A Brain-Inspired Regularizer for Adversarial Robustness

## Abstract

Abstract Convolutional Neural Networks (CNNs) excel in many visual tasks, but they tend to be sensitive to slight input perturbations that are imperceptible to the human eye, often resulting in task failures. Recent studies indicate that training CNNs with regularizers that promote brain-like representations, using neural recordings, can improve model robustness. However, the requirement to use neural data severely restricts the utility of these methods. Is it possible to develop regularizers that mimic the computational function of neural regularizers without the need for neural recordings, thereby expanding the usability and effectiveness of these techniques? In this work, we inspect a neural regularizer introduced in Li et al. [ 1 ] to extract its underlying strength. The regularizer uses neural representational similarities, which we find also correlate with pixel similarities. Motivated by this finding, we introduce a new regularizer that retains the essence of the original but is computed using image pixel similarities, eliminating the need for neural recordings. We show that our regularization method 1) significantly increases model robustness to a range of black box attacks on various datasets and 2) is computationally inexpensive and relies only on original datasets. Our work explores how biologically motivated loss functions can be used to drive the performance of artificial neural networks.

## 1 Introduction

Convolutional Neural Networks (CNNs) have achieved high performance on a variety of visual tasks such as image classification and segmentation. Despite their remarkable success, these networks are notably brittle; even a small change in the input can significantly alter the network’s output [, ]. Szegedy et al. [] found that small perturbations, imperceptible to the human eye, can lead CNNs to misclassify images. These adversarial images pose a significant threat to computer vision models.

Improving the robustness of CNNs against adversarial inputs is a major focus in machine learning. Various methods have been proposed, each with different levels of success and computational demands []. Some researchers have drawn inspiration from the mammalian brain, finding that deep neural networks trained to mimic brain-like representations are more resistant to adversarial attacks [, , ]. In particular, Li et al. [] demonstrated that incorporating a regularizer into the loss function, which aligns the CNN’s representational similarities [] with those of the mouse primary visual cortex (V1), significantly enhances the network’s robustness to Gaussian noise and adversarial attacks. Using a loss term to steer models towards brain-like representations is referred to as neural regularization. However, a significant drawback of these methods is the reliance on neural recordings, which are often difficult to obtain and limit the methods’ applicability.

In this work, focusing on CNNs used for image classification tasks, we take a deeper look at the neural regularizer introduced in Li et al. []. We ask whether the underlying working principles of this biologically-inspired regularizer can be extracted and utilized to enhance the robustness of deep neural networks without relying on large-scale neural recordings. In particular, the regularizer introduced in Li et al. [] steers a CNN’s representations to match the representational similarities of a predictive model of brain recordings. Taking this as a starting point, our contributions are the following:

- •
We observe that the representational similarities produced by the predictive model correlate highly with pixel-based similarities. Motivated by this, we propose a simple and interpretable similarity measure for regularization derived from the regularization image dataset, without using neural data.
- •
We evaluate the robustness of regularized models on black box attacks, where the attacker only has query access to the model as opposed to white box attacks where gradients and parameters are accessible to the attacker. We show that our regularizer drives the network to be more robust to a wide range of black box attacks.
- •
We demonstrate the flexibility of our method by using different datasets for regularization, including the classification dataset itself. We show that our method works on both grayscale and color datasets.
- •
We assess the robustness of the regularized models to common corruptions using the CIFAR-10-C dataset [].
- •
Our regularization method is computationally efficient, relying on original image datasets without the need for data distortions or augmentations during training. We show that it requires a relatively small regularization batch size and a small number of regularization images.
- •
We show that our regularization method primarily protects against high-frequency perturbations by analyzing the Fourier transformation of minimal perturbations needed to mislead models, as obtained from decision-based Boundary Attacks [].

Our work demonstrates that a brain-inspired regularizer can enhance model robustness without large-scale neural recordings. This contributes to the broader use of biologically-inspired loss functions to improve artificial neural networks’ performance. The end product is a simple, computationally efficient regularizer that performs well across a wide range of scenarios.

## 2 Related works

Adversarial attacks. Identifying adversarial examples that can mislead a model is a dynamic field of research, with an increasing number of attacks being introduced [, , , , ]. In this study, we concentrate on black box attacks, which do not have access to detailed model information, as these are more reflective of real-world scenarios. We evaluate our models against four types of attacks: random noise, common corruptions, transfer-based attacks, and decision-based attacks.

Random noise attacks involve applying noise sampled from known distributions (e.g., Gaussian, Uniform, and Salt and Pepper) to an input, see Appendix 7.1. Common corruptions correspond to distortions that can be found in real life computer vision applications (eg : motion blur) []. A transfer-based attack involves finding adversarial perturbations for a substitute model (an unregularized model in our case) and applying them to a target model. Evaluating robustness on transfer-based attacks is crucial because adversarial examples crafted for one model can also mislead another distinct model [].
We find these perturbations by applying the Fast Gradient Sign Method (FGSM) [] to the substitute model. Such adversarial samples are computed as :

$$ $\displaystyle x_{adv}=x+\epsilon\times\text{sign}(\nabla_{x}L(\theta,x,y))$ (1) $$

where $x_{adv}$ is the adversarial example, $x$ denotes the original input image, $y$ denotes the original input label, $\theta$ denotes the model parameters and $L$ is the loss. A decision based attack is an attack which solely depends on the final model’s decision. Evaluating robustness on them is key as they are applicable to real world black box models. Precisely, we evaluate robustness on a Boundary Attack introduced by Brendel et al. []. This attack starts from a large adversarial perturbation, and seeks to reduce the perturbation while remaining adversarial. Note that for such attack, the larger the perturbation size between the final adversarial image and the original image, the better in terms of robustness.

Adversarial training as a defense to adversarial attacks. As adversarial attacks have advanced, corresponding defenses have also been developed to secure against them [, , , ]. A common defense strategy involves augmenting each batch of training data with adversarial examples, a technique known as adversarial training [, ]. A widely used method for generating these adversarial examples is the Projected Gradient Descent (PGD) attack [], which is a multi-step variant of the Fast Gradient Sign Method (FGSM) attack. PGD is popular due to its effectiveness in creating challenging adversarial examples, thereby enhancing the model’s resilience against attacks.

Neural regularization. Recent work showed that jointly training a deep network to perform image classification while steering it towards having brain-like representations can improve the model’s robustness to adversarial attacks [, ]. This is achieved by introducing a penalty term in the loss function acting directly on image representations [] or activations [] at different network depths. Such a process is referred to as neural regularization. For instance, Li et al. [] used a neural regularizer to drive a CNN to aligh its representational similarities [] with those of mouse primary visual cortex (V1). Later on, Safarani et al. [] used a neural regularizer to drive a CNN towards predicting neural activity in macaque primary visual cortex (V1) in response to the same natural stimuli. The key bottleneck of such defenses is their reliance on the measurement of large scale neural recordings.

