Finding Biological Plausibility for Adversarially Robust Features via Metameric Tasks
Authors: Anne Harrington
Arturo Deza
Venue: ICLR 2022 Spotlight (2022)
Keywords: Peripheral Computation
Adversarial Robustness
Perceptual Invariance
Metamerism
Texture
Psychophysics

Abstract: Recent work suggests that feature constraints in the training datasets of deep neural networks (DNNs) drive robustness to adversarial noise (Ilyas et al., 2019). The representations learned by such adversarially robust networks have also been shown to be more human perceptually-aligned than non-robust networks via image manipulations (Santurkar et al., 2019, Engstrom et al., 2019). Despite appearing closer to human visual perception, it is unclear if the constraints in robust DNN representations match biological constraints found in human vision. Human vision seems to rely on texture-based/summary statistic representations in the periphery, which have been shown to explain phenomena such as crowding (Balas et al., 2009) and performance on visual search tasks (Rosenholtz et al., 2012). To understand how adversarially robust optimizations/representations compare to human vision, we performed a psychophysics experiment using a metamer task similar to Freeman \& Simoncelli, 2011, Wallis et al., 2016 and Deza et al., 2019 where we evaluated how well human observers could distinguish between images synthesized to match adversarially robust representations compared to non-robust representations and a texture synthesis model of peripheral vision (Texforms a la Long et al., 2018).  We found that the discriminability of robust representation and texture model images decreased to near chance performance as stimuli were presented farther in the periphery.  Moreover, performance on robust and texture-model images showed similar trends within participants, while performance on non-robust representations changed minimally across the visual field.  These results together suggest that (1) adversarially robust representations capture peripheral computation better than non-robust representations and (2) robust representations capture peripheral computation similar to current state-of-the-art texture peripheral vision models. More broadly, our findings support the idea that localized texture summary statistic representations may drive human invariance to adversarial perturbations and that the incorporation of such representations in DNNs could give rise to useful properties like adversarial robustness.

Published as a conference paper at ICLR 2022
FINDING BIOLOGICAL PLAUSIBILITY FOR ADVER- SARIALLY ROBUST FEATURES VIA METAMERIC TASKS
Anne Harrington & Arturo Deza Center for Brains, Minds and Machines Massachusetts Institute of Technology (annekh, deza @mi t. edu
ABSTRACT
Recent work suggests that feature constraints in the training datasets of deep neu- ral networks (DNNs) drive robustness to adversarial noise (Ilyas et al. 2019). The representations learned by such adversarially robust networks have also been shown to be more human perceptually-aligen
than non-robust networks via im- age manipulations (Santurkar et al. 2019; [Engstro et al., 2019). Despite ap- pearing closer to human visual perception, is unclear if the constraints in robust DNN representations match biological constraints found in human vision. Human vision seems to rely riphery, which have been shown to explain phenomena such as crowding (Balas) et al. 2009) and performance on visual search tasks (Rosenholtz et al. 2012).
statistic representations in the pe-
To understand how adversarially robust optimizaiionm/rppeeenttttisss compare to human vision, we performed psychophysics experiment using metamer task similar to FFreeman & Simoncelli (2011): Wallis et al. (2019); Deza et al. (2019b) where we evaluated how well human observers could distinguish between im- ages synthesized to match adversarially robust representations compared to non- robust representations and texture synthesis model of peripheral vision (Tex- forms (Long et al. 2018)). We found that the discriminability of robust rep- resentation and texture model images decreased to near chance performance as stimuli were presented farther in the periphery. Moreover, performance robust and texture-model images showed similar trends within participants, while perfor- mance on non-robust representations changed minimally across the visual field. These results together suggest that (1) adversarially robust representations cap- ture peripheral computation better than non-robust representations and (2) robust representations capture peripheral computation similar to current state-of-the-ar texture peripheral vision models. More broadly, our findings support the idea that localized texture summary statistic representations may drive human invariance to adversarial perturbations and that the incorporation of such representations DNNs could give rise useful properties like adversarial robustness. Link Code/Data: http://gghhhccoooommmmmooogoo//e Row.llly--ooooutt--ep-ep
INTRODUCTION
Texture-based summary statistic models of the human periphery have been shown to explain key
phenomena such as crowding (Balas et al. 2009 Freeman & Simoncelli] 2011) and performance on visual search tasks (Rosenholtz al. (012)) when used to synthesize reature-matching images. These amalysi--by-synthest
models have also been used to explain mid-level visual computation (e.g. V2) via perceptual discrimination tasks on images for humans and primates (Freeman Si- moncelli 2011 Ziemba et al. 2016: Long et al. 2018).
However, while summary statistic models can succeed at explaining peripheral computation in hu- mans, they fail to explain foveal computation and core object recognition that involve other repre- sentational strategies (Logothetis et al. 1995) Riesenhuber & Poggio 1999 DiCarlo & Cox 2007 Hinton 2021). Modelling foveal vision with deep learning indeed has been the focus of nearly all object recognition systems in computer vision (as machines do not have a periphery) (LeCun et al. 2015 Schmidhuber 2015)
yet despite their overarching success in plethora of tasks, they

---

Published as a conference paper at ICLR 2022
eccentricity (9)
Figure 1: A sample un- un-perturbed (left) and synthesized adversarially robust (right) image are shown peripherally. When human observer fixates at the orange dot (center), both images now placed away from the fovea - are perceptually indistinguishable to each other (i.e. metameric). In this paper we investigate if there is relationship between peripheral representations in humans and learned representations of adversarially trained networks in machines an analysis-by-synte We psychophysically test this phenomena over variety of images synthesized from adversarially trained network, a -aneerrsaarrllly trained network, and a model of peripheral computation as we manipulate retinal eccentricity over 12 humans subjects.
approach.
vulnerable to adversarial perturbations. This phenomena indicates: 1) a critical failure of current
artificial systems (Goodfellow et 2015 Szegedy et al. al. [0114); and 2) a perceptual mis-alignment
of such systems with humans (Golan et al. 2020; Feather et al., 2019 Firestone 2020 Geirhos
jet al.
2021: Funke al. 2021) with some exceptions (Elsayed et al. 2018). Indeed, there
many strategies to alleviate these sensitivities to perturbations, such as dute-nungnnttttion (Rebuffi
jet al.
2021 Gowal al. 2021), biologically-plausiie
inductive biases (Dapello al.. 2020 Reddy
eet al.
2020 Jonnalagadda et al.) (02T). and adversarial training (Tsipras et al. 2019 Madry et al.)
20017.
This last strategy in particular (adversarial training) is popular, but has been criticized as be- ing non- non-biologically plausible - despite yielding some perceptually aligned images when inverting
their representations (Engstrom et al., 2019 Santurkar al. 2019
Motivated by prior work on summary statistic models of peripheral computation and their poten- tial resemblance inverted representations of adversarially trained networks, we wondered if these two apparently disconnected phenomena from different fields share any similarities (See Figure I]- Could be that adversarially trained networks are robust because they encode object representa- tions similar to human peripheral computation? We know machines do not have peripheral compu- tation (Azulay & Weiss 2019 Deza Konkle 2020 Alsallakh et al. 202I), p. yet are susceptible to a type of adversarial attacks that humans are not. We hypothesize that object representation arising in human peripheral computation holds a critical role for high level robust vision in perceptual systems, but testing this has not been done.
Thus, the challenge we now face is how to compare an adversarially trained neural network model to current models of peripheral/mmidlleell visual processing and ultimately human observers the objective ground-truth. However, determining such perceptual parameterizations is computationally intractable. Inspired by recent works that have tested summary statistic models via metameric discrimination tasks (Deza et al.] 2019b] Wallis et al.] 2016 2017] 2019). we can evaluate how well the adversarially robust CNN model approximates the types of computations present human peripheral vision with set of rigorous psychophysical experiments wrt synthesized stimuli.
Our solution consists of performing set of experiments where we will evaluate the rates of hu- man perceptual discriminability as a function of retinal eccentricity across the synthesized stimuli from an adversarially trained network vs synthesized stimuli from models of mid-level/periphhral computation. If the decay rates at which the perceptual discriminability across different stimuli are similar, then this would suggest that the transformations learned in an adversarially trained network are related to the transformations done by models of peripheral computation and thus, to the hu- man visual system. It is worth noting that although adversarially robust representations have been shown to be more Human-perceptuue let al. 2019). they still look quite different when placed in the foveal region from the original ref- erence image (Feather et al. 2021). However, eccentricity-varyinn psychophysical experiments
aligned (Ilyas et al. 2019: Engstrom et al. 2019: Santurkar
2

