Probing Human Visual Robustness with Neurally-Guided Deep Neural Networks

## Abstract

Abstract Humans effortlessly navigate the dynamic visual world, yet deep neural networks (DNNs), despite excelling at many visual tasks, are surprisingly vulnerable to minor image perturbations. Past theories suggest that human visual robustness arises from a representational space that evolves along the ventral visual stream (VVS) of the brain to increasingly tolerate object transformations. To test whether robustness is supported by such progression as opposed to being confined exclusively to specialized higher-order regions, we trained DNNs to align their representations with human neural responses from consecutive VVS regions while performing visual tasks. We demonstrate a hierarchical improvement in DNN robustness: alignment to higher-order VVS regions leads to greater improvement. To investigate the mechanism behind such robustness gains, we test a prominent hypothesis that attributes human robustness to the unique geometry of neural category manifolds in the VVS. We first reveal that more desirable manifold properties, specifically, smaller extent and better linear separability, indeed emerge across the human VVS. These properties can be inherited by neurally aligned DNNs and predict their subsequent robustness gains. Furthermore, we show that supervision from neural manifolds alone, via manifold guidance, is sufficient to qualitatively reproduce the hierarchical robustness improvements. Together, these results highlight the critical role of the evolving representational space across VVS in achieving robust visual inference, in part through the formation of more linearly separable category manifolds, which may in turn be leveraged to develop more robust AI systems.

## 1 Introduction

Deep neural networks (DNNs), despite achieving human-level performance on many visual tasks [16, 69], remain brittle under minor image perturbations that are imperceptible and innocuous to humans, such as adversarial attacks [52, 64, 24]. In contrast, humans are known for their remarkable proficiency in navigating the challenging visual world. A long line of evidence has shown that humans reliably recognize objects across various changes such as translation [5], scale [6], viewpoint [7], and even under evolutionarily unnatural image degradations [23] and novel objects that fall outside of typical visual experience [8, 68]. This stark contrast is thought to stem from humans’ ability to develop a unique representational space that supports robust visual inference. DNNs, on the other hand, could potentially lack either the necessary architectural components (such as the extensive feedback and recurrent connections [19]) or the rich training environment (such as the active interaction with real-world [62]) to naturally achieve such a superior representational space.

Computational models [60] and theoretical frameworks [17, 31, 36] have highlighted the ventral visual stream (VVS), comprising hierarchically organized visual cortices such as V1, V2, V4, and the inferotemporal (IT) cortex, as critical for object recognition. Neuroscience studies have shown that representations in higher-order VVS areas become progressively more abstract and invariant to transformations [57, 74, 32, 30, 3, 54]. However, these previous studies have typically focused on single regions or limited comparisons between two areas (e.g. V4 vs. IT) [57, 30], leaving unanswered the fundamental question of whether robust visual representations are indeed progressively built along the VVS hierarchy, and if so, how this progression occurs. An alternative hypothesis is that robustness emerges exclusively in specialized regions such as IT (analogous to how face processing is localized to fusiform gyrus [33]), without contributions from early or intermediate regions. Resolving this question is important for both providing critical mechanistic insights into how human vision achieves resilience, and informing AI research by revealing the plausibility of intermediate representational stages scaffolding robustness in artificial systems.

To systematically evaluate whether robustness emerges progressively across the VVS, instead of solely in a specialized endpoint like IT, we build on prior work using neural alignment to train DNNs with primate brain data [41, 58, 15, 63]. Specifically, we apply “neural guidance” to steer the final-layer representations of DNNs to match human neural responses, recorded by functional Magnetic Resonance Imaging (fMRI), from consecutive regions of human VVS. By training a separate model aligned to each region, we are able to systematically test the hypothesis that later brain areas confer greater robustness to adversarial perturbations, thus supporting a VVS hierarchy of neural representations with increasing robustness-supporting capacity.

Moreover, by inspecting the resulting more human-like representations, we can also probe the mechanism, and ask what representational properties may be responsible for the improved robustness. One prominent candidate explanation is the manifold disentanglement hypothesis [17, 10, 12]. In this framework, identity-preserving transformations of an object form continuous manifolds in neural representational space, and robustness emerges as these manifolds become less diffuse, lower-dimensional, and more linearly separable across the VVS hierarchy. While theoretically appealing, direct evidence linking human neural manifolds to robustness has been limited. Here, we first test this connection using mean-field theoretic manifold analysis (MFTMA) [10], a recently developed framework that uses statistical mechanical modeling to probe the geometric and statistical properties of manifolds. We measure the extent (i.e., spatial spread) and linear separability of human neural category manifolds across VVS and ask whether such properties can be inherited by DNNs to predict model robustness. We then introduce “manifold guidance”, a form of category manifold-level neural alignment that moves beyond point-to-point neural guidance to test whether the structure of neural manifolds is indeed one critical component underlying robustness.

Our contributions are as follows:

- •
We show that DNNs trained with neural guidance from later VVS regions show progressively greater robustness to adversarial attacks, corroborating a functional hierarchy across human VVS to support robustness.
- •
We demonstrate that human neural manifolds become less diffuse and more linearly separable across the VVS, and that these properties are inherited by neurally-guided DNNs and predict their subsequent robustness gains.
- •
We introduce “manifold guidance” to show that supervision from coarse neural manifold structure is sufficient to qualitatively reproduce the hierarchical robustness effect, supporting neural manifold geometry as a key factor in human visual robustness.

## 2 Related Work

Neural alignment has been increasingly explored as a method to transfer biological properties to DNNs [63]. Several studies have aligned models to neural responses in order to produce more human-like behavior, such as decision patterns for object recognition tasks [15, 45], shape-over-texture preferences [34], and even more human-like semantic biases in language models [49]. Work more directly related to robustness used second-order similarity in representational geometry [37] to regularize DNNs [41], targeted early DNN layers [58] or leveraged specialized architectures such as CORnet with layers corresponding to areas like IT [15], to demonstrate improved robustness.

However, these studies primarily aim to demonstrate that neural alignment can induce human-like downstream behavior, and thus typically focus on a single brain area, such as V1 or IT, and rely on animal electrophysiology. In contrast, we leverage human fMRI data that allow simultaneous investigation of multiple fine-grained brain regions along ventral stream. This enables us to systematically test whether a gradient of robustness improvement emerges when aligning to progressively higher-order VVS regions. Beyond demonstrating this effect, we further investigate its underlying mechanism, i.e., whether it arises from the geometry of neural category manifolds.

Regarding biological manifolds, Froudarakis et al. [20] observed that higher-order visual areas in rodents show less diffuse manifolds than earlier ones. Here, we extend this work to demonstrate the decreasing extent and increasing linear separability in human VVS using MFTMA. Prior work [14] has also used MFTMA to show that robust DNNs tend to show less diffuse manifolds, but did not assess whether neural manifold structure itself can induce robustness. We extend these efforts by introducing manifold guidance to directly test whether neural manifold geometry alone is sufficient to confer robustness. Additionally, while MFTMA has inspired unique self-supervised learning methods [72, 59], we use it here as an empirical tool to evaluate whether the robustness-supporting capacity of the human brain can indeed be explained by this theoretical framework.

## 3 Methods

### 3.1 Neural guidance

Figure: Figure 1: (A) Illustration of anatomical locations of seven ROIs from Subject-1 used for neural guidance. (B) Architecture of the neurally guided ResNet, trained with a task head for image classification and a neural head to match neural responses generated by neural predictors.
Refer to caption: x1.png

#### Neural data

We used neural data from the publicly available Natural Scenes Dataset (NSD) [1], which provides high-resolution, whole-brain fMRI scans collected from human participants viewing natural images from MSCOCO [42]. In the NSD experiment, each trial involved participants viewing a single image, and voxel-wise activation levels were estimated via a general linear model (GLM) incorporating a hemodynamic response function regressor and various nuisance regressors for denoising. Activation levels correspond to the GLM coefficients for each image and reflect the percent change in fMRI signal magnitude relative to a voxel’s baseline activity. For each brain region, or Region of Interest (ROI), these values across voxels form a neural representation vector for each image. We used the fully preprocessed data and signal change estimates provided by the NSD processing pipeline to ensure reproducibility. To trace evolving representational spaces across the VVS, we extracted neural responses from seven visual ROIs (Fig. [1](https://arxiv.org/html/2405.02564v2#S3.F1)A), ranging from early visual areas (V1, V2) to intermediate region (V4), higher-order areas (VO, PHC, LO, TO (see Appendix [A](https://arxiv.org/html/2405.02564v2#A1) for detailed descriptions and expected contributions to robustness). All experiments reported here are based on Subject-1 because optimal registration across individuals remains a significant challenge [28]. However, using data from other NSD subjects provides similar results, as can be seen in Appendix [C.1](https://arxiv.org/html/2405.02564v2#A3.SS1).

#### Neural predictors

Following prior neural alignment work [58, 15], we used the human neural data acquired in NSD to train (^1^11All models in our study were trained using 4 NVIDIA A40 GPUs.) neural predictors, serving as surrogates for each ROI. These neural predictors enabled us to obtain neural responses for any arbitrary images, such as those from the ImageNet dataset, that are not seen by human participants but required for the neural guidance training and subsequent evaluation on DNN robustness. Following the NSD experiments’ protocol for train/test split, we divided the 9,841 unique images viewed by Subject-1 into a training set with 8,859 image-representation pairs and a test set with 982 pairs. Separate predictors were trained for each ROI (seven in total) based on a modified ResNet18 architecture [29], in which the final fully connected (FC) layer was replaced with a linear layer matching the targeted ROI’s dimensionality (e.g., the V1 predictor output matches the dimensionality of V1 representations). All classification-specific components (e.g., softmax) were removed. Each predictor was trained to minimize a Mean Squared Error (MSE) loss between the predicted and ground-truth neural representations. After training, predictor weights were frozen and used as feature extractors for subsequent neural guidance training. We performed quality control analyses to confirm that predictors indeed captured meaningful neural representations (Appendix [B](https://arxiv.org/html/2405.02564v2#A2)).

#### Neural guidance (NG)

As illustrated in Fig. [1](https://arxiv.org/html/2405.02564v2#S3.F1)B, we adapted ResNet-18 by adding an additional FC layer situated after the last convolutional block. This additional FC layer, or “neural head”, outputs representations matching the dimensionality of the targeted ROI, while the original “task head” performs classification. Training thus jointly optimized the classification and neural representation alignment objectives. Specifically, given input image $x_{i}$, its corresponding class label $y_{i}$ and neural representation $r_{i}$, the shared backbone $f^{s}$ produces features that are processed by the task head $f^{t}$ and the neural head $f^{n}$. The overall training loss is:

$$ $L=\alpha L_{\text{CE}}(f^{t}(f^{s}(x_{i})),y_{i})+(1-\alpha)L_{\text{MSE}}(f^{ n}(f^{s}(x_{i})),r_{i}),$ (1) $$

where $L_{\text{CE}}$ denotes the conventional cross-entropy loss for classification task and $L_{\text{MSE}}$ denotes the MSE loss for matching the representations. We tuned $\alpha$ to achieve an optimal tradeoff between task performance and neural representation alignment.

