Spatial-frequency channels, shape bias, and adversarial robustness
Authors: Ajay Subramanian
Elena Sizikova
Najib J. Majaj
Denis G. Pelli
Venue: NeurIPS 2023 oral (2023)
Keywords: object recognition
critical band masking
spatial-frequency channels
shape bias
adversarial robustness
TL;DR: Critical band masking, a tool from neuroscience, reveals a large difference in the spatial frequency information used by humans and neural networks to recognize objects in natural images.

Abstract: What spatial frequency information do humans and neural networks use to recognize objects? In neuroscience, critical band masking is an established tool that can reveal the frequency-selective filters used for object recognition. Critical band masking measures the sensitivity of recognition performance to noise added at each spatial frequency. Existing critical band masking studies show that humans recognize periodic patterns (gratings) and letters by means of a spatial-frequency filter (or "channel") that has a frequency bandwidth of one octave (doubling of frequency). Here, we introduce critical band masking as a task for network-human comparison and test 14 humans and 76 neural networks on 16-way ImageNet categorization in the presence of narrowband noise. We find that humans recognize objects in natural images using the same one-octave-wide channel that they use for letters and gratings, making it a canonical feature of human object recognition. Unlike humans, the neural network channel is very broad, 2-4 times wider than the human channel. This means that the network channel extends to frequencies higher and lower than those that humans are sensitive to. Thus, noise at those frequencies will impair network performance and spare human performance. Adversarial and augmented-image training are commonly used to increase network robustness and shape bias. Does this training align network and human object recognition channels? Three network channel properties (bandwidth, center frequency, peak noise sensitivity) correlate strongly with shape bias (51% variance explained) and robustness of adversarially-trained networks (66% variance explained). Adversarial training increases robustness but expands the channel bandwidth even further beyond the human bandwidth. Thus, critical band masking reveals that the network channel is more than twice as wide as the human channel, and that adversarial training only makes it worse. Networks with narrower channels might be more robust.

Spatial-frequency channels, shape bias, and adversarial robustness
Ajay Subramanian New York University as15003enyu. edu
Elena Sizikova New York University es52238nyu. edu
Najib Majaj New York University maj.jjnuu..aa..aaammmmma
jaj @nyu. edu
Denis G. Pelli New York University denis denis.pellie wwwppeellllleeeeeeeeeeeppppeelle
Abstract
What spatial frequency information do humans and neural networks use to recog- nize objects? In neuroscience, critical band musking is an established tool that can reveal the frequency-selective filters used for object recognition. Critical band masking measures the sensitivity of recognition performance to noise added at each spatial frequency. Existing critical band masking studies show that humans recognize periodic patterns (gratings) and letters by means of a filter (or "channel") that has a frequency bandwidth of one octave (doubling frequency). Here, we introduce critical band masking as task for network-human comparison and test 14 humans and 76 neural networks on 16-way ImageNet categorization in the presence of narrowband noise. We find that humans recognize objects natural images using the same one-octave-wide channel that they use for letters and gratings, making it canonical feature of human object recognition. Unlike humans, the neural network channel is very broad, 2-4 times wider than the human channel. This means that the network channel extends frequencies higher and lower than those that humans are sensitive to. Thus, noise at those frequencies will impair network performance and spare human performance. Adversarial and augmented-image training are commonly used to increase network robustness and shape bias. Does this training align network and human object recognition channels? Three network channel properties (bandwidth, center frequency, peak noise sensitivity) correlate strongly with shape bias (51% variance explained) and robustness of udversarially-trainn trained networks (66% variance explained). Adversar- ial training increases robustness but expands the channel bandwidth even further beyond the human bandwidth. Thus, critical band masking reveals that the network channel more than twice as wide as the human channel, and that adversarial training only makes it worse. Networks with narrower channels might be more robust.
Introduction
The world can be visually perceived at many possible resolutions. It contains large and tiny objects, with coarse and fine features, so viewing it at different resolutions amplifies different features. Everyday human activities like reading, driving, and social interaction rely heavily our ability to recognize objects. While doing so, what resolutions do we "see" the world in? Answering this question will help understand what features are useful for object recognition.
37th Conference on Neural Information Processing Systems (NcurIPS 2023).

---

18:35
0.0
Noise standard deviation
0.02
0.04
0.08
0.16
1.75
7.0
14.0 28.0
56.0
112.0
Spatial frequency of noise (cycles/image)
Figure 1: Demo: Critical band masking reveals the spatial frequency channel used for object recognition. Each cell in the grid contains sample grayscale, contrast-reduced (20%) image from ImageNet (5), perturbed with Gaussian noise of standard deviation a E {0, 0.02, 0.04, 0.08, 0.16} and filtered within one-octave-wide (doubling of frequency) spatial frequency bands centered at foenter E {1.75, 3.5, 7.0, 14.0, 28.0, 56.0, 112.0} cycles/image. Standard deviation of added noise increases from top to bottom, and spatial frequency increases from left right (with constant power). Measure how far down each column you can go before being unable to recognize the object in the image. These thresholds measured across columns should trace out an inverted- inverted-U-shappe U-shaped curve, typically centered at 28-56 cycles/image, This curve describes how much noise added at each spatial frequency limits your recognition performance, or other words, what spatial frequency information in the image most rely on for recognition, i.e., your "channel".
Formally, this question has been studied by examining how the brain filters visual stimuli. The visual system detects periodic patterns or gratings by means of parallel visual filters, each tuned to band of spatial frequency [I]. Experiments by Solomon & Pelli (2). and later by Majaj et al. [3], showed that letter recognition across a wide-range of stimulus conditions (alphabets, fonts, sizes, low- and high-pass noise) is mediated by the same single, narrow (1-octave-wide visual filter, which they called a "channel".
However, unlike letters and gratings, the real-world contains objects and features of various sizes, so we would expect people to make use a wider band of spatial frequency in their recognition. Using critical band masking task, first developed by Fletcher to identify auditory channels [4, and later used by Solomon & Pelli to find letter-recognition channels [2), we find that surprisingly, this is not the case. People use the same channel while performing 16-way ImageNet recognition [5), making a canonical feature of human object recognition.
This raises the question, what spatial frequencies do nert--- systems use, and how do they compare the human channel? Given that these networks are infamously susceptible to high-frequency adversarial perturbations, we hypothesize that their channel must be unlike the human channel. Testing neural-network-beee ImageNet recognition task as above, we find that this is true, across various architectures and training strategies. The neural network channel in the networks we tested least twice wide as the human channel.
object recognition
recognizers with the same 16-way

---

We then ask if this large, systematic difference between humans and networks could explain two important and well-documented points of divergence in their behavior: adversarial robustness and texture-vs-shape bias. It is well known in the machine learning literature that computer vision systems are highly-susceptible to targeted noise, known as adversarial perturbation, that is often imperceptible to human observers [6]. Additionally, convolutional networks primarily rely on texture information when recognizing images 77-) whereas transformer- based networks and humans rely on shape (9 [0]. We show here that the spatial frequency channel provides a helpful way of looking at these issues. Wang et al. M found that adversarial perturbations generally contain most of their power at high spatial frequencies. Moreover, Lieber at al. [2] showed that people use higher spatial frequencies while discriminating texture patches. We find that properties of the network channel correlate strongly with shape bias and the robustness of adversarially -arraiiiill-ttiieeddd networks, albeit in the wrong direction - adversarial training makes the networks'
less human-like.
To summarize our contributions:
1. We introduce critical band masking as a task for network-human comparison. We present data from 14 humans and 76 neural networks performing 16-way ImageNet categorization in the presence of narrowband noise.
2. Using our data, we characterize, for the first time, the spatial frequency channel used for natural object recognition by humans and networks. Humans use the same narrow, one-octave-wide channel for objects, letters, and gratings 3 Thus, this channel is a canonical feature of human object recognition. The neural network channel, across architectures and training procedures is more than twice as wide as the human channel.
3. We show that three channel properties (bandwidth, center frequency, peak noise sensitivity) correlate strongly with shape bias and robustness of adversarially-trainn well-documented human-vs-netword differences may be rooted in differences between their frequecy channel. Adversarial training increases robustness at the cost of widening the already-too-wind network channel.
networks. Thus, these
Our human and network datasets as well as code required to reproduce our experiments are available publicly at hhttss::/githeee cwt../ccoaaaaaoo.om httpaaaaa///rrrriaaalllaaaaaaaaa band-aasl---
2 Related work
Spatial-frequency channels. The visual system detects periodic patterns or gratings by means of parallel visual filters, each tuned to a band of spatial frequency [.. Critical band masking studies [ revealed that the same single, narrow filter also mediates the recognition of letters 22 [3] faces, and novel shapes [1]. Artificial neural networks also have frequency-
preferences. They are biased towards learning newffreqenccy functions (15) and prone shorteut learning in both spatial
and frequency domains [16] [7]. Existing work also suggests that robustness of a network is related its spatial-frequency preferences
(1)
Shape bias. Humans are well known to rely mainly on shape features for lexical learning and pretrained convolutional networks, the other hand, biased towards texture 22 223 Even though SaageNet-pretraiigg
object recognition tasks [10 77. preteene--retrainedd
transformers, like humans, are chape-biased (9. texture- shase bias of networks is thought to be influenced mainly by training data and its augmentations rather than network architecture [8].
Adversarial robustness. Adversarial attacks are small perturbations that cause inputs to be misclas- sified 6 224 Although these perturbations are often imperceptible to humans, humans can in some cases decipher adversarial examples 25) Recent work suggests that ad robustness of networks relates to their spatial frequency tuning (28
29].
Comparing human and neural network vision. The origins of deep learning are strongly tied to neuroscience (30) and the modern convolutional network architecture was inspired by properties of primate visual cortex [II. More recently, there have been parallel efforts both to use neural networks to improve models of visual neuroscience (32-54] and to improve network robustness by
taking inspiration from the human visual system [35] These lines of work strongly rely on recent advancements in model-human comparison metrics which compare networks and humans across
behavior [36]]] 37 and neural representations [4 38
3

