SoftHebb: Bayesian inference in unsupervised Hebbian soft winner-take-all networks
Authors: Timoleon Moraitis
Dmitry Toichkin
Yansong Chua
Qinghai Guo
Venue: ICLR 2022 Submitted (2022)

Abstract: State-of-the-art artificial neural networks (ANNs) require labelled data or feedback between layers, are often biologically implausible, and are vulnerable to adversarial attacks that humans are not susceptible to. On the other hand, Hebbian learning in winner-take-all (WTA) networks, is unsupervised, feed-forward, and biologically plausible. However, a modern objective optimization theory for WTA networks has been missing, except under very limiting assumptions. Here we derive formally such a theory, based on biologically plausible but generic ANN elements. Through Hebbian learning, network parameters maintain a Bayesian generative model of the data. There is no supervisory loss function, but the network does minimize cross-entropy between its activations and the input distribution. The key is a "soft" WTA where there is no absolute "hard" winner neuron, and a specific type of Hebbian-like plasticity of weights and biases. We confirm our theory in practice, where, in handwritten digit (MNIST) recognition, our Hebbian algorithm, SoftHebb, minimizes cross-entropy without having access to it, and outperforms the more frequently used, hard-WTA-based method. Strikingly, it even outperforms supervised end-to-end backpropagation, under certain conditions. Specifically, in a two-layered network, SoftHebb outperforms backpropagation when the training dataset is only presented once, when the testing data is noisy, and under gradient-based adversarial attacks. Notably, adversarial attacks that confuse SoftHebb are also confusing to the human eye. Finally, the model can generate interpolations of objects from its input distribution. All in all, SoftHebb extends Hebbian WTA theory with modern machine learning tools, thus making these networks relevant to pertinent issues in deep learning.

SOFTHEBB: BAYESIAN INFERENCE IN UNSUPERVISED HEBBIAN SOFT VINNER-TAKE-AL NETWORKS
Anonymous authors
Paper under double-blind review
ABSTRACT
State-of-the-arr artificial neural networks (ANNs) require labelled data or feedback between layers, are often biologically implausible, and are vulnerable to adversarial attacks that humans are not susceptible to. On the other hand, Hebbian learning in winner-take-all (WTA) networks is unsupervised, feed-forward, and biologically plausible. However, modern objective optimization theory for WTA networks has been missing, except under very limiting assumptions. Here we derive formally such theory, based on biologically plausible but generic ANN elements. Through Hebbian learning, network parameters maintain a Bayesian generative model of the data. There no supervisory loss function, but the network does minimize cross-entropy between its activations and the input distribution. The key is a "soft" WTA where there no absolute "hard" winner neuron, and a specific type of Hebbian-like plasticity of weights and biases. We confirm our theory in practice. where, in handwritten digit (MNIST) recognition, our Hebbian algorithm, SoftHebb, minimizes cross-entropp without having access to it, and outperforms the more frequently used, hard- hard-WTAA- WTAA-based method. Strikingly, even outperforms supervised end-to-end backpropagation, under certain conditions. Specifically, in a two-layered network, SoftHebb outperforms backpropagation when the training dataset is only presented once, when the testing data is noisy, and under gradient- based adversarial attacks. Notably, adversarial attacks that maximally confuse SoftHebb also confusing to the human eye. Finally, the model generate interpolations of objects from its input distribution. All in all, SobtHebb extends Hebbian WTA theory with modern machine learning tools, thus making these networks relevant to pertinent issues in deep learning.
INTRODUCTION
State-of-the-art (SOTA) artificial neural networks (ANNs) achieve impressive results in variety of machine intelligence tasks (Sejnowski, 2020). However, they largely rely on mechanisms that diverge from the original inspiration from biological neural networks (Bengio et al., 2015; Illing et al., 2019). As a result, only a small part of this prolific field also contributes to computational ncuroscience. In fact, this biological implausibility is also an important issue for machine intelligence. For their impressive performance, ANNS trade off other desired properties, which are present in biological systems. For example, ANN training often demands very large and labelled datasets. When labels are unavailable, self-supervised learning schemes exist, where supervisory error signals generated by the network itself are exploited and backpropagated from the output towards the input to update the network's parameters (Goodfellow et al., 2014; Devlin et al., 2018; Chen et al., 2020). However, this global propagation signals in deep networks introduces another limitation. Namely, prevents the implementation of efficient distributed computing hardware that would be based on only local signals from neighbouring physical nodes in the network, and is in contrast to local synaptic plasticity rules that partly govern biological learning. Several pieces of work have been addressing parts of the biological implausibility and hardware-inefficienny of backpropagation in ANNs (Bengio et al., 2015; Lillicrap et al., 2016; Guerguiev et al., 2017: Pfeiffer & Pfeil, 2018; Illing et al., 2019; Pogodin & Latham, 2020; Millidge et al., 2020; Pogodin et al., 2021). such as the need for exactly symmetric forward and backward weights the waiting time caused by the network's forward- baddd-bbaarddd pass between two training updates in a layer (weight transport and
problems). Recently, an approximation to backpropagation that is mostly Hebbian, i.e. relies mostly pre- and post-

---

synaptic activity of each synapse, has been achieved by reducing the global error requirements to 1-bit information (Pogodin & Latham, 2020). Two schemes that further localize the signal that is required for weight update are Equilibrium Propagation (Scellier & Bengio, 2017) and Predictive Coding (Millidge et al., 2020). Both methods approximate backpropagation through Hebbian-like learning, by delegating the global aspect of the computation, from global error signal, to global convergence of the network state to an equilibrium. This equilibrium is reached through several iterative steps of feed-forward and feed-back communication throughout the network, before the ultimate weight update by one training example. The biological plausibility and hardware-efficieng of this added iterative process of signal propagation are open questions that begin to be addressed (Ernoult et al., 2020).
Moreover, learning through backpropagation, and presumably also its approximations, has another indication of biological implausibility, which also significantly limits ANN applicability. Namely, it produces networks that are confused by small adversarial perturbations of the input, which are imperceptible by humans. It has recently been proposed that defence strategy of "detlection" of adversarial attacks may be the ultimate solution to that problem (Qin et al., 2020). Through this strategy, to cause confusion in the network's 's inferred class, the adversary is forced to generate such a changed input that really belongs to the distribution of a different input class. Intuitively, but also strictly by definition, this deflection is achieved if human assigns the perturbed input the same label that the network does. Deflection of adversarial attacks in ANNS has been demonstrated by an elaborate scheme that based on detecting the attacks (Qin et al., 2020). However, the human ability to deflect adversarial perturbations likely does not rely on detecting them, but rather on effectively ignoring them, making the deflecting type of robustness an emergent property of biological computation rather than a defence mechanism. The biological principles that underlie this property of robustness are unclear, but it might emerge from the distinct algorithms that govern learning in the brain.
Therefore, what is missing is a biologically plausible model that can learn from fewer data-points, without labels, through local plasticity, and without feedback from distant layers. This model could then be tested for emergent adversarial robustness. A good candidate category of biological networks and learning algorithms is that of competitive learning. Neurons that compete for their activation through lateral inhibition are a common connectivity pattern in the superficial layers of the cerebral cortex (Douglas & Martin, 2004; Binzegger et al., 2004). This pattern is described as winner-take take-akkeallll all (WTA), because competition suppresses activity of weakly activated neurons, and emphasizes strong ones. Combined with Hebbian-like plasticity rules, WTT connectivity gives rise to competitive- learning algorithms. These networks and learning schemes have been long studied (Von der Malsburg, 1973) and large literature based on simulations and analyses describes their functional properties. A WTA neuronal layer, depending on its specifics, can restore missing input signals (Rutishauser et al., 2011; Diehl & Cook, 2016), perform decision making i.e. winner selection (Hahnloser et al., 1999; Maass, 2000; Rutishauser et al., 201 1), and generate oscillations such as those that underlie brain rhythms (Cannon et al., 2014). Perhaps more importantly, its neurons can learn to become selective to different input patterns, such as orientation of visual bars in models of the primary visual cortex (Von der Malsburg, 1973), MNIST handwritten digits (Nessler et al., 2013; Diehl & Cook, 2015; Krotov & Hopfield, 2019). CIFARIO objects (Krotov & Hopfield, 2019), spatiotemporal spiking patterns (Nessler et al., 2013), and can adapt dynamically to model changing objects (Moraitis et al., 2020). The WTA model is indeed biologically plausible, Hebbian plasticity is local, and learning is input-driven, relying on only feed-forward communication of neurons - properties that seem to address several of the limitations of ANNs. However, the model's applicability limited to simple tasks. That is partly because the related theoretical literature remains surprisingly unsettled, despite its long history, and the strong and productive community interest (Sanger, 1989; Földiák Fdilr, 1989; Földiak, 1990; Linsker, 1992; Olshausen & Field, 1996; Bell & Sejnowski, 1995; Olshausen & Field, 1997: Lee et al., 1999; Nessler et al., 2013: Pehlevan & Chklovskii. 2014; Hu al., 2014; Pehlevan & Chklovskii, 2015; Pehlevan et al., 2017; Isomura & Toyoizumi, 201 8).
Nessler et al. (2009; 2013) descrihed a very related theory but for a model that is largely incompatible with ANNs and thus less practical. It uses spiking and stochastic neurons, input has to be discretized, and each input feature must be encoded through multiple binary neurons. Moreover, it was only proven for neurons with exponential activation function. It remains therefore unclear which specific plasticity rule and structure could optimize an ANN WTA for Bayesian inference. It is also unclear how to minimize a common loss function such as cross-entropy despite unsupervised learning,
2