We trained seven NG-models, each guided by one ROI along the VVS hierarchy to systematically test the effect of neural guidance from different stages of the ventral stream. All models were trained using a curated subset of ImageNet classes (ImageNet-50) selected to closely match the object categories used in NSD. Since MSCOCO images shown to NSD participants do not have a direct one-to-one category mapping to ImageNet, we classified all MSCOCO images used in NSD using a ResNet-101 trained on ImageNet. The 50 most frequently predicted ImageNet categories were selected to define the ImageNet-50 subset. This procedure aimed to maximize the generalizability of neural predictors trained on MSCOCO images in NSD to ImageNet images, thus improving the quality of approximated neural responses. In addition to ImageNet-50 classification, we also trained models with the same neural guidance setup on CIFAR-100 classification and MSCOCO image captioning tasks (thus evaluating changes in BLEU scores). Results for these additional datasets are reported in Appendix [C.3](https://arxiv.org/html/2405.02564v2#A3.SS3).

We also included four baseline models each allowing us to rule out different alternative hypotheses. The “None” model, serving as the absolute baseline condition, had only the task head and was merely fine-tuned on the ImageNet-50 subset. The “Random” model had the same dual-head structure, but the neural head was guided by an untrained neural predictor with only randomly initialized weights to test the impact of adding an uninformative auxiliary head. The “V1-shuffle” and “TO-shuffle” were both dual-headed models guided by the frozen V1 and TO neural predictors, respectively. However, before training, we performed a fixed random reassignment between input images and neural representations, effectively “shuffling” the correspondence so that each image was consistently paired with an incorrect neural target. This setup tested whether improvements could merely arise from the byproduct of neural-characteristic noise.

#### Robustness evaluation

During robustness evaluation, the neural head was removed from all NG models, and adversarial attacks were applied solely to the task head. The primary attack method we used here was the untargeted $l_{\infty}$-based Projected Gradient Descent (PGD) attack [46]. We tested a range of attack strengths by sweeping across a range of perturbation bounds $\epsilon$ ($\epsilon=0.001*(2i+1)$, where $i\in\{0,\ldots,9\}$) to more comprehensively probe the models’ performance. To ensure that the observed robustness improvements from neural guidance were not a coincidental result of this attack, we additionally included a range of common adversarial attacks : 1. $l_{\infty}$-based AutoAttack [13], which aggregates several attack methods including FAB, Square Attack, APGD-CE, and APGD-DLR; 2. $l_{\infty}$-based Fast Gradient Sign Method (FGSM) [24]; 3. $l_{2}$-based Fast Gradient Method (FGM) attack [24]; and 4. $l_{2}$-based DeepFool attack [48]. Robustness gains under all such attacks are depicted in Appendix [C.2](https://arxiv.org/html/2405.02564v2#A3.SS2).

### 3.2 Neural category manifold disentangling hypothesis

#### Manifold statistics

To test the manifold disentanglement hypothesis [17], we first applied MFTMA [10] to investigate whether object category manifolds with smaller extent and better linear separability indeed emerge in both human VVS ROIs and neurally guided DNNs. A category manifold is defined as the representations of all identity-preserving transformations of objects within a category. MFTMA estimates the system’s capacity, or linear separability, which reflects the maximal number of such manifolds that can still be linearly separated in an $N$-dimensional space. MFTMA estimates this separability from the geometry of each manifold, specifically its radius $r_{c}$, which reflects the size of the manifold for category $c$, effective dimension $d_{c}$ for the number of dimensions with significant variance, and thus extent $e_{c}=\frac{r_{c}}{\sqrt{d_{c}}}$ that captures the spatial diffuseness of the manifold. In particular, a more optimally structured representational space should have manifolds with smaller extent $e_{c}$ to enable better linear separability.

We first applied this analysis to human neural representations in each of the seven ROIs using NSD. Because most MSCOCO images in NSD contain multiple objects and thus are not ideal samples for capturing object category manifolds, we curated a subset of images containing only a single object category (see Appendix [E.1](https://arxiv.org/html/2405.02564v2#A5.SS1)), by prioritizing those with large bounding boxes. This resulted in 12 object categories, each with 50 images. We also applied MFTMA on neural representations estimated by the neural predictors using the same subset of images to confirm that they preserve the structure of the original neural manifolds.

To assess manifolds in the NG-models, we used the test set from the ImageNet-50 subset, which provided 50 categories and 50 images per category. To further test the manifold hypothesis [17] that identity-preserving transformations should be treated as part of the same category manifold, we enriched each category with adversarially perturbed variants of the test images, thus obtaining 100 samples in total per category, similar to previous work [14]. These perturbed versions of the test set were generated using the $l_{\infty}$-based PGD attack with $\epsilon=0.009$.

#### Manifold guidance

To test whether neural category manifold structure is sufficient to confer robustness, we replaced the neural guidance loss in Eq. [1](https://arxiv.org/html/2405.02564v2#S3.E1) with constraints that match key geometric properties of DNN category manifolds to those of the corresponding neural ones (see Fig. [4](https://arxiv.org/html/2405.02564v2#S4.F4)A). Importantly, we approximate each manifold as a first-order linear structure, defined by its center, spread (radius), and local subspace. This simplification allows for efficient integration into DNN training and is sufficient, as a proof-of-concept, to assess whether coarse geometric structure alone can induce robustness improvements.

We first characterized each neural category manifold $c$ offline using neural representations of the training set of ImageNet-50 images (i.e., 50 categories, 1300 clean image samples per category). For each category, we estimated 1. the center $m_{c}$ as the geometric mean of all samples, 2. the radius $r_{c}$ as the root-mean-squared (RMS) spread of centered representation vectors and 3. the subspace basis $V_{c}$ as the top singular vectors from singular value decomposition (SVD) retaining enough components to explaining 99% of variance.

During training, for each batch of images $X_{b}$ with labels $Y_{b}$, we minimize the loss:

$$ $L_{b}=\alpha L_{\text{CE}}(f^{t}(f^{s}(X_{b}),Y_{b})+(1-\alpha)\sum_{c\in\text {set}(Y_{b})}L_{\text{manifold}}(f^{n}(f^{s}(X_{b,c})),m_{c},r_{c},V_{c}),$ (2) $$

where $\text{set}(Y_{b})$ denotes the unique object categories present in batch $b$, which, given a sufficiently large batch size, typically includes all 50 categories in the dataset, and $L_{\text{manifold}}$ enforces alignment between DNN category manifolds and neural manifolds.
In a given batch, we grouped images based on their category $X_{b,c}$ and treat them as samples for the DNN manifold of category $c$. The manifold guidance loss were computed separately for each category and consisted of two terms:

- 1.
a radius constraint that penalizes if the DNN manifold radius exceeds the neural one
$L_{\text{RMS}}(Z_{b,c},m_{c},r_{c})=\max\left(0,f_{\text{RMS}}(Z_{b,c}-m_{c})-
r_{c}\right),$
(3)
where $Z_{b,c}=f^{n}(f^{s}(X_{b,c}))$ and $f_{\text{RMS}}$ denotes the root-mean-squared error,
- 2.
a subspace constraint, analogous to the Variance Accounted For (VAF) [18, 21], that encourages orientation alignment between the DNN and neural manifolds:
$L_{\text{subspace}}(Z_{b,c},V_{c})=\frac{\|Z_{b,c}-V_{c}V_{c}^{\top}Z_{b,c}\|_
{F}^{2}}{\|Z_{b,c}\|_{F}^{2}},$
(4)
where $\|\cdot\|_{F}$ denotes Frobenius norm.

The total manifold guidance loss is then summed over all categories in the batch

$$ $L_{\text{manifold}}(Z_{b,c},m_{c},r_{c},V_{c})=L_{\text{RMS}}(Z_{b,c},m_{c},r_ {c})+\beta L_{\text{subspace}}(Z_{b,c},V_{c}),$ (5) $$

where $\beta$ was tuned to balance the weighting between radius and subspace constraints. We note that to reliably estimate DNN category manifolds in each batch, the batch size needs to be large enough to allow a reasonable sample size for each category.

## 4 Results

### 4.1 Neural guidance from human VVS induces hierarchical improvement in DNN robustness

We first tested whether direct neural guidance from later regions of the VVS confers greater adversarial robustness to DNNs. As described above, we trained seven neurally guided DNNs, each using a frozen neural predictor serving as a surrogate for a different ROI along the VVS (V1–TO), while simultaneously learning image classification on ImageNet-50. We additionally included four control models, None, Random, V1-shuffle and TO-shuffle to rule out various hypothesis.

Fig. [2](https://arxiv.org/html/2405.02564v2#S4.F2)A shows performance of all models under the $l_{\infty}$-based PGD attack on the classification head with varying perturbation strengths $\epsilon$. While all baseline models showed similar vulnerability, all NG-models exhibited improved robustness. More importantly, this improvement followed a clear hierarchy. DNNs guided by V1 and V2 showed modest improvement in adversarial robustness, consistent with their early positions in the visual processing hierarchy. Improvements were more pronounced in the V4-guided model and were further surpassed by the LO-guided, VO-guided, and PHC-guided models, with the TO-guided model showing the highest level of robustness.

We replicated this hierarchical effect across multiple NSD subjects (Appendix [C.1](https://arxiv.org/html/2405.02564v2#A3.SS1)), alternative tasks and datasets (Appendix [C.3](https://arxiv.org/html/2405.02564v2#A3.SS3)), and across multiple attack types (Appendix [C.2](https://arxiv.org/html/2405.02564v2#A3.SS2)). In all cases, we observed a consistent trend: robustness increased with guidance from later visual areas, even though the absolute gains varied across settings. These converging findings across subjects, datasets, tasks, and attacks demonstrate that the robustness conferred by neural guidance is not coincidental. Instead, they suggest that human-constructed visual representations along the VVS become increasingly capable of supporting visual robustness and that such property is transferable to artificial systems.

