SlowGuess/NeurIPS_2023_OCR huggingface dataset:
The classic one-octave-wide spatial frequency band has appeared frequently in human psychophysics literature, as the channel for grating detection [1], and letter recognition [2] across various stimulus conditions (alphabets, fonts, sizes, low- and high-pass noise) [3]. It is a surprising result that of all the spatial frequency information available in the stimulus, the visual system would rely on such a narrow band for recognition. However, letters and gratings are largely homogeneous objects, and it is not obvious that those results will generalize well to the recognition of diverse, heterogeneous, noisy objects in the real world. From our critical band masking analyses, we report a surprising result. Humans use the same narrow, one-octave-wide spatial frequency band to recognize objects in natural images that they use for letter and grating recognition, making this channel a canonical feature of human object recognition. In Fig. 4 we show accuracy heatmaps of humans for the various noise conditions averaged across observers (A, left), and a Gaussian channel fit to thresholds from this heatmap (B, black curve). The bandwidth (see 3.4) of the human channel is 1.00 octave, consistent with previous measurements of 1-2 octaves for grating/sinusoid detection [57], and  $1.6 \pm 0.7$  octaves for letter recognition [3].
Figure 4: Results of 14 humans and 76 neural networks on critical band masking task. A. Heatmaps showing  $\%$  correct of humans (averaged across 14 observers given strong cross-observer consistency, see Supplementary Material for individual heatmaps) and ResNet-50, an example network. B. Threshold noise SD for  $50\%$  correct (points; jittered by  $5\%$  of range for visualization) and Gaussian fit i.e. channel, of human (averaged; black curve) and all 76 tested networks (all other colors).
4.2 The neural network channel is 2-4 times as wide as the human channel.
Having seen the same channel in humans across a variety of stimuli and stimulus conditions, a natural next question is: how about neural-network-based object recognition systems? On repeating the same critical band masking experiment and analyses on our set of 76 neural networks (accuracy heatmap for a sample network ResNet-50 shown in Fig. 4A, right), we plot the channel for networks alongside the human one in Fig. 4B. We observe that the network channel, across the various architectures and training procedures used in our set, is  $\approx 2 - 4$  times as wide as the human channel (1.00 octaves), ranging from 2.30 (ViT-B) to 5.98 (resnet50-12-eps1, an adversarially-trained network). In other words, neural networks are susceptible to noise at both high and low spatial frequencies that doesn't affect human performance.
4.3 Channel properties correlate strongly with shape bias, and with robustness of adversarially-trained networks.
We then ask if this stark difference between the spatial frequencies networks and humans use for recognition correlates with two other important and well-documented differences in human and
network behavior - shape bias and adversarial robustness. Humans are well-known to rely primarily on shape cues for object recognition and other visual tasks [10, 7]. Neural networks, on the other hand, show a lot of variance — convolutional networks use texture cues [7, 8], while other architectures such as transformers are shape-biased [9, 58]. Likewise, neural networks are generally strongly sensitive to tiny perturbations to their input that might be imperceptible to humans, called adversarial perturbations [6]. Fig. 5 plots each property of the spatial frequency channel against shape bias and whitebox accuracy (see 3.4 for metric details), along with line-fits (only significant fits with  $p < 0.05 / 18$  (Bonferroni-corrected) shown).
Figure 5: Relationship between network channel properties (center frequency, bandwidth, peak noise sensitivity), shape bias and adversarial robustness. Each figure plots one channel property against either shape bias or adversarial robustness (whitebox accuracy), for all networks represented by colored points. Adversarially-trained networks are represented by blue-colored points and increasing intensity of blue (light to dark) corresponds to increasing L2-adversarial robustness (i.e., stronger adversarial training). 3 regression lines were fit in each figure – to all network points (gray-dotted line), to only adversially-trained networks (blue-dotted line), to all non-adversarially-trained networks (crimson-dotted line) – and only those with  $p < 0.05 / 18$  (Bonferroni-corrected) are shown. In shape bias figures, the black star represents the human average (shape bias value taken from [36]). The three channel properties together explain  $51\%$  of variance in shape bias of all networks, and  $66\%$  of variance in whitebox accuracy across adversially-trained networks.
