SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Muhammad A. Shah
mshah1@cmu.edu
Aqsa Kashaf *
San Jose, CA 95110
akashaf@cmu.edu
Bhiksha Raj
bhiksha@cs.cmu.edu
Deep neural networks (DNNs) are known to be vulnerable to adversarial attacks – subtle, perceptually indistinguishable perturbations of inputs that change the response of the model. We hypothesize that an important contributor to the robustness of human visual perception is constant exposure to low-fidelity visual stimuli in our peripheral vision. To investigate this hypothesis, we develop  $R$ -Blur, an image transform that simulates the loss in fidelity of peripheral vision by blurring the image and reducing its color saturation based on the distance from a given fixation point. We show that compared to DNNs trained on the original images, DNNs trained on images transformed by  $R$ -Blur are substantially more robust to adversarial attacks, as well as other, non-adversarial, corruptions, achieving up to  $25\%$  higher accuracy on perturbed data<sup>2</sup>.
Deep Neural Networks (DNNs) are exceptionally adept at many computer vision tasks and have emerged as one of the best models of the biological neurons involved in visual object recognition [1, 2]. However, their lack of robustness to subtle image perturbations that humans are largely invariant [3, 4, 5] to has raised questions about their reliability in real-world scenarios. Of these perturbations, perhaps the most alarming are adversarial attacks, which are specially crafted distortions that can change the response of DNNs when added to their inputs [3, 6] but are either imperceptible to humans or perceptually irrelevant enough to be ignored by them.
While several defenses have been proposed over the years to defend DNNs against adversarial attacks, only a few of them have sought inspiration from biological perception, which, perhaps axiomatically, is one of the most robust perceptual systems in existence. Instead, most methods seek to teach DNNs to be robust to adversarial attacks by exposing them to adversarially perturbed images [7, 8, 9] or random noise [10, 11, 12] during training. While this approach is highly effective in making DNNs robust to the types of perturbations used during training, the robustness often does not generalize to other types of perturbations [13, 14, 15]. In contrast, biologically-inspired defenses seek to make DNNs robust by integrating into them biological mechanisms that would bring their behavior more in line with human/animal vision [16, 17, 18, 19, 20, 21, 22]. As these defenses do not require DNNs to be trained on any particular type of perturbation, they yield models that, like humans, are robust to a variety of perturbations [18] in addition to adversarial attacks. For this reason, and in light of the evidence indicating a positive correlation between biological alignment and adversarial robustness [18, 23], we believe biologically inspired defenses are more promising in the long run.
* work done while at Carnegie Mellon University
2The code for  $R$ -Blur is available at https://github.com/ahmedshah1494/RBlur
(b)
Figure 1:  $R$ -Blur adds Gaussian noise to image (a) with the fixation point (red dot) to obtain (b). It then creates a colored and a grayscaleed copy of the image and applies adaptive Gaussian blurring to them to obtain the low-fidelity images (c) and (d), where the numbers indicate the standard deviation of the Gaussian kernel applied in the region bounded by the boxes. The blurred color and gray images are combined in a pixel-wise weighted combination to obtain the final image (e), where the weights of the colored and gray pixels are a function of their respective estimated acuity values (see 2.2).
Following this line of inquiry, we investigate the contribution of low-fidelity visual sensing that occurs in peripheral vision to the robustness of human/animal vision. Unlike DNNs, which sense visual stimuli at maximum fidelity at every point in their visual field, humans sense most of their visual field in low fidelity, i.e without fine-grained contrast [24] and color information [25]. In adults with fully developed vision, only a small region (less than  $1\%$  by area) of the visual field around the point of fixation [26] can be sensed with high fidelity. In the remainder of the visual field (the periphery), the fidelity of the sensed stimuli decreases exponentially with distance from the fixation point [27]. This phenomenon is called "foveation". Despite this limitation, humans can accurately categorize objects that appear in the visual periphery into high-level classes [28]. Meanwhile, the presence of a small amount of noise or blurring can decimate the accuracy of an otherwise accurate DNN. Therefore, we hypothesize that the experience of viewing the world at multiple levels of fidelity, perhaps even at the same instant, causes human vision to be invariant to low-level features, such as textures, and high-frequency patterns, that can be exploited by adversarial attacks.