Figure: Figure 2: (A) Left: Top-1 classification accuracy of all models under $l_{\infty}$-based PGD attacks of varying strength $\epsilon$. “Clean” denotes accuracy on unperturbed images. Right: Robustness improvements summarized as the difference in area under the accuracy curve ($\Delta$AUC) for each model relative to the baseline (None model), computed across all $\epsilon$ values used (see Methods [3.1](https://arxiv.org/html/2405.02564v2#S3.SS1.SSS0.Px4)). (B) Transfer attack accuracy vs. native robustness improvement ($\Delta$AUC) for NG- (red diamonds) and WD-models (blue circles). Dashed lines show linear fits with slopes $\theta$ annotated (see Results [4.2](https://arxiv.org/html/2405.02564v2#S4.SS2)). (C) 3D MDS visualization of representational space similarity among 16 models and 7 human ROIs. Proximity indicates similarity in the representational space. Dashed stems are added for visualization of the relative positions of each circle.
Refer to caption: x2.png

### 4.2 Neural guidance induces unique output surfaces and representational spaces

One possible explanation for the robustness improvement observed in NG-models is that they stem from standard regularization effects. For example, simply increasing weight decay (WD) is a common approach known to improve adversarial robustness by smoothing the model’s output surface, i.e. loss surface with respect to input images [56, 43, 11, 73]. To assess whether neural guidance offers a distinct solution to robustness, we compared the output surface characteristics of NG-models and DNNs trained with increasing WD regularization.

We first trained five WD models with increasing regularization strength and confirmed that stronger regularization led to higher adversarial robustness (see Appendix [D.1](https://arxiv.org/html/2405.02564v2#A4.SS1)). We also verified that both WD and NG models showed smoother output surfaces via calculating gradient norm magnitude across neighborhood radii [71] (see Appendix [D.2](https://arxiv.org/html/2405.02564v2#A4.SS2)). To probe whether the underlying output surface geometry differs between NG and WD models, we leveraged transfer attacks [51], which test whether adversarial examples generated for one model can also compromise others. Transferability is a hallmark of conventional DNNs [51, 44, 55], suggesting a fundamental homogeneity among them. We first generated adversarial examples from the baseline None model (trained without neural guidance) and evaluated their effectiveness on NG and WD models (see Appendix [D.3](https://arxiv.org/html/2405.02564v2#A4.SS3) for details). Importantly, we matched models based on their native robustness improvement ($\Delta$ AUC, the difference in area under the PGD accuracy curve relative to the None model) to isolate differences in transfer susceptibility. We also fit linear regressions between $\Delta$AUC and transfer attack accuracy separately for each model type. As shown in Fig. [2](https://arxiv.org/html/2405.02564v2#S4.F2)B, NG models were consistently more resistant to transfer attacks than equally robust WD models. We also found that NG models ($\theta=1.50$) had flatter regression slopes compared to WD models ($\theta=3.57$), indicating that their transfer susceptibility does not scale as strongly with native robustness. Together, these results suggest that neural guidance alters the output surface in a qualitatively different way compared to common regularization effects.

We hypothesized that these differences in output surfaces arise from changes in representational geometry induced by neural guidance. Using representational similarity analysis (RSA) [37] (see Appendix [D.4](https://arxiv.org/html/2405.02564v2#A4.SS4) for methods), we compared internal feature spaces across 16 models (NG, baseline, WD) and 7 human neural ROIs, and derived a Representational Similarity Matrix (RSM) using Spearman’s $\rho$ correlation. We then applied multidimensional scaling (MDS) to project the space similarity structure into 3D space for visualization (Fig. [2](https://arxiv.org/html/2405.02564v2#S4.F2)C). Our results showed that all WD models and baseline models remained highly similar to each other, while NG models diverged from them and shifted closer to human ROIs. This shift in representational geometry suggests that neural guidance steers DNNs toward more human-like internal representations, which may underlie their unique loss landscape structure that ultimately benefited robustness.

Figure: Figure 3: (A) Isomap visualization of three example category manifolds in V1, V4, and TO representational spaces (note the shrinkage in axis scales indicating smaller extent) (B) Category manifold extent ($\downarrow$) and linear separability ($\uparrow$) estimated using MFTMA [10] for human brain ROIs (left), neural predictors (middle), and neurally-guided (NG) models (right). Error bars represent 95% Confidence Interval (CI) of extent across categories. Dashed lines mark the chance level for separability. (C) Manifold extent and linear separability in NG models predict their robustness improvement ($\Delta$AUC): NG models with less diffuse (smaller extent) and more separable manifolds show greater $\Delta$AUC.
Refer to caption: x3.png

### 4.3 Neural manifold geometry predicts robustness in NG models

Having shown that neural guidance improves robustness and alters representational geometry, we next asked: what specific properties of human neural representations make them particularly effective for supporting robustness? As described above, the manifold disentangling framework [17, 10] suggests that category manifolds, encompassing all identity-preserving transformations of objects in the given category, are progressively disentangled across the human VVS, naturally leading to robustness. This disentanglement is thought to be achieved by transforming manifolds to have smaller extent and thus become more linearly separable. To illustrate this visually, we show an example in Fig. [3](https://arxiv.org/html/2405.02564v2#S4.F3)A using Isomap [65] to embed three category manifolds into 3D space from V1, V4, and TO representational spaces (see Appendix [E.2](https://arxiv.org/html/2405.02564v2#A5.SS2) for details). As we move up the VVS hierarchy, the manifolds appear progressively less diffuse (note the shrinkage in axis scale) and separated.

Here using MFTMA, we quantified two key manifold statistics: extent, which reflects the diffuseness of each category manifold, and linear separability for all manifolds in the representational space. First, we observed in human neural space that manifold extent decreased and separability increased along the VVS (Fig. [3](https://arxiv.org/html/2405.02564v2#S4.F3)B left), confirming that later brain regions encode increasingly disentangled category manifolds. Similar patterns of decreasing extent and increasing separability in neural predictors (Fig. [3](https://arxiv.org/html/2405.02564v2#S4.F3)B middle) confirms that they retain key geometric features of the original neural space.

Similarly, NG models guided by later brain regions showed lower manifold extent and higher separability than those guided by earlier regions (Fig. [3](https://arxiv.org/html/2405.02564v2#S4.F3)B right). In comparison, baseline models overall showed diffuse, poorly separated manifolds. To quantitatively test whether these manifold properties explain NG models’ robustness gains, we fit linear regressions to predict robustness improvement $\Delta$AUC using manifold extent and separability. As expected, models with less diffuse and more linearly separable manifolds showed greater robustness improvements (Fig. [3](https://arxiv.org/html/2405.02564v2#S4.F3)C). Together, these results show that the desirable manifold properties observed in the human VVS can be inherited by NG models and can predict their downstream robustness gains.

### 4.4 Manifold-level guidance qualitatively reproduces robustness hierarchy

As proposed by the manifold disentangling hypothesis [17, 10], the key factor enabling visual robustness is the linear separability of category manifolds. Therefore, the robustness gains observed in neural guidance may arise from learning the more optimal structure of neural category manifolds, such as their smaller extent, orientation, and resulting separability. Importantly, if the geometry of the manifolds is what matters, then matching only manifold-level properties, instead of precisely matching individual representations, should suffice to recover the hierarchical robustness improvement. Motivated by this, we used a coarser form of supervision, manifold guidance Fig. [4](https://arxiv.org/html/2405.02564v2#S4.F4)A, to align the overall structure of category manifolds between DNNs and human neural representations.

As shown in Fig. [4](https://arxiv.org/html/2405.02564v2#S4.F4)B, models trained with manifold guidance showed a hierarchy in robustness: guidance from later visual areas produced larger gains. Although the overall robustness improvements were smaller than those achieved with full neural guidance, the relative ordering across brain regions was well preserved. Robustness gain ($\Delta$AUC) under manifold guidance was highly correlated with that under neural guidance from the same regions (Spearman’s $\rho=0.82^{*},p=0.023$, Fig [4](https://arxiv.org/html/2405.02564v2#S4.F4)C), indicating that the hierarchical effect from neural guidance is indeed reproduced.

It is important to note that our manifold guidance method uses a linear approximation of manifold geometry and does not capture nuanced nonlinear features such as curvature. Nonetheless, preserving only coarse geometric structure of neural manifolds, such as radius and subspace orientation, without access to any individual neural activation patterns, is already sufficient to recover the hierarchical robustness improvement. This provides strong evidence that learning the neural manifold properties could indeed contribute to the robustness conferred by neural guidance. However, the fact that manifold guidance does not fully reproduce the effects of neural guidance suggests promising directions for future work, such as incorporating more flexible or nonlinear manifold constraints, or investigating the role of finer-grained structures tied to individual neural representations.

Figure: Figure 4: (A) Illustration of manifold guidance that trains DNN with a task head for image classification and a neural head to match category manifold properties with the corresponding neural manifold ones estimated using neural predictors (B) Left: Top-1 classification accuracy of models trained with manifold guidance and the baseline None model under $l_{\infty}$-based PGD attacks. “Clean” denotes accuracy on unperturbed images. Right: Robustness improvements summarized as $\Delta$AUC relative to the baseline None model. (C) Correlation of robustness improvement $\Delta$AUC for DNNs trained with manifold guidance vs. neural guidance. Improvement hierarchy is preserved despite the small improvement magnitude.
Refer to caption: x4.png

## 5 Discussion and conclusions

In our study, we first demonstrated that aligning DNN representations to progressively higher-order regions of the human VVS yields a hierarchical improvement in robustness. We further showed that this progression is not merely a byproduct of generic regularization, but may be driven by the formation of category manifolds with smaller extent and greater linear separability. These results suggest that robustness may emerge through a progressive refinement of representations along the VVS, underscoring the importance of studying the visual system systematically rather than focusing on isolated or endpoint regions. Our findings also point to the geometry of human VVS representations as a potential source of robustness-supporting principles, thus offering promising neural priors and manifold-level constraints to inspire the development of more resilient AI models.

One limitation of our study is that while we demonstrate the relevance of neural manifold structure to the human visual robustness, we do not address how such manifolds are formed in the brain. Although our findings hint at a feed-forward progression across VVS, it is likely that top-down influences, or feedback connections, play a critical role in shaping manifold geometry. The human brain is richly interconnected with extensive feedback and recurrent connectivity [19] even for early regions like V1 [40], which may carry higher-level information that extends beyond basic feature detection. This could explain the notable robustness improvements from V1 despite its early position in the visual processing hierarchy. Supporting this idea, recent work has shown the benefits from adding feedback to artificial networks [35, 61]. One particularly relevant study demonstrated that feedback in linear neural networks helps reorient manifolds to preserve robustness under noise [50]. This also aligns with a long-standing view of the visual brain as a generative system that forms and tests perceptual hypotheses informed by both sensory stimulation and environmental statistical regularities [4, 67]. One intriguing future direction would thus be how specific forms of top-down influence, such as prior knowledge or expectations, guide the development of robust manifold structures and how to incorporating such generative principles in artificial systems.

