Joint rotational invariance and adversarial training of a dual-stream Transformer yields state of the art Brain-Score for Area V4
Authors: William Berrios
Arturo Deza
Venue: Submitted to ICLR 2023 (2023)
Keywords: Vision Transformer
Brain-Score competition
adversarial training
rotation invariance.

Abstract: Modern high-scoring models of vision in the brain score competition do not stem from Vision Transformers. However, in this paper, we provide evidence against the unexpected trend of Vision Transformers (ViT) being not perceptually aligned with human visual representations by showing how a dual-stream Transformer, a CrossViT $~\textit{a la}$ Chen et. al. (2021), under a joint rotationally-invariant and adversarial optimization procedure yields 2nd place in the aggregate Brain-Score 2022 competition (Schrimpf et al., 2020b)  averaged across all visual categories, and at the time of the competition held 1st place for the highest explainable variance of area V4. In addition, our current Transformer-based model also achieves greater explainable variance for areas V4, IT, and Behaviour than a biologically-inspired CNN (ResNet50) that integrates a frontal V1-like computation module (Dapello et al., 2020). To assess the contribution of the optimization scheme with respect to the CrossViT architecture, we perform several additional experiments on differently optimized CrossViT's regarding adversarial robustness, common corruption benchmarks, mid-ventral stimuli interpretation, and feature inversion. Against our initial expectations, our family of results provides tentative support for an $\textit{``All roads lead to Rome''}$ argument enforced via a joint optimization rule even for non biologically-motivated models of vision such as Vision Transformers.

Under review as a conference paper at ICLR 2023
JOINT ROTATIONAL INVARIANCE AND ADVERSARIAL TRAINING OF A DUAL-STREAM TRANSFORMER YIELDS STATE OF THE ART BRAIN-SCORE FOR AREA V4
Anonymous authors Paper under double-blind review
ABSTRACT
Modern high-scoring models of vision in the brain score competition do not stem from Vision Transformers. However, in this paper, provide evidence against the unexpected trend of Vision Transformers (ViT) being not perceptually aligned with human visual representations by showing how a dual-stream Transformer, a Cross ViT a la Chen et al. (2021). under a joint sarial optimization procedure yields 2nd place in the aggregate Brain-Scon 2022 competition (Schrimpf et al. 2020b) averaged across all visual categories, and at the time of the competition held 1st place for the highest explainable variance of area V4. In addition, our current Transformer-be bassdd model also achieves greater explainable variance for areas V4, IT and Behavior than a biologically-insprre CNN (ResNet50) that integrates frontal VI-like computation module (Dapello) et al. 2020). To assess the contribution of the optimization scheme with respect to the CrossViT architecture, we perform several additional experiments on differ- ently optimized Cross ViT's regarding adversarial robustness, common corruption benchmarks, mid-ventral stimuli interpretation and feature inversion. Against our initial expectations, our family of results provides tentative support for an "All roads lead to Rome" argument enforced via joint optimization rule even for non biologically-motiatte models vision such as Vision Transformers.
rittiionlll-invariin and adver-
INTRODUCTION
Research and design of modern deep learning and computer vision systems such the NeoCogni- tron (Fukushima & Miyake 1982). H-Max Model (Serre et al. 2005) and classical CNNs (LeCun
et al. 2015) have often stemmed from breakthroughs in visual neuroscience dating from Kuffler (1953) and Hubel & Wiesel (1962). Today, research in neuroscience passes through a phase of symbiotic development where several models of artificial visual computation (mainly deep neural networks), may inform visual neuroscience (Richards et al._ 2019) shedding light on puzzles of development (Lindsey al., 2019), physiology (Dapello et al. 2020). representation (Jagadeesh &
Gardner 2022) and perception (Harrington & Deza 2022).
Of particular recent interest the development of Vision Transformers (Dosovitskiy al. 2021 model that originally generated several great breakthroughs in natural language processing (Vaswani al. 2017), and that has now slowly begun dominate the field of machine visual computation. However, in computer vision, we still do not understand why Vision Transformers perform so well when adapted the visual domain (Bhojanapalli et al.) 2021]. Is this improvement in performance due to their self-attention mechanism; a relaxation of their weight-sharing constraint? Their greater number of parameters? Their optimization procedure? Or perhaps a combination of all these factors? Naturally, given the uncertainty of the models' explainability, their use has been carefully limited as a model of visual computation biological (human) vision.
This is double-edged sword: On one hand, perceptual psychologists still rely heavily on relatively low-scoring ImageNet-batee based accuracy models such as AlexNet, ResNet VGG despite their limited degree of biological plausibility (though some operations are preserved, eg. local filtering, half-wave rectification, pooling). On the other hand, new breed of models such as Vision Transformers has surged, but their somewhat non-biolygycally inspired computations have straightforward mapping

---

Under review as a conference paper at ICLR 2023
aranch
Turaformer
The rnformeee
Remm PONNEEE
Alleniion
Mave
Lnvvr
Liierr
Turalame
Tainsawerr Owcsder
Turokumer Brozeer
Acurtion
Alteation
Atarrer
ferm Acantion
More
Nam 2Ftrit-C
Elveation
Mall-Sale Turafome
Atartee
NEST
Acartion
Mall Scale
Nam
Cress Attenion
ML Herder)
(ML
Coss- Altortonn
temm
Bome
Rem
Nerm
Gola
Goll
Figure 1: Diagram of CiossVi--18 (Chen et al. 2021) architecture & specification of selected layers for the V1, V2, V4, IT brain areas and the behavioral benchmark. Our Brain-Score 2022 competition entry was a variation of this model where the architecture is cloned, and the network is adversarially trained with hard data-augmentation rotations starting from pre-trained ImageNet model.
to approximate the structure of the human ventral stream]] thus discarding them as serious models of the human visual system. Alas, if computer vision scientists may of the usefulness of a poologccal/non-booooiieco plausibility debate, the reality that computer vision systems are still far from perfect. The existence of Adversarial examples, both artificial (Goodfellow) et al. 2013 Szegedy et al. 2014) and natural (Hendrycks et al. (2021b) reflects that there is still long way to go to close the human-machin machine perceptual alignment gap (Geirhos et al. 2021). Beyond the theoretical milestone of closing this gap, this will be beneficial for automated systems in radiology (Hosny et al. 2218), surveillance (Deza al. 2019). driving (Huang & Chen 2020), and art (Ramesh et al. 2022).
remain the sidelines
These two lines of thought bring us to an interesting question that was one of the motivations of this paper: "Are Vision Transformers good models of the human ventral stream?" Our approach to answer this question will rely on using the Brrin-Sccome platform (Schrimpf et al. 2020a) and participating in their first yearly competition with Transformer-baset model. This platform quantifies the similarity via bounded [0.1] scores of responses between a computer model and a set of non-human primates. recordings and/or behavioral outputs when
Here the ground truth is collected via neurophysiologee primates are performing psychophysical tasks, and the scores are computed by some derivation of Representational Similarity Analysis (Kriegeskorte et al. 2008) when pitted against artificial neural network activations of modern computer vision models.
Altogether, if we find that specific model yields high Brain-Scores, this may suggest that such flavor of Vision Transformers-basee models obey a necessary but not sufficient condition of biological plausibility - or least relatively with respect their Convolutional Neural Network (CNN) counter-parts. As it turns out, we will find out that the answer to the previously posed question complex, and depends heavily on how the artificial model optimized (trained). Thus the main contribution of this paper is to understand why this particular Transformer-basee model when optimized under certain conditions performs vastly better the Brain-Score competition achieving SOTA in such benchmark, and not to develop another competitive/SOTA model for ImageNet (which has shown to not be a good target Beyer et al. (2020). The authors firmly believe that the former goal tackled in the paper is much under-explored compared the latter, and is also of great importance to the intersection of the visual neuroscience and machine learning communities.
Even their start, the patch embedding operation is not obviously mappable to retinal, I.G,, V1-like primate computation.
2

