SlowGuess/NeurIPS_2023_OCR huggingface dataset:
To determine if  $R$ -Blur improves robustness, we compare  $R$ -Blur with the unmodified ResNet and RandAffine under the APGD attack. We observe that  $R$ -Blur is significantly more robust than the unmodified ResNet and RandAffine models, consistently achieving higher accuracy than the two on all datasets and against all perturbation types and sizes, while largely retaining accuracy on clean data (Figure 5). While RandAffine does induce some level of robustness, it significantly underperforms  $R$ -Blur. On smaller datasets,  $R$ -Blur suffers relatively little loss in accuracy at small to moderate levels ( $\| \delta \|_{\infty} \leq 0.004$ ,  $\| \delta \|_2 \leq 1$ ) of adversarial perturbations, while the accuracy of baseline methods quickly deteriorates to chance or worse. On larger datasets - Ecoset and Imagenet, even the smallest amount of adversarial perturbation ( $\| \delta \|_{\infty} = 0.002$ ,  $\| \delta \|_2 = 0.5$ ) is enough to drive the accuracy of the baselines to  $\sim 10\%$ , while  $R$ -Blur still is able to achieve  $35 - 44\%$  accuracy. As the perturbation is increased to  $\| \delta \|_{\infty} = 0.004$  and  $\| \delta \|_2 = 1.0$ , the accuracy of the baselines goes to  $0\%$ , while  $R$ -Blur achieves  $18 - 22\%$ . We do observe that the accuracy of  $R$ -Blur on clean data from Ecoset and Imagenet is noticeably lower than that of the baseline methods.
We also compare  $R$ -Blur to two existing biologically motivated adversarial defenses: VOneBlock and  $R$ -Warp, and find that  $R$ -Blur achieves higher accuracy than both of them at all perturbation sizes and
(a) Ecoset
Figure 6: The difference in accuracy under adversarial attacks of several  $\ell_2$  and  $\ell_{\infty}$  norms between R-Blur and two biologically inspired defenses: R-Warp (blue) and VOneBlock (orange). R-Blur consistently achieves higher accuracy on all adversarial perturbation sizes than R-Warp and VOneBlock.
(a) Matched Setting  $(\sigma_{t} = \sigma_{c} = 0.125)$
Figure 7: The certified accuracy at various  $\ell_2$ -norm radii of  $R$ -Blur and  $G$ -Noise models.  $R$ -Blur-CFI uses 1 fixation at the center of the image, and  $R$ -Blur-5FI, averages logits from 5 fixation (corners + center).  $\sigma_t$  denotes the scale of noise added during training and is 0.125 unless specified, whereas  $\sigma_c$  is the scale of the noise used to compute the certified accuracy.  $G$ -Noise outperforms  $R$ -Blur in the matched scenario, while  $R$ -Blur is superior in the unmatched scenario indicating that the robustness of  $R$ -Blur is more generalizable.
(b) Unmatched Setting  $(\sigma_{t} < \sigma_{c} = 0.25)$
types. From Figure 6 we see that  $R$ -Blur achieves up to 33pp higher accuracy than  $R$ -Warp, and up to 15 pp higher accuracy than VOneBlock on adversarially perturbed data.
$R$ -Blur is certifiably robust. To verify that the gains in robustness observed above are indeed reliable, we use the certification method (CERTIFY) from [10] to provide formal robustness guarantees for  $R$ -Blur. This entails obtaining predictions for an input under a very large number  $(10^{5})$  of noise samples drawn from  $\mathcal{N}(0,\sigma_c)$ , and using a hypothesis test to determine the certified radius around the input in which the model's prediction is stable with high probability  $(\geq 99.9\%)$ . Given a dataset, we can compute the certified accuracy at a radius  $r$  as the proportion of data points for which the certified radius is  $\geq r$  and the model's prediction is correct. It was shown in [10] that a model trained on data perturbed with Gaussian noise achieves high certified accuracy. We call this model  $G$ -Noise. We compare the certified accuracy of  $G$ -Noise and  $R$ -Blur on 200 images from Imagenet and Ecoset.