---

Published as a conference paper at ICLR 2022
Stimuli Synthesizzed from:
Mode trat
Modal thetess
Model thut accoants for
Standard
Synthesize mazch Original
Original
Noise Seed
Synthesize to macch Original
CNN
Standard Accuracy: Adversarially Robust:
Human
Perceptually-Aligne
(kelagisaly Flaalia Teranerattor)
in this paper
Figure 2: A sub-collection of different synthesized stimuli used in our experiments that shows the differences across (columns) and within (rows) perceptual models. The original stimuli is shown on the left, while two parallel Noise Seeds, give rise to different samples for the Standard, Robust and Texform stimuli. Critically, an adversarially trained network which was used to synthesize the Robust stimuli (Engstrom al. 2019)- has implicitly learned to encode a structural prior with localized texture-Iie distortions similar to the physiologically motivated Texforms that account for several phenomena of human peripheral computation (Freeman & Simoncelli 2011 Rosenholtz et al. 2012 Long et al.] 2018). However, Standard stimuli, which are images synthesized from network with Regular (Non-Adee Adversarial) training have no resemblance to the original sample. this paper we evaluate how similar these models are, via their derived stimuli, with set of controlled human psychophysics experiments where we vary the retinal eccentricity of the stimuli.
are motivated by empirical work that suggests that the human visual periphery represents input in texture-like scrambled way, that can appear quite different than how information is processed the fovea (Rosenholtz) 2016 Stewart et al. 2020 Herrera-Esposito et al. 2021).
2 SYNTHESIZING STIMULI AS A WINDOW TO MODEL REPRESENTATION
Suppose we have the functions g (o) and (Standard that represent the adversarially trained and standard moon-ddeersaiillyy) trained neural networks; how can we compare them to human periph- eral computation if the function MHummn (o) is computationally intractable?
One solution is to take an analysis- seiss----yythhcc approach and to synthesize collection of stimuli that match the feature response of the model we'd like to analyze this is also known as feature inversion (Mahendran & Vedaldi 20155] Feather et al.] (019). If the inverted features (stimuli) of two models perceptually similar, then it is likely that the learned representations are also aligned. For example. if we'd d like to know what is the stimuli x' that produces the same response to the stimuli for network (o)), we can perform the following minimization:
z' arg min (llglll'(())))) (z) g' (=2))la]
In doing so, we find x' which should be different from æ for a non-trivial solution. This known as metameric constraint for the stimuli pair (z,40), wrt to the model g'(o): g'(x) g'(x') s.t. * x' for a starting pre-image 2i that is usually white noise in the iterative minimization Eq Indeed, for the adversarially trained network of liyas et al. Einsstro et al. (211): (Santurar ct al. (001)), we can synthesize robust stimuli wrt to the original image æ via:
ã arg min g (x) gAav (zu))ll)
which implies if the minimization goes to zero that:
[1gaa< gadv ( (1) 0
3

---

Published as a conference paper at ICLR 2022
Recalling the goal of this paper, we'd d like to investigate if the following statement is true: "a trans- formation resembling peripheral computation in the human visual system can closely be approx- imated by an adversarially trained network". which is formally translated as: 9Adv 9Hmman for some retinal eccentricity (r-), then from Eq. 3 we can also derive:
Human (z) -Hüman (i)ll2 = 0
(4)
However, Human (o) is computationally intractable, so how can we compute 4 A first step to perform psychophysical experiment such that we find retinal eccentricity T. at which human observers can not distinguish between the original and synthesized stimuli - thus behaviourally proving that the condition above holds, without the need to directly compute Pttumun-
More generally, we'd d like to compare the psychometric functions between stimuli generated from a standard trained network (standard stimuli), an adversarially trained network (robust stimuli), and a model that captures peripheral and mid-level visual computation (texform stimuli (Freeman & Simoncelli] 2011 Long et al., 2018)). Then we will assess how the psychometric functions vary as a function of retinal eccentricity. If there is significant overlap between psychometric functions between one model wrt the model of peripheral computation; then this would suggest that the trans- formations developed by such model are similar to those of human peripheral computation. We predict that this will be the case for the adversarially trained network (g)av(o)). Formally, for any model 9, and its synthesized stimuli Tg as shown in Figure 2 function Human, which depends on the eccentricity r as:
we will define the psychometric
Muman (g: r) 11giummn (x) Iituman (12))l2
(5)
where we hope to find:
Juman (gAdvir) = SUammn ( (Texfomm; r); Vr.
(6)
2.1 STANDARD AND ROBUST MODEL STIMULI
To evaluate robust vs non non-rooooee robust feature representations, we used the ResNet-50 models of Santurkar et al. (2019) Ilyas et al. (2019): : Ennssromm et al. (2019). We used their models so that our results could be interpreted in the context of their findings that features may drive robustness. Both models were trained on a subset of ImageNet (Russakovsky et al. 2015). termed Restricted ImageNet (Table [.. The benefit of Restricted ImageNet, stated by Ilyas et al.) Engstrom et al.) is models can achieve better standard accuracy than on all of ImageNet. One drawback is that it is imbalanced across classes. Although the class imbalance was not problematic for comparing the adversarially robust model to standard-tras traineed one, we did ensure that there was a nearly equal number of images per class when selecting images for our stimulus set to avoid class effects in our experiment (i.e. people are better at discriminating dog examples than fishes independent of the model training).
Using their readily available models, we synthesized robust and standard model stimuli using an image inversion procedure (Mahendran & Vedaldi, [015 Gatys et al. 2015) Santurkar et al. 2019)] Engstrom al., 2019; Πlyas et al., 2019). We used gradient descent minimize the difference between the representation of the second-to-lass network layer of a target image and an initial noise seed as shown in Figure 9 Target images were randomly chosen from the test set of Restricted ImageNet. We chose 100 target images for each of the 9 classes and synthesized a robust and standard stimulus for 2 different noise seeds. 5 target images were later removed as they were gray- scale and could not also be rendered as Texforms with the same procedure as the majority. All stimuli were synthesized at a size of 256 x 256 pixels, this was equivalent to 6.67 x 6.67 degrees of visual angle (d.v.a.) when performing the psychophysical experiments (See A.6 calculation).
2.2 TEXFORM STIMULI
Texforms Long et al. 2018 are object-equivalent rendered stimuli from the Freeman & Simoncelli 2011
Rosenholtz et al. (0122) models that break the metameric constraint to test for mid-level visual representations in Humans. These stimuli - initially inspired by the experiments Balas et al.
20099) preserve the coarse global structure of the image and its localized texture statistics (Portilla & Simoncelli 2000). Critically,
the texform stimuli voiding the metameric constraint as a perceptual control for the robust stimuli, as the texforms incarnate a sub-class of biologically- plausible distortions that loosely resemble the mechanisms of human peripheral processing.
4

---

Published as a conference paper at ICLR 2022
Texforms
Texform Perceptual Optimization
Drginal
Tecforn
DISTS Texform vs Robust
0.34
0.30
8. Minimize Difference across Stimuli w.r.t Original
0.28
DISTS
(I,ū)~
I
0.24
Stimuli
Noise seed
Original
E (s.z)
0.22
texform 0.7
texform 0.5
(x,8)~1
200
400
500
700
horizontal fixation (pixets)
Figure 3: (A.) A cartoon depicting the texform generating process where log-polar receptive fields are used as areas over which localized texture synthesis is performed - imitating the type of texture- based computation found in the human periphery and area V2. (B.) The perceptual optimization framework where the goal is to find the set of texform parameters (s.. =.) over which the loss is minimized match the levels of distortions of the robust stimuli before performing human psy- chophysics. (C.) The texform perceptual optimization pipeline results show the DISTS scores (Ding al. 2020) of texforms synthesized across different scaling factors and fixations points compared to ad adversarially robust stimuli synthesized from the same noise seed across 45 images (5 per Re- strictedImageNet class selected randomly). Error bars indicate two standard errors from the mean.
As the texform model has main parameters which are the scaling factor and the simulated point of fixation z, we must perform a perceptual optimization procedure to find the set of texforms that match the robust stimuli E as close as possible (w.r.t to the original image) before testing their discriminability to human observers as function eccentricity. To do this, we used the accelerated texform implementation Deza et al. (2019a) and generated 45 texforms with the initial noise seeds as the robust stimuli to be used as perceptual controls. Similar to Deza & Konkle (2020) we minimize the perceptual dissimilarity 2 to find (sx, 2.) over this subset of images that we will later use in the human psychophysics (~ 900 texforms):
collection of
(8., 2.) = arg min Z = || (((..,) - E (s.0)
(2.2)~/lQ1 (I( a)]l2
(#.2)
for an image quality assessment (IQA) function Q(),)). We selected DISTS in our perceptual optimization setup given that it is the IQA metric that is most tolerant to texture-based transforma- tions (Ding et al., [020]] (02T]. A cartoon illustrating the texform rendering procedure, the percep- tual optimization framework and the respective results can be seen in Figure 3 In our final exper- iments (See Next Section) we used texforms rendered with simulated scale of 0.5 and horizontal simulated point of fixation placed at 640 pixels. Critically, this value is immutable and texforms (like robust stimuli) will not vary function of eccentricity to provide fair discriminability control in the human psychophysics. For a further discussion on texforms and their biological plausibility and/or synthesis procedure, please Supplement A.2
HUMAN PSYCHOPHYSICS: DISCRIMINATING BETWEEN STIMULI AS A FUNCTION OF RETINAL ECCENTRICITY
We designed two human psychophysical experiments: the first was an oddity task similar to Wallis ct al. (2016), and the second was matching, two-alternative forced choice task (2AFC). Two differ- ent tasks were used to evaluate how subjects viewed synthesized images both only in the periphery (oddity) and those they saw in the fovea (matching 2AFC). The oddity task consisted of finding the oddball stimuli out of series of 3 stimuli shown peripherally one after the other (100ms) masked by empty intervals (500ms) while holding center fixation. Chance for the oddity task was out of (33.3)). The matching 2AFC task consisted of viewing stimulus in the fovea (100ms) and then
5

