / 1.2\%     & 0.12\% / 3.8\%     \\
\Ga  ResNet50         & 76.1   & 0.17\% / 3.0\%  & 0.19\% / 1.1\%  & 0.13\% / 1.5\%     & 0.14\% / 2.3\%     \\
\Gc  DenseNet121      & 74.4   & 0.15\% / 2.5\%  & 0.20\% / 1.5\%  & 0.12\% / 1.3\%     & 0.13\% / 1.7\%     \\
\midrule
            &                      &DeepFool            & FGSM                         &TR Non-Adap              &TR Adap \\
            \cmidrule{3-6}
     Model           & Accuracy       &  {$\rho_\infty$}  &  {$\rho_\infty$}         &  {$\rho_\infty$}   &  {$\rho_\infty$}       \\
    \midrule
\Ga  AlexNet          & 56.5         & 0.14\% / 4.3\%  & 0.16\% / 4.7\%      & 0.13\% / 1.4\%       & 0.13\% / 3.6\%       \\
\Gc  VGG16            & 71.5         & 0.11\% / 4.0\%  & 0.18\% / 5.1\%      & 0.10\% / 1.4\%       & 0.10\% / 3.4\%       \\
\Ga  ResNet50         & 76.1         & 0.13\% / 3.2\%  & 0.18\% / 3.7\%      & 0.11\% / 1.3\%       & 0.11\% / 2.7\%      \\
\Gc  DenseNet121      & 74.4         & 0.11\% / 2.3\%  & 0.15\% / 4.1\%      & 0.10\% / 1.1\%       & 0.10\% / 1.8\%       \\
     \bottomrule
\end{tabular}
\end{table*}

\subsection{Setup}\label{sec:outline}
We consider multiple different neural networks including variants of
(wide) residual networks~\cite{he2016deep,zagoruyko2016wide}, AlexNet, VGG16~\cite{simonyan2014very}, and DenseNet from~\cite{huang2017densely}.
We also test with custom smaller/shallower convolutional networks such as a simple
CNN~\cite[C1]{yao2018hessian} (refer as AlexLike with ReLU and AlexLike-S with Swish activation).
To test the second order attack method we run experiments
with AlexNet-S (by replacing all ReLUs with Swish function activation function~\cite{ramachandran2017swish}), along with a
simple MLP ($3072\rightarrow1024\rightarrow512\rightarrow512\rightarrow256\rightarrow10$) with Swish activation function.

By definition, an adversarial attack is considered successful if it is able
to change the classification of the input image.
Here we perform two types of attacks. The first one is where we
compute the smallest perturbation needed to change the target label. We refer to this as \textit{best class} attack.
This means we attack the class with:
    \[
     \argmin_{j} \frac{z_t-z_j}{\|\nabla_{\bf x} (z_t-z_j)\|}.
    \]
Intuitively, this corresponds to perturbing the input to cross the closest decision boundary (\fref{f:decision_boundary}). On the other hand, we also
consider perturbing the input to the class whose decision boundary is farthest away:
    \[
     \argmax_{j} \frac{z_t-z_j}{\|\nabla_{\bf x} (z_t-z_j)\|}.
    \]
\noindent Furthermore, we report two perturbation metrics of
\textit{average perturbation}, computed as:
    \[
    \rho_p = \frac{1}{N}\sum_{i=1}^N\frac{\|\Delta{\bf x}_i\|_p}{\|{\bf x}_i\|_p},
    \]
\noindent along with worst perturbation, computed as:
    \[
    \rho_p = \max\large\{\frac{\|\Delta{\bf x}_i\|_p}{\|{\bf x}_i\|_p}\large\}_{i=1}^N.
    \]

\noindent
For comparison, we also consider the following attack methods:

\begin{itemize
    \item Iterative FGSM from~\cite{fgsm, fgsm10}, where the following formula is used to compute adversarial perturbation, after which the perturbation is clipped
    in range $(\min({\bf x}), \max(x))$:
    \[
        {\bf x}^{j+1} = {\bf x}^j + \epsilon~sign(\nabla_{\bf x} \mathcal{L}({\bf x}^j, \theta, {\bf y})),
    \]
    \item DeepFool (DF) from~\cite{moosavi2016deepfool}. We follow the same implementation as~\cite{moosavi2016deepfool}. For the hardest class test, the
    target class is set as same as our TR method.
    \item CW attack from~\cite{carlini2017towards}. We use the open source code from~\cite{rauber2017foolbox}\footnote{https://github.com/bethgelab/foolbox}.

\end{itemize}

Finally, we measure the time to fool an input image by averaging the
attack time over all the testing examples. The measurements are performed
on a Titan Xp GPU with an Intel E5-2640 CPU.

\begin{table}[!htbp]
\caption{ Average perturbations / worst case perturbations
are reported of different models on ImageNet for hardest class attack (on the top 100 prediction classes).
Lower values are better.
The first set of rows show $L_2$ attack and the second shows $L_\infty$ attack.
}
\label{tab:imagenet_worst}
\centering
\small
\setlength\tabcolsep{4.1pt}
\begin{tabular}{lc|c|cccccccccccc}
\toprule
                    &DeepFool   &TR Non-Adap &TR Adap  \\

