Finding Biological Plausibility for Adversarially Robust Features via Metameric Tasks

1 INTRODUCTION . Texture-based summary statistic models of the human periphery have been shown to explain key phenomena such as crowding ( Balas et al. , 2009 ; Freeman & Simoncelli , 2011 ) and performance on visual search tasks ( Rosenholtz et al. , 2012 ) when used to synthesize feature-matching images . These analysis-by-synthesis models have also been used to explain mid-level visual computation ( e.g . V2 ) via perceptual discrimination tasks on images for humans and primates ( Freeman & Simoncelli , 2011 ; Ziemba et al. , 2016 ; Long et al. , 2018 ) . However , while summary statistic models can succeed at explaining peripheral computation in humans , they fail to explain foveal computation and core object recognition that involve other representational strategies ( Logothetis et al. , 1995 ; Riesenhuber & Poggio , 1999 ; DiCarlo & Cox , 2007 ; Hinton , 2021 ) . Modelling foveal vision with deep learning indeed has been the focus of nearly all object recognition systems in computer vision ( as machines do not have a periphery ) ( LeCun et al. , 2015 ; Schmidhuber , 2015 ) – yet despite their overarching success in a plethora of tasks , they are vulnerable to adversarial perturbations . This phenomena indicates : 1 ) a critical failure of current artificial systems ( Goodfellow et al. , 2015 ; Szegedy et al. , 2014 ) ; and 2 ) a perceptual mis-alignment of such systems with humans ( Golan et al. , 2020 ; Feather et al. , 2019 ; Firestone , 2020 ; Geirhos et al. , 2021 ; Funke et al. , 2021 ) – with some exceptions ( Elsayed et al. , 2018 ) . Indeed , there are many strategies to alleviate these sensitivities to perturbations , such as data-augmentation ( Rebuffi et al. , 2021 ; Gowal et al. , 2021 ) , biologically-plausible inductive biases ( Dapello et al. , 2020 ; Reddy et al. , 2020 ; Jonnalagadda et al. , 2021 ) , and adversarial training ( Tsipras et al. , 2019 ; Madry et al. , 2017 ) . This last strategy in particular ( adversarial training ) is popular , but has been criticized as being non-biologically plausible – despite yielding some perceptually aligned images when inverting their representations ( Engstrom et al. , 2019 ; Santurkar et al. , 2019 ) . Motivated by prior work on summary statistic models of peripheral computation and their potential resemblance to inverted representations of adversarially trained networks , we wondered if these two apparently disconnected phenomena from different fields share any similarities ( See Figure 1 ) . Could it be that adversarially trained networks are robust because they encode object representations similar to human peripheral computation ? We know machines do not have peripheral computation ( Azulay & Weiss , 2019 ; Deza & Konkle , 2020 ; Alsallakh et al. , 2021 ) , yet are susceptible to a type of adversarial attacks that humans are not . We hypothesize that object representation arising in human peripheral computation holds a critical role for high level robust vision in perceptual systems , but testing this has not been done . Thus , the challenge we now face is how to compare an adversarially trained neural network model to current models of peripheral/mid-level visual processing – and ultimately to human observers as the objective ground-truth . However , determining such perceptual parameterizations is computationally intractable . Inspired by recent works that test have tested summary statistic models via metameric discrimination tasks ( Deza et al. , 2019b ; Wallis et al. , 2016 ; 2017 ; 2019 ) , we can evaluate how well the adversarially robust CNN model approximates the types of computations present in human peripheral vision with a set of rigorous psychophysical experiments wrt synthesized stimuli . Our solution consists of performing a set of experiments where we will evaluate the rates of human perceptual discriminability as a function of retinal eccentricity across the synthesized stimuli from an adversarially trained network vs synthesized stimuli from models of mid-level/peripheral computation . If the decay rates at which the perceptual discriminability across different stimuli are similar , then