---

and how WTA could represent varying families of probability distributions. In summary, on the theoretical side, an algorithm that is simultaneously normative, based on WTA networks and Hebbian unsupervised plasticity, performs Bayesian inference, and, importantly, is composed of conventional, i.e non-spiking, ANN elements and is rigorously linked to modern ANN tools such as cross-entropy loss, would be important advance but has been missing- On the practical side, evidence that Hebbian WTA networks could be useful for presently pertinent issues of modern ANNs such as adversarial robustness, generation of synthetic images, or faster learning, has remained limited. Here we aim to fill these gaps. Recently, when WTA networks were studied in a theoretical framework compatible with conventional machine learning (ML), but in the context of short-term as opposed to long-term Hebbian plasticity, it resulted in surprising practical advantages over supervised ANNs (Moraitis et al., 2020). A similar theoretical approach could also reveal unknown advantages of long-term Hebbian plasticity in WTA networks. In addition, it could provide insights into how a WTA microcircuit could participate in larger-scale computation by deeper cortical or artificial networks.
Here construct "SoftHebb", biologically plausible WTA model that is based on standard rate- based neurons as in ANNs, can accommodate various activation functions, and learns without labels, using local plasticity and only feed-forward communication, i.e. the properties we seek in an ANN. Importantly, it is equipped with a simple normalization the layer's activations, and an optional temperature-scalinng mechanism (Hinton et al., 2015), producing soft WTA instead of selecting single "hard" winner neuron. This allows us to prove formally that a SoftHebb layer is generative mixture model that objectively minimizes its Kullback-Leibler (KL) divergence from the input distribution through Bayesian inference, thus providing new formal ML-theoretic perspective of these networks. We complement our main results, which are theoretical, with experiments that are small-scale but produce intriguing results. As generative model, SoftHebb has a broader scope than classification, but we test on image classification tasks. Surprisingly, in addition to overcoming several inefficiencies of backpropagation, the unsupervised WTA model also outperforms supervised two-layer perceptron several aspects: learning speed and accuracy the first presentation of the training dataset, robustness to noisy data and to one of the strongest white-box adversarial attacks, i.c. projected gradient descent (PGD) (Madry et al., 2017), and without any explicit defence. Interestingly, the SoftHebb model also exhibits inherent properties of deflection (Qin et al., 2020) of the adversarial attacks, and generates object interpolations.
THEORY
A supporting diagram summarising the theoretical and neural model, and succinct description of the learning algorithm are provided in the beginning of Appendix A.
Definition 2.1 (The input assumptions). Each observation , E R is generated by hidden "cause" " ,C from a finite set of K possible such causes: ,C E {Cx, , Yk S K E N}. Therefore, the data is generated by a mixture of the probability distributions attributed to each of the K classes Cz
K p(z) = - P(I)C)))((c).
(1)
In addition, the dimensions of x. I, are conditionally independent from each other, i.e. p(x)= = -I1:-1 The number K of the true causes or classes of the data is assumed to be known.
The term "cause" used here in the sense of causal inference. It is important to emphasize that the true cause of each input is hidden, i.c. not known. In the case of a labelled dataset, labels may correspond causes, and the labels are deleted before presenting the training data the model. We choose a mixture model that corresponds to the data assumptions but is also interpretable in neural terms (Paragraph 2.4):
Definition 2.2 (The generative probabilistic mixture model). We consider a mixture model distribu- tion q: q(x)= = (xx(C() Q(Ck), approximating the data distribution p. We choose specifically a mixture of exponentials and we parametrize Q(Cx; Wok) also as an exponential, specifically:
g( wxx) = wosk xt
| Vk.
QCCe; wox) = e Wox Vk. In addition, the parameter vectors are subject to the normalization constraints: ||ww||| = 1, Vk, and ΣK wok 1.
3

---

The model we have chosen is reasonable choice because it factorizes similarly to the data of Definition 2.1:
12
Th == q(2: Cxi wp)
II g wass e wok Tpil i=1
e
(4)
|= i.e. the cosine similarity of the two vectors. A similar probabilistic model was used in related previous theoretical work Nessler et al. (2009; 2013); Moraitis et al. (2020), but for different data assumptions, and with certain further constraints to the model. Namely, (Nessler et al., 2009; 2013) considered data that was binary, and created by a population code, while the model was stochastic. These works provide the foundation of our derivation, but here we consider the more generic scenario where data are continuous-valuce and input directly into the model, which is deterministic and, as we will show, more compatible with standard ANNS. In Moraitis al. (2020), data had particular short-term temporal dependencies, whereas here we consider the distinct case of independent and identically distributed (i.i.d.) input samples. The Bayes-optimal parameters of model mixture of exponentials can be found analytically as functions of the input distribution's 's parameters, and the model is equivalent to a soft winner-take-all neural network (Moraitis et al., 2020). After describing this, we will prove here that Hebbian plasticity of synapses combined with local plasticity of the neuronal biases sets the parameters to their optimal values.
where Wi -
w0g- 20
Theorem 2.3 (The optimal parameters of the model). The parameters that minimize the KI. divergence of such a mixture model from the data are, for every k,
Wok In P(Ck)
(5)
ppp. (ar)
and opt 2o
opt
(6)
opt uD&l
l1pps (x)ll'
where opt wy = Mpp (a), R., Mpx. (x) is the mean of the distribution Ph., and = p(æ (Ck)
In other words, the optimal parameter vector of each component le in this mixture is proportional to the mean of the corresponding component of the input distribution, i.e. it is a centroid of the component. In addition, the optimal parameter of the model's prior Q(Cx) is the logarithm of the corresponding component's 's prior probability. This Theorem's 's proof was provided in the supplementary material of Moraitis et al. (2020), but for completeness we also provide it in our Appendix. These centroids and priors of the input's component distributions, as well as the method of their estimation, however, are different for different input assumptions, and we will derive a learning rule that provably sets the parameters to their Maximum Likelihood Estimate for the inputs addressed here. The learning rule a Hebbian type of synaptic plasticity combined with a plasticity for neuronal biases. Before providing the rule and the related proof, we will describe how our mixture model is equivalent to WTA neural network.
2.4 EQUIVALENCE OF THE PROBABILISTIC MODEL TO A WTA NEURAL NETWORK
The cosine similarity between the input vector and each centroid's 's parameters underpins the model (Eq. 4). This similarity is precisely computed by a linear neuron that receives normalized inputs æ and that normalizes its vector of synaptic weights: w = w
x= - |||| summed weighted input 4y = w x then determines the cosine similarity of an input sample to the weight vector, thus computing the likelihood function of each component of the input mixture (Eq. 2). It should be noted that even though U4 depends on the weights of all input synapses, the weight values of other synapses do not need to be known to each updated synapse. Therefore, in the SoftHebb plasticity rule that we will present (Eq. 8), the term Ug is a local, postsynaptic variable that does not undermine the locality of the plasticity. The bias term of each neuron can store the parameter wos of the prior (C2,; Wok). ). Based these, it can also be shown that set of K such neurons actually compute the Bayesian posterior, if the neurons are connected in a configuration that implements softmax. Softmax has a biologically-plann plaussile implementation through lateral inhibition (divisive normalization) between neurons (Nessler et al., 2009; 2013; Moraitis et al., 2020). Specifically, based on the model of Definition 2.2, the posterior probability is too
|=] Specifically, the neuron's 's
Q x)) ΣK eu
But in the neural description, us + Wos is the activation of the k-th linear neuron. That is, Eq. 7 shows that the result of Bayesian inference of the hidden cause from the input ((Calar) is found
4

---

by softmax operation the linear neural activations. In this equivalence, will be using 9k = =[CCp x w) to symbolize the softmax output of the k-th neuron, i.c. the output after the WTA operation, interchangeably with Q(Cx|zz) |æ)) It can be seen in Eq. 7 that the probabilistic model has one more, alternative, but equivalent neural interpretation. Specifically, Q(Ca a:) can be described as the output of neuron with exponential activation function (numerator in Eq. 7) that is normalized by its layer's total output (denominator). This is equally accurate, and more directly analogous to the biological description (Nessler et al., 2009; 2013; Moraitis al., 2020). This shows that the exponential activation of each individual neuron k directly equals the k-th exponential component distribution of the generative mixture model (Eq. 4). Therefore. the softmax coonaa-x--ofgrredd linear neurons, or equivalently, the normalized exponential neurons, fully implement the generative model of Definition 2.2, and also infer the Bayesian posterior probability given an input and the model parameters. However, the problem of calculating the model's 's parameters from data samples is difficult one, if the input distribution's 's parameters are unknown. In the next sections we will show that this neural network can find these optimal parameters through Bayesian inference, in unsupervised and on-line manner, based on only local Hebbian plasticity.
2.5 A HEBBIAN RULE THAT OPTIMIZES THE WEIGHTS
Several Hebbian-like rules exist and have been combined with WTA networks. For example, in the case of stochastic binary neurons and binary population-coded inputs, it has been shown that weight updates with an exponential weight-dependence find the optimal weights (Nessler et al., 2009; 2013). Oja's rule is another candidate (Oja, 1982). An individual linear neuron equipped with this learning rule finds the first principal component of the input data (Oja, 1982). A variation of Oja's rule combined with hard-WTA networks and additional mechanisms has achieved good experimental results performance on classification tasks (Krotov & Hopfield, 2019), but lacks the theoretical underpinning that we aim for. Here we propose Hebbian- like rule for which we will show it optimizes the soft WTA's generative model. The rule is similar to Oja's rule, but considers, for each neuron k; both its linear weighted summation of the inputs ug, and its nonlinear output of the WTA yk:
Aw (SoftHebb)) 1] yik (2; UA wox),
(8) where Wik is the synaptic weight from the i-th input to the k-th neuron, and v) is the learning rate hyperparameter. As can be seen, all involved variables are local to the synapse, i.e. only indices and k are relevant. No signals from distant layers, from non-perisynaptic neurons, or from other synapses involved. By solving the equation E[Awas]
where E[-] is the expected value over the input distribution, we can show that, with this rule, there exists a stable equilibrium value of the weights, and this equilibrium value is an optimal value according to Theorem 2.3:
Theorem 2.5. The equilibrium weights of the SoftHebb synaptic plasticity rule are
w sk
Hobt
c Hpu (I:) = Wiks where c MPr (x)]
The proof is provided in the Appendix. Therefore, our update rule (Eq. 8) optimizes the weights of the neural network.
2.6 LOCAL LEARNING OF NEURONAL BIASES AS BAYESIAN PRIORS
For the complete optimization of the model, the neuronal biases wps must also be optimized to satisfy
Eq. 5, i.e. to optimize the Bayesian prior belief for the probability distribution over the K input causes. We define the following rate-based rule inspired from the spike- based bias rule of (Nessler et al., 2013):
(10) With the same technique we used for Theorem 2.5, also provide proof in the Appendix that the equilibrium of the bias with this rule matches the optimal value opt Wok = In P(Ck) of Theorem 2.3: Theorem 2.6. The equilibrium biases of the SoftHebb bias learning rule are
Aw HobtHebb 7JE" Woo (y)- wok)
SoftHebb In P(C+) ok
opt Wok-
(11)
2.7 ALTERNATE ACTIVATION FUNCTIONS AND RELATION TO HARD WTA The model of Definition 2.2 uses for each component p(z C₂) an exponential probability distribution with base of Fuler's e, equivalent model using similarly exponential neurons (Subsection 2.4).
5