---

3 Methods
3.1 Critical band masking
Solomon & Pelli developed a critical band masking task (based on Fletcher's auditory masking paradigm [4] to find the human opatial-frequenee channel for letter recognition [2]. We adapted their task to find the channel used by 14 human and 76 neural network observers to recognize objects in naturalistic images. The idea behind the task is as follows. Grayscale ImageNet images were converted to low-contrast (20%) and perturbed with Gaussian noise that was filtered within various ppatial-frrquene bands. Threshold contrasts for 50% categorization accuracy measured independently for each frequenyy condition trace out a curve that describes how sensitive human letter recognition is to noise at each spatial frequency.. Bands that have high noise-sensitivity are more useful for recognition because blocking them with noise severely impairs performance. In this way, critical band masking reveals the ppaiil-frequeng: channel useful for object recognition. Fig. Tillustrates this idea using demo.
Images. In all our experiments, human observers recognized objects images from ImageNet (5), popular dataset for neural network analysis. Since memorizing all 1000 categories of the original ImageNet is intractable for human observers, we used 16-class ImageNet [22]. a subset which, using the WordNet hierarchy [39, is labeled according to 16 higher-level categories: airplane, bear, bicycle, bird, boat, bottle, car, cat, chair, clock, dog, elephant, keyboard, knife, oven, and truck. Due to constraints on experiment length, we used a fixed set of 110 randomly sampled images for all experiments, that were roughly equally distributed across all 16 categories.
Preprocessing. Images were first resized to 256 x 256 and center-cropped to 224 x 224 (the standard protocol while handling ImageNet images) (Fig. ( before being converted to grayscale because noise, which we will add, is ill-defined for color images. Then, they were reduced to 20% of their original contrast to ensure that adding high-strength noise would not result in pixel-clipping at floor/ceiling values which would result in the effective added noise being non-Gaussian. Fig 2 shows sample images after these transformations.
Noise generation and masking. To the preprocessed images, we added Gaussian noise of strengths (standard deviations) (0.0, 0.02, 0.04, 0.08, 0.16), filtered into 7 octave wide (doubling of frequency) spatial-frequend corresponding to the seven successive levels of laplacian pyramid [4)] This gives
bands (centered at 1.75, 3.5, 7.0, 14.0, 28.0, 56.0, 128.0 cycles/image)
total of 29
distinct noise conditions: 4 non-zero strengths x 7 spatial frequencies + zero strength (Fig. (22). Both strength and spatial-frequency were sampled uniformly random such that the 1 1100 images in our dataset were roughly equally distributed across both the noise conditions (combination of strength and spatial frequency; s:31 images per condition) and categories (2=68 images per category). Fig. images from our experiment for all 29 conditions as a demo. By following the instructions in the figure's 's caption, you should be able to see an -eeerted-U-shapee boundary between images you can and cannot recognize, peaking at 28-56 cycles/image, which represents your channel for object recognition.
(smaller version in Fig. 2 shows sample
3.2 Human psychophysies
14 human observers performed 16-way recognition of the moise-masked images for 1100 trials, divided into one training block of 50 trials and five test blocks of 210 trials. In each trial, the observer was first presented with a blank screen with a "+" at the center, which they were instructed to click to proceed. This ensured fixation at the center of the image the start of presentation. Upon clicking, a randomly sampled image from our dataset was presented at the center of the screen (with a gray background) along with 16 buttons below it, representing the various categories (Fig. 2D). The observer was given unlimited time to identify the category of the image and click on the corresponding button. In training block trials, they would then see feedback on their response i.c., "correct" if they were right and "incorrect" along with the correct category if they were wrong. No feedback was given on test block trials (for screenshots of task, see Supplementary Material). We developed the study using LabJS [Л], hosted it on JATOS 42), and recruited participants via Amazon Mechanical Turk. The experiment lasted roughly an hour and participants were paid $20 for their efforts. A standard apB-appr (IBB-FY0016-404) consent form was signed by each observer, and demographic information was collected. All observers had either normal or corrected-to -ooeeedd------mall vision. Data of observers who scored below 50% on the no-n condition (0 strength, any ppatial-frequencyy

---

images imageleet
Imagen after
B2. Gauazian nake at strenpite (yass) Iitared
maae--mskedd imsges
Sports eequercy hole thys sctmayy)
Spuzia hequercy mode lyyc
bear
Center frequarey
und
0.02
bost
60
0.04
For
OR
0.08
40
diock
dispart
0.16
kni's
to The OL Sputial trecueecyy (erlestmrgge spatisi
155
56
Spulia
thrnhhald 5D for 50% accumay, and Couueban fanction to votain spatial frequency chared
Accuracs (% correct enaluandd for eash ncése oondition
Observer performes 16 cotegorization of moniso masked imaiees (0)
Figure 2: Critical band masking stimuli, task and analysis. A. 224 x 224 RGB images from ImageNet
[5]. B1. Images after grayscale-come scale-conversion and contrast reduction to 20%. B2. 224 x 224 Gaussian noise of 5 standard deviations (SDs), bandpass-filtes filtered within one-octave- spatial frequency (SF) bands centered at 7 values. This gives us total of 29 distinct noise conditions (4 non-zero SDD x 7 SFs+ for 0 SD). C. Images in B1 + noise in B2 gives us sample noise-maske images for each noise condition. Our experiment used 34 different images for each condition. We show only one per condition here for the purpose of visualization. D. In our experiment, human and neural network observers attempt to categorize 1200 noise-masked images into 16 high-level object categories [22]. E. Heatmap showing % correct of a sample observer separately for each noise condition. F. For each spatial-frequee frequency condition, threshold noise SD for 50% accuracy is computed (black points), and Gaussian function is fit to obtain the observer's 's channel. This function is parameterized by center frequency (maroon), bandwidth in octaves (log full- width-hatthh-f-tie sensitivity (reciprocal of channel height at center frequency; orange). Noise filtered to conditions within the channel prevents recognition, and noise filtered to conditions outside the channel does not.
distance; green), and peak noise
was discarded. Generally, researchers using online experiments recruit more than 100 participants. However, in our case, 14 was sufficient because we observed very small individual differences across participants (see Supplementary Material).
3.3 Neural network evaluation
We tested 76 pretrained neural networks on the same task that we used to test humans: 16-way categorization of noise-masked images from our critical band masking dataset (Fig. 2D). Networks and their pretrained weights were sourced primarily from PyTorch's 's torchvision library [43 and
Geirhos et al.'s modelvshuman benchmark (36). These networks spanned various architectures and training procedures (ImageNet-trained CNNs [43, self-supervised models 44 Big Transfer models [50], adversarially-trained models (51). vision transformers [52] (53,, semi-weakly supervised models (54), Noisy Student [55], and VOneNet (35) and hence, are large, representative sample of the state of the art networks from deep learning literature. For a full list of the networks we tested, and the color coding used in figures, see Supplementary Material, and for network details, see (36). We do not include the color codes in the main paper because with the exception of blue being used to represent ad adversarially -trinee models, network-type is irrelevant to our analyses, i.c., our results apply to all networks unless specified. By default, all networks accepted 224 x 224 images, and output probabilities for all 1000 original Imagenet categories. Images were normalized to ImageNet pixel mean and variance before being input to the network, to respect training data statistics. Experiments run without normalization yielded very few networks (only 20 of 76) that performed above-threshold (>50% accuracy) even the zero-noise condition. The probability of each coarse 16-class ImageNet category was computed as the average of the probabilities of the corresponding fine (1000-class ImageNet) categories (Supplementary Material of 22 justifies this choice). For each input image, the 16-class category with top- probabiitty was selected as the network's 's response
5

---

and network accuracy ppereent-correet was calculated separately for each of the 29 noise conditions
(strength, frequency combinations).
3.4 Metrics
Having collected data from humans and neural networks on our critical band masking task, we
move to analysis. Accuracies (% correct for 16-way categorization) of cach human observer and neural network were computed independently for each noise condition in our experiment. Fig. 2 summarizes this metric as a sample heatmap (in this case, for a sample human observer). Each cell in the heatmap represents a single noise condition (combination of standard deviation (SD) and spatial frequency; cell in Figs. [C) and its color, the categorization accuracy of the observer on that condition. For all analyses henceforth, we average across human participants because the cross-observer variance was very small (see Supplementary Material).
Channel properties: center frequency, bandwidth, and peak noise sensitivity. Next, we use the heatmap to estimate the observer's spatial frequency channel. The threshold noise strength (SD) for 50% accuracy was computed separately for each of the seven spatial frequency bands (column the heatmap). These thresholds, depicted as black points in Fig. F are measurement of noise sensitivity i.e., how much noise of each spatial frequency has to be added for the observer's s accuracy to drop to 50%. Fitting Gaussian function then yields a curve that captures the noise sensitivity of recognition across spatial frequency bands. This curve is a suitable representation for the spatial frequency channel because captures the importance of each spatial frequency band in the image for recognition by measuring how noise added to each band affects performance. The Gaussian function has been used extensively to describe frrfuncyy tuning in the brain (3] and also yields good fits across all human and network data (see Supplementary Material).
Figure 3: A sample cue-conflict image from Geirhos et al's dataset that has cat's shape and an elephant's 's texture. Source: [7).
The fitting procedure is as follows. The threshold values computed earlier are first mapped to linear indices ({> 0.16, 0.16, 0.08, 0.04, 0.02] +
())
having 3 param- eters: peak height (A), mean (1)), and standard deviation (α) is then fit to the thresholds. These fitted parameters then used to calculate three properties that characterize the channel: bandwidth in octaves (log full-width at half-mar max 20 2/n 4), center frequency (frequency for peak noise sensitivity 1.75 x 24), and peak noise sensitivity (scaled reciprocal of channel height 24-1). An octave is doubling of frequency. Fig. 2 illustrates the rescaled Gaussian channel (black curve) and its three parameters (orange, maroon, green) for sample observer, along with formulae to calculate the three channel properties.
(0, 2, 4}). A Gaussian function fxx = Ae 20
Shape bias. In a later section, we study how the above-derived channel properties correlate with two important and well-documented behavioral differences between humans and neural networks. The first of these is texture-vs- shappe bias which measures how much an observer relies on texture vs shape cues for object recognition. Empirically, Geirhos et al. ? measured an observer's shape bias by examining their response during a task that involved 16-way categorization (same categories that we use) of cue-conflict images. These images contain shape information from one category and texture information from another (e-g., a cat with an elephant's texture; Fig. 3 They defined shape bias as the fraction of images in their dataset categorized by an observer according to the shape category, and measured human shape bias as 0.99, meaning they categorize almost 100% of the images by shape. For all our shape bias analyses, we used cue-conflict images from their dataset measure the shape bias of all 76 networks. All shape bias scores were averaged across object categories to obtain a single number for each network. Additionally, we use their measurement of human shape bias (0.99) because it is reliable and replicable [36].
Adversarial robustness (whitebox accuracy). Adversarial robustness of a neural network measures how resistant it is to adversarial attacks, stimulus perturbations generated specifically to fool the network. To measure robustness of our networks, we generated adversarial perturbations for 1000 images (each belonging to a different category) from the ImageNet validation dataset using projected gradient descent (PGD; Loo 0.1, max. iterations 32), and measured the network's 's accuracy

---

in classifying those images. In our analysis, we use this measure, whitebox accuracy, computed using the PGD implementation from the Adversarial Robustness Toolbox [56]. Additionally, as comparison, we also measured the accuracy of all networks on 1000-way classification of all 50,000 available unperturbed ImageNet validation set images.
Results
4.1
Humans recognize objects natural images using the same spatial frequencies that they use for letters and gratings.
The classic one-octave-wide spatial frequency band has appeared frequently human psychophysics literature, as the channel for grating detection [Σ. and letter recognition 2 across various stimulus conditions (alphabets, fonts, sizes, low- and high-pass noise) [3]. It is surprising result that of all the spatial frequency information available in the stimulus, the visual system would rely such narrow band for recognition. However, letters and gratings are largely homogeneous objects, and is not obvious that those results will generalize well the recognition of diverse, heterogeneous, noisy objects in the real world. From our critical band masking analyses, we report a surprising result. Humans use the same narrow, one-octave-wine wide spatial frequency band recognize objects in natural images that they use for letter and grating recognition, making this channel a canonical feature of human object recognition.
Fig. 4 we show accuracy heatmaps of humans for the various noise conditions averaged across observers (A, left), and a Gaussian channel fit to thresholds from this heatmap (B, black curve). The bandwidth (see 3.4) of the human channel is 1.00 octave, consistent with previous measurements of 1-2 octaves for grating/sinusoid detection [57] and 1.6 + 0.7 octaves for letter recognition 3
(averaged)
N Nunare 16;; Namara-76
0.02
4.22
% correct
0.
0.66
0.36
Spatial frequlincy of nolse moyclls/mmage
Spatial Fracuency of noise lcycles/maage)
Figure 4: Results of 14 humans and 76 neural networks on critical band masking task. A. Heatmaps showing % correct of humans (averaged across 14 observers given strong cross-observer consistency, see Supplementary Material for individual heatmaps) and ResNet-50, an example network. B. Threshold noise SD 50% correct (points; jittered by 5% range for visualization) and Gaussian fit i.c. channel, of human (averaged; black curve) and all 76 tested networks (all other colors).
4.2 The neural network channel 2-4 times as wide as the human channel.
Having seen the same channel in humans across variety of stimuli and stimulus conditions, natural next question is: how about neural-network based object recognition systems? On repeating the same critical band masking experiment and analyses for a sample network ResNet-50 shown in Fig. 4A, right), we plot the channel for networks alongside the human one in Fig. 4B. We observe that the network channel, across the various architectures and training procedures used in our set, is x2-4 times as wide as the human channel (1.00 octaves), ranging from 2.30 (ViT-B) to 5.98 (resnet50-12-eps).
set of 76 neural networks (accuracy heatmap
adversarially-trainee network). In other words, neural networks are susceptible to noise at both high and low spatial frequencies that doesn't tt affect human performance.
4.3 Channel properties correlate strongly with shape bias, and with robustness adversarially-traine networks.
We then ask this stark difference between the spatial frequencies networks and humans use for recognition correlates with two other important and well-documented differences in human and
7