this would suggest that the transformations learned in an adversarially trained network are related to the transformations done by models of peripheral computation – and thus , to the human visual system . It is worth noting that although adversarially robust representations have been shown to be more human-perceptually aligned ( Ilyas et al. , 2019 ; Engstrom et al. , 2019 ; Santurkar et al. , 2019 ) , they still look quite different when placed in the foveal region from the original reference image ( Feather et al. , 2021 ) . However , our eccentricity-varying psychophysical experiments are motivated by empirical work that suggests that the human visual periphery represents input in a texture-like scrambled way , that can appear quite different than how information is processed in the fovea ( Rosenholtz , 2016 ; Stewart et al. , 2020 ; Herrera-Esposito et al. , 2021 ) . 2 SYNTHESIZING STIMULI AS A WINDOW TO MODEL REPRESENTATION . Suppose we have the functions gAdv ( ◦ ) and gStandard ( ◦ ) that represent the adversarially trained and standard ( non-adversarially ) trained neural networks ; how can we compare them to human peripheral computation if the function gHuman ( ◦ ) is computationally intractable ? One solution is to take an analysis-by-synthesis approach and to synthesize a collection of stimuli that match the feature response of the model we ’ d like to analyze – this is also known as feature inversion ( Mahendran & Vedaldi , 2015 ; Feather et al. , 2019 ) . If the inverted features ( stimuli ) of two models are perceptually similar , then it is likely that the learned representations are also aligned . For example , if we ’ d like to know what is the stimuli x′ that produces the same response to the stimuli x for a network g′ ( ◦ ) , we can perform the following minimization : x′ = argmin x0 [ ||g′ ( x ) − g′ ( x0 ) ||2 ] ( 1 ) In doing so , we find x′ which should be different from x for a non-trivial solution . This is known as a metameric constraint for the stimuli pair { x , x0 } wrt to the model g′ ( ◦ ) : g′ ( x ) = g′ ( x′ ) s.t . x 6= x′ for a starting pre-image x0 that is usually white noise in the iterative minimization of Eq.1 . Indeed , for the adversarially trained network of Ilyas et al . ( 2019 ) ; Engstrom et al . ( 2019 ) ; Santurkar et al . ( 2019 ) , we can synthesize robust stimuli wrt to the original image x via : x̃ = argmin x0 [ ||gAdv ( x ) − gAdv ( x0 ) ||2 ] ( 2 ) which implies – if the minimization goes to zero – that : ||gAdv ( x ) − gAdv ( x̃ ) ||2 = 0 ( 3 ) Recalling the goal of this paper , we ’ d like to investigate if the following statement is true : “ a transformation resembling peripheral computation in the human visual system can closely be approximated by an adversarially trained network ” , which is formally translated as : gAdv ∼ gr∗Human for some retinal eccentricity ( r∗ ) , then from Eq . 3 we can also derive : ||gr∗Human ( x ) − g r∗ Human ( x̃ ) ||2 = 0 ( 4 ) However , gHuman ( ◦ ) is computationally intractable , so how can we compute Eq.4 ? A first step is to perform a psychophysical experiment such that we find a retinal eccentricity r∗ at which human observers can not distinguish between the original and synthesized stimuli – thus behaviourally proving that the condition above holds , without the need to directly compute gHuman . More generally , we ’ d like to compare the psychometric functions between stimuli generated from a standard trained network ( standard stimuli ) , an adversarially trained network ( robust stimuli ) , and a model that captures peripheral and mid-level visual computation ( texform stimuli ( Freeman & Simoncelli , 2011 ; Long et al. , 2018 ) ) . Then we will assess how the psychometric functions vary as a function of retinal eccentricity . If there is significant overlap between psychometric functions between one model wrt the model of peripheral computation ; then this would suggest that the transformations developed by such model are similar to those of human peripheral computation . We predict that this will be the case for the adversarially trained network ( gAdv ( ◦ ) ) . Formally , for any model g , and its synthesized stimuli xg – as shown in Figure 2 , we will