---

100 epochs
B
epoch
Running loss (moving average)
R1 features
99
400
1.4
SoftHcbb Hard WTA
Softlebb Hard WTA
1.4
Backprop
Backprop
07.76
$2.80
97.
Chodbe 50 e002
Accussy 150
47
Mumbero K1
200
0.8
96.15
9503
95
71
0.4
0.2
95
1 Useo
Lugey' Lapex
2 Jaye Backgrop
shrul arhedy Hard VITA
serelt grondy SoftHebb
Sindi pw pARLT Backgrop
30103
50302
30000
60000
Hand WITA
SoftHebb
The ming examp
Trining examples
Figure 1: Performance of SoftHebb MNIST compared to ATrd and backpropagation.
Depending the task, different probability distribution shapes, i.c. different neuronal activation functions, may be better models. This is compatible with our theory (see Appendix B). Firstly, the base of the exponential activation function can be chosen differently, resulting in softmax took
function with a different base, such that Eq. 7 becomes more generally Q(Cg/a=) = ΣE wor""
This is equivalent to Temperature Scaling (Hinton et al., 2015), a mechanism that also maintains the probabilistic interpretation of the output. It can also be implemented by a normalized layer of exponential neurons, and are compatible with theoretical derivations and the optimization by the plasticity rule of Eq. 8. This allows us to integrate the hard WTA into the SoftHebb framework, as a special case with an infinite base. Therefore, the hard WTA. if used with the plasticity rule that we derived, is expected to have some similar properties to a soft WTA implementation. Moreover, we show in the Appendix that soft WTT models can be constructed by rectified linear units (ReLU) or in general by neurons with any non-negative monotonically increasing activation function, and their weights are also optimized by the same plasticity rule.
2.8 POST-HOC
is not obvious how to measure the loss of the WTA network during the learning process, since the ground truth for causes C may not match the labels, or even their number. For example, in reality, the cause of each MNIST example in the sense implied by causal inference is not the digit cause itself, but combination of a single digit cause D, which is the MNIST label, with one of many handwriting styles S. In the Appendix C, we derive a method for measuring the loss minimization during training in spite of this mismatch. The method's steps can be summarised (a) unsupervised training of SoftHebb, then (b) training a supervised classifier on top, and finally (cl) repeating the training of SobtHebb with the same initial weights and ordering of the training inputs, while (c2) measuring the trained classifier's loss. In this way, we can observe the cross-entropy loss Hiebels of SoftHebb while is being minimized, and infer that H Heauses is also minimized (Eq. 72). We call this the post-hoc cross-entropy method, and we have used it in our experiments (Section 3.2 and Fig. C and D) to evaluate the learning process theoretically sound manner.
EXPERIMENTS
3.1 MNIST COP-ACCURACY BENCHMARKS
We implemented the theoretical SoftHebb model in simulations and tested in the task of learning to classify MNIST handwritten digits. The network received the MNIST frames normalized by their Euclidean norm, while the plasticity rule that we derived updated its weights and biases in an unsupervised manner. We used K 2000 neurons. First we trained the network for 100 epochs, i.e. randomly ordered presentations of the 60000 training digits. Each training experiment was repeated five times with varying random initializations and input order. We will report the mean and standard deviation of accuracies. Inference of the input labels by the WTA network of 2000 neurons was performed in two different ways. The first approach is single-layer, where, after training the network, we assigned label to each of the 2000 neurons, in a standard approach that is used in unsupervised clustering. Namely, for each neuron, found the label of the training set that makes it win the WTA

---

competition most often. In this single-layer approach, this is the only time when labels were used, and at no point were weights updated using labels. The second approach was two-layer and based on supervised training of perceptron classifier on top of the WTA layer. The classifier layer trained with the Adam optimizer and cross-entropy loss for 100 epochs, while the previously-traines WTA parameters were frozen. SoftHehb achieved an accuracy of (96.31 + 0.06)% 1% and (97.80 + 0.02)% in its 1- and 2-layer form respectively. To test the strengths of the soft-WTA approach combined with training the priors through biases, which makes the network Bayesian, we also trained the weights of a hard- WTA network. The SoftHebb model slightly outperformed the hard WTA (Fig, 1A), especially in the l-aayer case where the supervised 2nd layer cannot compensate the drop. However, SoftHebb's accuracy is significantly lower than multi-layer perceptron (MLP) with one hidden layer of also 2000 neurons that is trained exhaustively (998.65) 65 + 0.0)))). This not surprising, due to end-to-end training, supervision, and the MIP being discriminative model as opposed to generative model merely applied to a classification task, as SoftHebb is. If the Bayesian and generative aspects that follow from our theory were not required, several mechanisms exist to enhance the discriminative power of WTA networks (Krotov & Hopfield, 2019), and even a random projection layer instead of trained WTA performs well (llling et al., 2019). The generative approach however has its own advantages even for discriminative task, and we will show some of these here.
3.2 CROSS-ENTRONE ENTROPY MINIMIZATION, SPEED ADVANTAGE OF SOFTHEBB.
Next, we tested SoftHebb's ' speed and efficiency by comparing it to other models during the first training epoch. In the common, "greedy" training of such networks, layer L+1 is trained only after layer L is trained on the full dataset and its weights frozen. We trained in this manner a second layer as a supervised classifier for 100 epochs. SoftHebb again slightly outperformed the Hard WTA showing that it extracts superior features. However, it was outperformed by I-epoch backpropagation pretraining that was followed by 100 epochs of training the 2nd layer only (Fig. 1B, light-coloured bars). Then, we demonstrated that in a truly single-epoch scenario, without longer training for the second layer, SobtHebb further outperforms HardWTA, and, strikingly, it even outperforms end-to-end (e2e) backpropagation in accuracy (Fig. 1B, bars label "simult."). In fact, it even outperforms backprop-traine trrnnod network that is pretrained for 100 epochs, before its 1st layer is reset and re- re-trained end-to-end for 1 epoch (Fig. IB, "pretr. L2"). In this experiment, the Hebbian networks had an additional important advantage. By using the delta rule for the 2nd layer, each individual training example updated both layers. In contrast to backpropagation, this simultaneous method does not suffer from the apdate-locking problem, i.e. the first layer can learn from the next example before the current input is even processed by the higher layer, let alone backpropagated. Moreover, we measured the post-hoc loss. Consistently with the first-epoch accuracy results, SoftHebb is faster than hard WTA and both are faster than backpropagation. which remarkable considering the absence of input labels. Also, it validates our theory that SoftHebb minimizes cross- cross-entropy. As a further insight into the differences between SoftHebb and hard-WTX learning, we measured throughout learning the number of learned features that lie on hypersphere with radius of 1 + 0.01 (R1 features), according to the Euclidean norm of the weight vectors. The SoftHebb learning algorithm converges to such normalization in theory (end of Appendix A, Theorem A.2), , and Fig. ID validates that it does, but also that it does so faster than the hard WTA implementation. demonstrating SoftHebb's superiority in unsupervised representation learning, irrespective of discriminative ability. Hebbian learning compared to backpropagation has not generally been considered superior for its accuracy, but for other potential benefits. Here we show evidence that, for small problems demanding fast learning, SoftHebb may be superior to backpropagation even in terms of accuracy, in addition to its biological plausibility and efficiency.
3.3 ROBUSTNESS TO NOISE AND ADVERSARIAL ATTACKS - GENERATIVE ADV. PROPERTIES
Based on the Bayesian, generative, and purely input-driven learning nature of the algorithm, we hypothesized that SoftHebb may be more robust to input perturbations. Indeed, we tested the trained SoftHebb and MLP models for robustness, and found that SoftHebb is significantly more robust than the cekkrrop-trained MLP, both to added Gaussian noise and to PGD adversarial attacks (see Fig. 2). PGD (Madry et al., 2017) produces perturbations in direction that maximizes the loss of each targeted network, and in size controlled by a parameter c. We also attacked model where the Hebbian layer was trained as hard WTA but forward propagation to the supervised classifier head and for inference, softmax as in SoftHebb was used. Hard- and soft-trained WTA are almost identically robust to these perturbations. This may be an expression of the fact that the ATTA model is essentially special case of the SoftHebb framework (Section 2.7). Strikingly, the Hebbian
7

---

A
Gaussian noise
B 100
PGD adversarial attack
100
SaftHebb Backprop
75
75
MNNITT F-MNEST
Accuracy (%)
SoftHebo
Accuracy (5)
Backprop
MNNST F-NNIST
4
25
0.0
0.2
0.4
0.6
1.0
4/255
8/255
16/255
32/255 e(L"/orm)
64/255 128/255 255/255
Standard deviation
Figure 2: Noise and adversarial attack robustness of SoftHebb and of backpropagation-trainee MLP on MNIST and MNNIS.. The insets show one example from the testing set and its perturbed versions, for increasing perturbations. (A) SoftHebb is highly robust to noise. (B) MLP's MNIST accuracy drops to ~60% by hardly perceptible perturbations (e 16/ /255), while SoftHebb requires visually noticeable perturbations (e = 64/ 225) for similar drop in performance. At that degree of perturbation, the MLP has already dropped zero. SoftHebb deflects the attack: it forces the attacker to produce examples of truly different classes the original digit "4" is perturbed to look like "O" (see also Fig. 3). The hard WTA curves (purple) are almost identical to SoftHebb's.
WTA model has visible tendency to deflect the attacks, i.c. its most confusing examples actually belong to a perceptually different class (Fig. 2B and 3). This effectively nullifies the attack and was previously shown in elaborate SOTA adversarial -efennce models (Qin et al., 2020). The attack's s parameters were tuned systematically (Appendix E). The pair of the adversarial attacker with the generative SoftHebb model essentially composes generative adversarial network (GAN), even though the term is usually reserved for pairs trained in tandem (Goodfellow et al., 2014; Creswell al., 2018). As a result, the model could inherit certain properties of GANs. It can be seen that is able to generate interpolations between input classes (Fig. 3). The parameter of the adversarial attack can control the balance between the interpolated objects. Similar functionality has existed in the realm of GANs (Radford et al., 2015), autoencoders (Berthelot et al., 2018), and other deep neural networks (Bojanowski al., 2017), but was not known for simple ieloogicalll-llussiiii models.
3.4 EXTENSIBILITY OF SOFTHEBB: F-MNIST, CIFAR-10, CONv-SOFTHEBB
Finally, we performed preliminary tests on two more difficult datasets, namely Reshion-MNIST (Xiao et al., 2017). which contains grey-scale images of clothing products, and CIFAR-10 (Krizhevsky et al., 2009), which contains RGB images of animals and vehicles. We did not tune the Hebbian networks' hyper-parameters extensively, so accuracies on these tasks are not definitive but do give a good indi- cation. On F-MNIST, the SobtHebb model achieved a top accuracy of 87.46% whereas hard WTA reached a similar accuracy of 87 87.49%. A supervised MLP of the same size achieved test accuracy of 90.55%. SoftHebb's ' generative interpolations (Fig. 3B) are reconfirmed on the F-MNIST dataset, as is its robustness attacks, whereas, with very small adversarial perturbations, the MLP drops an accuracy lower than the SobtHebb model (dashed lines in Fig. 2). On CIFAR-10's preliminary results, the hard WTA and SoftHebb achieved accuracy of 49.78% and 50. 27% respectively. In every tested dataset, it became clear that SoftHebb learns faster than either backpropagation or a hard WTA, by observing the loss and the learned features as Fig. 1 CC & D. The fully-connected SoftHebb layer is applicable on MNIST because the data classes are well-clustered directly in the feature-space of pixels. That is, SoftHebb's probabilistic model's assumptions (Def. 2.1) are quite valid for this feature space, and increasing the number of neurons for discovering more refined sub-clusters does help. However, for more complex datasets, this approach alone has diminishing returns and multilayer networks will be needed. Towards this, we implemented a first version of convolutional SoftHebb, with an added supervised classifier. In these early results, conv-SoftHode achieved 98. 68.6%% on MNIST, and 60.30% on CIFAR-10. This confirms that conv-SoftHer is functional, but did not systematically optimize its accuracy or explore its other strengths. This feasibility is evidence that SoftHebb's is strengths may soon also apply to larger networks and datasets.
8

