The DOI matches its Crossref record; 3 of the 3 references it cites were found in a registry or an index.
Dense Associative Memory Is Robust to Adversarial Inputs
Open accessAbstract
Deep neural networks (DNNs) trained in a supervised way suffer from two known problems. First, the minima of the objective function used in learning correspond to data points (also known as rubbish examples or fooling images) that lack semantic similarity with the training data. Second, a clean input can be changed by a small, and often imperceptible for human vision, perturbation so that the resulting deformed input is misclassified by the network. These findings emphasize the differences between the ways DNNs and humans classify patterns and raise a question of designing learning algorithms that more accurately mimic human perception compared to the existing methods. Our article examines these questions within the framework of dense associative memory (DAM) models. These models are defined by the energy function, with higher-order (higher than quadratic) interactions between the neurons. We show that in the limit when the power of the interaction vertex in the energy function is sufficiently large, these models have the following three properties. First, the minima of the objective function are free from rubbish images, so that each minimum is a semantically meaningful pattern. Second, artificial patterns poised precisely at the decision boundary look ambiguous to human subjects and share aspects of both classes that are separated by that decision boundary. Third, adversarial images constructed by models with small power of the interaction vertex, which are equivalent to DNN with rectified linear units, fail to transfer to and fool the models with higher-order interactions. This opens up the possibility of using higher-order models for detecting and stopping malicious adversarial attacks. The results we present suggest that DAMs with higher-order energy functions are more robust to adversarial and rubbish inputs than DNNs with rectified linear units.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“The energy function of modern Hopfield networks makes them robust against adversarial attacks (Krotov & Hopfield, 2018).”
From Hopfield Networks is All You Need (2020) · cites this paper as Krotov & Hopfield, 2018
Experimental — accuracy not yet measuredThe check wasn’t confident either way, so it gives no verdict — never disputed.
In the citing paper
“Interaction functions of the form F ( x ) = x n lead to storage capacity of α n d n -1 , where α n depends on the allowed error probability (Krotov & Hopfield, 2016; 2018; Demircigil et al., 2017) (see (Krotov & Hopfield, 2018) for the non-binary case).”
From Hopfield Networks is All You Need (2020) · cites this paper as Krotov & Hopfield, 2018
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Adversarial examples in the physical world
Kurakin, A., Goodfellow, I. J., & Bengio, S. (2018) · Artificial Intelligence Safety and Security · doi:10.1201/9781351251389-8 · Cited by 5,375
Deep neural networks are easily fooled: High confidence predictions for unrecognizable images
Nguyen, A., Yosinski, J., & Clune, J. (2015) · 2015 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2015.7298640 · Cited by 3,258
Best practices for convolutional neural networks applied to visual document analysis
Simard, P. Y., Steinkraus, D., & Platt, J. C. (2005) · IAPR International Conference on Document Analysis and Recognition (ICDAR) · doi:10.1109/icdar.2003.1227801 · Cited by 2,862
Research works printed but not linked: 10
- Goodfellow I. J., 2014, Explaining and harnessing adversarial examples
- Gu S., 2014, Towards deep neural network architectures robust to adversarial examples
- Huang R., 2015, Learning with a strong adversary
- Krotov D., 2016, Advances in neural information processing systems, 29, 1172
- Miyato T., 2015, Distributional smoothing with virtual adversarial training
- Nøkland A., 2015, Improving back-propagation by adding an adversarial gradient
- Papernot N., 2016, Transferability in machine learning: From phenomena to black-box attacks using adversarial samples
- Papernot N., 2016, Practical black-box attacks against deep learning systems using adversarial examples
- Szegedy C., 2013, Intriguing properties of neural networks
- Wang Q., 2016, Random feature nullification for adversary resistant deep architecture
Cited by