We expose both  $R$ -Blur and  $G$ -Noise to Gaussian noise of scale  $\sigma_t = 0.125$  during training and compute their certified accuracy at radii  $r \in \{0.5, 1.0\}$ . According to [10], if the scale of the noise used in CERTIFY is  $\sigma_c$ , then the maximum radius for which certified accuracy can be computed (with  $10^5$  noise samples) is  $r = 4\sigma_c$ . Therefore, when computing certified accuracy at  $r \leq 0.5$  CERTIFY adds noise of the same scale as was used during training ( $\sigma_c = 0.125 = \sigma_t$ ), thus we call this the matched setting. However, to compute certified accuracy at  $r \leq 1.0$  CERTIFY adds noise of a larger scale than was used during training ( $\sigma_c = 0.25 > \sigma_t$ ), and thus in order to achieve high certified accuracy at  $r \leq 1.0$  the model must be able to generalize to a change in noise distribution. We call this the unmatched setting.
Figure 7a and 7b show the certified accuracy of  $R$ -Blur and the  $G$ -Noise on Ecoset and Imagenet at several  $\ell_2$  norm radii under matched and unmatched settings. In both settings, we see that  $R$ -Blur achieves a high certified accuracy on both Ecoset and Imagenet, with the certified accuracy at  $r \approx 0.5$  and  $r \approx 1.0$  being close to the ones observed in Figure 5, indicating that our earlier results are a faithful representation of  $R$ -Blur's robustness. Furthermore, we see that even if  $R$ -Blur was trained without any noise, it can still achieve more than  $50\%$  of the certified accuracy achieved by  $R$ -Blur trained with noise. This indicates that adaptive blurring and desaturation do in fact endow the model with a significant level of robustness. Finally, we note that while  $G$ -Noise has (slightly) higher certified accuracy than  $R$ -Blur in the matched setting,  $R$ -Blur achieves significantly higher certified accuracy in the unmatched setting, outstripping  $G$ -Noise by more than  $10~\mathrm{pp}$  at  $r \approx 1.0$  on Imagenet. This shows that the robustness of  $R$ -Blur generalizes beyond the training conditions, while  $G$ -Noise
(a) Imagenet
(b) Ecoset
Figure 8: The accuracy of the models on Imagenet and Ecoset under the common corruptions from [38] at various severity levels. We see that  $R$ -Blur generally achieves the highest accuracy.
Method	Mean	CC	WB	Clean	Mean	CC	Wb	Clean
Ecoset	Imagenet
ResNet	37.1	39.4	0.8	71.2	34.7	33.6	0.1	70.3
RandAffine	35.7	35.8	3.6	67.6	33.7	30.8	2.0	68.3
AT	49.0	38.5	47.5	61.1	46.3	34.2	43.5	61.3
R-Warp	38.5	40.0	4.5	71.1	34.1	32.5	2.2	67.7
VOneBlock	42.9	40.7	16.1	72.0	38.8	35.8	11.9	68.7
R-Blur	44.2	45.6	23.8	63.3	38.9	39.0	17.2	60.5
best, second best
Table 1: Accuracy of the evaluated models on clean, and perturbed data from Imagenet. “WB” refers to the accuracy under APGD attacks, while “CC” refers to the accuracy under common nonadversarial corruption [38]. R-Blur significantly improves the robustness of ResNet, and outperforms prior biologically motivated defenses, while approaching the performance of  $AT$ .
overfits to them. This makes  $R$ -Blur particularly suited for settings in which the exact adversarial attack budget is not known, and the model must be able to generalize.
R-Blur Improves accuracy on common (non-adversarial) corruptions. Adversarial perturbations constitute only a small subset of perturbations that human vision is invariant to, therefore we evaluate R-Blur on a set of common image corruptions [38] that humans are largely invariant to but DNNs are not. We sample 2 images/class from Imagenet and 5 images/class from Ecoset. Then we apply  $17^5$  common corruptions proposed in [38] at 5 different severity levels to generate 85 corrupted versions of each image. This yields corrupted versions of Imagenet and Ecoset containing 170K and 240K images, respectively.
Figure 8 shows the accuracy of the models on corrupted Ecoset and Imagenet. Here we also compare against an adversarially trained model (AT) trained with  $\| \delta \|_{\infty} = 0.008$  using the method of [8]. We see that at severity greater than  $1R$ -Blur consistently achieves the highest accuracy. Furthermore, we also note that  $R$ -Blur, and VOneBlock consistently achieve higher accuracy than  $AT$ , which supports our hypothesis that the robustness of biologically motivated methods, and particularly  $R$ -Blur, is more general than non-biological defenses, like  $AT$ . In fact, the accuracy of  $AT$  on common corruptions is generally lesser than or at par with the accuracy of the unmodified ResNet, indicating that the robustness of  $AT$  does not generalize well.