---

network behavior shape bias and adversarial robustness. Humans are well-known to rely primarily on shape cues for object recognition and other visual tasks [0] 71. Neural networks, on the other hand, show a lot of variance convolutional networks use texture cues 7 g while other architectures such as transformers are shape-biased g 588. Likewise, neural networks are generally strongly sensitive to tiny perturbations to their input that might be imperceptible to humans, called adversarial perturbations [6]. Fig. plots each property of the spatial frequency channel against shape bias and whitebox accuracy (see 3.4 for metric details), along with line-fits (only significant fits with p < 0.05/15 18 (Bonferroni-correctdd] shown).
Beal all network points
adivessrially--ee -rriiii nelwork non-ecversariall--nee network points
Only signilicant (p 0.05/1 shown each figure.
A.
1.0
0.8
Shape bias
0.6
0.4
0.10.1
R
RC=0.29
0.2
0.0
40
50
2
22
2-1
1.0
Whitebox accuracy
0.8
0.6
RR=0.48
0.4
RF=0.30
0.2
0.0
30
40 50
2
2-1
2a
Center frequency (c/image) Bandwidth (octaves)
Peak noise sensitivity
Figure 5: Relationship between network channel properties (center frequency, bandwidth, peak noise sensitivity), shape bias and adversarial robustness. Each figure plots one channel property against either shape bias or adversarial robustness (whitebox accuracy). for all networks represented by colored points. Adversarially-train intensity of blue (light to dark) corresponds to increasing L2-adversarial robustness (i.e.. stronger adversarial training). 3 regression lines were fit in each figure to all network points (gray-dotted line), to only adversarially-trained networks (blue-dotted line), to all non--dversariilly--riinn (crimson-dotted line) and only those with p < 0.05/ 405/18 18 (Bonferroni-coreccte bias figures, the black star represents the human average (shape bias value taken from (36)). The three channel properties together explain 51 % of variance in shape bias of all networks, and 66% of networks.
networks are represented by blue-colored points and increasing
networks are shown. In shape
variance in whitebox accuracy across adversarially-train
Networks show a large range of shape bias scores. Although most are clustered around 0-1.0.2 (10-20% of cue-conflict images categorized by shape), few classes of networks are more strongly shape biased: ViTs (green, violet-red). scaled-up CNNs (BiTs in purple, Noisy Student in dark gray). Channel bandwidth strongly accounts for these differences, single-handedly explaining 29% of the variance, with a slope of -0.22 + 0.04. Networks with a smaller channel bandwidth are more shape biased. This trend is also supported by the human result (black star in middle panel of Fig, (5A). Humans are the most shape biased and have the smallest bandwidth. Center frequency and peak noise sensitivity also account for some of the variance: a linear model with center frequency, bandwidth and peak noise sensitivity accounts for 51% of the gross-network variance in shape bias, which is surprising given that shape is often thought to be complex feature of objects.
When we look at how well channel properties account for variance in whitebox accuracy (adversarial robustness), we see such pattern (Fig. 5B) Of the three, only noise sensitivity shows significant
8

---

fit (gray dotted line in rightmost plot in Fig. 5B). However, in these plots, we see some interesting patterns when we separately consider adversarially- trained networks (blue-colored points of any shade) and other networks. Increasing intensity of blue represents the same network architecture (ResNet-50) subjected to increasing amounts of adversarial training to yield a monotonic rise in their measured I.2-adversarial robustness (c E {0, 0.01, 0.03, 0.05, 0.1, 0.25, 0.5, 1,3, 1,3,5); 5); see [51] for details). Since these points clearly differ visually in our plots from other networks, we fit two more lines, one to only adversarially-trainee networks (dark blue, dotted), and the other to only the remaining (dark red, dotted). Interestingly, this yields strong fits for bandwidth and peak noise sensitivity cases. For adversarially- trained networks, the three channel properties together account for 66% of the cross-netwond variance in whitebox accuracy. Networks with higher bandwidth and higher peak seiiiisenstt are more adversarially robust.
As an aside, we suspect that the bimodal nature of white- box accuracy results is because unlike the case of shape bias, most networks we tested have poor adversarial ro- bustness, and hence lie on the flat portion of its psy- chometric function, while strongly adversarially-trained networks lie on the steep portion. Therefore, fitting lines to these two groups separately might be akin to fitting two lines to describe non-lineat psychometric function.
Charnel bandwichh Soiechhh (octaves)
Imagehiet accuracy
-0.6
Apourady (cconecc
Network bandwitth
-0.
Whitebox accuracy
-0.4
0.3
0.2
4.4 Adversarial training expands the channel further beyond the human bandwidth
0.1
Humen bendwidth
0.0
10
10-1
100
L2 12-adversarial robustness (e)
Embedded in correlational results above is impor- tant causal relationship. Given that the adversarially- trained networks test differ only in terms of the amount of adversarial training (measured using L2- robustness), we can analyze the effect that the amount of adversarial training has on channel properties. Firstly, as shown in Fig. 6 increasing L22rrbuutnness (e) corre- sponds to a monotonic increase in whitebox accuracy and a gradual decrease in ImageNet validation set accuracy. Secondly, we observe that as L2-robustness and whitcbox accuracy of adversarialll-traaiee trained networks increase, their bandwidth increases too, moving away from the human bandwidth. This means that networks that are more robust to adversarial attacks (according to both L2-robustness and whitebox accuracy) are in fact more sensitive to noise added in a larger set of spatial frequency bands that hu- mans are not sensitive to. Thus, adversarial training effect, makes them more susceptible to another kind of adversarial attack (filtered noise perturbation).
incressing adversorisl training
Figure 6: Effect of adversarial training on network channel bandwidth. ImageNet validation set accuracy (black square- dotted line), whitebox accuracy (black circle-solid line) of adversarially-trainel networks with increasing 1.2-robustness (increasing amount of adversarial train- ing), network channel bandwidth (green circle-solid line), and human bandwidth value (green dotted line). As robustness increases, whitebox accuracy improves at the cost of both ImageNet accuracy and expansion of the network bandwidth fur- ther beyond the human bandwidth.
Discussion
Having shown that neural network spatial-frequency channels diverge from the canonical one-octave- wide channel found in humans, we propose that critical band masking should be added to the toolbox of metrics for model-human comparison. Our dataset of 14 humans and 76 networks on 16-way categorization raises important questions about which spatial frequencies matter for object recognition.
Every one of the 76 networks we tested has a wide critical band. We tested all the networks from Geirhos et al. (36) which is the largest comparison of networks and humans on object recognition. That study included most of the popular network kinds, spanning a wide range of conditions: convolutional networks and transformers, shallow and deep networks, supervised and self-supervised training, standard and adversarially on a representative sample of popular network designs. More work is required to explore the effects of diverse kinds of training data and augmentation.
networks. Thus, the conclusions of this paper are based

---

When comparing biological vision and artificial neural networks, there are two questions to be asked: what can artificial networks learn from biology, and how can neural networks inform our understanding of biology (59 34 Needless to say, the origins of deep learning relied heavily on knowledge of biology [30]. But can biology impact the evolution of neural networks? Dapello et al. (35] showed that making the first layer's tuning match biological V1 tuning improves robustness. The critical band idea is central to understanding hearing and vision. Here we show that the critical bands, which are measure of tuning, are different between humans and networks, and that this difference strongly explains robustness (shape bias and adversarial robustness) of networks. Thus, the results presented here are evidence that narrowing the machine critical band to match that of humans may make neural networks even more robust.
The critical band masking paradigm characterizes the object recognition channel by measuring sensitivity to frequency-filten filtered noise 2. Our experiments use this approach to study how spatial frequency selectivity relates to noise robustness, core topic in machine learning research. Indeed, Geirhos al. (36) found that adversarial training of networks in the presence of high-frequency noise decreases their overall noise sensitivity. An alternative approach determines what spatial frequencies are used to recognize objects, by filtering the image itself, i.e., removing some frequencies instead of adding filtered noise to mask them [60] [18 (36.. The two approaches yield different results in humans []. which we will explore in future work.
object recognition models rely mainly on low spatial- frequency information in images (also see [TS).. Our observations qualitatively agree with their results. Our network channel is indeed centered on low-frequency band, and adversarial training expands its bandwidth. More work is needed to quantitatively compare the two approaches.
Li et al. [18] found that udversarially
6 Conclusions
In this paper, introduce the critical band masking paradigm study what spatial frequency information humans and neural networks use to recognize objects in natural images. To this end, we use a noise-masked ImageNet object recognition task. First, we find that humans use the same canonical one-octave-wide channel to recognize objects in natural images that they use for letter and grating recognition. Second, the neural network channel is 2-4 times wider than the human channel i.c., network performance is impaired by high and low spatial frequency noise to which humans are immune. Furthermore, properties of the spatial frequency channel correlate strongly with shape bias (explaining 51% cross-nctwork variance) and robustness of adversarially trrinne--reedd networks (explaining 66% variance). Finally, we find that adversarial training increases robustness but further widens the already-too te--ttoo-wdeeee network channel. Overall, critical band masking allows systematic frequency- -based analysis of both network and human object recognition performance, revealing important differences in noise sensitivity. The critical band offers and adversarial robustness. Thereby, our paper provides evidence suggesting that efforts to make a network more robust should look for ways to narrow its critical band. While our results are based on large, representative sample of popular network designs, more work required to explore the effects of diverse kinds of training data and augmentations. Such experiments would also help determine if the relationship between channel properties and robustness is also causal.
explanation of shape bias
Acknowledgments and Disclosure of Funding
We thank Furkan Özęelik and Ozhan Dehghani for ongoing work, and Eero Simoncelli, James Elder, Maria Pombo, Paul Gavrikov, our five anonymous reviewers, and audience at VSS, COSYNE, and ECVP for helpful comments and suggestions. A.S. additionally thanks Jiaming Xu and Chianna Cohen for being dinner companions during the pre-deadline slog. Our work was funded by grants from the National Eye Institute, National Institutes of Health (R01-EY027964 to D.G.P. and R01- CY031446 to N.J.M.). It was also supported by National Institutes of Health core vision grant (P30-EY013079) We are also grateful to NYU's High Performance Computing (HPC) cluster for enabling neural network experiments and analysis.
10

