Explicitly Modeling Subcortical Vision with a Neuro-Inspired Front-End Improves CNN Robustness
Authors: Lucas Piper
Arlindo L. Oliveira
Tiago Marques
Venue: NeurIPS 2025 poster ()
Keywords: Computational Neuroscience
Computer Vision
Object Recognition
Convolutional Neural Networks
Primary area: neuroscience_and_cognitive_science
TL;DR: We introduce Early Vision Networks (EVNets), hybrid CNNs combining biologically inspired subcortical and cortical front-end blocks, which improve V1 alignment and significantly boost robustness to different image perturbations.

Abstract: Convolutional neural networks (CNNs) trained on object recognition achieve high task performance but continue to exhibit vulnerability under a range of visual perturbations and out-of-domain images, when compared with biological vision. Prior work has demonstrated that coupling a standard CNN with a front-end (VOneBlock) that mimics the primate primary visual cortex (V1) can improve overall model robustness. Expanding on this, we introduce Early Vision Networks (EVNets), a new class of hybrid CNNs that combine the VOneBlock with a novel SubcorticalBlock, whose architecture draws from computational models in neuroscience and is parameterized to maximize alignment with subcortical responses reported across multiple experimental studies. Without being optimized to do so, the assembly of the SubcorticalBlock with the VOneBlock improved V1 alignment across most standard V1 benchmarks, and  better modeled extra-classical receptive field phenomena. In addition, EVNets exhibit stronger emergent shape bias and outperform the base CNN architecture by 9.3\% on an aggregate benchmark of robustness evaluations, including adversarial perturbations, common corruptions, and domain shifts. Finally, we show that EVNets can be further improved when paired with a state-of-the-art data augmentation technique, surpassing the performance of the isolated data augmentation approach by 6.2\% on our robustness benchmark. This result reveals complementary benefits between changes in architecture to better mimic biology and training-based machine learning approaches.

Explicitly Modeling Subcortical Vision with a Neuro-Inspired Front-End Improves CNN Robustness
Lucas Piper O Arlindo L. Oliveira e 22 Tiago Marques 3,4
INESSCID, Lisboa, Portugal
2 Instituto Superior Técnico, Universidade de Lisboa, Lishoa, Portugal Breastt Cancer Research Program, Champalimaud Foundation, Lisboa, Portugal "Faculdade de Medicina de Lisboa, Universidade de Lisboa, Portugal 1ucaspiper98ttecicco wtt.eniii.oouoso.o.oo.oooooooooe ulisboa.
Abstract
Convolutional neural networks (CNNs) trained on object recognition achieve high task performance but continue to exhibit vulnerability under a range of visual per- turbations and out-of-domain images, when compared with biological vision. Prior work has demonstrated that coupling a standard CNN with a front-end (VOneBlock) that mimics the primate primary visual cortex (V1) improve overall model robustness. Expanding on this, we introduce Early Vision Networks (EVNets), a class of hybrid CNNs that combine the VOneBlock with novel Subcortical- Block, whose architecture draws from computational models neuroscience and is parameterized to maximize alignment with subcortical responses reported across multiple experimental studies. Without being optimized to do so, the assembly of the Subcorticalllloc with the VOneBlock improved V1 alignment across most standard V1 benchmarks, and better modeled extra-classica receptive field phe- nomena. In addition, EVNets exhibit stronger emergent shape bias and outperform the base CNN architecture by 9.3% on an aggregate benchmark of robustness evaluations, including adversarial perturbations, common corruptions, and domain shifts. Finally, we show that EVNets can be further improved when paired with a state-of-the -ftott-----tttt art data augmentation technique, surpassing the performance of the isolated data augmentation approach by 6.2% on our robustness benchmark. This result reveals complementary benefits between changes in architecture to better mimic biology and training-based machine learning approaches.
Introduction
Convolutional neural networks (CNNs) have achieved remarkable performance across range of object recognition benchmarks [ 3 5) yet they remain vulnerable when faced with common corruptions (6), domain shifts [ and adversarial perturbations [10] IT]. These vulnerabilities
not only limit deployment in rorl-world settings but also underscore fundamental disparities between computer vision models and primate vision 8). In response, recent work has introduced biologically inspired models that integrate neuroscientific computations into CNN pipelines [12] 13 14 [6].
A prominent example is the VOneNet family [12]. which improves adversarial and corruption robustness by combining a biologically constrained front-end the VOneBlock - to conventional
CNN architectures. This block simulates processing in primate primary visual cortex (V1) via fixed-weight, empirically constrained Gabor filter bank (GFB), nonlinearities reflecting responses of V1 simple and complex cells, and neural noise generator. While VOneNets represent a key
Code and model weights available at htttpp////thhhhhhcco/////ppppppp
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

step towards neurally-aligned vision models, they abstract away the hierarchical processing in the early visual system, notably omitting subcortical circuits such the retina and lateral geniculate nucleus (I.GN). This raises the question of whether refining upstream processing to V1, by explicitly modeling subcortical processing, yields further gains in robustness and alignment with biology. To address this question, we present the following key contributions:
We introduce a novel fixed-weight CNN front-end called the SubcorticalBlock designed to capture key computations in the retina and the LGN. This module is instantiated from neuroscientific models and is explicitly parameterized to produce responses aligned with a broad set of experimentally observed subcortical response properties.
We introduce Early Vision Networks (EVNets), new class hybrid CNNs that combines two aeloogicall-ggoundde modules, the VOneBlock with the new SubcorticalBlock. as multi-stage front-end for standard CNN architecture.
We show that without any explicit optimization for VI predictivity, EVNets improve neural and behavioral alignment with primate vision, outperforming both standard CNNs and VOneNets across multiple benchmarks. In particular, EVNets capture extra-classics RF phenomena more accurately, increase VI tuning property alignment, and better mimic human inductive biases through stronger emergence shape bias.
We demonstrate that EVNets deliver enhanced robustness across a diverse battery of evalua- tions, including adversarial attacks, common image corruptions, and domain shifts, and that these gains generalize to other architecture back-ends.
We show that EVNets trained with state-of-the-ar (SOTA) data augmentation technique yield additive improvements in robustness, highlighting the complementary effects of architectural priors and baining-bbsed strategies.
1.1 Related Work
Modeling subcortical vision. The Difference-of Gaussian (DoG) model emerged as the foun- dational linear framework for characterizing spatial summation over the receptive field (RF) of subcortical cells 117 [8]. Subsequent extensions modeled extra-classical RF properties, including contrast gain control and surround suppression [19 20 Building on this, divisive normalization [21]
-fauussiae
22) and cascading linear-nonlinear (LN) models 23 improved subcortical predictivity by incorporat-
ing the interaction between different visual processing stages. More recently, CNNs outperformed prior models in predicting subcortical responses to visual stimuli [24].
Applications of subcortical vision. Beyond modeling subcortical vision, DoG-based filtering emerged as solution to edge detection [25], while Retinex theory (26) and lightness models (27] used spatial normalization to achieve color constancy. Subsequent frameworks such as scale-space representations (28) and multiscale Laplacian pyramids (29) generalized these computations into hi-
erarchical contrast and boundary encoding. Recent work has reintroduced these ideas into deep archi-
tectures, by embedding explicit center-surroune pathways for illumination-role
classification (30
and by unrolling Retinex-inspired optimization within CNNs for low-light image enhancement 31
Improving perturbation robustness. CNN robustness improvements have largely been driven by data augmentation techniques [32
33 34 To this end, standard benchmarks evaluate models
under image corrutiions (6) and alternative renditions 7 8 33 35 36 Recent work highlights that
composing augmentations 32
33 37),
especially when integrated with architectural changes [14),
forwards the SOTA under this regime. Notably, PRIME augmentation (34] samples semantically. aligned transformations from maximum entropy distributions. In parallel. the vulnerability of CNNs
to white-box adversarial perturbations has catalyzed extensive research [10 38 39 with adversarial
training emerging the dominant paradigm for improving robustness
10
Measuring alignment with primate vision. A growing suite of metrics has emerged to quantify
the alignment between models and the primate vision 40 41 42 43 Metries such as shape bias [8
have been instrumental in measuring model-human behavioral alignment, while parallel line of
research emphasizes representational alignment through the comparison of model tuning properties to 44 Complementing these efforts, the BrainScore platform 42
those observed in neural data 440

---

43 provides unified benchmark that integrates neural recordings and behavioral data across multiple visual cortical areas, including VI, V2, V4, and IT, alongside behavioral and task-driven metrics.
Building neuro-inspired models. Introducing biological computations into CNNs has consistently enhanced their robustness to input perturbations [12] [4] 13 16 45]. Gains have been observed with convolutional layers aligned to early visual RF' [15] 16], push-pull inhibition motifs inspired by
VI [14, 45). and by introducing the VOneBlock [2 13). Besides improving adversarial and corrup- tion robustness, VOneNets achieved improved accuracy in VI predictivity, and, when combined with VI divisive normalization. further sharpened alignment with VI response properties and corruption robustness [13 44). Finally, the systematic composition of hallmark VI computations into CNNs recently achieved SOTA performance on explaining VI predictivity and tuning properties [46]
2 Methods
Inspired by the hierarchical organization of early visual processing culminating in V1, we introduce EVNets, a new family of neuro-inspired CNNs that build upon the VOneNet framework. EVNets incorporate modular fixed-weight front-ends that reflects the functional stages of the early primate visual pathway (Fig- D This architecture comprises three key components: the SubcorticalBlock modeling response characteristies of foveal neurons in the retina and the L.N;; variant of the VOneBlock, which models classical RF properties of VI neurons; and a standard CNN back-end architecture. Together, the front-end blocks instantiate composite cascading LN model of carly cor- tical vision. EVNets adopt a spike-count formulation, abstracting over temporal dynamics, focusing solely spatial encoding. The EVNet operates over 7 field-of-ve view (FoV), reduced from the 8deg used in the original VOneBlock [12]. We also extend the GFB to higher spatial frequencies (SFs), improving alignment with the SF tuning properties of primate V1 [47] (ef. Supplementary Material A for an overview of VOneNets and our modifications). We trained three random seeds for both the VOneNet and the EVNet model families using ResNet50 back-end architecture. All models were trained on the ImageNet-11 k dataset L with clean accuracy evaluated on the standard validation split. Additional training details are provided in Supplementary Material E.4
2.1 Architecture
The SubcorticalBlock simulates spatial summation over the RF of parvocellular (P) and magnocellular (M) cells, processing them as separate parallel pathways. To account for both classical and extra- classical properties, each pathway comprises light adaptation stage, DoG convolutional layer, contrast normalization stage, and noise generator that simulates subcortical noise statistics.
DoG convolution. Spatial summation over the RF and center-surround antagonism modeled by incorporating set of DoG filters described by
(D, cxp (- x22 +t2) (k)) ( x22 _22++²²) r
+ r3
where r. and r, are the center and surround radii, and k k, is the peak contrast sensitivity ratio. We simulate biological color-opponent pathways characteristic of the different types of cells, with the P-cell stream incorporating red-green, green-red, and blue-yellow opponency, whereas M cells reflect achromaticity by incorporating a DoG filter with no color tuning [48] 49
Light adaptation. To mimic the subcortical mechanism of light adaptation [2] introduce a biologically inspired module that performs global luminance normalization. This trans- formation modulates the input x as
23 50
XLA
(2)
X
where XLA is the light-adapted input and the x denotes the average pixel intensity across channels and spatial dimensions of the input, ensuring null output for pixel values matching the global mean.
3

---

A
B
SubcorticalBlock
VOneBlock
VOneNet
LightAAdape.
DoG Convolution
Contrast Normalization
Neural Noise
Standard CNN layers
palliway
VOneBlock
EVNet
M pallwway
Standard layers
SubcorticalBlock
Fl Response
10?
P Cell
10
M Cell
10
10
10
0
3
0.0
0.5
1.0
Sputial Frequency [spd]
Radius [deg.]
Figure 1: Simulating primate early visual processing as CNN front-end blocks. The Subcor-
ticalBlock integrates two parallel processing pathways for P and M cells with light-adaptation layer, DoG convolutional layer, a contrast-normalizn normalization layer and a neural noise generator. B Both VOneNets and EVNets comprise initial block designed to simulate specific stage of the visual system, followed by a standard CNN architecture. VOneNets include a VOneBlock and EVNets include both Subcortical lock and VOneBlock. C SF, size, and contrast tuning curves (left to right) for two example subcortical neurons with example frames from the drifting gratings stimulus set shown below. Markers indicate the Fl component of the cell response and the solid line depicts the fitted response functions used for parameterizing response properties (cf. Supplementary Material E..)). Notably, the SubcorticalBlock exhibits hallmark LGN phenomena, including contrast saturation and surround suppression, with stronger modulation observed in M cells.
Contrast normalization. To model the adaptive gain control mechanisms characteristic of early visual processing [21] 22, 23 23 51 52], we introduce a contrast normalization stage that normalizes activations by local estimate of stimulus contrast. The normalized response is computed by
XDoG
XCN
(C50 + XDoo x WCN
where XDoG denotes the pre-normalized activation, Wen is a Gaussian kernel defining the contrast integration pooling window, cso semi-saturation constant controlling sensitivity, and governs the strength of the nonlincarity.
Push-pull pattern. The canonical push-pull pattern, emerging from the antagonistic interaction between ON- and OFF-center cells in early visual circuits, can be functionally approximated by subtracting rectified responses opposite polarity pathways [53 54]. Assuming ON and OFF cells of the same type share identical spatial profiles and gain, their Ris differ only in polarity. Under this assumption, since Equation B amtisymmetric with respect to Xpoo, the contrast-non nontaasz--ommllzeed responses of the ON and OFF pathways, x would satisfy x -XeN Thus, applying rectification to both signals and computing their differences gives
+
max (x 0) .max( - xtxx 0) xtx
(4)

---

Accordingly, our implementation bypasses explicit rectification and subtraction steps. instead operat- ing directly on the signed contrast normalizee signal improve computational efficiency without sacrificing functional fidelity.
Noise Generator. Neuronal responses in the primate visual system exhibit trial-to-trial variability with distinct stochastic signatures across processing stages. In VI, spike count variability closely follows Poisson distribution, where the variance is equal to the mean, corresponding a Fano Factor equal to one [55]. Conversely, subcortical neurons exhibit sub-Poisson variability, characterized by a spike count variance lower than the mean [56] 57 To faithfully capture this hierarchical structure of neural noise, we implement a dual-source noise injection mechanism in which we add independent Gaussian noise to each unit of both front-end blocks scaled accordingly. This noise calibrated at the unit level to maintain an overall variability with a unit Fano factor, while trial-to-trial activations at the VOneBlock output exhibit heteroskedasticity consistent with VI measurements (55). Prior to noise injection, unit activations are linearly rescaled such that their mean response to a stimulus aligns with the empirically observed spike count of the corresponding primate neuronal population over 50-ms ms integration window [12
2.2 Babberrtical-Aligninn Parameterization
Despite the wealth of empirical data on primate LGN and the existence of various fitted models [2] 22 23 51 52). the heterogeneity of modeling approaches across studies limits the direct reuse of parameters in the SubcorticalBlock, while complicating synthesis from the broader literature. To address this, we introduce a novel suuroppysioooggiallyoonsttann designed to produce responses that best match the mean neuronal response properties of an LGN neuronal population taken from prior studies and modeling strategies. Specifically, we selected a total of N 6 different response property distributions measured at foveal LGN to ensure alignment in SF tuning, size tuning, and contrast sensitivity. The individual properties are: center, surround, excitation and inhibition radii [18 58 59]. suppression index (58) and saturation index (51).
hyperparameter tuning strategy
We conducted series of silico experiments, presenting each cell with drifting gratings, quantifying each response property through the first harmonic (FI) of the cell's response. We then performed hyperparameter search via Bayesian optimization [60]. minimizing the loss
(f,().)) Fj
)
loga
For each response property i, Fr is the mean of the empirical response property distribution, f,. is a vector of Fl responses produced by the SubcorticalBled cell when subjected to the experiment- specific stimulus set, and R, maps the Fl responses the response property. This mapping often involved an intermediate model-fitting step, with the response property computed from the fitted parameters. Figure [C shows the F1 responses of both P and M cells, example frames of the stimulus set used for each experiment and response model curves obtained at convergence (cf. Supplementary Material E.2 for in-depth description of experiment methodology).
2.3 Model Evaluation
Alignment with primate vision. Shape bias was measured using a cue-conflict dataset [ that combines shapes and textures of ImageNet samples using style transfer (61). To quantify the correspondence between model internal representations and V1 responses, we assessed the activations from the first block of each model using two complementary BrainScore 442 43 benchmarks: V1 neural predictivity [41] and V1 response property (40). V1 neural predictivity evaluates the degree to which model features can account for the variance in primate V1 responses via partial least squares (PLS) regression. In contrast, VI response property quantifies RF tuning similarity by comparing the distributions of 22 response properties, extracted from the same first-block activations, to empirical VI distributions. These properties span functional categories: orientation and SF tuning, response selectivity, RF size, surround modulation, texture modulation, and response magnitude.
To quantify robustness, we report a mean Robustness Score, defined as the mean 1 accuracy across diverse set of common corruptions, adversarial attacks, and domain
Robustness evaluation.
5

---

shifts. To assess whether EVNets offer complementary gains to SOTA robustness training methods, we trained a standard ResNet50, VOneResNet50 and an EVResNet50 using PRIME (34). We included adversarial training with an Tix constraint of 0c 4/255 62 (AT I. as baseline.
Image corruptions. We evaluated model corruption robustness by measuring top-1 accuracy on the ImageNet-C dataset [6], which comprises 75 distinct corrupted variants of the ImageNet validation set. These corruptions are organized into 15 types applied five severity levels, reflecting a specific real-world image degradation. The corruption types are further grouped into four broad categories: noise, blur, weather, and digital perturbations.
Domain shifts. To assess each model's generalization under domain shifts, we averaged top- 1 accuracies across five ImageNet-derived datasets that focus on renditions partially address- able by early visual processing mechanisms. Specifically, we used ImageNet-R R [33], ImageNet- Cartoon (35], ImageNet-Draaeee Drawing [35], ImageNet-Skett [36]. and the 16-class Byylized-ImageNe [7] 8] (Stylizedıe- (-irredee--maeNNe))) Each dataset introduces representational changes such as abstraction, stylization, or domain-specific distortions while preserving the underlying semantic structure.
Adversarial attacks. Following Dapello et al. (12). we evaluated robustness to white-box adversar- ial attacks by applying untargeted Projected Gradient Descent (PGD) [T0] on 5000 images of the ImageNet validation set. Attacks were carried out under L... L2 and L, norm constraints and the per- turbation budgets used were |0|| E [1/1020, 1/255, 4/255, 16/255]. ||ól|2 E [0.15, 0.6, 1.2, 2.4] and ||ōl| E [40, 160, 640, 2560]. We used 64 PGD iterations with step size of | Additional implementation details are provided in Supplementary Material C.I
EVNet variants. We trained seven EVResNet50 variants derived from the full EVNet by performing six targeted ablations and one architectural addition (two seeds each). The ablations individually removed the P- and M-cell pathways, the contrast normalization and light adaptation layers, the VOneBlock, and the subcortical noise generator. When removing subcortical noise, cortical noise in the VOneBlock output was amplified to remain VOneNet [12). The final variant introduced an IGN-V2 skip connection (63] by concatenating the SubcorticalBlock output with the VOneNet bottleneck. While all EVResNe150 variants were tested for primate vision alignment and robustness, adversarial evaluations were restricted to a reduced attack set including only the two weakest perturbation strengths of each norm constraint.
consistent with the original
Additional experiments. To test whether improvements in adversarial robustness were not due to gradient masking (38). we performed battery of controls according to the best practices [38] 39
64) (cf. Supplementary M..e) We further evaluated the generalization of EVNet front-ends across back-end architectures by integrating them with EfficientNet-BOO (5) and CORnet-Z (65) (cf. Supplementary Material [D.2). Finally, we assessed performance gains from multi-pass ensemble
inference in Supplementary Material D.3
3 Results
3.1 EVNets Improve Neuronal and Behavioral Alignment with Primate Vision
We evaluated whether coupling the SubcorticalBlock with the VOneBlock improved alignment with primate V1. As illustrated in Figure 2 the inclusion of the SubcorticalBlock upstream of the VOneBlock introduces hallmark extra-classical RF response properties absent from the VOneBlock alone. In particular, we observe an increased surround suppression in the size tuning curve and a non-linear contrast-sensitivity curve.
Motivated by these observations, we used the BrainScore platform 42 43 to quantitatively evaluate V1 alignment. As shown in T while VOneNets outperform in predictivity, EVResNet50 achieves a higher mean response property score than both the ResNet50 and VOneResNet50 models. Notably, the highest gains are observed for the surround modulation and RF size tuning, both associated with the increased surround suppression. tradeoff SF tuning is observed, which can be attributed to the fact that changes were done to the GFB to account for the upstream processing.