---

AI I
6 2 8 2 8 8 3
6 2 8
2
B
1 / /
2
2
2
2
4
4
4 4
4
9
9
8
O
O
O
0
0
2
2
8 8
/
/ /
/
/
8
3
3
3
3
3
5
5
8
8
8
8
8
8
8
3
33
8
8
8
8
8
3
3
3
33 8 8 8
9
9
9
9
7
9
7
7
7
7
7
4
9
8 9 8
E (L norm)
E {L norm)
Figure 3: Examples generated by the adversarial pair PGD attacker/SoftHehb model. SoftHebb's inherent tendency to deflect the attack towards truly different classes is visible. This tendency can be repurposed to generate interpolations between different classes the data distribution, generative property previously unknown for such simple networks.
4 DISCUSSION
We have described SoftHebb, a highly biologically plausible neural algorithm that is founded Bayesian ML-theoretic framework. The model consists of elements fully compatible with conventional ANNs. It was previously not known which plasticity rule should be used to learn a Bayesian generative model of the input distribution in ANN WTTA networks. Moreover, we showed that Hard WTA networks and neurons with other activation functions can be described within the same framework variations of the probabilistic model. This theory could provide new foundation for normative Hebbian ANN designs with practical significance. For example. SoftHebb's 's properties unsupervised, local, and requires
are sought-after by efficient neuromorphic learning chips. no error or other feedback currents from upper layers, thus solving hardware-ineti ineffiiiieeeefficccciiieee and ioo-ipplausibbiities of backpropagation such as weight-transport and update-locking. Surprisingly, it surpasses backpropagation even in accuracy, when training time and network size are limited. In a demonstration that goes beyond the common greedy-training approach to such networks, we achieved update-ur apdlate-ullockd unlocked operation in practice, by updating the first layer before the input's 's full processing by the next layer. is intriguing that, through its biological plausibility, emerge properties commonly associated with biological intelligence, such speed of learning, and robustness noise and adversarial attacks. Significant robustness emerges without specialized defences. Furthermore, SoftHebb tends to not merely be robust attacks, but actually deflect them specialized SOTA defences aim to do.
Here, we explored SoftHebb's 's applicability several datasets. We measured its accuracy on MNIST, Fashion-MNIST, and CIFAR- 10 in preliminary results, and we reported a functional convolutional SoftHebb network that improves accuracy on the significantly harder dataset of CIFAR-10. The con- volutional implementation could become the foundation for deeper networks and complex problems. Ultimately, this could provide insights into the role of WTA microcircuits in larger networks in cortex with localized receptive fields (Pogodin et al., 2021), similar to area V1 of cortex (Hubel & Wiesel, 1962). All in all, the algorithm has several properties that are individually interesting and novel, and worth future extension. Combined, however, SoftHebb's properties shown in this work may already enable certain small-scale but greviuuly-impoosibbe unsupervised learning of simple tasks by edge sensing devices, operating in noisy conditions, with small battery and only local processing, requires those algorithmic properties that we demonstrated here.
applications. For example, fast, on-line,

---

REPRODUCIBILITY STATEMENT
Some of our main contributions are theoretical and their proof is fully reproducible by following the rigorous derivations in the main text and the appendices. Our experimental results are based on standard machine-learning techniques, while we also describe the hyperparameters and experimental protocols. Moreover, we provide Python code with specific instructions to reproduce the main experiments.
REFERENCES
Anthony J Bell and Terrence J Sejnowski. An information-maxxiizztionn approach to blind separation and blind deconvolution. Neural computation, 7(6):1129-1153 1995.
Yoshua Bengio, Dong-Hyun Lee, Jorg Bornschein, Thomas Mesnard, and Zhouhan Lin. Towards biologically plausible deep learning. arXiv preprint 1rXiv:1502.04116 2015.
David Berthelot, Colin Raffel, Aurko Roy, and lan Goodfellow. Understanding and improving interpolation in autoencoders via an adversarial regularizer. arXiv preprint arXiv: 1807.07543, 2018.
Tom Binzegger, Rodney Douglas, and Kevan AC Martin. A quantitative map of the circuit cat primary visual cortex. Journal of Neuroscience, 24(39) (4441):844111 -4533, 2004.
Piotr Bojanowski, Armand Joulin, David Lopez-Paz, and Arthur Szlam. Optimizing the latent space of generative networks. arXiv preprint arXivv1707.05776. 2017.
Jonathan Cannon, Michelle McCarthy, Shane Lee, Jung Lee, Christoph Börgers, Miles Whit- tington, and Nancy Kopell. Neurosystems: brain rhythms and cognitive processing. European Journal of Neuroscience, 39(5)7005-71,, 2014.
Ting Chen, Simon Kornblith, Mohammad Norouzi, and Geoffrey Hinton. A simple framework for contrastive learning of visual representations. In International conference on machine learning, pp. 1597-1607. PMLR, 2020.
Antonia Creswell, Tom White, Vincent Dumoulin, Kai Arulkumaran, Biswa Sengupta, and Anil Bharath. Generative adversarial networks: An overview. IEEE Signal Processing Magazine, 35(1): 53-65, 2018.
Jacob Devlin, Ming-Wes Wei Chang, Kenton Lee, and Kristina Toutanova. Bert: Pre-training of deep bidirectional transformers for language understanding. arXiv preprint arXiv: 048000 2018.
Peter U Diehl and Matthew Cook. Unsupervised learning of digit recognition using spike-timing- dependent plasticity. Frontiers in computational neuroscience, 9:99, 2015.
Peter U Diehl and Matthew Cook. Learning and inferring relations in cortical networks. arXiv
preprint /608. 08267, 2016.
Rodney J Douglas and Kevan AC Martin. Neuronal circuits of the neocortex. Annu. Rev. Neurosci., 27:419-451 2004.
Maxence Ernoult, Julie Grollier, Damien Querlioz, Yoshua Bengio, and Benjamin Scellier. Equilib- rium propagation with continual weight updates. arXiv preprint arXiv:2005.04116 040600000046........ 2020.
Peter Földiak. Forming sparse representations by local anti-hebbian learning. Biological cybernetics, 64(2):165-170, 1990.
Peter Földiák and Peter Fdilr. Adaptive network for optimal linear feature extraction. 1989.
Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley. Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial networks, arXiv preprint 1xXvv/406.2600 2014.
10

---

Jordan Guerguiev, Timothy P Lillicrap, and Blake A Richards. Towards deep learning with segregated dendrites. ELife, 6:e22901, 2017.
Richard Hahnloser, Rodney J Douglas, Misha Mahowald, and Klaus Hepp. Feedback interactions
between neuronal pointers and maps for attentional processing. nature neuroscience, 2(8):746-
1999.
Geoffrey Hinton, Oriol Vinyals, and Jeff Dean. Distilling the knowledge neural network. arXiv preprint arXiv:1503.0253/ 2015.
Tao Hu, Cengiz Pehlevan, and Dmitri B Chklovskii. A hebbian/anti-heebiaan network for online sparse dictionary learning derived from symmetrie matrix factorization. In 2014 48th Asilomar Conference on Signals, Systems and Computers, pp. 613-619. IEEE, 2014.
David H Hubel and Torsten N Wiesel. Receptive fields, binocular interaction and functional architec- ture in the cat's 's visual cortex. The Journal of physiology, 160(1):106-155)) 1962.
Bernd Illing, Wulfram Gerstner, and Johanni Brea. Biologically plausible deep learning but how far can we go with shallow networks? Neural Networks, 11::90-101, 2019.
Takuya Isomura and Taro Toyoizumi. Error-gated hebbian rule: local learning rule for principal and independent component analysis. Scientific reports, 8(1):1-11, 2018.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
Dmitry Krotov and John J Hopfield. Unsupervised learning by competing hidden units. Proceedings of the National Academy of Sciences, 116(16)7723-731,,2000 2019.
Te-Won Lee, Mark Girolami, and Terrence Sejnowski. Independent component analysis using an extended infomax algorithm for mixed subgaussian and supergaussian sources. Neural computation, 11(2):417-41, 1999.
Timothy P Lillicrap, Daniel Cownden, Douglas B Tweed, and Colin J Akerman. Random synaptic feedback weights support error backpropagation for deep learning. Nature communications, 7(1): 1-10, 2016.
Ralph Linsker. Local synaptic learning rules suffice to maximize mutual information in a linear network. Neural Compulation, 4(5):691-702, 1992.
Wolfgang Maass, On the computational power of winner-take-all, Neural computation, 12(1)::
2519-2535, 2000.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint 1xXx::706.00088) 2017.
Beren Millidge, Alexander Tschantz, and Christopher L Buckley. Predictive coding approximates backprop along arbitrary computation graphs. arXiv preprint arXiv:2006. 04 182, 2020.
Timoleon Moraitis, Abu Sebastian, and Evangelos Eleftheriou. Short-term synaptic plasticity opti-
mally models continuous environments, 2020.
Bernhard Nessler, Michael Pfeiffer, and Wolfgang Maass. hidden causes of their inputs. Advances neural information processing systems, 12:1357-1365, 2009.
Stdp enables spiking neurons to detect
Bernhard Nessler, Michael Pfeiffer, Lars Buesing, and Wolfgang Maass. Bayesian computation emerges in generic cortical microcircuits through tational biology, 94)xe 2013.
plasticity. PLoS compu-
Erkki Oja. Simplified neuron model principal component analyzer. Journal of mathematical biology, 15(3)2667-233, 1982.
Bruno A Olshausen and David J Field. Emergence of simple-cell receptive field properties by learning sparse code for natural images. Nature, 381 (658))6660776 1996.
11

