Cited by 119Adversarial Robustness in Machine LearningNeural Networks and ApplicationsAdvanced Neural Network Applications

The DOI matches its Crossref record; 2 of the 2 references it cites were found in a registry or an index.

Dense Associative Memory Is Robust to Adversarial Inputs

Open access
Krotov, Dmitry, Hopfield, John·2018·Neural Computation

Abstract

Deep neural networks (DNNs) trained in a supervised way suffer from two known problems. First, the minima of the objective function used in learning correspond to data points (also known as rubbish examples or fooling images) that lack semantic similarity with the training data. Second, a clean input can be changed by a small, and often imperceptible for human vision, perturbation so that the resulting deformed input is misclassified by the network. These findings emphasize the differences between the ways DNNs and humans classify patterns and raise a question of designing learning algorithms that more accurately mimic human perception compared to the existing methods. Our article examines these questions within the framework of dense associative memory (DAM) models. These models are defined by the energy function, with higher-order (higher than quadratic) interactions between the neurons. We show that in the limit when the power of the interaction vertex in the energy function is sufficiently large, these models have the following three properties. First, the minima of the objective function are free from rubbish images, so that each minimum is a semantically meaningful pattern. Second, artificial patterns poised precisely at the decision boundary look ambiguous to human subjects and share aspects of both classes that are separated by that decision boundary. Third, adversarial images constructed by models with small power of the interaction vertex, which are equivalent to DNN with rectified linear units, fail to transfer to and fool the models with higher-order interactions. This opens up the possibility of using higher-order models for detecting and stopping malicious adversarial attacks. The results we present suggest that DAMs with higher-order energy functions are more robust to adversarial and rubbish inputs than DNNs with rectified linear units.

Overview

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1162/neco_a_01143

Cites

2 of 2 references verified0 citation errors · 0 not checkable

Statistics

Verification

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • The energy function of modern Hopfield networks makes them robust against adversarial attacks.

    “The energy function of modern Hopfield networks makes them robust against adversarial attacks (Krotov & Hopfield, 2018).”

    From Hopfield Networks is All You Need (2020) · cites this paper as Krotov & Hopfield, 2018

    The Abstract (p. 1) reports that adversarial images made for low-power models fail to fool dense associative memory models with sufficiently high-order energy functions. The claim is broader than that result: the Discussion (p. 11) says that changing the activation function alone is not enough and that other aspects of training are important. (LLM, conf=0.87)

    Experimental — accuracy not yet measured
  • Interaction functions of the form F(x) = x^n lead to storage capacity of α_n d^{n-1}, where α_n depends on the allowed error probability.

    “Interaction functions of the form F ( x ) = x n lead to storage capacity of α n d n -1 , where α n depends on the allowed error probability (Krotov & Hopfield, 2016; 2018; Demircigil et al., 2017) (see (Krotov & Hopfield, 2018) for the non-binary case).”

    From Hopfield Networks is All You Need (2020) · cites this paper as Krotov & Hopfield, 2018

    Section 2 (p. 3) describes power-dependent, rectified-polynomial energy functions, but does not give a storage-capacity result. Searches for the α_n d^{n−1} scaling and its dependence on allowed error probability found no passage addressing either point in our copy. (LLM, conf=0.74)

    Experimental — accuracy not yet measured

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Citations

Cites

Flagged first, then by citations

Research works printed but not linked: 11

  1. Goodfellow I. J., 2014, Explaining and harnessing adversarial examples
  2. Gu S., 2014, Towards deep neural network architectures robust to adversarial examples
  3. Huang R., 2015, Learning with a strong adversary
  4. Krotov D., 2016, Advances in neural information processing systems, 29, 1172
  5. Kurakin A., 2016, Adversarial examples in the physical world
  6. Miyato T., 2015, Distributional smoothing with virtual adversarial training
  7. Nøkland A., 2015, Improving back-propagation by adding an adversarial gradient
  8. Papernot N., 2016, Transferability in machine learning: From phenomena to black-box attacks using adversarial samples
  9. Papernot N., 2016, Practical black-box attacks against deep learning systems using adversarial examples
  10. Szegedy C., 2013, Intriguing properties of neural networks
  11. Wang Q., 2016, Random feature nullification for adversary resistant deep architecture

Cited by

Sorted by citations

Metadata

Authors
Krotov, D., & Hopfield, J.
Affiliations
  • Institute for Advanced Study (US)
  • Princeton University (US)
Venue
Neural Computation
Published
2018-12
Volume
30
Issue
12
Pages
3151-3167
ISSN
  • 0899-7667 (ISSN-L)
  • 1530-888X
OpenAlex
W2584321260
Cited by
106
References
2
Citations by year
2026: 6 · 2025: 13 · 2024: 13 · 2023: 8 · 2022: 9 · 2021: 16 · 2020: 14 · 2019: 11 · 2018: 12
FWCI
7.42
Type
journal article
Language
en
Open access
Locations
  • Neural Computation (publishedVersion)
  • PubMed (publishedVersion)
  • arXiv (Cornell University) (submittedVersion)
  • arXiv (Cornell University)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
  • Physical Sciences › Computer Science › Artificial Intelligence › Neural Networks and Applications
  • Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Advanced Neural Network Applications
Keywords
dense associative memory, adversarial robustness, adversarial examples, higher-order interactions, energy function, decision boundaries, rectified linear units, deep neural network, human perception
MeSH terms
Brain, Humans, Pattern Recognition, Visual, Neural Networks, Computer

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review