Finding Biological Plausibility for Adversarially Robust Features via Metameric Tasks

1 INTRODUCTION . Texture-based summary statistic models of the human periphery have been shown to explain key phenomena such as crowding ( Balas et al. , 2009 ; Freeman & Simoncelli , 2011 ) and performance on visual search tasks ( Rosenholtz et al. , 2012 ) when used to synthesize feature-matching images . These analysis-by-synthesis models have also been used to explain mid-level visual computation ( e.g . V2 ) via perceptual discrimination tasks on images for humans and primates ( Freeman & Simoncelli , 2011 ; Ziemba et al. , 2016 ; Long et al. , 2018 ) . However , while summary statistic models can succeed at explaining peripheral computation in humans , they fail to explain foveal computation and core object recognition that involve other representational strategies ( Logothetis et al. , 1995 ; Riesenhuber & Poggio , 1999 ; DiCarlo & Cox , 2007 ; Hinton , 2021 ) . Modelling foveal vision with deep learning indeed has been the focus of nearly all object recognition systems in computer vision ( as machines do not have a periphery ) ( LeCun et al. , 2015 ; Schmidhuber , 2015 ) – yet despite their overarching success in a plethora of tasks , they are vulnerable to adversarial perturbations . This phenomena indicates : 1 ) a critical failure of current artificial systems ( Goodfellow et al. , 2015 ; Szegedy et al. , 2014 ) ; and 2 ) a perceptual mis-alignment of such systems with humans ( Golan et al. , 2020 ; Feather et al. , 2019 ; Firestone , 2020 ; Geirhos et al. , 2021 ; Funke et al. , 2021 ) – with some exceptions ( Elsayed et al. , 2018 ) . Indeed , there are many strategies to alleviate these sensitivities to perturbations , such as data-augmentation ( Rebuffi et al. , 2021 ; Gowal et al. , 2021 ) , biologically-plausible inductive biases ( Dapello et al. , 2020 ; Reddy et al. , 2020 ; Jonnalagadda et al. , 2021 ) , and adversarial training ( Tsipras et al. , 2019 ; Madry et al. , 2017 ) . This last strategy in particular ( adversarial training ) is popular , but has been criticized as being non-biologically plausible – despite yielding some perceptually aligned images when inverting their representations ( Engstrom et al. , 2019 ; Santurkar et al. , 2019 ) . Motivated by prior work on summary statistic models of peripheral computation and their potential resemblance to inverted representations of adversarially trained networks , we wondered if these two apparently disconnected phenomena from different fields share any similarities ( See Figure 1 ) . Could it be that adversarially trained networks are robust because they encode object representations similar to human peripheral computation ? We know machines do not have peripheral computation ( Azulay & Weiss , 2019 ; Deza & Konkle , 2020 ; Alsallakh et al. , 2021 ) , yet are susceptible to a type of adversarial attacks that humans are not . We hypothesize that object representation arising in human peripheral computation holds a critical role for high level robust vision in perceptual systems , but testing this has not been done . Thus , the challenge we now face is how to compare an adversarially trained neural network model to current models of peripheral/mid-level visual processing – and ultimately to human observers as the objective ground-truth . However , determining such perceptual parameterizations is computationally intractable . Inspired by recent works that test have tested summary statistic models via metameric discrimination tasks ( Deza et al. , 2019b ; Wallis et al. , 2016 ; 2017 ; 2019 ) , we can evaluate how well the adversarially robust CNN model approximates the types of computations present in human peripheral vision with a set of rigorous psychophysical experiments wrt synthesized stimuli . Our solution consists of performing a set of experiments where we will evaluate the rates of human perceptual discriminability as a function of retinal eccentricity across the synthesized stimuli from an adversarially trained network vs synthesized stimuli from models of mid-level/peripheral computation . If the decay rates at which the perceptual discriminability across different stimuli are similar , then this would suggest that the transformations learned in an adversarially