## 3 A neural representational similarity regularizer

To increase the robustness of artificial neural networks to adversarial attacks, one research direction focuses on extracting and applying computational concepts from the mammalian brain. In particular, Li et al. [] showed that adding a neural regularizer term to the training loss enhances the adversarial robustness of CNNs on image classification tasks. The regularization term is denoted by $L_{\text{sim}}$ as it depends on similarities between neural responses.
The loss function $L$ is written as:

$$ $L=L_{\text{task}}+\alpha L_{\text{sim}}$ (2) $$

where $L_{\text{sim}}$ given image pairs $(i,j)$ is defined as,

$$ $L_{\text{sim}}=\sum_{i\neq j}\left(\text{arctanh}(S_{ij}^{\text{CNN}})-\text{ arctanh}(S_{ij}^{\text{target}})\right)^{2},$ (3) $$

and $\alpha$ is a parameter that sets the overall regularization strength.
$S_{ij}^{\text{target}}$ in eq. (3) is the target’s pairwise cosine similarity between the representations of images $i$ and $j$. $S^{\text{CNN}}_{ij}$ measures the similarity between the representations of images $i$ and $j$ in a CNN. We compute it following the approach of Li et al. []. We combine feature similarities from a selection of $K$ equally spaced convolutional layers and average the results through trainable weights $\gamma_{l}$, where $l$ is the layer number. The latter are the output of a softmax function meaning $\sum_{l}\gamma_{l}=1$ and $\gamma_{l}\geq 0$. Overall,

$$ $\displaystyle S_{ij}^{\text{CNN}}=\sum_{l}\gamma_{l}S_{ij}^{\text{CNN}-l},$ (4) $$

where $S_{ij}^{\text{CNN}-l}$ is the mean-substracted cosine feature similarity between images $i$ and $j$ at layer $l$. Having $\gamma_{l}$ be trainable enables the model to choose which layer(s) to regularize to match the similarity target.

In their setup, Li et al. [] used a ResNet [] to classify grayscale CIFAR-10 and CIFAR-100 datasets. To compute $S_{ij}^{\text{target}}$, neural responses were collected from mouse primary visual cortex (V1), while the mouse was looking at grayscale images from ImageNet dataset. However, in practice, due to noise in neural recording, $S_{ij}^{\text{target}}$ was not computed from the neural recordings directly. Instead, it was computed from a predictive model [, ] trained to predict the neural responses from images. The predictive model consisted of a 3-layered CNN with skip connections [, , ], it accounts for behavioural data such as pupil position, size and running speed on treadmill (Appendix 7.1).

Training is done by first processing a batch of images from the classification task dataset to calculate the classification loss $L_{\text{task}}$, and then processing a batch of image pairs from the regularization dataset to compute the similarity loss $L_{\text{sim}}$. We then compute the full loss $L$ which we use for backpropagation.

## 4 A pixel similarity based regularizer

We inspect the similarity loss $L_{\text{sim}}$ (eq. (3)) introduced in Li et al. [] to extract its underlying strength. Our goal is to formulate a method that can bypass the use of neural recordings which can be costly.

Since the primary visual cortex (V1), where the neural recordings come from, is the first visual processing area in the cortex, we inspect the correlation between the neural representational similarity and image pixel similarities (computed as described in Appendix 7.1).

Figure: Figure 1: Correlation between representational similarities computed from the neural predictive model used in [] (see Section 3 and Appendix 7.1) and from image pixels computed as the cosine similarity between images which are flattened, mean subtracted and normalized. We trained more than 3 models on 6 distinct scans to predict neural responses and averaged their resulting representational similarity. We observe that the neural representational similarity correlates with the image pixel similarity.
Refer to caption: extracted/5918180/figures/Pixel_Model_Correlation.png

We observe that there is a high correlation between the two as shown in Fig. 1, left panel. Thus, we investigate the effect of using pixel similarities as target similarities in $L_{\text{sim}}$ instead of similarities obtained from neural recordings. To compare both approaches, we replicate the experimental setup in Li et al. []. We train a ResNet18 to classify grayscale CIFAR-10, and use grayscale images from ImageNet data, as the regularization dataset (same datasets used in Li et al. []). However, we differ from Li et al. [] in our choice of $S_{ij}^{\text{target}}$: we set $S_{ij}^{\text{target}}$ in eq. (3) to $S_{ij}^{\text{pixel}}$, where $S_{ij}^{\text{pixel}}$ is computed as the pixel cosine similarity between images which are flattened, mean subtracted and normalized. After training, we observe that the regularized model exhibits some enhancement in robustness, however this enhancement is not consistent across different image perturbations and adversarial attacks - as shown in Fig. 2.

Figure: (a)
Refer to caption: extracted/5918180/figures/pixel-neural/neural_pixel_gaussian.png

For example, we see a modest enhancement in robustness to Gaussian noise (Fig. 2(a)), and decision-based Boundary Attack (Fig. 2(c)), but this was not the case for transferred FGSM attack (Fig. 2(b)). For Uniform noise and Salt and Pepper noise, we see an enhancement in robustness at large noise levels (see Fig. 12 in Appendix 7.2). In Fig. 2 we also show the performance of the model of Li et al. [], which is regularized using neural representational similarities, for direct comparison.

If we go back and visually examine the last two panels in Fig. 1, we observe that the image pixel and neural representational similarity matrices have similar patterns, however the patterns are more enhanced in the neural representational similarity matrix. Thus, at the first stage of cortical visual processing, the brain seems to roughly preserve an underlying structure of the image pixel similarities but amplify it. Based on this observation, we define a new target similarity $S^{Th}$, such that

$$ $S_{ij}^{Th}=\begin{cases}1,&\text{ if }S_{ij}^{\text{pixel}}>Th,\\ -1,&\text{ if }S_{ij}^{\text{pixel}}<-Th,\\ 0,&\text{ if }|S_{ij}^{\text{pixel}}|\leq Th\end{cases}$ (5) $$

where, $Th\in(0,1)$ is a tunable thresholding hyperparameter. That is, we set $S_{ij}^{\text{target}}$ to be $S_{ij}^{Th}$. We note that in practice we don’t use exactly $1$ and $-1$ in eq. (5) by a very small number $\epsilon$ because of the arctanh function in eq. (3). Finally, we note that even though we use $L_{\text{sim}}$ as in eq. (3), the application of the arctanh function is not necessary in this case. The intuition behind this regularization term is as follows: it is constraining the lower layers in the network (as we show in Appendix 7.6) to have identical representations for image pairs that are close in pixel space, measured by the cosine similarity; hence viewing those images pairs as adversarial versions of each other. At the same time, it is pushing images farther away in pixel space to have orthogonal representations. In Appendix 7.7, we show the contribution of each term of $S^{Th}$ on robustness.
In Section 5.2 we propose how to select the hyperparameter $Th$ and the regularization hyperparameter $\alpha$.