Interestingly, adversarial attacks on the human visual system have achieved some success, particularly when humans are limited to brief viewing times, reducing the likelihood of engaging feedback connections that most DNN architectures lack [66, 22]. Moreover, monkey IT neurons’ preferences have been shown to be manipulable by adversarial attacks [27]. Therefore, while our findings affirm that the human visual system likely operates in a representation space with geometries more conducive to robustness, the human visual system may not be entirely impervious to such attacks. In particular, in our experiments, even the best-performing model does not enable DNNs to approach the expected robustness of human performance, as these almost imperceptible adversarial perturbations should not affect human perception at all. This discrepancy could certainly reflect limitations inherent to the quality of fMRI signals, the neural guidance training pipeline, or the choice of ROIs, but it may also indicate that the human visual system itself is not the ultimate gold standard. We leave the investigation into the limits of human visual robustness to future work.

## Acknowledgments

We thank Dr. Adam Steel for his comments to improve our manuscript. This work used Delta GPU at NCSA through allocation SOC230011 from the Advanced Cyberinfrastructure Coordination Ecosystem: Services & Support (ACCESS) program, which is supported by National Science Foundation grants #2138259, #2138286, #2138307, #2137603, and #2138296.

## References

- [1]
Emily J Allen, Ghislain St-Yves, Yihan Wu, Jesse L Breedlove, Jacob S Prince, Logan T Dowdle, Matthias Nau, Brad Caron, Franco Pestilli, Ian Charest, et al.
A massive 7t fmri dataset to bridge cognitive neuroscience and artificial intelligence.
Nature neuroscience, 25(1):116–126, 2022.
- [2]
Michael J Arcaro, Stephanie A McMains, Benjamin D Singer, and Sabine Kastner.
Retinotopic organization of human ventral visual cortex.
Journal of neuroscience, 29(34):10638–10652, 2009.
- [3]
Pinglei Bao, Liang She, Mason McGill, and Doris Y Tsao.
A map of object space in primate inferotemporal cortex.
Nature, 583(7814):103–108, 2020.
- [4]
Diane M Beck, Evan G Center, and Zhenan Shao.
The role of real-world statistical regularities in visual perception.
Current Directions in Psychological Science, 33(5):317–324, 2024.
- [5]
Irving Biederman and Eric E Cooper.
Evidence for complete translational and reflectional invariance in visual object priming.
Perception, 20(5):585–593, 1991.
- [6]
Irving Biederman and Eric E Cooper.
Size invariance in visual object priming.
Journal of Experimental Psychology: Human Perception and Performance, 18(1):121, 1992.
- [7]
Irving Biederman and Peter C Gerhardstein.
Recognizing depth-rotated objects: evidence and conditions for three-dimensional viewpoint invariance.
Journal of Experimental Psychology: Human perception and performance, 19(6):1162, 1993.
- [8]
Jeffrey S Bowers, Ivan I Vankov, and Casimir JH Ludwig.
The visual system supports online translation invariance for object identification.
Psychonomic bulletin & review, 23:432–438, 2016.
- [9]
Alyssa A Brewer, Junjie Liu, Alex R Wade, and Brian A Wandell.
Visual field maps and stimulus selectivity in human ventral occipital cortex.
Nature neuroscience, 8(8):1102–1109, 2005.
- [10]
SueYeon Chung, Daniel D Lee, and Haim Sompolinsky.
Classification and geometry of general perceptual manifolds.
Physical Review X, 8(3):031003, 2018.
- [11]
Jeremy Cohen, Elan Rosenfeld, and Zico Kolter.
Certified adversarial robustness via randomized smoothing.
In international conference on machine learning, pages 1310–1320. PMLR, 2019.
- [12]
Uri Cohen, SueYeon Chung, Daniel D Lee, and Haim Sompolinsky.
Separability and geometry of object manifolds in deep neural networks.
Nature communications, 11(1):746, 2020.
- [13]
Francesco Croce and Matthias Hein.
Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks.
In International conference on machine learning, pages 2206–2216. PMLR, 2020.
- [14]
Joel Dapello, Jenelle Feather, Hang Le, Tiago Marques, David Cox, Josh McDermott, James J DiCarlo, and SueYeon Chung.
Neural population geometry reveals the role of stochasticity in robust perception.
Advances in Neural Information Processing Systems, 34:15595–15607, 2021.
- [15]
Joel Dapello, Kohitij Kar, Martin Schrimpf, Robert Geary, Michael Ferguson, David D Cox, and James J DiCarlo.
Aligning model and macaque inferior temporal cortex representations improves model-to-human behavioral alignment and adversarial robustness.
BioRxiv, pages 2022–07, 2022.
- [16]
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei.
Imagenet: A large-scale hierarchical image database.
In 2009 IEEE conference on computer vision and pattern recognition, pages 248–255. Ieee, 2009.
- [17]
James J DiCarlo and David D Cox.
Untangling invariant object recognition.
Trends in cognitive sciences, 11(8):333–341, 2007.
- [18]
Gamaleldin F Elsayed, Antonio H Lara, Matthew T Kaufman, Mark M Churchland, and John P Cunningham.
Reorganization between preparatory and movement population responses in motor cortex.
Nature communications, 7(1):13239, 2016.
- [19]
Daniel J Felleman and David C Van Essen.
Distributed hierarchical processing in the primate cerebral cortex.
Cerebral cortex (New York, NY: 1991), 1(1):1–47, 1991.
- [20]
Emmanouil Froudarakis, Uri Cohen, Maria Diamantaki, Edgar Y Walker, Jacob Reimer, Philipp Berens, Haim Sompolinsky, and Andreas S Tolias.
Object manifold geometry across the mouse cortical visual hierarchy.
BioRxiv, pages 2020–08, 2020.
- [21]
Juan A Gallego, Matthew G Perich, Stephanie N Naufel, Christian Ethier, Sara A Solla, and Lee E Miller.
Cortical population activity within a preserved neural manifold underlies multiple motor behaviors.
Nature communications, 9(1):4233, 2018.
- [22]
Guy Gaziv, Michael Lee, and James J DiCarlo.
Strong and precise modulation of human percepts via robustified anns.
Advances in Neural Information Processing Systems, 36:65936–65947, 2023.
- [23]
Robert Geirhos, Carlos RM Temme, Jonas Rauber, Heiko H Schütt, Matthias Bethge, and Felix A Wichmann.
Generalisation in humans and deep neural networks.
Advances in neural information processing systems, 31, 2018.
- [24]
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy.
Explaining and harnessing adversarial examples.
arXiv preprint arXiv:1412.6572, 2014.
- [25]
Kalanit Grill-Spector, Tammar Kushnir, Shimon Edelman, Galia Avidan, Yacov Itzchak, and Rafael Malach.
Differential processing of objects under various viewing conditions in the human lateral occipital complex.
Neuron, 24(1):187–203, 1999.
- [26]
Caglar Gulcehre, Marcin Moczulski, Misha Denil, and Yoshua Bengio.
Noisy activation functions.
In International conference on machine learning, pages 3059–3068. PMLR, 2016.
- [27]
Chong Guo, Michael Lee, Guillaume Leclerc, Joel Dapello, Yug Rao, Aleksander Madry, and James Dicarlo.
Adversarially trained neural representations are already as robust as biological neural representations.
In International Conference on Machine Learning, pages 8072–8081. PMLR, 2022.
- [28]
James V Haxby, J Swaroop Guntupalli, Samuel A Nastase, and Ma Feilong.
Hyperalignment: Modeling shared information encoded in idiosyncratic cortical topographies.
elife, 9:e56601, 2020.
- [29]
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun.
Deep residual learning for image recognition.
In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016.
- [30]
Ha Hong, Daniel LK Yamins, Najib J Majaj, and James J DiCarlo.
Explicit information for category-orthogonal object properties increases along the ventral stream.
Nature neuroscience, 19(4):613–622, 2016.
- [31]
Marius Cătălin Iordan, Michelle R Greene, Diane M Beck, and Li Fei-Fei.
Basic level category structure emerges gradually across human ventral visual cortex.
Journal of cognitive neuroscience, 27(7):1427–1446, 2015.
- [32]
Leyla Isik, Ethan M Meyers, Joel Z Leibo, and Tomaso Poggio.
The dynamics of invariant object recognition in the human visual system.
Journal of neurophysiology, 111(1):91–102, 2014.
- [33]
Nancy Kanwisher, Josh McDermott, and Marvin M Chun.
The fusiform face area: a module in human extrastriate cortex specialized for face perception.
Journal of neuroscience, 17(11):4302–4311, 1997.
- [34]
Meenakshi Khosla, Keith Jamison, Amy Kuceyeski, and Mert Sabuncu.
Characterizing the ventral visual stream with response-optimized neural encoding models.
Advances in Neural Information Processing Systems, 35:9389–9402, 2022.
- [35]
Talia Konkle and George Alvarez.
Cognitive steering in deep neural networks via long-range modulatory feedback connections.
Advances in Neural Information Processing Systems, 36:21613–21634, 2023.
- [36]
Dwight J Kravitz, Kadharbatcha S Saleem, Chris I Baker, Leslie G Ungerleider, and Mortimer Mishkin.
The ventral visual pathway: an expanded neural framework for the processing of object quality.
Trends in cognitive sciences, 17(1):26–49, 2013.
- [37]
Nikolaus Kriegeskorte, Marieke Mur, and Peter A Bandettini.
Representational similarity analysis-connecting the branches of systems neuroscience.
Frontiers in systems neuroscience, 2:249, 2008.
- [38]
Alex Krizhevsky, Geoffrey Hinton, et al.
Learning multiple layers of features from tiny images.
2009.
- [39]
Jonas Larsson and David J Heeger.
Two retinotopic visual areas in human lateral occipital cortex.
Journal of neuroscience, 26(51):13128–13142, 2006.
- [40]
Tai Sing Lee and David Mumford.
Hierarchical bayesian inference in the visual cortex.
Journal of the Optical Society of America A, 20(7):1434–1448, 2003.
- [41]
Zhe Li, Wieland Brendel, Edgar Walker, Erick Cobos, Taliah Muhammad, Jacob Reimer, Matthias Bethge, Fabian Sinz, Zachary Pitkow, and Andreas Tolias.
Learning from brains how to regularize machines.
Advances in neural information processing systems, 32, 2019.
- [42]
Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick.
Microsoft coco: Common objects in context.
In Computer vision–ECCV 2014: 13th European conference, zurich, Switzerland, September 6-12, 2014, proceedings, part v 13, pages 740–755. Springer, 2014.
- [43]
Ilya Loshchilov and Frank Hutter.
Decoupled weight decay regularization.
arXiv preprint arXiv:1711.05101, 2017.
- [44]
Yantao Lu, Yunhan Jia, Jianyu Wang, Bai Li, Weiheng Chai, Lawrence Carin, and Senem Velipasalar.
Enhancing cross-task black-box transferability of adversarial examples with dispersion reduction.
In Proceedings of the IEEE/CVF conference on Computer Vision and Pattern Recognition, pages 940–949, 2020.
- [45]
Zitong Lu and Yile Wang.
Teaching cornet human fmri representations for enhanced model-brain alignment.
Cognitive Neurodynamics, 19(1):61, 2025.
- [46]
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu.
Towards deep learning models resistant to adversarial attacks.
arXiv preprint arXiv:1706.06083, 2017.
- [47]
David Marr.
Vision: A computational investigation into the human representation and processing of visual information.
MIT press, 2010.
- [48]
Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard.
Deepfool: a simple and accurate method to fool deep neural networks.
In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 2574–2582, 2016.
- [49]
Omer Moussa, Dietrich Klakow, and Mariya Toneva.
Improving semantic understanding in speech language models via brain-tuning.
In The Thirteenth International Conference on Learning Representations, 2025.
- [50]
Laura B Naumann, Joram Keijser, and Henning Sprekeler.
Invariant neural subspaces maintained by feedback modulation.
Elife, 11:e76096, 2022.
- [51]
Nicolas Papernot, Patrick McDaniel, and Ian Goodfellow.
Transferability in machine learning: from phenomena to black-box attacks using adversarial samples.
arXiv preprint arXiv:1605.07277, 2016.
- [52]
Nicolas Papernot, Patrick McDaniel, Arunesh Sinha, and Michael P Wellman.
Sok: Security and privacy in machine learning.
In 2018 IEEE European symposium on security and privacy (EuroS&P), pages 399–414. IEEE, 2018.
- [53]
Kishore Papineni, Salim Roukos, Todd Ward, and Wei-Jing Zhu.
Bleu: a method for automatic evaluation of machine translation.
In Proceedings of the 40th annual meeting of the Association for Computational Linguistics, pages 311–318, 2002.
- [54]
R Quian Quiroga, Leila Reddy, Gabriel Kreiman, Christof Koch, and Itzhak Fried.
Invariant visual representation by single neurons in the human brain.
Nature, 435(7045):1102–1107, 2005.
- [55]
Luke E Richards, André Nguyen, Ryan Capps, Steven Forsyth, Cynthia Matuszek, and Edward Raff.
Adversarial transfer attacks with unknown data and class overlap.
In Proceedings of the 14th ACM workshop on artificial intelligence and security, pages 13–24, 2021.
- [56]
Mihaela Rosca, Theophane Weber, Arthur Gretton, and Shakir Mohamed.
A case for new neural network smoothness constraints.
NeurIPS Workshops on ”I Can’t Believe It’s Not Better!”, pages 21–32, 2020.
- [57]
Nicole C Rust and James J DiCarlo.
Selectivity and tolerance (“invariance”) both increase as visual information propagates from cortical area v4 to it.
Journal of Neuroscience, 30(39):12978–12995, 2010.
- [58]
Shahd Safarani, Arne Nix, Konstantin Willeke, Santiago Cadena, Kelli Restivo, George Denfield, Andreas Tolias, and Fabian Sinz.
Towards robust vision by multi-task learning on monkey visual cortex.
Advances in Neural Information Processing Systems, 34:739–751, 2021.
- [59]
Rylan Schaeffer, Victor Lecomte, Dhruv Bhandarkar Pai, Andres Carranza, Berivan Isik, Alyssa Unell, Mikail Khona, Thomas Yerxa, Yann LeCun, SueYeon Chung, et al.
Towards an improved understanding and utilization of maximum manifold capacity representations.
arXiv preprint arXiv:2406.09366, 2024.
- [60]
Thomas Serre, Aude Oliva, and Tomaso Poggio.
A feedforward architecture accounts for rapid categorization.
Proceedings of the national academy of sciences, 104(15):6424–6429, 2007.
- [61]
Baifeng Shi, Trevor Darrell, and Xin Wang.
Top-down visual attention from analysis by synthesis.
In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 2102–2112, 2023.
- [62]
Jacqueline C Snow and Jody C Culham.
The treachery of images: how realism influences brain and behavior.
Trends in Cognitive Sciences, 25(6):506–519, 2021.
- [63]
Ilia Sucholutsky, Lukas Muttenthaler, Adrian Weller, Andi Peng, Andreea Bobu, Been Kim, Bradley C Love, Erin Grant, Iris Groen, Jascha Achterberg, et al.
Getting aligned on representational alignment.
arXiv preprint arXiv:2310.13018, 2023.
- [64]
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus.
Intriguing properties of neural networks.
arXiv preprint arXiv:1312.6199, 2013.
- [65]
Joshua B Tenenbaum, Vin de Silva, and John C Langford.
A global geometric framework for nonlinear dimensionality reduction.
science, 290(5500):2319–2323, 2000.
- [66]
Vijay Veerabadran, Josh Goldman, Shreya Shankar, Brian Cheung, Nicolas Papernot, Alexey Kurakin, Ian Goodfellow, Jonathon Shlens, Jascha Sohl-Dickstein, Michael C Mozer, et al.
Subtle adversarial image manipulations influence both human and machine perception.
Nature Communications, 14(1):4933, 2023.
- [67]
Hermann Von Helmholtz.
Helmholtz’s treatise on physiological optics, volume 3.
Optical Society of America, 1925.
- [68]
Patrik Vuilleumier, RN Henson, J Driver, and Raymond J Dolan.
Multiple levels of visual object constancy revealed by event-related fmri of repetition priming.
Nature neuroscience, 5(5):491–499, 2002.
- [69]
Kelvin Xu, Jimmy Ba, Ryan Kiros, Kyunghyun Cho, Aaron Courville, Ruslan Salakhudinov, Rich Zemel, and Yoshua Bengio.
Show, attend and tell: Neural image caption generation with visual attention.
In International conference on machine learning, pages 2048–2057. PMLR, 2015.
- [70]
Daniel LK Yamins, Ha Hong, Charles F Cadieu, Ethan A Solomon, Darren Seibert, and James J DiCarlo.
Performance-optimized hierarchical models predict neural responses in higher visual cortex.
Proceedings of the national academy of sciences, 111(23):8619–8624, 2014.
- [71]
Zhuolin Yang, Linyi Li, Xiaojun Xu, Shiliang Zuo, Qian Chen, Pan Zhou, Benjamin Rubinstein, Ce Zhang, and Bo Li.
Trs: Transferability reduced ensemble via promoting gradient diversity and model smoothness.
Advances in Neural Information Processing Systems, 34:17642–17655, 2021.
- [72]
Thomas Yerxa, Yilun Kuang, Eero Simoncelli, and SueYeon Chung.
Learning efficient coding of natural images with maximum manifold capacity representations.
Advances in Neural Information Processing Systems, 36:24103–24128, 2023.
- [73]
Fuxun Yu, Zhuwei Qin, Chenchen Liu, Liang Zhao, Yanzhi Wang, and Xiang Chen.
Interpreting and evaluating neural network robustness.
arXiv preprint arXiv:1905.04270, 2019.
- [74]
Davide Zoccolan, Minjoon Kouh, Tomaso Poggio, and James J DiCarlo.
Trade-off between object selectivity and tolerance in monkey inferotemporal cortex.
Journal of Neuroscience, 27(45):12292–12307, 2007.