---

Under review as a conference paper at ICLR 2023
Brain-Son Score
Io H-Hierrrhhy
Rank
Model ID
Deseription
Avg
VI
V2
11
Behavior
1033
Rag Tricks Riedel 2022 [New SOTA]
0.515
0.568
0.360
0.481
0.514
0.682
-0.2
991
Cruss VTT TS: (ddy + Kol) [Ours]
0.488
0.493
0.342
0.514
0,531
0.562
+0.8
1044
Gated Recurrence (Azeglio etal. 2022
0.463
0.509
0.303
0.482
0,467
0.554
-0.4
8395
N7A
0.456
0.538
0.336
0.485
0.459
0.461
-0.4
105T
N/A
0.453
0.539
0.332
0.475
0.510
0.410
-0.2
Table Ranking of all entries the Brain-Score 2022 competition as of February 28th, 2022. Scores in blue indicate world record (highest of all models at the time of the competition), while scores in bold display the highest scores competing entries. Column p-Hierarchy indicates the Spearman rank correlation between per-Area Brain-Score and Depth of Visual Area (VI IT).
OPTIMIZING A CROSSVIT FOR THE BRAIN-SCORE COMPETITION
Now, we discuss an interesting finding. where amidst the constant dehate of the biological plausibility of Vision Transformers which have been deemed less biologically plausible than convolutional
neural networks (as discussed in: [UR__ URL_2 2, though also see Conwell et al. (202I)) - we optimized under certain conditions, they may achieve high
find that when these Transformers explainable variance with regards to many areas in primate vision, and surprisingly the highest score to date at the time of the competition for explainable variance in area V4, that still remains mystery in visual neuroscience (see Pasupathy et al. (2020) for a review). Our final model and highest scoring model was based several insights:
Advarsarial-Training: Work by (Santurar et al. 2019 Engstrom et al. (2019b); Dapello et al. (2020), has shown that convolutional neural networks trained adversarially yield human perceptually- aligned distortions when attacked. This is an interesting finding, that perhaps extends to vision transformers, but has never been qualitatively tested before though recent works including this
one (See Figure 3 have started to investigate in this direction (Tuli et al.) [021]] Caro et al. (020)).
Thus we projected that once we picked specific vision transformer architecture, we would train adversarially.
Nusti-Resolution: Pyramid approaches (Burt & Adelson 1987 Simoncelli & Freeman 1995 Heeger
& Bergen 1995) have been shown to correlate highly with good models of Brain -rain-Scores MMrqques iet al. 2021). We devised that our Transformer had to incorporate this type processing either implicitly or explicitly in its architecture.
Object identification is generally rotationally invariant (depending on the category; e.g. not the case for faces (Kanwisher et al. 1998)). So implicitly trained our model to take in different rotated object samples via hard rotation- based data augmentation. This procedure is different from pioneering work of Ecker al. (2019) which explicitly added rotation equivariance to a convolutional neural network.
Rotation Invariance:
Localized texture- computation: Despite the emergence of global texture-biat in object recognition when training Deep Neural Networks (Geirhos et al. (019)) object recognition is a compositional process (Brendel & Bethge, 2019 Deza al. (020). Recently, works in neuroscience have also suggested that local texture computation is perhaps pivotal for object recognition to either create an ideal basis from which represent objects (Long al. 2018 Jagadeesh & Gardner 2022) and/or encode robust representations (Harrington & Deza 2022).
After searching for several models in the computer vision literature that resemble Transformer (that includes multi-resolution
model that ticks all the boxes above, we opted for a + local texture- based computation) that was trained with rotation-based augmentations and also adversarial training (See Appendix(A.3) A.33 exact training details, our bes! model also used 0.25 grayscale augmentation, though this contribution model Brain-Score is minimal).
2 AAvvrssaiia training is the process in which an image in the training distribution of network is perturbed adversarially (e.g. via PGD); the perturbed image is re-labeled to its original non-perturbed class, and the network is optimized via Empirical Risk Minimization (Madry et al. 2018).
3

---

Under review as a conference paper at ICLR 2023
ImageNet (*)
Brain-Score (1)
Model ID#
Description
Validation Accuracy (%)
Avg
VI
V2
V4
11
Behavior
N/A
Pixels (Baselinc)
NIA
0.053
0.158
0.003
0.048
0.035
0.020
NIA
AlexNet (Baseline)
63.3
0.424
0.508
0.353
0,443
0.447
0.370
NIA
VoncRosNetS0-oobustt (SOTA)
71.7
0.492
0.531
0.391
0.471
0.522
0.545
991
Cross CrossViT- VIT-18F (Adv Rot)
73.53
0.488
0.493
0.342
0,514
0,531
0.562
1084
Cros-ViT-18 (Adv)
64.60
0.462
0.497
0.343
0.508
0.519
0.441
1095
Cross CrossViT-11 VLT-18 (Rot)
79.22
0.458
0.458
0.288
0.495
0.503
0.547
1057
Cross VIT-18;
83.05
0.442
0.473
0.274
0.478
0.500
Table 2: A list of different models submitted to the Brain-Score 2022 competition. Scores in bold indicate the highest performing model per column. Scores in blue indicate world record (highest of all models at the time of the competition). All ViTS-V entries in the table are ours.
Results: Our best performing model #991 achieved 2nd place in the overall Brain-Score 2022 compe- tition (Schrimpl' et al. ) as shown in Table At the time of submission, it holds the first place for the highest explainable variance of area V4 and the second highest score in the IT area. Our model also currently ranks 6th across all Brain-Score submit- ted models as shown on the main brain-scorc web- site (including those outside the competition and since the start of the platform's 's conception, totaling
Table 3: Selected Layers of Cross Cross 18
Benchmark
Layer
V1,V2,V4
1.bl n.0.mrml
IT Behavior
blocks.I.blocks...44 1.4.mm22..1....2m
blocks.2.revert, 2ww.:rrreeeerrrrr...2222..
219). Selected layers used from the Cross 18 are shown in Figure [ and a general schematic of how Brain-Scores are calculated can be seen in
Figure
Additionally, in comparison with the biologically-inspreed model (VOneRes- Net50+ Adv. training), our model achieves greater scores in the IT, V4 and Behavioral benchmarks. Critically we notice that our best-performing model (#991) has a positive p-Hierarchy coefficient) compared to the new state of the art model (#1033) and other remaining entries, where this coefficient is negative. This was an unexpected result that we found most piologically-drive models obtain higher Brain-Scores at the initial stages of the visual hierarchy (V1) (Dapello et al.) 2020). and these scores decrease as a function of hierarchy with generally worse Brain-Scores in the final stages (e.g. IT).
Recordings
(Primate)
Neural Networks
tran Scre evdle of
Recordings from Artificial Neural Networks
A schematic of how brain-score is cal- culated as similarity metrics obtained from neural responses and model activations.
Figure 2:
We also investigated the differential effects of rotation invariance and adversarial training used on top of pretrained Cross ViT-18t as shown in Table We observed that each step independently helps to improve the overall Brain-Score, quite ironically at the expense of ImageNet Validation accuracy (Zhang et al.] 2019). Interestingly, when both methods are combined (Adversarial training and rotation invariance). the model outperforms the baseline behavioral score by a large margin (+0.062), the IT score by (+0.047), the V4 score by (+0.036), the V2 score by (+0.068), and the V1 score by (+0.020). Finally, even though is not the objective of paper, our best model outperforms on Imagenet standard accuracy (73.53%) to a more biologically principled model such as the adversarially trained Nett0o (71.7%) (Dapello al. 2020)
H-eerrrrch cnefficient: We define this as the Spearman rank correlation between the Brain-Scores of areas [V1,22, V4,IT] with hierarchy: [1,2,3,4]
4

---

Under review as a conference paper at ICLR 2023
Targeted Attack
Original
Cat
Dog
Insect
Fish
Frog
Figure 4: An extended demonstration of our winning model (CrossViT-188 [Adv. Training Rot. invariancel) where targeted attack is done for 3 images and the resulting stimuli is perceptu- ally aligned with human judgment of the fooled class. To our knowledge, this is the first time pprceptually-alinee adversarially attacks have been shown to emerge in Transformer-based models.
ASSESSMENT OF
MODELS
As we have seen, the optimization procedure heavily influences the brain-score of each Cross 18f model, and thus its alignment human vision (at a coarse level accepting the premise of the Brain- Score competition). Since understanding the importance of each step in the constrained optimization procedure of the Cross ViT of vital importance not only when benchmarked with non human primate neurophysiologica data but also in more classical in computer vision, We will now explore how different variations of such Cross ViT's change as function their training procedure, and thus their learned representations via suite of experiments. Additional experiments common corruptions (ImageNet-CC C) and ImageNet-R R can be seen in Appendix B
3.1 ADVERSARIAL ATTACKS
One of our most interesting qualitative results is that the direction of the adversarial attack made highest performing model resembles distortion class that seems to fool a human ob- Alas, while the ad-
Thryard Junc Galdii
(Figures versarial attack can be conceived as a type of
Qcalit
eigendistortion as Berardino al. (2017) we find that the Brain-Score optimized Transformer models are more perceptually aligned human observers when judging distorted stimuli. Sim- ilar results were previously found by Santurkar al. 2019) with ResNets, though there has not been any rigorous & unlimited time verification of this phenomena in humans similar the work of [Elsayed et al. (2018). Experimental details be found in Appendix
Oralif
(Ph seed
Figure 3: A qualitative demonstration of the human-machine perceptual alignment of the CrossViT-181 via the effects of adversarial per- turbations. As the average Brain-Score increases in our system, the distortions seem to fool human as well.
We also applied PGD attacks on our winning entry model (Adversarial Training Rot. Invari-
"Rigorous psychophysical experiments are still needed to empirically show this, although see Santurkar al. 2019:; Feather al. 2027 Harrington & Deza (222) where attacks brain-aligned models fool humans too.
5