---

References
[1] Fergus W Campbell and John G Robson. Application of fourier analysis to the visibility of gratings. The Journal of physiology. 197(3):551, 1968.
[2] Joshua A Solomon and Denis G Pelli. The visual filter mediating letter identification. 369(6479)3395 397, 1994.
Nature,
[3] Najib Majaj, Denis G Pelli, Peri Kurshan, and Melanie Palomares. The role of spatial frequency channels in letter identification. Vision research, 12(9):1165-11) 2002.
[4] Harvey Fletcher. Auditory patterns. Reviews of modern physics, 12(1):47, 1940.
[5] Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang. Andrej Karpathy, Aditya Khosla, Michael Bernstein, et al. Imagenet large scale visual recognition challenge. International journal of computer vision, 115:21 1-22, 2015.
[6] Christian Szegedy, Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. International Conference on Learning Representa- tions, 2014.
[7] Robert Geirhos, Patricia Rubisch, Claudio Michaelis, Matthias Bethge, Felix A Wichmann, and Wicland Brendel. Imagenet-trainge cnns are biased towards texture; increasing shape bias improves accuracy and robustness. arXiv preprint 1 1.1118111.12231 2018
[8] Katherine Hermann, Ting Chen, and Simon Komblith. The origins and prevalence of texture bias in convolutional neural networks. Advances in Neural Information Processing Systems, 19000- 2020.
[9] Shikhar Tuli, Ishita Dasgupta, Frin Grant, and Thomas I. Griffiths. Are convolutional neural networks or transformers more like human vision? arXiv preprint arXiv:2105.07191 2021.
[10] Barbara Landau, Linda Smith, and Susan Jones. Syntactic context and the shape bias in children's 's and adults' lexical learning. Journal of Memory and Language, 31(6):807-82) 825, 1992.
[11] Haohan Wang, Xindi Wu, Zeyi Huang, and Eric Xing. High-frequency component helps explain the generalization of convolutional neural networks. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 8684-866 8694, 2020.
[12] Justin D Lieber, Gerick M Lee, Najib J Majaj, and J Authony Movshon. Sensitivity to naturalistic texture relies primarily on high spatial frequencies. Journal of vision, 23(2):4 4, 2023.
[13] Ipek Oruç and Michael S Landy. Scale dependence and channel switching in letter identification. Journal of Vision, 99))444, 2009.
[14] Ipek Oruç and Jason IS Barton. Critical frequencies the perception of letters, faces, and novel shapes: Evidence for limited scale invariance for faces. Journal of Vision, 10(12):0020, 2010.
[15] Nasim Rahaman, Aristide Baratin, Devansh Arpit, Felix Draxler, Min Lin, Fred Hamprecht, Yoshua Bengio, and Aaron Courville, On the spectral bias of neural networks. In International Conference on Machine Learning, pages 5301-5310. PMLR, 2019.
[16] Robert Geirhos, Jörn-Henrik Jacobsen, Claudio Michaelis, Richard Zemel, Wieland Brendel, Matthias Bethge, and Felix A Wichmann. Shortcut learning in deep neural networks. Nature Machine Intelligence, 2(11):665 673, 2020.
[17] Shunxin Wang. Raymond Veldhuis, Christoph Brune, and Nicola Strisciuglio. Frequency shortcut Ieam- ing in neural networks. In NewrIPS 2022 Workshop on Distribution Shifts: Connecting Methods and Applications, 2022.
[18] Zhe Li, Josue Ortega Caro, Evgenia Rusak, Wieland Brendel, Matthias Bethge, Fabio Anselmi, Ankit B Patel, Andreas S Tolias, and Xaq Pitkow. Robust deep learning object recognition models rely on low frequency information in natural images. PLOS Computational Biology. 1900xx1010932, 2023,
[19] Dong Yin, Raphael Gontijo I Lopes, Jon Shlens, Ekin Dogus Cubuk, and Justin Gilmer. A fourier perspective model robustness in computer vision. Advances in Neural Information Processing Syxtems, 32, 2019.
[20] Paul Gavrikov, Janis Keuper, and Margret Keuper. An extended study of human like behavior under adversarial training. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 2360-2367, 2023.
11

---

[21] Antonio A Abello, Roberto Hirata, and Zhangyang Wang. Dissecting the high-frequency bias in convo- lutional neural networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 863-871, 2021.
[22] Robert Geirhos, Carlos RM Temme, Jonas Rauber, Heiko Schüit,, Matthias Bethge, and Felix Wichmann. Generalisation in humans and deep neural networks, Advances neural information processing systems, 31, 2018.
[23]
Nicholas Baker, Hongjing Lu, Gennady Erlikhman, and Philip J Kellman. Deep convolutional networks do not classify based on global object shape. PLoS computational biology, 14066)x 2018.
[24] Anh Nguyen, Jason Yosinski. and Jeff Clune. Deep neural networks are easily fooled: High confidence predictions for unrecognizable images. In Proceedings of the IEFE conference on computer vision and pattern recognition, pages 427-436, 2015.
[25] Gamaleldin Elsayed, Shreya Shankar, Brian Cheung, Nicolas Papernot, Alexey Kurakin, Ian Goodfellow, and Jascha Sohl-Dickstein. Adversarial examples that fool both computer vision and time-limited humans. Advances in neural information processing systems, 31, 2018.
[26] Vijay Veerabadran, Josh Goldman, Shreya Shankar, Brian Cheung, Nicolas Papernot, Alexey Kurakin, Ian Goodfellow, Jonathon Shiens, Jascha Sohl-Dickstein, Michael C Mozer, et al. Subtle adversarial image manipulations influence both human and machine perception. Nature Communications, 1:433, 2023.
[27] Zhenglong Zhou and Chaz Firestone. Humans can decipher adversarial images. Nature communications, 10(1):1334, 2019.
[28] Rémi Berhhard, Pierre-Alain Moëllic, Martial Mermillod, Yannick Bourrier, Romain Cohendet, Miguel Solinas, and Marina Reyboz. Impact of spatial frequency based constraints on adversarial robustness. In 2021 International Joint Conference on Neural Networks (IJCNN), pages 1-8. IEEE, 2021.
[29] Shishira R Maiya, Max Ehrlich, Vatsal Agarwal, Ser-Nam Lim, Tom Goldstein, and Abhinav Shrivastava.
A frequency perspective of adversarial robustness. arXiv preprint arwiv:2/11.000. 1.00611, 2021.
[30] Kunihiko Fukushima and Sei Miyake. Neocognitron: A new algorithm for pattern recognition tolerant of deformations and shifts in position. Pattern recognition, 15(6):455 469, 1982.
[31] Maximilian Riesenhuber and Tomaso Poggio. Hierarchical models of object recognition in cortex. Nature neumoscience, 2(1 1011 1999.
[32] Daniel LK Yamins and James J DiCarlo. Using goal-driven deep learning models to understand sensory cortex. Nature neuroscience, 19(3)355-365, 2016.
[33] Seyed-Mahdi Khaligh- Razavi and Nikolaus Kriegeskorte. Deep supervised, but not unsupervised. models may explain it cortical representation. PLoS computationnl biology, 10(1 1003915 2014.
[34] Martin Schrimpf, Jonas Kubilius, Ha Hong, Najib Majaj. Rishi Rajalingham, Elias B Issa, Kohitij Kar, Pouya Bashivan, Jonathan Prescott-Roy, Franziska Geiger, et al. Brain-score: Which artificial neural network for object recognition is most brain-like? BioRxiv, page 407007, 2018.
[35] Joel Dapello. Tiago Marques. Martin Schrimpf, Franziska Geiger, David Cox, and James J DiCarlo. Simulating primary visual cortex at the front of cans improves robustness to image perturbations. Advances in Neural Information Processing Systems, 33:13073-10 13087, 2020.
[36] Robert Geirhos, Kantharaju Narayanappa, Benjamin Mitzkus, Tizian Thieringer, Matthias Bethge, Felix A Wichmann, and Wieland Brendel. Partial success in closing the gap between human and machine vision. Advances in Neural Information Processing Systems, 34:23885-23899 2021.
[37] Jenelle Feather, Guillaume Leclere, Aleksander Mądry, and Josh H McDermott. Model metamers illuminate divergences between biological and artificial neural networks. bioRxiv, pages 2022-05 05, 2022.
[38] Nikolaus Kriegeskorte, Marieke Mur, and Peter Bandettin.. Representational similarity analysis- connecting the branches of systems neuroscience. Frontiers in systems neuroscience, page 4, 2008.
[39] George A Miller. Wordnet: a lexical database for english. Communications of the ACM, 38( 1):39441, 1995.
[40] Peter J Burt and Edward H Adelson. The laplacian pyramid as a compact image code. In Readings in computer vision, pages 671-679. Elsevier, 1987.
12

---

[41] Felix Henninger, Yury Shevchenko, Ulf K Mertens, Pascal Kieslich, and Benjamin E Hilbig. lab, js: A free, open, online study builder. Behavior Research Methods, pages 1-18, 2021.
[42] Kristian Lange, Simone Kühn, and Elisa Filevich. "just another tool for online studies"(jatos" An easy solution for setup and management of web servers supporting online studies. PloS one, 10(6):c01308) 2015.
[43] Séhastien Marcel and Yann Rodriguez. Torchvision the machine-vision package torch. In Proceedings of the 18th ACM international conference on Multimedia, pages 1485-1488, 2010.
[44] Zhirong Wu, Yuanjun Xiong, Stella X Yu, and Dahua Lin. Unsupervised feature learning via non parametric instance discrimination. In Proceedings of the IEEE conference on computer vision and pattern recognition. pages 3733-3742, 2018.
[45] Kaiming He, Haoqi Fan, Yuxin Wu, Saining Xie, and Ross Girshick. Momentum contrast for unsupervised visual representation learning. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. pages 9729- 9738, 2020.
[46] Xinlei Chen, Haoqi Fan, Ross Girshick, and Kaiming He. Improved baselines with momentum contrastive learning. arXiv preprint (tt.:20003042997 2020.
[47] Ishan Misra and Laurens van der Maaten. Self-supervised learning pretext-invarint representations. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 6707-6717, 2020.
[48] Yonglong Tian, Chen Sun, Ben Poole, Dilip Krishnan, Cordelia Schmid, and Phillip Isola. What makes for good views for contrastive lcarning? Advances in neural information processing systems, 33:6827-6888 2020.
[49] Ting Chen, Simon Komblith, Mohammad Norouzi. and Geoffrey Hinton. A simple framework for contrastive learning visual representations. International conference on machine learning, pages 1597-1607. PMLR, 2020.
[50] Alexander Kolesnikov, Lucas Beyer, Xiaohua Zhai, Joan Puigcerver, Jessica Yung, Sylvain Gelly, and Neil Houlsby. Big transfer (bit): General visual represcntation leamingg Computer Vision-ECCV 2020: 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceedings, Part V 16, pages 491-507. Springer, 2020.
[51] Hadi Salman. Andrew Ilyas. Logan Engstrom, Ashish Kapoor, and Aleksander Madry. Do adversarially robust imagenet models transfer better? Advances in Neural Information Procexsing Systems, 33:3533- 3545, 2020.
[52] Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghami, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x16 words: Transformers for image recognition scale, arXiv preprint arXiv:2010. 11999 2020.
[53] Ross Wightman et al. Pytorch image models, 2019.
[54] Zeeki Yalniz, Hervé Jégou, Kan Chen, Manohar Paluri, and Dhruv Mahajan. Billion-scall semi supervied learning for image classification. arXiv preprint arXiv: /tti::9900.000 1905.00546, 2019.
[55] Qizhe Xie, Minh-Thang Luong, Eduard Hovy, and Quoc V Le. Self-training with noisy student improves imagenet classification. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10687-10698, 2020.
[56] Maria-Irina Nicolac, Mathicu Sinn, Minh Ngoc Tran, Beat Buesser, Ambrish Rawat, Martin Wistuba, Valentina Zantedeschi, Nathalic Baracaldo, Bryant Chen, Heiko Ludwig, al. Adversarial robustness toolbox vl. 0.O. arXiv preprint arXiv: 1=07.v1807.000 00069, 2018
[57] Colin Blakemore and Fergus W Campbell. On the existence of neurones in the human visual system selectively sensitive to the orientation and size of retinal images. The Journal of physiology. 203(1):237- 260, 1969.
[58] Mostafa Dehghani, Josip Djolonga, Basil Mustafa, Piotr Padlewski, Jonathan Heek, Justin Gilmer, Andreas Steiner, Mathilde Caron, Robert Geirhos, Ibrahim Alabdulmohsin, ct al. Scaling vision transformers to 22 billion parameters. arXiv preprint arXiv:2302.00 000.2222..5542, 2023.
[59] Yann LeCun, Yoshua Bengio. and Geoffrey Hinton. Deep learning. nature, 521 444, 2015.
[60] David H Parish and George Sperling, Object spatial frequencies, retinal spatial frequencies, noise, and the efficiency of letter discrimination. Vision research. (177-)):39991444 1991.
13