In this paper, we propose  $R$ -Blur (short for Retina Blur), which simulates foveation by blurring the image and reducing its color saturation adaptively based on the distance from a given fixation point. This causes regions further away from the fixation point to appear more blurry and less vividly colored than those closer to it. Although adaptive blurring methods have been proposed as computational approximations of foveation [29, 30, 31], their impact on robustness has not been evaluated to the best of our knowledge. Furthermore, color sensitivity is known to decrease in the periphery of the visual field [25, 32, 33], yet most of the existing techniques do not account for this phenomenon.
Similar to how the retina preprocesses the visual stimuli before it reaches the visual cortex, we use  $R$ -Blur to preprocess the input before it reaches the DNN. To measure the impact of  $R$ -Blur, we evaluate the object recognition capability of ResNets [34] trained with and without  $R$ -Blur on three image datasets: CIFAR-10 [35], Ecoset [36] and Imagenet [37], under different levels of adversarial attacks and common image corruptions [38]. We find that  $R$ -Blur models retain most of the high classification accuracy of the base ResNet while being more robust. Compared to the base ResNet,  $R$ -Blur models achieve 12-25 percentage points (pp) higher accuracy on perturbed images. Furthermore, the robustness achieved by  $R$ -Blur is certifiable using the approach from [10]. We also compare  $R$ -Blur with two biologically inspired preprocessing defenses, namely VOneBlock [18], a fixed parameter module that simulates the primate V1, and a non-uniform sampling-based foveation technique [22], which we refer to as  $R$ -Warp. We observe that  $R$ -Blur induces a higher level of robustness, achieving accuracy up to 33 pp higher than  $R$ -Warp and up to 15 pp higher than VOneBlock against adversarial attacks. Compared to adversarial training (AT) [7, 8] - the state-of-the-art non-biological defense,  $R$ -Blur achieves up to 7 pp higher accuracy on average against non-adversarial corruptions of various types and strengths thus indicating that the robustness of  $R$ -Blur generalizes better to non-adversarial perturbations than AT. Finally, an ablation study showed that both adaptive blurring and desaturation contribute to the improved robustness of  $R$ -Blur.
2 Retinal Blur: An Approximation for Peripheral Vision
To simulate the loss in contrast and color sensitivity of human perception with increasing eccentricity, we propose  $R$ -Blur, an adaptive Gaussian blurring, and color desaturation technique. The operations
performed by  $R$ -Blur, given an image and fixation point, are shown in Figure 1. First,  $R$ -Blur adds Gaussian noise to the image to simulate stochastic firing rates of biological photoreceptors [39]. It then creates color and grayscale copies of the image and estimates the acuity of color and grayscale vision at each pixel location, using distributions that approximate the relationship between distance from the fixation point (eccentricity) and visual acuity levels in humans.  $R$ -Blur then applies adaptive Gaussian blurring to both image copies such that the standard deviation of the Gaussian kernel at each pixel in the color and the grayscale image is a function of the estimated color and grayscale acuity at that pixel. Finally,  $R$ -Blur combines the two blurred images in a pixel-wise weighted combination in which the weights of the colored and gray pixels are a function of their respective estimated acuity values. Below we describe some of the more involved operations in detail.
2.1 Eccentricity Computation
The distance of a pixel location from the fixation point, i.e. its eccentricity, determines the standard deviation of the Gaussian kernel applied to it and the combination weight of the color and gray images at this location. While eccentricity is typically measured radially, in this paper we use a different distance metric that produces un-rotated square level sets. This property allows us to efficiently extract regions having the same eccentricity by simply slicing the image tensor. Concretely, we compute the eccentricity of the pixel at location  $(x_p, y_p)$  as
$$
e _ {x _ {p}, y _ {p}} = \frac {\operatorname* {m a x} \left(\left| x _ {p} - x _ {f} \right| , \left| y _ {p} - y _ {f} \right|\right)}{W _ {V}}, \tag {1}
$$
where  $(x_{f},y_{f})$  and  $W_{V}$  represent the fixation point and the width of the visual field, i.e. the rectangular region over which  $R$ -Blur operates and defines the maximum image size that is expected by  $R$ -Blur. We normalize by  $W_{V}$  to make the  $e_{x_p,y_p}$  invariant to the size of the visual field.