Key advantages for this regularization method are 1) it does not require large scale neural recordings, 2) it relies on the original datasets, and does not require the introduction of data distortions or augmentations during training, and 3) it is computationally inexpensive, as we show in Section 5.6 .

## 5 Experiments

We train ResNets [] on image classification tasks using $L=L_{\text{task}}+\alpha~{}L_{\text{sim}}$ (eq. (2), and setting $S^{\text{target}}$ =  $S^{Th}$ in the regularization in the loss $L_{\text{sim}}$ (eq. (3)). The ($\alpha,Th$) pairs used for each classification-regularization dataset pairs are reported in Appendix 7.5. We also report in Appendix 7.6 the value of $\gamma_{l}$ (as defined in Section 3) for each dataset combination. After training, we evaluate the regularized model robustness to a set of black box adversarial attacks (Section 2).
Even though we report below results for ResNet18, we show in Appendix 7.4 and Appendix 7.8 results for ResNet34. To allow direct comparison with Li et al. [], we mainly show results using grayscale CIFAR-10 as classification dataset. However, to demonstrate the success of our method, we also show results using color CIFAR-10. Furthermore, in the Appendix we show results using other classification datasets like grayscale CIFAR-100 (Appendix 7.4), color CIFAR-100 (Appendix 7.8), MNIST (Appendix 7.4) and FashionMNIST (Appendix 7.4).
The details of our experimental setup and implementation can be found in Appendix 7.1.

### 5.1 Robustness to adversarial attacks

We test the robustness of regularized models using grayscale CIFAR-10 and grayscale ImageNet as classification and regularization datasets respectively, as used in Li et al. []. For Gaussian noise perturbations, we find that regularized models exhibit a substantial increase in robustness when compared to unregularized models as seen in Fig. 3, left panel. They also show a similar performance to neural regularized models [] (Fig. 3, left panel). The robustness of models regularized using $S^{Th}$, to Uniform and Salt and Pepper perturbations are shown in Appendix 7.3.

Figure: Figure 3: Robustness to Gaussian noise (left), transferred FGSM [] (center), and decision-based Boundary Attack [] (right). A ResNet18 is trained to classify grayscale CIFAR-10 and is regularized on grayscale images from ImageNet dataset. Results for different regularization targets are shown : $S^{pixel},S^{Th}$ and neural based targets as in Li et al. []. For the decision-based Boundary Attack, we compute the median squared $L_{2}$ perturbation size per pixel, averaged across 1000 images, and 5 repeats. Error shades represent the SEM across seven seeds per model.
Refer to caption: extracted/5918180/figures/comparing-with-li-et-al-corrected.png

We also test robustness to stronger black box attacks, particularly, to transferred FGSM [] perturbations from an unregularized model, and decision-based Boundary Attack [] (Section 2). We observe an increase in robustness to both attacks (Fig. 3, center and right panels). Note that for decision-based Boundary attack, the larger the perturbation size between the adversarial input and the original image, the better in terms of robustness. Again, we observe that models regularized using $S^{Th}$ perform similar to those regularized using neural data [] (Fig. 3, center and right panels).

The experiments above demonstrate that we can obtain similar robustness to neural regularized models [] by simply regularizing using $S^{Th}$, which does not require neural data, and relies only on the original unaugmented regularization dataset.

### 5.2 Hyperparameter selection and consistent behavior across attacks

An important question is how to select an $\alpha,Th$ hyperparameter pair? We propose a criteria to select those hyperparameters, as follows. A suitable pair should (1) be such that the resulting model has an ’acceptable’ accuracy on the distortion-free dataset, and (2) showcases an increase in robustness to adversarial attacks. To properly define what we mean by this, we introduce the following quantities $R_{0}$, $R_{N}$, $U_{0}$ and $U_{D}$.
Where, $R_{0}$ is the regularized model’s accuracy on distortion-free images and $R_{D}$ its accuracy at high distortion level. $U_{0}$ and $U_{D}$ are their equivalent for the unregularized model. The ratios $\frac{R_{0}}{U_{0}}$ and $\frac{R_{D}}{U_{D}}$ reflect how our regularization affects the model’s accuracy at zero and high distortion levels. To meet condition (1), we require that $\frac{R_{0}}{U_{0}}\geq A_{0}$, where $A_{0}$ is user defined. We select $A_{0}=0.9$. Condition (2) is simply met by requiring that $\frac{R_{D}}{U_{D}}>1$.

We can visualize the performance of a model by plotting $\frac{R_{0}}{U_{0}}$ vs $\frac{R_{D}}{U_{D}}$ for each $\alpha$, $Th$ pair. This allows the user to select the hyperparameter pair based on the selection criterion that they choose. In Fig. 4 we show the above plot for different adversarial attacks (the gray shaded planes).

Figure: Figure 4: Behavior across multiple black box attacks and hyperparameters $(\alpha,Th)$ choices. Models are trained to classify grayscale CIFAR-10 and regularized on grayscale images from ImageNet dataset. Different planes show results for different black box attacks. In each plane, the region shaded in blue represents the region of ’acceptable’ models, which we’ve taken here to be $R_{D}/U_{D}>1$ and $R_{0}/U_{0}\geq 0.9$ – a criteria that can be adjusted as needed. $U_{D},R_{D}$ are computed at $\epsilon=0.1$ for random attacks and $\epsilon=0.02$ for the transferred FGSM [] attack. Mean metrics across 7 seeds per model are displayed. The ($\alpha,Th$) values that we use in our experiments are reported in Appendix 7.5.
Refer to caption: extracted/5918180/figures/C10_IM/3d-3.png

As seen, the regularization method produces a consistent behavior across all the adversarial attacks that we use. This allows the user to use the simplest attack, like adding Gaussian noise to the images, to select the $\alpha$, $Th$ pair. In Fig. 4, the blue shaded area represents the region where conditions (1) and (2) are met for each attack.

### 5.3 Robustness across datasets combinations

Our method is flexible to the choice of the regularization dataset. We find that regularizing on different datasets leads to an increase in model robustness, but, there is a quantitative difference in the robustness level achieved by regularizing on different datasets. Fig. 5 shows the performance of a ResNet18 trained to classify grayscale CIFAR-10 regularized on grayscale images from three datasets separately (CIFAR-10, CIFAR-100 or ImageNet) for three attacks (Gaussian noise, transferred FGSM, and decision-based Boundary Attack) compared to an unregularized model. In Appendix 7.4 we show results for different classification-regularization datasets combinations.

