Dense Associative Memory Is Robust to Adversarial Inputs

By Dmitry Krotov, John J. Hopfield. 2017

140 citations recorded by the source corpus.

Deep neural networks (DNNs) trained in a supervised way suffer from two known problems. First, the minima of the objective function used in learning correspond to data points (also known as rubbish examples or fooling images) that lack semantic similarity with the training data. Second, a clean input can be changed by a small, and often imperceptible for human vision, perturbation so that the resulting deformed input is misclassified by the network. These findings emphasize the differences between the ways DNNs and humans classify patterns and raise a question of designing learning algorithms that more accurately mimic human perception compared to the existing methods. Our article examines these questions within the framework of dense associative memory (DAM) models. These models are defined by the energy function, with higher-order (higher than quadratic) interactions between the neurons. We show that in the limit when the power of the interaction vertex in the energy function is sufficiently large, these models have the following three properties. First, the minima of the objective function are free from rubbish images, so that each minimum is a semantically meaningful pattern. Second, artificial patterns poised precisely at the decision boundary look ambiguous to human subjects and share aspects of both classes that are separated by that decision boundary. Third, adversarial images constructed by models with small power of the interaction vertex, which are equivalent to DNN with rectified linear units, fail to transfer to and fool the models with higher-order interactions. This opens up the possibility of using higher-order models for detecting and stopping malicious adversarial attacks. The results we present suggest that DAMs with higher-order energy functions are more robust to adversarial and rubbish inputs than DNNs with rectified linear units.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

Citations in the corpus

SafetyNet: Detecting and Rejecting Adversarial Examples Robustly (2017, background): “Some network architectures appear to be robust to adversarial examples [13], which still need more empirical verification.”
Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey (2018, methodology): “Kortov and Hopfiled [126] examined the existence of adversarial perturbations in the context of Dense AssociativeMemory (DAM)models [162].”
Review of Artificial Intelligence Adversarial Attack and Defense Technologies (2019, methodology): “In the articles [31,32], they replaced DNN in MalGAN with RNN.”
Advances in adversarial attacks and defenses in computer vision: A survey (2021, background): “Nevertheless, Kortov and Hopfiled [297] later provided another evidence based on Dense Associative Memory [298] that supports the role of linearity in neural model susceptibility to adversarial examples.”
Fine-tuning Image Transformers using Learnable Memory (2022, background): “In a recent years, there has been proposed a series of improvements to the energy function of such networks to increase its capacity [24], help protect against adversarial attacks [23] or as a replacement for attention in transformer networks [32].”
Hopfield Networks is All You Need (2020, background): “Modern Hopfield networks called “dense associative memory” (DAM) models use an energy function with interaction functions of the form F (x) = x and, thereby, achieve a storage capacity proportional to dn−1 [41, 42].”
Adversarial Spheres (2018, background): “Some works increase robustness to small perturbations by changing the non-linearities used (Krotov & Hopfield, 2017), distilling a large network into a small network (Papernot et al., 2016), or using regularization (Cisse et al., 2017).”
Modern Hopfield Networks and Attention for Immune Repertoire Classification (2020, background): “We show that the attention mechanism of transformers is the update rule of modern Hopfield networks (Krotov & Hopfield, 2016, 2018; Demircigil et al., 2017) that are generalized to continuous states in contrast to classical Hopfield networks (Hopfield, 1982).”
Unsupervised learning by competing hidden units (2018, methodology): “The power of the activation function n ≥ 1 is a hyperparameter of the model [15, 16], n = 1 corresponds to ReLU.”
Adversarial Examples on Object Recognition (2020, background): “However, RBF units can not generalize very well and do not achieve the same performance as ReLU based DNNs. Krotov and Hopﬁeld [96] tried to replace ReLU activations with higher rectiﬁed polynomials and observed an increase in robustness.”
Keeping the Bad Guys Out: Protecting and Vaccinating Deep Learning with JPEG Compression (2017, unknown): “Dense Associative Memory model [12] tries to enforce higher order interactions between neurons by changing rectiﬁed linear unit (ReLU) to rectiﬁed polynomials.”
Adversarial Examples for Malware Detection (2017, background): “Other approaches include blocking the gradient flow [37], changing the activation function [17], or directly classifying adversarial examples as out of distribution [7,22,13,10].”