Pith. sign in

REVIEW 5 major objections 5 minor 23 references

Bidirectional associative memory becomes robust to noise and attacks when its weights are trained by subspace rotation; the two mechanisms—orthogonal weights and gradient–pattern alignment—can also be added as regularizers to backpropagatio

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-03 22:07 UTC pith:6ZAH27JC

load-bearing objection B-SRA plus OWM/GPA regularizers is a genuine contribution to BAM training, but the authors' own admission that standard gradient attacks are unsuitable for BAM pulls the rug out from under the advertised robustness ranking. the 5 major comments →

arxiv 2511.11902 v2 pith:6ZAH27JC submitted 2025-11-14 cs.LG cs.AI

Robust Bidirectional Associative Memory via Regularization Inspired by the Subspace Rotation Algorithm

Ci Lin , Tet Yeap , Iluju Kiringa This is my paper
classification cs.LG cs.AI
keywords Bidirectional associative memorysubspace rotation algorithmadversarial robustnessorthogonal weight matricesgradient-pattern alignmentregularizationassociative memory capacitybidirectional backpropagation
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Bidirectional associative memory (BAM) trained by standard two-way backpropagation is fragile: masked, noisy, or deliberately perturbed inputs produce retrieval errors. The paper proposes a gradient-free alternative, the Bidirectional Subspace Rotation Algorithm (B-SRA), in which each weight matrix is updated by rotating it so that the network's reconstructions align with the stored pattern pairs. Experiments show that B-SRA-trained BAMs retrieve correctly even under strong masking, Gaussian noise, and gradient-based attacks. From this success the paper extracts two principles—nearly orthogonal weight matrices and alignment between the loss gradient and the stored pattern—and adds them as regularizers to bidirectional backpropagation. The combined SAME configuration is the most resilient at 50, 100, and 200 stored pairs.

Core claim

The paper's central claim is that the fragility of BAM trained by bidirectional backpropagation is not inherent to associative memory but to how the weights are learned. A BAM trained with B-SRA—an iterative, gradient-free scheme that rotates each weight matrix so reconstructed patterns align with stored targets, using the SVD-based optimal rotation—retrieves stored pairs correctly even when half the query is masked, under strong Gaussian noise, and under FGSM perturbations with epsilon up to 0.9. The paper attributes this robustness to two measurable properties: orthogonal weight matrices, which keep the condition number at 1 and therefore do not amplify noise, and gradient-pattern alignmen

What carries the argument

The load-bearing mechanism is the Bidirectional Subspace Rotation Algorithm (B-SRA). For each end of the network, B-SRA computes the cross-correlation between the target patterns and the current reconstruction, takes its singular value decomposition, and multiplies the current weight matrix by the resulting optimal rotation. Alternating this rotation between the A-end and B-end brings both mappings into alignment with the stored associations without any gradient, learning rate, or loss backpropagation. The paper reads two principles out of the rotated solution: an orthogonal weight matrix (OWM), because rotations preserve norms and keep the condition number at 1, and gradient-pattern alignme

Load-bearing premise

The load-bearing premise is that FGSM, FFGSM, BIM, and PGD are valid adversarial threat models for BAM; the paper itself notes these gradient-based attacks 'may not be suitable' for evaluating BAM, and if that is true the robustness results are about resisting specific perturbations, not adversarial examples.

What would settle it

Construct an attacker that is native to BAM's recurrent dynamics—for example, maximize the retrieval error by gradient ascent on the network's energy function or on the mismatch between retrieved and target patterns within an epsilon-ball—and compare it with FGSM/PGD at the same epsilon on SRA/SAME models. If this attacker produces large retrieval errors where FGSM/PGD do not, the adversarial-robustness claim fails. A simpler check: if random Gaussian noise of the same magnitude produces retrieval errors comparable to FGSM/PGD, the methods are robust to bounded noise, not to adversarial exampl