---

Response (V) neuroa)
204
10
VOneNet
EVNet
10
0
0-
10
10"
10'
0.5
1.0
Spatial Frequency [epd]
Radius [deg]
Contrast
Figure 2: Subcortical preprocessing improves explanability of extra-classical RF properties in VI. SF, size, and contrast tuning curves (left to right) for an example neuron in the VOneBlock with and without subcortical preprocessing (M cell). Example frames from the drifting gratings stimuli are shown below. VOneBlock neurons in isolation exhibit predominantly classical RF effects but when coupled with subcortical processing exhibit behaviors consistent with those empirically observed, such enhanced surround modulation and non-linear contrast responses 66 67] Material B.1 for empirical V1 tuning curves.
See Supplementary
Table 1: EVResNet50 outperforms baselines on mean V1 response property alignment, and shape bias. BrainScore 42
43 V1 alignment scores and shape bias 8 for ResNet50, VOneRes-
Net50, and EVResNe150. Values indicate mean + SD (n = seeds).
V1 Response Properties
VI
VI Resp. Prop.
Orient. Tuning
SF Tuning
RF
Surround Mod.
Texture Mod.
Resp. Select.
Resp. Magn.
Shape
Model
Predict.
Size
Bias [%]
ResNet50
.211
.637
.822
.754
.214
.399
.792
.621
.865
18.8
4:00
+12
VOmeResNet50
.375
.754
.859
.969
.482
.373
.919
.792
.884
31.6
1.006
1.085
1.401
1.041
1.003
1.044
1.403
1.00
1122
EVResNet50
.364
.826
.854
.900
.726
.614
.916
.781
.933
48,9
000
1:000
4:00
4:000
2:00
:1.084
4:001
2:000
2:00
124
Among the suit of primate visual behavior alignment metrics, shape bias has emerged as particularly informative proxy human-aligned inductive biases and out-of-domain (OOD) generalization (78 Motivated by the hypothesis that shape bias may originate in early visual computations, shape bias in EVNets (Tab. D and observed substantial increase 30.1 50.1% % relative to the standard ResNet50 and of 17.3% relative to the VOneNet model. suggesting that EVNets may confer not only improved neuronal alignment but also behavioral traits more consistent with primate perception.
evaluated
3.2 EVNets Improve Robustness Across an Aggregate Benchmark
When tested on clean images (Tab. 2p. our VOneNets variant achieves 1.2% improvement over the original VOneNet [12], while EVNets displayed a performance drop of 1.3%, when compared to the same reported accuracy. We further examined whether the increased alignment EVNets with primate vision, also leads to improved robustness.
Image corruptions. Across most corruption categories and in terms of mean corruption accuracy, EVNets consistently outperformed both VOneNets and the base ResNet50, which only retained an advantage in weather corruptions. Notably, the most pronounced gains were observed on noise corruptions, where EVNets outperformed VOneNets by 3.7% while effectively preserving the same cumulative Fano factor as VOneNets (cf. Fig. C4 for accuracy across individual corruptions).
Domain shifts. Table TableJss our OOD generalization results. EVNets consistently outper- forms both the baseline ResNet50 and VOneNets across the majority of benchmarks, also surpassing these baselines on the mean domain shift accuracy. The only dataset where EVNets underperform ImageNet-Sketch, where the base ResNet50 exhibits marginal advantage.

---

Table 2: EVResNet50 outperforms baselines on most image corruption types and on mean corruption accuracy. Clean and corrupted top-1 accuracies averaged across severities and corruptions for ResNet50, VOn5ResNet50 and EVResNet50. Values indicate mean = SD (n = 3 seeds).
Corruption Types
Mean [%]
Noise [%]
Blur
Weather [%]
Digital [%]
Clean [%]
Model
[%]
ResNet50
38.8
29.2=006
34.61004
36.1+
49.5
75.4
VOneResNet50
40.4
35.9=0.5
34,8+0.1
32.6#0.1
52.2
72.9+0.1
EVResNet50
41.9
39.6
37.5
30.640.2
53.5...1
70.4
Table 3: EVResNet50 outperforms baselines on most domain shift datasets and on overall mean domain shift accuracy. Top-1 accuracies on ImageNet- SrngeNet-(Cartonn, Cartoon, Drawing. R, Sketch, Stylizedis! for ResNet50, VOneResNet50 and EVResNet50. Values indicate mean = SD (n = 3 seeds).
Mean [%]
Cartoon [%]
Drawing [%]
Sketch [%]
Stylizedıe [%]
Model
[%]
ResNet50
33.4.002
51.2.0.7
20.910.6
35.410.
23.31:0.1
36.311.2
VOneResNet50
37.1104
55.5
30.510.4
37.510.
23.1
38.8
EVResNet50
38.1
57.1
33,9
38.1
22.7+02
38.6+1.1
Adversarial attacks. EVNets improves adversarial robustness across most perturbation norms and attack strengths when compared to VOneNets (Tab. While VOneNets obtained marginal advantage under the weakest attack strengths for Lo and L2 norm constraints, EVNets improved ro- bustness the remaining attack settings, exhibiting also smaller gap between clean and adversarial accuracy.
Table EVResNet50 outperforms baselines on most adversarial perturbations and on mean adversarial robustness. Top-1 accuracies for the ResNet50, VOneResNet50 and EVResNet50 models. Values indicate mean + SD (n 3 seeds).
||]||
||0||
[|б]]
Mean [%]]
160
640
2560
1026 [%]
Model
[%]
[%]
[%]
[%]
[%]
[%]
[%]
[%]
[%]
[%]
[%]
ResNet50
8,3
23.4
0.4
0.2
0.2
37.2
1.8
0.2
0.2
33.6
1.7
0.2
0.2
VOneResNet50
26.1
62.6
30.4
1.2
0.0
66.2
42.3
4.2
0.0
64.5
37.3
3,9
0.0
1:0.1
20.4
20.33
20..1
=0.0
1003
20.22
20.1
::0.0
1:.6
40.2
20.0
EVResNet50
28.3
62.7
64.0
0.0
::0.2
2:0.2
1:0.6
1:0.1
1:000
=0.0
2:0.3
1.8
1:0.0
1.0.2
110.4
111.8
20.0
Table 5 summarizes all the robustness results described above and presents the Robustness Score for the evaluated models. The EVResNet50 model improves the Robustness Score by 9.3% over the base ResNe150 and by 1.6% over our VOneNet variant.
3.3 Combining EVNets with Data Augmentation Provides Cumulative Gains
In evaluation of the Robustness Score for the EVResNet50 with PRIME data augmentation (Tab. 5)). we find that this combined strategy yields cumulative performance gains beyond those of either component alone. Furthermore, when comparing these results with those obtained by augmenting a ResNet50 with adversarial training and augmenting a VOneNet with PRIME, no configuration surpasses the additive gains achieved by the EVResNet50 trained with PRIME.
3.4 EVNet Variants Reveal Competing Drivers of Primate Vision Alignment and Robustness
Selective ablation of specific SubcorticalBlock components affected primate vision alignment in different aspects (see Supplementary Material D.I. The components that caused a greater drop in V1

---

Table 5: EVResNet50 achieves higher Robust Score than ResNet50 and VOneResVet50 and, when coupled with PRIME, surpasses SOTA data augmentation approaches. Robustness Score, clean and perturbed top-1 accuracies for the ResNet50, VOneResNet50 and EVResNet50 models; for ResNet50 with two data augmentation approaches: , and PRIME; and for VOneResNet50 and EVResNet50 with PRIME. Values indicate mean + SD (n 3 seeds).
Perturbations
Robust. Score
Adversarial [%]
Corrupt. [%]
Domain Shift [%)
Clean
Model
[%]
[%]
ResNet50
26.8
8.34002
39. 10.3
33.340.1
75.4
VOneResNet
34.5
26.1
40.4
37.1
72.940.
EVResNet50
36.1:002
28.31.02
41.91002
38.110.3
70.4
ResNe150 + A.
662
34.4
31.3
32.5
39.5
62.4
ResNet50 + PRIME
36.510.1
14.3.00
52.6102
42.8
76.0
VOneResNet50 PRIME
42.1
28.7+0.3
53.410.0
44.3
74.0+0.1
EVResNet500 PRIME
42.7.102
30.7+008
53.240.1
44.240.1
72.0+0.1
response property benchmarks were the M-cell pathway and the contrast normalization, which greatly affected the RF size and surround modulation. Surprisingly, removing either the P-cell pathway or light adaptation greatly increased shape bias.
Table Model components contribution to robustness vary greatly. Robustness Score, clean and perturbed top-1 accuracies for all EVResNe150 variants. ResNet50 and VOneResNet500 included for reference but not in the comparison. Values indicate mean + SD (n 2 seeds).
Perturbations
Robust. Score* [%]
Adversarial" [%]
Corrupt. [%]
Domain Shift [%]
Clean [%]
Model
ResNet50
29.5+103
16.4
39.1
33.3
75.4
VOneResNer50
42.740.1
50.5
40.420.
37.1
72.940.0
EVResNet50
44.640.1
53.8
41.9+0.2
38.1
70.5
P Cells
38.41000
46.7=0.2
34.9+0.1
33.62000
60.7+0.1
M Cells
44.8=t01
54.0=0.2
42.2+0.1
38.2+0.3
70.3
Light Adapt.
44.3+003
55.1=0.5
40.4+0.2
37.4
69.8=002
Contrast Norm.
44.4+02
53.5=0.1
41.7=0.4
38.0+0.1
70.7=0.0
Subcort. Noise
42,6+000
48.5=0.1
41,9+02
37.4=0.1
72.6=002
VOneBlock
44.3
51.8
42.7
38.210.1
71.610.00
+ LLG-V222222 V2 Connect.
44.8
53.9=0.
42.1
38.3
70.7
CComputed with reduced attack perturbations per constraint); comparable Table
In terms of performance, the single component that had the largest impact on both clean accuracy and robustness the P-cell pathway (Tab.(6), On the other hand, removing the M-cell pathway or contrast normalization had no impact on clean accuracy and robustness. Light adaptation had only minor effects on specific robustness benchmarks and small drop in clean accuracy. Removing subcortical stochasticity improved clean accuracy while decreasing adversarial robustness. Interest- ingly, the omission of the VOneBlock barely affected overall robustness, revealing even to be the best variant under image corruptions and an improvement in clean accuracy, accompanied by a small drop in adversarial robustness. The inclusion of LGN- V2 skip connections had little no impact in performance across all perturbations types and clean images.
4 Discussion
In this work, we present new family of neuro-inspired CNNs that not only display enhanced robust- ness across a broad spectrum of perturbations also achieve stronger alignment with primate vision. Previous works have incorporated biologically inspired mechanisms such DoG filtering [15 16

---

30J. divisive normalization [3 68]. and noise injection [37] within CNN architectures. In contrast, our SubcorticalBlock introduces a principled segregation of computations into parallel P- and M-cell pathways constrained by prior empirical neurophysiological findings. The EVNet architecture intro- duces a modular, cascading model of V1 that incorporates stage-specific architectural priors, offering a compelling alternative to V1 Vi-inspired CNN paradigms. The V V1-alignment improvements observed in EVNets are most pronounced for surround modulation and RF size. These effects likely arise from the normalization mechanisms within the SubcorticalBlock, which induce local competition and lead to extraclassical RF responses not present in VOneNets. Despite these improvements, benchmark scores for surround modulation and RF size are still relatively low, suggesting that normalization mechanisms at the V1 level, either caused by recurrent or feedback circuits, are also needed for a better alignment [3 68). J. While EVNets do not entirely solve the longstanding problem of robust generalization, our results also underscore the critical importance of subcortical processing in shaping early visual representations: while the DoG filtering improves features selectivity, performs low-pass filtering, mitigating high-frequency noise, the normalization layers promote local competition and dynamic range compression, reducing sensitivity to input perturbations. Notably, we demonstrate that meaningful improvements to VI modeling can be achieved by exclusively refining upstream stages. The cumulative gain shown by combining the SubcorticalBlock with the VOneBlock reveals a poologically-plausibe
potential for compositionality in inductive biases, where each module targets distinct axes of visual invariance, together producing synergistic improvements in perturbation robust- ness. Specifically, while the SubcorticalBlock primarily encodes invariance to luminance and contrast, the VOneBlock focuses more on spatial and polarity invariance. Finally, we show that integrating colloicalll-inspiree architectures with standard data augmentation techniques leads to synergistic improvements in robustness, surpassing data augmentation alone and adversarial training, the most effective methods for improving adversarial and corruption robustness. Together, these results provide further evidence that reuroscience-driver inductive biases and machine learning heuristics are not mutually exclusive, but can in fact be complementary.
While the observed robustness gains are compelling, there are also some trade-offs. Specifically, our model abstracts subcortical processing by instantiating only four channels that reflect the aver- age spatial response profiles observed in the LGN, rather than capturing the full heterogeneity of subcortical cells. An interesting observation is that the M-cell pathway contributes marginally to downstream performance, which is in line with the classical view of M cells small contribution the ventral stream. However, this result presents some inconsistencies with more recent literature [69]. Additionally, enhancements in perturbation robustness are consistently accompanied by modest reductions in clean image accuracy, a common tension in robustness research [12] [4]. Beyond these considerations, subsequent work could examine the possibility of initializing from neuro-inspired weights while allowing task-driven fine-tuning of the front-ends used, For VI alignment, we kept the VOneBlock unchanged as upstream processing minimally affected its responses aside from the improved extra-classical RF effects. However, the slight drop in V1 aligmment on some benchmarks likely reflects unforseen interactions between modules. Future work could adapt the GFB to account for subcortical preprocessing and add normalization mechanisms at the VI level to evaluate if these changes further enhance alignment and robustness. Finally, while our approach may seem to contrast the "Bitter Lesson" (70). the trajectory of neurally aligned vision tells a more nuanced story. Prior work indicates that scaling alone does not yield more brain-like representations (71), and large-scale benchmarks (72) show that neural alignment with primate visual cortex saturates with model size aarchitectures with stronger biological priors often align better than transformers. Our work lever- ages this insight by embedding early vision-inspired inductive biases to achieve the efficiency and alignment characteristic of biological vision.
Broader impact. This work advances computer vision by proposing a biologically grounded alternative to vision transformers (73). By simulating early vision, we bridge the gap between human and machine vision, improving robustness, transparency, and interpretability, with potential benefits for bias reduction and accessibility. Fully replicating human vision remains challenging and calls for further research. We acknowledge that some foundational insights stem from animal studies, emphasizing the ethical responsibility to minimize harm and favor alternative approaches. Leveraging existing biological data, as done here, may reduce reliance on new animal experimentation.
10