---

Bruno A Olshausen and David Field. Sparse coding with overcomplete basis set: A strategy employed by v1? Vision research, 37(23):3311-3325 1997.
Cengiz Pehlevan and Dmitri Chklovskii. A normative theory of adaptive dimensionality reduc- tion in neural networks. In C. Cortes, N. Lawrence, D. Lee, M. Sugiyama, and R. Gar- nett (eds.), Advances in Neural Information Processing Systems, volume 28. Curran Asso- ciates, Inc., 2015. URL (ag.cc99f7..ee733cccc33334222223
neurips http:///wwg.a.uooooooo//o//////a hctps/pappppp//////eeeee./ pdf.
Cengiz Pehlevan and Dmitri B Chklovskii. A hebbian/anti-hebbian network derived from online non-negative matrix factorization can cluster and discover sparse features. In 2014 48th Asilomar Conference Signals, Systems and Computers, pp. 769-775. IEEE, 2014.
Cengiz Pehlevan, Alexander Genkin, and Dmitri B Chklovskii. A clustering neural network model of insect olfaction. In 2017 51st Asilomar Conference on Signals, Systems, and Computers, pp. 593-600. IEBE, 2017.
Michael Pfeiffer and Thomas Pfeil. Deep learning with spiking neurons: opportunities and challenges. Frontiers in neuroscience, 12:774, 2018.
Roman Pogodin and Peter E Latham. Kernelized information bottleneck leads to biologically plausible 3-factor hebbian learning in deep networks. arXiv preprint arXiv:2006.07123 2020.
Roman Pogodin, Yash Mehta, Timothy P Lillicrap, and Peter Latham. Towards biologically plausible convolutional networks. arXiv preprint arXiv:2106. 1303/, 2021.
Yao Qin, Nicholas Frosst, Colin Raffel, Garrison Cottrell, and Geoffrey Hinton. Deflecting adversarial attacks. arXiv preprint arXiv:2002.07405, 2020.
Alec Radford, Luke Metz, and Soumith Chintala. Unsupervised representation learning with deep convolutional generative adversarial networks. arXiv preprint
2015.
Ueli Rutishauser, Rodney Douglas, and Jean-Jacques Slotine. Collective stability of networks of winner-take-all circuits. Neural computation, 23(3):735-773, 2011.
Terence D Sanger. Optimal unsupervised learning in a single-layer linear feedforward neural network. Neural networks, 2(6):459-473. 1989.
Benjamin Scellier and Yoshua Bengio. Equilibrium propagation: Bridging the gap between energy- based models and backpropagation. Frontiers computational neuroscience, 11: :2,4, 2017.
Terrence Sejnowski. The unreasonable effectiveness of deep learning in artificial intelligence. Proceedings of the National Academy of Sciences. 117(4))300333-3000 2020.
Chr Von der Malsburg. Self-organization of orientation sensitive cells in the striate cortex. Kybernetik, 14(2):85-100, 1973.
Han Xiao, Kashif Rasul, and Roland Vollgraf. Fashion-mnist: novel image dataset for benchmarking machine learning algorithms, 2017.
12

---

APPENDIX A SUPPLEMENTARY INFORMATION TO THE THEORY SECTION
Probabilistic interpretation
Mathematical description
Neuronal interpretation
mixture model
((x)
Σi-1 o(2)(C)) Q(C.)
likelibood function
(a: Was = Q(Ca i. waz)
posterior probablity
lateral inhubition
Em of En puraeiin
divisive inhibition softmax
(x; wa) @(Cki
activation of exponential neuron
modeled prior probablity
Q(C²; Wps) e
porameter of modeled prior probabiliyy
nouron biss
parameter
modeled k-th component of likelihood fumction
(u(x; w.) = ((2 Cui una)
g
cosine similarity
Mi (2; ws)
preactivation
(total weighted neuronal input)
normalized parameter of modeled likelibood function
[wxll
normalized weights
sample normalized catta
[
normalized imput
Figure 4: The soft WTA model (Moraitis al., 2020) used in SoftHebb. The network graph is shown on the right. The input to the layer is shown at the bottom and the output is at the top. Each depicted computational element in the diagram is white or grey row that also includes the element's description on the left.
Algorithm SoftHebb learning
1: for all neurons & {1, 2, ..., K} } in the layer, do
2: initialize random weights and biases
3: for all training examples do
4: for all neurons do
5: Calculate preactivation 2g W.
6: for all neurons k do
7: Optional: calculate activation of h( + Wok)
b> c.g. =
8: Calculate posterior (i.e. normalized activation) yk
Deg. Softmax
9:
for all neurons do for all synapses do
10:
calculate weight change Aw (SaftHebb) = M/ (x, w(x)
11:
12:
update weight wit Wik + A A calculate bias change Aw Sobt update bias Wok Wok Aw SoftHebb
(SoftHebb)
13:
me - (yk - woR)
14:
Proof of Theorem 2.3. The parameters model g are optimal w opt w if they minimize the model's Kullback-Leibhe divergence with the data distribution p. Dx (x(()())) w)). Because Pk P() is independent from Pt, and qs q(x[(c;; wx) is independent from wi for every I # k, we can find the set of parameters that minimize the KL divergence of the mixtures, by minimizing the KI. divergence of each component k: min D (pallg)), Vk, and simultaneously setting
P(C+) Q(Cx; wor), Vk. From Eq. and this last condition, Eq. 5 of the Theorem proven:
(12)
opt Wps In P(Cx).
13

---

Further,
opt Wy = arg min DEL l1x)
Ph dx
= arg min
Ph: In
qr:
arg min we
Pk In ps
Ps In dg.
arg min We
Pk. In qudx
(13)
arg max
Pk. In qu da
arg max we
Ps. In nh dx
(14)
arg max
arg max Upp (ux)
arg max Ppa. (cos (20,, x))
(15)
where we used for Eq. 13 the fact that [ Pse pada a constant because it determined by the environment's s data and not by the model's parametrization on w. Eq. 14 follows from the definition of ql. The result in Eq. 15 is the mean value of the cosine similarity ug.
Due to the symmetry of the cosine similarity, it follows that
opt Ww = arg max Ppp (cos (wk: x)) = arg max cos (Wk, Hpp (x)) anl
(16)
=c Hpp (x) E IR.
(17)
Enforcement of the requirement for normalization of the vector leads to the unique solution
of Ppg (a)
Pps [=]]]]
Proof of Theorem 2.5. We will find the equilibrium point of the SoftHebb plasticity rule, i.e. the (SaftHebb) 0.
weight wi that implies E[ E[Aw Aw
We will expand this expected value based on the plasticity rule itself, and on the probability distribution of the input
E ( =1
yx (xx)x)) (x+ (x)=wa)) (())))
(18)
17 / ( w...kssk)
Σ ((a)) da
(19)
WpWii / (on()))(((
7
aan ((C))
(20)
Based on this, we will now show that
Mpp (
Wk opt W
and Wok opt Woks Ak
(21)
11mpe [x)]]
E Au (SoftHebb)
Vi, lt.
(22)
Using the premise 21, we can take the following steps, where steps 3, 4, and are the main ones, and steps 1, 2, and 5, as well as Theorem A.1 support those.
14

---

(a) We assume that the "support" 0% of the component p& (2), i.e. the region where pk is not negligible, is not fully overlapping with that of other components pt. In addition, 0f narrow relative to the input space Ak, because, first, the cosine in case 1. The cosine similarity function (xxx) Iw,, as determined by the total weighted input to the neuron k, and appropriately normalized, defines a probability distribution centred symmetrically around the vector wt, Le. Mng (a) = we and ug (Mu, x) un (Hr,, + x).
Wk. as premised, equal to the normalized Mps (x). i.c. the mean of the distribution (=( = p(z[Ck), therefore: Ma, (æ) Hp. (z:).
2. The TAAt-WTA version of the neuronal transformation, i.e. the softmax version of the model's inference is
exp (ux (x)) exp(wok)
y4 (x))
(23)
E exp (x)) cxp((wor)
But because of the premise 21 that the parameters of the model ug are set to their optimal value, it follows that exp(1x (up (x:) = (x)) and exp(wok) = P(Ck), Ak (see also Theorem 2.6), therefore
(x) ((()))
(24)
P)
3. Eq. 20 involves twice the function yı (2))p()) Σi= Yı (z) (x)) Using the above two points, we will now show that this approximately equal to yı (x)
similarity (x) diminishes fast from its maximum at arg max ug of non-trivial dimensionality of the input space, and, second, pk (x) = exp (ux (x)) applies a further exponential decrease.
Therefore, the overlap 0f Of is small, or none, VI + k. If 0% is the "support" of yk. then this is even narrower than 0f, due to the softmax. As result, the overlap 0% n Of of yv and is even smaller than the overlap O% n of of pk and pt, VI + k.
(b) Because of the numerator in Eq. 24, the overlap Of n Og of ys and pr is large. Based on these two points, the overlaps Of n Of can be neglected for of k. and follows that
K
Σ (x()))(())P((CC)) = (z))
(25)
Therefore, we can write Eq. as
E Aw (SoftMecbb)
1) I (1) wy
(26)
Next, we aim to show that the integrals f. x. (x) (x)dx and f.x zyy (z)x in- volved in that Equation equal the mean value of x, and æ respectively according to the distribution Pk-
To show this, observe that the integrals indeed mean values of 2; and according to a probability distribution, and specifically the distribution y&Pps We will first show that the distribution pk symmetric around its mean Mp, (x: Then will show that ya (ar) is also symmetric around the same mean. Then we will use the fact that the product of two such symmetric distributions with common mean, such as PkPk. a distribution with the same mean, a fact that we will prove in Theorem A.
4. Because the cosine similarity function uy (æ) is symmetric around the mean value Pag (x) wgi Us (Pu, x)) = Ue(Hu, + x). it follows that ps (Hu, - x) = exp(ux (Hug x)) exp(us (Pr, + x)) pk (Mug + ar).
15