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Gradient-free training of BAM is sufficient for strong robustness: the entire update is alternating SVD rotations, with no gradients and no hyperparameter schedule.
  • Bidirectional backpropagation can be brought to nearly the same robustness by adding two simple penalties, so existing gradient-based pipelines can be hardened without abandoning backpropagation.
  • The SAME configuration—OWM and GPA in the same direction—is the most balanced across Gaussian noise, FGSM, FFGSM, BIM, and PGD, and its edge grows in a deeper 5-layer BAM storing 200 pairs.
  • Because orthogonal weights keep the condition number at 1, perturbations are not amplified as they propagate through the network, giving a quantitative explanation for the tolerance to masking and noise.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: if gradient-based attacks are indeed unsuitable for recurrent associative memories, the reported numbers measure robustness against bounded perturbations rather than adversarial examples; a BAM-specific attacker built from the network's energy function could rank the methods differently.
  • Editorial inference: the same two penalties could be applied to any associative or attention-like layer whose stored patterns act as attractors; a concrete test is adding L_ortho and L_align to a Hopfield-style memory and measuring retrieval error under noise.
  • Editorial inference: the GPA rationale predicts a local-geometry signature—the loss surface around each stored pattern is flatter along directions orthogonal to the pattern than along the pattern itself; measuring the local Lipschitz constant or Hessian spectrum along those directions would test the mechanism directly.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. This paper addresses the robustness of Bidirectional Associative Memories (BAMs). It extends the Subspace Rotation Algorithm (SRA) to bidirectional training (B-SRA) by alternating orthogonal Procrustes updates on the two sets of weights, and it identifies two principles--orthogonal weight matrices (OWM) and gradient-pattern alignment (GPA)--as the sources of B-SRA's robustness. These principles are then added as regularizers to Bidirectional Backpropagation (B-BP), yielding configurations ORTH, ALIGN, DIFF, and SAME (OWM+GPA). The paper evaluates B-BP, B-SRA, and the regularized variants on paired MNIST digits and Chinese script patterns at capacities 50, 100, and 200 pairs, under masking, Gaussian noise, and FGSM/FFGSM/BIM/PGD attacks. The central claim is that the SAME configuration achieves the strongest overall resilience; for example, Table III FGSM shows SAME output error 0.0 at the B end versus 2.057 for SRA. A stability analysis and an ablation study are also presented.

Significance. If the central claims held, the paper would contribute a gradient-free training method for associative memories and two simple regularizers that transfer robustness principles from a rotation-based algorithm to a backpropagation-trained BAM. The work is organized as a systematic ablation across six training strategies, several perturbation types, and multiple capacities, and it provides a public code link. However, the theoretical support contains an unproved sign assumption in the stability proof, the rotation derivation in Appendix C is not valid as written, and the adversarial evaluation is called into question by the paper's own concluding remark that existing gradient-based attacks may not be suitable for BAM. The practical significance is therefore conditional on resolving those issues.