---

Acknowledgments
This work was supported by the project Center for Responsible Al reference no. C628696807- 00454142, and by national funds through Fundação para a Ciência a Tecnologia, L... (FCT) under projects UID/50021/2025 and HDD/PRRR/0021/2022 We thank Ajani Stewart, Joel Dapello and James J. DiCarlo for initial explorations on the architectural space of EVNets, and Kartik Pradeepan for assistance in using the BrainScore benchmarking platform.
References
[1] Alex Krizhevsky, Ilya Sutskever, and Geoffrey E Hinton. "ImageNet Classification with Deep Convolutional Neural Networks". In: Advances in Neural Information Processing Systems. Ed. by Pereira, C.J. Burges, Bottou, and K.Q. Weinberger. Vol. 25, Curran Associates, Inc.. 2012.
[2] Karen Simonyan and Andrew Zisserman. "Very Deep Convolutional Networks for Large-Scale Image Recognition". In: Computational and Biological Learning Society, 2015, pp. 1-14. [3] Christian Szegedy, Wei Liu, Yangqing Jia, Pierre Sermanet, Scott Reed, Dragomir Anguelov, Dumitru Erhan, Vincent Vanhoucke, and Andrew Rabinovich. "Going deeper with convolu- tions". In: 2nd International Conference on Learning Representations, ICLR 2014, Banff. AB, Canada, April 14-16, 2014, Conference Track Proceedings. 2015, pp. 1-9.
[4] Kaiming He, Xiangyu Zhang. Shaoqing Ren, and Jian Sun. "Deep Residual Learning for Image Recognition". In: 2016 IEEE Conference Computer Vision and Puttern Recognition (CVPR). 2016, pp. 770-778.
[5] Mingxing Tan and Quoc Le. "EfficientNet: Rethinking Model Scaling for Convolutional Neural Networks". In: Proceedingy of the 36th International Conference on Machine Learning. Ed. by Kamalika Chaudhuri and Ruslan Salakhutdinov. Vol. 97. Proceedings of Machine Learning Research. PMLR, June 2019, pp. 6105-6114.
[6] Dan Hendrycks and Thomas Dietterich. "Benchmarking Neural Network Robustness to Com- mon Corruptions and Perturbations". In: International Conference on Learning Representa- tions. 2019.
[7] Robert Geirhos, Kantharaju Narayanappa, Benjamin Mitzkus, Tizian Thieringer, Matthias Bethge, Felix A. Wichmann, and Wieland Brendel. "Partial success in closing the gap between human and machine vision".. In: Advances Neural Information Processing Systems. Ed. by A. Beygelzimer, Y. Dauphin, P. Liang, and Wortman Vaughan. 2021.
[8] Robert Geirhos, Patricia Rubisch, Claudio Michaelis, Matthias Bethge, Felix Wichmann, and Wieland Brendel. "ImageNet- CNNs are biased towards texture; increasing shape bias improves accuracy and robustness." In: International Conference on Learning Represen- tations. 2019.
[9] Robert Geirhos, Kristof Meding, and Felix A. Wichmann. "Beyond Accuracy: Quantifying Trial-by-Trial Behaviour of CNNs and Humans by Measuring Error Consistency".. In: Proceed- ings of the 34th International Conference Neural Information Processing Systems. N0. Vancouver, BC, Canada: Curran Associates Inc., 2020. ISBN: 9781 118171382956...
[10] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. "Towards Deep Learning Models Resistant to Adversarial Attacks". In: International Conference on Learning Representations. 2018.
[11] Ian Goodfellow, Jonathon Shlens, and Christian Szegedy. "Explaining and Harnessing Adver- sarial Examples". In: International Conference on Learning Representations. 2015.
[12] Joel Dapello, Tiago Marques, Martin Schrimpf, Franziska Geiger, David Cox, and James J DiCarlo. "Simulating a Primary Visual Cortex the Front of CNNs Improves Robustness to Image Perturbations" In: Advances in Neural Information Processing Systems. Ed. by H. Larochelle, M. Ranzato, R. Hadsell, M.F. Balcan, and H. Lin. Vol. 33. Curran Associates, Inc., 2020, pp. 13073-13087.
[13] Andrew Cirincione, Reginald Verrier, Artiom Bic, Stephanie Olaiya, James J. DiCarlo, Lawrence Udeigwe, and Tiago Marques. "Implementing Divisive Normalization CNNs Im- proves Robustness to Common Image Comuptions". In: SVRHM 2022 Workshop @ NeurIPS. 2022.

---

[14] Guru Swaroop Bennabhaktula, Enrique Alegre. Nicola Strisciuglio, and George Azzopardi. "PushPull-Net: Cuabiition-Driverr ResNet Robust to Image Corruptions". In: Pattern Recog- nition: 27th International Conference, ICPR 2024, Kolkata, India, December 1-5, 2024, Proceedings, Part VIII. Kolkata, India: Springer- Verlag, 2024, 391-914008 ISBN: 978-3-031-
78185-8. DOT: 10. 1007/008-7----1-0 031---0------1-00 78186-5-22
[15]
Benjamin D. Evans, Gaurav Malhotra, and Jeffrry S. Bowers. "Biological convolutions improve DNN robustness to noise and generalisation". In: Neural Networks 148 (2022), pp. 10. ISSN: 0893-6080.
[16] Akhilesh Adithya, Basabdatta Sen Bhattacharya, and Michael Hopkins. "Robustness of Filter-Basee Based ConvNet to Signal Perturbation" In: Artificial Neural Networks and Machine Learning ICANN 2023. Ed. by Lazaros Iliadis, Antonios Papa- leonidas, Plamen Angelov, and Chrisina Jayne. Cham: Springer Nature Switzerland, 2023,
pp. 394-406. ISBN: 378-3-031-44204
[17] Stephen W. Kuffler. "Discharge Patterns And Functional Organization Of Mammalian Retina".
In: Journal of Neurophysiology 16.1 (1953). PMID: 13035466, pp. 37-68.
[18] W. Rodieck. "Quantitative analysis of cat retinal ganglion cell response to visual stimuli".
In: Vision Research 5.12 (1965), pp. 381-601. ISSN: 0042-6989.
[19] R M Shapley and J D Victor. "The effect of contrast on the transfer properties of cat retinal ganglion cells." " In: The Journal of Physiology 285.1 (1978), pp. 275-298.
[20] Samuel G. Solomon, Barry B. Lee, and Hao Sun. "Suppressive Surrounds and Contrast Gain
in Magnocellular-Pattwwa Retinal Ganglion Cells of Macaque". In: Journal of Neuroscience 26.34 (2006), pp. 87 8715-8726. ISSN: 0270-6474.
[21] Matteo Carandini and David J. Heeger. "Normalization as canonical neural computation". In: Nature Reviews Neuroscience 13.1 (Jan. 2012), pp. 51-62. ISSN: 1471-0048.
[22] Vincent Bonin, Valerio Mante, and Matteo Carandini. "The Suppressive Field of Neurons in
Lateral Geniculate Nucleus". In: Journal of Neuroscience 25.47 (2005), pp. 10844 10856. ISSN: 0270-6474.
[23] Valerio Mante, Vincent Bonin, and Matteo Carandini. "Functional Mechanisms Shaping Lateral Geniculate Responses to Artificial and Natural Stimuli". In: Neuron 58.4 (2008), pp. 625-638, ISSN: 0896-6273.
[24] Lane T. McIntosh, Niru Maheswaranathan. Aran Nayebi, Surya Ganguli, and Stephen A. Baccus. "Deep learning models of the retinal response to natural scenes". In: Proceedings of the 30th International Conference on Neural Information Processing Systems. NIPS' 16. Barcelona, Spain: Curran Associates Inc., 2016, pp. 1369-1377. ISBN: 1083881...
[25] David Marr and Ellen Hildreth. "Theory of Edge Detection".. In: Proceedings of the Royal Society of London. Series B. Biological Sciences 207.1167 (1980), pp. 187-217. Dor: 10
1098/ 0098/rspb.. 1980. 0020
[26] Edwin H. Land and John J. McCann. "Lightness and Retinex Theory". In: J. Opt. Soc, Am. 61.1 (Jan. 1971), pp. 1-11. DOI: 10. 1364/JOSA, 61. 000001
[27] Berthold K.P. Horn. "Determining lightness from an image". In: Computer Graphics and
Image Processing 3.4 (1974), pp. 277-299.
ISSN: 0146-664X. DOI: htttt::://ai..rrg//et/
1016/0146- 6646 (74)
[28] J. J. Koenderink and A. J. van Doorn. "Representation of local geometry in the visual system"
In: Biologicul Cybernetics 55.6 (Mar. 1987), pp. 367-375. ISSN: 1432-0770. DOI: 10 1007/
BF00318371
[29] P. Burt and E. Adelson. "The Laplacian Pyramid Compact Image Code". In: IEEE Transactions on Communications 31.4 (1983), pp. 532-540. DOI: 10. 1109 /COM.. 1983
1095851
[30] Zahra Babaice, Ramin Hasani, Mathias Lechner, Daniela Rus, and Radu Grosu. "On-Off Center-Surrount Receptive Fields for Accurate and Robust Image Classification". In: Pro- ceedings of the 38th International Conference on Machine Learning. Ed. by Marina Meila and Tong Zhang. Vol. 139. Proceedings of Machine Learning Research. PMLR, July 2021, pp. 478-489.
[31] Liu Risheng, Ma Long. Zhang Jiaao, Fan Xin, and Luo Zhongxuan. "Retinex inspire Un- rolling with Cooperative Prior Architecture Search for Low-light Image Enhancement". In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition. 2021.
12

---

[32] Dan Hendrycks*, Norman Mu*. Ekin Dogus Cubuk, Barret Zoph. Justin Gilmer, and Balaji Lakshminarayanan. "AugMix: A Simple Method to Improve Robustness and Uncertainty under Data Shift". In: International Conference on Learning Representations. 2020.
[33] Dan Hendrycks, Steven Basart, Norman Mu, Saurav Kadavath, Frank Wang. Evan Dorundo, Rahul Desai, Tyler Zhu, Samyak Parajuli, Mike Guo, Dawn Song, Jacob Steinhardt, and Justin Gilmer. "The Many Faces of Robustness: A Critical Analysis of Out-of-Distribune Generalization". In: 2021 IEEE/CVF International Conference on Computer Vision (ICCV). 2021, pp. 8320-8332.
[34] Apostolos Modas, Rahul Rade, Guillermo Ortiz-Jiménez,, Seyed-Mohsen Moosavi- and Pascal Frossard. "PRIME: A Few Primitives Can Boost Robustness to Common Corrup- tions". In: Computer Vision - ECCV 2022. Ed. by Shai Avidan, Gabriel Brostow, Moustapha Cissé, Giovanni Maria Farinella, and Tal Hassner. Cham: Springer Nature Switzerland, 2022,
pp. 623-640. ISBN: 978-3-031-19806-9
[35] Tiago Salvador and Adam M Oberman. "ImageNetCCartee domain shift datasets for ImageNet". In: /CML 2022 Shift Happens Workshop. 2022.
and ImageNet-Drawingg two
[36] Haohan Wang, Songwei Ge, Zachary Lipton, and Eric P Xing. "Learning Robust Global Representations by Penalizing Local Predictive Power". In: Advances in Neural Information Processing Systems. 2019, pp. 10506-10518.
[37] Evgenia Rusak, Lukas Schott, Roland S. Zimmermann, Julian Bitterwolf, Oliver Bringmann, Matthias Bethge, and Wieland Brendel. "A Simple Way to Make Neural Networks Robust Against Diverse Image Corruptions". In: Computer Vision - ECCV 2020. Ed. by Andrea
Vedaldi. Horst Bischof, Thomas Brox, and Jan-Michael Frahm. Cham: Springer International Publishing, 2020, pp. 53-69. ISBN: 978-3-030-58580-
[38] Anish Athalye, Nicholas Carlini, and David Wagner. "Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples". In: Proceedings of the 35th International Conference on Machine Learning, ICML 2018. July 2018.
[39] Nicholas Carlini, Anish Athalye, Nicolas Papernot, Wieland Brendel, Jonas Rauber, Dimitris Tsipras, Ian Goodfellow, Aleksander Madry, and Alexey Kurakin. "On Evaluating Adversarial Robustness". In: arXiv preprint 0rXivv:792.0000
(2019).
[40] Tiago Marques, Martin Schrimpf, and James J. DiCarlo. "Multi-scale hierarchical neural network models that bridge from single neurons in the primate primary visual cortex to object recognition behavior". In: bioRxiv (2021). DO1: 10. 1101/202111111 03. 4334995
[41] Jeremy Freeman, Corey M. Ziemba, David J. Heeger, Eero P. Simoncelli, and J. Anthony Movshon. "A functional and perceptual signature of the second visual area in primates". In: Nature Neuroscience 16.7 (July 2013), pp. 974-981. ISSN: 1546-1726. 3402
DOI: 10. 1038/mm nn
[42]
Martin Schrimpf, Jonas Kubilius, Ha Hong. Najib J. Majaj. Rishi Rajalingham, Elias B. Issa, Kohitij Kar, Pouya Bashivan, Jonathan Prescott-Roy, Franziska Geiger. Kailyn Schmidt, Daniel L. K. Yamins, and James J. DiCarlo. "Brain-Score: Which Artificial Neural Network for Object Recognition is most Brain-Like?? In: bioRxiv preprint (2018).
[43] Martin Schrimpf, Jonas Kubilius, Michael J Lee, N Apurva Ratan Murty, Robert Ajemian, and James DiCarlo. "Integrative Benchmarking to Advance Neurally Mechanistic Models of Human Intelligence". In: Neuron (2020).
[44] Stephanie Olaiya, Tiago Marques, and James J. DiCarlo. "Measuring the Alignment of ANNs and Primate V1 on Luminance and Contrast Response Characteristics". In: SVRHM 2022 Workshop @ NeurIPS. 2022.
[45] Nicola Strisciuglio, Manuel Lopez-Antequera, and Nicolai Petkov. "Enhanced robustness of convolutional networks with a push- pull inhibition layer". In: Neural Comput. Appl. 32.24 (Dec. 2020), pp. 17957-17971. ISSN: 0941-0643.
[46] Galen Pogoncheff, Jacob Granley, and Michael Beyeler. "Explaining V1 Properties with a Biologically Constrained Deep Learning Architecture". In: Thirty-sevnnth Conference Neural Information Processing Systems. 2023.
[47] Russell L. De Valois, Duane G. Albrecht, and Lisa G. Thorell. "Spatial frequency selectivity of cells in macaque visual cortex". In: Vision Research 22.5 (1982), pp. 545-559, ISSN: 0042-6989.
13

---

[48] Ungsoo Samuel Kim, Omar A. Mahroo, John D. Mollon, and Patrick Yu- Mai-MaaM.nn "Retinal Ganglion Cells- Diversity of Cell Types and Clinical Relevance". In: Frontiers in Neurology 12 (2021). ISSN: 1664-2295.
[49] T N Wiesel and D H Hubel. "Spatial and chromatic interactions in the lateral geniculate body of the rhesus monkey." " In: Journal of Nearophysiology 29.6 (1966). PMID: 4961644, pp. 1115-1156.
[50] Alexander Berardino, Johannes Ballé, Valero Laparra, and Eero Simoncelli. "Figen-Distortions of Hicrarchical Representations". In: Advances in Neural Information Processing Systems 30 (NIPS 2017). NIPS' 17. Long Beach, California, USA: Curran Associates Inc., 2017, pp. 3533- 3542. ISBN: 97815 10866944.
[51] R. T. Raghavan, Jenna G. Kelly, J. Michael Hasse, Paul G. Levy, Michael J. Hawken, and J. Anthony Movshon. "Contrast and Luminance Gain Control in the Macaque's ' Lateral Geniculate Nucleus". In: eNeuro 10.3 (2023).
[52] Valerio Mante, Robert A. Frazor, Vincent Bonin, Wilson S. Geisler, and Matteo Carandini. "Independence of luminance and contrast in natural scenes and in the early visual system". In: Nature Neuroscience 8. (Dec. 2005), pp. 1690-1697,
ISSN: 1546-1726.
[53] Matteo Carandini and David J. Heeger. "Summation and Division by Neurons in Primate Visual Cortex". In: Science 264.5163 (1994), pp. 1333-1336.
[54] A Hirsch, J M Alonso, R C Reid, and L M Martinez. "Synapticc integration in striate cortical simple cells". en. In: The Journal of Neuroscience 18.22 (Nov. 1998), pp. 9517-9528.
[55] W R Softky and C Koch. "The highly irregular firing of cortical cells is inconsistent with temporal integration of random EPSPs". en. In: The Journal of Neuroscience 13.1 (Jan. 1993). pp. 334-350.
[56] Loie Daumail, Brock M. Carlson, Blake A. Mitchell, Michele A. Cox, Jacob A. Westerberg, Cortez Johnson, Paul R. Martin, Frank Tong, Alexander Maier, and Kacie Dougherty. "Rapid adaptation of primate LGN neurons to drifting grating stimulation". In: Journal of Neurophysi- ology 129.6 (2023). PMID: 371 37162181, pp. 1447-1467. DOT: 10. jn. 00058. 2022
[57] V. J. Uzzell and E. J. Chichilnisky. "Precision of Spike Trains in Primate Retinal Ganglion Cells". In: Journal of Neurophysiology 92.2 (2004). PMID: 15277596, pp. 780-789. DOI: 01171. 2003
10. 1152/jn jn. 01171. 2003 eprint: httpp::/ddot org/10. 10
[58] Samuel G. Solomon, Andrew J. R. White, and Paul R. Martin. "Fxtraclassical Receptive Field Properties of Parvocellular, Magnocellular, and Koniocellular Cells in the Primate Lateral Geniculate Nucleus". In: Journal of Neuroscience 22.1 (2002), pp. 338-349. ISSN: 0270-6474.
DOL: 10. 1523/ JNEUROSCI. 22 00038.20022
[59] Michael P. Sceniak, Dario L. Ringach, Michael J. Hawken, and Robert Shapley. "Contrast's effect on spatial summation by macaque V1 neurons". In: Nature Neuroscience 2.8 (Aug.
1999), pp. 733-739. ISSN: 1546- 106-1728 1726. DO1: 10. 1ew.10081110 11197
[60] J. Močkus. "On bayesian methods for seeking the extremum". In: Optimization Techniques IFIP Technical Conference Novosibirsk,, July 1-7, 1974. Ed. by G. I. Marchuk. Berlin, Heidel- berg: Springer Berlin Heidelberg, 1975, pp. 400-404. ISBN: 178-3-540-37497-5
[61] Leon A. Gatys, Alexander S. Ecker, and Matthias Bethge. "Image Style Transfer Using Convolutional Neural Networks". In: 2016 IEEE Conference on Computer Vision and Pattern Recognation (CVPR). 2016, pp. 2414-2423 DOT: 10. www./199VV..... 2016. 265
[62] Logan Engstrom, Andrew Ilyas, Hadi Salman, Shibani Santurkar, and Dimitris Tsipras. Ro- bustness (Python Library). 2019. URL: /htttttt///// / com http///aaallbbbbbttttttsss
[63] J. Bullier and H. Kennedy. "Projection of the lateral geniculate nucleus onto cortical area V2 in the macaque monkey". In: Experimental Brain Research 53.1 (Dec. 1983). pp. 162- ISSN: 1432-1106. DO1: 10. 1007 #007/BF00239409
[64] Diederik P. Kingma and Max Welling. Auto-EEnooiing Variational Bayes". In: 2nd Interna- tional Conference on Learning Representations, ICLR 2014, Conference Track Proceedings. 2014.
[65] Jonas Kubilius, Martin Schrimpf, Aran Nayebi, Daniel Bear, Daniel L. K. Yamins, and James J. DiCarlo. "CORnet: Modeling the Neural Mechanisms of Core Object Recognition". In: (2018). [66] James R. Cavanaugh, Wyeth Bair, and Anthony Movshon. "Nature and Interaction of Signals From the Receptive Field Center and Surround in Macaque V1 Neurons". In: Journal of Neurophysiology 88.5 (2002). PMID: 12424292, pp. 2530-2546. DOI: 10. 1152/ jn. 00692
2001
14