trained network are related to the transformations done by models of peripheral computation – and thus , to the human visual system . It is worth noting that although adversarially robust representations have been shown to be more human-perceptually aligned ( Ilyas et al. , 2019 ; Engstrom et al. , 2019 ; Santurkar et al. , 2019 ) , they still look quite different when placed in the foveal region from the original reference image ( Feather et al. , 2021 ) . However , our eccentricity-varying psychophysical experiments are motivated by empirical work that suggests that the human visual periphery represents input in a texture-like scrambled way , that can appear quite different than how information is processed in the fovea ( Rosenholtz , 2016 ; Stewart et al. , 2020 ; Herrera-Esposito et al. , 2021 ) . 2 SYNTHESIZING STIMULI AS A WINDOW TO MODEL REPRESENTATION . Suppose we have the functions gAdv ( ◦ ) and gStandard ( ◦ ) that represent the adversarially trained and standard ( non-adversarially ) trained neural networks ; how can we compare them to human peripheral computation if the function gHuman ( ◦ ) is computationally intractable ? One solution is to take an analysis-by-synthesis approach and to synthesize a collection of stimuli that match the feature response of the model we ’ d like to analyze – this is also known as feature inversion ( Mahendran & Vedaldi , 2015 ; Feather et al. , 2019 ) . If the inverted features ( stimuli ) of two models are perceptually similar , then it is likely that the learned representations are also aligned . For example , if we ’ d like to know what is the stimuli x′ that produces the same response to the stimuli x for a network g′ ( ◦ ) , we can perform the following minimization : x′ = argmin x0 [ ||g′ ( x ) − g′ ( x0 ) ||2 ] ( 1 ) In doing so , we find x′ which should be different from x for a non-trivial solution . This is known as a metameric constraint for the stimuli pair { x , x0 } wrt to the model g′ ( ◦ ) : g′ ( x ) = g′ ( x′ ) s.t . x 6= x′ for a starting pre-image x0 that is usually white noise in the iterative minimization of Eq.1 . Indeed , for the adversarially trained network of Ilyas et al . ( 2019 ) ; Engstrom et al . ( 2019 ) ; Santurkar et al . ( 2019 ) , we can synthesize robust stimuli wrt to the original image x via : x̃ = argmin x0 [ ||gAdv ( x ) − gAdv ( x0 ) ||2 ] ( 2 ) which implies – if the minimization goes to zero – that : ||gAdv ( x ) − gAdv ( x̃ ) ||2 = 0 ( 3 ) Recalling the goal of this paper , we ’ d like to investigate if the following statement is true : “ a transformation resembling peripheral computation in the human visual system can closely be approximated by an adversarially trained network ” , which is formally translated as : gAdv ∼ gr∗Human for some retinal eccentricity ( r∗ ) , then from Eq . 3 we can also derive : ||gr∗Human ( x ) − g r∗ Human ( x̃ ) ||2 = 0 ( 4 ) However , gHuman ( ◦ ) is computationally intractable , so how can we compute Eq.4 ? A first step is to perform a psychophysical experiment such that we find a retinal eccentricity r∗ at which human observers can not distinguish between the original and synthesized stimuli – thus behaviourally proving that the condition above holds , without the need to directly compute gHuman . More generally , we ’ d like to compare the psychometric functions between stimuli generated from a standard trained network ( standard stimuli ) , an adversarially trained network ( robust stimuli ) , and a model that captures peripheral and mid-level visual computation ( texform stimuli ( Freeman & Simoncelli , 2011 ; Long et al. , 2018 ) ) . Then we will assess how the psychometric functions vary as a function of retinal eccentricity . If there is significant overlap between psychometric functions between one model wrt the model of peripheral computation ; then this would suggest that the transformations developed by such model are similar to those of human peripheral computation . We predict that this will be the case for the adversarially trained network ( gAdv ( ◦ ) ) . Formally , for any model g , and its synthesized stimuli xg – as shown in Figure 2 , we will define the psychometric function δHuman , which depends on the eccentricity r as : δHuman ( g ; r ) = ||grHuman ( x ) − grHuman ( xg ) ||2 ( 5 ) where