\midrule
     Model                &  {$\rho_2$}        &  {$\rho_2$}        &  {$\rho_2$}                             \\
\midrule
\Gc  AlexNet            & 0.74\% /8.7\%   & 0.39\% /5.0\%     & 0.39\% /5.0\%     \\
\Ga  VGG16              & 0.45\% /5.4\%   & 0.27\% /3.6\%     & 0.27\% /3.8\%     \\
\Gc  ResNet50           & 0.52\% /5.8\%   & 0.31\% /4.2\%     & 0.31\% /4.2\%     \\
\Ga  DenseNet           & 0.48\% /5.7\%   & 0.29\% /3.8\%     & 0.29\% /3.8\%     \\
\midrule
     Model              &  {$\rho_\infty$}    &  {$\rho_\infty$}          &  {$\rho_\infty$}             \\
    \midrule
\Gc  AlexNet                & 0.53\% /9.9\%         & 0.31\% /7.5\%      & 0.33\% /9.1\%       \\
\Ga  VGG16                  & 0.36\% /11.6\%        & 0.25\% /5.1\%      & 0.26\% /6.8\%      \\
\Gc  ResNet50               & 0.43\% /6.6\%         & 0.28\% /3.7\%      & 0.30\% /4.6\%     \\
\Ga  DenseNet               & 0.38\% /6.4\%         & 0.24\% /4.5\%      & 0.27\% /5.7\%      \\
     \bottomrule
\end{tabular}
\end{table}

\begin{table*}[!htbp]
\caption{Second order and first order comparison on MLP and AlexNet with Swish activation
function on Cifar-10. The corresponding baseline accuracy without adversarial perturbation is 62.4\% and 76.6\%, respectively.
As expected, the second order TR attack achieves better results as compared to first-order with fixed iterations. However, the second-order
attack is significantly more expensive, due to the overhead of solving QCQP problem.}
\label{tab:tr_second}
\centering
\small
\setlength\tabcolsep{4.1pt}
\begin{tabular}{llcccccccccccc} \toprule
     Iter       &     & 1       & 2       & 3          & 4   & 5     & 6       &7         & 8     & 9    & 10\\
    \midrule
\Gc  MLP        &  TR First      & 47.63   & 33.7     & 22.24   & 13.76 & 8.13   & 4.59    & 2.41     & 1.31  & 0.63 & 0.27\\
\Ga  MLP        &   TR Second     & 47.84   & 33.37    & 21.49   & 13.3  & 7.39   & 4.16    & 2.17     & 1.09  & 0.49 & 0.20\\
\midrule
\Gc  AlexNet    &  TR First      & 51.51   & 28.17   & 12.45     &5.53   & 2.61  & 1.33    & 0.82   & 0.66   & 0.51  & 0.46\\
\Ga  AlexNet    &  TR Second     & 50.96   & 26.97   & 10.73     &4.11   & 1.79  & 0.91    & 0.67   & 0.54   & 0.47  & 0.44\\
     \bottomrule
\end{tabular}
\end{table*}

\subsection{Cifar-10}\label{sec:cifar10}
We first compare different attacks of various neural network models on Cifar-10 dataset, as reported in~\tref{tab:cifar}.
Here, we compute the average and worst case perturbation for
best class attack. For $L_2$ attack, we can see that TR Non-Adap can achieve comparable
perturbation as CW, with both TR and CW requiring smaller perturbation
than DeepFool.
An important advantage of the TR attack is its speed, as compared to
CW attack, which is illustrated in~\fref{f:efficient_cifar} (please see appendix). Here we plot the time spent to
fool one input image versus average perturbation for all $L_2$ attack methods on
different models. It can be clearly seen that, with similar perturbations, the time to get the adversarial examples is: TR $<$ CW.
Note that DeepFool is also very fast but requires much larger perturbations than TR attack and CW.
Also note that the TR Adap method achieves similar results, with slightly slower
speed and slightly larger perturbation. This is because the adaptive method
has not been tuned any way, whereas for the non adaptive version we manually
tuned $\eps$.
TR Adap does not require tuning, as it automatically adjust  the TR radius.
The slight performance degradation is due to the relaxed $\sigma_1$ and $\sigma_2$ parameters, which could be made more conservative as a trade-off for speed.
But we did not tune these parameters beyond the default, to give a realistic
performance for the non-tuned version.

Another important test is to measure the perturbation needed to fool
the network to the hardest target class. This is important in that flipping a pedestrian to a cyclist may be easier than flipping it to become a car.
In Table~\ref{tab:cifar_worst}, we report the hardest class attack on Cifar-10. Note
that our methods are roughly $1.5$ times better than DeepFool in all cases.
Particularly, For $L_2$ attack on WResNet, our worst case is $3.9$ times better than
DeepFool in terms of perturbation magnitude.

\subsection{ImageNet Result}\label{sec:imagenet}
We observe similar trends on ImageNet.
We report different attacks on various models
on ImageNet in Table~\ref{tab:imagenet}. Note that TR and CW require
significantly smaller perturbation for the worst case as compared to DeepFool.
However, TR is significantly faster than CW. The timing results are shown in~\fref{f:efficient}.
For instance in the case of VGG-16, TR attack is $\mathbf{37.5\times}$ faster than CW which is significant.
An  example perturbation with AlexNet is shown in~\fref{f:adv_example1} (for which TR is $\bf 15\btimes$ faster).
As one can see, CW and TR
perturbations are smaller than DeepFool ($2\times$ in this case), and
more targeted around the object. For $L_\infty$ methods, our TR Non-Adap and TR Adap
are consistently better than FGSM and DeepFool in both average and worst cases.
Particularly, for worst cases, TR is roughly two times better than the other methods.
An example perturbation of DeepFool and TR Non-Adap with $L_\infty$ on VGG16 is shown in~\fref{f:adv_example2}. It can be clearly seen that, TR perturbation is much smaller than DeepFool ($1.9\times$ in this case), and more targeted around the objective.