define the psychometric function δHuman , which depends on the eccentricity r as : δHuman ( g ; r ) = ||grHuman ( x ) − grHuman ( xg ) ||2 ( 5 ) where we hope to find : δHuman ( gAdv ; r ) = δHuman ( gTexform ; r ) ; ∀r . ( 6 ) 2.1 STANDARD AND ROBUST MODEL STIMULI . To evaluate robust vs non-robust feature representations , we used the ResNet-50 models of Santurkar et al . ( 2019 ) ; Ilyas et al . ( 2019 ) ; Engstrom et al . ( 2019 ) . We used their models so that our results could be interpreted in the context of their findings that features may drive robustness . Both models were trained on a subset of ImageNet ( Russakovsky et al. , 2015 ) , termed Restricted ImageNet ( Table 1 ) . The benefit of Restricted ImageNet , stated by Ilyas et al . ; Engstrom et al. , is models can achieve better standard accuracy than on all of ImageNet . One drawback is that it is imbalanced across classes . Although the class imbalance was not problematic for comparing the adversarially robust model to standard-trained one , we did ensure that there was a nearly equal number of images per class when selecting images for our stimulus set to avoid class effects in our experiment ( i.e . people are better at discriminating dog examples than fishes independent of the model training ) . Using their readily available models , we synthesized robust and standard model stimuli using an image inversion procedure ( Mahendran & Vedaldi , 2015 ; Gatys et al. , 2015 ; Santurkar et al. , 2019 ; Engstrom et al. , 2019 ; Ilyas et al. , 2019 ) . We used gradient descent to minimize the difference between the representation of the second-to-last network layer of a target image and an initial noise seed as shown in Figure 9 . Target images were randomly chosen from the test set of Restricted ImageNet . We chose 100 target images for each of the 9 classes and synthesized a robust and standard stimulus for 2 different noise seeds . 5 target images were later removed as they were grayscale and could not also be rendered as Texforms with the same procedure as the majority . All stimuli were synthesized at a size of 256 × 256 pixels , this was equivalent to 6.67× 6.67 degrees of visual angle ( d.v.a . ) when performing the psychophysical experiments ( See A.6 for calculation ) . 2.2 TEXFORM STIMULI . Texforms ( Long et al. , 2018 ) are object-equivalent rendered stimuli from the Freeman & Simoncelli ( 2011 ) ; Rosenholtz et al . ( 2012 ) models that break the metameric constraint to test for mid-level visual representations in Humans . These stimuli – initially inspired by the experiments of Balas et al . ( 2009 ) – preserve the coarse global structure of the image and its localized texture statistics ( Portilla & Simoncelli , 2000 ) . Critically , we use the texform stimuli – voiding the metameric constraint – as a perceptual control for the robust stimuli , as the texforms incarnate a sub-class of biologicallyplausible distortions that loosely resemble the mechanisms of human peripheral processing .

Summary: This paper examines whether an adversarially trained (“robust”) ResNet-50 classification model might better resemble the representation of human peripheral vision than a non-adversarially trained (“non-robust”) model. It does so by means of a human perceptual experiment: test images from Restricted ImageNet (a collapsed subset of ImageNet comprising 9 super-classes) are resynthesized via gradient descent from random noise initial conditions by minimizing the L2 difference in the penultimate feature activation of both a robust and non-robustmodel.  In addition, the same stimuli are resynthesized according to previously validated models of summary statistic based peripheral computation (Texforms). A range of perceptual discrimination experiments (odd-one-out and two alternative forced-choice) are carried out with human subjects among different pairs of stimuli (original, robust, non-robust and texform) at varying degrees of peripheral eccentricity. The experiments show that the discriminability of robust and texform stimuli vs original stimuli degrade similarly with increasing eccentricity, while non-robust stimuli are relatively easy to pick out vs original stimuli at all levels of eccentricity.