---

Therefore, (=( exp (x)( does have the sought property of symmetry, around Mpp (x)).
In point of this list we have also shown that Muu (x) Hpz (z)), thus ps is symmetric around its own mean Mp, (z).
5. The reason why the softmax output yn is symmetric around the same mean as consists in the following arguments:
(a) The numerator ps of the ys softmax in Eq. 24 symmetric around Mps (æ), as was shown in the preceding point.
(b) The denominator Eq. 24, i.e. Σ exp (pr())) P(C)) is also symmetric around Mp, (a) in 0% where 0% is the "support" of the py distribution, i.e. the region where the numerator Pk: is not negligible.
This is because:
assume that the data is distributed on the unit hypersphere the input space according to p(æ) without a bias. Therefore the total contribution of components Eiek Pi (z) P(C)) to p(x) that neighbourhood Og approximately symmetric around μog (x). ii. Σitx pr (z) P(C)) is not only approximately symmetric, but also its remaining asymmetry has a negligible contribution to p(z) in 0g because p(r) in 02 is mostly determined by (x))).
This is true, because as we showed in point 3a, Of no is a narrow overlap 4I & k.
iii Ps: is also symmetric, therefore, the total sum Σi= exp (pi(z)) P(Ci) is symmet- ric around pp, (ar).
(c) The inverse fraction of a symmetric function f is also symmetric around the same mean, therefore the inverse of the denominator p(æ) Σ (=)) is also
symmetric around the mean value Mp, (2).
(d) The normalized product of two distributions that are symmetric around the same mean a probability distribution with the same mean. We prove this formally Theorem A.I and its Proof the end of the present Appendix A.
Therefore yk Pk p(m) P', (r).
is indeed symmetric around Pm,. (x) Mag (x)
-wk
summary,
Mpx (x) Myy (z),
(27)
and, due to the symmetry,
(M + x)) = Px xx),
(28)
yk (x a)) yk (ppp x))
(29)
6. Because the means of (z) and of pk (x) are both equal to Pox (x), and because both distri- butions are symmetric around that mean, the probability distribution yo (x=))x (a: P(Cx)/ Ts. where Tg is the normalization factor, also has mean Hyaps (x)) equal to Pp,, (zr):
/ æ. (z)
dn Pya (m))
(30)
We prove this formally in Theorem A.I and in its Proof at the end of the present Appendix A.
Therefore, the first component of the sum in Eq. 26
Z.Wlk (x)pu (x) Is Ppa (4;)
(31)
and, similarly, the second component is
W.g Wikk
æyyk myy (2)) = - -TgDEWsk Ppa (2:).
(32)
16

---

From the above conclusions about the components of the sum in Eq. 26, it follows that
E| El [ = pm (x;) - Was Moe (x)
(33)
I (14p, (x44) wx (xz) waa)
(34)
(pyp (2r2) - 11pr (1)p(()))]] || wixk
(35)
Hop (2:4)
TN (Kp (144) (Moe(
11 (o))
(36)
11 (x)]
O.
(37)
Therefore, it is indeed true that wy = opt w
Mpp (ar)
Vk
ElAw
(SoftHebbl 0 Vi, k.
1lups (x=]l
Thus, the optimal weights of the model SoftHebb plasticity rule and network.
opt 2
lMpp (e]]
Mop (x))
vk are equilibrium weights of the
However, it is not yet clear that the weights that are normalized to a unit vector are those that the rule converges to, and that other norms of the vector unstable. We will now give an intuition, and then prove that this is the case.
The multiplicative factor ey is common between our rule and Oja's rule (Oja, 1982). The effect of this factor is known to normalize the weight vector of each neuron to a length of one (Oja, 1982), as also shown similar rules with this multiplicative factor (Krotov & Hopfield, 2019). We prove that this is the effect of the factor also in the SoftHebb rule, separately in Theorem A.2 and its Proof, provided at the end of the present Appendix A.
This proves Theorem 2.5, and satisfies the optimality condition derived in Theorem 2.3.
Proof of Theorem 2.6. Similarly to the Proof of Theorem 2.5, find the equilibrium parameter Wok of the SoftHebb plasticity rule.
E E|Awok]
= =
(yke-wou 1) p(yx
(38)
yk
mok
p(yk) -1)
(39)
n
E(yk] -1)
(40)
1)
wor pma (Q(Ck(zz)
(41)
17
[e wor Mmu (P(Cklz))
(42)
7
wox P(Ck) -1]
(43)
Therefore,
E[Awps]
SoffHHbb = In P(Ck), W
(44)
which proves Theorem 2.6 and shows the SoftHebb plasticity rule of the neuronal bias finds the optimal parameter of the Bayesian generative model as defined by Eq. Theorem 2.3.
O
Theorem A.1. Given two probability density functions (PDF) y(ι) and p(x) that are both centred symmetrically around the same mean value μ. their product y(x),(x), normalized appropriately, is PDF with the same mean, i.e.
J, xy(x)dx= =
Jn xp(x)dd =
1 1 zy(2)p(x)dz n.
(45)
p(u+ x) = -p(u-1 x)
x = u(u - x))
17

---

Proof of Theorem A.I.
f ny(x)p(a)dr = S ny(x)p(()dr + f xy(x)p(z)dr
(46)
, ry(c)p(z)dr
(47)
(u -uy(u uu)p(u u)d(f u)
(48)
400
- (e u)y(u 2)p(f u)du
(49)
palp u)p(f - u)du- +
wyln u)p(H - u)du
(50)
+00
mlln + u)p(u
+ w)d(
wy(u u)plu u)du
(51)
+ Hlat
u)ppu ujdu
uy(u + uu)ppu + w)du
(52)
1l y(z)p(x)dz
uy(p u)p(u+ u)du.
(53)
+oc 1 = ry(s)p(x)dx
(54)
= =/0 (n + u)y(H + u)p(m + u)d(H + +.)
(55)
pyll + uup(u + u)du+ + (r uyln + u)p(H + u)du
(56)
= 1 s(x)p(o)de+ + love uylu+ + w)p(a + u)du.
(57)
Therefore,
f nu(()p(r)dr= = I1 12
(58)
= p " y(z)p(z)do | uylu + u)p(y + u)du
(59)
[ +00
u(x)p(z)dr+ + / uy(n + u)p(u + uddu = p. I,
+p
(60)
where / = fto
to0 y(z)p(r)dz.
Theorem A.2. The equilibrium weights of the SoftHebb synaptic plasticity rule of Eq. 8 are implicitly normalized by the rule vector of length 1.
Proof of Theorem A.2. Using technique similar to (Krotov & Hopfield, 2019), write the Soft- Hebb plasticity rule as a differential equation
dw (SoftHehb)
T
db
dt
= T Aw w
ik
(SoftHebb)
TT - 8k (x; u.wa))
(61)
18

---

SoftHebb) The derivative of the norm of the weight vector is
d w ll
d(urgank))
dwv
dt 2r0
(62)
dt
dt
Replacing dws de
in this equation with the SoftHebb rule of Eq. 61, is
d|
w g
2 wE
(xc up wx) = 22 wp Vk (æ wbZw[a
dt
2 U (1 - 1| Il)
(63)
This differential equation shows that the derivative of the norm of the weight vector increases if ||we|| and decreases [w/| > such that the weight vector tends sphere of radius which proves the Theorem.
19

---

APPENDIX B DETAILS TO Alternate activation functions (SECTION 2.7)
Theorem 2.3, which concerns the synaptic plasticity rule in Eq. 8, was proven for the model of Definition 2.2, which uses mixture of natural exponential component distributions, i.e. with base (Eq. 4):
4 == (kx wx) = e
(64)
This implied an equivalence to a WTA neural network with natural exponential activation functions (Section 2.4). However, it is simple show that these results can be extended to other model probability distributions, and thus other neuronal activations.
Firstly, in the simplest of the alternatives, the base of the exponential function can be chosen differently, In that case, the posterior probabilities that are produced by the model's Bayesian inference, i.e, the network outputs, Q[C& [z; w) y& (2; w) are given by a softmax with a different base. If the base of the exponential is b, then
6 +
((Ck|a;;0) w) yk
(65)
Eisl 611
is obvious in the Proof of Theorem 2.3 in Appendix A that the same proof also applies to the changed base, if we use the appropriate logarithm for describing KL divergence. Therefore, the optimal parameter vector does not change, and the SobtHebb plasticity rule also applies to the SoftHebb model with a different exponential base. This change of the base in the softmax bears similarities to the change of its exponent, in technique that is called Temperature Scaling and has been proven useful in classification (Hinton al., 2015).
Secondly, the more conventional type of Temperature Scaling, i.e. that which scales exponent, is also possible in our model, while maintaining Bayesian probabilistic interpretation of the outputs, neural interpretation of the model, and the optimality of the plasticity rule. In this case, the model becomes
e wox))
Q(Ck/z; yh-
(66)
21=1 eluu+wor//T
The Proof of Theorem 2.3 in Appendix A also applies in this case, with a change in Eq. 14, but resulting in the same solution. Therefore, the SoftHebb synaptic plasticity rule is applicable in this case too. The solution for the neuronal biases, i.e. the parameters of the prior in the Theorem (Eq. 5), also remains the same, but with factor of T: ope "ox = T In P(Cx).
Finally, and most generally, the model can be generalized to use any negativte and monotonically increasing function l((x) for the component distributions, i.e. for the activation function of the neurons, assuming h(x)) is appropriately normalized to be interpretable as probability density function. In this case the model becomes
I((x)) Wok
Q(Ck|z;; w) = yk Σ N(()) wot
(67)
Note that there is a change in the parametrization of the priors into a multiplicative bias Wo, compared to the additive bias in the previous versions above. This change is necessary in this general case, because not all functions have the property ea+h = e" e² that we used in the exponential case. We can show that the optimal weight parameters remain the same in the previous case of an exponential activation function, also for this more general case of activation h. It can be seen in the Proof of Theorem 2.3, that for more general function h(z)) than the exponential, Eq. 14 would instead become:
opt W3 = arg min D (palle)) = arg max / Pk. In h(u )x wy
[ pr In (cco (WE, )d)
arg max
ws
arg max Mer. (In li(cos (wxx, x)))
ui
arg max Upa (g(cos (w), x: x)))
(68)
Wk
20