---

Published as a conference paper at ICLR 2022
A1.
Oddity Task
B1.
2AFC Task
Original vs Synth
A2.
Oddity Task
B2.
2AFC Task
Synth vs Synth
Tholes Milms
Chance is out of 3.
Chance is out of 2.
Tests Peripheral to Peripheral Template Matching.
Tests Foveal to Peripheral Template Matching.
Figure 4: A schematic of the two human psychophysics experiments conducted in our paper. The first (A1,,A2.) illustrates Oddity task where observers must determine the 'oddball' stimuli with- out moving their eyes for very brief presentation times (100 ms) that are masked which do not allow for eye-movements
feedback processing, The second experiment (B1.,B.)) shows the 2 Alternative Forced Choice (AFC) Matching Tasks where observers must match the foveal tem- plate to 2 potential candidates on the left or right of the image. All trials are done while observers are instructed to remain fixating at the center of the image. These two experiments test different mechanisms of visual processing. In particular the Oddity task examines discriminability of purely peripherrl-toopeerihhera representations, while the 2AFC task evaluates discriminability of foveal- to-peripheral representation. Differences across rows indicate the type of interleaved trials shown to the observers: (1) Original vs Synthesized, and (2) Synthesized vs Synthesized. Critically these are image perceptual discrimination tasks not image categorization tasks.
matching it to two candidate templates in the visual periphery (100 ms) while holding fixation. A 1000 mask used in this experiment and chance was 50%.
For both experiments, we also had interleaved trials where observers had to engage in an Original stimuli vs Synthesized stimuli task, Synthesized stimuli vs Synthesized stimuli discrimination task (two stimulus pairs synthesized from different noise seeds to match model representations). The goal of these experimental variations (called 'stimulus roving") was two-fold: to add difficulty to the tasks thus reducing the likelihood of ceiling effects; 2) to gather two psychometric functions per family of stimuli, which portrays a better description of each stimuli's evoked perceptual signatures.
We had 12 participants complete both the oddity and matching 2AFC experiments. The oddity task was always performed first so that subjects would never have foveated on the images before seeing them in the periphery. We had two stimulus conditions (1) robust & standard model images and (2) texforms. Condition consisted of the inverted representations of the adversarially robust and standard-trained models. The two model representations were randomly interleaved since they were synthesized with the same procedure. Condition 2 consisted of texforms synthesized with a fixed and perceptually optimized fixation and scaling factor which yielded images closest in structure to the robust representations at foveal viewing (robust features have no known fixation and scaling- which is why partly evaluate multiple points in the periphery. Recall Figure B. We randomly assigned the order in which participants saw the different stimuli. More details found in A.6
The main results of our 2 experiments can be found in Figure 5 where show how well Humans can discriminate per type of stimuli class and task. Mainly, human observers achieve near perfect discrimination rates for the Standard stimuli wrt to their original references, but near chance levels

---

Published as a conference paper at ICLR 2022
A.
Standard
N=12
Hobust
Texform
B.
Texorm
Ouality Tank
Phoperton ConNec
2MPC Task
DAPO
BAFC
Froweidyy
Figure 5: Pooled observer results of both psychophysical experiments are shown (top and bottom row). (A.) Left: we see that observers perfectly discriminate the original image wrt the standard stimuli, in addition to chance performance when comparing against synthesized stimuli. Critically there is no interaction of the standard stimuli with retinal eccentricity which suggests that the model used to synthesize such stimuli is a poor model of peripheral computation. Middle: Human ob- servers do worse discriminating the robust stimuli wrt the original as a function of eccentricity and also between synthesized robust samples. Given this decay in perceptual discriminability, it would suggest that the adversarially trained model used to synthesize robust stimuli does capture aspects of peripheral computation. This effect can also be seen on the texforms (Right) which have been extensively used as stimuli from derived models that capture peripheral and V2-like com- putation. (B.) Superimposed human performance for Robust and Texform stimuli. Errorbars are computed via bootstrapping and represent the 95% confidence interval.
when discriminating to another synthesized sample. This occurs for both experimental paradigms (Oddity- + 2AFC), suggesting that the network responsible for encoding standard stimuli is a poor model of human peripheral vision given no interaction with retinal eccentricity.
However, observe that Humans show similar perceptual discriminability rates for Robust and Texform stimuli - and that these vary in a similar way as a function of retinal eccentricity. Indeed, for both of these stimuli their perceptual discrimination rates follow sigmoidal decay-like curve when comparing the stimuli to the original, and also between synthesized samples. The similarity between the blue and magenta curves from Figure 3 suggests that if the texform stimuli do capture some aspect of peripheral computation, then - by transitivity - so do the adversarial stimuli which were rendered from an adversarially trained network. These results empirically verify our initial hypothesis that we set out to test in this paper. A superposition of these results in reference to the Robust stimuli for better interpretation can also be seen in Figure (B.).
3.1 SIMULATED FOVEA/PERIPHERY IMAGE QUALITY ASSESSMENT (IQA) ACROSS STIMULI
Some distortions are more perceptually noticeable than others for humans and neural networks (Be- rardino al. 2017 Martinez-Garcia et al., 2019)- so how do we assess which model better accounts for peripheral computation, if there are many distortions (derived from the synthesized model stim- uli) that can potentially yield the same perceptual sensitivity in a discrimination task?
Our approach consists of computing two IQA metrics (DISTS & MSE) over the entire psychophysi- cal testing set over 2 opposite levels of Gaussian Pyramid decomposition (Burt & Adelson 1987). This procedure checks which stimuli presents the greatest distortion (MSE), and yet yields greater perceptual invariance (DISTS). A Gaussian Pyramid decomposition was selected as it stimulates the frequencies preserved given changes in human contrast sensitivity and cortical magnification factor from fovea to periphery (Anstis 1974| Geisler & Perry) 1998). These two metrics were one that is texture- and perceptually aligned (DISTS), and another that is non- penepeccepy aligned metric: Mean Square Error (MSE). Both IQA metrics were computed in pixel space for both the Original Synthesized and Synthesized vs Synthesized conditions.
7

---

Published as a conference paper at ICLR 2022
Gaussian Pyramid Foven!
Gausstan Pyramid (simulate Periphery)
Org Aa Paneeesee
Dinet ol Great Pecceptu Inverancc
Orig nal Standard Robust Texform
on
Synthestzed vz Synthesizes
0.20 0.00,
0.00,0.99
1458
MSF
Figure 6: Here we evaluate how the different stimuli differ to each other wrt to the original (top row) or synthesized samples (bottom row) via two IQA metrics: DISTS and MSE. This characterization allows us to compare which model discards more information (MSE) while yielding greater degree of model based perceptual invariance. We find that Texform and Robust stimuli are similar terms of both IQA scores, suggesting their models compute the same transformations. This is observed at the Oth level (simulated fovea) and 3rd level (simulated periphery) of the Gaussian Pyramid.
Testing Stimuli
Driginal
Stardard
Robust
Texform
dinn
Adve thainig
ResNetOD trained on Original images
1R: 09%
23.3%
Stardard treining
PR: 07%
Figure 7: Here we show 2D projection using t-SNE [Van der Maaten & Hinton 2008 to visu- alize the outputs of the last layer of the Adversarially trained network (that used to synthesize the Robust Stimuli), and the Standard trained network (that was used to synthesize the Standard stimuli), both family of different stimuli: Original, Standard, Robust and Texform. The Ad- versarially trained network similar to the human can not distinguish between 2-class Standard Stimuli (unlike the Standard Network that has near perfect 2-class hit rate). Most importantly, the Adversarially trained network yields a near double hit rate on Texform classification wrt the Stan- dard trained network. This suggests that the Adversarially trained network has a representation that is more perceptually aligned to models of Peripheral Computation than the Standard trained model.
Results are explained in Figure 6 where Standard Stimuli yields low perceptual invariance to the original image at both levels of the Gaussian Pyramid, but robust and texform stimuli have a similar degree of perceptual invariance. Critically, robust stimuli slightly more distorted via MSE than texform stimuli suggesting that the adversarially trained model has learned to represent peripheral computation better than the texform model by maximizing the perceptual null space and throwing away more useless low-level image features (hence achieving greater Mean Square Error).
DISCUSSION
One of the fundamental questions in modern computer vision understanding what are the prin- ciples that give rise to adversarial stimuli which show a striking perceptual divergence between man and machine (Feather al. 2019 Gilan al. 2020) Geirhos al., 2021 Funke al. 2021)
8

---

Published as a conference paper at ICLR 2022
Distribution Training Samples per Class (Pixel Space)
Distribution of Training Samples per Class (Latent Space)
ves-Oue Soparaise Fioual heppoes
Lealtira Class Perrpena Tamplrss
Figure 8: A cartoon depicting a conjecture of how peripheral computation may induce adversarial robustness. In (A.) we a family of perceptually equidistant peripheral templates from the original foveal template (center dot) constructed with the adversarially robust model used to perform periph- eral encoding. In (B.) we observe the same templates projected from high-dimensional space into a uni-dimensional space. We also see that the greater covariances only induced by peripheral tem- plates lead to greater adversarial robustness during learning in a perceptual system despite having equal Intra-Clat Class means (for both foveal or peripheral templates). This suggests that peripheral computation may implicitly act as a natural visual regularizer of learned representations.
While it may seem theoretically impossible to escape from adversarial stimuli (Gilmer et al. 2018) perhaps efforts in the community should focus on understanding the biologically plausible mechanisms (if any) of the solutions that grant some level of adversarial robustness aligned with human error. In this paper we focused on potentially linking the representations learned from an adversarially trained network and human peripheral computation via series of psychophysical ex- periments through family of stimuli synthesized from these models.
We found that stimuli synthesized from an adversarially trained (and thus robust) network are metameric the original stimuli in the further periphery (slightly above 30g) for both Odd- ity and 2AFC Matching tasks. However, more important than deriving a critical eccentricity for metameric gaurantees across stimuli in Humans we found a surprisingly similar pattern of results in terms of how perceptual discrimination interacts with retinal eccentricity when comparing the adversarially trained network's robust stimuli with classical models of peripheral computation and V2 encoding (mid-level vision) that were used to render the texform stimuli (Freeman & Simon- celli] 20IT Long et al.] 2018 Ziemba et al. 2016) Ziemba & Simoncelli (021). Further, this type of eccentricity-driven interaction does not occur for stimuli derived from non-adversarially trained (standard) networks.
More generally, now that we found that adversarially trained networks encode similar class of transformations that occur in the visual periphery - how do we reconcile with the fact that adver- sarial training is biologically implausible in humans? Recall from the work of [laa et al. (2019) that performing standard training on robust images yielded similar generalization and adversarial robustness performing adversarial training standard images; how does this connect then to human learning if we assume a uniform learning rule in the fovea and the periphery?
We think the answer lies in the fact that as humans learn perform object recognition, they not only fixate at the target image, but they also look around, and can eventually learn where to make saccade given candidate object peripheral templates- thus learning certain invariances when the
object is placed both in the fovea and the periphery (Cox et al. [2005] Williams et al. 2008 Poggio al. 2014; Han et al. 2020). This is idea that dates back Von Helmholtz (1867), as highlighted in Stewart et al. (2020) on the interacting mechanisms of foveal and peripheral vision in humans.
high-resolution processing redundant and sub-optimal in the o.o.d. regime in the way that the visual representation which is computed is CNNs that are
Altogether, this could suggest that spatially-
independent of point of fixation - as seen classically in adversariallyyvvuneraa translation invariant and have no foveated//patially aaaapti computation. Counter-intuitively, the fact that our visual system spatially-adaptive could give rise to a more robust encoding mechanism of the visual stimulus as observers can encode distribution rather than point as they move their center of gaze (Nandy & Tjan 2012). Naturally, from all the possible types of transformations, the ones that are similar those shown in this paper which loosely resemble localized texture- computation are the ones that potentially lead to a robust hyper-plane during learning for the observer (See Fig. and 8).