## Appendix A Selection of Brain Regions of Interest (ROIs)

We focused on ROIs spanning the VVS from early visual areas to higher-order object-selective cortices along the ventrolateral surface of the brain. Specifically, we selected seven ROIs: V1, V2, V4, VO (Ventral-Occipital), PHC (posterior Parahippocampal Cortex), LO (Lateral-Occipital), and TO (Temporal-Occipital) (illustrated in Fig. [1](https://arxiv.org/html/2405.02564v2#S3.F1)B).

V1 and V2 are retinotopically organized areas known for processing low-level details [47] and represent the initial stages of the cortical processing hierarchy. V4 serves as an intermediate stage. While not yet exhibiting a pronounced preference for objects, V4 demonstrates early signs of invariance [57]. Further along the ventral cortex lie VO and PHC. VO is positioned immediately anterior to V4 with a demonstrated object preference [9], while PHC, located further anterior and overlapping with the Parahippocampal Place Area (PPA) starts to show preference for scenes [2], indicative of its capability to extract global information. LO on the lateral surface, which includes LO1 and LO2, overlaps with the relatively posterior section of the functionally defined Lateral Occipital Complex (LOC) [39], commonly recognized for its holistic shape processing capabilities [25]. Finally, TO, although less frequently investigated on its own in relation to object recognition, is situated anterior to LO, and potentially encompasses the more anterior portion of LOC [39].

Figure: Figure 5: Schematic illustration of expected robustness improvements hierarchy across the seven ROIs included in our study.
Refer to caption: x5.png

Importantly, we do not assume a strictly linear progression of robustness across all higher-order regions. In particular, based on the anatomical positions and functional roles described above, we expect V4 to confer greater robustness than V2 and V1, with all these three early visual areas trailing the higher-level regions. We also expect PHC to confer more robustness than VO due to its scene-level integration, and TO to outperform LO as a more anterior and potentially more abstract object-selective area. However, the relative contributions between the ventral (VO–PHC) and lateral (LO–TO) pairs remain an open question. Therefore, we expect a fork-like hierarchical pattern, where the ventral (VO–PHC) and lateral (LO–TO) ROI pairs may show parallel robustness trends, with a clear progression within each branch (see schematic illustration in Fig. [5](https://arxiv.org/html/2405.02564v2#A1.F5)). This pattern can indeed be observed across our replication experiments (lower rows in Fig. [7](https://arxiv.org/html/2405.02564v2#A3.F7), [8](https://arxiv.org/html/2405.02564v2#A3.F8), and [9](https://arxiv.org/html/2405.02564v2#A3.F9)).

## Appendix B Neural predictor quality check

We conducted evaluation and control experiments to ensure the quality of the neural predictors used in training NG models. Importantly, we show results from three other NSD subject (Subject-2, 5, and 7) in addition to Subject-1 focused on in the main text, as their data were used for replication experiments in Appendix [C.1](https://arxiv.org/html/2405.02564v2#A3.SS1). These four subjects were selected among the eight subjects included in the NSD, because of their completion of the full natural image viewing seccion in NSD, thus providing a more adequate dataset for training the neural predictors.

We evaluated prediction quality by computing Pearson’s $r$ between predicted and actual neural response patterns for each ROI (see Fig.[6](https://arxiv.org/html/2405.02564v2#A2.F6)). We show the noise ceiling, as vertical bars, estimated using split-half correlations with Spearman-Brown correction [70], leveraging repeated image presentations in NSD. As can be observed, across all four subjects, neural predictors achieved performance approaching this noise-bounded upper limit.