major comments (5)
  1. [Section II-A, Eq. (6)] The monotonic decrease of the energy E(t) is not proven. The transition from Eq. (5) to Eq. (6) uses dV_k/dt = g'(R_k) * dR_k/dt and then asserts that R_k and U_k have rates of change with the same sign. This is an unproved assumption, not a consequence of the monotonicity of tanh/sigmoid/ReLU. In a recurrent BAM with trained weights, dR_k/dt and dU_k/dt can easily have opposite signs; no coupling argument is provided. Additionally, Eq. (2) has a dimension/transpose issue: dR_{k-1}/dt = V_k(t) W_k^T should presumably be W_k^T V_k(t). Because the stability guarantee is load-bearing for the claim that B-SRA-trained models are dynamical associative memories, the proof needs to be corrected or replaced by an explicitly stated condition.
  2. [Appendix C, Eqs. (19)-(21)] The derivation of the subspace-rotation update is not valid as written. The two terms to be maximized in Eq. (19) are tr(Q^T * \Y^T Y) and tr(\X^T X Q). For the original BAM, \Y^T Y = X^T \W^T W X while \X^T X = Y^T \W W^T Y; these are different matrices and generally have different SVDs. A single Q = U V^T cannot maximize both terms simultaneously. The alternating updates in Algorithm 1 may still be a reasonable training heuristic, but the paper should either prove convergence of the alternation to a joint optimum or present the method as a heuristic. As written, the statement that Eq. (7) is solved by Q = U V^T is unsupported.
  3. [Section V and Appendix D] The central robustness comparison is built on FGSM, FFGSM, BIM, and PGD attacks. The paper's own conclusion states that existing gradient-based attacks may not be suitable for effectively evaluating the vulnerabilities of BAM. If BAM retrieval is an iterative fixed-point process, an adversary should differentiate through the fixed point or use a BAM-specific attack, rather than a one-step forward mapping. The reported tables (e.g., Table III FGSM: SAME output error 0.0 vs. SRA 2.057 at the B end) therefore measure robustness under a threat model that the manuscript itself argues is inappropriate. This leaves the SAME-vs-SRA ranking unestablished for actual BAM vulnerabilities. The authors should either add fixed-point-aware attacks or explicitly limit the claim to robustness against one-step gradient perturbations.
  4. [Section IV-C2 and Appendix B] The regularizer coefficients lambda_ortho and lambda_align are never reported, and the B-SRA epoch count and hidden-layer widths are not given. These are free parameters that determine the GPA/OWM values in Table I and the subsequent robustness rankings. Without these values, the ablation is not reproducible and the claim that SAME achieves the strongest resilience cannot be independently checked. Please state the exact values used for all experiments, either in the main text or in a dedicated table.
  5. [Section IV-C1] The explanation of the GPA principle is internally inconsistent. The text first says the loss increases most along X and is flat perpendicular to X, then claims that noise perpendicular to X is more harmful than noise aligned with X. If the loss landscape is flat perpendicular to X, the opposite would be expected. This contradiction undermines the stated mechanism for the GPA regularizer. The regularizer may still be empirically useful, but the paper should correct the intuition or present GPA as an empirical observation rather than as a derived principle.
minor comments (5)
  1. [Eq. (8)] There is a missing closing parenthesis: the expression should be ||f(W(x+delta))||_F <= ||W(x+delta)||_F.
  2. [Tables II-IV and Appendix D] The reported 'Input A' MSE values do not match the stated perturbation parameters. For example, FGSM with eps=0.9 should give MSE 0.81, and Gaussian noise with variance 2 should give MSE 2, but the tables report 1.21 and 12.27 respectively. Either the parameters used in the tables differ from those in the figures, or the definition of the reported MSE is different; this should be clarified.
  3. [Section IV-B and Algorithm 1] The text says B-SRA requires no hyperparameters, but Algorithm 1 has an Epoch parameter. It would be clearer to say that B-SRA requires no learning rate or regularization coefficient, while the number of epochs remains a hyperparameter.
  4. [Tables II-IV] The footnote says all attackers of the same type are configured with the same parameters, but the actual values (eps, alpha, iterations) used for the tables are not given. These should be reported explicitly.
  5. [Sample Preparation] The source of the Chinese character script dataset is not cited. Please provide a reference or a URL for the dataset.

Circularity Check

0 steps flagged

No significant circularity: B-SRA is derived self-contained from an orthogonal Procrustes objective, and the OWM/GPA regularizers are evaluated independently on B-BP rather than being read off from the fit.

full rationale

The claimed derivation chain is not circular. B-SRA is defined by minimizing ||Y - ŶQ|| + ||X - X̂Q^T|| (Eq. 7) and solved with the SVD/orthogonal Procrustes argument in Appendix C, which cites the external Schönemann result; no step defines the algorithm in terms of its own robustness outcome. The two 'key principles' (OWM, GPA) are not parameters fitted to the robustness numbers and then renamed as predictions: Table I reports their measured values, and Tables II-III plus Figures 2-3 test B-BP variants with independent regularizers against masking, Gaussian noise, FGSM, FFGSM, BIM, and PGD. Although B-SRA initializes weights orthogonally and rotates them by orthogonal factors (so OWM=0 for SRA is a by-construction property), the paper's central comparison is whether adding OWM and GPA penalties to B-BP changes retrieval error under perturbation; that is an empirical claim, not a tautology. The self-citations [14-16] provide motivation that SRA works for RHNs, but the paper derives B-SRA's update and demonstrates its robustness with its own experiments, so the self-citations are not load-bearing. The manuscript's own concession that 'existing gradient-based attacks may not be suitable for effectively evaluating the vulnerabilities of BAM' is a threat-model/validity limitation on the robustness conclusions, not a circularity: it does not make any prediction equal to an input by construction. Accordingly, no exhibited reduction of a claimed result to its own inputs is present.