Reviews:
[{"review_id": "In4NVI3zwd", "reviewer": "Reviewer_kLx7", "summary": "I have read the authors' rebuttal and will maintain my already very high rating.\n\nThis paper discovers a new fact (which should be replicated by others) about human vision: That we use the same frequency band for objects as we do for words and gratings. It seems remarkable that this has not been tested before, but a cursory google search didn’t turn up any previous result like this. Second, the paper shows that 76 deep network vision systems use a much wider band of frequencies than humans. Finally, the paper shows that aspects of these frequencies predict both shape bias and robustness against adversarial examples.", "questions": "The x axis for peak noise sensitivity in Figure 6 seems incorrect, based on the definition in Figure 2F, For example, for humans, it looks to be 1/(0.03), or about 33. It’s only after checking the supplementary material that this is made clear. It’s actually 1/(0.02*2^A), where A is the fitted parameter. This should be made clearer in the main text.\n\nDid you use MTurk’s ratings of workers? It seems like subjects 9 and 13 were only marginally engaged in the task. I would have thrown them out. \n\nI think you should reverse Figures 1 and 2. Also (if possible) 5 & 6. In both cases, you refer to the later one before the other.", "limitations": "Despite using 76 different networks, they only use ResNet50 for the adversarially-trained networks. It would be good to add a couple of other networks of different types (e.g., ViT, etc.) to see that this still holds. This could be added to the supplementary material.", "rating": 10, "confidence": 5, "soundness": 4, "presentation": 4, "contribution": 4, "strengths": "-This is one of those papers that one wishes one had written. The result about the human bandwidth is *Nature*-worthy! \n\n-The sequence of experiments: First human psychophysics, then network “psychophysics”, then showing that these measurements of noise-sensitivity (mean, std dev., and peak noise sensitivity) account for fairly large amounts of variance in the networks’ adversarial robustness and shape-sensitivity are both logical and surprisingly revealing. \n\n-The fact that these measurements account for 53% of the variance in shape-bias is remarkable, given that these are relatively low-level, and don’t have any necessary relationship to shape.", "weaknesses": "Just a few comments here:\nInclude the heat map key in the supplementary material (figure 2).\nYou should run some more experiments with adversarially-trained networks (see below).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**Strengths:**\n\n>-This is one of those papers that one wishes one had written. The result about the human bandwidth is Nature-worthy!\n\n>-The sequence of experiments: First human psychophysics, then network “psychophysics”, then showing that these measurements of noise-sensitivity (mean, std dev., and peak noise sensitivity) account for fairly large amounts of variance in the networks’ adversarial robustness and shape-sensitivity are both logical and surprisingly revealing.\n\n>-The fact that these measurements account for 53% of the variance in shape-bias is remarkable, given that these are relatively low-level, and don’t have any necessary relationship to shape.\n\nThank you for rating our paper so positively! We are glad the significance and contributions of our paper came through.\n\n**Weaknesses:**\n\n>Just a few comments here: Include the heat map key in the supplementary material (figure 2). \n\nDone. The heatmap figure in supplementary material will be modified to include a colorbar and axis labels, as shown in Fig. 1 in the attached PDF.\n\n>You should run some more experiments with adversarially-trained networks (see below).\n\nAnswered below.\n\n**Questions:**\n\n>The x axis for peak noise sensitivity in Figure 6 seems incorrect, based on the definition in Figure 2F, For example, for humans, it looks to be 1/(0.03), or about 33. It’s only after checking the supplementary material that this is made clear. It’s actually 1/(0.02*2^A), where A is the fitted parameter. This should be made clearer in the main text.\n\nDone. The following paragraph describing the fitting procedure will be added to Methods in the main text.\n\n*The fitting procedure is as follows. The threshold values computed earlier are first mapped to linear indices ($[ >0.16,0.16,0.08,0.04,0.02 ]\\rightarrow[ 0,1,2,3,4 ]$). A Gaussian function $f(x) = Ae^{-\\frac{(x-\\mu)^2}{2\\sigma^2}}$ having 3 parameters: peak height (A), mean ($\\mu$), and standard deviation ($\\sigma$) is then fit to the thresholds. These fitted parameters are converted back to their original scale and then used to calculate three properties that characterize the channel: peak noise sensitivity (reciprocal of channel height = $\\frac{1}{0.02 \\times 2^A}$), center frequency (frequency for peak noise sensitivity = $\\mu$), and bandwidth in octaves (log full-width at half-max = $\\log_2{2.355\\sigma}$). An octave is a doubling of frequency. Fig. 2F illustrates the rescaled Gaussian channel (black curve) and its three parameters (orange, maroon, green) for a sample observer, along with formulae to calculate the three channel properties.*\n\n>Did you use MTurk’s ratings of workers? It seems like subjects 9 and 13 were only marginally engaged in the task. I would have thrown them out.\n\nDone. Data of subjects 9 and 13 have been discarded and all analyses involving human data have been redone and will be modified in the paper. Our results remain the same with the only significant change being that the human channel bandwidth is now narrower: 1.21 instead of the previously-reported 1.56. This makes our main result, that the network channel is wider than the human bandwidth, stronger. \n\n>I think you should reverse Figures 1 and 2. Also (if possible) 5 & 6. In both cases, you refer to the later one before the other.\n\nDone, thanks. We will remove all references to Figure 2 before those to Figure 1 because they were redundant as you pointed out. Also, the order of Figures 5 and 6 will be reversed.\n\n**Limitations:**\n\n>Despite using 76 different networks, they only use ResNet50 for the adversarially-trained networks. It would be good to add a couple of other networks of different types (e.g., ViT, etc.) to see that this still holds. This could be added to the supplementary material.\n\nThank you for this suggestion. Yes, we agree that it will be interesting to analyze how network architecture and other factors affect our results on adversarial robustness. For this paper, we intended to test only networks that have previously been evaluated on other popular benchmarks (primarily from Geirhos et al. 2021) to observe how networks from those benchmarks fare on our spatial-frequency-based metric. Attributing our results to factors such as architecture, training data etc is interesting and is something we intend to pursue next. We have modified the Discussion and Conclusion sections of the current manuscript as follows, to include this point.\n\n*DISCUSSION: Every one of the 76 networks we tested has a wide critical band. We tested all the networks from Geirhos et al., 2021 which is the largest comparison of networks and humans on object recognition. The Geirhos study included most of the popular network kinds, spanning a wide range of conditions: convolutional networks and transformers, shallow and deep networks, supervised and self-supervised training, standard and adversarially-trained networks. Thus, the conclusions of this paper are based on a representative sample of popular network designs. More work is required to explore the effects of diverse kinds of training data and augmentation.*\n\n*CONCLUSION: … are based on a representative sample of popular network designs. More work is required to explore the effects of diverse kinds of training data and augmentation.*\n"}, {"review_id": "8QEA50JWuZ", "reviewer": "Reviewer_QrRK", "summary": "This work presents an empirical analysis of the sensitivity of humans and neural networks to critical band masking. This is the process of perturbing specific spatial frequencies, and determining which frequencies and at what magnitude, will lead to recognition errors. This in turns identifies the frequencies/magnitudes that a visual system “filters out” or “relies on” when performing recognition. The main finding is that neural networks are sensitive to a larger set of noise frequencies/magnitudes than human participants. Further, the paper presents evidence that adversarial-trained networks are sensitive to an even bigger set of frequencies/magnitudes, and correlation-based analyses indicating that more human-like networks that are sensitive to a narrow set of frequencies (smaller bandwidth) have a bigger shape bias.\n", "questions": "- What exactly is the significance of the findings presented in this work? What should be the main takeaway for researchers working on deep learning methodology for visual recognition, regarding how their future work should be affected by these findings? Is it necessarily better if the \"channel\" (as defined in this paper) is more human-like, and if so, why?\n- Given that filtered noise perturbation significantly alters the visual appearance of an image, so much so that it appears to be quite easy to identify images with such an attack, what is the significance of identifying the susceptibility to such attacks of adversarial-trained models (described in L298)?\n- What is the significance of the current findings abound frequency sensitivity, in light of the fact that the effect of training dataset choice and some basic techniques could be used to improve it?. How pervasive is this emerging phenomenon of a wider spatial frequency sensitivity of neural networks?", "limitations": "The authors have adequately addressed the limitations.", "rating": 4, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "Originality\n- Critical band masking-based analysis has previously been done to analyze recognition of letters and gratings. The novelty for this paper comes from its critical band masking-based for ImageNet-like object recognition for 16 humans and 76 different neural networks.\n\nQuality\n- The design of the study is mostly sound: 1100 images from 16 categories of ImageNet with various kinds of added noise are used as the test set. Careful steps were taken to avoid clipping as a result of added noise. 16 participants are sufficient due to the small variability between subjects (Figure 2 in supplement).\n- The evidence for the claims of bigger channel bandwidth than humans, inverse correlation of bandwidth and shape bias, and increased bandwidth with, are sound regarding the 76 networks evaluated in this paper. Figures 4 5 6 contain clear evidence of these claims\n\nClarity\n- The paper is well written and mostly easy to follow. The plots in Figure 5 and 6 are quite condensed, containing a lot of information, but with the text and captions the reader can mostly parse them well.\n", "weaknesses": "Quality\n- The practical motivation behind using grayscale images reduced to 20% contrast makes sense, however, this represents a testing condition outside of the training data domain of these neural networks. A control experiment where the performance discrepancy between testing on standard RGB data and contrast reduced grayscale is quantified would justify this choice of test setting.\n- While the paper does investigate a diverse set of networks, one confounding factor that at least should be mentioned and ideally should be investigated in an analysis paper like this is the effect of training data and data augmentation on spatial frequency sensitivity. The design of the neural network itself is not the only factor. \n    * The neural networks used in this paper are primarily trained on ImageNet, but there are other datasets, for example Office-Home, with images from different domains for each object, and therefore different spatial frequency characteristics. Training on such data will likely result in different spatial frequency sensitivity. \n    * There might be straightforward steps like band-pass filtering or adding noise to the input data at training time, that might effectively reduce the range of frequencies a model is sensitive to.\n- The paper lacks a related work section. While it does mention a variety of prior work throughout the draft, it would be beneficial to include a separate section that would cover prior work on topics like: spatial frequency sensitivity of humans and neural networks, shape bias, adversarial robustness, and comparing humans and neural networks more broadly. The main benefit is to help the reader understand exactly where the proposed work lies relative to prior methods.\n\nSignificance\n- While it is interesting to see a comparison of spatial frequency sensitivity of networks to humans for object recognition, and to identify it as an emerging phenomenon for a variety of ImageNet-trained models, I’m concerned about what exactly is the significance of these findings for deep learning practitioners. How should researchers rethink their work going forward as a result of these findings?\n- As mentioned in the quality section, after reading this paper there is a sense of it not going quite far enough in the analysis. How pervasive is the phenomenon of a wider spatial frequency sensitivity of neural networks? It would be more impactful if it is demonstrated that this is a general phenomenon despite training data or simple mitigation strategies.\n- The observations about adversarial robustness are focused on one type of white-box adversarial attack, which is the least practically plausible. \n", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**Strengths:**\n\n>Originality\n\n>Critical band masking-based …\n\n>Quality\n\n>The design of the study is mostly sound: 1100 images from …\n\n>The evidence for the claims of bigger channel bandwidth than humans, inverse correlation of bandwidth and shape bias, and …\n\nThank you!\n\n>Clarity\n\n>The paper is well written and mostly easy to follow. The plots in Figure 5 and 6 are quite condensed, containing a lot of information, but with the text and captions the reader can mostly parse them well.\n\nThank you!\n\n**Weaknesses:**\n\nQuality\n\n>The practical motivation behind using grayscale images reduced to 20% contrast makes sense, …\n\nDone. Fig. 2 from the attached PDF will be added to the paper’s supplementary material and will be referenced in the main paper. This figure shows the percent correct values of each network we tested for each of 3 image conditions: color, gray, and low-contrast gray. Of the 88 networks available in our source datasets, 12 were below threshold for low-contrast gray images (alexnet, squeezenet1_0, squeezenet1_1, shufflenet_v2_x0_5, bagnets 9, 17, 33, resnet50_l2_eps1,3,5, selecsls42b, selectls84), which made them impossible to test on our critical band masking task. This left us with the 76 networks that we report results for in the main paper. Importantly, for these networks, we see in the figure that the change in performance from the color to gray to low-contrast gray condition is very small.\n\n>While the paper does investigate a diverse set of networks, …\n\nThank you for this suggestion. Yes, we totally agree that the influence of training data on these results is interesting to look at. We have clarified this point in the modified discussion and conclusion sections, as follows.\n\n*DISCUSSION: Every one of the 76 networks we tested has a wide critical band. We tested all the networks from Geirhos et al., 2021 which is the largest comparison of networks and humans on object recognition. The Geirhos study included most of the popular network kinds, spanning a wide range of conditions: convolutional networks and transformers, shallow and deep networks, supervised and self-supervised training, standard and adversarially-trained networks. Thus, the conclusions of this paper are based on a representative sample of popular network designs. More work is required to explore the effects of diverse kinds of training data and augmentation.*\n\n*CONCLUSION: … are based on a representative sample of popular network designs. More work is required to explore the effects of diverse kinds of training data and augmentation.*\n\n>The paper lacks a related work section…\n\nDone. We have written a Related work section (please see our common response to all reviewers) that will be added to the manuscript.\n\n>Significance\n\n>While it is interesting to see a comparison…\n\nThank you for raising this important point. We agree that the significance of the paper for engineering applications isn’t completely clear in the current manuscript. To resolve this, we will add the following text to both the abstract and conclusion of the paper.