---

Published as a conference paper at ICLR 2022
Finally, we'd like to add disclaimer level through-out this paper. However, current work is looking into reproducing the experiments carried out in this paper with physiological component explore temporal dynamics (MEG) and localization (fMRI) evoked from the stimuli. While it is not obvious we will find a perceptual signature of the adversarial robust stimuli in humans, paradigm presents a first step towards the road of linking what is known (and unknown) across texture representation, peripheral computation, and adversarial robustness in humans and machines.
the term biological plausibility representational
think this novel stimuli and experimental
ACKNOWLEDGEMENTS
The authors would like to thank the Poggio, Rosenholtz, Simoncelli, DiCarlo & Bonner labs and Lockheed Martin for valuable feedback. The authors would also like thank the Anonymous Reviewers, Andrzej Banburski, Andrei Barbu, Tom Wallis, Pramod RT, Corey Ziemba and Tiago Marques for valuable discussions the theory of distortions and suggestions for experimental con- trols. This work was sponsored by the Massachusetts Institute of Technology's Center for Brains, Minds & Machines (MIT-CBMM), and Lockheed Martin Corporation.
REFERENCES
Bilal Alsallakh, Narine Kokhlikyan, Vivek Miglani, Jun Yuan, and Orion Reblitz-Richardson. Mind the pad - {cnn]s Js can develop blind spots. In International Conference on Learning Representa- tions, 2021. URL JRLhhttps: httttps::/openreiieeee hot.rrriiieeeeeee/ooomooooo--om ctD.ddddmmmc//ppupp
net wooumrrrdddinn
Stuart M Anstis. A chart demonstrating variations in acuity with retinal position. Vision research, 14(7):589-555 592, 1974.
Aharon Azulay and Yair Weiss. Why do deep convolutional networks generalize so poorly small image transformations? Journal of Machine Learning Research, 20:1-25, 2019.
Benjamin Balas, Lisa Nakano, and Ruth Rosenholtz. A summary- statistic representation in periph- eral vision explains visual crowding. Journal of vision. 912):13-13, 2009.
Alexander Berardino, Valero Laparra, Johannes Ballé, and Eero Simoncelli. distoriisss of
hierarchical representations. Advances in Neural Information Processing Systems, 30, 2017.
Peter Burt and Edward H Adelson. The laplacian pyramid as a compact image code. In Readings in computer vision, pp. 671-679 Elsevier, 1987.
David D Cox, Philip Meier, Nadja Oertelt, and James J DiCarlo. 'breaking' position- invariant object recognition. Nature neuroscience, 8(9):
2005.
Joel Dapello, Tiago Marques, Martin Schrimpf, Franziska Geiger, David D Cox, and James Di- Carlo. Simulating primary visual cortex at the front of cnns improves robustness to image perturbations. BioRxiv, 2020.
Arturo Deza and Talia Konkle. Emergent properties of foveated perceptual systems. arXiv preprint arXiv:2006.00 079911 2020.
Arturo Deza, Yi-Chia Chen, Bria Long, and Talia Konkle. Accelerated texforms: Alternative meth- ods for generating unrecognizable object images with preserved mid-level features. In Conference Cognitive Computational Neuroscience, 2019a.
Arturo Deza, Aditya Jonnalagadda, and Miguel P Eckstein. Towards metamerism via foveated style transfer. In International Conference Learning Representations, 2019b.
James J DiCarlo and David D Cox. Untangling invariant object recognition. Trends in cognitive sciences, 1 1338)3333-31, 2007.
K Ding, K Ma. S Wang, and EP Simoncelli. Image quality assessment: Unifying structure and
texture similarity. IEEE Transactions Pattern Analysis and Machine Intelligence, 2020.
10

---

Published as a conference paper at ICLR 2022
Keyan Ding, Kede Ma, Shiqi Wang, and Eero P Simoncelli. Comparison of full-reference image quality models for optimization of image processing systems. International Journal of Computer Vision, (29(4):
2021.
Gamaleldin Elsayed, Shreya Shankar, Brian Cheung, Nicolas Papernot, Alexey Kurakin, Ian Goodfellow, and Jascha Sohl-Dickstein. Adversarial examples that fool both computer vision and time-limited humans. In NeurlPS, 2018.
Logan Engstrom, Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Brandon Tran, and Alek- sander Madry. Adversarial robustness as a prior for learned representations. arXiv preprint arXiv: 00945, 2019.
Jenelle Feather, Alex Durango, Ray Gonzalez, and Josh McDermott. Metamers of neural networks reveal divergence from human perceptual systems. In Advances in Neural Information Processing Systems, pp. 10078-10089, 2019.
Jenelle Feather, Alex Durango, Guillame Leclerc, Aleksander Madry, and Josh McDermott. Adver- sarial training aligns invariances between artificial neural networks and biological sensory sys- tems. Cosyne Meeting Abstract, 2021.
Chaz Firestone. Performance vs. competence in human machnee comparisons. Proceedings of the National Academy of Sciences, 117743):2566-22677 2020.
Jeremy Freeman and Eero P Simoncelli. Metamers of the ventral stream. Nature neuroscience, 14 (9):1195-1201, 2011.
Christina M Funke, Judy Borowski, Karolina Stosio, Wieland Brendel, Thomas SA Wallis, and Matthias Bethge. Five points to check when comparing visual perception in humans and ma- chines. Journal of Vision, 21(3):16-16, 2021.
Leon Gatys, Alexander S Ecker, and Matthias Bethge. Texture synthesis using convolutional neural networks. Advances in neural information processing systems, 28:262-270, 2015.
Robert Geirhos, Kantharaju Narayanappa, Benjamin Mitzkus, Tizian Thieringer, Matthias Bethge, Felix A Wichmann, and Wieland Brendel. Partial success in closing the gap between human and machine vision. Neural Information Processing Systems, 2021.
Wilson S Geisler and Jeffrey S Perry. Real-time foveated multiresolution system for low- www-bandwidth video communication. Human vision and electronic imaging III, volume 3299, pp. 294-30440 305. International Society for Optics and Photonics, 1998.
Justin Gilmer, Luke Metz, Fartash Faghri, Sam Schoenholz, Maithra Raghu, Martin Wattenberg, and lan Goodfellow. Adversarial spheres, 2018. URU/ttts::/ net forum?
id=SyUkxx20b/
Tal Golan, Prashant C.
Raju, and Nikolaus Kriegeskorte. Controversial stimuli: Pitting neural net- works against each other as models of human cognition. Proceedings of the National Academy of Sciences, 117737999717)2239399999,,,3,, 29337, 2020. ISSN 0027-8422 8424. doi: 19..077/pnaa.199123342 URL
https::/ wwwp///www///// phas. org/ http:///nnnnnttnnn///a/////
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. International Conference on Learning Representations, 2015.
Sven Gowal, Sylvestre-Alvise Rebuffi, Olivia Wiles, Florian Stimberg. Dan Andrei Calian, and Timothy A Mann. Improving robustness using generated data. Advances in Neural Information Processing Systems, 34, 2021.
Yena Han, Gemma Roig, Gad Geiger, and Tomaso Poggio. Scale and translation-invariance for novel objects in human vision. Scientific reports, 10(1):1-13, 2020.
Daniel Herrera- Espoostoo Ruben Coen-Cagli, and Leonel Gomez-Senal Flexible contextual modu-
lation of naturalistic texture perception in peripheral vision. Journal of vision, 21(1):1-1, 2021.