Figure: Figure 5: Robustness of a ResNet18 trained to classify grayscale CIFAR-10 regularized on grayscale images from different datasets : grayscale CIFAR-10 (blue), CIFAR-100 (purple) or ImageNet (red). For the decision-based Boundary Attack, we compute the median $L_{2}$ perturbation size, averaged across 1000 images, and 5 repeats. Error shades/bars represent the SEM across seven seeds per model. The same ($\alpha$,$Th$) values are used in training all models i.e for all regularization datasets (see Appendix 7.5).
Refer to caption: extracted/5918180/figures/dataset-combinations.png

### 5.4 Robustness to common corruptions

Regularized models are also more robust than their unregularized counterpart on common corruptions. We evaluate regularized models on grayscale CIFAR-10-C dataset [] which consists of grayscaled CIFAR-10 images with common corruptions that can be found on everyday computer vision application. Evaluating on common corruptions at different severity levels is critical as they simulate real world conditions.
Fig. 6 shows the performance of a ResNet18 trained to classify grayscale CIFAR-10 regularized with grayscale images from ImageNet dataset vs unregularized model. Fig. 6 (left) shows the performance averaged over all 15 common corruptions at different severity levels, Fig. 6 (right) shows the robustness of unregularized and regularized models for the 15 individual corruptions present in CIFAR-10-C [], at severity level 4.

Figure: Figure 6: Robustness to grayscale CIFAR-10-C Common Corruptions []. (left) We compute the regularized model’s accuracy on grayscale CIFAR-10-C for different severity levels, averaging across all 15 common corruptions present in CIFAR-10-C. (right) We show the robustness of unregularized and regularized models on 15 individual corruptions at severity 4. Error bars correspond to the SEM across seven seeds per model. Results are for a ResNet18 trained to classify grayscale CIFAR-10 regularized wih grayscale images from ImageNet dataset.
Refer to caption: extracted/5918180/figures/C10_IM/CC_performance.png

### 5.5 Frequency decomposition of adversarial perturbations and common corruptions

To understand the strengths and weaknesses of our regularization method, we investigate the frequency components present in the minimal perturbation required to flip the decision of unregularized and regularized models which we compute via a decision-based Boundary Attack []. We observe that models regularized using pixel-based similarities ($S^{Th}$) rely more on low frequency information than their unregularized counterparts (Fig. 7 center and right panels). We further evaluate our regularized model performance on grayscale CIFAR-10-C [] following the approach described in [], where we categorize the 15 corruptions in CIFAR-10-C into Low, Medium, and High frequency based on their spectra (see Fig. 7 left panel and Appendix Fig. 25). Results are shown for ResNet18 trained to classify CIFAR-10 and regularized using images from CIFAR-10, CIFAR-100 or ImageNet datasets. Our results show that regularized models outperform unregularized ones, especially on high-frequency corruptions, confirming our findings. Such a reliance on low-frequency information has also been observed in models subjected to neural regularization as explained in Li et al. [].

Figure: Figure 7: Frequency perspective on robustness. The results are for ResNet18 trained to classify grayscale CIFAR-10 and regularized on grayscale images from different datasets: CIFAR-10, CIFAR-100 or ImageNet (left). Robustness of regularized ResNet18 models evaluated on grayscale CIFAR-10-C at severity 4, categorized by the frequency range of each corruption. (center) Fourier power spectrum for the mean minimal corruption required to flip a model’s decision. (right) Radial Spectrum of minimal pertubation required to mislead models, as provided by a decision-based Boundary Attack [] - using 10k steps. The error bars (left panel) and shaded areas (right panel) represent the SEM across seven and four seeds per model respectively.
Refer to caption: extracted/5918180/figures/frequencies/spectra_2_final_all.png

### 5.6 Computational advantages

In addition to being a simple method to apply, our regularization method is computationally inexpensive. First, in regard to training time, for $k$ image pairs per regularization batch, the additional time taken per batch to train the model corresponds to $2\times k$ additional forward passes. We see in Fig. 8 that the method is successful for regularization batch size values: 4, 8, 16, 32. Choosing a smaller batch size can help in cutting the extra training time needed for successful regularization.

Figure: Figure 8: Robustness of a ResNet18 trained to classify grayscale CIFAR-10 and regularized on grayscale images from ImageNet dataset is shown for different regularization batch sizes, $k\in\{4,8,16,32\}$. For the decision-based Boundary Attack, we compute the median $L_{2}$ perturbation size, averaged across 1000 images, and 5 repeats. Error shades/bars represent the SEM across seven seeds per model.
Refer to caption: extracted/5918180/figures/C10_IM/reg_batch_size.png

Second, although the number of target similarities is $\binom{N}{2}$ for $N$ selected regularization images, we find that we do not need many images for regularization. In our experiments we used $N=5000$, leading to approximately $12\times 10^{6}$ pairs (Appendix 7.1), however, we show in Fig. 9 that we do not need that much images; as can be seen using only $N\in\{100,1000\}$ images provides robustness increase to black box attacks. Last, our method relies on the original image datasets, and does not require the introduction of different data distortions or augmentations during training.

Figure: Figure 9: Robustness of a ResNet18 trained to classify grayscale CIFAR-10 and regularized on grayscale images from ImageNet dataset is shown for different number of regularization images. For the decision-based Boundary Attack, we compute the median $L_{2}$ perturbation size, averaged across 1000 images, and 5 repeats. Error shades/bars represent the SEM across seven seeds per model.
Refer to caption: extracted/5918180/figures/C10_IM/reg_image_num.png

### 5.7 Results using color datasets

Our previous results were obtained using grayscale datasets, which as we previously mentioned, were chosen to allow direct comparison with Li et al. [], and for consistency. Here, we show that our method is also successful when using color datasets, which are more utilized in practice.

In Fig. 10 we show results using color CIFAR-10 as classification dataset, and color CIFAR-10, CIFAR-100 or ImageNet as regularization datasets. As seen, there is an increase in the model’s robustness for all regularization datasets. Similar results are observed when using color CIFAR-100 as classification dataset (see Appendix 7.8).

Figure: Figure 10: Robustness of a ResNet18 trained to classify color CIFAR-10 regularized on colored images from different datasets : CIFAR-10 (blue), CIFAR-100 (purple) or ImageNet (red). For the decision-based Boundary Attack, we compute the median $L_{2}$ perturbation size, averaged across 1000 images, and 5 repeats. Error shades/bars represent the SEM across seven seeds per model.
Refer to caption: extracted/5918180/figures/colored/C10/colored_cifar10.png

## 6 Conclusion and discussion

Extracting the working principles of the brain to advance AI is a long-term goal of neuroscience. To further this goal, we examined a brain-inspired method for adversarial robustness proposed by Li et al. []. This method uses neural recordings from the brain to align learned representations in an artificial neural network with brain representations through a regularization term added to the training loss. We extracted the core working principle behind this regularizer and proposed a simple, pixel-based regularization scheme that achieves similar performance, and gave an intuitive interpretation of our method. These findings contribute to the broader objective of leveraging brain-inspired principles to advance AI.