To confirm that these correlations reflect meaningful learning rather than fitting noises in the fMRI data, we trained control predictors on shuffled data from Subject-1. Specifically, for each input image, we assigned a randomly selected, non-corresponding neural response as the ground truth. However, the integrity of the input-output correspondence was maintained during testing. Therefore, if the correlations can still be observed under these shuffling conditions, then this would suggest that the neural predictors are fitting neural-characteristic noises. However, as shown in Fig. [6](https://arxiv.org/html/2405.02564v2#A2.F6), predictors trained on this shuffled data consistently performed near chance across all ROIs, validating that the original predictors learned informative, image-relevant representations.

We emphasize that these shuffled predictors were used solely for model validation and were discarded before our main analyses. The “V1-shuffle" and “TO-shuffle" conditions in the NG model experiments instead used predictors trained on valid neural data (see Methods in the main text for details) .

Figure: Figure 6: Quality checks of the neural predictors, shown as Pearson’s r correlation between the predicted neural responses and the actual human recordings. Vertical bars indicate the noise-bounded upper limit of neural predictor performance, estimated using split-half correlations with Spearman-Brown correction [70] for each ROI. In Subject-1, we included shuffled conditions (“Shuffled TO” and “Shuffled V1”) served as baseline conditions to show that the neural predictos are indeed learning meaningful information (see Appendix [B](https://arxiv.org/html/2405.02564v2#A2)).
Refer to caption: x6.png

## Appendix C Replicating robustness improvement hierarchy from Neural Guidance

### C.1 Across additional NSD subjects

To assess the consistency of our findings across individuals, we trained NG-models using three additional NSD participants (Subjects 2, 5, and 7), each of whom, as described above, completed the full natural image viewing sessions and thus allowing sufficient data for training. We evaluated robustness improvements under untargeted $l_{\infty}$-based PGD attacks. As shown in Fig.[7](https://arxiv.org/html/2405.02564v2#A3.F7), all three subjects exhibited the same hierarchical trend observed in Subject 1 (main text Fig.[2](https://arxiv.org/html/2405.02564v2#S4.F2)): models guided by later visual areas consistently demonstrated greater robustness gains than those guided by early regions.

To quantify the consistency in the robustness hierarchy, we computed $\Delta$AUC between each NG model and the baseline (None) model and assessed the correlation in robustness hierarchies across subjects. Spearman’s $\rho$ values showed statistically significant alignment with the hierarchy observed in Subject 1 (see the lower row of Fig.[7](https://arxiv.org/html/2405.02564v2#A3.F7)). We note that the variability in magnitude is expected, potentially because of both individual differences and variances in the quality of neural data as well as neural predictors, as reflected by noise ceilings and predictor performance in Fig.[6](https://arxiv.org/html/2405.02564v2#A2.F6).

Figure: Figure 7: Top: $l_{\infty}$-PGD attack performance for NG-models guided by Subject-2, 5, and 7 in the NSD dataset. Bottom: The robustness improvement measured in $\Delta$AUC observed for these additional subjects (x-axis) show significant correlation with that of Subject-1 (y-axis), validating the results across individuals.
Refer to caption: x7.png

### C.2 Across adversarial attacks

We further tested whether the hierarchical robustness improvement observed in NG-models generalizes across different types of adversarial attacks. Using NG-models trained on Subject 1, we evaluated their robustness under four additional attack benchmarks: 1. $l_{\infty}$-based AutoAttack [13], which aggregates several attack methods including FAB, Square Attack, APGD-CE, and APGD-DLR; 2. $l_{\infty}$-based Fast Gradient Sign Method (FGSM) [24]; 3. $l_{2}$-based Fast Gradient Method (FGM) attack [24]; and 4. $l_{2}$-based DeepFool attack [48].

Despite variations in absolute accuracy, all attack types reproduced the same hierarchical trend: models guided by higher-level ROIs consistently exhibited greater robustness. We quantified this alignment in hierarchy by computing Spearman’s $\rho$ between robustness gains ($\Delta$AUC) from each ROI under each attack and those under the $l_{\infty}$-based PGD attack reported in the main text. All correlations were statistically significant (Fig.[8](https://arxiv.org/html/2405.02564v2#A3.F8), lower row), confirming that the observed hierarchy is robust across a range of attack benchmarks.

Figure: Figure 8: Top: Robustness of NG-models trained with neural data from Subject-1 under four alternative adversarial attacks. Bottom: Robustness improvement hierarchies under these attacks (x-axis) compared to the original $l_{\infty}$-based PGD results (y-axis) reported in the main text. Spearman’s $\rho$ values indicate significant correspondence across attack types.
Refer to caption: x8.png

### C.3 Across alternate tasks and datasets

Figure: Figure 9: Top: Robustness of NG-models trained with Subject-1 evaluated on CIFAR-100 classification (left) and MSCOCO image captioning (right) tasks under $l_{\infty}$-based PGD attacks. Black squares and arrows indicate zoomed-in regions for visibility. For the captioning task, the shaded green region highlights the $\epsilon$ range where the hierarchical robustness pattern emerges. Bottom: Robustness improvement hierarchies (measured by $\Delta$AUC) from the two tasks (x-axis) compared to the ImageNet classification results (y-axis) reported in the main text. Significant correlations again confirm the replicability of the hierarchical effect across tasks and datasets.
Refer to caption: x9.png

#### CIFAR-100

To assess the effect of neural guidance on a dataset with different visual statistics, we replicated our experiment using another classic classification benchmark, CIFAR-100 [38]. We used Subject-1’s neural data and trained seven additional NG-models, one for each ROI. Given the resolution mismatch with the NSD images (227$\times$227, 32$\times$32 for CIFAR-100), we adapted both the neural predictors and NG-models: we modified the initial convolutional layer (Conv1) of both of the DNNs by reducing both the kernel size (reduced from 7 to 3) and stride (reduced from 2 to 1) to better accommodate the smaller image size. For neural predictors, we trained them with MSCOCO images (those shown to the participants in NSD) that are downsampled to CIFAR-100 resolution for better generalizability.

The NG-models were then evaluated under the same $l_{\infty}$-based PGD attack. As shown in Fig. [9](https://arxiv.org/html/2405.02564v2#A3.F9), while the overall robustness gains were reduced, potentially due to the limited generalization of neural predictors trained on MSCOCO images to CIFAR-100, the hierarchical pattern of robustness across ROIs was preserved. As in previous experiments, we observed a significant Spearman’s $\rho$ between the $\Delta$AUC values and the VVS hierarchy.

#### Image captioning with MSCOCO

To test whether the robustness benefit of neural guidance generalizes beyond classification, we evaluated the NG-models on an image captioning task. Following standard practice, we used each NG-model’s convolutional backbone (with both heads removed and weights frozen) as a feature extractor, and paired it with a standard LSTM-based decoder equipped with an attention module [69]. The decoder was initialized with pre-trained weights and then fine-tuned on MSCOCO images viewed by Subject-1 in NSD (the same images used for training the neural predictors). This is to ensure that both the predictors and decoders operate on similar visual content to maximize the transferability. Evaluation was then performed using standard BLEU scores [53]. To assess robustness, we applied the same $l_{\infty}$-based PGD attacks used in the classification experiments.

As shown in Fig. [9](https://arxiv.org/html/2405.02564v2#A3.F9), despite overall smaller effect sizes, likely due to the decoder being trained on frozen representations from a classification-focused model, we again observed a consistent robustness hierarchy. NG-models guided by higher-order ROIs produced captions that were more robust to adversarial perturbations, particularly at higher attack strengths (see green region in Fig. [9](https://arxiv.org/html/2405.02564v2#A3.F9)), mirroring the patterns observed in classification tasks. Therefore, we were able to show a replication of the robustness improvement hierarchy from neural guidance in the context of image captioning as well.

## Appendix D Uniqueness of NG-models in output surfaces and representational spaces

### D.1 WD-models

To demonstrate that NG-models achieve a unique output surface and representational space that differs from conventional regularization techniques, we trained additional ResNet-18 models (“WD-models”) on the ImageNet-50 dataset. These models were trained by varying the weight decay parameter [43], a common method for imposing regularization [56]. For a better comparison, we selected five distinct weight decay values, targeting multiple robustness levels within a relatively comparable range comparable to those observed in neural-guided models, as shown in Fig. [10](https://arxiv.org/html/2405.02564v2#A4.F10).

Figure: Figure 10: Robustness performance of WD-models trained with five different weight deays values to impose stronger regularization under $l_{\infty}$-based PGD attacks. The gradient of performance is comparable to those observed with Neural Guidance (Fig. [2](https://arxiv.org/html/2405.02564v2#S4.F2)A).
Refer to caption: x10.png

### D.2 Smoothness check

A key characteristic observed of robust models is their association with smoother output surfaces or more slowly changing loss landscapes with respect to the input images [73]. Adversarial attacks exploit irregular and complex output surfaces, which facilitates the search for adversarial examples via gradient descent and creates numerous adversarial examples around each correctly classified data sample. Regularization methods such as the straightforward WD manipulation we here adopted [43, 56], along with other more sophisticated defenses [11] all leverage this insight to smooth the neural network function.

On the other hand, from a representational perspective smooth output surfaces may also arise as a natural consequence of operating on a well-structured representational space. In such a space, semantically similar images—including perturbed instances—are mapped to nearby locations, ideally lying on tighter and disentangled category manifolds [10, 17]. Linear decision boundaries can then more easily separate category manifolds that include all identity-preserving transformations of object instances. Therefore, we should expect NG-models to also show smoother output surfaces if neural guidance induces more ideally structured representational geometry.

Given an input data $x$, ground truth $y$, and the loss function $\ell_{\theta}$, we first quantified models’ smoothness loss [71] as the “worst" smoothness in a given data point $x$’s $l_{\infty}$-based neighborhood:

$$ $L_{\text{smooth}}(\ell,\theta,x,y)=\max_{\|\hat{x}-x\|_{\infty}}\|\nabla_{\hat {x}}\ell_{\theta}(\hat{x},y)\|_{2}$ (6) $$

where $\hat{x}$ is the adversarial image obtained using PGD optimization. We then calculate the gradient norm of the loss with respect to $\hat{x}$. Note that for this quantification, higher values suggest larger gradients, steeper slopes, and therefore less smooth surfaces. For clarity, we applied the following transformation: $e^{-L_{\text{smooth}}}$ so that higher smoothness scores correspond to a smoother output surface.