---

Published as a conference paper at ICLR 2022
Geoffrey Hinton. How to represent part-whole hierarchies in neural network. arXiv preprint arXiv:2102.12627, 2021.
Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. Adversarial examples are not bugs, they are features. Advances in Neural Information Processing Systems, pp. 125-136, 2019.
Aditya Jonnalagadda, William Wang, and Miguel P Eckstein. Foveater: Foveated transformer for image classification. arXiv preprint arXiv:2105. 14173, 2021.
Yann LeCun, Yoshua Bengio, and Geoffrey Hinton. Deep learning. nature, 521(7553))36-4444 2015.
Gang Liu, Yann Gousseau, and Gui-Song Xia. Texture synthesis through convolutional neural net- works and speetrum constraints. In 2016 23rd International Conference on Pattern Recognition (ICPR), pp. 2234-3239. IEEE, 2016.
Nikos K Logothetis, Jon Pauls, and Tomaso Poggio. Shape representation in the inferior temporal cortex of monkeys. Current biology, 5(5):552-565 1995.
Bria Long, Chen-Ping Yu, and Talia Konkle. Mid-level visual features underlie the high-level cate- gorical organization of the ventral stream. Proceedings of the National Academy of Sciences, 115 (38):19015--E9024, 2018.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. To- wards deep learning models resistant adversarial attacks. International Conference on Learning Representations, 2017.
Aravindh Mahendran and Andrea Vedaldi. Understanding deep image representations by inverting them. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 1188-5196, 2015.
Marina Martinez-Gane Garcia, Marcelo Bertalmío, and Jesús Malo. In praise of artifice reloaded: Caution with natural image databases in modeling vision. Frontiers in neuroscience, 13:8, 2019.
Anirvan Nandy and Bosco S Tjan. Saccade-confounded image statistics explain visual crowding. Nature neuroscience, 15(3):463 2012.
Tomaso Poggio, Jim Mutch, and Leyla Isik. Computational role of eccentricity dependent cortical magnification. arXiv preprint arXiv: 1770, 2014.
Javier Portilla and Eero Simoncelli. A parametric texture model based on joint statistics of com- plex wavelet coefficients. International journal of computer vision, 40(1):49-70, 2000.
Sylvestre-Alvise Rebuffi, Sven Gowal, Dan Calian, Florian Stimberg, Olivia Wiles, and Tim- othy Mann. Fixing data augmentation to improve adversarial robustness. Neural Information Processing Systems, 2021.
Manish V Reddy, Andrzej Banburski, Nishka Pant, and Tomaso Poggio. Biologically inspired mech- anisms for adversarial robustness. Neural Information Processing Systems, 2020.
Maximilian Riesenhuber and Tomaso Poggio. Hierarchical models of object recognition in cortex.
Nature newroscience, 2(11): 1999.
Ruth Rosenholtz. Capabilities and limitations of peripheral vision. Annual Review of Vision Science, 2:437-457, 2016.
Ruth Rosenholtz, Jie Huang, Alvin Raj, Benjamin Balas, and Livia Ilie. A summary statistic representation in peripheral vision explains visual search. Journal of vision, 14(4):14-14, 2012.
Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang. Andrej Karpathy, Aditya Khosla, Michael Bernstein, et al. Imagenet large scale visual recognition challenge. International journal of computer vision, 11(3):211-252, 2015.
12

---

Published as a conference paper at ICLR 2022
Shibani Santurkar, Dimitris Tsipras, Brandon Tran, Andrew Ilyas, Logan Engstrom, and Aleksander Madry. Image synthesis with a single (robust) classifier. Neural Information Processing Systems, 2019.
Jürgen Schmidhuber. Deep learning in neural networks: An overview. Neural networks, 61:85-117, 2015.
Emma EM Stewart, Matteo Valsecchi, and Alexander C Schütz. A review of interactions between peripheral and foveal vision. Journal of vision, 20( 2012:22--, 2020.
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. International Conference Learning Representations, 2014.
Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry. Robustness may at odds with accuracy. International Conference on Learning Representations, 2019.
Laurens Van der Maaten and Geoffrey Hinton. Visualizing data using t-sne. Journal of machine learning research, 9(11), 2008.
Hermann Von Helmholtz. Handbuch der physiologischen Optik: mit 213 in den Text eingedruckten Holzschnitten und 11 Tafeln, volume 9. Voss, 1867.
Thomas SA Wallis, Matthias Bethge, and Felix A Wichmann. Testing models of peripheral encoding using metamerism in an oddity paradigm. Journal of vision, 16(2):444, 2016.
Thomas SA Wallis, Christina M Funke, Alexander S Ecker, Leon A Gatys, Felix A Wichmann, and Matthias Bethge. A parametric texture model based on deep convolutional features closely matches texture appearance for humans. Journal of vision, 17(12)5--5, 2017.
Thomas SA Wallis, Christina M Funke, Alexander S Ecker, Leon A Gatys, Felix A Wichmann, and Matthias Bethge. Image content more important than boumas law for scene metamers. ELife, 8:e42512, 2019.
Mark A Williams, Chris Baker, Hans P Op De Beeck, Won Mok Shim, Sabin Dang, Christina Triantafyllou, and Nancy Kanwisher. Feedback of visual object information to foveal retinotopic cortex. Nature neuroscience, 11(12):1439-144 1445, 2008
Corey Ziemba and Eero P Simoncelli. Opposing effects of selectivity and invariance in peripheral vision. Nature Communications, 12(1):1-11, 2021.
Corey M Ziemba, Jeremy Freeman, J Anthony Movshon, and Eero Simoncelli. Selectivity and tolerance for visual texture in macaque v2. Proceedings of the National Academy of Sciences, 400 2016.
13

---

Standard Published as a conference paper at ICLR 2022
min| min|lgaav(o) (adv(xo)lla
Repest until
(x)v(x)
robust synth image
Update Image
9Adv [Adv(Fo)
relu
layer 1
layer
layer
layer 4
ResNet-50
Figure 9: The Robust Image Synthesis pipeline: noise image æo is passed through adversarially trained ResNet-50 and the penultimate layer features JAd (zo) are matched wrt the original images' penultimate feature activation (a)) via an L2 loss, and is repeated until convergence (Santurkar et al. 2019; Engstrom al. 2019). Critically we use gadv as summary statistic of peripheral processing in our experiments.
A IMAGE SYNTHESIS DETAILS
Classes
RIN
Dog
Cat
Frog
Turtle
Bird
Primate
Fish
Crab
Insect
IN
151-268
281-28 281-285
30-32
33-37
68-100
365-382
389-397
118-121
300-319
Table 1: Classes of RestrictedImageNet (RIN) and the corresponding ImageNet (IN) class ranges.
A.1 STANDARD AND ROBUST STIMULI
We used the publicly available code from Santurkar al. (2019): Engstrom al. (2019) 1lyas
et al. (2019) found here to synthesize both standard and robust stimuli which where derived from regularly and adversarially trained model respectively: htttp:://ittubs: com cwt./oooaaaa/ab//////.aa.
schematic that illustrates the robust stimuli rendering pipeline can be seen in Figure 9 stimuli is generated with the same procedure, and number of iterations, but the network Jaav (o) is replaced with IStandard instead.
A visualization of the convergence of the loss when performing the synthesis procedure can be seen Figure 10
A.2 TEXFORM STIMULI
Texform stimuli were synthesized using the publicly available code Deza et al. (001a)) https:
The following images (class:[image id's]) were removed they did not converge:
texform0: 01491119022213444444111111111012
1exform1: 0.9909/9844221333444441331400000
14

---

Published as a conference paper at ICLR 2022
Dog
Cal
Frog
robust stundard
13
109
305
1.5
109
305
300
105
307
Turtle
Hird
Monkey
Loss
03
107
107
107
100
17
107
101
107
105
10
107
Fish
Crab
Insect
13
10.
10"1
155
107
301
107
10t
301
10
305
Esrations
Figure 10: Per-Class Synthesis Loss visualizations for the Robust and Standard Stimuli across all samples. Errorbar represents I standard error.
In addition the following image id's were removed from our psychophysical analysis from the tex- form stimuli they converged to the exact same image even when starting from different noise seeds. This was found while doing a post-hoc IQA analysis as the one shown in Figure These stimuli only occurred for classes O (dog) and (cat):
texform: (T2.2.1....2222294444379999.9..9
We found that Standard and Robust stimuli did not have this identical convergence problem over the 900 rendered pairs (1800 stimuli in total for Standard and 1800 in total for Robust).
Note 1a: A common mis-conception is that Freeman Simoncelli (201 --derivedd stimuli (such as texforms) do not contain structural priors and only performs localized texture synthesis over smoothly overlapping log-polar receptive fields. This has been investigated with great detail in Wal- lis al. (2016) (017]:[Liu et al. (2016) that showed that without spectral constraints it is impossible to generate metameric images from non-stationary textures for the human observer when showing such stimuli in the visual periphery. For texforms the metameric constraint is purposely broken because we'd d like to test how a specific Seloogccall--llussiiie through the synthesis procedure) interacts with eccentricity when the ercentricit-ddependee and scaling factors texform parameters are fixed. See 8.) from Eq. 7
family of transformations (embodied
Note 1b: The Freeman & Simoncelli (2011) synthesis model is not equivalent the Portilla & Simoncelli (2000) synthesis model. The Freeman & Simoncelli (201T) is super-ordinate synthe- sis model class that locally uses the Portilla Simoncelli (2000) synthesis model over smoothly overlapping receptive fields in addition to adding global structural prior. Texforms are rendered with the Freeman & Simoncelli (201T) model, by placing he simulated point of fixation outside the image (Long et al. 2018 Deza al. 2019a).
Usual texform rendering time is about I day per image, though the rendering procedure has been accelerated to the order of minutes as shown in Deza et al. (201aa). We used their publicly available code in our experiments. Thus, it is worth noting that synthesizing texforms the order of hundreds of thousands (or millions) for supervised learning experiments has not been done before and is computationally expensive (may take months), which is why Figure no information on exffor--tained CNN's. This direction is current work.
Note 1c
15