We showed that our method increases the robustness of CNNs to a spectrum of black box attacks (Section 2). We proposed a method to select the regularization hyperparameters ($\alpha,Th$), and showed that the choice of an ($\alpha$, $Th$) pair value for regularization, affects the robustness level in a consistent way across different attacks. We demonstrated the effectiveness and scalability of our method, by showing its success in increasing model robustness using different combinations of classification and regularization datasets, including classification datasets CIFAR-10 and CIFAR-100 (Appendix 7.1). We evaluated the performance of regularized models on common corruptions using grayscale CIFAR-10-C. We performed a Fourier analysis on minimal adversarial perturbations obtained from a decision-based Boundary Attack on our regularized model, and found that the perturbations from the regularized model contained higher low-frequency components relative to the unregularized model. We also showed that our method is more effective against common corruptions that are categorized as high frequency corruptions based on the average frequency estimated from the Fourier spectrum of the perturbations induced by these corruptions []. These findings are in line to those in Li et al. [], who examined the same perturbations for a model regularized using neural data []. Even though we mostly presented results using grayscale datasets to allow direct comparison with the method in Li et al. [], we demonstrated that our method is also successful when using color datasets, where we showed results for color CIFAR-10 and color CIFAR-100. We also investigated the contribution of different parts of $S^{Th}$ (Appendix 7.7).

Despite that we use a biologically inspired loss term that originally utilized large scale neural recordings to enhance the robustness of machine learning models, we have shown that this loss term can be implemented in a successful way that bypasses the use of neural data. Furthermore, our regularization method, although effective, is very simple. It relies on the original image datasets, and does not require the introduction of any additional data distortions or augmentations during training. It is flexible in regard to choosing the regularization dataset. It is computationally inexpensive, it requires a relatively small batch size for regularization. It also requires a small number of images to regularize on, or more precisely to construct the targets $S^{Th}$ (eq. (5)). Our work is an encouraging step towards dissecting the workings of neural regularizers, to come up with methods that can both, enhance the performance of machine learning models, and be implemented by a broader machine learning community. Finally, we point out that one limitation of our method, is its inability to increase model robustness to some common corruptions as can be seen in Fig. 6 (right) and Fig. 7 (left). Also, it does not achieve the level of robustness attained using state of the art defenses against adversarial attacks []. However, we stress that our aim is not to come up with the best adversarial defence, but rather to show that our method which is based on the neural regularizer in Li et al. [] can be equally effective without the need to use expensive neural data.

All codes are available at [https://github.com/elieattias1/pixel-reg](https://github.com/elieattias1/pixel-reg).

## 7 Appendix / supplemental material

### 7.1 Experimental setup

Training - Neural Predictive Model - We train neural predictive models [, ] to predict neural responses using all scans (measurements of neurons) with the same training configurations and neural data available in the codebase left by Li et al. [].
Training - Image classification -
All models were trained by stochastic gradient descent on a NVIDIA A100-SXM4-40GB GPU. Models classifying grayscale CIFAR-10 were trained during 40 epochs. Training and regularizing a ResNet18 CIFAR-10 took in average 34 min to run. We used a batch size of 64 for the classification pathway and a batch of 16 image pairs for the regularization pathway. The number of regularization images used by default is $5000$. Target similarities $S_{ij}^{\text{pixel}}$ are computed as follows. We compute the cosine similarity between images which are flattened, mean subtracted and normalized. We use the same learning schedule as in []. Models were trained using Pytorch [].
The classification datasets used are : MNIST [], FashionMNIST [], grayscale CIFAR-10 [], grayscale CIFAR-100. The regularization datasets used are : MNIST, FashionMNIST, grayscale CIFAR-10, grayscale CIFAR-100 and grayscale ImageNet []. In Appendix 7.5, we report the $(\alpha,Th)$ used for each dataset combinations. The code used for training is based on the code used in Li et al. []. All codes are available at [https://github.com/elieattias1/pixel-reg](https://github.com/elieattias1/pixel-reg).

Adversarial attacks (see Section 2) - All perturbations are reported for image pixels in the range $[0,1]$. We evaluate model robustness to random noise and transferred FGSM [] perturbations by measuring the accuracy of evaluated models for distinct perturbation strengths $\epsilon$. We empirically find the range of perturbation strengths used to evaluate models, such that the unregularized model performs bad at the highest $\epsilon$ used for that particular model-dataset-attack combination. The random noise perturbations are showcased in Fig 11.

Figure: Figure 11: Visualization of (left) Gaussian noise, (center) Uniform noise and (right) Salt and Pepper noise with $\epsilon=0.06$.
Refer to caption: extracted/5918180/figures/random_noise_visualization.png

The decision-based Boundary Attack [] was applied via Foolbox [] using 50 steps, unless stated otherwise. To evaluate the success of this attack, we measure the following score :

$$ $S(M)=\text{median}_{i}\left(\frac{1}{d}\left\|\eta_{M}(x_{\text{original}}^{i} )\right\|_{2}^{2}\right)$ $$

introduced in [] where $\eta_{M}(x_{original})=x_{original}-x_{adversarial}\in\mathbb{R}^{d}$ is the adversarial perturbation found by the attack. We measure this score using $1000$ randomly sampled images from the test set. The final reported score is the average $S(M)$ calculated over 5 repetitions. All codes relative to adversarial evaluation are supplemented with this submission.