Summary of Results: Table 1 summarizes the results of our paper and reiterates two key observations from earlier sections. Firstly,  $R$ -Blur makes models more significantly robust to adversarial perturbations than the unmodified ResNet, and other biologically inspired defenses.  $R$ -Blur, however, achieves lower accuracy against white-box attacks than  $AT$ . This is to be expected because  $AT$  is trained on adversariably perturbed data. Secondly,  $R$ -Blur augmented models are significantly more robust to common corruptions than all other models, including  $AT$ . In contrast, the accuracy of  $AT$  on common corruptions is almost the same as that of the unmodified ResNet, indicating that the robustness of  $AT$  does not generalize.
We exclude Gaussian blur and Gaussian noise since they are similar to the transformations done by  $R$ -Blur.
Figure 9: Accuracy on clean and APGD  $(\| \delta \|_{\infty} = 0.008)$  perturbed Ecoset-10 images when individual components of  $R$  -Blur are removed (left), and when non-adaptive transforms are used (right). Removing the biologically-motivated components of  $R$  -Blur harms the robustness
Figure 10: Comparison of  $R$ -Blur with models trained with non-adaptive Gaussian blur or Gaussian noise augmentations. (a) compares the accuracy under adversarial attack on Ecoset-10 of  $R$ -Blur and models augmented with non-adaptive Gaussian blur of various standard deviations ( $\sigma$ ). While non-adaptive Gaussian blur does increase robustness, the adaptive blurring in  $R$ -Blur outperforms it by a margin. (b) compares the accuracy under adversarial attack onImagenet of  $R$ -Blur and models augmented with either non-adaptive Gaussian blur or Gaussian noise. We see that  $R$ -Blur achieves better robustness than either of these methods.
We examine, by way of ablation, how much each component of  $R$ - $Blur$  contributes towards its overall robustness as shown in Figure 9. The most significant contributor to robustness is the addition of noise. This echoes the findings from [18], which showed that neural stochasticity contributes significantly to the robustness of the visual system. Nevertheless, even without noise  $R$ - $Blur$  achieves an 11 point improvement over the vanilla ResNet which archives  $0\%$  accuracy under the attack, which indicates that other components of  $R$ - $Blur$  also contribute towards robustness. Furthermore, experimental results reveal that robustness induced by noise diminishes as the complexity of the dataset increases and the size of the perturbations increases. As observed in Figure 10b, Gaussian noise augmentation achieves  $45 - 58\%$  (8-10 points) lower accuracy than  $R$ - $Blur$ , and in Figure 7b, which shows that at larger perturbation sizes  $R$ - $Blur$  achieves higher certified accuracy.
The second most significant contributor to robustness is the blurring performed by  $R$ -Blur. Importantly, we note that Gaussian blurring in and of itself does not greatly improve robustness. Figure 9 shows that non-adaptive blurring with a single Gaussian kernel having  $\sigma = 10.5$  ( $\sigma = 10.9$  is the maximum used in  $R$ -Blur) improves robustness by only 5 points. Furthermore, Figure 10a shows that increasing the strength of non-adaptive blurring trades off clean accuracy for robustness. However, after  $\sigma = 8$  the gains in robustness hit (a rather low) ceiling, and increasing  $\sigma$  further reduces both clean accuracy and robustness. On the other hand,  $R$ -Blur, without any additive noise, achieves similar clean accuracy as non-adaptive blurring ( $\sigma = 10.5$ ) but achieves significantly better adversarial robustness, thereby demonstrating that Gaussian blurring alone accounts for only a fraction of  $R$ -Blur's robustness. Furthermore, Figure 10b shows that the contribution of non-adaptive blurring declines on the more complex Imagenet, where it achieves only  $1\%$  accuracy on moderate-sized perturbations.
The next most significant factor, after noise and adaptive blurring, is evaluating multiple fixation points which improved robustness significantly compared to a single fixation point in the center of the image, which suggests that, multiple fixations and saccades are important when the image is hard to recognize and presents a promising direction for future work. Furthermore, not adaptively desaturing the colors reduces the robustness slightly. Finally, we note that dynamic fixation does not improve performance compared to 5 predefined fixation points. To summarize, most of the biologically-motivated components of  $R$ -Blur contribute towards improving the adversarial robustness of object recognition DNNs from close to  $0\%$  to  $45\%$  ( $\ell_{\infty} = 0.008$  for Ecoset-10).