2.2 Visual Acuity Estimation
We compute the visual acuity at each pixel location based on its eccentricity. The biological retina contains two types of photoreceptors. The first type, called cones, are color sensitive and give rise to high-fidelity visual perception at the fovea, while the second type, called rods, are sensitive to only illumination but not color and give rise to low-fidelity vision in the periphery. We devise the following two sampling distributions,  $D_{R}(e_{x,y})$  and  $D_{C}(e_{x,y})$ , to model the acuity of color and grayscale vision, arising from the cones and rods at each pixel location,  $(x,y)$ .
$$
\mathcal {D} (e; \sigma , \alpha) = \max  [ \lambda (e; 0, \sigma), \gamma (e; 0, \alpha \sigma) ] \tag {2}
$$
$$
D _ {C} (e; \sigma_ {C}, \alpha) = \mathcal {D} (e; \sigma_ {C}, \alpha) \tag {3}
$$
$$
D _ {R} (e; \sigma_ {R}, \alpha , p _ {\max }) = p _ {\max } \left(1 - \mathcal {D} (e; \sigma_ {R}, \alpha)\right), \tag {4}
$$
where  $\lambda (.;\mu ,\sigma)$  and  $\gamma (.;\mu ,\sigma)$  are the PDFs of the Laplace and Cauchy distribution with location and scale parameters  $\mu$  and  $\sigma$ , and  $\alpha$  is a parameter used to control the width of the distribution. We set  $\sigma_{C} = 0.12,\sigma_{R} = 0.09,\alpha = 2.5$  and  $p_{max} = 0.12$ . We choose the above equations and their parameters to approximate the curves of photopic and scotopic visual acuity from [27]. The resulting acuity estimates are shown in Figure 2b. Unfortunately, the measured photopic and scotopic acuity curves from [27] cannot be reproduced here due to copyright reasons, however, they can be viewed at https://nba.eth.tmc.edu/neuroscience/m/s2/chapter14.html (see Figure 14.3).
2.3 Quantizing the Visual Acuity Estimate
In the form stated above, we would need to create and apply as many Gaussian kernels as the distance between the fixation point and the farthest vertex of the visual field. This number can be quite large as the size of the image increases and will drastically increase the per-image computation time. To mitigate this issue we quantize the estimated acuity values. As a result, the locations to which the same kernel is applied no longer constitute a single pixel perimeter but become a much wider region (see Figure 1 (c) and (d)), which allows us to apply the Gaussian kernel in these regions very efficiently using optimized implementations of the convolution operator.
To create a quantized eccentricity-acuity mapping, we do the following. We first list all the color and gray acuity values possible in the visual field by assuming a fixation point at  $(0,0)$ , computing eccentricity values  $e_{0,y}$  for  $y\in [0,W_V]$  and the corresponding values of  $\mathcal{D}_R = \{D_R(e_{0,y})|y\in$
Figure 2: Estimated visual acuity of sharp and colorful, photopic, and gray and blurry, scotopic, vision using equations 3 and 4
Figure 3: Illustration of increasing the viewing distance (left to right). As the viewing distance is increased, more of the image is brought into focus. We used  $vd = 3$  during inference.
$[0, W_V]\}$  and  $\mathcal{D}_C = \{D_C(e_{0,y})|y \in [0, W_V]\}$ . We then compute and store the histograms,  $H_R$  and  $H_C$ , from  $\mathcal{D}_R$  and  $\mathcal{D}_C$ , respectively. To further reduce the number of kernels we need to apply and increase the size of the region each of them is applied to, we merge the bins containing less than  $\tau$  elements in each histogram with the adjacent bin to their left. After that, given an image to process, we will compute the color and gray visual acuity for each pixel, determine in which bin it falls in  $H_R$  and  $H_C$ , and assign it the average value of that bin.
2.4 Changing the Viewing Distance
Increasing the viewing distance can be beneficial as it allows the viewer to gather a more global view of the visual scene and facilitates object recognition. To increase the viewing distance we drop the  $k$  lowest acuity bins and shift the pixels assigned to them  $k$  bins ahead such that the pixels that were in bins 1 through  $k - 1$  are now assigned to bin 1. Figure 3 shows the change in the viewing distance as the value of  $k$  increases from 0 to 5. Formally, given the quantized  $D_{C}(e_{x,y})$  and  $D_{R}(e_{x,y})$ , let  $D = [d_1,\dots,d_n]$  represent the value assigned to each bin and  $P_{i}$  be the pixel locations assigned to the  $i^{th}$  bin, with  $P_{1}$  and  $P_{n}$  corresponding to points with the lowest and highest eccentricity, respectively. To increase the viewing distance, we merge bins 1 through  $k$  such that  $D^{\prime} = [d_{1},\dots,d_{n - k}]$  and the corresponding pixels are  $P_1' = [P_1,\dots,P_k]$  and  $P_{i > 1} = P_{k + 1}$ .