\n\n*We show that the idea of a critical-band offers a spatial-frequency-based explanation of shape bias and adversarial robustness. Thereby, our paper provides evidence suggesting that efforts to make a network more robust should look for ways to narrow its critical band.*\n\n>As mentioned in the quality section, …\n\nPlease refer to our answer above to your comment in the Quality section.\n\n>The observations about adversarial robustness are focused on one type of white-box adversarial attack, which is the least practically plausible.\n\nWe don’t know about real-world or practically plausible attacks. Can you give us a pointer?\n\n**Questions:**\n\n>What exactly is the significance of the findings …\n\nPlease refer to our answer above to your comment in the Significance section.\n\n>Given that filtered noise perturbation significantly …\n\nWhile the filtered noise perturbations to an image are indeed easy to see/detect, they do not affect human categorization decisions. We show in the paper that category decisions of adversarially-trained models are MORE affected by such filtered noise, making their recognition susceptible to a kind of attack that humans are not susceptible to. The significance of this is that more adversarially-robust object recognition networks are more affected by simple frequency-based perturbations which do not affect human decisions, raising questions about the robustness of these networks.\n\n>What is the significance of the current findings abound …\n\nPlease refer to our answer above to your comment in the Significance section."}, {"review_id": "84lOjmGwbk", "reviewer": "Reviewer_9K3N", "summary": "This paper presents an analysis of neural network response to object classification from the perspective of frequency components. The authors use an analytic tool based on critical band masking, which is a technique borrowed from neuroscience. \nThe focus of the network to use certain frequency bands for object classification is related to the frequency capabilities of the human visual system, then with shape bias and adversarial robustness of classification networks. \nThe contributions/novelty is in the neuroscientific technique used to analyze the network responses and behavior. The contributions are related to comparison of the frequency bad usage in the human visual system (HSV), neural networks and adversarially-trained networks, with limited contribution in terms of practical insights or indications/suggestions on how these observations would be usable.\n", "questions": "-\tCan the authors clarify details about the method and experimental analysis, such as the use of magnitude and phase of the spectrum?\n-\tCan the authors clarify the motivations why neural networks based vision models have to be compared with the human visual system of the brain, and why aspects such as energy efficiency, memory, and ‘training’? are not taken into account?\n-\tHow does the work related to actual existing work on frequency analysis of neural networks in vision tasks?\n-\tHow the achieved results fall within the current progress in understanding neural network learning and application, and how they can be used to improve models for vision task?\n-\tAre 16 human observers enough to have significant results? This is glossed over very briefly in the paper, but not analyses are provided to support the claims.\n", "limitations": "The authors do not discuss limitations explicitly.\nAbout ethics, the authors say that humans are used for experiments and that a consent form has been signed, but there is no evidence of how this form is written, what the users agree with, and who approved the experiments.\n", "rating": 7, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "-\tUse of a novel approach to analyze neural networks: the critical band masking technique is borrowed from neuroscience (very popular in auditory system analysis) and used to analyze the response of networks. The approach is novel and interesting.\n-\tExtent of models considered in the analysis (although the transformers are only slightly covered)\n", "weaknesses": "-\tUsefulness and outlook of the results: while the experimental results present an interesting view on the neural networks frequency selectivity for object classification, their significance and possible usage are not clear nor explicitly covered. Networks have a different behavior/frequency selectivity (not surprisingly I would say) nut no indication of how one should take over these findings and use them.\n-\tRelation between HVS and neural networks: the paper reads with an implicit assumption that the human visual system and neural networks for vision tasks are comparable systems. They are actually very different (with the second showing only some conceptual resemblance with the first), in terms of processing the data, energy-efficiency, ‘training’ etc. The results show that they behave differently (as expected) but do not address substantial differences between the two systems. I see a missed answer to important questions, as ‘why should we compare these systems and what do we gain from this analysis’?\n-\tDetails about the methodology are missing: e.g. is the analysis done taking into account both magnitude and phase of the spectrum, or only the magnitude? Phase is for instance shown important for object classification [1].\n-\tPlacement in the literature is very limited – references are outdated: missing references of works that study the network from a frequency perspective, relating the frequency spectrum with robustness and bias problems ([2,3,4,5], to mention a few).\n\n[1] Chen et al. Amplitude-phase recombination: Rethinking robustness of convolutional neural networks in frequency domain, ICCV 2021. \n\n[2] Yin D. et al. A fourier perspective on model robustness in computer vision. In NeurIPS, 2019.\n\n[3] Maiya et al. A frequency perspective of adversarial robustness, 2022.\n\n[4] Wang et al. Frequency shortcut learning in neural networks.  NeurIPS 2022 Workshop on Distribution Shifts\n\n[5] Wang et al. High-frequency component helps explain the generalization of convolutional neural networks. In CVPR, 2020.\n", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**Strengths:**\n\n>Use of a novel approach to analyze neural networks: the critical band masking…\n\n>Extent of models considered in the analysis …\n\nThank you!\n\n**Weaknesses:**\n\n>Usefulness and outlook of the results: …\n\nThank you for raising this important point. We agree that the significance of the paper for engineering applications isn’t completely clear in the current manuscript. To resolve this, we will add the following text to both the abstract and conclusion of the paper.\n\n*We show that the idea of a critical-band offers a spatial-frequency-based explanation of shape bias and adversarial robustness. Thereby, our paper provides evidence suggesting that efforts to make a network more robust should look for ways to narrow its critical band.*\n\n>Relation between HVS and neural networks…\n\n*When comparing biological vision and artificial neural networks, there are two questions to be asked: what can artificial networks learn from biology, and how can neural networks inform our understanding of biology (LeCun, Bengio & Hinton, 2015; Schrimpf et al., 2018). Needless to say, the origins of deep learning relied heavily on knowledge of biology (Fukushima, 1982). But can biology impact the evolution of neural networks? Dapello et al., (2020) showed that making the first layer’s tuning match biological V1 tuning improves robustness. The critical band idea is central to understanding hearing and vision. Here we show that the critical bands, which are a measure of tuning, are different between humans and networks, and that this difference strongly explains robustness (shape bias and adversarial robustness) of networks. Thus, the results presented here are evidence that narrowing the machine critical band to match that of humans may make neural networks even more robust.*\n\nThis text will be added to the discussion section in the revised manuscript. \n\n>Details about the methodology are missing: e.g. is the…\n\nNoise was generated by making an array of independent identically distributed Gaussian noise samples. This has a white spectrum and random phase. The white noise was then band-pass filtered. We did all of our experiments with random phase noise. Indeed, both machines and humans care a lot about phase while recognizing objects. We will include a sentence about this in the Discussion section.\n\n>Placement in the literature is very limited...\n\nDone. We have written a Related work section (please see our common response to all reviewers) that will be added to the manuscript.\n\n**Questions:**\n\n>Can the authors clarify details about the method and experimental analysis…\n\nAnswered above in the Weaknesses section.\n\n>Can the authors clarify the motivations why neural networks …\n\nAnswered above in the Weaknesses section.\n\n>How does the work related to actual existing work on...\n\nAnswered above, in the newly added related work section.\n\n>and why aspects such as energy efficiency, memory, and ‘training’? are not taken into account?\n\nThank you for raising this point. We agree that these are all interesting points that should be analyzed, and is something we intend to pursue next. The following text (see answer to next question) will be added to the discussion and conclusion sections to address these concerns.\n\n> How the achieved results fall within the current progress in understanding …\n\nThank you for raising this important point. We agree that the significance of the paper for engineering applications isn’t completely clear in the current manuscript. To resolve this, we have added the following text to both the discussion and conclusion of the paper.\n\n*DISCUSSION: Every one of the 76 networks we tested has a wide critical band. We tested all the networks from Geirhos et al., 2021 which is the largest comparison of networks and humans on object recognition. The Geirhos study included most of the popular network kinds, spanning a wide range of conditions: convolutional networks and transformers, shallow and deep networks, supervised and self-supervised training, standard and adversarially-trained networks. Thus, the conclusions of this paper are based on a representative sample of popular network designs. More work is required to explore the effects of diverse kinds of training data and augmentation.*\n\n*CONCLUSION: … are based on a representative sample of popular network designs. More work is required to explore the effects of diverse kinds of training data and augmentation.*\n\n>Are 16 human observers enough to have significant results...\n\nWe are working on analyses showing statistical significance of our human experimental results and will try to share updates during the discussion period.\n\n**Limitations:**\n\n>The authors do not discuss limitations explicitly. \n\nDone. Our revised conclusion section, copied below, will discuss limitations as follows.\n\n*While our results are based on a large, representative sample of popular network designs, more work is required to explore the effects of diverse kinds of training data and augmentations. Additionally, our current results are purely correlational, and such experiments would also help determine if the relationship between channel properties and robustness is also causal.*\n\n>About ethics, the authors say that humans are used for experiments and that a consent form has been signed, but there is no …\n\n>Flag For Ethics Review: Ethics review needed: Compliance (e.g., GDPR, copyright, license, terms of use)\n\nClearly there has been a misunderstanding. As we point out in L128, our study and consent form were approved by the university IRB (Institutional Review Board) which abides by the Helsinki agreement (check). This is the standard protocol for review and publication of human behavior experiments in psychology and neuroscience journals. NeurIPS also follows this standard practice.\n\nIt is highly unusual to request a consent form as part of a scientific review but we would be happy to share it if necessary.\n"}, {"review_id": "5CMkmjXNbN", "reviewer": "Reviewer_vBv1", "summary": "The authors propose to measure the differences in how humans and models rely on spectral information to recognize objects by using critical band masking to ablate. They conduct a human study revealing that humans detect objects with the same channels they use to detect letters and grating. On the other hand, models show a significantly wider channel. They further correlate the properties of the channel to robustness and shape bias, e.g. showing that AT results in an even wider channel.", "questions": "- Are there any insights on whether improving the alignment between the model critical channel compared to humans would improve robustness or shape-bias, i.e. is there evidence of causality and not only correlation? \n- Did the authors attempt to encourage alignment in training?\n- Are there any observations on other datasets?", "limitations": "The authors do not discuss limitations explicitly. One salient limitation is the evaluation of ImageNet. As discussed above certain frequency properties may not carry over to other datasets.\n\nI don't see any potential negative societal impact of their work.", "rating": 7, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 4, "strengths": "### Originality\nThe paper explores a less common yet highly important research direction. Some \"model\" findings were partially reported in literature, but for the most part the findings are highly original.\n\n### Quality\nThe submission is of high quality (minor weaknesses see below). The authors rigorously conduct (well-documented) human experiments and benchmark 76 ImageNet models to arrive at their conclusions.\n\n### Clarity\nThe paper is very well written. Key points are communicated clearly through writing and figures.\n\n### Significance\nThe authors share many findings, that may be of great interest to the NeurIPS community. In particular, they measure the human critical channel and show that models measure higher bandwidths. Adversarial Training increases the channel even further. Generally, they find correlations between channel properties and shape-bias/robustness that may lead to a new perspective on robustness but also shows another misalignment between humans and models.\n", "weaknesses": "### Method\n- Evaluation only on ImageNet: I never thought I would make this as a weakness but here we go ... previous work has shown that the frequency band of adversarial attacks is not always HF (the authors arrive at the same conclusion in L230ff) but also highly depends on the dataset [2,3,4]. Given that this paper \"only\" presents an empirical evaluation I am not sure if the findings (about models and in particular robustness) scale to other datasets. At the very least this is a limitation that should be discussed.\n- Poor choice of robust networks: The authors choose $\\ell_2$-AT trained ResNets as robust networks and attack them with $\\ell_\\infty$ attacks. However, AT is notoriously poor at generalizing to new attacks. A better choice would have been $\\ell_\\infty$-AT trained ResNets. There may also be some differences in the evaluation as [1] showed that the norm differently affects performance on high/lowpass data. I don't expect this to flip observations, but it would be a more appropriate choice.\n- Minor: uncommon choice of parameters for robustness analysis. A more common choice would be $\\epsilon=4/255$ via 20-step PGD or better the AutoAttack suite. This probably won't impact the observations at all but may be easier to relate to.\n\n### Novelty \n- Some claims/observations in the submitted draft were already published. This does not invalidate the (exceeding) contributions of this paper, but the respective works should at least be mentioned. [2] already performed band-masking to study the critical bands of CNNs, [1] discussed how frequencies interact with shape-bias.\n\n\n### Others\n- The authors use 76 pretrained models only partially citing them. The Paper Checklist clearly states to cite all the used assets.\n\n- Authors do not discuss limitations\n\n- Minor: The authors repeatedly claim that transformers are shape-biased. This is not inherently true. It may hold if pretrained on large datasets such as ImageNet21k, but out of the box they don't perform much better, e.g. [1] shows that XCiT just barely performs better than ResNets in shape-bias when only trained on ImageNet1k.\n\n[1] Paul Gavrikov, Janis Keuper, Margret Keuper. \"An Extended Study of Human-Like Behavior Under Adversarial Training\". CVPR-W, 2023.\n[2] Antonio A. Abello, Roberto Hirata, and Zhangyang Wang. \"Dissecting the high-frequency bias in convolutional neural networks\". CVPR-W, 2021.