\subsection{Second order method}\label{sec:second_order}
As mentioned in
Section~\ref{sec:method}, the ReLU activation function does not require Hessian
computation. However, for non-linear activation functions including Hessian
information is beneficial, although it may be very expensive. To test this
hypothesis, we consider two models with Swish activation function. We fix the
TR radius (set to be 1 for all cases) of our first and second order
methods, and gradually increase the iterations. Table~\ref{tab:tr_second} shows the results for MLP and AlexNet models.
It can be seen that second order TR out-performs the first order TR method in all
iterations. Particularly, for two and three iterations on AlexNet, TRS can drop the model
accuracy 1.2\% more as compared to the first order TR variant. However, the second
order based model is more expensive than the first order model, mainly due to
the overhead associated with solving the QCQP problem. There is no closed form
solution for this problem because the problem is non-convex and the Hessian can contain negative
spectrum. Developing computationally efficient method for this is an interesting next direction.

redpajama_set_name: RedPajamaArXiv


Typically the prognosis for anyone undergoing a routine form of surgery is good to excellent. And certainly a tonsillectomy would fall into the category of one of the most routine of surgeries. That's why Bay Area personal injury attorney Gregory J. Brod is as shocked as the rest of the community and the nation over the tragic case of a teenager in Oakland who is now clinically brain dead after having her tonsils removed.
According to the San Jose Mercury News, Jahi McMath, 13, checked into Children's Hospital Oakland for tonsil surgery on Dec. 9. McMath suffered from sleep apnea, which is a potentially serious sleep disorder in which the afflicted person's breathing is repeatedly interrupted during sleep, and her doctors felt that removal of her tonsils would help alleviate the sleep apnea.
Just after her surgery, McMath seemed healthy and alert, but later that evening she began to bleed and then she went into cardiac arrest. After experiencing a massive swelling in her brain, McMath was pronounced brain dead three days after the operation. Tests conducted since the operation have shown no brain activity.
McMath's family has sought to keep her on life support, but her mother said that staff at the hospital had been pressuring her to sign paperwork to take McMath off life support and release her body to the Alameda County coroner's office. In response, the McMath family attorney has delivered a cease-and-desist letter to officials at the hospital to keep the teenager alive.
Children's Hospital Oakland officials decline to discuss the specifics of the case, claiming that the family has denied them permission to speak on the matter. As is the case in such situations, privacy laws forbid a hospital from releasing information concerning a patient's condition or care without his or her consent.
Meanwhile, the McMath family understandably has maintained a vigil for their stricken teenager. And the family had been touched by the outpouring of support from strangers.
Indeed, many are praying for her recovery, and news of her condition has spread around the world. McMath's story has resonated on social media, where there has been an upwelling of support for the family.
For their part, the family is appreciative of the support and maintains hope that McMath will recover.
Words can not begin to express the shock and sadness one feels in a tragic situation such as the one Jahi McMath is in, and our hearts go out to her family. Even in the face of the terrible emotional toll such tragedies take on the family, it is imperative for those concerned to get legal counsel as soon as possible. If you or a loved one has been harmed while getting medical treatment, please contact the experienced attorneys at the Brod Law Firm for a free consultation.


text:
About Grace Preparatory Academy:
Grace Preparatory Academy, founded in 1992, has been serving the families of the Dallas/Fort Worth Metroplex who share the core values and principles upon which this model of education, University Model Schooling®, is built. Grace Prep is accredited by SACS-AdvancEd and is a member of the National Association of University Model Schools (NAUMS), the Texas Association of Private and Parochial Schools (TAPPS), and the Tarrant Independent School Consortium (TISC).
Our Mission Statement:
At Grace Preparatory Academy, our philosophy of education centers around one central mission statement: GPA partners with parents to provide a Christ-centered, college preparatory education where students are allowed to further develop their God-given talents and virtues and become college-worthy character witnesses for Christ.
From this mission, we have built our methodology around three foundational pillars. Please review Our Mission on this site for a detailed definition of these pillars.
Our Professional Commitment:
If we are to have high standards for our students to become college-worthy character witnesses for Christ, we need to set an example for them in how we conduct ourselves as professionals. As such, we are committed to be:
"GPA professional-worthy character witnesses for Christ—Individually we contribute…Together we transform."
How to Join Our Team:
Please submit your resume along with a cover letter expressing a personal evaluation of your abilities and strengths for this opportunity to serve the students and families of Grace Preparatory Academy. Send both items to Grace Prep at careers@graceprep.org. All candidates must be willing to authorize a criminal background check and agree to abide by the agreed Code of Conduct. All candidates must be in agreement with the Statement of Faith that is required of all employees and families. (Please see Our Beliefs for a detailed description.) Grace Preparatory Academy is an equal opportunity employer and therefore does not discriminate on the basis of race, color, national origin, sex, or disability.
Applications and professional reference requests (3) will be required of those selected as finalists from the pool of candidates. Candidates are encouraged to respond as soon as possible. Application periods will be listed within each posting. A decision will be made and communicated to all interviewed candidates as soon thereafter as possible. Thank you for your consideration of employment at Grace Preparatory Academy.
GPA partners with parents to provide a Christ-centered, college preparatory education where students are allowed to further develop their God-given talents and virtues and become college-worthy character witnesses for Christ.