---

Published as a conference paper at ICLR 2022
Note 2: A first naive criticism the selection of making texforms fixed and not varying function of eccentricity given the model they were based on (Freeman & Simoncelli 2011] is that they will not create metameric stimuli. Our anticipated reply to this is three-fold, and partially aligned with the motivation of Long et al. 20188:
1. Our goal is not to make metameric stimuli out of texforms or robust stimuli, but to exam- ine how perceptual discriminability rates fixed stimuli change as a function of retinal eccentricity. By checking if these perceptual decays are similar (which we show) we can connect both functions that give rise to these apparently un-related transformations (the stimuli). Recall Eq. 6
2. Having a "metameric texform" that changes as a function of eccentricity would defeat the purpose of using it as control in our experiments. Had this been the road taken, we would now have a control curve that will presumably be horizontal and at chance, providing no information about how the transformation that gives rise to the robust stimuli is linked to the texform transformation.
3.
The goal of this paper is not to make a foveated metamer model that fools human ob- servers similar that of Freeman Simoncelli (2011); Rosenholtz al.) (2012); Deza et al. (2019b); |Walii et al. (2019) that would be based on foveated adversarially trained network. The previous idea however highly interesting and is being explored in current work, and this work provides a proof of concept that it is tractable.
A.3 SYNTHESIS VS SYNTHESIS AND ORIGINAL VS ORIGINAL
The goal of combining these experimental variations into block (called 'stimulus roving") in experiments was two-fold: 1) to add difficulty to the tasks thus reducing the likelihood of ceiling effects; 2) to gather two psychometric functions per family of stimuli, which portrays better de- scription of each stimulus's 's evoked perceptual signatures. Synthesis vs Synthesis experiments probe the diversity samples in pixel space that can potentially yield visual metamerism, while the Orig- inal vs Synthesis condition yields stronger condition for visual metamerism. Several works have explored these paradigms (Wallis et al. 2016
Deza et al. 2019b).
16

---

Published as a conference paper at ICLR 2022
List of All Duplicate Texforms (Excluded from Analysis)
Original
Class : Dog
Texform
Original
Class 0: Dog
Texform
Original
Class 1 Cat
Texform
Figure 11: Duplicates are images that even though they were initialized with two different random noise images, they converged to the exact same image (Mean Square Error between synthesized samples is equal to zero). These stimuli were excluded from our analysis and represent only 2% (18/894) of the used texform stimuli.
17

---

Published as a conference paper at ICLR 2022
A.4
SAMPLE STIMULI
Original
Initial Image (Noise)
Standard
Robust
Texform
Sample
Sample
Sample
Sample
Sample
Sample
Sample
Sample
Dog
Cat
Frog
Turtle
Bird
Primate
Fish
Craio
Insect
Figure 12: collection of sample stimuli for each image class used in our experiments.
18

---

Published as a conference paper at ICLR 2022
A.5 SYNTHESIS VARIATIONS
In this sub-section we show a collection of different synthesized samples using different reference images, and also using different starting images. If the transformations undergoing the texform model and the adversarially robust model are similar, then the resulting synthesis outputs should look similar if the output of one model is used as the input to another (See inset 2). A similar effect should occur if the starting image for the texform model is robust stimuli and vice-versa (See inset 3). We see this effects qualitatively holds even more so for the Turtle than the Cat image. Overall there are striking low- low-frequency structural similarities across all images in the last 2 columns. However, further syccoppysicall experiments are needed to test the rates of discriminability of such images as a function of retinal eccentricity to establish more precise relationship between them.
1)
Raference
Starting Image
Robust Bynthesia Output
Texform Byrthasis Output
Original
Nols (teed
Robuat
Texfor
2)
Texform
Noisa (seed 0)
Rabust from Texform
Robust
Noise (seed
Textorm from Robust
X
3)
Original
Teeform with Naise seed
Robual with Texform seed
Original
Robust Noise seed D
Textorm with Robust seed
Figure 13: Robust and Texform synthesis variations of a cat with different reference images and starting images.
19

---

Published as a conference paper at ICLR 2022
1)
Reference
Starting Image
Robust Synthasis Guiput
Texform Syrthesis Gulput
Origina
Noire (reed 0)
Robust From Original
Textorn from Original
2)
Textorm
Nosse (seed 0)
Robust From Texdorm
Robust
Noise (seed 0)
Texform from Robust
3)
Original
Texfor with Naise
Robust with Teeform ased
Original
Robust with Noise seed
Toxtorm with Robust seed C
Figure 14: Robust and Texform synthesis variations of a turtle with different reference images and starting images.
20

---

Published as a conference paper at ICLR 2022
A.6 ETHICS STATEMENT, ADDITIONAL METHODS & SINGLE OBSERVER RESULTS
All 12 human subjects involved in this research willfully participated in this experiment via explicit consent during each session of this experiment. Our experimental design was reviewed and approved by an Institutional Review Board (IRB).
Subjects: We used total of 12 human subjects that consisted of undergraduates from the Mas- sachusetts Institute of Technology. Subjects were paid a fee of $20 per hour to complete the experi- ment in total of hours over anywhere between 2 to days where observers performed a maximum of 2 hours of psychophysics per day. Our experiments had an approved IRB protocol from the Mas- sachusetts Institute of Technology. Human participants were all tested with a Snellen eye-chart and had at least 20/20 visual acuity and had either no visual correction contact lenses to correct their vision. All participants were naive to the experiment (i.e. no participants were experimenters), in all cases, subjects were not familiar with the concepts of either visual metamerism adversarial images. No participants with eye-glasses were used in our experiments.
Experiments were ran LAB 2015a's Psychtoolbox version 3.0.14. A chin rest was used so that observers can view stimuli screen placed at 50 em distance from their eyes. We used 34 inch diagonal 75 Hz LCD monitor, that measured 80cm width and 34 cm height with a visual display resolution 3440 pixels width by 1440 pixels height. From here the total degrees of visual angle computed via:
Apparatus:
Ubuntu-Linux Machine version 14.04.5 LTS with MAT-
atan 17.00/00.0 180.0/x
And the degrees of visual angle subtended by the stimuli is computed by multiplicating the propor- tion of pixels subtended by the stimuli with respect to the monitor:
Stimmlli = x 256/1440 14400 6.67
Figure 15: visualization how the psychophysical experiments were ran.
21

---

Published as a conference paper at ICLR 2022
In the rest of this sub-section plot the single observer results where the trends observed in Figure still hold true at the individual per-observer level. Each participant saw 72 trials of the oddity task synthesized at 5 degrees,
for every stimuli condition and eccentricity (i.e. robust synthesized robust synthesized vs original at degrees, etc ...). On the 2AFC matching, they saw 80. Errorbars in each plot were computed via 10,000 sample bootstrapping and represent the 95% confidence interval.
22

---

Published as a conference paper at ICLR 2022
Subject
Robust vs Standard
Proparion CorNST
BAOC
Robust vs Texform
O4853
O oede
Proporson Coneec
Ecowerdity
Figure 16: Subject 63
23

---

Published as a conference paper at ICLR 2022
Subject
Robust vs Standard
Trx
Proparion CorNST
Robust vs Texform
O4853
Proporson Coneec
g0od Verteed
Figure 17: Subject
24

---

Published as a conference paper at ICLR 2022
subject
Robust vs Standard
Proparion CorNST
BA0C
Robust vs Texform
O4853
Proporson Coneec
Mirital VALE.
g0ad Verteed
Econtratt
Figure 18: Subject 30
25

---

Published as a conference paper at ICLR 2022
Subject
Robust vs Standard
Proporion CorNST
BARC
Robust vs Texform
O4853
Proporson Coneec
Me-icaat VALE.
Ecowtratt
Figure 19: Subject 55
26

---

Published as a conference paper at ICLR 2022
subject
Robust vs Standard
Propario CorNST
0 0 5
Robust vs Texform
O4853
Proporson Coneec
Meri 21 SALE.
Ecowtratt
Figure 20: Subject 18
27

---

Published as a conference paper at ICLR 2022
subject
Robust vs Standard
Trx
Proporio CorNST
0 5
Robust vs Texform
Ohe
Proporson Coneec
aodt Boritel VALE.
Ecowtratt
Figure 21: Subject 34
28

---

Published as a conference paper at ICLR 2022
subject
Robust vs Standard
Trc
Proporso CorNST
BA0C
Robust vs Texform
O4t5g
Proporson Coneec
Ecowtratt
Figure 22: Subject 02
29

---

Published as a conference paper at ICLR 2022
Subject 12
Robust vs Standard
Trc
Propario CorNST
0 0.2.88 2
BAOC
Robust vs Texform
Proporson Coneec
BASC
Ecowtratt
Figure 23: Subject 12
30

---

Published as a conference paper at ICLR 2022
Subject
Rebust vs Standard
Propario CorNST
BARC
Robust vs Texform
Proporson Coneec
SALL
Ecowtratt
Figure 24: Subject 89
31

---

Published as a conference paper at ICLR 2022
subject
Robust vs Standard
Proporio CorNST
Robust vs Texform
O4853
Proporson Coneec
phad rerter M0-CCCE
Ecowtratt
Figure 25: Subject 75
32

---

Published as a conference paper at ICLR 2022
subject 32
Robust vs Standard
Trc
Propario CorNST
BA0C
Robust vs Texform
O4853
Proporson Coneec
Ecowtratt
Figure 26: Subject 32
33

---

Published as a conference paper at ICLR 2022
subject
Rebust vs Standard
Proparion CorNST
Robust vs Texform
O4853
Proporson Conecc
Ecowtratt
Figure 27: Subject 03
34