2.5 Blurring and Color Desaturation
We map the estimated visual acuity at each pixel location,  $(x_{p},y_{p})$ , to the standard deviation of the Gaussian kernel that will be applied at that location as  $\sigma_{(x_p,y_p)} = \beta W_V(1 - D(e_{x,y}))$ , where  $\beta$  is constant to control the standard deviation and is set to  $\beta = 0.05$  in this paper, and  $D = D_C$  for pixels in the colored image and  $D = D_R$  for pixels in the grayscale image. We then apply Gaussian kernels of the corresponding standard deviation to each pixel in the colored and grayscale image to obtain an adaptively blurred copy of each, which we combine in a pixel-wise weighted combination to obtain the final image. The weight of each colored and gray pixel is given by the normalized color and gray acuity, respectively, at that pixel. Formally, the pixel at  $(x_{p},y_{p})$  in the final image has value
$$
v _ {\left(x _ {p}, y _ {p}\right)} ^ {f} = \frac {v _ {\left(x _ {p} , y _ {p}\right)} ^ {c} D _ {C} \left(e _ {x , y} ; \sigma_ {C} , \alpha\right) + v _ {\left(x _ {p} , y _ {p}\right)} ^ {g} D _ {R} \left(e _ {x , y}; \sigma_ {C} , \alpha\right)}{D _ {C} \left(e _ {x , y}; \sigma_ {C} , \alpha\right) + D _ {R} \left(e _ {x , y}; \sigma_ {C} , \alpha\right)}, \tag {5}
$$
$v_{(x_p,y_p)}^c$  and  $v_{(x_p,y_p)}^g$  are the pixel value at  $(x_p,y_p)$  in the blurred color and gray images respectively.
In this section, we determine the accuracy and robustness of  $R$ -Blur by evaluating it on clean data and data that has been perturbed by either adversarial attacks or common – non-adversarial – corruptions. We compare the performance of  $R$ -Blur with an unmodified ResNet, two existing biologically-inspired defenses,  $R$ -Warp [22] and VOneBlock [18], and a non-biological adversarial defenses: Adversarial Training (AT) [7]. We show that  $R$ -Blur is significantly more robust to adversarial attacks and common corruptions than the unmodified ResNet and prior biologically inspired methods. Moreover, we use Randomize Smoothing [10] to show that  $R$ -Blur is provably robust. While AT is more robust
(a)  $R$ -Blur
(b)  $R$ -Warp
Figure 4: Illustration of fixation selection. The initial fixation point is set to top-left  $(0,0)$  and the image at  $t_0$  is processed with  $R$ -Blur/R-Warp to get the image at  $t_1$ . DeepGaze-III is used to generate a fixation heatmap from this image. The next fixation point is sampled from the heat map, and  $R$ -Blur/R-Warp is applied to get the image at  $t_2$ . The region in the heatmap around the chosen fixation point is masked with an inverted Gaussian kernel to prevent spatial clustering of fixation points. This process is repeated to get a sequence of fixation points.
than  $R$ -Blur against adversarial attacks,  $R$ -Blur is more robust than  $AT$  against common corruptions, thus indicating that the robustness of  $R$ -Blur generalizes better to different types of perturbation than  $AT$ . We also analyze the contribution of the various components of  $R$ -Blur in improving robustness.
Datasets: We use natural image datasets, namely CIFAR-10 [35], Imagenet ILSVRC 2012 [37], Ecoset [36] and a 10-class subset of Ecoset (Ecoset-10). Ecoset contains around 1.4M images, mostly obtained from ImageNet database [40] (not the ILSVRC dataset), that are organized into 565 basic object classes. The classes in Ecoset correspond to commonly used nouns that refer to concrete objects. To create Ecoset-10, we select 10 classes from Ecoset that have the highest number of images. The training/validation/test splits of Ecoset-10 and Ecoset are 48K/859/1K, and 1.4M/28K/28K respectively. For most experiments with Ecoset and Imagenet, we use 1130, and 2000 test images, with an equal number of images per class. During training, we use random horizontal flipping and padding + random cropping, as well as AutoAugment [41] for CIFAR-10 and RandAugment for Ecoset and Imagenet. All Ecoset and Imagenet images were resized and cropped to  $224 \times 224$ . We applied these augmentations to all the models we trained - those with biological and non-biological defenses, as well as the baseline models.