### 7.2 Robustness to random noise for models trained to classify CIFAR-10 regularized using S pixel superscript 𝑆 pixel S^{\text{pixel}} italic_S start_POSTSUPERSCRIPT pixel end_POSTSUPERSCRIPT

Figure: Figure 12: Robustness of a ResNet18 trained to classify grayscale CIFAR-10 and regularized on $S^{pixel}$ from grayscale images from ImageNet dataset to Gaussian, Uniform noise and Salt and Pepper noise. Error shades represent the SEM across seven seeds per model.
Refer to caption: extracted/5918180/figures/C10_IM/pixel_reg_random.png

### 7.3 Robustness to random noise for models trained to classify CIFAR-10 regularized using S T ⁢ h superscript 𝑆 𝑇 ℎ S^{Th} italic_S start_POSTSUPERSCRIPT italic_T italic_h end_POSTSUPERSCRIPT

Figure: Figure 13: Robustness of a ResNet18 trained to classify grayscale CIFAR-10 and regularized on $S^{Th}$ from grayscale images from ImageNet dataset to Gaussian, Uniform noise and Salt and Pepper noise. Error shades represent the SEM across seven seeds per model.
Refer to caption: extracted/5918180/figures/C10_IM/random.png

### 7.4 Robustness on image classification task for different classification-regularization datasets

Figure: Figure 14: Robustness of a ResNet18 trained to classify MNIST and regularized on images from MNIST and FashionMNIST datasets to Gaussian noise, Uniform noise and Salt and Pepper noise. Error shades/bars represent the SEM across seven seeds per model.
Refer to caption: extracted/5918180/figures/MNIST_random.png

Figure: Figure 15: Robustness of a ResNet18 trained to classify FashionMNIST and regularized on images from MNIST and FashionMNIST datasets to Gaussian, Uniform and Salt and Pepper noise. Error shades/bars represent the SEM across seven seeds per model.
Refer to caption: extracted/5918180/figures/Fashion_random.png

Figure: Figure 16: Robustness of a ResNet34 trained to classify grayscale CIFAR-100 and regularized on grayscale images from CIFAR-10, CIFAR-100, ImageNet datasets to Gaussian noise, Uniform noise and Salt and Pepper noise. Error shades/bars represent the SEM across seven seeds per model.
Refer to caption: extracted/5918180/figures/CIFAR100_random.png

Figure: Figure 17: Robustness of a ResNet18 trained to classify MNIST and regularized on MNIST and FashionMNIST images to transferred FGSM [] perturbations from an unregularized model, and a decision boundary attack []. Error shades/bars represent the SEM across seven seeds per model.
Refer to caption: extracted/5918180/figures/M_strong.png

Figure: Figure 18: Robustness of a ResNet18 trained to classify FashionMNIST and regularized on images from MNIST and FashionMNIST to transferred FGSM [] perturbations from an unregularized model, and a decision boundary attack []. Error shades/bars represent the SEM across seven seeds per model.
Refer to caption: extracted/5918180/figures/F_strong.png

Figure: Figure 19: Robustness of a ResNet34 trained to classify grayscale CIFAR-100 and regularized on grayscale images from CIFAR-10, CIFAR-100, and ImageNet datasets to transferred FGSM [] perturbations from an unregularized model, and a decision boundary attack []. Error shades/bars represent the SEM across seven seeds per model.
Refer to caption: extracted/5918180/figures/CIFAR100-strong.png

### 7.5 Hyperparameters used for regularization

The $\alpha,Th$ value pairs selected in our work yield an acceptable accuracy-robustness trade-off ($\frac{R_{D}}{U_{D}}>1$ and $\frac{R_{0}}{U_{0}}\geq 0.9$) across attacks during regularization. These pairs are:

**Table 1: Hyperparameters used for regularization**
| Classification - Regularization | $\alpha$ | $Th$ |
| --- | --- | --- |
| CIFAR-10 - CIFAR-10 | 10 | 0.8 |
| CIFAR-10 - CIFAR-100 | 10 | 0.8 |
| CIFAR-10 - ImageNet | 10 | 0.8 |
| CIFAR-100 - CIFAR-10 | 10 | 0.8 |
| CIFAR-100 - CIFAR-100 | 10 | 0.8 |
| CIFAR-100 - ImageNet | 10 | 0.8 |
| MNIST - MNIST | 4 | 0.2 |
| MNIST - FashionMNIST | 10 | 0.8 |
| FashionMNIST - MNIST | 10 | 0.4 |
| FashionMNIST - FashionMNIST | 10 | 0.8 |

We did not conduct an extensive hyperparameter sweep, so there are likely some $\alpha$ and $Th$ pairs that could yield stronger robustness.

### 7.6 Weighting candidate layers

We here report the weights $\gamma_{l}$ obtained after training, for different models and dataset-combinations.

**Table 2: Averaged weights for all candidate layers in a ResNet18 across seven seeds per model**
| Classification - Regularization | $\gamma_{1}$ | $\gamma_{5}$ | $\gamma_{9}$ | $\gamma_{13}$ | $\gamma_{17}$ |
| --- | --- | --- | --- | --- | --- |
| CIFAR-10 - CIFAR-10 | $8.2\times 10^{-3}$ | 0.56 | 0.38 | $5.2\times 10^{-2}$ | 0 |
| CIFAR-10 - CIFAR-100 | 0.62 | 0.38 | 0 | 0 | 0 |
| CIFAR-10 - ImageNet | 0.62 | 0.38 | 0 | 0 | 0 |
| MNIST - MNIST | 0.5 | 0.125 | 0.25 | 0.125 | 0 |
| MNIST - FashionMNIST | 0.125 | 0.375 | 0.5 | 0 | 0 |
| FashionMNIST - MNIST | 0.75 | 0.125 | 0.125 | 0 | 0 |
| FashionMNIST - FashionMNIST | 0.143 | 0.286 | 0.571 | 0 | 0 |

**Table 3: Averaged weights for all candidate layers in a ResNet34 across seven seeds per model**
| Classification - Regularization | $\gamma_{1}$ | $\gamma_{7}$ | $\gamma_{15}$ | $\gamma_{27}$ | $\gamma_{33}$ |
| --- | --- | --- | --- | --- | --- |
| CIFAR-100 - CIFAR-10 | 0.375 | 0.375 | 0.25 | 0 | 0 |
| CIFAR-100 - CIFAR-100 | 0.875 | 0.125 | 0 | 0 | 0 |
| CIFAR-100 - ImageNet | 0.8 | 0.2 | 0 | 0 | 0 |

### 7.7 Relevance of different similarity ranges

In this subsection, we share an investigation regarding the target similarity ranges which matter the most for regularization. Indeed, given a threshold $Th$, specific $S_{ij}^{Th}$ will take values in $\{0,-1,1\}$. We define the following sets of regularization target pairs : $i,j$ : $S_{-}^{Th}:=\{S_{ij}\mid S_{ij}<-Th\text{ or }|S_{ij}|<Th\}$ , $S_{+}^{Th}:=\{S_{ij}\mid S_{ij}>Th\text{ or }|S_{ij}|<Th\}$, $S_{\text{low}}^{Th}:=\{S_{ij}\mid|S_{ij}|<Th\}$, $S_{\text{high}}^{Th}:=\{S_{ij}\mid|S_{ij}|>Th\}$. The set $S_{-}^{Th}$ represents regularization targets with values in $\{-1,0\}$, while $S_{+}^{Th}$ represents targets in $\{0,1\}$. Additionally, $S_{\text{low}}^{Th}$ represents regularization targets with values in $\{0\}$, and $S_{\text{high}}^{Th}$ represents regularization targets with values in $\{-1,1\}$. We also define a target set depending on two thresholds : $Th_{1}>Th_{2}>0$ denoted as $S_{\text{double}}^{Th_{1},Th_{2}}$ such that :

$$ $S_{\text{double},ij}^{Th_{1},Th_{2}}=\begin{cases}1,&\text{ if }S_{ij}^{\text{ pixel}}>Th_{1},\\ -1,&\text{ if }S_{ij}^{\text{pixel}}<-Th_{1},\\ 0,&\text{ if }|S_{ij}^{\text{pixel}}|\leq Th_{2}\end{cases}.$ (6) $$