Non-biological defenses: Perhaps the most successful class of adversarial defenses are adversarial training algorithms [7, 9, 49, 17, 8], which train models on adversially perturbed data generated by backpropagating gradients from the loss to the input during each training step. Another popular class of defenses is certified defenses [10, 11, 50, 51] which are accompanied by provable guarantees of the form: with probability  $1 - \delta$ , the model's output will not change if a given image is perturbed at most  $\epsilon$ . Perhaps, most closely related to our work are preprocessing defenses [52, 53] that apply a large number of transforms to the input during inference. Usually, these defenses rely on non-differentiable transformations, and a high degree of randomization in the number, sequence, and parameters of the transforms they apply to each image. Therefore, these defenses tend to obfuscate gradients [47], and have been shown to be compromised by attacks with a higher step budget. We would like to point out that R-Blur does not have these aforementioned pitfalls – the transforms that R-Blur applies (Gaussian blur and desaturation) are fully differentiable and totally deterministic. In general, it is our opinion that by not being cognizant of the biological basis of robust vision, current approaches are excluding a large set of potentially effective approaches for defending against adversarial attacks.
Biologically inspired defenses: Several biological defenses have been proposed over the years. These defenses involve integrating computational analogues of biological processes that are absent from common DNNs, such as predictive/sparse coding [16, 17], biologically constrained visual filters, nonlinearities, and stochasticity [18], foveation [19, 20, 21, 22], into DNNs. The resulting models are made more robust to adversarially perturbed data, and have been shown to better approximate the responses of biological neurons [18].
Most relevant to our work are defenses that have integrated foveation with DNNs. One of the earliest works [20] implements foveation by cropping the salient region of the image at inference time. This work has several shortcomings. Firstly, the biological plausibility of this method is questionable because it does not simulate the degradation of visual acuity in the periphery of the visual field, rather it discards the periphery entirely. Secondly, it crops the image after applying the adversarial attack, which means that the attack does not take into account the cropping, which is akin to obfuscating the gradients, and hence any reported improvements in robustness are suspect. A later work [22] (R-Warp) avoids the aforementioned pitfalls and simulates foveation via non-uniform sampling (regions further away from the fixation points are sampled less densely). Since this method is fully differentiable and highly biologically plausible, we compare against it in this paper. Some recent works [19, 21] apply foveation in the latent feature space (the intermediate feature maps generated by a CNN). These works implement foveation by changing the receptive field sizes of the convolutional kernels based on the distance to the fixation. Since they operate on the latent feature space, rather than image pixels, their methods not directly comparable to ours.
Adding  $R$ -Blur reduces accuracy on clean data, however, it is possible to significantly improve the accuracy of  $R$ -Blur by developing better methods for selecting the fixation point. Further experimental results presented in Appendix B show that if the optimal fixation point was chosen by an oracle the clean accuracy of  $R$ -Blur can be improved to within 2% of the accuracy of the unmodified ResNet.
Since the existence of adversarial attacks presents a divergence between DNNs and humans, we ask if some aspect of human vision is fundamental to its robustness that is not modeled by DNNs. To this end, we propose  $R$ -Blur, a foveation technique that blurs the input image and reduces its color saturation adaptively based on the distance from a given fixation point. We evaluate  $R$ -Blur and other baseline models against APGD attacks on two datasets containing real-world images.  $R$ -Blur outperforms other biologically inspired defenses. Furthermore,  $R$ -Blur also significantly improves robustness to common, non-adversarial corruptions and achieves accuracy greater than that of adversarial training. The robustness achieved by  $R$ -Blur is certifiable using the approach from [10] and the certified accuracy achieved by  $R$ -Blur is at par or better than that achieved by randomized smoothing [10]. Our work provides further evidence that biologically inspired techniques can improve the accuracy and robustness of AI models.
[56] Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv:2010.11929, 2020.
(b)
Figure 11: Accuracy of a  $R$ -Blur model trained on Imagenet under APGD attack with different settings. (a) shows the accuracy when APGD attack is applied with different numbers of update steps. (b) shows the accuracy when 10 step of expectation-over-transformation (EOT-10) [54] is used and  $R$ -Blur is converted into a straight-through-estimator (STE) in the backward pass. The dashed line in (b) shows the accuracy of a 25-step APGD attack without EOT and normal gradient computation for  $R$ -Blur. Together these results strongly indicate that  $R$ -Blur does not obfuscate gradients and legitimately improves the adversarial robustness of the model.