Axiom & Free-Parameter Ledger

4 free parameters · 4 axioms · 0 invented entities

The central claims rely on an unproved stability sign argument, a heuristic transfer from norm preservation to robustness, and an adversarial-evaluation assumption the authors themselves question. Reproducibility is further gated by unreported regularization coefficients, epoch counts, and architecture details.

free parameters (4)
  • lambda_ortho = not reported
    OWM regularization coefficient in L_total; never given a value in the text or appendix, yet it controls all ORTH/SAME/DIFF experiments.
  • lambda_align = not reported
    GPA regularization coefficient in L_total; value absent, preventing independent replication of the alignment experiments.
  • B-SRA epoch count = not reported
    Algorithm 1 iterates over 'Epoch', but no epoch count is specified in Section IV-B, so the convergence behavior is not reproducible from the text.
  • hidden layer widths = not reported
    The 3-layer and 5-layer BAM architectures are named but their layer dimensions are not specified, despite the 200-pair results depending on the deeper architecture.
axioms (4)
  • domain assumption For any orthogonal weight matrix W and contractive activation f, ||f[W(x+delta)]||_F <= ||x||_F + ||delta||_F, and this one-step norm bound implies BAM robustness.
    Eq. 8 in Section IV-C1. The norm bound is true, but the leap from one-step norm preservation to iterative basin-of-attraction robustness in a recurrent BAM is not proved.
  • ad hoc to paper The time derivatives of R_k and U_k at the same layer have the same sign, so their inner product is positive.
    Section II-A, Eq. 6. This is asserted without proof and can fail for arbitrary weight matrices, so the dE/dt <= 0 stability theorem is not established.
  • domain assumption FGSM, FFGSM, BIM and PGD give a valid measure of adversarial robustness for BAM.
    Central to all robustness tables in Section IV, but the conclusion itself says 'existing gradient-based attacks may not be suitable for effectively evaluating the vulnerabilities of BAM,' making the assumption internally contested.
  • domain assumption Comparing BAMs of different depths across capacities isolates the effect of memory capacity.
    Section IV-E uses a 3-layer BAM for 50/100 pairs and a 5-layer BAM for 200 pairs; architecture depth and memory capacity are confounded, so capacity-robustness conclusions are not cleanly supported.

pith-pipeline@v1.3.0-alltime-deepseek · 14472 in / 14633 out tokens · 134684 ms · 2026-08-03T22:07:11.490621+00:00 · methodology

0 comments
read the original abstract

Bidirectional Associative Memory (BAM) trained with Bidirectional Backpropagation (B-BP) often suffers from poor robustness and high sensitivity to noise and adversarial attacks. To address these issues, we propose a novel gradient-free training algorithm, the Bidirectional Subspace Rotation Algorithm (B-SRA), which significantly improves the robustness and convergence behavior of BAM. Through comprehensive experiments, we identify two key principles -- orthogonal weight matrices (OWM) and gradient-pattern alignment (GPA) -- as central to enhancing the robustness of BAM. Motivated by these findings, we introduce new regularization strategies into B-BP, resulting in models with greatly improved resistance to corruption and adversarial perturbations. We further conduct an ablation study across different training strategies to determine the most robust configuration and evaluate BAM's performance under a variety of attack scenarios and memory capacities, including 50, 100, and 200 associative pairs. Among all methods, the SAME configuration, which integrates both OWM and GPA, achieves the strongest resilience. Overall, our results demonstrate that B-SRA and the proposed regularization strategies lead to substantially more robust associative memories and open new directions for building resilient neural architectures.

Figures

Figures reproduced from arXiv: 2511.11902 by Ci Lin, Iluju Kiringa, Tet Yeap.

Figure 1
Figure 1. Figure 1: Retrieval performance of BAM trained by B-BP and B-SRA under masking and GN [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Comparison of retrieval performance for different models when query patterns are corrupted or noisy [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Retrieval performance of BAM trained with different strategies on 100 script pattern pairs [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Effect of memory capacity on retrieval performance of BAM trained with different strategies [PITH_FULL_IMAGE:figures/full_fig_p007_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Association of uppercase and lowercase letters using BAM trained with B-BP and B-SRA [PITH_FULL_IMAGE:figures/full_fig_p013_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Association of 20 digital number with another 20 digital number in MNIST dataset using BAM trained with B-BP and B-SRA [PITH_FULL_IMAGE:figures/full_fig_p013_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Association of 50 regular scripts with 50 seal scripts using BAM trained with B-BP and B-SRA [PITH_FULL_IMAGE:figures/full_fig_p013_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: Retrieval performance of BAM trained with different strategies under FGSM attack ( [PITH_FULL_IMAGE:figures/full_fig_p014_8.png] view at source ↗
Figure 9
Figure 9. Figure 9: Retrieval performance of BAM trained with different strategies under FFGSM attack ( [PITH_FULL_IMAGE:figures/full_fig_p014_9.png] view at source ↗
Figure 10
Figure 10. Figure 10: Retrieval performance of BAM trained with different strategies under PGD attack ( [PITH_FULL_IMAGE:figures/full_fig_p015_10.png] view at source ↗
Figure 11
Figure 11. Figure 11: Retrieving 100 associated patterns from corrupted patterns [PITH_FULL_IMAGE:figures/full_fig_p015_11.png] view at source ↗
Figure 12
Figure 12. Figure 12: Retrieving 100 patterns from noisy patterns [PITH_FULL_IMAGE:figures/full_fig_p015_12.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