Figure: Figure 20: ResNet18 trained to classify grayscale CIFAR-10 and regularized with grayscale images from ImageNet for different regularization targets. Error shades/bars represent the SEM across seven seeds per model.
Refer to caption: extracted/5918180/figures/C10_IM/reg_range_set.png

Figure: Figure 21: ResNet18 trained to classify grayscale CIFAR-10 and regularized with grayscale images from CIFAR-10 for different regularization targets. Error shades/bars represent the SEM across seven seeds per model.
Refer to caption: extracted/5918180/figures/C10-C10/reg_range_set.png

Figure: Figure 22: ResNet18 trained to classify grayscale CIFAR-10 and regularized with grayscale images from CIFAR-100 for different regularization targets. Error shades/bars represent the SEM across seven seeds per model.
Refer to caption: extracted/5918180/figures/C10_C100/reg_range_set.png

### 7.8 Regularization on color datasets

Our previous results on CIFAR-100 were obtained using grayscale datasets, which as we previously mentioned, were chosen to allow direct comparison with Li et al. [], and for consistency. Here, we show that our method is also successful when using color datasets, which are more utilized in practice.

In Fig. 23 we show results using color CIFAR-100 as classification dataset, and color CIFAR-10, CIFAR-100 or ImageNet as regularization datasets. As seen, there is an increase in the model’s robustness for all regularization datasets.

Figure: Figure 23: Robustness of a ResNet34 trained to classify color CIFAR-100 regularized on color images from different datasets : CIFAR-10 (blue), CIFAR-100 (purple) or ImageNet (red). For the decision-based Boundary Attack, we compute the median $L_{2}$ perturbation size, averaged across 1000 images, and 5 repeats. Error shades/bars represent the SEM across seven seeds per model.
Refer to caption: extracted/5918180/figures/colored/CIFAR100/CIFAR100.png

### 7.9 Benchmarking our method against those in the RobustBench leaderboard

We benchmarked a model trained to classify (color) CIFAR-10 regularized on (color) CIFAR-100 using our method, against 3 models referenced in the RobustBench [] leaderboard - commonly used to systematically track the real progress in adversarial robustness - on CIFAR-10-C, at severity 5. We select $L_{\infty}$, $L_{2}$ and common corruption (thereafter CC) specific models denoted as Carmon2019Unlabeled [], Engstrom2019Robustness [] , Modas2021PRIMEResNet18 [] respectively. We also benchmark against the ’standard’ model available on RobustBench. As we see in Fig. 24, our regularized model performs better than the standard model reflecting the robustness gain, but does not reach the same performance as state of the art networks. We acknowledge that our method does not beat the state of the art methods in the adversarial robustness literature. The aim of our method is not to beat the state of the art methods, but rather to show that our method which is based on the neural regularizer in Li et al. [] can be equally effective without the need to use expensive neural data.

Figure: Figure 24: Benchmarking a model trained to classify (color) CIFAR-10 regularized on (color) CIFAR-100 using our method, against 3 models referenced in the RobustBench [] leaderboard - commonly used to systematically track the real progress in adversarial robustness - on CIFAR-10-C, at severity 5. We select $L_{\infty}$, $L_{2}$ and common corruption (thereafter CC) specific models denoted as Carmon2019Unlabeled [], Engstrom2019Robustness [] , Modas2021PRIMEResNet18 [] respectively. We selected our most robust model on CIFAR10-C for such benchmarking. We also benchmark against the ’standard’ model available on RobustBench.
Refer to caption: extracted/5918180/benchmark.png

### 7.10 Fourier spectra of common corruptions

Following the approach of [], we divided the common corruptions present in CIFAR-10-C into three categories based on their corresponding dominating frequencies whether they belong to low, medium or high frequency ranges. Low frequency corruptions are composed of ‘snow’, ‘frost’, ‘fog’, ‘brightness’, ‘contrast’ corruptions. Medium-frequency corruptions are composed of ‘motion blur’, ‘zoom blur’, ‘defocus blur’, ‘glass blur’, ‘elastic transform’, ‘jpeg compression’ and ‘pixelate’ corruptions. High-frequency corruptions are composed of ‘gaussian noise’, ‘shot noise’ and ‘impulse noise’ corruptions. For completeness, we reproduced the Fourier transformation of the common corruptions as shown below.

Figure: Figure 25: Fourier transform of the corruptions in CIFAR-10-C at severity 3, ordered by groups of frequency ranges from low, to medium to high. For each corruption, we compute $\mathbb{E}[|F(C(X)-X)|]$ by averaging over all test images, where $F$ denotes a discrete Fourier transformation, $X$ denotes an original image, and $C(X)$ its corrupted counterpart. We apply a logarithm $x\mapsto\log(1+x)$ for visualization purposes.
Refer to caption: extracted/5918180/figures/frequencies/CC_fourier_spectra.png

## Peer Reviews

confidence: 3
contribution: 2
initial_rating: 3
presentation: 3
questions: My main concern is the contradictory claims in the paper. Please refer to the weakness section for more questions and details.
soundness: 2
strengths: - The proposed method eliminates the need for neural recordings, which are generally expensive.
- Well-motivated, intuitive, and simple method to eliminate the actual neural recordings. 
- Computationally light method.
summary: The paper inspects an existing neural regularizer to establish that the idea can be used for image pixel similarities without the use of actual neural recordings. Based on this observation, the authors propose a new regularization method based on two hyperparameters and eliminating the need for neural recordings. It is evaluated for different adversarial attacks and grayscale and colored datasets. Based on the selected threshold value, the target similarity matrix is calculated. The method is tested against transferable FGSM and Boundary attack as well as common image corruptions.
weaknesses: - The authors mention, "our aim is not to come up with the best adversarial defence ..." on lines 519-521, which contradicts the title and the paper content that gives an impression the proposed method is to improve the adversarial robustness of the existing networks. 
- The authors should discuss the preliminary details/definitions they use frequently from the baseline paper. For example, what are the classification and regularization datasets? 
- While the improvement on the common corruptions is good, the evaluation of adversarial robustness is incomplete. The method is only tested against transferable FGSM and Boundary attacks. More robust evaluation with stronger white-box [1, 2] and black-box attacks [3] should be done to claim adversarial robustness. 
- Evaluation is only limited to one CNN architecture - ResNet18. More evaluation of diverse architectures and models like WideResNet will provide additional evidence for the claims.
- In Section 2, the adversarial attacks mentioned are very old. The newer, more effective, and stronger attacks are not included. Similar observations are made for the adversarial defense subsection in Section 2.   
- Minor typos - "imageNet" instead of "ImageNet" on line 389, every equation is referred as "eq. equation " instead of "Eq. " or "Equation ",  

[1] Croce, Francesco, and Matthias Hein. "Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks." International conference on machine learning. PMLR, 2020.
[2] Mądry, Aleksander, et al. "Towards deep learning models resistant to adversarial attacks." stat 1050.9 (2017).
[3] Andriushchenko, Maksym, et al. "Square attack: a query-efficient black-box adversarial attack via random search." European conference on computer vision. Cham: Springer International Publishing, 2020.