---

[67] Gary Sclar, John H.R. Maunsell, and Peter Lennie. "Coding of image contrast in central visual pathways of the macaque monkey". In: Vision Research 30.1 (1990), pp. 1-10. ISSN: 0042-6989. DOT: htttps://dol org/ 10. 1016/0042- 0042-6989 (90) 90123-3
[68] Michelle Miller, Yue Chung, and Kenneth D. Miller. "Divisive Feature Normalization Improves Image Recognition Performance in AlexNet". In: International Conference on Learning Representations. 2022.
[69] Nádia Canário, Lília Jorge, M.F. Loureiro Silva, Mário Alberto Soares, and Miguel Castelo- Branco. "Distinct preference for spatial frequency content in ventral stream regions underlying the recognition of scenes, faces, bodies and other objects". In: Neuropsychologia 87 (2016),
pp. 110-119. ISSN: 0028-3932. DOI: htttps://do. h org/10. 1016/] otg.g//ooo..o.....ooorrooaaoaaaa neuropsychologia
2016 05.000
[70]
Richard S. Sutton. The Bitter Lesson, accessed: 2025-10-33 Mar. 2019. URL: http: www
incompleteideass net Itt.Ieeaa/Bittereesssseea// html
[71] Jonas Kubilius, Martin Schrimpf, Kohitij Kar, Rishi Rajalingham, Ha Hong, Najib Majaj, Elias Issa, Pouya Bashivan, Jonathan Prescott-Roy Roy. Kailyn Schmidt, Aran Nayebi, Daniel Bear, Daniel L Yamins, and James J DiCarlo. "Brain- Like Object Recognition with High-Performing Shallow Recurrent ANNs". In: Advances in Neural Information Processing Systems. Ed. by H. Wallach, H. Larochelle, A. Beygelzimer, d' Alché-Buss E. Fox, and R. Garnett, Vol. 32. Curran Associates, Inc., 2019.
[72] Abdulkadir Gokce and Martin Schrimpf. "Scaling Laws for Task-Optimized Models of the Pri- mate Visual Ventral Stream". In: Forty-second International Conference on Machine Learning. 2025.
[73]
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby. "An Image is Worth 16x16 Words: Transformers for Image Recogmition at Scale". In: International Conference on Learning Representations. 2021. [74] Nicole C. Rust, Odelia Schwartz, J. Anthony Movshon, and Eero P. Simoncelli. "Sppatioteppo- ral Elements of Macaque VI Receptive Fields". In: Neuron 46.6 (2005), pp. 945-956. ISSN: 0896-6273.
[75] P Jones and I A Palmer. "The two-dimensional spatial structure of simple receptive fields in cat striate cortex". en. In: Journal of Neurophysiology 58.6 (Dec. 1987), pp. 1187-1211.
[76] Edward H. Adelson and James R. Bergen. "Spatiotemporal energy models for the perception motion". In: J. Opt. Soc. Am. 2.2 (Feb. 1985), pp. 284-299.
[77] Russell L. De Valois, E. William Yund, and Norva Hepler. "The orientation and direction
selectivity of cells in macaque visual cortex". In: Vision Research 22.5 (1982), pp. 531-544.
ISSN: 0042-6989.
[78] Dario L. Ringach. "Spatial Structure and Symmetry of Simple-Cell Receptive Fields in Macaque Primary Visual Cortex". In: Journal of Neurophysiology 88.1 (2002). PMID: 12091567, pp. 455 463.
[79] Avinash Baidya, Joel Dapello, James J. DiCarlo, and Tiago Marques. "Combining Different V1 Brain Model Variants to Improve Robustness to Image Corruptions in CNNs". In: SVRHM
2021 Workshop @ NeurIPS. 2021.
[80] P. H. Schiller, B. L. Finlay, and S. F. Volman. "Quantitative studies of single-cell properties in monkey striate cortex. III. Spatial frequency". In: Journal of Neurophysiology 39.6 (1976).
PMID: 825623, pp. 1334-1351.
[81] Ankit Rohatgi. WebPlotDigitizer. Version 5.2. URL:
[82] Maria-Irina Nicolae, Mathieu Sinn, Minh Ngoc Tran, Beat Buesser, Ambrish Rawat, Martin Wistuba, Valentina Zantedeschi, Nathalie Baracaldo, Bryant Chen, Heiko Ludwig, Ian Molloy, and Ben Edwards. "Adversarial Robustness Toolbox v1 v1.2.0". In: CoRR 1807.01066 (2018).
[83] Xinrui Wang and Jinze Yu. "Learning to Cartoonize Using White-Bon -Bxte-Box&& Cartoon Representa- tions". In: 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). 2020, pp. 8087-8096. DOI: 10. 1119/1101..../ wwt.///C222000..... 2020. 000010
[84] Cewu Lu, Li Xu. and Jiaya Jia. "Combining sketch and tone for pencil drawing production". In: Proceedings of the Symposium on Non-Photoreallste Animation and Rendering. NPAR "12 Annecy, France: Eurographics Association, 2012, pp. 65-73. ISBN: 9783905673906.
15

---

[85] Xun Huang and Serge Belongie. "Arbitrary Style Transfer in Real-Time with Adaptive Instance Normalization", In: 2017 IEEE International Conference on Computer Vision (ICCV). 2017,
pp. 1510-1519, DOT: 10. 1109/ ICCV www...01...... .167
[86] George A. Miller. eWordNet: lexical database for English". In: Commun, ACM 38.11 (Nov.
1995), pp. 39-41. ISSN: 0001-0782.
[87] Lisa J. Croner and Ehud Kaplan. "Receptive fields of P and M ganglion cells across the primate retina". In: Vision Research 35.1 (1995), pp. 7-24. ISSN: 0042-6989.
[88] Pauli Virtanen, Ralf Gommers, Travis E. Oliphant, Matt Haberland, Tyler Reddy, David Cournapeau, Evgeni Burovski, Pearu Peterson, Warren Weckesser, Jonathan Bright, Stéfan J. van der Walt, Matthew Brett, Joshua Wilson, K. Jarrod Millman, Nikolay Mayorov, Andrew R. J. Nelson, Eric Jones, Robert Kern, Eric Larson, CJ Carey, Ilhan Polat, Yu Feng. Eric W. Moore, Jake VanderPlas, Denis Laxalde, Josef Perktold, Robert Cimrman, Ian Henriksen, E. A. Quintero, Charles R. Harris, Anne M. Archibald, Antônio H. Ribeiro, Fabian Pedregosa, Paul van Mulbregt, and SciPy 1.0 Contributors. "SciPy 1.0: Fundamental Algorithms for Scientific Computing Python". In: Nature Methods 17 (2020), pp- 261-272. DO1: 10. 1038/ s41992 019-0686-2
[89] Christian Szegedy, Vincent Vanhoucke, Sergey Ioffe. Jon Shlens, and Zbigmiew Wojna. "Re- thinking the Inception Architecture for Computer Vision". In: 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR). 2016, pp. 2818-2826. DOI: 10. 1109/
CVPR. 2016.308
[90] Leslic N. Smith and Nicholay Topin. Super-Convereence: Very Fast Training of Neural Networks Using Large Learning Rates. 2018. arXiv: 1708. 071200 [Cs.LG]
16

---

Supplementary Material
A VOneNets
VOneNets [2] are convolutional neural networks (CNNs) augmented with collogically-ispireed fixed-weigh front-end simulating primary visual cortex (V1), termed the VOneBlock. This front-end structured as a neneinnnnniiear-ae Poisson (LNP) cascade (74), incorporating Gabor filter bank (GFB) [75], nonlinearities for both simple and complex cells [76], and stochastic spiking mechanism modeling neuronal variability (55) (cf. Fig. AT.. The GFB parameters are sampled from empirical distributions of orientation preference, spatial frequency (SF) tuning, and receptive field (RF) size
47 77 78.. The channels are split evenly berween simple and complex cells, and Poisson-lide noise generator is applied to emulate spiking variability. The full implementation is available at under a GNU General Public License v3.0.
https://ga thubbb....t.t......
GFB
Non-lincarity
Stochasticity
Figure A1: VOneNets simulate V1 processing upstream of standard CNNs. Each VOneNet front-end,
Simple
incorporates a coologicall--consraiiin the VOneBlock, preceding conventional CNN. The VOneBlock consists of a fixed-weight Gabor filter bank (GFB) parameterized by empirical dis- tributions, nonlinearities emulating simple and complex cell responses, and a stochastic com- ponent that injects Poisson-like noise to mimic VI neuronal variability. Adapted from Baidya et al. (79].
x 256
Complex
x 256
To construct a VOneNet, we replaced the initial block of each base architecture with the VOneBlock, along with a channel-matching bottleneck layer to maintain architectural compatibility between the front-end and the downstream convolutional stack. Consistent with the original VOneResNet50 model [2]. we replaced single convolutional layer, batch normalization, nonlinearity, and max- pooling operation and preserved the original configuration of 512 channels within the VOneBlock, allocating 256 channels to each cell type (simple and complex). When using an EfficientNer- BO, we substituted the initial convolution, batch normalization, and activation with the VOneBlock. Since this initial block has a total stride of 2, we decreased the stride of the VOneBlock accordingly. Furthermore, given the reduced channel dimensionality in the EfficientNet-Bi where the second stage expects only 32 channels, contrast to in ResNet50 we downscaled the VOneBlock, employing 128 channels per cell type. Finally, for the CORnet-Z we removed a single convolutional layer, nonlinearity, and max max-pooling operation. Since this first block has the same combined stride and output dimension as the ResNet50, no additional modifications were necessary.
We modified the VOneBlock by adjusting the field of view (FoV) to 7deg (down from the original 8deg) and increased the SF range of the GFB to 0.5 8.0 epd (from 0.5 - 5.6cpd). This modification allows us to better match empirical V1 distributions, while maintaining a similar safety margin with respect to the Nyquist SF. Additionally, to maintain consistency with upstream processing, we configured the GFB to uniformly sample a single channel from the input, regardless of any preceding subcortical transformations. Finally, to ensure methodological consistency in the spike- based activation regime across both the SubcorticalBlock (cf. Section E.2) and the VOneBlock, we imposed unified temporal integration window of 50ms. In alignment with Table C2 of Dapello et al. [12), we applied a linear scaling factor to the VOneBlock outputs such that the mean evoked response to batch of natural images from ImageNet matched the target stimulus response of 0.655 spikes. This scaling factor was computed independently for the VOneNet and for each E EVnet variant described in this study.
17

---

B
Primate Vision Alignment
B.1
Empirical V1 Tuning Curves
10"
Response [spikes/ sec..
40
30
10'
0:
10
0
5
0
Spatial Frequency [epd]
Radius [deg]
Contrast
Figure B2: Examples of empirical V1 tuning curves retrieved from the literature. SF, size, and contrast tuning curves (left to right) for example VI neurons. Left SF tuning curve of a simple (gray) and complex (black) cell to drifting grating stimuli. Markers represent the total number of Fl responses to gratings of different SF normalized to the best response and the solid line depicts quadratic fit for purposes of illustrating the tuning profile (adapted from Figure 10 in Schiller al. [80).. Middle Size tuning curve two complex cells of V1 with distinct degrees surround suppression under high contrasts. Gray depicts the cell form VI layer 4B under 0.15 contrast and black represents a cell from V1 layer under 0.31 contrast. Markers represent each cell's F1 response differently-sized gratings and the line depicts the predicted response of fitted DoG model discussed in the original article (adapted from Figure in Sceniak et al. [59]). Right Contrast tuning curve of two simple VI cell from the least (gray) and most (black) contrast sensitive thirds of their respective population. Marks indicate F1 response and the solid line depicts a fitted response
model discussed in the original article (adapted from Figure 2 in Sclar al. (67)) Data points extracted via WebPlotDigitalizer [8I]
B.2 Shape-bias
In contrast humans, who predominantly rely on shape cues for object recognition, ImageNet-trained CNNs have been shown to exhibit strong bias toward texture-based representations (8). Measuring shape bias thus serves as a proxy for alignment with human inductive biases. We evaluate this using the cue conflict dataset from Geirhos et al. (8). where images contain conflicting shape and texture cues (c.g., a cha-sh image with elephant texture). While humans tend to classify by shape, trraneet- CNNs often prefer texture. A model's shape bias is computed the proportion of shape-consistent predictions out of all shape- or texture-consistent responses.
B.3 BrainScore
The BrainScore platform 4 is standardized benchmarking suite for evaluating how brain-like artificial neural networks (ANNs) are. In the context of object recognition, BrainScore compares model activations against neural recordings from primate visual areas and human behavioral data. For early visual processing, V1 predictivity is quantified via the FreemanZiemba2013 [1]] neural benchmark, while response properties in VI are assessed using the Marques2020 [40] benchmark. BrainScore aggregates multiple such benchmarks into composite score that reflects model's alignment with neural and behavioral patterns observed in biological systems. Researchers can submit their models for evaluation https: //www. brain- wcore.ccoe.oooo org/
B.4 V1 Predictivity
To predict model's ability to predict single-neuron responses VI, we employed a dataset [1] comprising responses from 102 VI neurons to 450 unique 4deg image patches, spanning both naturalistic textures and noise stimuli. Predictivity was measured as the explained variance using partial least squares (PLS) regression under a 10-fold cross-validation scheme
18

---

Table B1: Detailed results for V1 response property alignment. BrainScore 42
43
V1 alignment
scores for ResNet50, VOneResNer50, and EVResNe150. Values indicate mean SD (n seeds).
Models
Category
Resp. Property
ResNet50 [4]
VOneResNet50
EVResNet50
Orientation
Orientation Selective
0.975
0.999100001
0.999=10.01
Cire. Variance (CV)
0.818
0.742.10.013
0.754
Orth./reef. Ratio
0.855:1.022
0.717
0.710:10.001
CV Bandwidth Ratio
0.740
0.763
0.762:10.001
Pref. Orientation
0.943
1.985
0.968
Orth./Pref--CV Diff.
0.766410.01
0.885
0.869
Or. Bandwidth
0..09
1.0020
0.952.10.000
Spatial Frequency
Peak SF
0.551 10.047
0.961 1.0002
0.961 1.0.00
SF Bandwidth
0.82610.019
0.962 0.000
0.937 1.0000
SF Selective
0.886#0.053
0.983
0.000
Response
Texture Selective
0.678
0.800.10.004
0.774
Selectivity
Modulation Ratio
0.349
100002
0.736=+0.000
Texture Var. Ratio
0.794
0.703
0.694:10.001
Texture Sparseness
0.663
0.927=10000
0.920
RF Size
Grating Sum. Field
0.272.10.00
0.547.10016
0.716
Surround Diameter
0.156
0.361 1:0.055
0.736
Surround Mod.
Surround Sup. Index
0.389
0.303
0.614
Texture
Abs. Texture Mod. Idx.
0.97810.019
0.942
0.934
Modulation
Texture Mod. Idx.
0.606
0.897.1..01
0.898
Response
Max. Texture
0.939
0.906
0.951
Magnitude
Max. DC
0.873 0.053
0.824
0.885
0.001
Max. Noise
0.783
0.923+10006
0.965=+0.000
B.5 V1 Response Properties
Marques et al. [40] introduced a novel model-toobrain comparison framework that bypasses conven- tional fitting procedures, instead relying on in silico neurophysiology establish direct, one-to-one correspondences between artificial and V1 neurons. By probing models with canonical stimulus sets such drifting gratings and texture pattern, the method quantifies alignment through normalized similarity metric grounded in the Kolmogorov-Sminnt of neural response properties. Critically, this framework enables rigorous benchmarking against prior neurophysiological studies without requiring raw recordings, effectively transforming existing literature into executable Vl-aligning tests. total, this method focuses 22 distinct response characteristics, organized into seven functional domains: orientation tuning, spatial frequency tuning, receptive field size, surround modulation, texture modulation, response selectivity, and response magnitude. Table pressens all individual response properties along with the scores obtained for the ResNet50, the Ner50 and Eeee5 models.
distance, capturing the distributional match
19

---

C Image Perturbations
C.1 Adversarial Attacks
To evaluate white-box robustness, we employed Projected Gradient Descent (PGD) [10 on top of subset of 5000 images from the ImageNet validation split. PGD is a widely adopted first-order attack that has proven effective against biologically inspired models such as VOneNets [2]. We selected this attack due to its scalability to large datasets (e.g., 5k ImageNet samples), and its compatibility with deterministic inference pipelines, which avoids the pitfalls of stochastic defenses that may artificially degrade attack success rates [12]. We run PGD for N = 64 iterations, where each step follows the update rule:
x ++1 Px+s (x' + sgn (
where xf denotes the adversarial input at iteration t, C is the cross-entropy loss function, and Px+S projects back onto the perturbation set S centered the clean input x. Under Lxc threat model, S corresponds to a box constraint, while for L1 or L2 norms with a perturbation budget c, the gradient direction is rescaled each iteration to have the respective norm a, and the projection ensures the final adversarial input Xadv satisfies ||xaty - XIIp S c. We used a used a step size of a = c/32 and performed total of 12 attacks carried out under Loo, L2 and L1 perturbation budgets each: |o0| E [1/ [1/1020. 1 1/255, 4 4/255, 16 16/255], ||0]| E [0.15, 0.6, 1.2, 2.4] and ||ō]| E [40, 160, 640, 2560). We used the Adversarial Robustness ToolBox v1.17.1 82 to conduct all the attacks.
constraints four
Lo Norm
L2 Norm
L Norm
Top-1 Accuracy [%]
40
ResNet50
20
VOneResNet50
EVResNet50
0.
16
32
64
16
32
64
16
32
64
PGD Iterations
Figure C1: Adversarial robustness is evaluated at convergance of PGD iterations. Top-1 white- box accuracy iteration curves for PGD attacks with || 1/255, |011| 0.6. || 160 constraints for ResNet50, VOneResNet50 and EVResNet50 models, evaluated on 500 images. The step size was adjusted to be for iterations, and 2e/N, in the remaining cases. Increasing the number of PGD iteration steps increases attack effectiveness only up to roughly 32 iterations. Lines indicate the mean accuracy and shaded error bars denote SD (n 3 seeds).
Due to the inherent stochasticity in our models, special considerations were necessary to enable gradient-based adversarial optimization. We first applied the reparameterization trick [64), which permits gradient flow through stochastic nodes by expressing random variables as deterministic functions of noise. To obtain reliable gradient estimates for PGD, we further adopted the approach of Athalye et al. (38), replacing Vf with an average over multiple stochastic forward passes. Specifically, we estimate gradients as
k V
V
where each v corresponds to gradient computed using an independent Monte Carlo sample. We set A: = 10, similarly to prior work on VOneNets, given that the additional noise source in the SubcorticalBlock did not mask the gradients any further.
20