23 extracted references · 3 linked inside Pith

  1. [1]

    Pattern recognition and machine learning, vol- ume 4

    Christopher M Bishop and Nasser M Nasrabadi. Pattern recognition and machine learning, vol- ume 4. Springer, 2006

    2006

  2. [2]

    Au- tonomous Data Association and Intelligent Infor- mation Discovery Based on Multimodal Fusion Technology.Symmetry, 16(1):81, 2024

    Wei Wang, Jingwen Li, Jianwu Jiang, Bo Wang, Qingyang Wang, Ertao Gao, and Tao Yue. Au- tonomous Data Association and Intelligent Infor- mation Discovery Based on Multimodal Fusion Technology.Symmetry, 16(1):81, 2024

    2024

  3. [3]

    A comprehensive survey of grammatical error correction.ACM Transactions on Intelligent Systems and Technology (TIST), 12(5):1–51, 2021

    Yu Wang, Yuelin Wang, Kai Dang, Jie Liu, and Zhuo Liu. A comprehensive survey of grammatical error correction.ACM Transactions on Intelligent Systems and Technology (TIST), 12(5):1–51, 2021

    2021

  4. [4]

    Bidirectional associative memories

    Bart Kosko. Bidirectional associative memories. IEEE Transactions on Systems, man, and Cybernet- ics, 18(1):49–60, 1988

    1988

  5. [5]

    Neural networks and physical systems with emergent collective computational abilities.Proceedings of the national academy of sciences, 79(8):2554–2558, 1982

    John J Hopfield. Neural networks and physical systems with emergent collective computational abilities.Proceedings of the national academy of sciences, 79(8):2554–2558, 1982

    1982

  6. [6]

    Bidirectional backpropagation.IEEE Transactions on Systems, Man, and Cybernetics: Systems, 50(5):1982–1994, 2019

    Olaoluwa Adigun and Bart Kosko. Bidirectional backpropagation.IEEE Transactions on Systems, Man, and Cybernetics: Systems, 50(5):1982–1994, 2019

    1982

  7. [7]

    Bidirectional associative memories: unsupervised Hebbian learning to bidirectional backpropagation.IEEE Transactions on Systems, Man, and Cybernetics: Systems, 51(1):103–115, 2021

    Bart Kosko. Bidirectional associative memories: unsupervised Hebbian learning to bidirectional backpropagation.IEEE Transactions on Systems, Man, and Cybernetics: Systems, 51(1):103–115, 2021

    2021

  8. [8]

    Spartan books Washington, DC, 1962

    Frank Rosenblatt et al.Principles of neurodynamics: Perceptrons and the theory of brain mechanisms, volume 55. Spartan books Washington, DC, 1962

    1962

  9. [9]

    Biometric Authentication and Correlation Analysis Based on CNN-SRU Hybrid Neural Network Model

    Houding Zhang and Zexian Yang. Biometric Authentication and Correlation Analysis Based on CNN-SRU Hybrid Neural Network Model. Computational Intelligence and Neuroscience, 2023(1):8389193, 2023

    2023

  10. [10]

    The safety filter: A unified view of safety-critical control in autonomous systems.Annual Review of Control, Robotics, and Autonomous Systems, 7, 2023

    Kai-Chieh Hsu, Haimin Hu, and Jaime F Fisac. The safety filter: A unified view of safety-critical control in autonomous systems.Annual Review of Control, Robotics, and Autonomous Systems, 7, 2023

    2023

  11. [11]

    A photonic integrated quantum secure communication system.Nature photonics, 15(11):850–856, 2021

    Taofiq K Paraiso, Thomas Roger, Davide G Marangon, Innocenzo De Marco, Mirko Sanzaro, Robert I Woodward, James F Dynes, Zhiliang Yuan, and Andrew J Shields. A photonic integrated quantum secure communication system.Nature photonics, 15(11):850–856, 2021