---

Under review as a conference paper at ICLR 2023
100
166
1.99
Aec Becaue
Archviacture
Archkcctuue
ACCURRC (50
60
Creed 1it (No5
Crostt (Ada)
ANcumnyy (50
CreashTT:2 148%
(nicoal: 60) (Hx))
Accusecy Ph)
Conoluti a4 [Mar]
CraaviT-LBy JAEv
Croedr 318 (wetra red)
Conorali: (wwrnized)
60
20
(a) PGD attack-
step
(b) PGD attack- 10 step
(c) PGD attack- 20 step
Figure 5: A suite of multiple steps [1,10,20] PGD-based adversarial attacks clones of Cross 18 models that were optimized differently. Here we see that our winning entry (Adversarial training + Rotation Invariance) shows greater robustness (adversarial accuracy) than all other models the number of steps of PGD-based attacks increases only for big step sizes of 10 & 20.
ance) range e E {1/255, 2/255, 4/255, 6/255, 8/ 8/88//25 255, 10/255] and step-size # #PGDaeertion as in the robustness Python library (Engstrom et al. 2019a) in addition to three other controls: Adv. Training, Rotational Invariance, and a pretrained Cross VIT, to evaluate how their adversarial robust- ness would change as function of this particular distortion class. When doing this evaluation we observe in Figure 5 that Adversarially trained models are more robust to PGD attacks (three-step size flavors: 1 (FGSM). 10 & 20). One may be tempted to say that this is "expected" as the adversarially trained networks would be more robust, but the type of adversarial attack on which they are trained is different (FGSM as part of FAT (Wong et al. 2020) during training; and PGD at testing). Even if FGSM can be interpreted as a step PGD attack, it is not obvious that this type of generalization would occur. In fact, of particular interest that the Adversarially trained Cross V with "fast adversarial training" (FAT) shows greater robustness to PGD step attacks when the epsilon value used at testing time is very close to the values used at training (See Figure Naturally, for PGD- based attacks where the step size is greater (10 and 20; Figs. 5b winning entry model achieves greater robustness against all other trained Cross VIT's independent of the e values.
2.5
3.2 MID-VENTREE STIMULI INTERPRETATION
Next we are interested in exposing our models to a new type of stimuli/distortion class called "texforms" because recent work has used these types of stimuli to show that human peripheral computation may act as a biological proxy for an adversarially robust processing system (Harrington) & Deza 2022). and that humans may in-fact use strong texture-like cues to perform object recognition (in IT) without the specific need for strong structural cue (Long et al. 20118) Jagadeesh & Gardner 2022). Roughly speaking these texforms are very similar to their original counter-parts where they
match in global structure (i.e. form). but are locally distorted through eexture-macching operation (i.e. lexture) as seen in F (Inset 0.).
In particular we are interested in knowing if the class separation is preserved across the visual hierarchy for both the original and texform stimuli for the Cro-sViT-1s (Adv. Training + Rot. Invariance but not for the Cross ViT (PreTrained) modulated by a higher Brain-Score even if fixed with the same architecture. We used both the original and texform stimuli (100 images per class) from Harrington & Deza (0222), showing only 2 classes to the systems: primate and insect represented as circles and crosses respectively in Figure 6 In this analysis, we will use t-SNE projection with a fixed random seed across both models and stimuli to evaluate the qualitative similarity/differences of their 2D clustering patterns.
this would show a models' dissociation
We find that Pretrained Cross models have trouble in early visual cortex read-out sections to cluster both classes. In fact, several images are considered "visual outliers" for both original and texform images. These differences are slowly resolved only for the original images as we go higher in depth in the Transformer model until we get the Behavior read-out layer. This is not the case for the texforms, where the PreTrained Cross ViT- can not tease apart the primate and insect classes at such simulated behavioral stage. However, this story was to our surprise very different and more coherent with human visual processing for the Adv + Rot Cross Cross 18t where outliers no longer exist as there none in the small dataset- -, and the degree of linear separability for the original
6

---

Under review as a conference paper at ICLR 2023
Amplifie aizaaiattion Stimul
lesting Stmuai
Testing Stmmdi
Oriinal
Original
Behavior
Prenadned CrossViT-101
Adv. Training Rot. Invariance CrosVVi-1377
Figure 6: comparison of how two CiossViT-18f models manage to classify original and texform stimuli. In (0.) we see magnification of a texform, and in (A..B.) we see how our winning Model Adv. + Rot. manages to create tighter vicinities across the visual stimuli, and ultimately at the behavioral level - can separate both original and texform stimuli, while pretrained transformers seem to struggle with texform linear separability at the behavioral stage.
and texform stimuli increases in tandem through the hierarchy to near perfect separation for both stimuli at the behavioral stage.
3.3 FEATURE INVERSION
The last assessment provided was inspired by feature inversion models that are window to the representational soul of each model (Mahendran & Vedaldi, 2013). Oftentimes, models that are aligned with human visual perception in terms of their inductive biases and priors will show renderings that are very similar to the original image even when initialized from a noise image (Feather et al.) 2019). We use the list of stimuli from Harrington & Deza (2022) compare how several of these stimuli look like when they are rendered from the penultimate layer of a pretrained and our winning entry Cross ViossViTbbaseee model. A collection of synthesized images can be seen Figure 7
Even when these images are rendered starting from different noise images, Transformer- based models are remarkably good at recovering the structure of these images. This hints coherence with the results of Tuli et al. (22T)) who have argued that Transformer-basee models have a stronger shape bias than most CNN's (Geirhos et al. 2019). We think this due to their initial patch-embedding stage that preserves the visual organization of the image, though further investigation is necessary to validate this conjecture.
COMPARISON OF CROSSVIT VS VANILLA TRANSFORMES (VIT) MODELS
In this last section, we investigated what the role of the architecture in our results. Did arrive at a high-scoring Brain-Score model by virtue of the general Transformer architecture, or was there something particular about the CrossViT (dual stream Transformer), that in tandem with our training pipeline allowed for more ventral-streat procedures with a collection of vanilla Vision Transformers (ViT) where we manipulated the patch size and number of layers with the conventions of Dosovitskiy et al. (2021) shown in Figure 8
like representation? We repeated our analysis and training
Here we see that the Brain-Score on V2, V4, superior processing IT, Behavior and Average increase independent of the type of Vision Transformer used for our suite of models (CrossViT-118; and multiple ViT flavors) except for the particular case of ViT-S/16 due to over over-fitting (See Figure IT) that heavily reflects the behavior score. To surprise, adversarial training in some cases helped VI score and in some not, potentially due to an interaction with both patch size and transformer depth that has not fully been understood. In addition,
knowledge, this is also the first time that has
7

---

Under review as a conference paper at ICLR 2023
CrossViT-181
ResNet-50
Original
Initial Image (Noise)
Pretrained
Adv.+ Rot.
Standard
Robust
Sample
Sample
Sample
Sample
Dog
Cat
rrog
Turde
Bidd
Figure 7: summary of Feature Inversion models when applied on two different randomly samples noise images from subset of the stimuli used in Harrington & Deza (2022). Standard and Pretrained models poorly invert the original stimuli leaving high spatial frequency artifacts. Adversarial training improves image inversion models, and this is even more evident for Transformer models. Notice that Transformer models independent their optimization seem to preserve a higher shape bias as they recover the global structure of the original images. An extended figure can be viewed in the supplementary material.
been shown that adversarial training coupled with rotational invariance homogeneously increases brain-scores across Transformer-like architectures, as previous work has shown that classical CNNs (i.e. ResNets) increase Brain-Scores with adversarial training (Dapello al. 2020
Metnod
Method
Method Adv Rot Pverriieed
AdV + Sot
Adr + Rtt Fretrained
0.2
CrosdiT:110 RR
VIT-/12
VIT-16
VT--122
Crosectt 181
V/T8/7
VITAVLE
VIT
VIT-0112
VITARI
V/T-522
Axchieettree
Archilcture
Scores
(b) V2 Scores
(c) V4 scores
0.7
37
0.7
Method
0.6
3.6
0.5
0.5
3.5
0.5
0.4
0.3
02
0.2
0. VTT8119
0.1
0.0
0.
Coouli1-288
VIT882 VIT8211
GwsaVi113 WIT-0/22
Architattrre
(d) IT Scores
(e) Behavior Scores
(l) Average Brain-Scores
Figure 8: Similarity Brain-Score analysis on the different cortical areas of the ventral stream for vanilla transformers (ViT) and Cioss For nearly all Transformer variations, Adversarial Training with Joint Rotational Invariance increases per Area and Average Brain-Scores.
8