\n[3] Remi Bernhard, Pierre-Alain Moellic, Martial Mermillod, Yannick Bourrier, Romain Cohendet, Miguel Solinas, and Marina Reyboz. \"Impact of spatial frequency based constraints on adversarial robustness\". IJCNN, 2021.\n[4] Guillermo Ortiz-Jimenez, Apostolos Modas, Seyed-Mohsen Moosavi-Dezfooli, and Pascal Frossard. \"Hold me tight! influence of discriminative features on deep network boundaries\". NeurIPS, 2020.\n", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**Strengths:**\n\n>Originality\n\nThe paper explores a less common yet highly important research direction. Some \"model\" findings were partially reported in literature, but for the most part the findings are highly original.\n\n>Quality\n\nThe submission is of high quality (minor weaknesses see below). The authors rigorously conduct (well-documented) human experiments and benchmark 76 ImageNet models to arrive at their conclusions.\n\n>Clarity\n\n>The paper is very well written. Key points are communicated clearly through writing and figures.\n\n>Significance\n\n>The authors share many findings, that may be of great interest to the NeurIPS community. In particular, they measure the human critical channel and show that models measure higher bandwidths. Adversarial Training increases the channel even further. Generally, they find correlations between channel properties and shape-bias/robustness that may lead to a new perspective on robustness but also shows another misalignment between humans and models.\n\nThank you!\n\n**Weaknesses:**\n\n>Method\n\n>Evaluation only on ImageNet: I never thought...\n\nThank you for raising this point. Our revised conclusion section will mention this as a limitation, as follows.\n\n*While our results are based on a large, representative sample of popular network designs, more work is required to explore the effects of diverse kinds of training data and augmentations. Additionally, our current results are purely correlational, and such experiments would also help determine if the relationship between channel properties and robustness is also causal.*\n\n>Poor choice of robust networks...\n\n>Minor: uncommon choice of parameters for robustness analysis...\n\nThank you for these suggestions. We are working on running it with these parameters, and will try to share updates during the discussion period.\n\n>Novelty\n\n>Some claims/observations in the submitted draft were already published. This does not invalidate the (exceeding) contributions of this paper, but the respective works should at least be mentioned. [2] already performed band-masking to study the critical bands of CNNs, [1] discussed how frequencies interact with shape-bias.\n\nDone. We have written a Related work section (please see our common response to all reviewers) that will be added to the manuscript.\n\n>Others\n\n>The authors use 76 pretrained models only partially citing them. The Paper Checklist clearly states to cite all the used assets.\n\nDone. All evaluated models will be cited in the revised text.\n\n>Authors do not discuss limitations\n\nDone. We have added a discussion of limitations to the Conclusion section, as mentioned above. Copied below again for your reference.\n\n*While our results are based on a large, representative sample of popular network designs, more work is required to explore the effects of diverse kinds of training data and augmentations. Additionally, our current results are purely correlational, and such experiments would also help determine if the relationship between channel properties and robustness is also causal.*\n\n>Minor: The authors repeatedly claim that transformers are shape-biased...\n\nThank you for pointing this out. We will change all occurrences of this statement to talk about “Imagenet-pretrained transformers)” instead of transformers in general.\n\n**Questions:**\n\n>Are there any insights on whether improving the alignment between the model critical channel compared to humans would improve robustness or shape-bias, i.e. is there evidence of causality and not only correlation?\n\n>Did the authors attempt to encourage alignment in training?\n\nIndeed, we are very interested in examining how our results are influenced by training settings, and this is something we intend to pursue next. We will modify our Discussion and Conclusion sections as follows.\n\n*DISCUSSION: Every one of the 76 networks we tested has a wide critical band. We tested all the networks from Geirhos et al., 2021 which is the largest comparison of networks and humans on object recognition. The Geirhos study included most of the popular network kinds, spanning a wide range of conditions: convolutional networks and transformers, shallow and deep networks, supervised and self-supervised training, standard and adversarially-trained networks. Thus, the conclusions of this paper are based on a representative sample of popular network designs. More work is required to explore the effects of diverse kinds of training data and augmentation.*\n\n*CONCLUSION: … are based on a representative sample of popular network designs. More work is required to explore the effects of diverse kinds of training data and augmentation.*\n\n>Are there any observations on other datasets?\n\nNot yet, but we plan to look at other datasets, as mentioned above in our modified discussion and conclusion sections (above). For now, we have considered only ImageNet since it is the most popular dataset for the evaluation of object recognition systems.\n"}, {"review_id": "GeEDxbFd8p", "reviewer": "Reviewer_TCTa", "summary": "This study applies a well-established procedure from psychophysics, critical band masking, to an object recognition task on which human and a wide range of neural networks are compared.\nThe core finding is that while humans use roughly the same spatial frequency channels for object recognition as they do for e.g. letter / grating recognition, all 76 investigated neural networks use much wider channels (more than twice as wide as the human channel).\nThis means that humans and neural networks rely on different spatial frequencies for object recognition.", "questions": "### Questions:\n* What is going on with the two outlier observers in Figure 2 (1st column, bottom two rows)?\n* Given that some networks have severely reduced performance at 20% contrast, I'm wondering whether there might be a possible interaction of the experimental findings with the contrast level. As a supplementary experiment, it might be interesting to test the core findings separately for (a) networks which only show a minor performance detriment when reducing images to 20% contrast and (b) the rest of the networks.\n\n### Major opportunities for improvement:\n(The study is already quite solid, and I am in favor of publication. These suggestions go beyond what is currently done in the paper. If at least one of them can be addressed, I would be happy to increase my score further.)\n* \"we propose that critical band masking should be added to the toolbox of metrics for model-human comparison.\": I agree, and I was wondering whether the authors plan to facilitate this. For instance, they could release their stimuli as part of an open-source testbed (e.g., as a fork of  / addition to the model-vs-human toolbox, or in any other way).\n* The authors show that properties of critical bands are correlated with important properties like shape bias / adversarial robustness. Going beyond a correlation, I was wondering whether a causal link could be established, e.g. by reducing the signal-to-noise ratio of non-human channels in the input during training, leading to changed critical bands (e.g., more human-like ones), and then showing that the properties of interest (shape bias / adversarial robustness / ...) change accordingly.\n* The reasons for the human-model divergence are not yet understood. It would be interesting to know why this divergence arises, and whether it is a property of the architecture, the training procedure, or something else.\n\n\n### Minor questions:\n* line 86: should this be \"human object recognition\"?\n* why \"roughly equally distributed across all 16 categories\"? What was the exact distribution, and why was it not exactly equally distributed? (Background: performance can be above chance level 1/16 when categories aren't exactly equally distributed)\n", "limitations": "The authors don't have a section on limitations. In accordance with the checklist, the authors are encouraged to describe the limitations of their approach, in particular related to the experimental choices mentioned in the \"weaknesses\" section above.", "rating": 7, "confidence": 5, "soundness": 2, "presentation": 4, "contribution": 4, "strengths": "* Overall, I really liked this study - it has a simple yet effective protocol, clear findings, and approaches a novel question through sound experiments.\n* The proposed approach is applicable to the analysis of future networks, i.e. it is sufficiently general such that it can be used by follow-up studies / on general architectures\n* Successful transfer of psychophysical method to the study of neural networks\n* The paper is very well-written, easy to follow, clearly structured and has good visualizations\n* Human data will be made publicly available upon publication", "weaknesses": "Significance testing:\n* Figure 6 does not correct for multiple comparisons. I would like to know which of the plotted effects still hold after Bonferroni correction by dividing the alpha level (.05) by 18, i.e. the number of comparisons (6 plots x 3 fits), resulting in a corrected alpha level of 0.0027777. I would encourage the authors to update the figure with a corrected version.\n\nHuman experimental weaknesses:\n* In human visual perception, spatial frequency is measured in cycles per degree of visual angle and depends on the distance to the monitor. If I understand correctly, the setup is employed with unknown distance between observers and monitor.\n* No information on monitor calibration, which is very important in experiments where stimuli of reduced contrast are shown. E.g., many monitors have settings that \"enhance\" contrast, which is not unlikely to have an impact on human experimental performance. Did the authors take this into account?\n* Human experiments with reduced contrast are best performed in a setting where contrast adaptation can take place. In the present study, however, the screen constantly changes from grey to bright white and back to grey again.\n* Given the online study setup, how did the authors ensure normal / corrected-to-normal vision (beyond self-reporting, where online participants have monetary incentives for inaccurate reporting)?\n* Two of the 16 observers (supplementary Figure 2) do not seem to perform well at all on the simple task", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**Strengths:**\n\n>Overall, I really liked this study...\nThank you!\n\n**Weaknesses:**\n\n>Significance testing:\n\n>Figure 6 does not correct for multiple comparisons...\n\nDone. We applied the correction to our results and do not see any change in any of the results discussed in the paper. There were a few minor changes however, which are reflected in the modified figure Fig. 3 shown in the attached PDF.\n\n>Human experimental weaknesses:\n\n>In human visual perception, spatial frequency is...\n\nGood point. We estimate that the viewing distance of online observers varies over a 2:1 range, 40 to 80 cm because <40 requires an uncomfortable accommodative effort and >80 makes it impossible to reach a laptop keyboard. However, human vision, to a first approximation, scales with image size. Majaj et al. 2002 measured the tuning of spatial frequency channels as a function of letter size and found a slight deviation whereby the channel frequency slightly less-than-doubles ($2^{\\frac{2}{3}}$) when the letter size is halved. Thus, a large 2:1 variation in viewing distance will produce a small ($2^{\\frac{1}{3}}=1.26:1$) variation in channel center frequency in cycles per image. Thus, the uncontrolled variation in viewing distance contributed only slightly to the 2:1 bandwidth that we measured.\n\n>No information on monitor calibration...\n\nWe plan to add the following to Methods.\n\n*Nearly all of our online observers will have been looking at digital displays. The ICC specified standards for color management that require a provision of an ICC profile characterizing the properties of each display (including gamma and color primaries). The HTML <img command in all modern browsers invokes color management (if enabled) to display images faithfully. Thus, the computer screens will have varied in luminance from backgrounds of 200 to 500 nits but we expect contrast to have been accurate.*\n\n*Furthermore, even if the display gamma is other than assumed (because color management was not enabled), the too high or too low contrast will affect both signal and noise equally with practically no effect on signal-to-noise ratio (SNR). It is well established that the human energy threshold grows linearly with noise power spectral density so that when the noise is strong, doubling or halving display contrast hardly affects target recognition (Pelli & Farrell, 1999).*\n\n>Human experiments with reduced contrast...\n\nYes, it is true that the change of background luminance will change the level of light adaptation. However, our results depend on contrast, not luminance, and so will not be affected.\n\n>Given the online study setup, how did the authors...\nWe did ask our participants if they have normal or corrected-to-normal vision. In principle, one could measure acuity as a check. However, this is how most online vision studies are done.\n\n>Two of the 16 observers (supplementary Figure 2)...\n\nYes, good point. We have removed those two observers (9 and 13) from all analyses in the paper. Our main results remain the same.\n\n**Questions:**\n\n>What is going on with the two outlier...\n\nThanks for pointing this out. Answered above.\n\n>Given that some networks have severely...\n\nFig. 2 from the attached PDF will be added to the paper’s supplementary material and will be referenced in the main paper. This figure shows the percent correct values of each network we tested for each of 3 image conditions: color, gray, and low-contrast gray. Of the 88 networks available in our source datasets, 12 were below threshold for low-contrast gray images, which made them impossible to test on our critical band masking task. For the remaining 76, the change in performance from the color to gray to low-contrast gray condition is very small.\n\n>Major opportunities for improvement:\n\n>(The study is already quite solid...\n\n>\"we propose that critical band masking...\n\nYes, we strongly intend to do so in the near future.\n\n>The authors show that properties of...\n\n>The reasons for the human-model divergence...\n\nIndeed, we are very interested in examining how our results are influenced by training settings, and this is something we intend to pursue next. We will modify our Discussion and Conclusion sections as follows.\n\n*DISCUSSION: Every one of the 76 networks we tested has a wide critical band. We tested all the networks from Geirhos et al., 2021 which is the largest comparison of networks and humans on object recognition. The Geirhos study included most of the popular network kinds, spanning a wide range of conditions: convolutional networks and transformers, shallow and deep networks, supervised and self-supervised training, standard and adversarially-trained networks. Thus, the conclusions of this paper are based on a representative sample of popular network designs. More work is required to explore the effects of diverse kinds of training data and augmentation.*\n\n*CONCLUSION: … are based on a representative sample of popular network designs. More work is required to explore the effects of diverse kinds of training data and augmentation.*\n\n>Minor questions:\n\n>line 86...\n\nThis will be corrected in the revised manuscript, thanks.\n\n>why \"roughly equally distributed...\n\nWe say roughly distributed because the number of images in our testbed (1100) is not exactly divisible by 16. So we distribute 1088 (16 * 68) images equally and the remaining 12 are chosen at random from all categories. We will modify Methods to include this detail.\n\n**Limitations:**\n\n>The authors don't have a section on limitations...\n\nDone. We have added a discussion of limitations to the Conclusion section. Copied below.\n\n*While our results are based on a large, representative sample of popular network designs, more work is required to explore the effects of diverse kinds of training data and augmentations. Additionally, our current results are purely correlational, and such experiments would also help determine if the relationship between channel properties and robustness is also causal.*\n"}]