redpajama_set_name: RedPajamaCommonCrawl


The people sat there nodding in agreement. Heads bobbing this way and that way in a dance of acquiescence. There was an understanding evident in the lines etched across their faces. Her words meant something to them. They had waited for words such as these and now that she had spoken them, they grabbed onto them like a lifeline.
I couldn't figure out what she was saying. Even though I was in the audience, the message was not reaching me. It was neither the room nor the chair for I occupied these with a fortitude that was fully my own. Her words simply did not stay. They moved in and out of me. There was no soft place for them to land. I was at this conference and this is where I ended up – with no soft places for words. No home to offer for the things that matter to me. I walked in and out of rooms looking for myself. But it wasn't that I was lost, it was simply that I was on the other side of things.
These are the words I scribbled feverishly across the notebook as I listened to people present interesting papers, one after the other, varying across the landscape of knowledge.
As a world, we value intelligence. I couldn't tell you why because I'm not sure I know the answer. It is a measure we were all born into. Intelligent people are appealing. They know things. And they can tell you things in words you never knew existed grabbing them as if from thin air. When they speak the room seems a little loftier and you are left feeling a little dumber. You realise just how much you don't know.
But the intellect is today, a war machine. We use it to fight each other in arguments of the intelligentsia. We use it to fight the injustice that has besieged our world. We construct theories, stitching thoughts and concepts together to explain and make sense of the thing that eludes us the most: ourselves.
Sitting across people who were articulating the world in complex ideas of being and not being, I was struck by how we all seemed so complicated. Wrestling with notions and ideas at a level that didn't reach the feet and hands; at a level that didn't reach the heart. Words flung from one corner of the room to the other, sometimes breaking apart in mid air and shattering to the floor where they could not be put back together. I gaped and gawked. I was in a war zone and I had not realised it.
I don't always feel intelligent.
And it is not even the first thing I look for when I open my eyes in the morning. My hand reaches to trace the patches of white clouds hanging in a blue sky visible through my window, I listen to the breathing in my body and the breathing outside of all living things that enters my room. I listen to the ache in my heart. These things reach me first and I forget about intelligence. The demand for it forcibly comes when I arrive at my work desk, "they are expecting you to show how intelligent you are with this work" my mind reminds me.
Maybe the purpose of the intellect is to hold the heart in place, the two twirling their fingers together, in love and loved by each other; the one incomplete without the other and incapable of finding the paths of justice.
To be intelligent and have heart is something akin to wisdom.
And without wisdom we can be nothing but basic.