---

where ((x) = In h(z). We have assumed that h is an increasing function, therefore g is also increasing. The cosine similarity is symmetrically decreasing as a function of a around wg. Therefore. the function g'(x:)
g(cos( (Wg, æ)) also decreases symmetrically around wt- Thus, the mean of that function g' under the probability distribution pk: is maximum when Mp, = wp- As a result, Eq. 68 implies that in this more general model too, the optimal weight vector is oyr uh c Ppp (x)) e C R. and, consequently, it is also optimized by the same SoftHebb plasticity rule.
The implication of this is that the SoftHebb WTA neural network can use activation functions such as rectified linear units (ReLU), or other non-negative and increasing activations, such as rectified polynomials (Krotov & Hopfield, 2019) etc.. and maintain its generative properties, its Bayesian computation, and the theoretical optimality of the plasticity rule. A more complex derivation of the optimal weight vector for alternative activation functions, which was specific to ReLU only, and did not also derive the associated long-term plasticity rule for our problem category (Definition 2.1) 1), was provided by Moraitis al. (2020).
APPENDIX C CROSS-ENTROPY AND TRUE CAUSES, AS OPPOSED TO LABELS
It is important to note that, in labelled datasets, the labels that have been assigned by human supervisor may not correspond exactly to the true causes that generate the data, which SoftHebb infers. For example, consider MNIST. The 10 labels indicating the 10 decimal digits do not correspond exactly to the true cause of each example image. In reality, the cause C' of each MNIST example in the sense implied by causal inference is not the digit cause itself, but a combination of single digit cause D, which is the MNIST label, with one of many handwriting styles S. That is, the probabilistic of Definition 2.1, the cause C' of each sample is dual, i.c. there exists digit Da (d [0, and a style S, such that P(CI)= = P(C = Ck) = P(S.) # P(Da). and P(Da) Σ P(C.))(DalC.)
model is such that in the Eq. P(x)= = Eg P(x]Ck)
(69)
(70)
This is important for our unsupervised model. To illustrate this point, a network with K competing neurons trained on MNIST may learn not to specialize to K digits D. but rather to K handwriting styles S of one digit Da, or in general K combinations of digits with styles - combinations, which are the true causes C' that generate the data. This leads in this case a mismatch between the labels D. and the true causes C' of the data. Therefore, given the labels and not the causes, it is not obvious which number K should be chosen for the number of neurons. Practically speaking, K can be chosen using common heuristics from cluster analysis. It is also not obvious how to measure the loss of the WTA network during the learning process, since the ground truth for causes C is missing. We will now provide the theoretical tools for achieving this loss coss-evaluation based on the labels. Even though SoftHebb is a generative model, it can be used for discrimination of the input classes Ck. using Bayes' theorem. More formally, the proof of Theorem 2.3 involved showing that SobtHebb minimizes the KL divergence of the model q(x) from the data p(x). Based on this it can be shown that the algorithm also minimizes its cross-entropy H = HP(C)), Q(C[z)) of the causes Q(Ca (æ) that it infers, from the true causes of the data P(Cx): w SoftHebb = arg min,, Hgausee An additional consequence is that by minimizing Heausee SoftHebb also minimizes its label-based cross-entropy Hlabels = ((P(Ds). Q(Da)) between the true labels P(Da) and the implicitly inferred labels Q(aa):
Q(Da)= = EQ(CwP(DaCs)
(71)
Heauses arg min H Hlabels SoftHebb arg min HQ
(72)
w
This is because, in Eqs. 70 and 71, the dependence of the labels on the true causes P(Da|Ck) is fixed by the data generation process. To obtain Q(Da(z) and measure the cross-entropy, the causal structure P(Da C') is missing, but it can be represented by a supervised classifier (2aaii((Cla) of SoftHebb's outputs, trained using the labels Da- Therefore, by (a) unsupervised training of SoftHebb, then (b) training supervised classifier on top, and finally (cl) repeating the training of SoftHebb with the same initial weights and ordering of the training inputs, while (c2) measuring the trained classifier's loss, we can observe the cross-entropy loss Hlabels of SoftHebb while it is being
21

---

minimized, and infer that Heauses is also minimized (Eq. 72). We call this the post-hoe eross-entropy method, and we have used it in our experiments (Section 3.2 and Fig. C and D) to evaluate the learning process in theoretically sound manner.
APPENDIX D DETAILS ON HEBBIAN EXPERIMENTS
In our validation experiments found that softmax with base of 1000 (see Section 2.7) performed best. The learning rate 1) of Eq. decreased linearly from 0.03 to O throughout training.
We found that initial learning rate of 0.05 was best for the hard-WTA network. There certain tunable options and hyperparameters for the training of SoftHebb as well as for its forward propagation the next layer. Here we provide some guidelines for choosing the best options, and report those that we used. We searched over the initial learning rate of Eq. 8 in the range of 0.1 and 0.001. The activation function (forward pass) searched among RePU (rectified polynomial unit generalization of ReLU) ??, softmax, sigmoid, tanh. For the 100 epochs experiment, we found that SoftHebb and its limit case of hard WTA are both stable with learning rate that decays linearly to zero and starts between 0.08 and 0.02 while being optimum at an initial value of 0.045. As for the activation, we found that there 3 accurate configurations; RePU with a power of 4.5, softmax with is added. For the I epoch
base of 200 and softmax with smaller base of if run, the learning rate best decaying exponentially, starting at 0.55 and ending 0.0055. In that fast learning mode, only softmax activation with high base of 200 gives good accuracy.
For Fashion-MNIST the same options are best, except that an initial learning rate value of 0.065 performs better.
Supervised training of 100 epochs was done using Adam optimizer with mini-batch of 64. The learning-rate schedule starts 0.001 and every 15 epochs is divided by 2.
In the single-epoch case, learning online, i.e. mini-batch size 1, for both the Hebbian and the supervised layer.
D.1 CONVOLUTIONAL SOFTHEBB
We implemented convolutional version of SoftHebb. In this case, the WTA soft competition is between convolutional kernels. This WTA computation and the corresponding SoftHebb update iterated over each patch of the layer's input features, and this repeated operation over the patches parallelized on GPUs. Effectively, this is similar to a fully connected SoftHebb that trained on smaller patches of the original images.
APPENDIX E DETAILS ON ADVERSARIAL ATTACKS
We used "Foolbox", Python library for ad adversarial attacks.
E.
TUNING PGD's S PARAMETERS
Curc
E 12/22525 2255
E 128 2255
/255
Figure 5: Noise and adversarial attack robustness SoftHebb and other unsupervised algorithms.
PGD has a few parameters that influence the effectiveness the attack. Namely, e which is a parameter determining the size of the perturbation, the number of iterations for the attack's 's gradient ascent, the step size per iteration, and a number of possible random restarts per attacked sample. Here chose 5 random restarts. Then found that 200 iterations sufficient for both MNIST and
22

---

F-MNIST (Fig. 5 A and B). Then, using 200 iterations, and different values, we searched for sufficiently good step size. We found that relative to c a step size value of 0.01 = 0.33c (which is also the default value of the toolbox that we used) is good value. An example curve for e 32/255 is shown in Fig. 5 C for MNIST and F-MNIST.
0.3
E.2 ADVERSARIAL ROBUSTNESS OF K-MEANS AND PCA
A
B 100.00
100
Gauasdan notse
PGD adversarial attack
Hard WIAh
Scttiich
Atcrocy (N)
26.00
Scrweth Eineess
MAST
MAAT F-WNST
PCA
0.00
02
0.6
9.7
3.0
5253
18225
128225 225/255
Standard deviaatin
Figure 6: Noise and adversarial attack robustness of SoftHebb and of other unsupervised algorithms.
It possible that the observed robustness of SoftHebb can be reproduced by other unsupervised learning rules. To test this possibility, we compared SoftHebb with PCA and k-means. We used 100 neurons, principal components, or centroids respectively. In PCA and k-means we then treated the learned coefficients as weight vectors of neurons and applied an activation function to then train supervised classifier on top. First we attempted softmax as in SoftHebb. However the unperturbed test accuracy achieved at convergence was much lower. For example, on MNIST, k-means only reached an accuracy of 53.64% and PCA 28. 28.55, whereas SoftHebb reached 91.06 .06. Therefore, we performed the experiment again, but with ReLU activation for k-means and PCA, reaching 90.61% and 82.74% respectively. Then we tested for robustness, revealing that SoftHebb's 's learned features are in fact more robust than those of other unsupervised algorithms (Fig. 6). For completeness, we also include the hard WTA network, which is essentially a special case of SoftHebb with very high base in the softmax (Section 2.7), and is therefore learning equally robust features.
E.3 EFFECT OF ACTIVATION FUNCTION ON ADVERSARIAL ROBUSTNESS
B
Gausdian 50
PGD adversaral attack
120.00
Jadepaa Sottibb
$2.00
MRNT
Backprop Sotrmus
VAAST
PANMSTT
8.00
1UNST
077
253/255
Standard Fevizion
Figure 7: Noise and adversarial attack robustness of SoftHebb and of backpropagatioo-triin traineed softmax-MIP MNIST and FaShion-MNIST. Both SoftHebb and the MI.P use softmax activation at the hidden layer.
It is possible that the observed robustness of SoftHebb is due to the use of softmax function. To test this, we compared the SoftHebb network from Fig. 2 with a same-sizz size backprop- trained 2-layer network, but here where the hidden layer's summed weighted input was passed through a softmax instead of ReLU before forwarding to the 2nd layer. First, we observed that at convergence, the backprop-trained network did not achieve SoftHebb's accuracy on either MNIST
activation
23

---

(94.38%) or Fashion-MNIST (75.90%). Increasing the training time to 300 epochs did not help. Second, as can be seen in 7, backpropagation remains significantly less robust than SoftHebb to the input perturbations. This, together with the previous control experiments, suggests that, rather than its activation function, it SoftHebb's s learned representations that are responsible for the network's robustness.
24