---

confidence: 3
contribution: 2
initial_rating: 3
presentation: 1
questions: 1. As stated in your second contribution, 'We show that our regularizer drives the network to be more robust to a wide range of black-box attacks,' and since all your experiments are based on ResNet18, I am curious whether this method would work for different architectures, such as MLPs.

2. Since FGSM is $L_infty$ based and considered one of the weakest attack methods, I am curious whether your proposed method would still be effective against more advanced transfer attacks.  

3. In Section 4.6, you attempt to demonstrate that your method is computationally inexpensive, but it is quite confusing to understand why this is the case from Fig. 8. Could you provide any plots related to computational complexity or time to support your argument?
soundness: 2
strengths: 1. The idea presented in the paper is interesting.
2. Lots of experiments have been conducted to support the conclusions.
3. The paper considers various aspects of robustness, including both *adversarial robustness* and *common corruptions*.
summary: Inspired by the work of Li et al. (2019) and guided by the observation that pixel similarities in the original image exhibit a pattern similar to neural recordings, the authors propose a new regularization method to improve neural network robustness with a significant reduction in computational requirements. As claimed by the authors, the proposed method also applies to colour datasets and has been tested on ResNet18 using CIFAR10, CIFAR100, and ImageNet with Gaussian noise and some black-box attacks.
weaknesses: 1. There are lots of obvious grammar, abbreviation, and citation errors in the paper. Aside from the grammar mistakes, such as in line 12 of the Abstract where it says "... but they tend to sensitive ..." which should be "... they tend to be sensitive...", nearly all equation references are incorrectly formatted. It should be "Equation" or "Eq." instead of "eq.equation." Additionally, please check the references you've used. For instance, on lines 83-84 of page 2, you incorrectly cite Szegedy et al. (2013) ... Madry et al. (2017) without proper formatting. A parenthesis is likely needed here; please refer to the formatting instructions in section 4.1. You should review the paper at least once before submission.
    
2. The writing and organization of the paper are very vague and confusing. In the Introduction section on page 2, you list six contributions of your work. However, some of these contributions are too trivial to be included as a separate item. For example, in the fourth contribution, you state: 'We assess the robustness of the regularized models to common corruptions using the CIFAR-10-C dataset (Hendrycks & Dietterich, 2019a).' I do not believe this alone is substantial enough to be listed as a contribution. Some contributions could be combined. In the last contribution, you mention: 'We show that our regularization method primarily protects against high-frequency perturbations…,' which explains the mechanism behind your proposed method but does not stand alone as a contribution. Instead, the sentence on lines 74-75 serves more as a contribution but is not included in the contributions list.
 
3. Outdated related works. In the related works section, the most recent work you mention on adversarial attacks is from 2017, which was published seven years ago. You should include at least one recent study. Additionally, the most recent work across all of your related works is Kireev et al. (2022), which is only mentioned once. I suggest incorporating a broader scope of more up-to-date works.

4. Some concepts are not clearly explained. On page 3, lines 137-138, you mention S_{i,j}^{target} as the target's pairwise cosine similarity, but it is unclear what 'target' refers to.

5. Some of your claims need clearer evidence. On page 4, lines 162-166, you mention a similarity in the pattern of correlation between neural representational similarity and image pixel similarity, but the only evidence provided is Fig. 2, which is not convincing on its own. Additionally, your explanation of Fig. 2 is quite vague. For example, in the leftmost figure of Fig. 2, I see r=0.83, but there is no explanation provided for this value.

---

confidence: 5
contribution: 1
initial_rating: 3
presentation: 2
questions: How does the method presented compare with current defenses?
soundness: 3
strengths: The strengths of this paper include an accessible regularizer that enhances robustness without neural data and computational efficiency by avoiding data augmentations.
I find the brain-inspired motivation of the paper also worthwhile.
summary: The paper introduces a new, brain-inspired regularizer for CNNs that enhances robustness against adversarial attacks without needing neural data. By using pixel-based similarity measures instead of neural recordings, the proposed method simplifies implementation and makes the regularization process computationally efficient. Tests across several datasets and adversarial attacks (e.g., Gaussian noise, FGSM, and Boundary Attacks) show that this approach achieves significant robustness. Though it doesn’t outperform the latest adversarial defenses on all fronts, it holds promise for practical applications requiring efficient and accessible methods for adversarial robustness. The findings highlight how neuroscience-inspired regularizers can improve machine learning models without heavy data dependencies.
weaknesses: There are many weaknesses.
The authors only tested on CIFAR. I could not see any tests comparing with the large amount of defenses available today. 
The paper is heavily based on the paper from Li 2019.
I find the presentation to be lacking. There are no figures explaining the bioinspiration or the motivation behind the method,  or even how does this differs from the work from Li 2019.
The improvement from regularization looks very similar to the ones achieved by simple adversarial training. 
The choice of attacks could. have been more diverse. L0 and Linfty attacks with both white and black box types are the standard for evaluation.

Meta-review: This paper proposes a brain-inspired regularizer that replaces neural recordings with image pixel similarities to enhance adversarial robustness in CNNs. Reviewers appreciated the novelty of removing the dependency on neural data and the potential computational efficiency of the approach. However, several concerns were raised: the evaluations were limited to weaker and outdated adversarial attacks (e.g., FGSM and Boundary attacks), with no testing on modern white-box or stronger black-box attacks. Experiments were restricted to ResNet18, with limited generalization to other architectures. Reviewers also flagged significant issues with writing, including grammar errors, vague explanations of concepts like "target" similarity, and poor formatting. Additionally, the related work section was seen as outdated, lacking references to recent adversarial defenses. While the idea is promising, the submission requires clearer presentation, more rigorous evaluation, and stronger positioning against current methods to meet the standards of ICLR 2025.

Decision: Reject