text:
Tag Archives: writers
Posted on November 25, 2018 by V. St. Clare under Short Stories and Creative Non-fiction
A short story by Jason Feingold
John Schwartzkopf awoke to the police banging on his door. After last night, he wasn't surprised to find the Mail Nazis had come for him. They were going to disappear him like they had so many other mail objectors in the past. With no friends or sympathetic followers to protect him, no one would know he was missing. He'd simply fall off the face of the earth. He wasn't going to let that happen. If he was going to die, he was damn sure going to make sure that as many citizens as possible knew what was going down.
He took an old .38 revolver his grandfather had left him and tucked into the waistband of the pants he had hurriedly put on. After donning a t-shirt, he went to the front door and opened it, but he left the screen door closed.
"Are you John Schwartzkopf?" the officer asked.
"I have some questions for you. Can I come in?"
John backed away from the door, leaving it to the police officer to open the screen door on his own. As the cop was doing so, with his hand occupied by being on the handle of the door, John drew his weapon. The officer jumped back and went for his own gun, but John had the drop on him, and to prove it he fired a warning shot. He'd meant for it to go to the right of the officer, but it grazed the cop's left arm instead.
"Step inside," John ordered. "Drop your belt." The officer complied with difficulty, his left arm being useless for the moment.
"Now take out your handcuffs, and no funny business." The officer did as he was told. "Go to the kitchen and handcuff both your hands to the refrigerator door." John gave the officer a wide berth as he did so. In a moment, the officer was handcuffed to the handle of the refrigerator door and dripping blood slowly on the kitchen floor. He writhed in pain.
"You don't want to do this," the cop said. "They'll come looking for me. This can only end one way."
"I know that," John said. "I knew it as soon as you knocked on my door."
"Uncuff me," the officer said. "Turn yourself in. It'll go easier on you if you do. You'll get a plea bargain."
"If only that were true. I'm not going to let you storm troopers send me to the Postal Re-Education Centers that easily," John said. "Not until everyone knows about you Mail Nazis and your Mail Führer."
John could not remember a time he had not hated the mail. As far as he was concerned, nothing good ever came by mail.
He knew what time the mail usually came. He could pick out the sound of the mail truck from anywhere in the house. He could hear it stop and go as it came down the block. He couldn't ignore it. His heart would leap into his throat, and the only way to get it back where it belonged was to go and check the mailbox. He was drawn to the box the way a dog is drawn to its own vomit.
The mail brought student loan default notices, threatening letters from child support enforcement, and notices of garnishment.
The absolute worst thing he could find in the mailbox was a notice that he would have to go to the post office to pick up a certified letter. If nothing good ever came from the mailbox, then certified letters were absolutely diabolical. He'd have to wait until the next day to pick it up – twenty-four hours of excruciating angst spent wondering how bad it was, knowing that the ax was sure to fall. In this, he was usually correct. Legal papers came by certified mail describing various actions that had been brought against him to get more money out of him.
One day a thought popped into his head out of nowhere: the mail was the problem – not his ex-wife, not Navient, but the mail itself. Mail was the medium through which the tyrants of money enslaved people. The whole concept of mail was abominable, and it had to go. If a document were that important, the people who were out to get his money could deliver it by themselves. His resolution to combat the Mail Nazis was firm.
He was going to stop the mail.
"Now where's your phone?" John asked the captive officer.
"In my right front pants pocket."
John set his .38 on the stove and went toward the subdued officer.
"If you try anything, I'll shoot you again," John said.
The officer nodded. John retrieved the phone.
"Who are you calling?" the cop asked mildly.
John put the phone on speaker.
"911," the phone said. "What is your emergency?"
"My name is John Schwartzkopf. I'm at 543 Oakfield Drive. I'm holding Officer, what's your name?"
"Bradley. Ed Bradley."
"I'm holding Officer Ed Bradley at gunpoint. I have a list of demands."
"Is he okay?" the operator asked.
"Tell them," John ordered.
"Shot in the arm," Bradley said. "Not seriously. Hurts like a bitch, though."
"Shut up," John said.
"What are your demands?"
Sirens spoke out in the distance.
"I'll tell the person in charge."
"Who is that, sir?"
"You know who."
"No, I don't, sir."
"If you want to play games, we'll play games," John said. "I want to talk to the Mail Führer."
He hung up the phone.
John began his anti-mail campaign by writing to the head of the USPS.
Dear Postmaster General,
I am writing to you today to demand that all postal services be stopped. All the mail does is deliver bad news from bad people to good people who deserve good news. Mail is all about taking money away from people who don't have much money and giving it to people who already have enough money. As a citizen and a taxpayer, I have a right to demand that you stop the mail immediately. As a civil servant, you need to honor my request.
John Schwartzkopf
He waited a few weeks for a response, but nothing came back in the mail. He wasn't surprised. The mail people were all going to stick together on this one. They were afraid of honest work. After all, they made money with each letter they delivered. That would stop, at least as far as he was concerned. He got online and put an indefinite stop delivery on his mail.
Afterward, John took a bottle of lighter fluid to his mailbox and set it on fire, watching the plastic that had been approved by the Postmaster General bubble and melt and drip to the ground as it burned. Didn't the Postmaster General have anything better to do than approve mailboxes? By the time he was done, there was nothing left but a metal post sticking out of the ground. With a fair degree of effort, he removed it and chucked it into his garage.
A few weeks later his cable TV stopped working. Then the lights went out. Then the water was shut off. Finally, his telephones, both landline, and cell, stopped working, even though he hadn't received a bill from any of them.
Clearly, my last letter fell on deaf ears that don't want to see the truth. If you think that your lackeys in cable, water, electricity, and telephone can stop me from exercising my RIGHT to demand that the mail be stopped, you've got another thing coming. I know that the Constitution requires the government to redress grievances, and you are required to redress mine by halting all mail activity both at home and abroad.
P.S. – Restore my utilities immediately!
Still, there was no response.
Postmaster General,
If you don't honor my demand that the mail be stopped, I will have to
resort to further action.
It was only after John sent the last letter that he realized that the Postmaster General was, in fact, the Mail Führer. He studied some stamps he had stuck in the kitchen drawer. If he looked closely enough, he could see the swastika cleverly embedded in each picture the stamps contained. Well, he wasn't a hundred percent sure it was a swastika, but it was close enough to count.
The Mail Führer completely ignored him, so it was time to take his message to the street. He put a sign in his front yard that said "End the dictatorship of the Post Office! Tell the Mail Führer to STOP THE MAIL NOW!" Once he put it up, he sat in front of his living room window to see if anyone was reading it. He concluded that they were, because a lot of cars slowed down in front of his house, presumably to study it. Some of them tooted their horns.
On the second day, the mail truck pulled up in front of it while John was watching. He couldn't be sure because of the viewing angle, but he was pretty confident that the mailman spat on it. John was so angry he came out of his house with a bat to confront the Mail Nazi, but the man drove away in his truck before John could open the door.
"Fuck you!" John called out down the street at the truck. "Drive away like a scared little
Nazi bastard!" More than a few neighbors stopped and stared.
It was time for the revolution to begin.
John sat on the kitchen floor. He had his .38 revolver and Bradley's .40 caliber Glock and two fully loaded magazines next to him. He could see blue and red lights through the covers of every window in his line of sight. He knew his house was surrounded. He knew he was already dead.
Bradley's phone rang.
"This is Sergeant Bill Murphy. I'm calling to talk to you about your demand."
"I want to talk to the Mail Führer," John repeated. "If that doesn't happen, Ed Bradley here is as good as dead in sixty minutes. Tick tick tick."