Networks show a large range of shape bias scores. Although most are clustered around 0.1-0.2 (10-20% of cue-conflict images categorized by shape), a few classes of networks are more strongly shape biased: ViTs (green, violet-red), scaled-up CNNs (BiTs in purple, Noisy Student in dark gray). Channel bandwidth strongly accounts for these differences, single-handedly explaining 29% of the variance, with a slope of  $-0.22 \pm 0.04$ . Networks with a smaller channel bandwidth are more shape biased. This trend is also supported by the human result (black star in middle panel of Fig. 5A). Humans are the most shape biased and have the smallest bandwidth. Center frequency and peak noise sensitivity also account for some of the variance: a linear model with center frequency, bandwidth and peak noise sensitivity accounts for 51% of the cross-network variance in shape bias, which is surprising given that shape is often thought to be a complex feature of objects.
When we look at how well channel properties account for variance in whitebox accuracy (adversarial robustness), we see no such pattern (Fig. 5B). Of the three, only noise sensitivity shows a significant
fit (gray dotted line in rightmost plot in Fig. 5B). However, in these plots, we see some interesting patterns when we separately consider adversarially-trained networks (blue-colored points of any shade) and other networks. Increasing intensity of blue represents the same network architecture (ResNet-50) subjected to increasing amounts of adversarial training to yield a monotonic rise in their measured L2-adversarial robustness ( $\epsilon \in \{0, 0.01, 0.03, 0.05, 0.1, 0.25, 0.5, 1, 3, 5\}$ ; see [51] for details). Since these points clearly differ visually in our plots from other networks, we fit two more lines, one to only adversarially-trained networks (dark blue, dotted), and the other to only the remaining (dark red, dotted). Interestingly, this yields strong fits for bandwidth and peak noise sensitivity cases. For adversarially-trained networks, the three channel properties together account for  $66\%$  of the cross-network variance in whitebox accuracy. Networks with higher bandwidth and higher peak noise-sensitivity are more adversarially robust.
As an aside, we suspect that the bimodal nature of white-box accuracy results is because unlike the case of shape bias, most networks we tested have poor adversarial robustness, and hence lie on the flat portion of its psychometric function, while strongly adversarily-trained networks lie on the steep portion. Therefore, fitting lines to these two groups separately might be akin to fitting two lines to describe a non-linear psychometric function.
4.4 Adversarial training expands the channel further beyond the human bandwidth
Embedded in our correlational results above is an important causal relationship. Given that the adversarially-trained networks we test differ only in terms of the amount of adversarial training (measured using L2-robustness), we can analyze the effect that the amount of adversarial training has on channel properties. Firstly, as shown in Fig. 6, increasing L2-robustness  $(\epsilon)$  corresponds to a monotonic increase in whitebox accuracy and a gradual decrease in ImageNet validation set accuracy. Secondly, we observe that as L2-robustness and whitebox accuracy of adversarially-trained networks increase, their bandwidth increases too, moving away from the human bandwidth. This means that networks that are more robust to adversarial attacks (according to both L2-robustness and whitebox accuracy) are in fact more sensitive to noise added in a larger set of spatial frequency bands that humans are not sensitive to. Thus, adversarial training in effect, makes them more susceptible to another kind of adversarial attack (filtered noise perturbation).
Figure 6: Effect of adversarial training on network channel bandwidth. ImageNet validation set accuracy (black squared-dotted line), whitebox accuracy (black circle-solid line) of adversarially-trained networks with increasing L2-robustness (increasing amount of adversarial training), network channel bandwidth (green circle-solid line), and human bandwidth value (green dotted line). As robustness increases, whitebox accuracy improves at the cost of both ImageNet accuracy and expansion of the network bandwidth further beyond the human bandwidth.
Having shown that neural network spatial-frequency channels diverge from the canonical one-octave-wide channel found in humans, we propose that critical band masking should be added to the toolbox of metrics for model-human comparison. Our dataset of 14 humans and 76 networks on 16-way categorization raises important questions about which spatial frequencies matter for object recognition.