---

Under review as a conference paper at ICLR 2023
5 DISCUSSION
question from this work that motivated the writing of this paper beyond the achievement of a high score in the Brain-Score competition is: How does a CrossViT--18 perform well explaining variance in primate area V4 without many iterations of hyper-parameter engineering? In this paper, we have only scratched the surface of this question, but some clues have emerged.
One possibility is that the cross cross-attention mechanism of the Cross 18 is proxy for Gramian-lit operations that encode local texture computation (vs global Geirhos et al. (2019)) which have been shown to be pivotal for object representation in humans (Long et al. 2018 Jagadeesh & Gardner 2022, Harrington & Deza 2022). This initial conjecture is corroborated by our image inversion effects (Section 3.3) where we find that CrossViT's preserves the structure stronger than Residual
Networks (ResNets), while vanilla ViT's shows strong grid-like artifacts (See Figures [5
[6 in the
supplementary material).
Equally relevant throughout this paper has been the critical finding of the role of the optimization procedure and the influence it has achieving high Brain-Score even for non-biologically plausible architectures (Riedel 2022). Indeed, the simple combination of adding rotation invariance as an implicit inductive bias through aaggeaugmenttiion, and adding "worst-case scenario" (adversarial) images in the training regime seems to create a perceptually-aligned representation for neural networks (Santurkar al. 2019).
On the other hand, the contributions to visual neuroscience from this paper are non-obvious. Tra- ditionally, work in vision science has started from investigating phenomena in biological systems via psychophysical experiments and/or neural recordings of highly controlled stimuli in animals, to later verify their use or emergence when engineered in artificial perceptual systems. We are now in a situation where we have "by accident" stumbled upon a perceptual system that can successfully model (with half the full explained variance) visual processing human area V4 a region of which its functional goal still remains mystery to neuroscientists (Vacher et al.) 2020) Bashivan et al.) 2019) -, giving us the chance to reverse engineer and dissect the contributions of the optimization procedure to a fixed architecture. We have done our best to pin-point causal root to this phenomena, but we can only make an educated guess that a system with a cross cross-attentinn attention mechanism can even under regular training achieve high V4 Srain-Scooees and these are maximized when optimized with our joint adversarial training and rotation invariance procedure.
Ultimately, does this mean that Vision Trans- formers are good models of the Human Ventral Stream? We think that answer to this ques- tion is a response to the nursery rhyme: "It looks like a duck, and walks like duck, but it's not duck!" One may be tempted to affirm that it duck if we are only to examine the family of in-distribution images from ImageNet at in- ference; but when out of distribution stimuli are shown to both machine and human perceptual systems we will have a chance to accurately as- sess their degree of perceptual similarity 5 We can tentatively expand this argument further by studying adversarial images for both perceptual systems (See also Figure 9). Future images used in the Brain-Score competition that will better representational similar- ity should use these adversarial-lis like images to test if the family of mistakes that machines make are similar nature than to the ones made by hu- mans (See For example Golan et al. (2020)). If that is to the case, then we are one step closer to building machines that can see like humans.
Crose Vis-18t
CiossVit-1ff
(Adv. Training Rotation)
Machine Perception
Human Perception
Adversarial Image Set
Distribution Image Set
Distribution Image Set
Figure 9: A cartoon inspired by Feather et al. (2019) 2021) depicting how our model changes its perceptual similarity depending its optimiza- tion procedure. The arrows outside the spheres represent projections of such perceptual spaces that are observable by the images we show each system. While may look like our winning model is "nearly human" it has still a long way to go, as the adversarial conditions have never been physio- logically tested.
assess numan-machine
CConsider for example, that some stimuli used in Brain-Score are a basis set of Gabor filters, which are never encountered in nature

---

Under review as a conference paper at ICLR 2023
REFERENCES
Simone Azeglio, Simone Poetto, Marco Nurisso, and Luca Savant Aira. Improving neural predictivity in the visual cortex with gated recurrent connections. In Brain-Score Workshop, 2022. URL net
https::/
Pouya Bashivan, Kohitij Kar, and James J DiCarlo. Neural population control via deep image synthesis. Science, 364(6439::aavv433, 2019.
Alexander Berardino, Valero Laparra, Johannes Ballé, and Eero Simoncelli. Figen-distortions of hierarchical representations. Advances neural information processing systems, 30, 2017.
Lucas Beyer, Olivier Hénaff, Alexander Kolesnikov. Xiaohua Zhai, and Aäron van den Oord. Are done with imagenet? arXiv preprint arXiv:2006.0713 2020.
Srinadh Bhojanapalli, Ayan Chakrabarti, Daniel Glasner, Daliang Li, Thomas Unterthiner, and
Andreas Veit. Understanding robustness of transformers for image classification. In Proceedings of the JEEE/CVE International Conference on Computer Vision, pp- 10231-10241, 2021.
Wieland Brendel and Matthias Bethge. Approximating cnns with mag-oo-local-feature models works surprisingly well on imagenet. arXiv preprint arXiv: 19X.::1904000760, 2019.
Peter Burt and Edward H Adelson. The laplacian pyramid as a compact image code. In Readings in computer vision, pp. 1799 Elsevier, 1987.
Josue Ortega Caro, Yilong Ju, Ryan Pyle, Sourav Dey, Wieland Brendel, Fabio Anselmi, and Ankit Patel. Local convolutions cause implicit bias towards high frequency adversarial examples. arXiv preprint arXiv:2006. 14440, 2020.
Chun-Fu Richard Chen, Quanfu Fan, and Rameswar Panda. Crossvit: Cross-attention multi-scale vision transformer for image classification. Proceedings of the IEEE/CVF International Confer- on Computer Vision, pp. 357-366, 2021.
Colin Conwell, Jacob S. Prince, George Alvarez, and Talia Konkle. What can 5.17 billion regression fits tell us about artificial models of the human visual system? In SVRHM 2021 Workshop @ NeurlPS, 2021. http://pee//ppneeveeeeeeee//eeee pttp:rrmmmiiiiiiiiiyoo66pe0001 xiyGq6FNT
Joel Dapello, Tiago Marques, Martin Schrimpf, Franziska Geiger, David Cox, and James DiCarlo. Simulating a primary visual cortex the front of cnns improves robustness to image perturbations. Advances in Neural Information Processing Systems, 33: 13033-1308 2020.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In 2009 JEEE conference on computer vision and pattern recognition, pp. 248-255. Ieee, 2009.
Arturo Deza, Amit Surana, and Miguel P Eckstein. Assessment of faster r-cnn in man-machine collaborative search. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pp. 3185-3194, 2019.
Arturo Deza, Qianli Liao, Andrzej Banburski, and Tomaso Poggio. Hierarchically compositional tasks and deep convolutional networks. arXiv preprint arXiv:2006.13915. 2020.
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn. Xiaohua Zhai Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image is worth 16x16 words: Transformers for image recognition at scale. In International Conference on Learning Representations, 2021. URL WRW httlttt://ppeereiiieee net pue//fore ftre/ 2id.mmmdddyYccbFFc 1I
Alexander S. Ecker, Fabian H. Sinz, Emmanouil Froudarakis, Paul G. Fahey, Santiago A. Ca- dena, Edgar Y. Walker, Erick Cobos, Jacob Reimer, Andreas S. Tolias, and Matthias Bethge. A Dotation-equivate convolutional neural network model of primary visual cortex. In International Conference on Learning Representations, 2019. URL ht https::// //tpt:/e////eeeeieee. net.ewwwweeeeeee.e.eeee.eeeeeeee fform? id=H1 FU8
10

---

Under review as a conference paper at ICLR 2023
Gamaleldin Elsayed, Shreya Shankar, Brian Cheung, Nicolas Papernot, Alexey Kurakin, Ian Good- fellow, and Jascha Sohl-Dickstein. Adversarial examples that fool both computer vision and time-limited humans. Advances in neural information processing systems, 31, 2018.
Logan Engstrom, Andrew Ilyas, Hadi Salman, Shibani Santurkar, and Dimitris Tsipras. Robustness (python library). 2019a. URL https: /ttph/ggthh.../// com/ wawaddyyaabrbbuuttttate
Logan Engstrom, Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Brandon Tran, and Alek- sander Madry. Adversarial robustness as a prior for learned representations. arXiv preprint orXiv:1906.00990 2019b.
Jenelle Feather, Alex Durango, Ray Gonzalez, and Josh McDermott. Metamers of neural networks reveal divergence from human perceptual systems. Advances in Neural Information Processing Systems, 32, 2019.
Jenelle Feather, Alex Durango, Guillame Leclere, Aleksander Madry, and Josh McDermott. Adver- sarial training aligns invariances between artificial neural networks and biological sensory systems. Cosyne Meeting Abstract, 2021.
Kunihiko Fukushima and Sei Miyake. Neocognitron: A self-organizing neural network model for mechanism of visual pattern recognition. In Competition and cooperation in neural nets, pp. 267-285. Springer, 1982.
Robert Geirhos, Patricia Rubisch, Claudio Michaelis, Matthias Bethge, Felix A. Wichmann, and Wieland Brendel. Imagenet-trained CNNs are biased towards texture; increasing shape bias improves accuracy and robustness. In International Conference on Learning Representations, 2019. URLLAttpp../opeeneeeeew...s oetp://eww.....eeofooooooe/eegge
Robert Geirhos, Kantharaju Narayanappa, Benjamin Mitzkus, Tizian Thieringer, Matthias Bethge, Felix A. Wichmann, and Wieland Brendel. Partial success in closing the gap between human and machine vision. In A. Beygelzimer, Y. Dauphin, P. Liang, and J. Wortman Vaughan (cds.), URL htttps://ope.revie.
Advances in Neural Information Processing Systems, 2021.
net/forum? 1d= 1d= 144rr
Tal Golan, Prashant C. Raju, and Nikolaus Kriegeskorte. Controversial stimuli: Pitting neural networks against each other as models of human cognition. Proceedings of the National Academy of Sciences, 117477)29333--229333 29337, 2020. doi: 10. 1073 191133311..11 URLpttps::/ www
pnas.org/doi//e hwtp///bb/ll0000 1073/ pnas 1912334117
lan J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In Yoshua Bengio and Yann LeCun (eds.), 3rd International Conference on Learning Representations, ICLR 2015, San Diego CA, USA, May 7-9, 2015, Conference Track Proceedings, 2015. BtRLbtt::///ax:t org/ 1412. 6572
Anne Harrington and Arturo Deza. Finding biological plausibility for adversarially robust features via metameric tasks. In International Conference on Learning Representations, 2022. URL
https:://peereviie net forum?id=yee 2x9vgNm)
David Heeger and James R Bergen. Pyramid-based texture analysis/synthesi.. In Proceedings of the 22nd annual conference Computer graphics and interactive techniques, pp. 229-238, 1995.
Dan Hendrycks and Thomas Dietterich. Benchmarking neural network robustness common corruptions and perturbations. In International Conference on Learning Representations, 2019. URL htt/:httss/:/ppeeeeeee
wwt./ http://ooommm.oooo6.....o.
Dan Hendrycks, Steven Basart, Norman Mu, Saurav Kadavath, Frank Wang, Evan Dorundo, Rahul Desai, Tyler Zhu, Samyak Parajuli, Mike Guo, Dawn Song, Jacob Steinhardt, and Justin Gilmer. The many faces of robustness: critical analysis of out-oi-distii generalization. ICCV, 2021a.
Dan Hendrycks, Kevin Zhao, Steven Basart, Jacob Steinhardt, and Dawn Song. Natural adver- sarial examples. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 15262-15271 2021b.
11