Reviews:
[{"review_id": "sTfqBcnMEDr", "reviewer": "Reviewer_U8eW", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "# Strengths\n\n1. I thought the topic of the paper was interesting and relevant for ICLR since it probes at a link between the representations learned by adversarially trained image classifiers and the robustness of human peripheral vision, and suggests some possible paths forward (e.g. spatially-adaptive computation of continuous representations)\n\n2. The experiments appear to me to be carefully thought through and executed, and the results are well explained and documented.\n\n3. The paper describes related literature well and I feel like I learned some useful things from reading it, so thank you!\n\n# Weaknesses\n\n1. I find the assertion that \"robust representations capture peripheral computation similar to current state-of-the-art texture peripheral vision models\" a little strong. It's certainly the case that the synthesized metamers have similar (but not matching) behavior curves in the precision vs eccentricity discrimination tasks of Fig 5, but is this sufficient to claim that they capture computation similarly? Is it possible that a model could yield synthesized images which also have similar curves but have nothing to do with how peripheral computation takes place? What if you were to learn a decoder from the representations of robust and non-robust networks, and train it to reconstruct the images from those representations, then use those reconstructions in place of the current synthetic images. Do you think these relationships would hold up? Would that be an invalid way of producing synthetic images?\n\n2. Along that line, I’d like to see some discussion and analysis about the role of optimization in generating the stimuli. In particular, do the Standard and Robust images share the same final L2 minimization error? Does gradient descent find sub-optimal local minima more often for either Standard or Robust? How often? Does it matter? Could the optimization landscape of the non-robust and robust models lead to incorrect experimental conclusions or is it not a concern? Quantitatively, since Standard and Robust models use the same network, what are the distributions of converged L2 distances in both sets of tested stimuli? Similarly, what are the L2 distances vs the Original representation if, for example, you take a Robust image and feed it into a Standard model, and vice versa? Is one model more invariant to the other’s stimuli? \n\n3. There are various details missing from the experiments section which I think are important. Was vanilla gradient descent used, as currently implied in the paper, or a more adaptive optimizer, e.g. Adam, as in Feather et al., or gradient descent with momentum, as in Mahendran et al.? How was the experiment carried out - remote? in-lab? What controls were in place? Was an eye tracker used to ensure subject fixations? Did all subjects view all stimuli pairs?\n\n4. I would love to understand the role of visual angle in the experiments. It seems the choice was made to map 256x256 pixel stimuli to 7x7 d.v.a. (p4) - how was this decided? Presumably the results are sensitive to this choice -- if say a 14x14 d.v.a. were used instead, would it become easier to discriminate the Robust and Original stimuli? Would it make sense to check that similar trends continue to exist between Texform and Robust stimuli even despite such changes (maybe just causing shifts in the curves in Fig 5)?\n\n5. I think it should be made clearer at an earlier point in the abstract / introduction, why human peripheral vision (as opposed to foveal vision) is important to this problem. I like the clarity of the statement at the bottom of page 3: “we’d like to investigate if the following statement is true: a transformation resembling peripheral computation in the human visual system can closely be approximated by an adversarially trained network”. I think something along these lines should be stated in the abstract to improve readability. Also, I found the term “Biological plausibility” to be a little vague, and unqualified until the Discussion section - and as mentioned above, I am not yet convinced that these experiments definitely \"find biological plausibility\". \n\n6. I would like to understand why the choice was made to take the representation at the second-to-last network layer, *after* average pooling, which destroys some potentially useful local information. Did you try to optimize for the representation before average pooling? Or is there a particular reason why doing so would not make sense? I would be very curious to see whether that closes the gap between the robust and non-robust discriminability curves.\n\n# Minor points\n\n1. Figure clarity. The clarity of Fig 4 would be helped by adding what kind of stimulus each one is in the frame (not easy to tell without zooming in a lot). Fig 6 red and pink are a little hard to distinguish on my screen - maybe choose a more distinct color? Fig 7 is similarly difficult to make out without zooming in - a clearer alternative might be e.g. filled and unfilled circles?\n\n2. Sec2.1: “We used gradient descent to minimize the difference between the representation of the second-to-last network layer of a target image and an initial noise seed as shown in Figure 9.” -- rather than “an initial noise seed”, would it be clearer to say “a synthetic image initialized with random noise”?\n\n3. I understand the code used in the paper is already largely public from other sources, but the work may have better impact if the various synthetic and original stimuli could be released alongside the paper, perhaps along with the generation scripts.\n", "summary_of_the_paper": "This paper examines whether an adversarially trained (“robust”) ResNet-50 classification model might better resemble the representation of human peripheral vision than a non-adversarially trained (“non-robust”) model. It does so by means of a human perceptual experiment: test images from Restricted ImageNet (a collapsed subset of ImageNet comprising 9 super-classes) are resynthesized via gradient descent from random noise initial conditions by minimizing the L2 difference in the penultimate feature activation of both a robust and non-robustmodel. \nIn addition, the same stimuli are resynthesized according to previously validated models of summary statistic based peripheral computation (Texforms). A range of perceptual discrimination experiments (odd-one-out and two alternative forced-choice) are carried out with human subjects among different pairs of stimuli (original, robust, non-robust and texform) at varying degrees of peripheral eccentricity. The experiments show that the discriminability of robust and texform stimuli vs original stimuli degrade similarly with increasing eccentricity, while non-robust stimuli are relatively easy to pick out vs original stimuli at all levels of eccentricity. \n", "summary_of_the_review": "I think this paper is marginally below the acceptance threshold, but this may be due in part to the exposition of the work. I like the effort to try to link these two areas of human peripheral vision and robust representations, and I think the paper does quite a good job to describe the experiments undertaken. If the authors can respond convincingly to the various questions I and other reviewers may have, I would be willing to upgrade my rating.\n\nEDIT: following the rebuttal from the authors and taking into consideration their response to other reviewer comments, I am upgrading my score.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "sE2FT2dZ5qi", "reviewer": "Reviewer_s6dV", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "While the idea of connecting summary statistics with the robustness to adversarial attacks is interesting, I feel the paper has a number of points that should be clarified by the authors before it can be accepted for publication at ICLR.\n\n1. Two representations with the same null-space are not necessarily the same.\n\nThe authors say that the representation of robust nets is similar to the representations of the models of peripheral vision only because the images coming from the inverse of such models are metameric (similarly non-discriminable) for humans.\nNote that this only means that these representations share the null space and this null space is also shared by humans. However, this is far from being the same as saying that the representations are equivalent or similar.\n\nAn example of this difference can be obtained from color science (where the metamer concept comes from). Imagine the space of spectral radiances with vectors living in a 100-dimensional space (say one value every 3 nm in the 400-700 nm interval).\nConsider a perceptual system defined by a linear operator, P, that projects this 100-dimensional space into a 3-dimensional space (P is a 3*100 matrix that performs the integration by the cone sensitivities). Note that this perceptual system, P, has a null-space (the inverse is not unique) and many different spectra lead to the same \"tristimulus\" representation. We say that these physically different stimuli are metameric (they are the same for the perceptual system P).\nThey are perceptually same because these different spectra differ in vectors that belong to the null-space of the projection operator P.\nWith this in mind, if we consider any arbitrary rotation of the 3-d vectors, all these would be *different* color representations, but they would share the same null-space with the same metamers.\nDoes this mean that all these different color spaces are equivalent?\nNot at all: actually, spaces that separate the achromatic information from the chromatic information (as opposed to LMS cones) are closer to the internal physiological and psychophysical representations of color...  And their statistical properties of these opponent spaces are quite different too. Therefore, sharing some null space does not mean having equivalent representations.\n\nNow, imagine the complication of going from the 100 dimensions of spectral radiance, to the millions of dimensions in color images... This complexity implies that the rationale followed in the paper is not obvious.\nThe authors sould give additional evidences of why their rationale is correct or acknowledge the problems in this assumption.\n\n2. Authors should give additional evidence for the suggested connection between summary statistics and robustness to adversarial attacks.\n\nSpecifically, in the discussion [in fig. 8] the authors argue that this conection may come from the fact that imposing separability of classes with high-variance (responses of peripheral vision) leads to enlarged class separation of small-variance sets in foveal vision, with samples that have the same mean. I think this interesting suggestion in the discussion is not justified in any way (or I totally missed the justification -sorry if that is the case-).\n\n3. Generation of \\hat{x} implies the minimization of a perceptual distance with regard to \\tilde{x} (as explained in Section 2.2, eq. 7). In this situation, who is responsible for the human-like behavior of \\tilde{x}?. More specifically, who is responsible for the similar behavior of humans in \\hat{x} and \\tilde{x}? (a) the fact that the robust representation is human-like (as argued by the authors), or (b) the fact that the images \\hat{x} were selected so that they were close to \\tilde{x} for humans?.\n\nIt is interesting to note that the texture distortion metric DISTS is based in computing summary statistics which are similar in spirit to the synthesis method taken as model of peripheral vision. Consider that the procedure in Freeman and Simoncelli 11 reduces to enforcing the replication of certain statistical descriptions as in the old Portilla and Simoncelli 01 paper. In a similar vein, in DISTS texture similarity is measured according to mean and variance of the responses in different layers of a VGG net, and in fact, in Ding et al. PAMI 21, they also propose enforcing the replication of these descriptors as a texture synthesis method. All this seems quite overlapped.\n\n4. Related to the previous question, Fig. 6, that shows that the perceptual distance of \\tilde{x} and \\hat{x} wrt x are similar seems like a consequence of the selection of \\hat{x} described in section 2.2, no?\n\n5. Moreover, given the fact that x_s are so subjectively different from natural images, the whole psychophysical procedure seems unnecessary. Simple inspection of the synthesized images x_s and \\tilde{x} is enough to see that \\tilde{x} is closer to whatever \\hat{x} and x, and that x_s simply is just not right. As a result, it is not surprising that the psychometric functions for \\tilde{x} are more similar to those of \\hat{x} than those of x_s. \nIn this way, I feel the psychophysical experiments and the perceptual image quality metrics do not add much with regard to the qualitative visualizations shown in Tsipras et al. ICLR 2019.