    2021

  12. [12]

    Dense associa- tive memory for pattern recognition.Advances in neural information processing systems, 29, 2016

    Dmitry Krotov and John J Hopfield. Dense associa- tive memory for pattern recognition.Advances in neural information processing systems, 29, 2016

    2016

  13. [13]

    Hopfield Networks is All You Need

    Hubert Ramsauer, Bernhard Schäfl, Johannes Lehner, Philipp Seidl, Michael Widrich, Lukas Gruber, Markus Holzleitner, Thomas Adler, David Kreil, Michael K Kopp, et al. Hopfield Networks is All You Need. InInternational Conference on Learning Representations, 2022. 9 TABLE IV COMPARATIVESTUDY OFBAM ROBUSTNESSACROSSMEMORYSIZES(50, 100, 200 PAIRS) Attackers S...

    2022

  14. [14]

    Subspace Rotation Algorithm for Training Restricted Hopfield Network.36th IEEE International Conference on Tools with Artificial Intelligence (ICTAI 2024), 2024

    Ci Lin, Tet Yeap, and Iluju Kiringa. Subspace Rotation Algorithm for Training Restricted Hopfield Network.36th IEEE International Conference on Tools with Artificial Intelligence (ICTAI 2024), 2024

    2024

  15. [15]

    On the basin of attraction and capacity of restricted hop- field network as an auto-associative memory

    Ci Lin, Tet Yeap, and Iluju Kiringa. On the basin of attraction and capacity of restricted hop- field network as an auto-associative memory. In 2023 International Conference on Cyber-Enabled Distributed Computing and Knowledge Discovery (CyberC), pages 146–154, 2023

    2023

  16. [16]

    Restricted Hopfield Networks are Robust to Adver- sarial Attack.Authorea Preprints, 2025

    Ci Lin, Tet Yeap, Iluju Kiringa, and Biwei Zhang. Restricted Hopfield Networks are Robust to Adver- sarial Attack.Authorea Preprints, 2025

    2025

  17. [17]

    Explaining and harnessing adversarial examples.arXiv preprint arXiv:1412.6572, 2014

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples.arXiv preprint arXiv:1412.6572, 2014

    Pith/arXiv arXiv 2014

  18. [18]

    Fast is better than free: Revisiting adversarial training

    Eric Wong, Leslie Rice, and J Zico Kolter. Fast is better than free: Revisiting adversarial training. arXiv preprint arXiv:2001.03994, 2020

    Pith/arXiv arXiv 2001

  19. [19]

    Adversarial examples in the physical world

    Alexey Kurakin, Ian J Goodfellow, and Samy Bengio. Adversarial examples in the physical world. InArtificial intelligence safety and security, pages 99–112. Chapman and Hall/CRC, 2018

    2018

  20. [20]

    To- wards deep learning models resistant to adversarial attacks.arXiv preprint arXiv:1706.06083, 2017

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. To- wards deep learning models resistant to adversarial attacks.arXiv preprint arXiv:1706.06083, 2017

    Pith/arXiv arXiv 2017

  21. [21]

    A generalized solution of the orthogonal procrustes problem.Psychometrika, 31(1):1–10, 1966

    Peter H Schönemann. A generalized solution of the orthogonal procrustes problem.Psychometrika, 31(1):1–10, 1966. 10 APPENDIX TABLE OFCONTENTS I Introduction1 I-A Motivation and Contribution . . . 1 I-B Organization . . . . . . . . . . . . 2 II Bidirectional Associative Memory2 II-A Stability Analysis . . . . . . . . . 2 III Bidirectional Subspace Rotation...

    1966

  22. [22]

    Initial Experiment on B-SRA and B-BP To assess the fundamental differences in robustness between B-BP and B-SRA, we conducted a series of initial experiments using three distinct datasets: alphabet letters, MNIST digits, and Chinese script patterns. For each dataset, BAM models were trained using both B-BP and B-SRA, and then evaluated under two adversari...

  23. [23]

    These models are tested under three adversarial attack scenarios: FGSM, FFGSM, and PGD

    Ablation Study for Individual Regularization In this section, we present a comprehensive abla- tion study using six training strategies—B-BP, ALIGN, SAME, DIFF, ORTH, and SRA—to evaluate the individ- ual contributions of orthogonal weight matrix regulariza- tion and gradient-pattern alignment to model robustness. These models are tested under three advers...