Model Architectures: For CIFAR-10 we use a Wide-Resnet [42] model with 22 convolutional layers and a widening factor of 4, and for Ecoset and Imagenet we use XResNet-18 from fastai [43] with a widening factor of 2. Moving forward, we will refer to both these models as ResNet and indicate only the training/evaluation datasets from which the exact architecture may be inferred. Results for additional architectures are presented in Appendix C.
Baselines and Existing Methods: We compare the performance of  $R$ -Blur to two baselines: (1) an unmodified ResNet trained on clean data (ResNet), and (2) a ResNet which applies five affine transformations  $^3$  to the input image and averages the logits (RandAffine). We also compare  $R$ -Blur with two biologically inspired defenses: VOneBlock pre-processing proposed in [18], which simulates the receptive fields and activations of the primate  $\mathrm{V}1^4$ , and  $R$ -Warp preprocessing proposed in [22], which simulates foveation by resampling input images such that the sampling density of pixels is maximal at the point of fixation and decays progressively in regions further away from it. Finally, we compare  $R$ -Blur with two non-biological adversarial defenses: fast adversarial training [8] with  $\| \delta \|_{\infty} = 0.008(AT)$ , and Randomized Smoothing (RS) [10].
Fixation Selection for  $R$ -Blur and  $R$ -Warp: While training models with  $R$ -Blur and  $R$ -Warp, we split each batch into sub-batches of 32 images, and for each sub-batch, we randomly sample a single fixation point that we use to apply  $R$ -Blur or  $R$ -Warp to all the images in that sub-batch. While training the  $R$ -Blur model, we also set the viewing distance uniformly at random using the procedure
<sup>3</sup>We apply rotation, translation, and shearing, with their parameters sampled from  $[-8.6^{\circ}, 8.6^{\circ}]$ ,  $[-49, 49]$  and  $[-8.6^{\circ}, 8.6^{\circ}]$  respectively. The ranges are chosen to match the ranges used in RandAugment. The random seed is fixed during evaluation to prevent interference with adversarial attack generation.
As in [18], we remove the first conv, batch norm, ReLU, and MaxPool from the ResNet with VOneBlock.
(b) Ecoset-10
(c) Ecoset
Figure 5: Comparison of accuracy on various datasets (a-d) under adversarial attacks of several  $\ell_2$  (top) and  $\ell_{\infty}$  (bottom) norms between  $R$ -Blur (green) and two baseline methods: RandAffine (orange) and ResNet (blue). The dashed lines indicate accuracy on clean images.  $R$ -Blur models consistently achieve higher accuracy than baseline methods on all datasets, and adversarial perturbation sizes.
(d) Imagenet
described in 2.4. During inference, we determine a sequence of five fixation points (a scanpath) using DeepGaze-III [44]. DeepGaze-III passes the input image through a pretrained CNN backbone (DenseNet-201 in [44]) and extracts the activations from several intermediate layers of the CNN. It then applies a sequence of pointwise convolution and normalization layers to the activations to obtain a heatmap indicating where a human is likely to fixate. We found that it was more efficient to not use the scanpath prediction module in DeepGaze-III, and instead obtain scanpaths by keeping track of the past fixation points, and masking the predicted heatmap at these locations prior to sampling the next fixation point from it. This process is illustrated in Figure 4.
We trained two instances of DeepGaze-III using the ResNets we trained with  $R$ -Blur and  $R$ -Warp as the CNN backbone. We use the corresponding DeepGaze-III models to predict the scanpaths for  $R$ -Blur and  $R$ -Warp models. To train deepgaze-iii we used the code from the official github repository [41]. The only significant modification we made was to replace the pretrained DenseNet-201 with the pretrained R-Warp/R-Blur augmented XResNet-18 we trained on ImageNet. This improves performance, while keeping the total number of parameters low. Following [41] we train DeepGaze on the SALICON dataset [45]. This corresponds to phase 1 of training mentioned in Table 1 of [41]. We did not notice any benefits in our use case of phases 2-4, so we skipped them.
$R$ -Blur improves robustness to white-box attacks. We evaluate robustness by measuring the accuracy of models under Auto-PGD (APGD)[46] attack, which is a state-of-the-art white-box adversarial attack. We run APGD for 25 steps on each image. We find that increasing the number of steps beyond 25 only minimally reduces accuracy (Appendix A). We take a number of measures to avoid the pitfalls of gradient obfuscation [47, 48] so that our results reflect the true robustness of  $R$ -Blur. These steps and detailed settings used for adversarial attacks are mentioned in Appendix A.