---

Figure C2: Increasing the number of Monte Carlo gradient samples has limited impact on white-box attack effectiveness. White-box PGD accuracy evaluated under ||]|| 1/255 with 64 PGD iterations 500 images. Increasing k from 10 to 64 leads to only marginal decreases in accuracy for both VOneResNet50 and EVRes- Net50, indicating that additional samples do not substantially strengthen the attack. Lines indi- cate the mean accuracy and error bars denote SD (n 3 seeds).
Top-I Accuracy [%)
40
20
ResNet50
VOneReaNet50
EVResNet50
0
32
64
Gradient Samples
To verify the reliability of our adversarial evaluation pipeline, we conducted suite of sanity checks recommendations on a 500-image subset from the ImageNet validation set. line with the recommendations Athalye
et al. (38) and Carlini et al. (39,, we confirmed that top-1 accuracy decreases monotonically function of perturbation strength across all norm constraints (Tab. 4). Additionally, we verified that increasing the number of PGD iterations increased attack effectiveness (Fig, CT) and that increasing the number of gradient samples in the Monte Carlo approximation did not lead to a substantial increase in attack success (Fig. further supporting the completeness of our threat model.
C.2 Image Corruptions
The ImageNet-C dataset [6] consists of 15 different corruption types, each at levels of severity for a total of 75 different perturbations applied to validation images of the ImageNet validation split. Accuracy improvement on these datasets should be indicative of model robustness gains, given that it comprises, in total, 75 diverse corruptions. The individual corruption types Gaussian noise, shot noise, impulse noise, defocus blur, glass blur, motion blur, zoom blur, snow, frost, fog, brightness, contrast, clastic transform, pixelated, and JPEG compression. The individual corruption types are grouped into 4 categories: noise, blur, weather, and digital effects. Examples of image corruptions presented in Figure C3 //github.. cww/com////aaeeee cwneddrycck//obuusttooo tness under Creative Commons Attribution 4.0 International.
The ImageNet-C dataset is publicly available at https
C.3 Domain Shifts
ImageNet-R The ImageNet-R dataset [33] consists of curated set of 200 classes from the ImageNet validation set. This dataset includes 30,000 images featuring renditions in various artistic styles, such as paintings, sketches, and cartoons, designed test model's ability generalize beyond natural image statistics. ImageNet-R publicly available at /ttttss://ggiiiie com wwt.coom/cchceeeeece http//nnndrr///////e imagenet-r
ImageNet- Cacarten- & ImageNet-Drawing The ImageNet-Cartoon and ImageNet- Drawinn datasets [35]. are two domain shift benchmarks derived from the ImageNet validation set by applying label-preserving style transformations, ImageNet-Cartoor contains images transformed into cartoon- like renditions using GAN-based framework [83], while ImageNet- Draawing comprises colored pencil sketch versions of the same images created via an image processing pipeline (84). These datasets challenge models to generalize beyond natural image statisties, revealing significant accuracy drops- on average 18 and 45 percentage points, respectively when standard ImageNet- mod- els evaluated. Both datasets publicly available at htttps://zent org/ trecords/6001000 under Creative Common Attribution 4.0 International.
ImageNet-Skktch. The EnageNet-Sketch dataset 36 is a large-scale benchmark designed to evaluate OOD generalization in image classification. contains 50,000 black-and-whiit sketch-style images, with 50 images for each of the 1,000 classes in the ImageNet validation set, collected independently using keyword queries like "sketch of [class name]". Unlike perturbation- datascts, InageNet-Sketch represents significant domain shift in both texture and color, challenging
21

---

Original
Gaussian Noise
Shot Noise
Impulsc Noise
Defocus Blur
Glass Blur
Motion Blur
Zoom Blur
Snow
Frost
Fog
Brightness
Contrast
Elastic Transform
Pixelate
Jpeg Compression
Figure C3: Examples of common image corruptions from the ImageNet-C dataset at intermedi- ate severity (level 3) The first row shows the original image and three noise corruptions; the second row displays blur corruptions; the third row presents weather-related corruptions; and the fourth row illustrates digital corruptions.
models trained on natural images to rely on global structure rather than local textural cues. The dataset is publicly available at htttps:/wwwt kaggle
(8] is created by introducing different painting styles into ImageNet images through Adaptive Instance Normalization style transfer (85). While texture cues are replaced by those in the paintings, overall shape is preserved. Since the original dataset was introduced primarily for training purposes and models exhibited extremely low performance, we instead used subset of (e.g., airplane, dog) that are supersets of 227 ImageNet classes within the WordNet hierarchy [86). We followed the same approach as the original article, where the probability distribution over ImageNet classes is mapped to this 16-class distribution by averaging the probabilities of corresponding fine- grained classes. This 16-class Stylized ImageNet along with the code for probability aggregation is publicly available at https: / gi thub. com/ bethgelab/model vs vushn
Imageee..
as used in Geirhos et al. 77). This subset focuses on 16 basic categories
22

---

ResNet50
ResNet50+PRIME
VOneResNe150
VOnsResNct5O-PRIIE
EVResNe150
EVResNet50-PRUE PRIME
Shot Noise
Gaussian Noise
Impulse Noise
60
60
40
30
30
0
Motion Blur
Glass Blur
Zoom Blur
60
60
20
50
30
25
Defocus Blur
Fog
Frost
Top-1 Accuracy [%)
60-
60
50-
30
25
Snow
Contrast
Elastic Transform
60-
60
40
30-
30-
0
Brightness
Pixelate
JPEG Compression
75
60
60
60
40
30
2
3
4
5
2
3
Corruption Severity
Figure C4: Detailed results for common corruptions benchmarks. TTpp1 accuracy across.
severity levels for the 15 individual common corruptions of ImageNet-C. Lines indicate the mean top-1 accuracy and error bars denote SD (n 3 seeds)
23

---

ImageNet-Cartoon
ImageNet-Drawing
6.8
ImageNet-Sketae
ImageNNt-R
Figure C5: Examples from domain shift benchmark datasets derived from ImageNet. ImageNet- Cartoon (adopted from Salvador and Oberman (35) features object representations in cartoon style. ImageNNet-Drawing (adopted from Salvador and Oberman (35) includes images rederd as colored pencil-like hand drawings. ImageNet-Sketch (adopted from Wang et al. (36]) consists of black-and-whit sketches emphasizing contours. Stylized-ImageNee (adopted from Geirhos et (8) applies replaces the original textures with those of random paintings. ImageNet-R (adopted from Henrdycks al. (33) contains various renditions of ImageNet classes, including painting, cartoon, origami, toy, embroidery, and sculpture styles.
24

---

D Additional Experiments
D.1 EVNet Variants
Table DI: Detailed results for EVResNet50 variants, including ablations, on brain-alignment metries, BrainScore [42 43] VI alignment scores and shape bias (8] for all EVResNet50 variants. ResNet50 and Ver5OesNet50 included for reference but not in the comparison. Values indicate
mean SD (n seeds).
V1 Response Properties
VI Resp. Prop.
Orient. Turing
SF Tuning
Surmund Mod.
Texture Mod.
Resp. Select.
Resp. Magn.
Shape
Model
Predict.
Bias [%]
ResNet50
.271
.822
.754
2144
.389
.792
18.8
t.002
t.008
#:027
2.026
=: 002
t.025
0.025
=000
t.012
#1.2
VOncResNet50
.744
.599
.699
.82
.373
.919
.722
.84
31.6
#:
EVResNec50
364
.266
.854
.950
.726
.644
.916
.781
.933
48.9
+2.4
P Cells
350
.845
854
.455
.738
.737
.910
.764
.655
77.8
006
4:002
=:000
4:007
M Cells
.68
.763
.858
.950
.527
.343
.906
.781
.926
49.9
1036
2:000
4:004
2:000
= 000
#:007
#:006
2:004
2:000
#100
Light Adapt.
.364
.826
.859
.951
.720
.630
.908
.780
.936
70.0
1 001
2:.011
1:,002
22.000
+ 006
1:.008
1:009
1:005
2:000
133
Contrast Norm.
.374
.768
.868
.562
.921
.784
48.0
1.007
1.000
1.002
11.001
1.
1.001
1.008
1.005
1.000
123
Table D2: Detailed results for EVResNet50 variants, including ablations, on common corruption categories. Clean and corrupted top-1 accuracies averaged across corruptions types for all EVRes- Net50 variants. ResNet50 and VOneResNet50 included for reference but not in the comparison. Values indicate mean SD (n seeds).
Corruption Types
Mean [%]
Noise [%]
Blur [%]
Weather [%]
Digital [%]
Clean [%]
Model
ResNet50
38.8
29.2.0s
34.6104
36.1.a.
49.5
75.4
VOneResNet50
40.440.1
35.9+0.5
34.8+001
32.6=0.1
52.2+0.1
72.9+0.1
EVResNet50
41.9
39.6+10.
37.5+0.1
30.6=02
53.5+0.1
70.4
P Cells
34.9=0.1
42.7+00.1
26.8+0.11
19.6=0.1
45.7+0.1
60.7
M Cells
42.1+0.1
41.1400
37.740.0
30.6=0.1
53.3410.
70.3
Light Adaptation
40.4
35.2+400
37.9++02
29.2=0.2
52.2+0.1
69.8+0.2
Contrast Norm.
41.7=0.
39.2+11
37.6+04
30.4=0.4
53.4+0.1
70.7+0.0
Subcort. Noise
41.9=0.2
39.9+0.5
35.8+0.1
32.2=0.5
53.8+000
72.6+0.2
VOneBlock
42.7110.
41.2.109
37.4102
32.61101
54.2-10.1
71.610.1
+ -LGN-V V2 Conn.
42.110.1
40.0.1.11
37.61003
30.8
53.8.000
70.7
25

---

Table D3: Detailed results for EVResNet50 variants, including ablations, on domain-shift accu- racy, Top-1 accuracies on ImageNet- (Cartoon, Drawing. R, Sketch, Stylizedıe] for all EVResNet50 variants. ResNet50 and VOneResNet50 included for reference but not in the comparison. Values indicate mean SD (n seeds).
Mean [%]
Cartoon [%)
Drawing [%]
R
Sketch [%]]
Stylized [%]
Model
[%]
ResNet50
33.4
51.2=a07
20.9
35,4
23.3+0.1
36.3+1.2
VOn5ResNet50
37.1
55.5
30.5+04
37.5
23.1
38.8
EVResNet50
38. 10.33
57.1=203
33,9+002
38.1+002
22.7+02
38.6+1.1
P Cells
33.6=00.0
46.3+1022
20.1+00.
36.3+00.3
24.7+00.1
40.7+003
M Cells
38.2
57.0=20.2
34.4+00.
38.0=0.0
22.8+002
38, #5.9
Light Adaptation
37.4=002
56,2+10.
34.1+00.
37.4
21.3+0.4
38,1 1+111
Contrast Norm.
38.010.1
56.910.2
33.7104
38.110.3
22.71006
38.6109
Subcort. Noise
37.4.0.1
56.5.10.
31.0.03
37.610.0
23.0.10.1
38.710.1
VOneBlock
38.2
57.21000
34.7
38.2+00
23.040.
38.1106
+ LGN-V2 Conn.
38.3+0.2
57.0=2.2
34.5400
38.0+0.2
22.8+02
39.0+0.5
Table D4: Detailed results for EVResNet50 variants, including ablations, on adversarial ro- bustness. Top-1 accuracies for all EVResNet50 variants on limited adversarial set. ResNet50 and VOneResNet50 included for reference but the comparison. Values indicate mean SD (n seeds).
||
||01|2
||
Mean [%]
0.15
0.6
40
160
1020 [%]
Model
[%]]
[%]
[%]
[%]
[%]
ResNet50
16.4
23.4
0.4
37.2
1.8
33.6
1.7
20.5
10.8
10.00
11.0
10.22
1.0.7
:10.2
VOneResNet50
50.5
62.6
30.4
66.2
42.3
64.5
37.3
10.1
1.0.4
1.033
1...3
10..2
10.3
1.066
EVResNe150
53.8
62.7
38.8
65.1
48.0
64.0
44.5
102
1:0.2
1:0.6
1:0.0
1:0.3
::0.2
10.4
Cells
46.7
53.4
33.4
55.6
42.4
55.2
40.3
40.3
10055
10.4
M Cells
54.0
62.6
40.1
64.8
48.4
64.1
44.0
-011
+0,3
+002
100.1
+0.2
#0.11
+0.7
Light Adapt.
55.1
62.8
42.1
65.0
50.3
64.0
46.3
=0.5
+0.5
#00.4
+-0.
#:0.
#:0.2
44.3
Contrast Norm.
53.3
62.7
38.2
65.2
47.3
64.3
43.5
+0.2
#0.4
:10.3
+:0.3
#000
Subcort. Noise
48.5
60.5
28,2
64.2
39.6
62.7
35,8
10..1
10.1
1.0.8
100.1
1.0.3
1:0.1
10.3
VOneBlock
51.8
62.2
34.3
65.2
44.8
63.9
40.4
20.5
+:033
+:0.6
+:0.8
+-0.2
+:0.9
40.4
LLNN-2 V2 Conn.
53.9
62.8
38.7
65.0
48.4
64.5
44.2
100.2
1.0.3
10.11
110.8
1.0.2
..0.2
102
26

---

D.2 EVNet Backend Generalization
Similarly to the results obtained with EVResNet50, the EVEfficientNet-BB and EVCORnet-Z models consistently outperform their corresponding base model across most corrpption categories, as well as in mean corruption accuracy, as shown Table D5] However, this improvement comes with greater relative drop in clean image accuracy compared to the ResNet50-basee models. This steeper drop likely reflects architectural differences sensitivity to input statisties. EfficientNet-Bi employs compound scaling and aggressive architecture search to optimize performance specifically for standard ImageNet inputs [5]. making more susceptible deviations introduced by our biologically inspired preprocessing. In contrast, ResNet50, with its more generic design appears to be more adaptable to altered input distribution. Similarly, compared to ResNet50, the compact architecture of CORnet-Z exhibits lower degree of feature redundancy which, when coupled with mismatch between the inductive biases imposed by the front-end and those the network was designed to exploit, can limit its flexibility to adapt to the upstream processing. When evaluated domain shift datasets, both EVEfficientNet BO and EVCORnet-Z surpass their base models on most benchmarks, as reported in Table D6 with the only exception being ImageNet-Sketch., mimicking the same pattern observed with the EV ResN550.. Both EVEfficientNNet-B and EVCORnet-Z. exhibit substantial improvements across all norm constraints (Table[D7) and, when aggregated into the Robustness Score (Table (D).. EVNets consistently surpass their respective base architectures, reinforcing the effectiveness of back-end generalization.
Table D5: EVNets outperforms base models on most image corruption types and on mean corruption accuracy, across different backend architectures. Clean and corrupted top-1 accuracies averaged across severities and corruptions for EfficientNet-Be EVEfficientNer-BB, CORnet-Z and EVCORnet-Z. Values indicate mean + SD (n seeds).
Corruption Types
Mean [%]
Noise [%]
Blur [%]
Weather [%]
Digital [%]
Clean [%]
Model
EfficientNet-B0
30.3=0.4
18.7.002
26.6100 30.5+0.3
29.1
68.1 4..
EVEfficientNet-B00
34.1=0.0
30.7:10,2
24.3=0.1
45.0
61.4=0.4
CORnet-Z
18.0
6.4
17.010.0
12.4
29. 1..11
53.2.001
EVCORnet-Z
21.3-000
20.0=20.0
18.2+0.1
11.6+0.0
30.4
44.7=000
Table D6: EVNets outperforms base models on most OOD datasets and on mean domain shift accuracy, across different backend architectures. Top-1 accuracies on ImageNet- ImageNet-(Cartonn. Cartoon. Drawing, R, Sketch, Stylized for EfficientNet-BO. EVEsticcienNNet-B0, CORnet-Z and EVCORnet-
Z. Values indicate mean SD (n seeds).
Mean [%]
Cartoon [%]
Drawing [%]
R
Sketch [%]
Stylized16 [%]
Model
[%]
EfficientNet-Bi -O
28.9:102
40.2:1.4
17.1
29.9.102
17.3:10
40.0:a7
EVEfficientNet-Bl
33.5:102
49.1+:00
28.2:002
31.5-002
16.8403
41.8+110
CORnet-Z
19.5
30.9+02
12.5
21.0+002
9,5
23,8+188
EVCORnet-Z
21.1
32.9=0.1
16.2:102
21.3:000
9.0
26.0+11
D.3 EVNet Inference Ensembling
To evaluate whether combining the stochastic activations of EVNets across multiple forward passes leads to cumulative performance gains, we conducted an ensemble analysis varying both ensemble size and the stage at which activations are aggregated. Specifically, we compared ensembles that averaged activations at three points in the network: (1) the logit layer, (2) the final embedding stage (1ayer4, before the global average pooling), and (3) immediately after the VOneBlock bottleneck. We found that averaging later representations at the embedding or logit level yielded marginal but consistent improvements across clean, corruption, and domain-shift evaluations (Fig.DD)) In contrast, averaging activations after the bottleneck reduced performance, with the exception of a small
27