Reviews:
[{"review_id": "oVMz2y1q6FE", "reviewer": "Reviewer_F6Fz", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "# UPDATED SCORE\n* Score was updated to reflect the changes made by the authors during the rebuttal phase: 5-> 6\n\n# Strengths\n* Biologically-inspired Bayesian generative neural network that combines Hebbian learning with winner-takes-all connectivity\n* Apparent improvement in robustness both to white-box adversarial attacks (PGD) and black-box attacks (Gaussian Noise)\n\n# Weaknesses\n* Model is evaluated only on MNIST and Fashion-MNIST datasets and is not clear whether it can be expanded to more challenging tasks\n* Details on the adversarial attacks are missing\n* Improvements other than those related to robustness are marginal at best and some controls are missing\n* Detailed explanation on the model implementation is missing\n\n\n# Detailed explanation of criticism\n## MNIST and Fashion-MNIST only\nThe authors implement a SoftHebb model for the MNIST and Fashion-MNIST datasets. While these are interesting toy datasets, they are very simple to solve and solutions to them not always generalize to more challenging problems closer to real-world applications. In that sense the authors should do a better job at pointing a direction for future model development. For example, the authors claim that the number of true causes for the data, which in their single-layer implementation translates to number of neurons, can be chosen using common heuristics from cluster analysis. Can the authors indicate what this number would be for the CIFAR-10, TinyImageNet or even ImageNet datasets? How can this framework be adapted for a multilayer network? And can it be used in conjunction with convolutional layers which are a key component of neural networks for visual tasks? If not, wouldn’t it make more sense to demonstrate the use of this framework in a non-visual problem?\n\n## Details on adversarial attacks are missing\nVery interestingly, the SoftHebb model is very robust to both white-box and black-box attacks. While the robustness to Gaussian noise is undisputed (though it would be interesting to evaluate robustness to other types of random noise), the same cannot be said about the PGD adversarial attacks. When claiming improvements in robustness to gradient-based attacks, the burden of proving that the attacks have been properly performed is on the proponents of the defense. Unfortunately, in the current form of the paper, it is impossible to evaluate if the attack has been properly implemented. PGD has multiple hyperparameters, such as the number of the attack steps and the attack step size, that need to be optimized for different models separately. The authors make no reference to the choice of these hyperparameters and whether they tested different combinations to ensure that the attack was optimal. A bare minimum would be to show attack iteration curves for different attack step sizes for an intermediate perturbation strength. Also, it has been shown that the activation function greatly affects adversarial robustness (Xie et al 2021), does the standard MLP use the same activation function of the SoftHebb? It is possible that the improvements in robustness in SoftHebb are due to more trivial causes and do not depend necessarily on the proposed framework. \n\n## Marginal improvements\nThe performance gains of the SoftHebb over the hard WTA model are marginal at best as well as the gains after 1 epoch over the standard backprop model. In the paper, I think a few visualizations are missing. For example, the authors should include the backprop model on Figure 1A and the hard WTA model on Figure 1B,C,D and Figure 2. This way, it gives the impression that the authors are cherry picking the baselines to compare based on the benchmark. While the authors make it clear in the main text that the backprop model outperforms their model in 100 epochs, comparisons between the SoftHebb and the hard WTA model for the remaining benchmarks are missing. How much better is the SoftHebb model over the hard WTA in terms of robustness?\n\n## Improving model explanation\nTheory could be better introduced/contextualized for example by illustrating how the different terms relate to the components of the ANNs. Also, the model description should be expanded either in the main text or supplementary. Diagram of the connectivity, formula for the neurons activation function as implemented in the code, and an algorithmic description of the model training would greatly improve understanding. Also, details on computational times are missing. While the authors focus their analyses on the number of epochs and training examples, it is not clear whether the training times and inference times of the different models is the same or deviate considerably, as well as the memory requirements to train/run each model.\n\n## Minor points\n* The authors point the dependence on feedback by standard ANNs as a criticism. However, there is a high degree of feedback in the brain. I suggest that the authors soften this point.\n", "summary_of_the_paper": "In this paper, the authors develop a theoretical framework to incorporate winner-takes-all (WTA) connectivity with Hebbian-like plasticity which translates into a Bayesian generative model that can be used with generic artificial neural network (ANN) elements. This implementation, which they call SoftHebb, marginally outperforms a competing WTA alternative in digit classification on the MNIST. Furthermore, it also trains marginally faster than a standard backprop multilayer perceptron (MLP), though its performance saturates at a lower accuracy. Finally, the model appears to be substantially more robust than the standard MLP for both black-box and white-box attacks.", "summary_of_the_review": "This study is definitely an interesting take on incorporating biologically-plausible components in an ANN design. However, the proposed model contains several limitations in terms of its expansibility to more challenging problems and some controls are missing to ensure the validity of the main claims, particularly those related to the robustness of the model. For these reasons, I cannot suggest accepting the paper in the current, but am willing to update the score if the authors address my concerns.  ", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "Z0mdmzBmgPu", "reviewer": "Reviewer_4CvS", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "The paper mentions prior work in the same direction, such as (Nessler et al., 2009), but claims that a Bayesian theory for WTA learning has been missing. This claim is not correct.\nThe incomplete discussion of the state-of-the art makes it hard to identify the innovations of this paper.\n\nAlthough the paper states that is aims at biological plausibility, its synaptic plasticity rule (8) is not local: the rule for adapting the weight from neuron i to neuron k requires knowledge of the current weights of all other synapses to the same postsynaptic neuron k (via the term u_k, see (4)).\n\nA nice aspect of this paper is that it includes empirical studies of the noise robustness of the model. But it only compares the robustness of their model with that of MLPs, rather than with other unsupervised learning approaches.\n..................\nSome of these points have been improved in the update.\n\n", "summary_of_the_paper": "The paper wants to provide an optimization theory for WTA networks that it claims to be missing. More precisely they consider soft WTA networks that are implemented as ANNs.They apply their model to MNIST and Fashion-MNIST. In addition some robustness to adversarial attacks is demonstrated.", "summary_of_the_review": "The paper addresses an interesting topic. But it is not clear what its innovations are, and whether it can be implemented with a local learning rule.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "Hhv9cpRLup3", "reviewer": "Reviewer_vMDj", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strengths:\n- The formalization of (a type of) competitive Hebbian learning from an optimization perspective is interesting and useful.\n- The proposed method does seem to perform well.\n- The experimental investigation on the effects of noise and adversarial attacks in the proposed method vs standard gradient-based methods is very nice.\n\nWeaknesses:\n- Evaluation is a bit weak (more below).\n- Evaluation is performed only on two simple datasets, MNIST and Fashion-MNIST.\n- The models evaluated only have 1 or 2 layers, which are extremely simplistic and limited. It is also not clear whether and how well the method would scale when a deep architecture is used.\n", "summary_of_the_paper": "The authors pursue a formalization of WTA networks as optimization. In the paper, they show that WTA networks that compete via soft-max (approximating possibly plausible biological lateral inhibition) and are updated by Hebbian learning are implicitly minimizing the cross-entropy between inputs and layer activation.\n", "summary_of_the_review": "The paper has both valid strengths and weaknesses. The paper could be a clear 'accept' for me if the authors would at least present results with more standard MNIST architectures, like conv+pool layers and/or 3-4+ layers. Additionally, it would be nice to see results of the method at least on CIFAR-10.\n", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "Not applicable"}, "extra_text": {}}, {"review_id": "81zTIfqitqY", "reviewer": "Reviewer_ereX", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "\n* The equivalency between mixture model and WTA has been proposed in a previous work (Moraitis et al. 2020) so the novelty on that end is quite limited.\n\n* There are several other Hebbian and non-Hebbian learning rules that have been used in other works. Will any of them be adoptable in this framework?\n\n* The comparisons are only made with 1 or 2-layer MLP and the accuracy differences are not significant. It is not clear what the advantage of softHebb is. The performance seems to be poor on the F-MNIST dataset. Discussion and experiments on learning with larger/more complex datasets need to be addressed.\n\n* The adversarial robustness results seem promising compared to MLP, but a comparison is need with other adversarial learning/robustness techniques to assess the utility.\n", "summary_of_the_paper": "The work presents an interesting equivalency between a generative probabilistic mixture model and a winner-take-all Hebbian local learning rule-based learning. The approach seems promising, especially the adversarial robustness results compared to a multi-layer perceptron. \n\n**UPDATED SCORE**\nI would like to thank the authors for their revisions and modification based on my feedback. I am changing my score from 5 --> 6 to reflect that. I would also like to mention that there have been works based on Hebbian/Non-Hebbian Learning that outperform backdrop-based  approaches in challenging scenarios such as continual supervised/reinforcement learning. There are other strategies for backprop networks such as implicit formulation (treating NN as a dynamical system) that improves adversarial robustness without adversarial training. Moreover, from a practical usability standpoint, even though SoftHebb is faster, the accuracy still trails the backprop-based networks. \n\n", "summary_of_the_review": "The approach is promising, but is limited in terms of novelty, experiments and the comparison with existing approaches that makes it difficult to assess the true potential of this approach.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}]

Author rebuttal:

Meta-review: The authors provide an analysis of soft-winner-take-all (WTA) networks with Hebbian local learning as a generative probabilistic mixture model. They then present experiments on comparably simple data sets, MNIST and F-MNIST. Results are compared to hard WTA networks and an MLP of the same size (single hidden layer) trained with backprop. Besides accuracy, the learning speed and adversarial robustness of the networks are compared.

This paper is borderline, and I was discussing it quite a bit with the reviewers.
The reviewers agree that the manuscript has some merits, but they also point to a number of weak points.

Besides the objective evaluation, I would like to comment on the review dynamics of this paper. The paper had initially rather low ratings. The authors commented extensively on the reviews, in several waves, and with suggestive text such as "All reviewer's points addressed" (as a comment title) or "Based on the Reviewer's earlier comment, the revised paper is now a clear 'accept'." to name just a few. I and the reviewers had the impression that the authors strongly urged the reviewers to increase their scores.

Due to the borderline ratings, I decided to read the paper carefully. My impression is in-line with the main criticisms of the reviewers, and summarized in the following:
On the positive side:
- The manuscript tackles an interesting problem. WTA architectures are biologically highly relevant structures and it is relevant to study learning in them.
- The authors provide a nice theoretical analysis.
- The observation that WTA architectures improve adversarial robustness is very interesting.
- Learning is local.
- The manuscript is well-written.

On the negative side:
- Theory: Similar analyses have been performed before. While there are differences, the main ideas are rather similar, in particular with respect to (Nessler et al., 2009). The authors argue that in contrast to their work, Nessler et al. 2009 deals with spiking neurons. But since the authors argue with biological plausibility, I would see that as an advantage of Nessler et al.
- Performance: The performance of their model is comparable to the standard hard WTA network, often showing only a very slight advantage. This raises the question why the soft WTA should be preferred over the hard WTA. The performance of the single-hidden-layer ANN is clearly better. This raises the question of the scalability of the approach.
- The analysis of adversarial robustness is interesting, but there is no comparison to other defense methods (e.g. adversarial training). The authors argued in their comments that it is not an adv. defense paper, so this comparison is out of scope. This reasoning is understandable, but since this is maybe the most interesting point of the paper, it would be a nice to have.
- Scalability: It is true that the learning is local, but the question is whether it scales to larger problems and deeper networks. After the first reviews, the authors added experiments on CIFAR-10 and a convolutional version of the model. However, the results were clearly below the state-of-the-art and the convolutional model is barely described (5 lines in the appendix).

Conclusion: The manuscript has some interesting points. Given the the strong competition within ICLR however, I cannot propose acceptance.
Decision: Reject