"Let's stay calm," Murphy said. "Can you tell me who the Mail Führer is?"
"Like you don't know. She's the person in charge. She's the one who cuts your marching orders."
The line went silent for a time.
"Do you mean the Postmaster General?" Murphy asked.
"So you do know," John said in an "ah-ha" voice.
Before the police came and after his nightly ritual of filling his water bottles from his neighbor's hose, he left the house dressed all in black with his aluminum baseball bat laying across his shoulder. He had duct-taped a towel around the bat to muffle the sound. As he roamed through the neighborhood bashing mailboxes, he imagined how grateful his neighbors would be once they discovered that they couldn't get mail anymore. He hoped a few of them might take up his cause, going into other neighborhoods and relieving good, honest working families from the totem pole of fear and hate and repression symbolized by their rural route mail receptacles.
"I don't think we're going to be able to get her here in sixty minutes," Murphy said. "Is there someone else you'd like to talk to?"
"Yes. A TV news crew. I don't care which station."
"I'll tell you what," Sergeant Murphy said. "You release Officer Bradly, and I'll get that news crew for you."
"Are you kidding? Do you really think I'm that stupid?"
"I don't think you're stupid, John."
"You better not. Because I'm not stupid. You have an hour to get the TV people or I'm going to pop another cap into this Mail Nazi's ass."
With that, John hung up the phone again.
"They're here," Sergeant Murphy called and said forty-five minutes later.
"Send them in."
"I'm not stupid either, John," Murphy said. "I'm not giving you more hostages."
"I'll send Officer Ed out if you send the reporter and the cameraman in," I said grudgingly.
"No deal."
"I'll send them out again when I'm done."
"I can't do that, John. You know that."
"I'll still have a couple of guns," John said. "We'll get to have our shootout."
"No one wants that," Murphy said.
"If you don't send the camera crew in, I'm going to shoot this cop in the thigh. I'm not sure when the femoral artery is, so I hope I miss it when I shoot him so he doesn't bleed out all over the floor. I'm not going to shoot him with this piss-ant .38 either. I'm going to use his Glock."
"Wait a minute," Murphy said quickly. "Let me see if the news people are willing to go in."
John waited.
"I want you to know this isn't personal," John said to Bradley. "You're just on the wrong side."
"Sure," Bradley said. "I understand." John knew he didn't understand. He was just a soldier following orders, blissfully unaware of the tremendous evil he was doing.
Murphy came back on the line.
"They're willing to go in," Murphy said. "I'll let them go in when Bradley comes out."
"You're treating me like I'm stupid again," John said. "You send them in and I'll send Bradley out."
"How do I know you're telling the truth?"
"I haven't lied to you so far," he said.
"Okay," Murphy said. "We'll do it your way. I'm taking an awful risk. Make sure you keep your word."
"Tell them I'm in the kitchen," John said.
A male reporter and a cameraman entered the house and went to the kitchen. John held the gun on them. He had the reporter retrieve Bradley's handcuff key and let him loose.
"Go," John commanded. Bradley left without hesitation. John stood up and turned to the reporter.
"Start interviewing me," John said.
The cameraman manipulated some buttons on the camera and gave a thumbs-up.
"I'm here at the residence of Mr. John Schwartzkopf," the reporter said. "Mr. Schwartzkopf was holding a police officer hostage, but he released the officer in exchange for my cameraman and myself entering the residence.
"Why are you doing this, Mr. Schwartzkopf?" the reporter asked, shoving the microphone in John's face.
"I'll tell you why. I hope the people who are watching are paying attention because they're about to hear the truth.
"For hundreds of years, people have suffered the tyranny of the Postal Service and the dictatorship of the Mail Führer. Nothing ever good comes in the mail, and that's an understatement. The USPS uses the police to let all of the big corporations to send enormous bills to everyday people who are tricked into believing that they actually need to pay money to receive services like cable, electricity, water, etc. People don't know that the big corporations don't actually need the money. All they do with the money is line the pockets of the fat-cat CEOs on Wall Street.
"Even dogs know that the Mail Nazis are evil. Trust your dog. Trust your instincts. You know I'm right. Anyone in a uniform is a Mail Nazi. Take it to the street. Abolish the postal system now."
John stopped talking.
"Is that it?" asked the reporter.
"That's it," John said.
"What are you going to do now?" he asked. John admired the fact that the reporter seemed so calm. In the same situation, he'd be shaky and stuttering. Come to think of it, his situation wasn't much different.
"I'm going to send you out," John said. "Thanks for coming in. It was very brave. I hope the Mail Nazis don't do anything to you for coming in here."
John watched them go. After a few minutes of silent reflection, he held the Glock in his right hand and the .38 in his left. He walked out the front door, taking aim at the nearest Mail Nazi.
He didn't get a single shot off before he heard the loud pop that knocked him off his feet. Sitting up against the door jam, he looked down at his chest. Blood was flowing freely. It wouldn't be long until he was dead.
A policeman in tactical gear approached him from behind a riot shield. He moved the shield to the side as he knelt down in front of John.
"Right conspiracy, wrong conspirators, comrade," the policeman whispered. He bopped John on the head with a hammer, and then a sickle came out of nowhere and tore out John's throat.
A poem by Richard King Perkins II
Through the stray ebb of night,
swirls of black water form her
in a meager grove
of orange-leafed trees.
She studies the bracken and reeds,
looks past the embankment
to figures standing in the distance;
the man in the straw hat
leaning on a grey fence
talking to his daughter.
In a few desperate sentences
he speaks of things to deny or embrace
the endless sky
the empty earth
ghosts of the north country
conspiring with fire.
The girl listens momentarily,
begins to drift away
floating through leaves
and tresses of moss
alighting on a small shoreline—
folding in, turning back.
Richard King Perkins II is a state-sponsored advocate for residents in long-term care facilities. He lives in Crystal Lake, Illinois with his wife, Vickie, and daughter, Sage. He is a three-time Pushcart, Best of the Net and Best of the Web nominee whose work has appeared in more than a thousand publications.
An Astounding Perimeter
It's not a dream
but a slightly bygone world
covered in frozen mist.
Sparrows alight on the small shoreline
of an astounding perimeter—
a sanctum whispering in white.
I study the icebound bracken and reeds,
gazing past the embankment
to this vacancy of snow where your car once slept.
In the old meeting place, I still look for you—
where our conversations spilled upon gentle light;
simple confessions of twigs and soul.
But we're left with only a few desperate sentences;
having spoken of things to deny or embrace,
the evergreen ghosts of our endless north country.
Now you're stranded on a bridge in St. Louis
with no money and no credit cards
and your passenger side window broken out.
I'm in the bristling pines laced ivory
where someone once wrote a song about you;
how your eyes extinguished sensibility,
how your eyes painted light into every corner of darkness.
Can you recall how desperately we believed
that the return of robins and sharp shadows
could change everything;
that crocuses would ignite life in themselves?
Nurserymen and Psychedelia
A poem by Jake Sheff
Encyclopedic hands reach
to reassess squat and woody
cycads. Branchless plants
embrace fingers in recesses
questing for meaning and
other pests. Struck by ugly
pleasure's naked structure,
collectors pay high prices
for loves like leaves sprouting
from no trees. (Cycads generate
heat for male cones to repel
insects toward a more temperate,
fervent sex. Harvest trickles
relative to nature's truckloads
of relaxed approaches.) New
York City nurses doctors
stalking neurotoxic and self-
similar geometries at home;
garment-shredding spikes are
brushed like hair, loosening
deep time's translucent hour.
Jake Sheff is a major and pediatrician in the U.S. Air Force. He is married and has a daughter and three pets. His current home is the Mojave Desert. Jake's poems have been published in Marathon Literary Review, Jet Fuel Review, The Cossack Review, and elsewhere. He has published a chapbook: Looting Versailles, available from Alabaster Leaves Publishing. He considers life an impossible sit-up, but plausible.
Time Is a Long Island