---

Table D7: EVNets outperforms base models most adversarial perturbations and on mean adversarial robustness, across different backend architectures. Top-I accuracies for EfficientNet- BO, EVEfficientNet-B0, CORnet-Z and EVCORnet-Z. Values indicate mean + SD (n 2 seeds).
|
|
||
Mean [%]
0.15
0.6
40
160
1020 [%]
Model
[%)
[%]
[%]
[%]
[%]
EfficientNet-B0
20.9
35.0
2.0
43.5
5.1
36.2
3.3
=0.1
#0.6
=0.1
+0.3
=0.1
#0.2
=0.1
EVEfficiietNer--00
45.6
53.2
31.1
55,8
40.8
55.0
37.7
+:0.5
#:0.5
::0.2
0.66
1:0.5
0.6.
1.66
CORnet-Z
17.6
24.4
0.7
34.8
5.4
34.7
5.5
+:03
#:077
+0.0
#0.6
=0.1
#006
=0.0
EVCORnet-Z
31.1
36.7
19.0
38.8
26.9
39.0
26.2
+006
+009
0008
#0.6
=0.4
#0.6
=0.4
Table D8: EVNets outperforms base models Robustness Score, across different backend archi- fectures. Robustness Score, clean and perturbed top-1 accuracies for EfficientNet-B EVEfficientNet- B0, CORnet-Z and EVCORnet-Z. Values indicate mean + SD (n2 seeds).
Perturbations
Robust. Score"
Adversarial [%]
Corrupt. [%]
Domain Shift [%]
Clean [%]
Model
[%]
EfficientNet-BB
26.7 39.7:10.3
20.9
30.3104
28.9102 33.5
68.1
EVEfficiietNNet-B0
45.6:104
34.1:00
61.4104
CORnet-Z
18.4
17.61003
18.0+00
19.5412
53.2
EVCORnet-Z
24.5
31.1
21.3+00.
21.1::03
44.7=0.0
performance gain by the two-model ensemble when evaluated on ImageNet-C. This degradation likely arises because the bottleneck lies immediately downstream of the noise-injection stage, and averaging at this point effectively diminishes the stochastic variability that the EVNet leverages during training. We did not evaluate adversarial performance in this setting. generating adversarial samples already requires an ensemble of forward passes, and using an additional ensemble for evaluation would compound computational costs impractical level.
Clean
Corruptions
Domain Shift
Top- Accuracy [%)
43
38
70
42
68
36
Logits
Embedding
Bottleneck
41
2
4
8
2
4
8
Ensemble Size
Figure D1: Averaging EVNet logits or final embeddings yields slight performance improvements, whereas averaging bottleneck activations degrades accuracy. Accuracy under clean, corruption, and domain-shie images for EVResNet50 ensembles varying sizes. "Logits" denotes ensembles averaged at the logit layer, "Embeddings" refers averaging activations in layer4 (prior to global average pooling), and "Bottleneck" indicates averaging immediately after VOneBlock bottleneck. Lines indicate mean top-1 accuracy and enror bars represent SD (n 3 seeds).
28

---

E
Implementation Details
E.1
Grating Experiments
When tuning the SubcorticalBlock and when measuring its response properties, we presented 12 frames of drifting sine-wave gratings with phase shifts of 30 degrees in the interval [0, 360[ degrees. Grating orientation
set to horizontal and the diameter, SF and contrast accurately replicate the response- cesponse-property studies used for tuning (see Table studies from which the stimulus set properties were taken). The background area not covered by the grating was set to 50% gray. To characterize the response properties of the VOneBlock, we adopted the same experimental paradigm detailed above.
chosen most the reference
E.2 SubcorticalBlock Implementation
To parameterize the fixed weights of the SubcorticalBlock, we developed novel tuning strategy that optimizes alignment with average neuronal response properties of SF tuning, size tuning, and contrast sensitivity, using Bayesian optimization. Table shows the reference values and values obtained values for the six subcortical response properties. This procedure was applied independently to the P and M pathways within the SubcorticalBlock. While several hyperparameters were directly optimized, Gaussian kernel sizes were indirectly determined by computing the kernel size necessary to elicit 75% of the their total integrated response. Specifically, this formulation was used with the surround Gaussian in the DoG kernel and with the Gaussian kernel of contrast normalization layer.
Light adaptation pooling size. Because the primate visual system exhibits both global and local forms of light adaptation, we initially modeled luminance adaptation as a spatially local process, implemented via Gaussian filtering analogous to our contrast normalization layer. Interestingly, during Bayesian optimization, the learned filter radius consistently expanded to encompass nearly the entire image, suggesting that global rather than local adaptation better supported LGN response property prediciton. To reduce computational overhead, we therefore adopted a global luminance normalization strategy.
Table E1: Reference and tuned response property values for the SubcorticalBlock. Response property values specific to P and M cells used to tune the SubcorticalBlock. shown alongside reference values from the original studics from which they were sourced. Six response propertics were used for tuning: center, surround, excitation and inhibition radii; suppression index; and saturation index.
Reference
SubcorticalBlock
Resp. Property
P cells
M cells
P cells
M cells
Center Radius [deg] 58
0.042
0.063
0.041
0.064
Surround Radius [deg] [58]
0.279
0.602
0.289
0.620
Excitation Radius [deg] [58
0.236
0.289
0.094
0.125
Inhibition Radius [deg] 58
0.564
0.869
0.226
0.609
Suppression Index 58
0.808
0.719
0.710
0.610
Saturation Index (5
0.095
0.365
0.200
0.410
Search space. When defining the search space for each variable in our Bayesian optimization framework, our primary objective was to minimize the introduction of inductive biases by employing search spaces as broad as feasible. In many cases, this was straightforward constrained parameters like the semisaturation constant, c50 to lie within physically meaningful bounds. However, for parameters such as the center and surround radii of the DoG filters, the radius of the Gaussian used in the contrast normalization layer, and the ratio of peak contrast sensitivity, we adopted more heuristic approach. Specifically, we drew on values reported in the neuroscience literature to inform the bounds of the search space. For the DoG center and surround radii, we defined symmetric search intervals centered around values reported in the reference study to which we aimed to maximize alignment (58). Similarly, the bounds for the normalization radius were guided by reported relationships between the suppressive field and the surround Gaussian (22). The same principle was applied to the contrast sensitivity ratio (87 Table E2 provides comprehensive
for instance, we
29

---

overview of all parameters tuned, including the corresponding search bounds, the literature references used guide their selection, where applicable, and the final hyperparameters.
Table E2: SubcorticalBlock hyperparameters and search space used for tuning. Minimum (Imin) and maximum (Fmax) bounds used in the Bayesian optimization for each hyperparameter of the SubcorticalBlock and hyperparameter optima obtained (x:). Values describe center radius of the DoG (rz); surround radius of the DoG (r,); peak contrast sensitivity ratio (kg/ka) ki)); contrast normalization pooling radius (reN); semisaturation constant (cso): contrast normalization exponent (n). While obtained through optimization, the kernel sizes used (KDoG and kcn) are also presented. For a subset of these hyperparameters, literature references were used to inform the choice of search bounds.
P cells
M cells
Layer
x
T'in
T'ax
Tmia
Tmax
Ref.
DoG
Tc [deg]
0.034
0.050
0.047
0.050
0.76
0.76
58
Conv.
Ts [deg]
0.223
0.335
0.224
0,482
0.722
0.534
58
kg/ ke
-0.068
-0.003
-0.12
-0.037
-0.002
-0,004
87
KDaG
19
33
Contrast Norm.
TCN [deg]
0.140
0.419
0.419
0.301
0.903
0.902
(2
C50
0.01
1.0
1.0
0.01
1.0
0.19
n
0.01
1.0
1.0
0.01
1.0
0.81
kcN
43
69
Bayesian optimization. We employed Bayesian optimization using the gp_minimize function from the Scipy library (88) The optimization was performed over a defined parameter space for 640 evaluations, with 64 initial points generated using a Sobol sequence. The acquisition function was probabilistically selected among Lower Confidence Bound (LCB), Expected Improvement (EI), and Probability of Improvement (PI) at each iteration. The exploration-explotatiin balance was controlled using x 1.96 for LCB and 0.01 for El and PI.
E.3
EVNet Variants
For all EVNet variants, we re-estimated the scaling factor applied to the VOneBlock whenever was included, and adjusted the VI noise Fano factor such that the accumulated Fano factor was 1. Apart from these modifications, most variants were derived by simply performing the modifications described in previous sections, with the two exceptions detailed below.
Contrast normalization ablation. Because the light adaptation and contrast normalization layers operate in close synchrony, removing the contrast normalization layer substantially destabilized training. In particular, the absence of contrast normalization caused activations within the Subcortical- Block to explode, primarily due to excessively high responses from the light adaptation mechanism. This effect most pronounced when image (or image crops) contained small, bright regions surrounded by dark backgrounds responses in Equation To mitigate this, modified the light adaptation layer's 's mean computation to ignore pixel values below a threshold of c = 0.05, effectively preventing spurious amplification of isolated bright pixels.
conditions that produce low mean activations but locally high
LGN-V2 skip connection. When incorporating the skip connections between the SubcorticalBlock and the VOneBlock bottleneck, we maintained a total channel dimensionality of 64 the input the backend model. Of these, 60 channels originated from the bottleneck output, while the remaining 4 channels were adapted activation maps from the SubcorticalBlock. Given the VOneBlock operates with stride of 4, applied 5 x 5 max-pooling operation with the same stride to the Bubcorticalllock activations prior to concatenation, ensuring spatial alignment and consistent feature scaling across pathways.
30

---

E.4
Training Details
All models were trained on an internal cluster, using 48GB NVIDIA A40 GPUs with Python 3.11, PyTorch 2.2 with CUDA 11.7, taking roughly tree days to train.
Preprocessing. During training, images were randomly horizontally flipped with probability of 0.5, then resized and cropped to x24x224 pixels. Images were normalized by subtracting and dividing by [0.5, 0.5, 0.5], with the exception of model that included the light adaptation layer of the SubcorticalBlock. During evaluation, images were resized to 256 pixels on the shorter side, followed by center crop to 224 224 pixels, and the same normalization was applied.
Loss function and optimization. Models were trained using a cross-entropy loss between ground- truth labels and predicted logits, with label smoothing (89 of 0.1. When using the ResNet50 and CORnet-Z architectures, optimization was performed using stochastic gradient descent with momentum set 0.9 and weight decay of 10-4 For EfficientNet-BO we used R.MSProp with momentum of 0.9, smoothing constant of 0.9, and a denominator stability term of 1.0. Training was conducted for 50 epochs with a batch size 256. We employed the 1-Cycle learning rate policy (90), where the learning rate was initialized at 4% of the maximum learning rate, increased up maximum at 30% of the total training steps, and then annealed to 4 X 10 4% of the maximum following a cosine schedule. For the ResNet50, the maximum learning rate was set to 0.256; and, for CORnet-Z, it was set to 0.05. When using PRIME 34] we fine-tuned standardly trained model for additional 50 epochs using the same training protocol, except with maximum learning rate of 0.01 reached at 10% of the training schedule.
set to 0.1; for the EfficientNet-Bel -OO
31

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: The main claims summarized in the abstract are properly supported by the introduction of the our novel architecture in Methods and the results described in Results
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine to include aspirational goals as motivation long is clear that these goals are not attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
The limitations of our modeling approach and of our results is discussed in the Discussion
Justification:
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (c.g.. independence assumptions, noiseless settings, model sell-speciiiitiinn asymptotic approximations only holding locally). ). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-tex, system might not be used reliably to provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimesss.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community, Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
32

---

Answer:
[NA]
Justification:
The paper does not include theoretical results.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proof's can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided not)?
Question:
Answer: [Yes]
Justification: The information needed to reproduce the main experimental results is described in Methods and in Implementation Details
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, descríbing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how reproduce that algorithm. (b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e-g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should possible for other researchers to have some path to reproducing verifying the results.
5. Open access to data and code
33

---

reproducible, they Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Question:
Answer: [Yes]
The model weights will be made publicly available and the code repository will be well-documented with instructions for environment setup, training and testing our models.
Justification:
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips. cc/
Sengliic/uuuees/oCdelubmimssssss Psllclll for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" an acceptable answer. Papers cannot be rejected simply for including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https
//abps.cc/public/uuiide
sssssssssiiyyyyyo for more details.
The authors should provide instructions on data access and preparation, including how access the raw data, preprocessed data, intermediate data, and generated data,
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permirted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification; All training and testing details are specified in Methods and in Implementation Details
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to a level of detail that is necessary appreciate the results and make sense of them.
The full details can provided either with the code, appendix, or as supplemental material.
7. Experiment statistical significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [Yes]
Justification: The paper reports standard deviations for all results obtained with our architec- tures, but does not include for all models.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by emor bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
34

---

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
It should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out range (e.g. negative еπτог rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: Details on computer resources used for training and testing are detailed in Training Details
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics httpps:/neurips. cc. http:/p.......bicecchccccccceeee
Answer: [Yes]
Justification:
The research does violate the NeurlPS Code of Ethics.
Guidelines:
The answer NA means that the authors have not reviewed the NeurlPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- eration due to laws regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification:
The societal impact of this research is discussed on the last paragraph of the
Discussion
Guidelines:
The answer NA means that there is no societal impact of the work performed.
35

---

If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), faimess considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification:
The paper poses no such risks.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards challenging, and many papers do not require this, but encourage authors to take this into account and make best. faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: All model authors are appropriately credited in both the main paper and the Supplementary Material. The same applics to the datasets used in this work.
Guidelines:
The answer NA means that the paper does
existing assets. The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset used and, possible, include a URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
36

---

If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode. com/dataseta
latasets.papersstt
has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if has changed) should be provided.
this information is not available online, the authors are encouraged to reach out to the asset's s creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification: The code that will be included in the repository will be well-commented and comprehensive documentation with instructions for environment setup, model training, and evaluation will also be provided.
Guidelines:
The answer NA means that the paper does release assets.
Researchers should communicate the details the dataset/code/mooell as part their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create anonymized URL or include anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification:
The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included the main paper.
According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Question:
Answer: [NA]
Justification:
The paper does not involve crowdsoureing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
37

---

Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if' applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Does the paper describe the usage of LLMs if is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, originality of the research, declaration is not required.
Question:
Answer: [NA]
Justification: The core method development in this research does not involve LLMS as any important, original, non-standard components.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, non-standard components.
Please refer to our LLM policy hatt:p//eearrrppcc//ooofeeeeeee/ /ct////ooeeeeeccc//22////.. for what should or should not be described.
38