---

Under review as a conference paper at ICLR 2023
Ahmed Hosny, Chintan Parmar, John Quackenbush, Lawrence H Schwartz, and Hugo JWL Aerts.
Artificial intelligence in radiology. Nature Reviews Cancer, 18(8):500-510, 2018.
Jeremy Howard. Imagewang, 2019. URL httpp::/ggttub..otttt http:///////////aaooaaaaaaaaaaa/
Yu Huang and Yue Chen. Autonomous driving with deep learning: A survey of state-of-art technolo-
gies. arXiv preprint arXiv:2006.06091, 2020.
David H Hubel and Torsten N Wiesel. Receptive fields, binocular interaction and functional architec- ture in the cat's visual cortex. The Journal of physiology, (60(1):106, 1962.
Akshay V. Jagadeesh and Justin L. Gardner. Texture-like representation of objects in human visual cortex. Proceedings of the National Academy of Sciences, (19((7)2221111111100011 2022. doi: 10. 10.1003/pnas... 2115302119 URL htt.:ss//wwwppssssorr//////////0 www
2115302119
Ahmadreza Jeddi, Mohammad Javad Shafiee, and Alexander Wong. A simple fine-tuning is all you need: Towards robust deep learning via adversarial fine-tuning, 2020.
Nancy Kanwisher, Frank Tong, and Ken Nakayama. The effect of face inversion on the human fusiform face area. Cognition, 68(1):B1-B1,, 1998.
Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization. arXiv preprint arXiv: 62800, 2014.
Klim Kireev, Maksym Andriushchenko, and Nicolas Flammarion. On the effectiveness of adversarial training against common corruptions. arXiv preprint arXiv:2103.023: 02.352. 2021.
Simon Korbblith, Mohammad Norouzi, Honglak Lee, and Geoffrey Hinton. Similarity of neural network representations revisited. In Kamalika Chaudhuri and Ruslan Salakhutdinov (eds.), Proceedings of the 36th International Conference Machine Learning, volume 97 of Proceedings of Machine Learning Research, pp. 3559. PMLR, 09-15 Jun 2019. URL https://
proceedings mwr. prw.s/rsss/e..... http:////////oobblcc//a/ 1th.11ithh9190 1aa.19a.. html
Nikolaus Kriegeskorte, Marieke Mur, and Peter A Bandettini. Representational similarity analysis- connecting the branches of systems neuroscience. Frontiers in systems neuroscience, 2:4, 2008.
Stephen W Kuffler. Discharge patterns and functional organization of mammalian retina. Journal of neurophysiology. 16(1):37-68, 1953.
Alfred Laugros, Alice Caplier, and Matthicu Ospici. Are adversarial robustness and common perturbation robustness independant attributes? In Proceedings of the IEEE/CVF International Conference on Computer Vision Workshops, pp. 0-0, 2019.
Yann LeCun, Yoshua Bengio, and Geoffrey Hinton. Deep learning, nature, 521(7553):436-444 2015.
Zhe Li, Josue Ortega Caro, Evgenia Rusak, Wieland Brendel, Matthias Bethge, Fabio Anselmi, Ankit B Patel, Andreas S Tolias, and Xaq Pitkow. Robust deep learning object recognition models rely on low frequency information in natural images. bioRxiv, 2022.
Jack Lindsey, Samuel A. Ocko, Surya Ganguli, and Stephane Deny. The effects of neural resource con- straints on early visual representations. In International Conference on Learning Representations, 2019. URL
net wttp://www..eeetttteteeemom forummid-d 1x33==5ttx
Bria Long, Chen-Ping Yu, and Talia Konkle. Mid-level visual features underlie the high-level categorical organization of the ventral stream. Proceedings of the National Academy of Sciences, 115(38)E9011- 2018.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt. Dimitris Tsipras, and Adrian Vladu. To- wards deep learning models resistant to adversarial attacks. In International Conference on Learn- ing Representations, 2018. / wtt.:nee//oormmm..ed.rr......
12

---

Under review as a conference paper at ICLR 2023
Aravindh Mahendran and Andrea Vedaldi. Understanding deep image representations by inverting them. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 5188-5196, 2015.
Tiago Marques, Martin Schrimpf, and James DiCarlo. Multi-scale hicrarchical neural network models that bridge from single neurons in the primate primary visual cortex to object recognition behavior. bioRxiv, 2021.
Anitha Pasupathy, Dina V Popovkina. and Taekjun Kim. Visual functions of primate area v4. Annual review of vision science, 6:363-385, 2020.
Rishi Rajalingham. Elias B. Issa, Pouya Bashivan, Kohitij Kar, Kailyn Schmidt, and James J. DiCarlo. Large-scale, high-resolution comparison of the core visual object recognition behavior of humans, monkeys, and state-of-the-art deep artificial neural networks. bioRxiv, 2018. doi: 10. 10.1101/240614.
URL httph: wwwp//wwww.... http:///www.booxx.o www.iiiviiivvv.........iii.iiw.. org/ wwtgg//oneet///oe wttpa//tteaaaayrrraeaeea /02 00//0//2122222222/
Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen. Hierarchical text- conditional image generation with clip latents. arXiv preprint arXiv:2204.06122, 2022.
Blake A Richards, Timothy P Lillicrap. Philippe Beaudoin, Yoshua Bengio, Rafal Bogacz, Amelia Christensen, Claudia Clopath, Rui Ponte Costa, Archy de Berker, Surya Ganguli, et al. A deep learning framework for neuroscience. Nature neuroscience, 22(1 22(11):177 (7111))7761177000 2019.
Alexander Riedel. Bag of tricks for training brain-like deep neural networks. In Brain-Score Workshop, 2022. URL https::/ net forum? Sd--
Shibani Santurkar, Andrew Ilyas, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. Image synthesis with a single (robust) classifier. Advances in Neural Information Processing Systems, 32, 2019.
Martin Schrimpf, Jonas Kubilius, Ha Hong, Najib J Majaj, Rishi Rajalingham, Elias B Issa, Kohitij Kar, Pouya Bashivan, Jonathan Prescott-Roy, Franziska Geiger, et al. Brain-score: Which artificial neural network for object recognition is most brain-like? BioRxiv, pp. 407007, 2020a.
Martin Schrimpf, Jonas Kubilius, Michael J. Lee, N. Apurva Ratan Murty, Robert Ajemian, and James DiCarlo. Integrative benchmarking to advance neurally mechanistic models of human intelligence. Neuron, 108(3):413-423, 2020b. ISSN 0896-6273. doi: https://doi.org/10.. 1016/j.
neuron. neurom.2020.07.044 040. URL https: www. www.scciieeeeeeeeeeeeeeeeeeeeeee wet.eccoocccciii stio///eeeec//ricciee.
Thomas Serre, Minjoon Kouh, Charles Cadieu, Ulf Knoblich, Gabriel Kreiman, and Tomaso Pog- gio. A theory of object recognition: computations and circuits in the feedforward path of the ventral stream in primate visual cortex. Technical report, MASSACHUSETTS INST OF TECH CAMBRIDGE MA CENTER FOR BIOLOGICAL AND .... 2005.
Eero P Simoncelli and William T Freeman. The steerable pyramid: flexible architecture for multi- scale derivative computation. In Proceedings. International Conference on Image Processing, volume 3, pp. 444 447. IEEE, 1995.
Christian Szegedy, Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In Yoshua Bengio and Yann LeCun (eds.), 2nd International Conference on Learning Representations, ICLR 2014, Banff, AB, Canada, April 14-16, 2014, Conference Track Proceedings, 2014. URL pectp://axxin org/abs 1312. 6199
Shikhar Tuli, Ishita Dasgupta, Erin Grant, and Thomas L Griffiths. Are convolutional neural networks or transformers more like human vision? arXiv preprint arXiv:2105.077197 2021.
Jonathan Vacher, Aida Davila, Adam Kohn, and Ruben Coen-Cagli. Texture interpolation for probing visual perception. Advances in Neural Information Processing Systems,
2020.
13