Sorted by citations
Items 101–119 of 119
Interconnection Tensor Rank and the Neural Network Storage Capacity
Kryzhanovsky, B. (2025) · Optical Memory and Neural Networks · doi:10.3103/s1060992x25600272
Learning and Design Methodologies for Efficient, Robust Neural Networks
Panda, P. (2019) · Figshare · doi:10.25394/pgs.8256749
Индексные структуры для быстрого поиска по сходству бинарных векторов
Рачковский, Д. А. (2017) · The scientific electronic library of periodicals of the National Academy of Sciences of Ukraine (National Academy of Sciences of Ukraine)
Multi-model-based defense against adversarial examples for neural networks
Srisakaokul, S. (2020) · Illinois Digital Environment for Access to Learning and Scholarship (University of Illinois at Urbana-Champaign)
Ramanathan, S., & Sengupta, A. (2025) · Cambridge University Press eBooks · doi:10.1017/9781009564335.008
Optical Hopfield neural networks with enhanced storage capacity
Li, Z., Kumar, S., Katidis, M., Musa, K., Huang, Y., & Qu, C. (2026) · Optics Letters · doi:10.1364/ol.584466
Hopfield network-based algorithm for combinatorial optimization
Hamdouch, H., Rbihou, S., Senhaji, K., & Haddouch, K. (2026) · Applied Soft Computing · doi:10.1016/j.asoc.2026.114652
Explaining Machine Learning and Memorization with Statistical MechanicsPreprint
Thériault, R. (2026) · arXiv (Cornell University) · doi:10.25429/theriault-robin_phd2026-01-15
Restricted Hopfield Networks are Resilient to Adversarial Perturbations
Lin, C., Yeap, T., Kiringa, I., & Zhang, B. (2025) · IEEE International Conference on Cognitive Machine Intelligence (CogMI) · doi:10.1109/cogmi67134.2025.00018
Exemples adversaires et régions linéaires
Seck, I. (2021) · theses.fr (ABES) · doi:10.70675/c43fdbbez8e62z4884z9f3ez5e78e3005032
Dense Associative Memory with Biased Patterns: A Replica Symmetric Analysis
Albanese, L., Alessandrelli, A., & Carella, F. (2026) · Journal of Statistical Physics · doi:10.1007/s10955-026-03679-y
Inference acceleration and optimization in deep neural networks for computer vision
Keddous, F. E. (2022) · theses.fr (ABES) · doi:10.70675/b08b2f98z66c2z46d7za694z241b7296cbd2
Deep learning and neuroscience : a match made in heaven?
Choksi, B. (2022) · theses.fr (ABES) · doi:10.70675/42802d90z0c77z4de8z829dz508145498217
Mansingh, S., Kenyon, G. T., & Teti, M. (2026) · Assurance and Security for AI-enabled Systems · doi:10.1117/12.3094612
Li, Y., & Aihara, K. (2026) · Frontiers in Network Physiology · doi:10.3389/fnetp.2026.1778380
Semi-supervised Hopfield model: Theoretical and Numerical results
Albanese, L., Ladiana, A., & Lepre, A. (2026) · Physica A Statistical Mechanics and its Applications · doi:10.1016/j.physa.2026.132009
Les Xarxes de Hopfield i el seu abast
Blanch, G. D. L. R. (2025) · Rovira & Virgili repository
Sequential Sampling as a Computational Principle of Episodic MemoryPreprint
Kerrén, C., Dixit, S., Coxon, E., Nikolaev, A., & Doeller, C. (2026) · bioRxiv (Cold Spring Harbor Laboratory) · doi:10.64898/2026.10.08.757704
On the Statistical Mechanics of AttentionPreprint
Hu, J. Y.-C., Chen, Y.-A., Su, M., & Liu, H. (2026) · arXiv (Cornell University) · doi:10.48550/arxiv.2610.17347
Metadata
- Authors
- Krotov, D., & Hopfield, J.
- Affiliations
- Institute for Advanced Study (US)
- Princeton University (US)
- ORCID
- Krotov, Dmitry
- Venue
- Neural Computation
- Publisher
- MIT Press - Journals
- Published
- 2018-12
- Volume
- 30
- Issue
- 12
- Pages
- 3151-3167
- ISSN
- 0899-7667 (ISSN-L)
- 1530-888X
- OpenAlex
- W2584321260
- Cited by
- 106
- References
- 2
- Citations by year
- 2026: 6 · 2025: 13 · 2024: 13 · 2023: 8 · 2022: 9 · 2021: 16 · 2020: 14 · 2019: 11 · 2018: 12
- FWCI
- 7.42
- Type
- journal article
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- Neural Computation (publishedVersion)
- PubMed (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- arXiv (Cornell University)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Neural Networks and Applications
- Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Advanced Neural Network Applications
- Keywords
- dense associative memory, adversarial robustness, adversarial examples, higher-order interactions, energy function, decision boundaries, rectified linear units, deep neural network, human perception
- MeSH terms
- Brain, Humans, Pattern Recognition, Visual, Neural Networks, Computer
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