Reviews:
[{"review_id": "T8Lz4u2Hy5", "reviewer": "Reviewer_g9Dr", "summary": "The authors introduce Early Vision Networks (EVNets) as an extension of standard convolutional deep networks with bio-inspired early layer computations. The authors process images first with two parallel pathways inspired by the parvo- and magnocellular pathways in biological vision. Responses in both pathways are subject to a battery of contour-strengthening (DoG filters) and normalization operations. The authors perform experiments with the proposed EVNet (that combines prepends a ResNet-50 with a subcortical block and VOneBlock) and show that their robustness to a variety of image distortions is significantly better than that of a baseline ResNet-50, although they observe a decline in clean image accuracy.", "questions": "Please refer to my review above. My main questions are about the novelty of the proposed EVNet architecture, how it advances either our understanding of biological/machine visual perception or how it improves the state of the art in deep-learning based computer vision.", "limitations": "yes.", "rating": 3, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 2, "originality": 2, "strengths_and_weaknesses": "Strengths:\n- Theoretical soundness: I believe the paper proposes a well motivated extension of VOneBlock with magno- and parvo-cellular pathways which seem to have slightly different response properties as shown in Fig.1.C. This could potentially be a beneficial inductive prior to add to DNNs for enhancing their robustness.\n- Reproducing receptive field properties of biological neurons: Figure 2 is interesting, it is nice that the authors are able to replicate the receptive field tuning observed in biological cells using EVNets.\n\nWeaknesses:\n- Novelty: First, it has been shown in several prior works that adding the pieces of EVNet mentioned here (using opponent-channel DoG filters, low and high SF pathways, contrast normalization, stochastic responses) can enhance the robustness of DNNs, some of which has in fact been shown in the VOneNet paper that the authors are extending. I don't find a significantly novel contribution in this work due to this reason.\n- Weak baselines: The proposed EVNets are only evaluated against VOneNet and an ImageNet-trained ResNet-50 block. If the authors want to convincingly present bio-inspired operations as a valid defense against image deformations, they must compare to other non-bio inspired approaches to enhancing perceptual robustness in DNNs. Also, given there are several advancements in image-processing deep neural networks, I'm skeptical the advantages of adding the subcortical module and VOneBlock claimed using comparisons with ResNet-50 will transfer to recent DNNs that have relatively scaled significantly in number of parameters / training dataset size / training objectives.\n- Clarity on how the paper influences neuroscience / machine learning: There are several bio-inspired architectures like CORNets [1], hGRU [2], ConvRNNs [3] etc. and this paper seems to be a new addition to the line of such architectures. Given the low novelty, I am unsure what we learn about visual neuroscience that we haven't already known from the previous architectures. Since the clean image accuracy of EVNets is worse when compared to ResNet-50, there isn't a strong architectural contribution from a machine learning standpoint as well.\n\nReferences:\n1. Kubilius, J., Schrimpf, M., Kar, K., Rajalingham, R., Hong, H., Majaj, N., ... & DiCarlo, J. J. (2019). Brain-like object recognition with high-performing shallow recurrent ANNs. Advances in neural information processing systems, 32.\n2. Linsley, D., Kim, J., Veerabadran, V., Windolf, C., & Serre, T. (2018). Learning long-range spatial dependencies with horizontal gated recurrent units. Advances in neural information processing systems, 31.\n3. Nayebi, A., Bear, D., Kubilius, J., Kar, K., Ganguli, S., Sussillo, D., ... & Yamins, D. L. (2018). Task-driven convolutional recurrent models of the visual system. Advances in neural information processing systems, 31.", "was_revised": true, "final_justification": "I have read the author rebuttal and other reviews. I am raising my score since some of my concerns are addressed by the rebuttal. I am not recommending acceptance since my concerns about novelty and performance gains are not adequately addressed.", "rebuttal": "We thank the reviewer for their assessment and appreciate the recognition of our work’s theoretical grounding and our efforts to replicate biological receptive field properties. We address the main points of concern below.\n\n### **Novelty**\nWhile it is true that individual components of our model (e.g., DoG filters and normalization mechanisms) have been previously explored, our contribution lies in the systematic integration of these components into a unified module that simulates responses of subcortical neurons of primate retina and LGN. Crucially, this is not a heuristic assembly: we introduce a novel, neurophysiologically-constrained hyperparameter tuning procedure that calibrates the SubcorticalBlock according to average empirical response property values. This represents a methodological advancement over prior work, which often relied on loosely inspired architectural motifs without systematic alignment to subcortical physiology. Additionally, EVNets establishes a modular architecture, in the form of a CNN, that explicitly models the early visual cascade from the retina up to V1, enabling a layer-wise commitment to biological function. This fills a notable gap in the literature and in platforms like BrainScore, which, despite its +100 benchmarks for measuring alignment across the whole ventral stream, still lack tools for evaluating subcortical alignment partially because no models have made this level of biological commitment until now. Therefore, while the building blocks may not be individually novel, their integrated and parameter-constrained formulation, as well as the broader architectural strategy of EVNets, represent a meaningful step forward.\n\n### **Baselines and Comparisons**\nWe agree that comparing against non-biological robustness methods is important. For this reason, we include both adversarial training and PRIME augmentation as strong baselines (Table 5). EVNet+PRIME outperforms both, indicating that the biological priors introduced by EVNets offer complementary and additive gains to established training-based defenses. We focus on these particular methods, because these remain the most effective and widely adopted methods for improving adversarial robustness and robustness to image corruptions. Adversarial training (e.g., PGD) is a long-standing standard for defending against white-box attacks, while PRIME outperforms other augmentation techniques on ImageNet-C [1]. In addition, earlier forms of data augmentations as used in PRIME have been shown to outperform 1000-fold increase on the training dataset for ImageNet-C, and large pretraining and even self-attention mechanisms for out-of-domain datasets such as ImageNet-R [2]. Furthermore, the objective of our work is not to present a new SOTA defense but to evaluate whether modeling the early visual system in greater detail enhances both robustness and brain alignment. Thus, comparing primarily against biologically-inspired and standard CNNs is most appropriate for isolating the effects of architectural priors. As for the backend architectures used, in Supplementary Material D.2, we show results for EVNets using an EfficientNet-B0 backend, in which the robustness benefits persist, and we will be including an additional backend architecture in the final manuscript.\n\n### **Impact on neuroscience and machine learning**\nWhile EVNets belong to the broader category of bio-inspired models, they target a distinct and underexplored segment of the visual hierarchy. Unlike prior work focusing on high-level cortical motifs like recurrence (e.g., CORnet, hGRU, ConvRNNs), our architecture explicitly models early vision through a modular assembly of empirically constrained subcortical and V1-like components. This focus on simulating retinal and LGN computations fills a gap left by most prior biologically-inspired CNNs, which typically begin at or beyond V1. Moreover, as shown in our work, such early vision modules are not mutually exclusive with cortical models, they are instead complementary. EVNets provide a foundation that can be integrated with cortical motifs, potentially yielding even greater brain alignment and robustness gains.\nFrom a neuroscience perspective, our findings demonstrate that (1) enhanced V1 tuning and extra-classical properties can emerge solely from upstream (subcortical) computations; and that (2) compositionality of biologically grounded modules can improve overall alignment without additional supervised fitting. On the other hand, from a ML perspective, we show that (1) explicitly modeling subcortical mechanisms can serve as a robustness-enhancing architectural prior, and that (2) these neuro-inspired priors are orthogonal to training-based methods, as shown by additive improvements when EVNets are combined with PRIME. Thus, the work contributes insights into how biological fidelity at early stages can inform both our understanding of visual representations and robust ML design.\nIn sum, we believe our paper contributes a meaningful advance by introducing a novel, empirically aligned model of subcortical processing, demonstrating emergent V1 phenomena from upstream modules and by showing robustness gains that are complementary to SOTA training methods. We hope these clarifications will help the reviewer reconsider the novelty and impact of our work.\n\n\n### **References**\n[1] A. Modas, R. Rade, G. Ortiz-Jiménez, S.-M. Moosavi-Dezfooli, and P. Frossard, ‘PRIME: A Few Primitives Can Boost Robustness to Common Corruptions’, in Computer Vision -- ECCV 2022, 2022, pp. 623–640.\n\n[2] D. Hendrycks et al., ‘The Many Faces of Robustness: A Critical Analysis of Out-of-Distribution Generalization’, in 2021 IEEE/CVF International Conference on Computer Vision (ICCV), 2021, pp. 8320–8329."}, {"review_id": "ZXGFiPROgb", "reviewer": "Reviewer_Nrfx", "summary": "The manuscript proposes a biologically plausible front-end layer for convolutional neural networks, aiming to better align representations between artificial and biological neural systems. To this end, the authors introduce a SubCorticalBlock that incorporates several stages inspired by the early visual system, including light adaptation, centre-surround modulation, contrast normalisation, and neural noise. The proposed framework is extensively evaluated across various datasets, including V1 response properties, corrupted versions of ImageNet, and adversarial attack scenarios. The main finding is that incorporating the SubCorticalBlock generally improves network performance on degraded or \"unclean\" images and enhances robustness to adversarial attacks—suggesting a closer alignment with how humans process visual information.", "questions": "1. The rationale behind certain modifications to the original VOneNet architecture is not clearly explained. For example, why was a 7-degree field of view (FoV) used instead of the original 8 degrees? Is this change supported by neuroscientific evidence, or was it an engineering decision? If it is the latter, it is important to clarify how sensitive the reported results are to this parameter. A similar clarification is needed for the changes made to the Gabor Filter Bank (GFB).\n\n2. It is unclear why P-cells were excluded from the ablation experiments. Given their relevance to visual processing, an investigation of their contribution would provide a more complete understanding of the subcomponents' functional roles.\n\n3. It would strengthen the evaluation to include ablation results for V1 response properties, similar to those reported in Table 1 of the main manuscript. This would offer a more comprehensive view of how each component influences biological plausibility. Similar ablation results for (EV)EfficientNet-B0 would also be valuable.\n\n4. The ablation results suggest that modelling M-cells may not significantly benefit performance. This raises the broader question of whether the performance differences observed across the components are statistically significant. In some cases, improvements appear to be marginal (i.e. in the decimal range), which might not be meaningful without appropriate statistical testing.\n\n5. What is the total number of parameters introduced by the proposed subcortical layer? It would be useful to understand how this additional complexity contributes to the observed performance gains.", "limitations": "Yes.", "rating": 5, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "1. The manuscript is well written and easy to follow. The source code is publicly available, which enhances transparency and reproducibility. The idea of the SubCorticalBlock is scientifically sound, well executed, and represents a valuable multidisciplinary contribution.\n\n2. A significant limitation of the current manuscript is that the proposed biologically inspired SubCorticalBlock is only tested as the front-end of two architectures: ResNet-50 and EfficientNet-B0. It is not evident that the same front-end would provide similar benefits for other convolutional architectures. This assumption should be validated through additional experiments. In particular, I recommend evaluating simpler architectures such as AlexNet and VGG, which are in some ways more biologically plausible and could offer additional insight.\n\n3. While the availability of source code supports reproducibility, the manuscript lacks important implementation details necessary for fully understanding the method and interpreting the results. For example, what are the sizes of the designed DoG kernels in the P and M pathways? What values are used for surround inhibition? A tabular summary of these key parameters—presumably optimised through hyperparameter tuning—would be highly informative.\n\n4. There is a substantial body of classical computer vision literature that incorporates similar biological mechanisms to those proposed in this manuscript. For example, Difference-of-Gaussians (DoG) models have been extensively used to describe surround modulation in boundary detection, or to model beyond classical receptive fields in colour constancy algorithms. This literature is currently absent from the related work section. Including it would help contextualise the benefits of biologically inspired algorithms beyond the deep learning era and demonstrate continuity with earlier work in computational neuroscience and vision science.", "was_revised": true, "final_justification": "I believe the manuscript builds nicely on an important previous work (VOneNets), and the findings are of multidisciplinary interest. Therefore, I increase my rating to 5.", "rebuttal": "We thank the reviewer for their constructive feedback and for highlighting the strengths of our work, including the scientific soundness of the SubcorticalBlock and the manuscript’s clarity. We address the reviewer’s main concerns and questions below.\n\n### **Generalization to Other Architectures**\nOur initial focus on ResNet-50 and EfficientNet-B0 was shaped both by computational constraints and by the precedent established in prior work on VOneNets [1], which demonstrated that biologically inspired front-ends can generalize well across diverse CNN backbones, including AlexNet and CORNet. Nonetheless, to further assess the generality of EVNets, we are conducting new experiments applying the EVNet front-end to other simpler back-end architectures, such as AlexNet, and will include these results in the final version.\n\n### **Implementation Details and Parameter Summary**\nWe agree that greater transparency in parameterization would be helpful. In the final version, we will include a table summarizing all SubcorticalBlock parameters, including DoG kernel sizes, surround inhibition values, and parameters derived from our neurophysiologically-constrained hyperparameter tuning. While many values were derived through empirical alignment with subcortical data (see Table E5 in Supp. E.2), we acknowledge the need for easier reference.\n\n### **Connection to Classical Computer Vision Literature**\nWe appreciate the reviewer’s suggestion to better contextualize our approach within the classical computer vision literature. In the final version, we will add references and discussion on early computational models of center-surround mechanisms and DoG-based edge and contrast processing (e.g., Marr & Hildreth [2]), as well as their influence on tasks such as boundary detection and color constancy. We agree that this will provide valuable historical perspective and highlight the continuity between classical vision and modern biologically-inspired deep learning\n\n### **Field of View Changes**\nIn our models, the field of view (FoV) defines the portion of the visual field occupied by the object being classified. The original 8deg FoV in VOneNet was chosen as a rough dataset-wide average but ImageNet exhibits substantial variability in object size and framing. Moreover, standard ImageNet training involves random cropping, sometimes reducing the input to as little as 8% of the original image, further increasing the variation in apparent FoV during training. In earlier experiments on Tiny ImageNet, we used a 2deg FoV for 64×64 images, corresponding to 32 pixels per degree (ppd), which closely matches the 28 ppd used in the original VOneNet and follows precedents in adapting VOneNets to this dataset [3–5]. To maintain consistent resolution across input sizes, we selected a 7deg FoV for ImageNet-scale images, which allows for fair comparison across different input scales while keeping receptive field sizes fixed. Although we did not include a direct baseline with an 8deg FoV for comparison, our VOneNet implementation with a 7deg FoV actually improves over the original VOneNet in clean accuracy (72.9% vs. 71.7%), mean corruption accuracy (40.4% vs. 40.0%), and adversarial robustness (51.5% vs. 51.1%, based on comparable attack conditions) [1]. These results suggest that the change in FoV did not negatively impact performance and may have modestly improved it.\n\n### **Gabor Filter Bank Changes**\nRegarding the Gabor Filter Bank (GFB), we extended its spatial frequency (SF) range to better match empirical V1 distributions. In the original VOneNet implementation, the range of SFs processed by the GFB was sampled from a binned empirical distribution of V1 receptive field preferences [5], but was constrained by the Nyquist frequency of the model. For 224×224 images, the Nyquist frequency, $f_N$, along the diagonal is given by $\\frac{1}{2\\sqrt(2)} px^{-1}$. With the original 8deg FoV, this yields $f_N$ = 9.9cpd, and maximum SF used in the GFB was 5.6 cpd, as the next bin (8 cpd) was considered too close to the Nyquist limit to be reliably represented. By decreasing the FoV to 7deg, we increase the model’s resolution, and the Nyquist frequency rises to 11.3cpd. This allows us to safely include higher-frequency components in the GFB, expanding the range of SFs modeled to 8cpd, and thus achieving better coverage of the empirical V1 SF distribution, while maintaining a similar safety margin with respect to the Nyquist limit. This modification enhances the biological plausibility of the GFB’s tuning properties without altering the overall architecture of the VOneBlock\n\n### **Ablations**\nOur initial ablation strategy focused on understanding how individual components modulate the behavior of a linear P-cell pathway, which we used as a baseline due to its known dominance in ventral stream projections [7]. Omitting the P pathway would remove both chromatic information and high-acuity processing, making the ablated model qualitatively unlike the full system. On the other hand, omitting the M pathway did not significantly affect performance, which is aligned with the hypothesis that it does not contribute significantly to ventral stream processing. However, we agree that including a P-cell ablation improves completeness and interpretability, and we have, in the meanwhile, trained one seed of a EVResNet50 with the P-cell pathway omitted. This model achieves an accuracy of 62.6% (vs. 71.7% on the full EVResNet50) on the ImageNet validation set, a mean corruption accuracy of 35.6% (vs. 41.5% on EVResNet50) and a mean out-of-domain accuracy of 33.9 (vs. 38.7% on EVResNet50). We appreciate the suggestion to evaluate the impact of each component on V1 response properties. To support a deeper understanding of their individual contributions to V1 alignment, we will add a table with ablation results to the Supplementary Material. We will also extend the ablation results to other backend architectures used.\n\n### **Statistical Significance**\nWhile some improvements may appear modest (e.g., sub-percentage gains), the consistency of results across seeds and benchmarks (e.g., shape bias, corruption robustness) suggest genuine benefits. Evaluating statistical significance between different models would require training a much larger number of seeds.\n\n### **Parameters introduced by the Subcortical layer**\nRegarding model complexity, we emphasize that the SubcorticalBlock introduces no trainable parameters. All components, DoG filters, normalization stages, and noise generators, are parameterized based on biological priors and remain fixed during training. The complete SubcorticalBlock configuration relies on six hyperparameters (see Supplementary Table E6), which are optimized to align model responses with empirical subcortical properties.\n\n### **Reference list formatting**\nWe thank the reviewer for the suggestion. In the final camera-ready version, we will ensure that all author names are listed in full in the References section.\n\n### **References**\n[1] J. Dapello, T. Marques, M. Schrimpf, F. Geiger, D. Cox, and J. J. DiCarlo, ‘Simulating a Primary Visual Cortex at the Front of CNNs Improves Robustness to Image Perturbations’, in Advances in Neural Information Processing Systems, 2020, vol. 33, pp. 13073–13087.\n\n[2] D. Marr, E. Hildreth, and S. Brenner, ‘Theory of edge detection’, Proceedings of the Royal Society of London. Series B. Biological Sciences, vol. 207, no. 1167, pp. 187–217, 1980.\n\n[3] A. Baidya, J. Dapello, J. J. DiCarlo, and T. Marques, ‘Combining Different V1 Brain Model Variants to Improve Robustness to Image Corruptions in CNNs’, in SVRHM 2021 Workshop @ NeurIPS, 2021.\n\n[4] A. Cirincione et al., ‘Implementing Divisive Normalization in CNNs Improves Robustness to Common Image Corruptions’, in SVRHM 2022 Workshop @ NeurIPS, 2022.\n\n[5] R. Barbulescu, T. Marques, and A. L. Oliveira, ‘Contribution of V1 Receptive Field Properties to Corruption Robustness in CNNs’, in ECAI 2024, IOS Press, 2024, pp. 658–665.\n\n[6] Russell L. De Valois, Duane G. Albrecht, and Lisa G. Thorell. “Spatial Frequency Selectivity\nof Cells in Macaque Visual Cortex”. In: Vision Research 22 (1982), pp. 545–559.\n\n[7] Nassi, J., Callaway, E. Parallel processing strategies of the primate visual system. Nat Rev Neurosci 10, 360–372 (2009)."}, {"review_id": "u8UE6ZGbks", "reviewer": "Reviewer_nd1A", "summary": "This paper introduces SubCorticalBlock, a new processing block to be used in conjunction with VOneNet convolutional neural networks that simulates processing strategies known to exist in subcortical processing regions of the primate visual system.  These SubCorticalBlocks are composed of four primary processing mechanisms: Difference of Gaussian (DoG) convolutions, Light Adaptation, Contrast Normalization, and subcortical noise injection, which are intended to mimic neural processing strategies found in the retina and LGN.  The resulting networks, EVNets are shown to achieve greater alignment with primate V1 response (as evaluated though BrainScore’s neural predictivity and tuning alignment evaluations) and improvements on corrupt image robustness and out of distribution robustness as compared to baselined ResNet50 and VOneResNet50 models.", "questions": "- I was left wondering if artificial neural activity measured from the SubCorticalBlock would actually predict biological neural activity measured from subcortical regions (i.e., not just V1) better than models without this processing block.  Is there any available dataset that could support this evaluation?  If so, a quick experiment may be to evaluate RSA or linear predictivity of SubCorticalBlock representations with this neural data as compared to baseline ResNet50.\n- Is the biological parameterization necessary?  