The Author's Arrangement: Adrienne and Corri are friends at a wine tasting with live music. The speaker of the poem is Corri's husband, changing their daughter Maddie's diaper in the restroom of the winery. The speaker's brother is Nathan, on his way to visit aboard the ferry from Connecticut. It's Adrienne's last day visiting, and the wine tasting is just before her flight home.
For A.N.
As Adrienne and Corri tasted wine
I changed a diaper to the tunes of
Hurricane Irene and Buddy Holly.
As Nathan rode the ferry to Orient
Point, a period with two points rode
Like wild fire on the Hampton Jitney
Past Walt Whitman's wrong perfection
Near Ronkonkoma. Soft indifference
Shook the day, cracking Washington's
Monument to – no offense! – a broken
Bagpipe. Wild fire crackled to the quiet
Thud of death as Montauk lit the sea
With magpie intelligence. As Nathan's
Ferry hit the sea, like adages, to bits
And pieces, new advantages were
Speeding down the LIE, past Nassau
County's Art Museum, Tiffany lamps
And shortages of pricelessness. Pure
As rope, the wine was more celestial
Than cellists as Adrienne's plane
Landed in Islip. Jetsetters removed
Their carry-ons from overhead bins
Like jesters overselling peacetime
Exercises in the rain. Sag Harbor was
The province of trapdoors around
The time I finished wiping Maddie's
Fanny*. A calzone was beside a cannoli
And itself in Patchogue's Zagat Rated
Dumpster. Fatigue was dressed up
In fatigues by artists down the LIE
From honesty and letters to editors.
And Nathan's ferry honed its boldness
Down to honey in the homestretch,
But with no agenda in the company
Of gods, it was dogged by goodness
Like a leafy tree. Abbreviated, one-
Sided theories brewed like wild fire
In the South Fork as Adrienne's
Flight was getting used to acronyms
And practice de-icing. Highfalutin
Housekeeping – always the hallmark
Of chastity – festooned the ferry
Like all Poughkeepsie or the Flatiron
Building was on board, but Nathan
Humbly puffed on thoughts of wild
Nights on Fire Island, dazed on chains
Of possibilities like days. The LIE
Poured traffic into Riverhead like casks
Of enthusiasm or wine downhill, done
Gone swirled and sniffed. Wild
Strawberries at Strawberry Fest saw
Wild fire with jet-black forgiveness,
As the Target I browse at for Target
Brand baby powder and wipes went up
Like eyebrows of swallowtail butterflies.
Dogwoods on Stony Brook's campus –
Being of sound minds and street legal
Religions – loaned their agenda to
The ferry and Nathan's career, both
Above the rules and flounders that vary
Very much each season. Butterfish
And porgy knew more than we
Claimed to as Adrienne's taxi
Commenced the saddest story,
Sad because I told it wrong and ate
Its crab cakes, crumbly as calendars.
Mail-order emollients were shipped
From Amagansett to Shelter Island
With toxic affability to prove to wild
Fire only people do important things,
Unlike the Polish Town cemetery,
Ocelot or human occiput without a gut
To tug its soul from aphorists and
Aphrodisiacs; right illnesses and,
And crazy sanity abound on islands
Where the minds and selves of men
Are all like drowning lakes. Planets
Fidgeted on their paths like oaths
As Adrienne stepped into her cab for
MacArthur airport. Iced tea disparaged
Asparagus and lobster bisque behind
The bar on Nathan's ferry; Polish
Town's cemetery said, "Put nothing
Off," and Maddie's diaper said,
"You're putting me on." The same old
Novelties seemed far too medium
Up and down the North Fork as the wild
Fire died, Adrienne's plane took off
And a ferry arrived behind tailor-made
Kindness's everlasting budding holly.
* Consider nates.
Antigone: Of Revenge
In all her urgency she ventured.
The world beyond the world she knew
was there for the curious kind.
And promises, so loosely bound,
dared to defy expectations
of the cautious claims
that had no right to her mind.
Considering every verity,
she heard what was to be
no more than evasion.
Hers was a truth transforming.
She spoke of restoration,
of changes to be made
in cartographies of the antique.
Moving by implication
into an audacious child,
so unusual in her need
to be undefined.
an available reality, she prayed
in the silence between storms.
Her zest was tempestuous fortune,
and so persuasive the means,
her qualifying mercy
of behaving badly
all for the good of all.
Geoffrey Heptonstall's novel, Heaven's Invention, is available in hardback and paperback from Black Wolf. He has recently had his writing published in Scarlet Leaf Review, The London Magazine, and The Global Dispatches.
Diffusion / NBA Finals, 2016
A poem by James Croal Jackson
Pacing around the bar crowd, watching
the Cavaliers transfer heat to one another through
bullet passes around invisible perimeters, Kurt
and I keep drinking the strangers toward us.
"Gaseous diffusion," he offers. "Alcohol
is only molecules bumping into each other."
Our bodies generate more heat with every swig,
the atmosphere tense but warm through
our gullets. We chug chaos in the blur,
invite a thousand basketballs to bounce up
and down halfcourt. The players don't notice
our dribbled words in soundwaves processed
a million different ways in the space between
earlobe and brain. Endlessly the spectators
chant go to sleep because no one we want
to talk to wants to talk to us, our zigzagged steps
combining with the sound of a team on the verge
of climbing a challenging mountain though
the peak is steep so we try nothing more
but the drinks that keep us moving. To stop
would be to hear the room's haunting cheer.
James Croal Jackson is the author of The Frayed Edge of Memory. (Writing Knights Press, 2017.) His poetry has appeared in Hobart, FLAPPERHOUSE, Yes Poetry, and elsewhere. He edits The Mantle, a poetry journal. Find him in Columbus, Ohio, or contact him via his website.
Posted on September 14, 2018 by V. St. Clare under Poetry
A poem by David Lohrey
Say hello, Guido.
Even he deserves a kind word.
Even Guido rates a greeting.
Hello, Guido. Calm the fuck down.
This Guido is an American icon.
He's my uncle. He's my father.
I have a brother named Guido, too.
Here's the thing: Guido's a thug.
Guido spends his days thinking up bad things to do.
Do you know what's going on?
Security guards stealing from banks.
Clerks forgetting to ring customers up.
Bartenders giving away drinks.
Police robbing and raping working women.
Presidents selling arms to terrorists.
Say hello to Guido, who breaks necks
for a living. His talent is stabbing people
in the back and twisting the knife.
He just bought a house on West Clover Drive.
His son wants a tricycle for his birthday.
If you don't know who Guido is,
I'd say you are a lucky man.
You can wear the magic jacket and
distribute coffee beans from your car.
You can sleep at night with your sister.
You can step up to the mic.
You'll say be nice because Guido is gay.
You'll say remember that Guido is mentally ill.
You'll say Guido deserves a second chance.
Some will say Guido is a hero.
I say Guido should be whipped.
Take Guido to the square and tie him up.
Guido and his gang wreck havoc
everywhere they go. They don't
deserve a second chance. Crime
is not a misunderstanding. Guido is not
your friend. He is not your brother nor your sister.
Loyalty is out of order. Stay away.
Lunatics don't deserve mercy. Save it
for the less fortunate: you and me, just
little ants trying to make a living.
We don't deserve to be stepped on.
Monsters do.
David Lohrey is from Memphis, Tennessee. He graduated from U.C., Berkeley. His poetry can be found in Otoliths, Stony Thursday Anthology, Sentinel Literary Quarterly, and Boxcar Poetry Review. Some of his recent poems have appeared in the U.S. publications Poetry Circle, FRiGG, Obsidian, and Apogee Journal. His fiction can be read in Crack the Spine, Dodging the Rain, and The Broke Bohemian. His book, The Other Is Oneself, a study of 20th century literature, was published last year in Germany. David's first collection of poetry, Machiavelli's Backyard, was released in August by Sudden Denouement Publishers. David lives in Tokyo.
Mr. and Mrs. Adam and Eve
Illegals are to be called the undocumented.
Changing names does wonders.
His bastard is a love-child.
Why not move right into the fantasy?
Drop the love-child off at the orphanage.
Why not move right in?
We won't call them criminals; we'll call them underprivileged.
Plaster over all our bruises; cover our cracks.
Talking filth can sound pretty if you bang a tambourine.
Plaster over our bruises; cover our tracks.
One can issue a death sentence while playing the piano.
We had that with the Germans: musical exterminations.
Your killer needn't be called a criminal.
We had that with the Germans.
We'll call him a liberator, an emancipator, or an engineer.
I like to spit on my hand and shake.
Others like lawyers; they prefer fancy language.
Why can't the government pay our bills?
Others like lawyers; they prefer fancy words.
Send someone over to clean up my yard.
Take the profits away from the Waltons.
Give us a charge account at Saks Fifth Avenue.
The rich can pay for it.
What's the deficit got to do with it?
We give up.
Call it anything you want.
Take away the burden of daily life.
Take us back to Eden. We give up.