---

Under review as a conference paper at ICLR 2023
Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, E ukasz Kaiser, and Illia Polosukhin. Attention is all you need. Guyon, U. Von Luxburg, S. Bengio, H. Wallach, R. Fergus, S. Vishwanathan, and R. Gamett (eds.), Advances in Neural Information Processing Systems, volume 30. Curran Asso- ciates, Inc., 2017. URL http:: htttpss://proccediinnn 3FFe2/3377661110003ccccec3333333
Paper. pdf
Eric Wong, Leslie Rice, and J. Zico Kolter. Fast is better than free: Revisiting adversarial training, 2020.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In International conference machine learning, pp. 7472-7482. PMLR, 2019.
14

---

Under review as a conference paper at ICLR 2023
A EXPERIMENTAL SETUP
A.1 DATASET
We used the ImageNet 1 (Deng et al. 2009) dataset for training. ImageNet contains 1,000 classes and the number of training and validation images are 1.28 million and 50,000, respectively. We validate the effectiveness of our models in the different datasets proposed in the Brain-Score (Schrimpl al. 2020a) competition.
A.2 CUSTOM SCHEDULER
The proposed learning rate scheduler is based on Jeddi et al. (2020) and is formulated as 0.0004 for LR 0.00002 for 1 < e <= 6. As shown in Figure T0 start with small learning rate and then it is smoothly increased for one epoch. We empirically found that fine-tuning the trans- former for more than epoch resulted in an unter-fitting behavior of the adversarial robust- ness. After this first epoch, the learning rate reduced very fast so that model performance converges to steady state, without having too much time to overfit on the training data.
1e44
2,00
1.75
LR 0.00012
and
1.50
1.00
0.75
0.50
0.25
Epoch number
Figure 10: Custom scheduler used for training the Vision Transformer.
A.3 TRAINING SETUP
We used pretrained CrossViT-18t (Chen et al. 2021) downloaded from the timm library that adversarially trained via fast gradient sign method (FGSM) attack and random initializa- tion (Wong al. 2020). We opted for this strat- egy, known as "Fast Adversarial Training" as it allows a faster iteration in comparison with other common approaches (e.g. adversarial training with the PGD attack). In particular, all experi- ments used 2/255 and step size 1.25c as proposed originally (Wong et al. 2020). However, in contrast the previous method, follow a 5 epoch fine-tuning approach with a cus- tom learning rate scheduler in order avoid derfitting. We optimize our networks with Adap- tive Moment Estimation (Adam a la Kingma & Ba (2014) and employed mixed precision for faster training- All input images were pre- processed with resizing to 256 x 256 followed
Creal S-l UMd
V15222 rady 160
9118/3 (ddr
Figure 11: Training robust acc. of each Vision Transformer model (Adv Rot). We clearly ob- served that ViT-S/16 has over-fitted during train- ing.
by standard random cropping and horizontal mirroring. In the case of our best performing model (#991), we additionally incorporated random grayscale transformation (p 0.25) and set of hard rotation transformations of (0,, 90", 180", 270%) implicitly aiding for rotational invariance due to the characteristics of images appearing in the behavioral benchmark of Rajaaingham et al. (2018). All our experiments were run locally on a GPU-Tesla V-100. Each adversarial training of a vision transformer took around 48 hours.
15

---

Under review as a conference paper at ICLR 2023
B ADDITIONAL ASSESSMENT OF CROSSVIT-18f-BASSE BBASED MODELS
B.1 COMMON CORRUPTION BENCHMARKS
We also looked into how adversarial training would affect the performance of the different sets of neural networks common corruptions that are adversarial. To do this, we our models and benchmarked them to the ImageNet- - dataset (Hendrycks & Dietterich] 2019).
One would have expected Brain- Aligned models like our adversarially-traant Cross VIT to also present strong robustness to common corruptions. To our surprise, this was not the case seen Table This is a puzzling result, though there have been several bodies of work suggesting that adversarial robustness and common corruptions robustness are independent phenomena (Laugros et al.) 2019). however Kireev et al. (202T) have proved otherwise contingent on the Loo radius 8 but now see Li et al. 2022).
rotationally invariant
Aonmay
Impoton
Rog
ReiNedo Augrex
77.53
63.1
655
66.
664
673
63.8
66.1
71.6
70,9
66.5
57.8
602
76.
59.5
68.5
CHouViE-RR) Mav
503
532
902
1904
6480
16
96.
982
921
816
1003
822
1949
754
161
752
678
DowVV7-11 1B
37
Table table showing the comparison of mean corruption errors (mce)'s across CrossVi1 models contingent on their training regime. A DesNet50-Augmis is shown as reference of particularly strong model to common corruptions. Here lower scores are indicative of better robustness to the different distortion types of Hendrycks & Dietterich (209)).
B.2 IMAGENET-R
We also looked into how adversarial training would affect the performance of generalization to various abstract visual renditions. To do this, we ran our models and benchmarked them on the CongeNet-Rendition (ImageNet-R) dataset (Hendrycks al. 2021a).
We observe that the accuracy on ImageNet-R decreases when the CrossViT is adversarially trained. However, when combine the rotation invariance and adversarial training regimes, the accuracy ImageNet-R becomes competitive with its pretrained version. In addition, we also appreciate that this combination does not affect the IID/ODD Gap with respect the pretrained CrossVill
Network
ImageNet-200 (f)
ImageNet-R (f) Gap (4)
Cross ViT-18 (Adv + Rot)
90.75
41.14
49.61
Cross ViT-18 (Adv)
85.52
35.73
49.79
CrossViT-188 (Rot)
93.89
37.35
56.54
Cross ViT-181
95.64
45.7
49.94
Table 5: A table showing the comparison of the accuracy on Imagenet-R dataset across Cross ViT
models contingent in their training regime.
B.3 CENTER KERNEL ALIGNMENT TO UNDERSTAND CROSSVIT REPRESENTATION
We also calculated the center kernel alignment (Krrbllth et al. 2019 scores each brain-region layer and on the Behavior and Inversion layers using a linear kernel. Besides, CKA scores were generated using the 'ImageNette' validation dataset (Howard 2019) which is subset of 10 easily classified classes from ImageNet. The objective this experiment is to understand how correlated are the variance of internal representations across the different versions of the optimized ViT-188.
AAsoo see Li ct al. 2022 that shows that generally robust models (robust to adversarial + commmon corruptions) have preference for low-spatial frequency statisties.
16

---

Under review as a conference paper at ICLR 2023
We see in Figure 12 that intermediate brain- layers (IT, Behavior) tend to have similar representations across the 3 variants Cross Vin--8iTT88 (Rot. Adv., Rot. and Adv.) based on the CKA score. In addition, also appreciate that best model (Crossvit- + Rot. + Adv.) is more correlated with their individual versions (Rot. and Adv.) than with its pretrained version.
It is also remarkable that the penultimate layer of the largest branch (inversion layer), our best Cross VIT possesses a very weak similarity with its pretrained form. This suggests that adversarial training and rotation invariance, either jointly or independently, strongly changes the representation of the final layers with respect to its pretrained version (Cross ViT-
CreSsMT
CosSVIT
0.9
0.
0.6
81
CrozsVTT
Chossit doou hol)
Guasiit 389 (aba)
CoGoNT 22 (uo))
Crocn
Crossit 18) davv Rod
Grossit 38 (hbv
CresuT 30 coo3
Crec0
MODEL
MODEL
Layer Behavior
1.0
Layer Inversion
1.0
DroasW (ddv Reb)
0.93
0.92
0.89
0.89
0.48
CrodVIT1111 (AdV)
0.98
0.81
0.81
CrosUIT 38 (Adk)
0.89
0.86
0.46
CroaVit-15r (Rab)
0.92
0.91
0.85
Crosu B1 (Nos)
0.89
0.86
0.53
Cros
0.83
5.
81
0.85
0.5
CrossViT-1B8 18t
0.48
0.46
0.53
355
CoSpT 12h Rod)
Crocoit 18t (48))
Crecim (NoS)
GroSshT 181
CoSSTT 28 (Md Rus
CrosOI11 (403
Crocitt 18
MODEL
MODEL
Figure 12: Similarity of representations at V1, V2, V4, Behavior and Inversion layers across the four versions of Cross (pretrained, Adv., Adv. + Rot., Rot.). A score of 1.0 indicates highest representational similarity, while score of 0.0 indicated lowest.
C ADVERSARIAL ATTACKS EXPERIMENTS
C.I TARGETED ADVERSARIAL ATTACKS
In this experiment, we maximize the probability of a specific class ("Goldfish" targeted attack) for the 4 flavors of the Cross V8T- We observed that the average "Brain-Score" increases, the models tend to resemble more accurately the samples of the target class (Figure 33.. addition, we also performed targeted attacks for different classes the ImageNet dataset as can be seen in Figure Parameters used for these experiments can found in Table 6
C.1.1 ADVERSARIAL ROBUSTNESS PGD ATTACKS
Results of PGD adversarial attacks on different versions of Cross Cross ViT-18t can be found in Table 7 All experiments used {1/255, 2/255, 4/255, 6/255, 8/ 8/255, 10/255} and step-size 2.5 in the robustness Python library (Engstrom et al. 2019a
*PGDiteratooss
17