Author rebuttal:
Dear Reviewers kLx7, QrRK, 9K3N, vBv1 and TCTa

Thank you for your thoughtful reviews, with scores ranging from 4 to 10. The paper seems much improved by our efforts to respond to your questions and comments. We are particularly grateful for the explicit questions asking us how our work can be used by deep learning practitioners. Briefly, our paper provides evidence suggesting that efforts to robust-ify a network should look for ways to narrow its critical band. Most of you requested exposition of limitations and related work, which we now provide. Some of you also requested additional analyses of the statistical significance of our results, which we now provide. Reviewer TCTa had technical questions about online testing, to which we provide detailed responses addressing the concerns. We are planning to look at the influence of training and architecture on our results, similar to what reviewers suggested. Finally, as requested by two reviewers, data from two poorly performing participants was removed. Detailed responses follow.

Additionally, please find a PDF attached with helper figures. These are referenced and described in our individual responses to reviewers.

Finally, owing to lack of available space in individual responses, we post the modified Related work section as a common response to all reviewers.

**RELATED WORK**

**Spatial-frequency channels.** The visual system detects periodic patterns or gratings by means of parallel visual filters, each tuned to a band of spatial frequency (Campbell & Robson, 1968). Critical band masking  studies (Fletcher, 1940) revealed that the same single, narrow filter also mediates the recognition of letters (Solomon & Pelli, 1994; Majaj et al., 2002; Oruc & Landy, 2009), faces, and novel shapes (Oruc & Barton, 2010). Artificial neural networks also have frequency-based preferences. They are biased towards learning low-frequency functions (Rahaman et al., 2019) and prone to shortcut learning in both spatial and frequency domains (Geirhos et al., 2020; Wang et al., 2022). Existing work also suggests that robustness of a network is related to its spatial-frequency preferences (Wang et al., 2020; Li et al., 2023, Yin et al., 2019, Gavrikov et al., 2023, Abello et al., 2021).

**Shape bias.** Humans are well known to rely mainly on shape features for lexical learning and object recognition tasks (Landau, Smith & James, 1992; Geirhos et al., 2018). ImageNet-pretrained convolutional networks, on the other hand, are biased towards shape (Geirhos et al., 2018, Baker et al., 2018). Although imagenet-pretrained transformers, like humans, are shape-biased (Tuli et al., 2021), texture-vs-shape bias of networks is thought to be influenced mainly by training data and its augmentations rather than network architecture (Hermann et al., 2021).

**Adversarial robustness.** Adversarial attacks are small perturbations that cause inputs to be misclassified. (Szegedy et al., 2014, Nguyen et al., 2015). Although these perturbations are often imperceptible to humans, humans can in some cases decipher adversarial examples (Elsayed et al., 2018, Zhou & Firestone, 2019). Recent work suggests that adversarial robustness of networks relates to their spatial frequency tuning (Bernhard et al., 2021; Li et al., 2023, Maiya et al., 2021). 

**Comparing human and neural network vision.** The origins of deep learning are strongly tied to neuroscience (Fukushima, 1982) and the modern convolutional network architecture was inspired by properties of the primate visual cortex (Riesenhuber & Poggio, 1999). More recently, there have been parallel efforts both to use neural networks to improve models of visual neuroscience (Yamins & DiCarlo 2016, Khaligh-Razavi & Kriegeskorte 2016, Schrimpf et al., 2018) and to improve network robustness by taking inspiration from the human visual system (Dapello et al., 2020). These lines of work strongly rely on recent advancements in model-human comparison metrics which compare networks and humans across behavior (Geirhos et al., 2021, Feather et al., 2022) and neural representations (Schrimpf et al., 2018, Kriegeskorte et al., 2008).


Meta-review: In this paper, the authors examine the properties of image recognition systems in order to better understand their divergence from the human visual system. In particular, the authors focus on a well-established procedure from psychophysics, termed critical band masking, to measure the sensitivity to spatial frequencies for humans and deep neural networks. The authors find that humans recognize objects including letters and gratings within one octave of spatial frequency. Conversely, across 76 neural networks the authors find that the networks recognize objects using a much wider bandwidth (i.e. >2x in bandwidth). The result of this observation is that neural networks are more sensitive to noise and adversarial attacks in spatial frequency regimes in which humans are insensitive.

The authors further identify that the empirically observed channel properties of neural networks may explain a good fraction of shape bias (53%) and robustness in adversarially trained networks. The reviewers commented positively on the motivation and design of the experiments, the quality and strength of the results, and the clarity of presentation. The reviewers also identified some concerns about the applicability of these results to future network design, and the lack of related work in the paper. The authors agreed to add a Related Work section and discuss more about the applicability and impact of these results on future network designs. Given that unanimous consensus of the reviews, this paper will be accepted to this conference. I took the opportunity to review this paper as well and was impressed by the overall experimental design and the potential to provide an important direction for future research in computer vision. For these reasons, I have recommended this paper for an oral presentation.
Decision: Accept (oral)