These Olympians could sign lucrative endorsement deals after the Winter Games.
Gold has become America's sweetheart because of her talent, looks and personality, and could be in line for new sponsorship deals worth over $1 million.
Gold, who helped her team win a bronze medal, already has deals with companies such as Nike (NKE), Visa (V), United Airlines and Procter & Gamble (PG).


I have learned to become a very devotional mother and wife. I have two kids one boy and one girl. The boys name is Tyler Lamont and, he is seven years old now, he was born in February 18, 2005. My daughter's name is Emily Lamont, she is six years out she was born in 2006. Around the time I was facing Warren in court. Luckily now Lamont and I have established a nice future together with our two lovely kids. Our two young kids are loving there life.
I remember writing a diary witch only had two pages filled out the day I realized who I would be marrying. Sadly though I didn't put any real emotions in it though since I was told to be careful with what I wrote in it, since I could eventually regret it in the future. I eventually wrote a book, published in 2008. The book is based on my life and really gets in depth of what I have been trying to explain. This book even has pictures included in it of my life and family. Hopefully you get time to read it since it's really good book.
I Really enjoyed driving remember my first car, it was a Ford Ranger. I had learned to drive a truck around the age of 14 like most FLDS girls. I had so many good memories with this car I would drive it everywhere and it would also be my get away from Allen. I remember for a long time I started to practically live in my car for fear of going home and being afraid of what Allen was going to do next to me. The car was originally Allen's but since he had two he let me keep it pracically.


iHateBadService.ca - Do you hate bad service ? We do.: Kotex "Mini's"
Me, being a girl was browsing walmart one evening, when I came across the new "U by Kotex" pads. Naturally, the bright colors attracted me. I took them home, and I took them out of the package and was appaulled at how small they are.. They should be called "Teen Size" because they're so small. I emailed the company and explained how I was really disappointed in the size, and they sent me coupons for 2 packages!! Why do I want to buy more, when I'm not going to use the ones I have?!