A Preventing Gradient Obfuscation
We take a number of measures to ensure that our results correspond to the true robustness of our method, and we avoid the pitfalls of gradient obfuscation [47, 48].
Firstly, we remove inference time stochasticity from all the models we test. We do this by sampling the Gaussian noise used in  $R$ -Blur and VOneBlock once and applying the same noise to all test images. Similarly, we sample the affine transform parameters for RandAffine once and use them for all test images. We also compute the fixation point sequences for  $R$ -Blur and  $R$ -Warp on unattacked images and do not update them during or after running APGD.
Secondly, we ran APGD for 1 to 100 iterations and observed that as the number of iterations increases the success rate of the attack increases (Figure 11a). The success rate plateaus at 50 iterations. Since the attack success rate with 25 steps is only  $0.1\%$  lower than the success rate with 50 steps, we run APGD with 25 steps in most of our experiments.
Thirdly, we evaluate  $R$ -Blur against AutoAttack [46], an ensemble of 4 state-of-the-art white and black box adversarial attacks. Figure 12 compares the accuracy of  $R$ -Blur on Imagenet under APGD and AutoAttack. We see that the accuracy under AutoAttack is only slightly lower than the accuracy under APGD, with the maximum difference being  $3\%$ , which would not change any of the trends observed in the paper. Since computing AutoAttack requires a lot of time and compute, and given that it does not decrease accuracy significantly compared to 25-step APGD, we chose to use the latter for most of the results presented in the paper.
Finally, we applied expectation over transformation [54] by computing 10 gradient samples at each APGD iteration and averaging them to obtain the final update. We found this did not change the attack success rate so we take only 1 gradient sample in most of our experiments (Figure 11b). Finally, we also used a straight-though-estimator to pass gradients through  $R$ -Blur in case it may be obfuscating them and found that doing so reduces the attack success rate, thus indicating that gradients that pass through  $R$ -Blur retain valuable information that can be used by the adversarial attack (Figure 11b).
B Fixation Point Selection
In this study, we did not attempt to develop an optimal fixation point selection algorithm, and instead, we operate under the assumption that points at which humans tend to fixate are sufficiently informative to perform accurate object classification. Therefore, we used DeepGaze-III [44], which is a neural
Figure 12: Accuracy of  $R$ -Blur on Imagenet under APGD (blue) and AutoAttack (orange). The accuracy under APGD and AutoAttack is very similar, which shows that evaluating with only APGD provides a reliable measure of  $R$ -Blur's robustness
(a) Optimal Fixation
Figure 13: The accuracy obtained on clean and adversarial data when (a) the optimal fixation point was selected, (b) when the five fixation approach from Section 3 was used, and (c) an adversially trained model was used.
(b) DeepGaze-III Five Fixations
(c) Adversarial Training
network model trained to model the human gaze. DeepGaze-III uses a deep CNN backbone to extract features from the image, and based on these features another DNN predicts a heatmap that indicates, for each spatial coordinate, the probability that a human will fixate on it. However, it is possible that this algorithm is sub-optimal, and with further study, a better one could be developed. Though developing such an algorithm is out of the scope of this paper, we conduct a preliminary study to determine if it is possible to select better fixation points than the ones predicted by DeepGaze-III.
To this end, we run the following experiment to pick an optimal fixation point for each image during inference. For each testing image, we select 49 fixation points, spaced uniformly in a grid. Using the models we trained in earlier (see section 3) we obtain predictions for each image and each of the 49 fixation points. If there was at least one fixation point at which the model was able to correctly classify the image, we consider it to be correctly classified for the purpose of computing accuracy. We repeat this experiment for Ecoset-10, Ecoset, and Imagenet, using clean and adversarially perturbed data. We obtain the adversarially perturbed images for each of the 49 fixation points by fixing the fixation point at one location running the APGD attack with  $\ell_{\infty}$ -norm bounded to 0.004. Figure 14 illustrates this experiment with some example images.
The results are presented in Figure 13. We see that when the optimal fixation point is chosen accuracy on both clean and adversarially perturbed data improves, with the improvement in clean accuracy being the most marked. The clean accuracy on Ecoset-10, Ecoset, and Imagenet improved by  $5\%$ ,  $11\%$ , and  $10\%$  respectively, which makes the clean accuracy of the  $R$ -Blur model on par or better than the clean accuracy achieved by the unmodified ResNet. Furthermore, when the optimal fixation point, is chosen  $R$ -Blur obtains higher clean accuracy than  $AT$  on all the datasets.