we hope to find : δHuman ( gAdv ; r ) = δHuman ( gTexform ; r ) ; ∀r . ( 6 ) 2.1 STANDARD AND ROBUST MODEL STIMULI . To evaluate robust vs non-robust feature representations , we used the ResNet-50 models of Santurkar et al . ( 2019 ) ; Ilyas et al . ( 2019 ) ; Engstrom et al . ( 2019 ) . We used their models so that our results could be interpreted in the context of their findings that features may drive robustness . Both models were trained on a subset of ImageNet ( Russakovsky et al. , 2015 ) , termed Restricted ImageNet ( Table 1 ) . The benefit of Restricted ImageNet , stated by Ilyas et al . ; Engstrom et al. , is models can achieve better standard accuracy than on all of ImageNet . One drawback is that it is imbalanced across classes . Although the class imbalance was not problematic for comparing the adversarially robust model to standard-trained one , we did ensure that there was a nearly equal number of images per class when selecting images for our stimulus set to avoid class effects in our experiment ( i.e . people are better at discriminating dog examples than fishes independent of the model training ) . Using their readily available models , we synthesized robust and standard model stimuli using an image inversion procedure ( Mahendran & Vedaldi , 2015 ; Gatys et al. , 2015 ; Santurkar et al. , 2019 ; Engstrom et al. , 2019 ; Ilyas et al. , 2019 ) . We used gradient descent to minimize the difference between the representation of the second-to-last network layer of a target image and an initial noise seed as shown in Figure 9 . Target images were randomly chosen from the test set of Restricted ImageNet . We chose 100 target images for each of the 9 classes and synthesized a robust and standard stimulus for 2 different noise seeds . 5 target images were later removed as they were grayscale and could not also be rendered as Texforms with the same procedure as the majority . All stimuli were synthesized at a size of 256 × 256 pixels , this was equivalent to 6.67× 6.67 degrees of visual angle ( d.v.a . ) when performing the psychophysical experiments ( See A.6 for calculation ) . 2.2 TEXFORM STIMULI . Texforms ( Long et al. , 2018 ) are object-equivalent rendered stimuli from the Freeman & Simoncelli ( 2011 ) ; Rosenholtz et al . ( 2012 ) models that break the metameric constraint to test for mid-level visual representations in Humans . These stimuli – initially inspired by the experiments of Balas et al . ( 2009 ) – preserve the coarse global structure of the image and its localized texture statistics ( Portilla & Simoncelli , 2000 ) . Critically , we use the texform stimuli – voiding the metameric constraint – as a perceptual control for the robust stimuli , as the texforms incarnate a sub-class of biologicallyplausible distortions that loosely resemble the mechanisms of human peripheral processing .

Summary: The authors hypothesize that description of visual textures/objects using summary statistics (as may be doing the human vision in the periphery) may induce robustness to adversarial examples.   In the discussion they argue that this may be the case because imposing separability of classes with high-variance (responses of peripheral vision) leads to enlarged class separation of small-variance sets in foveal vision which have the same mean.   The authors check their initial hypothesis in an indirect way: they check that robust representations to adversarial attacks resemble human representations. They do so by comparing \tilde{x} (synthesized images from networks which are robust to adversarial examples) and \hat{x} (synthesized images from models of human peripheral vision). They argue that given the fact that these classes of images (\tilde{x} and \hat{x}) are equally discriminable by humans from the original images, x, the image representation of robust networks is similar to the (periphery) image representation in humans. The authors also compare the discriminability of images, x_s, generated from standard (non-robust) networks.  The specific way in which \tilde{x}, \hat{x} and x_s are compared is measuring the psychometric function (over eccentricity) so that these images are discriminable by humans from the original image. Interestingly, these images are also compared using subjective image distortion metrics.