Every one of the 76 networks we tested has a wide critical band. We tested all the networks from Geirhos et al. [36] which is the largest comparison of networks and humans on object recognition. That study included most of the popular network kinds, spanning a wide range of conditions: convolutional networks and transformers, shallow and deep networks, supervised and self-supervised training, standard and adversarially-trained networks. Thus, the conclusions of this paper are based on a representative sample of popular network designs. More work is required to explore the effects of diverse kinds of training data and augmentation.
When comparing biological vision and artificial neural networks, there are two questions to be asked: what can artificial networks learn from biology, and how can neural networks inform our understanding of biology [59, 34]. Needless to say, the origins of deep learning relied heavily on knowledge of biology [30]. But can biology impact the evolution of neural networks? Dapello et al. [35] showed that making the first layer's tuning match biological V1 tuning improves robustness. The critical band idea is central to understanding hearing and vision. Here we show that the critical bands, which are a measure of tuning, are different between humans and networks, and that this difference strongly explains robustness (shape bias and adversarial robustness) of networks. Thus, the results presented here are evidence that narrowing the machine critical band to match that of humans may make neural networks even more robust.
The critical band masking paradigm characterizes the object recognition channel by measuring sensitivity to frequency-filtered noise [4, 2]. Our experiments use this approach to study how spatial frequency selectivity relates to noise robustness, a core topic in machine learning research. Indeed, Geirhos et al. [36] found that adversarial training of networks in the presence of high-frequency noise decreases their overall noise sensitivity. An alternative approach determines what spatial frequencies are used to recognize objects, by filtering the image itself, i.e., removing some frequencies instead of adding filtered noise to mask them [60, 18, 36]. The two approaches yield different results in humans [3], which we will explore in future work.
Li et al. [18] found that adversarially-robust object recognition models rely mainly on low spatial-frequency information in images (also see [15]). Our observations qualitatively agree with their results. Our network channel is indeed centered on a low-frequency band, and adversarial training expands its bandwidth. More work is needed to quantitatively compare the two approaches.
In this paper, we introduce the critical band masking paradigm to study what spatial frequency information humans and neural networks use to recognize objects in natural images. To this end, we use a noise-masked ImageNet object recognition task. First, we find that humans use the same canonical one-octave-wide channel to recognize objects in natural images that they use for letter and grating recognition. Second, the neural network channel is 2-4 times wider than the human channel i.e., network performance is impaired by high and low spatial frequency noise to which humans are immune. Furthermore, properties of the spatial frequency channel correlate strongly with shape bias (explaining  $51\%$  cross-network variance) and robustness of adversarially-trained networks (explaining  $66\%$  variance). Finally, we find that adversarial training increases robustness but further widens the already-too-wide network channel. Overall, critical band masking allows systematic frequency-based analysis of both network and human object recognition performance, revealing important differences in noise sensitivity. The critical band offers a spatial-frequency-based explanation of shape bias and adversarial robustness. Thereby, our paper provides evidence suggesting that efforts to make a network more robust should look for ways to narrow its critical band. While our results are based on a large, representative sample of popular network designs, more work is required to explore the effects of diverse kinds of training data and augmentations. Such experiments would also help determine if the relationship between channel properties and robustness is also causal.
We thank Furkan Özçelik and Ozhan Dehghani for ongoing work, and Eero Simoncelli, James Elder, Maria Pombo, Paul Gavrikov, our five anonymous reviewers, and audience at VSS, COSYNE, and ECVP for helpful comments and suggestions. A.S. additionally thanks Jiaming Xu and Chianna Cohen for being dinner companions during the pre-deadline slog. Our work was funded by grants from the National Eye Institute, National Institutes of Health (R01-EY027964 to D.G.P. and R01-EY031446 to N.J.M.). It was also supported by a National Institutes of Health core vision grant (P30-EY013079). We are also grateful to NYU's High Performance Computing (HPC) cluster for enabling our neural network experiments and analysis.