---

Under review as a conference paper at ICLR 2023
Dataset
Steps
Step size
ImageNet
300
500
1
Table 6: Parameters used for the targeted attacks
tes((T)
Cross
(Adv Roi
65.176133766183 83
$5.9511271512255
39.52/3231 69
27.81715.661 76/13
19.5316.6776.33
147772.122.44
CrossViT-18f (Adv)
62.27/5.3/4.15
59,9/4.2/2.1
55.36/7.188 18/0.999
51.02/1497/0.C 9.7///66666
47.16/12.8400.6
43.76/6.37096
CrossViT-181 (Rot)
48/1.75/L5
4,57/000
2,17/0/0
1,89000
1.87/0/0
2.13/010
CrossViT-18f
48.31/14.87/6.64
44.01/5.56/11
41.58/1.4700.09
40.96/0 40.96/0.59/0.02
40.79/0.35/0.01
40.9/0.1//0
Table 7: PGD adversarial attacks on different flavors of Cross ViT-188. Results represent adversarial accuracy at 1/10/20 PGD-iterations
D BRAIN-SCORE
D.1 METRICS
Brain-Score is composite of multiple neural and behavioral benchmarks that score most of the artificial neural networks on how similar they are to the primate's ' brain mechanisms for core object recognitior/Schrimpf et al. )020aa..
In the same direction, the Brain-Score competition was held for months from December to March 22. The objective was evaluate models that engage with the whole ventral visual stream. These models were evaluated in 33 neuronal and behavioral benchmarks related to activity macaque visual cortical areas V1, V2, V4, and IT and human psychophysical performance in set of object classification tasks. The metrics used in the evaluation are the followings:
Measures how well the responses to given images in a model area predict the responses of a neuronal population of the corresponding area in the macaque brain. First, the model responses are mapped the neuronal recordings using a linear transformation (PLS regression with 25 components) on training set of images. Then the model's predictivity is determined for held-out images by computing the Pearson correlation coefficient between the model's predictions and the neuronal responses.
Neural predictivity:
Single-neuron property distribution similarity: Measures whether single neurons in model area are functionally similar to single-neum neurons in the corresponding monkey brain area. This is done by comparing the distribution of single-neume response properties between the model area and the brain area using a similarity score (using the KS distance).
Behavioral consistency: Measures the behavioral similarity between the model and humans in core object recognition tasks. This metric does not measure the overall accuracy of the model but whether it can predict the patterns of successes and failures humans in a set object recognition tasks. Model's 's and humans' behavioral accuracies are first transformed to a d' stattistic and then compared using the Pearson correlation coefficient.
D.1.1 SELECTING BEST-BRAINSCO LAYERS
Best performing layers on each vision transformer were selected by brute-force approach. We evaluate each layer of the vision transformer models on each brain region and behavior dataset and select the layer that got the best score on the public benchmarks (in order to avoid overfitting) proportioned by Brain-Score organization. After this step, the "Adv Rot" & pretrained versions of each transformer are submitted to the competition fixing best performing layers (See Table We achieved our highest score the time of our 4th submission, which the lowest number of submissions in the competition (the winner of the competition performed nearly 60 submissions). All results reflect the private scores obtained by each vision transformer model.
Additionally to the experiments on Cross ViT-18t, we also evaluate the brain-scores on vanilla Vision transformers that be seen in Table
18

---

Under review as a conference paper at ICLR 2023
Model
II
Behavior
CrosViT-188
bldcs Nockk.. A.noml
blocks. blocks. drseml
boock..Ibloeke Dunorml
blocks.1 1 L.bckka 4.nomm
2iooks.2.reverr, proje
blocks. Lmipact
3atti. pro)
3norm.
pec_logats
VIT-//66
Imlpast
blocks Jalln pallin
blocks 3normz
norm
lopiis
VIT-2/12
Bickss Impoa
blocks Monorml
Bioks.2
bicks monmnm
peo. logii
bocks, Lolp..t
poo_logits
VIT-R/32
Lmipact
blecis
blocks,
Table 8: Layers selected for each brain region on each vision transformer.
ImageNe((1)
Brain- (coin-)
Description
Validation Acc. (%)
Avg
VI
V2
V4
IT
Behavior
VIT-S/16
81.40
0.445
0.527
0.295
0,454
0.449
0.498
ViT-S/32
75.99
0.415
0.531
0.271
0.422
0.423
0.426
VIT-B/16
84,53
0.451
0.522
0.317
0.398
0.487
0.529
ViT-B/32
80.72
0.440
0.553
0.311
0,413
0.418
0.505
ViT-S/16 (Adv Rot)
50.44
0.443
0.506
0.332
0.470
0.496
0.409
VIT-S/32 (Adv Rot)
55.20
0.457
0.512
0.347
0,433
0.485
0.508
ViT-B/16 (Adv Rot)
67.25
0.486
0.536
0.332
0.470
0.496
0.598
VIT-B/32 (Adv Rot)
53.01
0.457
0.524
0.357
0.417
0.472
0.515
Table 9: ImageNet accuracy. Brain-Scores of each brain area & Behavior benchmark evaluated on vanilla vision transformers. The spearman rank correlation between the validation accuracy and the average Brain-Score is -0.28 suggesting inverse correlation between clean ImageNet accuracy and Brain-Score (Schrimpf et al. 2020a).
E IMAGE SYNTHESIS EXPERIMENTS
E.1 STANDARD & ROBUST STIMULI
We used publicly available transformer models from timm library which were trained adversarially (c= 2c=2/255 and step size 1.25) as in (Wong et al. (2000) coupled with of hard rotation462 transformations (0%, 90º, 180", 270%) as proposed in this paper. In order to synthesize the standard and robust images, used the penultimate layer (norm layer) in all of vision transformer models except in the case of the Cross versions which we used the penultimate layer of the largest branch for all variations. Parameters used in these experiments can be seen in Table TO
Constraint
Step-size Iterations
12
1000
10000
Table 10: Parameters used for standard & robust stimuli by feature inversion
19