\n\n6. Finally, given the above concerns, I suggest another way of assessing the similarity between the robust networks and human vision. Why not trying to simulate other human tasks? such as in Geirhos et al. ICLR 19 (cited in the work) or classical psychophysical responses as in Martinez-Garcia et al. Frontiers in Neuroscience 2019 (not cited in the work). I am not suggesting to do this now, but I feel a comment on alternative comparisons with humans is due. \n\n", "summary_of_the_paper": "The authors hypothesize that description of visual textures/objects using summary statistics (as may be doing the human vision in the periphery) may induce robustness to adversarial examples. \n\nIn the discussion they argue that this may be the case because imposing separability of classes with high-variance (responses of peripheral vision) leads to enlarged class separation of small-variance sets in foveal vision which have the same mean. \n\nThe authors check their initial hypothesis in an indirect way: they check that robust representations to adversarial attacks resemble human representations. They do so by comparing \\tilde{x} (synthesized images from networks which are robust to adversarial examples) and \\hat{x} (synthesized images from models of human peripheral vision). They argue that given the fact that these classes of images (\\tilde{x} and \\hat{x}) are equally discriminable by humans from the original images, x, the image representation of robust networks is similar to the (periphery) image representation in humans. The authors also compare the discriminability of images, x_s, generated from standard (non-robust) networks.\n\nThe specific way in which \\tilde{x}, \\hat{x} and x_s are compared is measuring the psychometric function (over eccentricity) so that these images are discriminable by humans from the original image. Interestingly, these images are also compared using subjective image distortion metrics.", "summary_of_the_review": "The attempt to assess the human-nature of the image representation of networks which are robust to adversarial attacks is very interesting both for machine learning as well as for computational neuroscience. However, a number of points need to be clarified before the work can be published at ICLR:\n\n1. Representations with shared null-space (the central idea that is checked in the work) are not necessarily the same: simple linear examples  tell us that they can differ in arbitrary rotations or extra linear invertible transforms, and these may represent quite different qualitative nature!\n\n2. Authors should give additional evidence for the suggested connection between the use of summary statistics and robustness to adversarial attacks (fig. 8).\n\n3. Authors should mention other ways to assess the similarity between the robust networks and humans which may be centered in the response space rather than in the null space.\n\nSee extra minor comments at the detailed review.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "fGv8ncM34Dj", "reviewer": "Reviewer_teJp", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "## Strengths\n\n- The paper raises some interesting ideas linking network robustness with human perception; specifically about the roles of eye movements and peripheral computations in inducing useful invariances\n- The psychophysical experiments appear well conducted (though see below)\n\n## Weaknesses\n\n- Purely in terms of writing, I found the motivation and results of the paper difficult to understand until the discussion. The key motivating question posed on page 2 (\"Could it be that adversarially trained networks are robust because they encode object representations similar to human peripheral computation?\") comes out of the blue. Why would they? We are of course also robust (perhaps more so) in the fovea, so this didn't seem to make sense on the face of it.\n- The paper claims that the texform and robust models are doing similar things (or even \"the same computations\"; Figure 6), based on (1) the finding of similar psychometric functions (Figure 5) and similar IQA scores (Figure 6). This is quite weak. As the paper itself notes, \"there are many distortions (derived from the synthesized model stimuli) that can potentially yield the same perceptual sensitivity in a discrimination task\". I do not find the IQA analysis convincing either. If I understand correctly, these measure the distance between the original and the synthesized, and synthesized vs synthesized images *within the same model*. But isn't the key issue whether the generated images look similar to each other? Presumably if they are performing \"the same computations\" they should? I think a stronger way to assess this point would be to perform some variant of \"maximum differentiation competition\" (MAD; Wang & Simoncelli, 2008). Loosely: synthesize an image that maximally changes the robust synthesis while keeping the texform representation unchanged, and vice versa. If the two models are performing similar computations, then moving in some direction in one model's space while keeping the other fixed should create little perceptible change.\n- Missing experimental details. Was the human data collected in a lab or online? Was eye tracking performed to monitor fixation? Was the study conducted according to relevant ethical guidelines and approved by a review board or similar? I could also find no details on this in the supplement.\n\n## Minor\n\n- p. 6 Typo \"Mainly Human observers\" \n- the differences in the terms in equation 7 were hard to read ($\\tilde{x}$ vs $\\hat x$ look very similar, so I was confused for a while)\n- A relevant reference for the conjectures on page 9 around learning invariances from fovea to periphery is: Nandy, A. S., & Tjan, B. S. (2012). Saccade-confounded image statistics explain visual crowding. *Nature Neuroscience, 15*(3), 463–469.\n- p. 9: \"Counter-intuitively, the fact that our visual system is spatially-adaptive could give rise to a more robust encoding mechanism of the visual stimulus as observers can encode a distribution rather than a point as they move their center of gaze.\" -- does this imply the converse, that non-foveated biological vision systems are *less* robust? I don't know of evidence that speaks specifically to this, but there are certainly organisms with non-foveated visual systems that get along just fine in their niche.", "summary_of_the_paper": "This paper presents a psychophysical comparison between a peripheral summary statistics model (\"texforms\"), adversarially robust and non-robust neural networks. Images are generated from each model / network using gradient ascent, then presented to humans at different retinal eccentricities. The key finding is that images generated by non-robust networks don't look anything like natural images, and so are easily discriminable, whereas robust and texforms become more difficult to tell apart from natural images as they are moved further into the periphery. The main claim is that because of this similar performance falloff, training on adversarial noise may cause similar representations to be learned as in the human periphery. By comparing the generated images in terms of physical and perceptual distances, the claim is further strengthened as \"suggesting their models compute the same transformations\". The paper ends with the interesting conjecture that \"peripheral computation may implicitly act as a natural visual regularizer\". \n", "summary_of_the_review": "The paper makes a few interesting arguments linking robustness to foveated visual systems. I find the evidence that the texform and robust models are doing similar / the same computation to be only weakly supported. The story of the paper could also be more clearly constructed.\n\nEDIT after discussion: Given report of new experimental evidence that the texform and robust models generate perceptually-similar images, I am raising my score from 5 to 8.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "Xs1s-fC7lF", "reviewer": "Reviewer_5yZa", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "I enjoyed reading the paper and found the connections it makes inspiring. \n\nThoughts:\n\n* Overall, the metameric manipulation seems to make a simple prediction: if a model correctly captures human vision for a given eccentricity, then the metamers should not be discriminable by humans when presented at that eccentricity. The authors interpret the decreasing discriminability as indicative that robust CNNs enjoy a similar relation to peripheral vision as the Freeman & Simoncelli model does. I agree that this is a reasonable interpretation. However, the data also suggests a discrepancy between robust CNNs and peripheral vision, as discriminability remains above chance even for 30 visual degrees. The authors might consider addressing this discrepancy in the text and in subsequent analyses, analyzing what humans see that the model can't.\n\n* Doesn't fitting the two free parameters of the Freeman & Simoncelli model to the robust CNN weaken the conclusion that the two models are equivalent in their predictive power? What if the Texforms are formed independently of the CNN?\n\n* It is unclear to me whether it's fair to generate metamers to be tested in the periphery without simulating visual acuity limitations during stimulus synthesis. The standard CNN might be driven by high-frequency information that isn't even there when the stimulus is presented at 20 or 30 degrees. At least, the authors might want to evaluate posthoc whether the metamers remain metamers under high-pass filtering emulating retinal constraints at the different eccentricities.\n\n* The synthetic vs. synthetic condition is included without sufficient motivation or discussion. How should this condition be interpreted differently than the natural vs. synthetic condition? This point is particularly relevant for the standard CNN where these two conditions diverge.\n\n* Do subject demographics, ethical approval, and subject compensation appear in the text?\n\n* Open-sourcing the code, stimuli, and behavioral results would increase the impact of this work.\n\n* Learning invariances shared between foveal and peripheral processing is an interesting idea! Perhaps this approach can replace adversarial training. This direction should be pursued further in another study. \n\nMinor points:\n\n* The discussion treats standard CNNs as spatially uniform. However, in practice, this is not the case due to effects related to pooling (Azulay &  Weiss, 2018) and padding (Alsallakh et al., 2020). The latter study even indicates implicit foveation.\n\n* Some of the cited ArXiv citations are outdated and should be replaced with citations of the corresponding conference proceedings.\n\nReferences:\nAlsallakh, B., Kokhlikyan, N., Miglani, V., Yuan, J., & Reblitz-Richardson, O. (2020). Mind the Pad--CNNs can Develop Blind Spots. arXiv preprint arXiv:2010.02178.\n\nAzulay, Aharon, and Yair Weiss. \"Why do deep convolutional networks generalize so poorly to small image transformations?.\" arXiv preprint arXiv:1805.12177 (2018).", "summary_of_the_paper": "This study draws a surprising connection between adversarially trained CNNs and human peripheral perception. Using the synthesized metamers, the authors show that the human ability to discriminate between natural images and their synthetic metamers drops in a similar fashion for metamers generated by inverting adversarially trained CNNs and for metamers generated by an inversion of a well-studied model of peripheral vision (i.e., \"Texforms\") as display eccentricity increases. This may indicate that adversarially trained models bear some resemblance to human visual processing at the retinal periphery.", "summary_of_the_review": "Although this work has some weaker aspects, this is a mature research project whose acceptance to ICLR would promote more important research into the connections between CNNs, robustness, and peripheral vision. Therefore, I recommend acceptance.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}]

Author rebuttal:

Meta-review: This paper shows that images synthesized to match adversarially robust
representations are similar to original images to humans when viewed 
peripherally.  This was not true for adversarially non-robust
representations.  Additionally the adversarially robust
representations were similar to the texform model image from a model
of human peripheral vision.


Reviewers increased their score a lot during the rebuttal period as  
the authors provided more details on the experiments and agreed to 
tone down some of the claims (especially the strong claim that the
robust representations capture peripheral computation similar to
current SOA texture peripheral vision models).  As well stated by 
reviewer s6dV, two representations with the same null-space are not
necessarily the same.  

With reviewer scores of 8 across the board, reviewers agree that this
is interesting work that should be presented at the conference.  I agree.
Decision: Accept (Spotlight)