As shown in Fig. [11](https://arxiv.org/html/2405.02564v2#A4.F11)B, WD-based regularization produced the expected monotonic increase in output surface smoothness with increasing WD magnitude. As predicted, NG models also exhibited enhanced smoothness compared to the baseline None model Fig. [11](https://arxiv.org/html/2405.02564v2#A4.F11)A. Interestingly, even the control models (random, V1-shuffle, TO-shuffle) showed moderate smoothing effects, consistent with the long observed benefits of noise injection [26]. However, all NG-models outperformed these baselines in smoothness across neighborhood radii, with later-region models exhibiting the greatest effects. This hierarchy also largely mirrored that of robustness improvement reported in the main text.

Figure: Figure 11: Output surface smoothness scores for (A) NG-models and (B)WD-models. Higher values denote smoother output surface.
Refer to caption: x11.png

### D.3 Transfer attack

To further assess the similarity of the loss landscape with respect to input images between NG models and the WD models trained with conventional regularization methods, we employed transfer attacks [51] as an alternative evaluative measure. Specifically, adversarial examples were generated using the $l_{\infty}$-based PGD attack by attacking the standard “None” model, which had undergone only fine-tuning on the ImageNet-50 dataset. These adversarial examples were then applied to both the set of five WD-models and the seven NG models to evaluate their classification accuracy on these perturbed inputs. Poor accuracy then indicates compromised performance and thus a greater similarity in the loss landscape, or more precisely, the positioning of adversarial examples, between the source “None” model and the target model.

As expected, when attacking NG models using adversarial examples generated from the None model, neurally-guided models showed superior robustness compared to all baseline models (Fig. [12](https://arxiv.org/html/2405.02564v2#A4.F12)A), again with hierarchically later regions exhibiting increasingly better resistance to transfer attacks. Importantly, a similar increase in resistance to the transfer attack was also observed in WD-models (Fig. [12](https://arxiv.org/html/2405.02564v2#A4.F12)B) given that increased smoothness should generally lead to fewer vulnerabilities to be exploited. Such a result might tempt one to consider the hierarchical improvement in robustness observed in NG models as simply a reflection of the increasing regularization. Importantly, however, as we showed in the main text (Fig. [2](https://arxiv.org/html/2405.02564v2#S4.F2)B) with comparable and even lower native robustness, neurally-guided models consistently outperformed WD-models in resisting transfer attacks. Therefore, NG-models developed not only more smooth and thus robust output surface, but also uniquely different ones from conventional regularization effect.

Figure: Figure 12: Transfer attack performance (assessed using adversarial examples generated from the None-model—a standard ResNet-18 DNN trained on the ImageNet classification task only) for (A) NG-models and (B) WD-models.
Refer to caption: x12.png

### D.4 Representational Similarity Analysis (RSA)

We applied RSA [37] to assess the similarity of representational spaces across all models and human ROIs. To enable direct comparison with human ROIs, we used the MSCOCO images presented during the NSD experiment to construct representational spaces. For all DNNs, we extracted 1D feature vectors from the average-pooling layer for each image. We then computed pairwise Euclidean distances between all image features to form a Representational Dissimilarity Matrix (RDM) for each model. Subsequently, we computed Spearman’s $\rho$ correlations between RDMs to produce a Representational Similarity Matrix (RSM), capturing pairwise similarities among the representational spaces of all models and human ROIs. To produce the visualization in Fig, [2](https://arxiv.org/html/2405.02564v2#S4.F2)C, we applied Multidimensional Scaling (MDS) to the RSM, embedding the models into a three-dimensional space where models or ROIs with more similar representational spaces are positioned closer together.

## Appendix E Neural category manifolds

### E.1 Selection of images for analyzing human neural manifolds

To estimate category manifold properties, extent and linear separability, using the MFTMA framework [10], we need multiple representative samples per object category. For NG-models trained on ImageNet-50, this process was straightforward: we used the test set with 50 categories and 100 samples per category (50 original and 50 perturbed images). However, for human neural data from the NSD, selecting appropriate category-level samples was more challenging. NSD participants viewed naturalistic images from the MSCOCO dataset [42], which is curated for tasks such as object detection and segmentation and often contains complex scenes with multiple overlapping objects (see Fig. [13](https://arxiv.org/html/2405.02564v2#A5.F13)A for an example), making them unsuitable for object-centric manifold analysis.

To address this, we curated a subset of images viewed by Subject-1 that were more appropriate for representing single-object categories. Our filtering procedure was as follows: For each image, we identified whether it contained only one object category or whether one object category occupied a significantly larger area (based on aggregated bounding box area) than all other objects combined. If either of the conditions was satisfied, we assigned the image to the dominant object category. Within each selected category, we ranked the images by object size (bounding box area aggregated across all instances of the dominant object category) in descending order and retained the top 50 images per category to serve as category manifold samples. This process yielded a final set of 12 object categories with more appropriate single-object exemplars for MFTMA (see Fig. [13](https://arxiv.org/html/2405.02564v2#A5.F13)B for the selected categories and representative examples).

Figure: Figure 13: (A): Example MSCOCO image presented to NSD participants containing multiple prominent objects, making it unsuitable for category-level manifold analysis. (B): The 12 object categories selected for human neural manifold analysis using MFTMA, each illustrated with an example image containing a single, dominant object.
Refer to caption: x13.png

### E.2 Category manifolds visualization

To visually illustrate how category manifolds are transformed across the human VVS, we applied Isomap to neural representations of three example categories (elephant, clock, and train) selected from the 12 filtered categories described above. We performed this separately for V1, V4, and TO, representing early, intermediate, and higher-order regions in the VVS, respectively (see Fig. [3](https://arxiv.org/html/2405.02564v2#S4.F3)A).

Following the manifold disentangling hypothesis [17], which posits that identity-preserving transformations of objects form continuous and separable manifolds, we treated each category as an independent manifold. Isomap was thus applied independently to each category’s high-dimensional neural representations to obtain their 3D embeddings. However, since Isomap embeddings give arbitrary rotation and translation, we registered all manifolds into a common visualization space so that we can compare their relative position, extent and orientation. Specifically, we first extracted a shared 3D basis using the original high-dimensional neural representations with Principal Component Analysis (PCA). We then projected all representations into this common space, and they serve as targeted references for alignment. For each category, we used orthogonal Procrustes analysis to find the optimal rotation that aligned its Isomap embedding to the corresponding projection in the common space. This ensured that manifold shape and internal geometry obtained using Isomap were preserved while aligning all manifolds into the same coordinate system. Finally, each aligned manifold was translated to match the centroid of its corresponding PCA-projected reference and rescaled to match its average spread, thus enabling meaningful visual comparison of scale and spacing.

This visualization illustrates that category manifolds become increasingly compact (smaller extent, as reflected by the decreasing axis ranges in Fig. [3](https://arxiv.org/html/2405.02564v2#S4.F3)A) and appear more separated from one another in the higher-order visual area TO compared to others. We note that this analysis is intended for illustrative purposes only. For the quantitative assessment of overall manifold properties, we refer readers to the MFTMA-based analyses reported in the main text.

## Peer Reviews

confidence: 4
contribution: 2
initial_rating: 6
presentation: 3
questions: - Does the manifold geometry cause robustness, or do both come from some other property of neural representations? Could you test this by techniques such as directly controlling manifold properties independent of neural guidance?
- What if you train a model to align to different VVS regions simultaneously? Would this provide the model with more information and help improve robustness? 
- There are many other robustness measures which come from human-model misalignment, such as common corruptions and out-of-distribution scenarios. Would the findings generalize to those scenarios?
soundness: 3
strengths: - **Clear motivation and novel systematic investigation.** The paper studies and improves modes’ adversarial robustness via the alignment between DNNs and human visual systems. It provides a systematic examination of how robustness evolves across multiple consecutive human VVS regions, which is different from prior work that focuses on isolated areas such as just V1 or IT. This provides valuable insights into the hierarchical nature of visual robustness.
- **Rigorous experimental design and statistical analysis.** I find this paper especially interesting because it goes beyond only demonstrating the phenomenon but analyze how it occurs with the MFTMA analysis and further claims the importance of geometric structure with the manifold guidance experiments. The evaluation includes multiple baseline conditions, various NSD subjects (Figure 7), adversarial attacks and configurations (Figure 8), and tasks (Figure 9). 
- **Clear Presentation.** The paper is well-written with clear communication of the methodology and evaluation. Well-designed visualizations help make the concepts of the alignment between human visual system and DNNs accessible.
summary: This paper studies whether aligning DNNs to human neural responses with specifically-designed techniques can improve adversarial robustness. The authors proposed a dual-head architecture to train ResNet models with “neural guidance” by simultaneously optimizing classification tasks and alignment to fMRI responses from seven VVS regions. The study shows that guidance from higher-order VVS regions leads to greater robustness against adversarial attacks. To analyze and explain this phenomenon, they apply statistical modeling, Mean-Field Theoretic Manifold Analysis, and show that human neural category manifolds become less diffuse and more linearly separable along the VVS hierarchy. Finally, as opposed to point-to-point guidance, the authors introduce “manifold guidance” to match coarse geometric properties and effectively reproduce the hierarchical robustness effect.
weaknesses: We thank the authors for submitting the paper to ICLR 2026! There are a few weaknesses listed below which I believe can make the paper better.
- **Limited absolute robustness gain.** While the hierarchical pattern is consistent, with results from different NSD subjects, the absolute robustness improvements of TO-guided models are small. They still show substantial vulnerability to adversarial perturbations which are imperceptible to humans. The authors already acknowledge this limitation but more further insights on future approaches which can scale to human-level robustness or if there is an existence of fundamental barriers would make the work more significant to the field. 
- **Manifold guidance limitations.** While manifold guidance reproduces the hierarchical pattern, the absolute improvements are very limited (Figure 4B). The linear approximation of manifold geometry seem to be too coarse. It would be good to see what additional information beyond manifold structure contributes to adversarial robustness in the full neural guidance condition. 
- **Architecture generalization and other related work.** The paper focuses on ResNet architectures, it is unclear whether the findings can generalize to widely-used architectures such as vision transformers, other CNN architectures, and biologically-inspired architectures such as CORnet. Also, many defense mechanisms seem related but not discussed in the paper such as biologically-inspired defenses beyond neural alignment, adversarial training which also improves manifold geometric, etc.

---

confidence: 5
contribution: 4
initial_rating: 6
presentation: 3
questions: Could the authors quantify how fMRI signal noise or predictor quality influences the strength of the robustness hierarchy?


Would the same hierarchical effect persist if neural alignment were performed using multi-subject averaged representations rather than subject-specific ROIs?


Can the manifold guidance loss be extended to self-supervised or contrastive settings to assess scalability beyond supervised classification?


How do the authors interpret the trade-off between accuracy and robustness observed in later VVS-guided models?

The authors have a few missing citations: In line 40 around the unnatural image degradations, the authors should missed Extreme Image Transforms (EITs) [Crowder et al., 2022; Malik et al., 2023, Biol Cybernetics, Malik et al., 2023, arXiv] which present a novel view of structural changes in the input images. 