Reviews:
[{"review_id": "a3da4vcqsNB", "reviewer": "Reviewer_kkk2", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The authors challenge the common notion that transformer-like architecture is not particularly brain-like because, to the best of our neuroknowledge, the self-attention mechanism employed in transformers is not inspired by how the brain works. To that end they pick a few optimization constraints that in the past have shown to increase the Brain-Score (a metric that measures how close a certain ANN model's activity is close to brain activity is in representational space) and train a transformer architecture subject to all these constrains. And, as they discover, when trained like this, a transformer architecture is no worse that other ones, more \"bioplausible\" artificial models of vision and it scores even higher than some architectures that were manually crafted to be brain-like.\n", "summary_of_the_review": "This is an interesting paper and a valuable contribution in that it should spark an important discussion on how should we go about assessing brain-likeness of an ANN architecture. To me the most important message from this paper is, as I've long suspected, that if you fiddle with any architecture long enough then you can make it score high on Brain-Score. We, as a community, should be much more careful when claiming brain-likeness based on Brain-Score, and this paper is an important voice in this discussion.\n\nThe paper is well-written, the experiments support the claims and those claims are important and/or novel.\n\nMy recommendation is to accept this work as I would definitely like to see it presented at the conference.\n\n\n------ UPDATE after having a joint call with other reviewers ------\n\nThe way I understood the main contribution of this work initially was to highlight that with enough effort one can make even a transformer-based architecture to score on brain-likeness test. The main claim of the paper as I saw it then appeared to me something like \"let's not put too much trust in such way of evaluating brain-likeness\".\n\nHowever, after reading the final version and looking at the text with the perspective other reviewers provided, I can see that this is not the main claim of the work and is a secondary message (or, it does not come out of the manuscript clearly enough). The main claim of the work becomes (as the title says) that with a certain set of add-ons a vision transformer scores high. And this, while still curious, to me does not constitute as important of a message as the one above might. In order to advance knowledge in NS this would need to have one step further, to establish a deeper connection between the evaluated add-ons and brain structure/function (and I think it was never the claim that this work advanced the knowledge in ML per se). Leaving us with a set of interesting observations, and the (surprising? or not?) outcome that it scores high on BrainScore.\n\nMy general recommendation is still to accept, but now with a score of 6 instead of 8 (there's no \"7\" available).", "strength_and_weaknesses": "The narrative of this work has an unfortunate break when the Section 3 starts: the first four pages very clearly outline the premises and ideas of the authors and the scientific question emerges (being something like \"can transformers score high and what would it take and what that would mean\"). In Section 2 the main answer is given -- the fact that properly \"motivated\" transformer scores high on Brain-Score. But the the transition to Section 3 is unclear, it makes the reader feel that Section 3 is where the main results is, while actually Section 3 is a collection of \"optional\" observations. I would recommend to explain *why* you are now going to \"explore how different variations of such CrossViT’s change as a function of their training procedure\" and in each of those sections bring forward what does this analysis do for the main claim of the paper or how does it contribute to the \"brain-likeness discussion\".\n\nCurrently some of the points you make in Section 3 are dangling unconnected to the rest. For example model's ability or inability to classify between 2 classes in original vs texform space. Why is that relevant? Do we (humans) really use texture-like cues to perform object recognition without the need for shapes? I would disagree with that already on the bases of my personal experience -- looking at Figure 6, panel 0, texform insect -- without context I would have never classified that as an insect? I think we (humans) do need the shape quite a lot. So the fact that one model can perform well on textures while another cannot does not convince in that model's brain-likeness.\n\nSection 3.3 feels even more disconnected from the whole brain discussion. It basically just states that transformers have stronger reliance on shape information. Ok, it's a cool fact to know, but how does that connect to the topic of the paper? And how does this finding relate to the one presented in 3.2 where the whole point was somewhat the opposite -- that high Brain-Scoring model can work well in texture-form?\n\nTaken together sections 3.1 to 3.3 take the reader away from the main conversation and into some vague and as it seems irrelevant observations that blur the excitement and clarity of the message in Section 2.\n\nAddressing this broken narrative I think will do a great service to bring forward the numerous strengths of this paper:\n- clear and bold scientific question\n- logical exploration and experimental work to find the answer\n- important message for the bioplausible vision community\n- clear language", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "TnfVJmVhkp", "reviewer": "Reviewer_84qC", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This work shows that a vision transformer (ViT) model is able to achieve higher brain score (i.e. performance at predicting electrophysiology recordings of primates viewing images) than a more \"biologically-plausible\" alternative (a convolutional neural network + a frontal V1-like module), specifically when the ViT is trained with specific training objectives: invariance to rotation and adversarial training. The authors show that each one of these objectives individually contributes to the improvement in brain score. Additionally, this work makes some attempts to study how the representations of the well-performing ViT model change as a function of their training procedure.", "summary_of_the_review": "While this work investigates an important and timely question of why transformer-based models are so good at predicting brain recordings, it can be significantly improved along several dimensions w.r.t. the motivation of the completed analyses and the significance of the finding, and the relation to other work in this area. In its current form, I do not believe it is ready for publication in a top-tier ML venue. ", "strength_and_weaknesses": "Strengths:\n- investigates a timely question of why transformers are so good at predicting brain recordings\n- careful evaluation of the effect of training procedure on the model representations \n\nWeaknesses:\n1. Unclear motivation for the specific investigations of the model representations, which also makes it difficult to know what to takeaway from these investigations. Why were these specific investigations chosen, and what did the authors hope to learn from each of them?\n2. There is also a need to position this work more clearly with respect to the related literature. What aspects of this model are entirely new with respect to evaluating the brain score? Even if the combination of all components is novel (ViT + rotational invariance + adversarial training), were certain components previously investigated and what is the new takeaway from the current work? Also have previous works investigated the effect of these training procedures on model representations?\n3. There are several points in the manuscript where the writing is difficult to follow and/or the claims are not supported by the evidence provided. A few examples: \n- \"interesting question that was one of the motivations of our paper: \"Are Vision Transformers good models of the human ventral stream?\" (how did you plan to answer this question by looking at data from non-human primates?)\n- \"if we find that a specific model yields high Brain-Scores, this may suggest that such a flavor of ViT-based models obey a necessary but not sufficient condition of biological plausibility\" (I do not follow this logic. Perhaps you can conclude something about a sufficient condition, but I do not see anything in the experiments in this work that can suggest a necessary condition for brain alignment) \n- \"we observed that each step independently helps to improve the overall Brain-Score\" (the observation is that each step contributes individually. The authors have not shown that the contributions are independent of each other\n- Fig 3 caption: \"As the average Brain-Score increases in our system, the distortions seem to fool a human as well.\" (is this statement based on actual human experiments or the authors' own feelings?)\n- \"Is this new excel in performance due to their..\" (excel is a verb and not a noun) \n- \"their use has been carefully limited as a model of visual computation\" (what does carefully limited mean?)\n4. Some of the figures are illegible (Fig 1 and 2)", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "OGZHa8ZqUb", "reviewer": "Reviewer_ywsh", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The paper presents a dual-stream transformer architecture using CrossViT of [Chen et al. 2021], trained under a joint adversarial training objective with rotation invariance (imposed by hard rotation-based data augmentation), that achieved the second place in the BrainScore 2022 competition. Authors discuss in depth their optimization design choices empirically to illustrate how their ViT model could achieve high explainable variances in various competition metrics as an analogous model to the biological visual stream. Several ablation experiments with respect to the proposed joint optimization scheme are performed with the same CrossViT backbone, as well as comparisons with vanilla ViT models under the same training objectives.", "summary_of_the_review": "I think the paper explores a very interesting problem in depth and demonstrates significant insights as to how simple adversarial training, data augmentation, and vision transformers could be combined to achieve high similarity to the biological visual stream in several metrics of the Brain-Score Competition. However I still believe the paper is not sufficiently strong at this venue without any independent novel methodological contribution. I have some specific questions to the authors summarized below:\n- Explorations on adversarial training and robustness from Section 3.1: It would be reasonable to see the model thrive in more than the Brain-Score competition ranking, when it comes to claims on better adversarial robustness. For instance, to extend simpler PGD-type evaluations in Figure 5, authors could perform evaluations on AutoAttack and demonstrate how their adversarially trained CrossViT ranks in the Robustbench ImageNet category?\n- In a similar vein, were there any explorations on the adversarial training pipeline (FAT, TRADES, standard AT etc.)? Can/did the authors explore alternative AT objectives for their model?\n- How does the adversarially trained VOneNet [Dapello et al. 2020] compare in Figure 5?\n- There have been a significant line of work on exploring adversarially trained vision transformers' generalization capabilities. Can the authors compare their baseline model with some of those?\n- Authors' explorations in Supplementary Section B.1& B.2 are of major importance to the rest of the manuscript, even though the results look unsatisfactory. Their proposed optimization approach significantly hinders out-of-distribution generalization capability of CrossViT under common corruptions (even much lower than the ResNet-50 baseline). A discussion on this should be present in the main manuscript.\n- Minor comment: Figure 8(a) legend is blocking the main results in the plot.", "strength_and_weaknesses": "Strength: The manuscript is written clearly and in an understandable fashion. It achieves SOTA results in several categories at the time of their Brain-Score competition submission, and empirical ablations support their results.\n\nWeaknesses: Currently the paper is restricted to explaining a set of experiments performed in the context of the competition, which appear to be outperformed to date. From a deep learning perspective, the methodological contribution is low since there is no clear architectural or algorithmic novelty proposed. This appears to be the main limitation in my opinion.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "KZO4gV-lEf", "reviewer": "Reviewer_2i2E", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The authors test a neural network (NN) architecture based on vision transformers on the brain-score competition. When using adversarial training (gradient attack) and rotated data augmentation, the NN reaches state of the art performance for area V4. In contrast with other best performing models, their model is getting better and better at predicting higher visual area. Then, the authors assess the variation of training to highlight that robustness probably explains the performance ranking of the different training methods. They also draw a parallel peripheral vision to explain specifically the good performance in area V4 and show that their model is invertible. Finally, a last comparison is done against classical vision transformers.", "summary_of_the_review": "Sadly, the brain-score competition is not part of a conference with proceedings... This would be where this paper belongs to.\nI am inclined to accept this paper once the authors have accounted for my comments.", "strength_and_weaknesses": "Strength:\n- high performance of vision transformer for predicting neural activity (brain score competition),\n- using an architecture that incorporate biologically plausible features (multiscale, invariance, texture features),\n- an attempt to explain the performances (robustness, texture-like computation, invertibility),\n- include models comparison \n\nWeaknesses:\n- the fact that targeted attacks result in stimuli that are perceptually aligned with human judgement is not supported by any perceptual experiment", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "1: The contributions are neither significant nor novel.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}]

Author rebuttal:

Decision: Reject