The DOI matches its Crossref record; 3 of the 3 references it cites were found in a registry or an index.
Dense Associative Memory Is Robust to Adversarial Inputs
Open accessAbstract
Deep neural networks (DNNs) trained in a supervised way suffer from two known problems. First, the minima of the objective function used in learning correspond to data points (also known as rubbish examples or fooling images) that lack semantic similarity with the training data. Second, a clean input can be changed by a small, and often imperceptible for human vision, perturbation so that the resulting deformed input is misclassified by the network. These findings emphasize the differences between the ways DNNs and humans classify patterns and raise a question of designing learning algorithms that more accurately mimic human perception compared to the existing methods. Our article examines these questions within the framework of dense associative memory (DAM) models. These models are defined by the energy function, with higher-order (higher than quadratic) interactions between the neurons. We show that in the limit when the power of the interaction vertex in the energy function is sufficiently large, these models have the following three properties. First, the minima of the objective function are free from rubbish images, so that each minimum is a semantically meaningful pattern. Second, artificial patterns poised precisely at the decision boundary look ambiguous to human subjects and share aspects of both classes that are separated by that decision boundary. Third, adversarial images constructed by models with small power of the interaction vertex, which are equivalent to DNN with rectified linear units, fail to transfer to and fool the models with higher-order interactions. This opens up the possibility of using higher-order models for detecting and stopping malicious adversarial attacks. The results we present suggest that DAMs with higher-order energy functions are more robust to adversarial and rubbish inputs than DNNs with rectified linear units.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“The energy function of modern Hopfield networks makes them robust against adversarial attacks (Krotov & Hopfield, 2018).”
From Hopfield Networks is All You Need (2020) · cites this paper as Krotov & Hopfield, 2018
Experimental — accuracy not yet measuredThe check wasn’t confident either way, so it gives no verdict — never disputed.
In the citing paper
“Interaction functions of the form F ( x ) = x n lead to storage capacity of α n d n -1 , where α n depends on the allowed error probability (Krotov & Hopfield, 2016; 2018; Demircigil et al., 2017) (see (Krotov & Hopfield, 2018) for the non-binary case).”
From Hopfield Networks is All You Need (2020) · cites this paper as Krotov & Hopfield, 2018
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Adversarial examples in the physical world
Kurakin, A., Goodfellow, I. J., & Bengio, S. (2018) · Artificial Intelligence Safety and Security · doi:10.1201/9781351251389-8 · Cited by 5,375
Deep neural networks are easily fooled: High confidence predictions for unrecognizable images
Nguyen, A., Yosinski, J., & Clune, J. (2015) · 2015 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2015.7298640 · Cited by 3,258
Best practices for convolutional neural networks applied to visual document analysis
Simard, P. Y., Steinkraus, D., & Platt, J. C. (2005) · IAPR International Conference on Document Analysis and Recognition (ICDAR) · doi:10.1109/icdar.2003.1227801 · Cited by 2,862
Research works printed but not linked: 10
- Goodfellow I. J., 2014, Explaining and harnessing adversarial examples
- Gu S., 2014, Towards deep neural network architectures robust to adversarial examples
- Huang R., 2015, Learning with a strong adversary
- Krotov D., 2016, Advances in neural information processing systems, 29, 1172
- Miyato T., 2015, Distributional smoothing with virtual adversarial training
- Nøkland A., 2015, Improving back-propagation by adding an adversarial gradient
- Papernot N., 2016, Transferability in machine learning: From phenomena to black-box attacks using adversarial samples
- Papernot N., 2016, Practical black-box attacks against deep learning systems using adversarial examples
- Szegedy C., 2013, Intriguing properties of neural networks
- Wang Q., 2016, Random feature nullification for adversary resistant deep architecture
Cited by
Sorted by citations
Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey
Akhtar, N., & Mian, A. (2018) · IEEE Access · doi:10.1109/access.2018.2807385 · Cited by 2,021
Adversarial Examples for Malware Detection
Grosse, K., Papernot, N., Manoharan, P., Michael Backes, A., & McDaniel, P. D. (2017) · Lecture notes in computer science · doi:10.1007/978-3-319-66399-9_4 · Cited by 584
Review of Artificial Intelligence Adversarial Attack and Defense Technologies
Qiu, S., Liu, Q., Zhou, S., & Wu, C. (2019) · Applied Sciences · doi:10.3390/app9050909 · Cited by 429
SafetyNet: Detecting and Rejecting Adversarial Examples Robustly
Lu, J., Issaranon, T., & Forsyth, D. A. (2017) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2017.56 · Cited by 405
Cyber security meets artificial intelligence: a survey
Li, J. (2018) · Frontiers of Information Technology & Electronic Engineering · doi:10.1631/fitee.1800573 · Cited by 373
Metadata
- Authors
- Krotov, D., & Hopfield, J.
- Affiliations
- Institute for Advanced Study (US)
- Princeton University (US)
- ORCID
- Krotov, Dmitry
- Venue
- Neural Computation
- Publisher
- MIT Press - Journals
- Published
- 2018-12
- Volume
- 30
- Issue
- 12
- Pages
- 3151-3167
- ISSN
- 0899-7667 (ISSN-L)
- 1530-888X
- OpenAlex
- W2584321260
- Cited by
- 106
- References
- 2
- Citations by year
- 2026: 6 · 2025: 13 · 2024: 13 · 2023: 8 · 2022: 9 · 2021: 16 · 2020: 14 · 2019: 11 · 2018: 12
- FWCI
- 7.42
- Type
- journal article
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- Neural Computation (publishedVersion)
- PubMed (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- arXiv (Cornell University)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Neural Networks and Applications
- Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Advanced Neural Network Applications
- Keywords
- dense associative memory, adversarial robustness, adversarial examples, higher-order interactions, energy function, decision boundaries, rectified linear units, deep neural network, human perception
- MeSH terms
- Brain, Humans, Pattern Recognition, Visual, Neural Networks, Computer
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