When comparing previous work of Dapello et al., the authors should consider comparing their work to VOneNet [Dapello et al., 2020, NeurIPS], which fails under similar circumstances as EITs and is not widely tested on datasets like ImageNet-C [Hendrycks et al, 2019, ICLR]. 

The authors have uploaded a zip file for the code, but are encouraged to release it online on a publicly accessible platform.
soundness: 3
strengths: Strong experimental validation: multiple controls, cross-subject replication, and attack-type diversity.


Novel conceptual framing: robustness as a byproduct of manifold geometry inherited from neural data.


Elegant theoretical integration: combines neuroscience principles with modern robustness evaluation.


High reproducibility: clear methodological exposition, use of open datasets (NSD), and code availability.


Mechanistic insight: links representational geometry to robustness, moving beyond surface-level performance metrics.
summary: The paper investigates the neural mechanisms underlying human visual robustness and explores how these can be transferred to deep neural networks (DNNs). Specifically, the authors test the hypothesis that robustness in human vision arises progressively along the ventral visual stream (VVS)—from early visual areas (V1, V2) to higher-order regions (e.g., TO, PHC)—rather than being localized solely in specialized cortical areas.
To evaluate this, the authors train DNNs to align their internal representations with human neural responses from consecutive VVS regions using data from the Natural Scenes Dataset (NSD). They demonstrate that DNNs aligned to later visual areas exhibit greater adversarial robustness than those aligned to early areas, establishing a clear hierarchy. The study further connects this effect to the geometry of category manifolds in neural representational space—showing that smaller manifold extent and greater linear separability in higher-order regions predict improved robustness. Finally, the authors introduce “manifold guidance”, aligning DNN category manifold geometry (rather than individual activations) with human neural manifolds, and find that it qualitatively reproduces the hierarchical robustness pattern.
weaknesses: The reliance on fMRI-based predictors limits representational precision; neural alignment fidelity could improve with higher-resolution data (e.g., intracranial recordings).


The scope of tasks (primarily object classification) is limited; extending analyses to temporal or contextual visual understanding would strengthen generalization claims.


Manifold guidance, while promising, remains a coarse approximation; incorporating nonlinear manifold constraints could further clarify its efficacy.


The current framework does not model feedback and recurrence, known to be crucial for human visual robustness.

---

confidence: 3
contribution: 3
initial_rating: 6
presentation: 2
questions: * How does the performance of a DNN trained with neural guidance compare to an adversarially trained model in terms of robustness to adversarial examples?
* Are the results architecture dependent? Did you run experiments on anything other than ResNet architectures?
* Is the manifold guidance method of training useful outside of the neural guidance framework? Would you expect to see similar improvements in robustness if the manifolds for each class were not derived from neural data and instead chosen in some other (possibly unsupervised) way?
* How do your neural and manifold guidance loss terms impact the time complexity of model training?
soundness: 3
strengths: * The results in this paper are surprising : simply training a model to mimic human brain activity confers adversarial robustness. Not only could this provide insight into the robustness of the human visual system to image perturbations, it could also inform our knowledge of machine learning robustness more generally.
* The results provide compelling evidence for the manifold disentanglement hypothesis and may be of note to cognitive scientists.
* The novel manifold guidance loss term that is defined in this paper may inspire future research in training models that are robust to image corruptions.
summary: This paper is motivated by the robstness of the human visual system to adversarial examples, which have been studied extensively in the computer vision literature. To better understand this phenomenon, the VVS in human brains is modeled using deep neural networks. Using fMRI data from humans looking at images, neural predictors are traubed to model the responses of regions of interest in the brain to unseen images. These predictions are then used to align the outputs of neural heads, which are added to traditional ResNet image classifiers. A related training method where representations are aligned with compact manifolds is also defined in order to test the manifold disentanglement hypothesis. Experiments show that neural guidance does in fact increase robustness, and the hierarchy of robustness when aligning models with different regions of interest aligns with that of the human visual system. Further experiments explore the learned representation spaces of the NG-models and demonstrate the effectiveness of the manifold guidance method.
weaknesses: * The model presented doesn't engage much with the existing literature on adversarial robustness. I think that additional space should be devoted to the relationship between this paper and the adversarial training literature in the related work. It would be informative to know whether adversarially trained models also conform to the manifold disentanglement hypothesis.
* The robustness results would be more compelling if they weren't restricted to $\ell_p$ bounded adversarial corruptions. There are many types of common (non-adversarial) corruptions that humans are robust to which we want our models to be invariant to (such as those included in Imagenet-C [1]). These corruptions can also be used to define adversarial bounds which are distinct from $\ell_p$ (i.e. [2]). It's not clear from the results presented that these models are robust to anything other than $\ell_p$ imperceptible corruptions.
* Relatedly, I think it's important to note that just because a model is more robust to a specific adversarial attack, it is not necessarily more robust to adversarial attacks in general (as noted in [3]). It is possible that an informed adversary could design an attack that effectively targets neurally-guided models. I think that this should be noted as a limitation.
* Experiments were only run using fMRI data from four individuals. This low sample size may be unavoidable due to difficulties in collecting data.

[1] Hendrycks, Dan, and Thomas Dietterich. "Benchmarking neural network robustness to common corruptions and perturbations." arXiv preprint arXiv:1903.12261 (2019).

[2] Kaufmann, Max, Daniel Kang, Yi Sun, Steven Basart, Xuwang Yin, Mantas Mazeika, Akul Arora et al. "Testing robustness against unforeseen adversaries." arXiv preprint arXiv:1908.08016 (2019).

[3] Tramer, Florian, Nicholas Carlini, Wieland Brendel, and Aleksander Madry. "On adaptive attacks to adversarial example defenses." Advances in neural information processing systems 33 (2020): 1633-1645.

---

confidence: 4
contribution: 2
initial_rating: 2
presentation: 3
questions: Questions:
- It would be good to know if any of the attack strengths are perceivable. Can you add that info?
- In the MDS: Any idea of what the dimensions capture?
- Why use regression slopes in Fig 3 but spearman in Fig 4? We should use spearman in both.
- "To further test the manifold hypothesis (DiCarlo & Cox, 2007) that identity-preserving transformations should be treated as part of the same category manifold, we enriched each category with adversarially perturbed variants of the test images, thus obtaining 100 samples in total per category, similar to previous work." The focus of the DiCarlo and Cox work was on identity-preserving transformations like translation and scaling. What about using these types of transformations? The more I think about it, the more confused I am that the authors focused on adversarial perturbations instead of naturalistic transformations for which there are a variety of popular benchmarks in computer vision (objectnet, imagenet-A, etc.).
- What about an adversarially trained model as a control?
soundness: 2
strengths: - Lots of interesting ideas and I really like the manifold analyses. It's an elegant way of comparing human and machine vision. 
- Well done adding the weight decay controls.
- Very creative work.
summary: The authors co-train DNNs for image classification and alignment with fMRI recordings from the human ventral visual stream. They found that alignment to higher-order regions of the visual system (i.e., LO vs. V1) yielded more linearly separable neural category manifolds and, potentially as a consequence, larger adversarial robustness gains in the DNNs. These results suggest that the representational geometry shaped through transformations applied by the ventral visual system are a key reason why humans do not experience the same sensitivity to adversarial perturbations as DNNs.
weaknesses: - I'm struggling with the logic. Why would training on higher order layers lead to lower clean accuracy? I would actually guess the opposite. Higher order regions should encode more invariant object representations, which should train models to similarly have more tolerance to transformations as well as noise.
- No discussion about the inherent limitations of doing this with fMRI. How could that be a limiting factor for this work?
- "Past theories suggest human visual robustness arises from a
representational space that evolves along the ventral visual stream (VVS) of the
brain to increasingly tolerate object transformations" This is a weak sentence. And the follow up is at best underspecified, even for the abstract "To test whether robustness is
supported by such progression as opposed to being confined to specialized higher-
order regions..."

Minor: Line 220: "We first applied this analysis to human neural representations in each of the seven ROIs using NSD." I would use something like voxel activity patterns instead of human neural representations here. The latter is some latent property of the patterns that you hope to extract from the former.

---

confidence: 3
contribution: 4
initial_rating: 8
presentation: 4
questions: I suggest the authors either:
1) Reduce the scope of the claim including in the title to claim these results only for ResNet, not DNNs generally
or
2) Test the results presented on a set of other model architectures including VIT, bio-inspired, and a simpler CNN model (no skip-connections).
soundness: 3
strengths: This paper is an important computational exploration of an outstanding hypothesis in visual neuroscience (that robustness is an emergent property of human vision and the VVS).
The authors have demonstrated exceptional rigor with comprehensive analyses for each experiment with all appropriate controls for each of the experiments presented.
The paper goes beyond demonstrating correlation of neural guidance with robustness to introduce "Manifold Guidance" as a form of supervision that isolates this geometric constraint, confirming that representational geometry in a model is sufficient to transfer the robustness principle. A new tool in the toolbox for inducing robustness will be useful, and it will be interesting to see what other aspects of human alignment emerge from this type of supervision.
While the main results are for a single subject, the authors analyze 2 subjects in the supplemental demonstrating generality.
The authors test the results over multiple attack types demonstrating generality.
The authors clearly state (all but one of) the limitations of their experiments
I find the paper overall exceptionally well written and generally easy to follow. The discussion in particular is interesting and contextualizes the results well.
summary: This paper explores the connection between robustness and human neural (fMRI) responses, demonstrating that guiding model representations towards neural responses improves robustness. Furthermore, the authors expand on this result, creating a supervision metric that encourages the learned manifold to have human-inspired beneficial geometric properties. The authors demonstrate that this manifold guidance also improves robustness without the need for human data.
weaknesses: The main weakness of the paper is in overstatement of implied architecture generality of the robustness findings reported. The evidence is based solely on results from ResNet-18. While ResNet is an obvious choice, adversarial robustness is highly dependent on architecture, so the claim that this is a result applying to DNNs broadly is unsubstantiated. If the authors wish to make this claim broadly, they should demonstrate if this result holds for other DNN architectures such as VIT, bio-inspired CORnet (which the authors mention in related work), and a simpler architecture such as VGG-16. Alternatively, the authors could restrict their claims (including in the title) to be regarding only ResNet-18 
While the ordering of the robustness results (V1 to TO) is highly compelling and supports the central hypothesis, the magnitude of the quantitative improvement for manifold guidance (Figure 4) appears modest. The core finding currently rests on the trend of the means, not the statistical significance of the differences. This could be addressed by measuring variability across initialization seeds, and/or a statistical test for linear trend across regions.

Minor Points:
Formatting figures 5, 10


Decision: Reject