For instance, how would different parameterizations impact V1 alignment and robustness scores.\n- Is the VOneBlock necessary? How does EVResNet50 model performance change without it?\n- Table 5: Is an evaluation available for VOneResNet50+PRIME?\n- Tables D1 and D2 provide ablation study results for EVResNet50 on the corrupt image and out of distribution robustness benchmarks.  Providing adversarial robustness results for each ablation model could additionally be insightful.", "limitations": "yes", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 4, "significance": 3, "originality": 2, "strengths_and_weaknesses": "Strengths:\n- SubCortical block is (in theory) agnostic to the downstream CNN processing.  The  parameters of this processing block are fixed which poses this as a processing block that could be easily added onto the front of other CNNs.\n- Fixed parameters of the SubCortical block are learned directly from alignment with biological data, providing additional hints to the utility of biological priors in deep neural network processing.\n- Improvement in V1 response property scores are large compared to ResNet50 and VOneResNet50 baselines.  A V1 response property score of .808 puts this model at rank 6 for this score among public BrainScore models.\n- In appendix E2, authors show that the SubCorticalBlock generalizes beyond the ResNet50 architecture by adding it to the front of an EfficientNet model, demonstrating generality of the proposed processing block.\n- Paper is clearly written and motivated\n- Ablation studies clearly show the utility of each implemented mechanism of the SubCortical on most evaluated benchmarks.\n\nWeaknesses:\n- A full breakdown of model performance across each different corruption type would be appreciated.  This may help reveal what robustness benefits are actually seen as compared to expectation.  For instance, do the contrast normalization and light adaptation mechanisms of the SubCortical block improve robustness to the contrast and brightness corruptions of ImageNet-C?\n- No explanation is provided for why a different receptive field is used (7 degree visual angle) as compared to VOneNets and many existing brain score models.  Receptive field size decisions can have a reasonably high impact on brain score results, so should be considered for an additional ablation study.\n- Little insights are provided into why specific tuning properties improve (or worsen) with the introduction of these subcortical processing mechanisms.\n- Common with related literature, little insight (beyond numerical results from ablation studies) is provided into WHY we observe improvements in robustness and the tradeoffs of using these new processing strategies.", "was_revised": true, "final_justification": "I maintain my original score (5) for this paper based on the strengths of the paper that I originally listed.  In follow-up discussion with the authors, they have additionally helped resolved my remaining concerns regarding receptive field and parameterization choices and have helped detail a subset of their results more clearly.", "rebuttal": "We thank the reviewer for the thoughtful and constructive feedback. We address the reviewer’s main concerns and questions below.\n\n### **Model performance across individual corruptions**\nWe thank the reviewer for pointing out this omission. We will include figures in the Supplementary Material that display model accuracy across different corruption severities and types. Notably, our functional analysis of the SubcorticalBlock suggests that its integration offers greater robustness to contrast and brightness corruptions compared to others. However, this is not observed in practice, EVNets achieve an accuracy of 32.1% (31.6% in VOneNets and 39.4% in ResNet50) for contrast and 62.0% for brightness (64.3% in VOneNets and 66.4% in ResNet50). Although these corruptions are primarily related to changes in luminance and contrast, it is important to acknowledge the additional loss of information that occurs due to encoding quantization in 8-bit RGB with gamma correction. Reducing contrast before saving an image increases quantization error, resulting in more pronounced discretization artifacts. Similarly, increasing brightness leads to overexposed images, where pixel values are clipped to the maximum allowable value, further contributing to information degradation. Ideally, if brightness were adjusted by scaling an image by a constant, without any value clipping nor gamma correction, the light-adaptation layer of the SubcorticalBlock would generate the same activation map as for the original image. Considering that this mapping does not reflect true brightness variations, it is not surprising that the gains in brightness robustness are similar to those observed with other types of corruption.\n\n### **Field of View Changes**\nIn our models, the field of view (FoV) defines the portion of the visual field occupied by the object being classified. The original 8deg FoV in VOneNet was chosen as a rough dataset-wide average, but ImageNet exhibits substantial variability in object size and framing. Moreover, standard ImageNet training involves random cropping, sometimes reducing the input to as little as 8% of the original image, further increasing the variation in apparent FoV during training. In earlier experiments on Tiny ImageNet, we used a 2deg FoV for 64×64 images, corresponding to 32 pixels per degree (ppd), which closely matches the 28 ppd used in the original VOneNet and follows precedents in adapting VOneNets to this dataset [1–3]. To maintain consistent resolution across input sizes, we selected a 7deg FoV for ImageNet-scale images, which keeps the spatial resolution and allows for fair comparison across different input scales while keeping receptive field sizes fixed. Although we did not include a direct baseline with an 8deg FoV for comparison, our VOneNet implementation with a 7deg FoV actually improves over the original VOneNet in clean accuracy (72.9% vs. 71.7%), mean corruption accuracy (40.4% vs. 40.0%), and adversarial robustness (51.5% vs. 51.1%, based on comparable attack conditions) [1]. These results suggest that the change in FoV did not negatively impact performance and may have modestly improved it.\n\n### **Clarification of tuning property gains**\nWe agree that the manuscript would benefit from a deeper discussion of how subcortical computations influence V1 tuning properties, and we will expand on this point in the revised Discussion section. The observed improvements in V1 alignment, particularly for surround modulation and RF size, stem from the normalization stages implemented in the SubcorticalBlock. These mechanisms enforce local competition and approximate extraclassical phenomena which the VOneBlock alone cannot capture due to its purely classical RF structure. Our results suggest that upstream normalization acts as a surrogate for some of the missing recurrent (and possibly feedback) processes in V1, enhancing the biological plausibility and functional fidelity of the V1 responses observed downstream. This supports the idea that some extraclassical properties can emerge from subcortical preprocessing alone.\n\n### **Reason behind robustness improvements and need for biological parameterization**\nWe agree that further insights into the source of robustness gains are valuable, and we will expand on this point in the revised Discussion section. As noted in prior work using the VOneNet architecture and changing the V1 properties [3], corruption robustness is not dependent on exactly matching biological parameter distributions but rather on the broader structure and covariance between some of these properties. In the case of subcortical computations, our hypothesis is that normalization layers promote local competition and dynamic range compression, which are known to improve robustness by reducing sensitivity to input perturbations. Meanwhile, the DoG filtering improves features selectivity, while performing low-pass filtering, mitigating high-frequency noise.\n\n### **Evaluating neural predictivity of subcortical neurons**\nWe acknowledge the reviewer’s suggestion to assess alignment with subcortical recordings. However, our SubcorticalBlock is designed to match the average response properties of primate LGN neurons, and does not attempt to capture their full variability or even single-unit responses, in contrast with the VOneBlock. Because of this design choice, applying RSA or linear predictivity on existing single-unit LGN datasets would not be meaningful as our model lacks the heterogeneity required for such comparisons. We believe that future work should focus on expanding the dimensionality and diversity of the SubcorticalBlock before using it in predictive frameworks.\n\n### **Need for the VOneBlock**\nIn early experiments, we evaluated a version of our model that only includes the SubcorticalBlock. While it retained some robustness benefits, it consistently underperformed the full EVNet architecture in corruption robustness. This suggests that the VOneBlock and SubcorticalBlock confer complementary inductive biases, with one targeting contrast and luminance invariance (Subcortical) and the other contributing spatial and orientation-specific processing. We will include the corresponding ablation results in the final Supplementary Material.\n\n### **VOneNet + PRIME**\nOur intent was not to benchmark EVNet against VOneNet under all conditions, but to examine how architectural and training-based robustness strategies interact. Since the impact of combining biologically inspired front-ends with PRIME had not been studied before, we focused on EVNet+PRIME to highlight its cumulative gains. That said, as including VOneResNet50+PRIME in our study would be interesting, we will include these results in our final manuscript.\n\n### **Adversarial Robustness on Ablations**\nDue to computational constraints and the high cost of performing Monte Carlo PGD attacks with 32 samples per iteration under stochastic noise, we did not include adversarial robustness results for all ablations. However, we agree this would offer valuable insight, particularly in understanding the role of specific mechanisms (e.g., contrast normalization, light adaptation) under gradient-based attacks. We will include these evaluations in the final manuscript and update the Supplementary Material accordingly.\n\n### **References**\n\n[1] A. Baidya, J. Dapello, J. J. DiCarlo, and T. Marques, ‘Combining Different V1 Brain Model Variants to Improve Robustness to Image Corruptions in CNNs’, in SVRHM 2021 Workshop @ NeurIPS, 2021.\n\n[2] A. Cirincione et al., ‘Implementing Divisive Normalization in CNNs Improves Robustness to Common Image Corruptions’, in SVRHM 2022 Workshop @ NeurIPS, 2022.\n\n[3] R. Barbulescu, T. Marques, and A. L. Oliveira, ‘Contribution of V1 Receptive Field Properties to Corruption Robustness in CNNs’, in ECAI 2024, IOS Press, 2024, pp. 658–665."}, {"review_id": "GB4YemhClw", "reviewer": "Reviewer_KMuy", "summary": "The authors investigate a new front-end for deep convolutional neural networks (CNNs) that implements a fixed-weight model of the retina and LGN. This builds on prior work showing that a V1 model as a front-end can improve the robustness of object recognition. The authors implement their subcortical model as a front end to ResNet-50 and compare the performance of three different models: the base ResNet-50; the VOneResNet-50 with the V1 front end from Dapello et al; and the EVResNet-50 with their subcortical (retina + LGN) block followed by the V1 block as a front end. They assess these models' performance in terms of their similarity to neural recordings from the primate visual system, and in terms of their object recognition performance (clean test accuracy, robustness to domain shifts, and robustness to corruptions).\n\nThe authors observe that, by most metrics EVResNet > VOneResNet > ResNet in terms of similarity to neural recordings from the primate visual system and that ResNet> VOneResNet > EVResNet in terms of clean test accuracy on ImageNet.  EVResNet yielded better accuracy on most domain-shifted and corrupted ImagNet tasks than did VOneResNet or ResNet.", "questions": "- Rich Sutton's \"Bitter Lesson\" teaches us that approaches that scale well to more data and larger compute resources tend to outcompete finely-tuned and less-scalable architectures. I am of course open to being shown otherwise (and I would welcome counterexamples to the bitter lesson!!). With that in mind, I think it would be helpful to compare the \"add neural model front-ends\" approach with the \"scale up simple stuff\" approach that is exemplified by SSL pretraining, vision transformers, etc. That comparison would help us to understand where to invest our energies if we want to push forward the SOTA.\n\n- Given the random noise in the neural activities, would it make sense to shut off that source of randomness during inference (as in dropout training)? Alternately, perhaps the authors would benefit from repeating the noisy inference multiple times for each input image (with different random noise draws) and averaging over the resultant category labels. This could leverage any stochastic resonance effects and possibly improve categorization.\n\n- In Fig. 2, it would help to show real brain data alongside the two model curves so readers can tell at a glance which model class better matches the brain data.\n\n- In terms of light adaptation, the authors use a global luminance adaptation (Eq. 2) whereas the biological visual system has both global and local light adaptation, and the local adaptation is substantial. E.g., each individual photoreceptor adapts to the local light intensity. This has the benefit of minimizing the effects of spatial lighting variation on perception, and the same property could help a lot in robustness to weather shifts (for example).\n\n- I wonder if it would help to give skip connections around these early blocks. (I.e., to have skip connections from pixels to VOne block and to the downstream ResNet, and to have skips that send the subcortical block's output directly to the downstream ResNet). Then, the ResNet could use these pre-computed features from the neural model when they are useful, and could also find other features in the pixel inputs in cases where those are not provided by the neural model blocks. In the case of skip connections from the subcortical block to the ResNet (bypassing the VOne block), this would mimic the known projections from LGN to V2.\n\n- I also wonder if it would help to let the parameters of the early neural blocks be trainable. They could still be initialized to the values used by the authors, but this would allow the models to find better parameters than those hard-coded ones.", "limitations": "Yes", "rating": 5, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 2, "strengths_and_weaknesses": "Strengths:\n\n- The authors have correctly identified a key weakness of the Dapello et al. work, in that it ignores the subcortical contributions to vision. They have done a good job of paralleling that line of work in building their subcortical block.\n\n- The improvements in robustness to corruption and domain shifts are notable, although they come at the expense of a reduction in robustness to adversarial attack (vs VOneNet).\n\n- The ablation study (removing M cell pathway) is nice to see.\n\nWeaknesses:\n\n- The work did not consider how their approach might compare to other avenues for improving computer vision models. E.g., how does their addition of fixed-weight neural models compare to self-supervised pretraining, attention layers, and other components of SOTA vision models? Performing this comparison would help to understand where the field should invest its effort in advancing computer vision.", "was_revised": true, "final_justification": "The authors presented excellent justifications for their modeling choices and added some thoughtful experimental details (e.g., using ensemble approaches by averaging over noisy inference steps). This improved my opinion of the work so I increased my score from 3->5.", "rebuttal": "We thank the reviewer for the thoughtful and constructive feedback. We address the reviewer’s main concerns and questions below.\n\n### **Comparison to broader computer vision methods**\nWe agree that comparing against non-biological robustness methods is important. For this reason, we include both adversarial training and PRIME augmentation as strong baselines (Table 5). EVNet+PRIME outperforms both, indicating that the biological priors introduced by EVNets offer complementary and additive gains to established training-based defenses. We focus on these particular methods, because these remain the most effective and widely adopted methods for improving adversarial robustness and robustness to image corruptions. Adversarial training (e.g., PGD) is a long-standing standard for defending against white-box attacks, while PRIME outperforms other augmentation techniques on ImageNet-C [1]. In addition, earlier forms of data augmentations as used in PRIME have been shown to outperform 1000-fold increase on the training dataset for ImageNet-C, and large pretraining and even self-attention mechanisms for out-of-domain datasets such as ImageNet-R [2]. Furthermore, the objective of our work is not to present a new SOTA defense but to evaluate whether modeling the early visual system in greater detail enhances both robustness and brain alignment. Thus, comparing primarily against biologically-inspired and standard CNNs is most appropriate for isolating the effects of architectural priors. Moreover, many attention mechanisms are hypothesized to arise at higher cortical stages, beyond the scope of our subcortical and V1 front-ends [3]. Nonetheless, we acknowledge the importance of this comparison and will expand the discussion in the final version to better contextualize our findings within broader computer vision research.\n\n### **Scaling in opposition to neuro-inspiration**\nWe thank the reviewer for invoking Rich Sutton's \"Bitter Lesson.\" While the lesson cautions against manual design in favor of scalable approaches in task-optimization regimes, we believe the story in neurally-aligned vision is more nuanced. In fact, prior work [4] suggests that bigger models are not necessarily more brain-like. Additionally, recent evidence from large-scale benchmarking [5] shows that neural alignment with the primate visual cortex saturates with scale, even as task performance and behavioral alignment continue to improve. Crucially, models with strong architectural priors such as CNNs achieve higher neural alignment, than scale-heavy models like ViTs, especially in low-data regimes. Furthermore, human vision itself is highly efficient, achieving strong generalization and robustness under tight biological constraints. Our work aims to mimic this efficiency by introducing compact, fixed-weight modules that encode inductive biases aligned with the structure of early primate vision. In resource-constrained applications, such efficient and interpretable models may offer practical advantages over large-scale transformers. We will explicitly discuss these tradeoffs and include a broader reflection on the tension between scaling and structure in the final manuscript.\n\n### **Stochasticity during inference**\nWe thank the reviewer for the insightful suggestion regarding removing stochasticity during inference. The Poisson-like nature of stochasticity shifts the activation distribution non-symmetrically. This way, removing stochasticity after training the model with it, impairs its performance (clean accuracy declined from 71.7% to 64.5%). This phenomenon is also present in VOneNets. On the other hand, the alternative strategy of averaging the logits of multiple stochastic forward passes per image, mirroring an ensemble strategy, is a valid one. When averaging over 3 forward passes increased ImageNet accuracy from 71.7% to 72.2%, corruption robustness from 41.5% to 42.4%, and OOD generalization from 38.7% to 39.2%. We will perform an extensive analysis to explore how performance is affected by the number of forward passes and include it in the final manuscript.\n\n### **Empirical tuning curves**\nWe agree with the reviewer that including real neural tuning curves would enhance Figure 2. Our model tuning curves were carefully fitted and aligned to mean LGN response properties from multiple studies, as described in Section 2.2 and Supplementary Material E.2. However, due to the heterogeneity of biological neurons, there is no single “canonical” response to compare against. Our goal was to model the average tuning behavior of foveal P and M cells. That said, we appreciate the need for transparency and will include representative empirical curves alongside our model fits in the Supplementary Material, along with citations and commentary.\n\n### **Light adaptation pooling size**\nIndeed, the biological visual system includes both global and local light adaptation. In early experiments, we implemented a local light adaptation layer using a Gaussian filter. However, during Bayesian optimization, the filter radius consistently grew toward the size of the image, effectively becoming global. To avoid unnecessary compute, we opted for global luminance normalization. That said, we emphasize that our model retains multiple local adaptation mechanisms such as DoG filters and a contrast normalization layer, which provide spatially localized gain control and surround modulation. We will clarify this design choice and include ablation results in the Supplementary Material.\n\n### **Skip connections**\nWe appreciate the creative architectural suggestion and agree that skip connections from the SubcorticalBlock to the downstream CNN could reflect known projections from LGN to V2. While direct skips from the pixels to V1 are less biologically plausible, incorporating LGN-V2 bypasses is indeed worth exploring. We plan to investigate this for the final version. Such modifications could offer greater flexibility for the network to use or ignore early features depending on the context.\n\n### **Trainable front-ends**\nWe fully acknowledge the potential benefits of allowing early blocks to be fine-tuned. However, our focus was on designing a fixed-weight front-end that is biologically grounded and not driven by task-based optimization. This approach improves interpretability and alignment with neuroscientific models, and is motivated by prior work showing that fixed-weight architectures like the VOneBlock can achieve competitive robustness. Nonetheless, we agree that enabling training of these early modules is a promising direction. Prior work [6] has shown the utility of this strategy by introducing trainable divisive normalization in a VOneNet-style architecture leads to both enhanced robustness and improved alignment with V1 recordings, as measured by BrainScore. More broadly, letting the front-end adapt to the task might allow neural-like operations to emerge rather than be hand-specified. For example, [7] showed that DoG-like filters can emerge when a convolutional network is constrained by architectural bottlenecks similar to the primate optic tract. This suggests a compelling hybrid route of initialization with biological priors followed by task-dependent fine-tuning thereby balancing biological plausibility and representational flexibility. We will elaborate on this in the revised Discussion and highlight the possibility of initializing from neuro-inspired weights but allowing task-driven fine-tuning.\n\n### **References**\n[1] A. Modas, R. Rade, G. Ortiz-Jiménez, S.-M. Moosavi-Dezfooli, and P. Frossard, ‘PRIME: A Few Primitives Can Boost Robustness to Common Corruptions’, in Computer Vision -- ECCV 2022, 2022, pp. 623–640.\n\n[2] D. Hendrycks et al., ‘The Many Faces of Robustness: A Critical Analysis of Out-of-Distribution Generalization’, in 2021 IEEE/CVF International Conference on Computer Vision (ICCV), 2021, pp. 8320–8329.\n\n[3] S. J. Luck, L. Chelazzi, S. A. Hillyard, and R. Desimone, ‘Neural Mechanisms of Spatial Selective Attention in Areas V1, V2, and V4 of Macaque Visual Cortex’, Journal of Neurophysiology, vol. 77, no. 1, pp. 24–42, 1997.\n\n[4] J. Kubilius et al., ‘Brain-Like Object Recognition with High-Performing Shallow Recurrent ANNs’, in Advances in Neural Information Processing Systems, 2019, vol. 32.\n\n[5] A. Gokce and M. Schrimpf, ‘Scaling Laws for Task-Optimized Models of the Primate Visual Ventral Stream’. 2025.\n\n[6] A. Cirincione et al., ‘Implementing Divisive Normalization in CNNs Improves Robustness to Common Image Corruptions’, in SVRHM 2022 Workshop @ NeurIPS, 2022.\n\n[7] J. Lindsey, S. A. Ocko, S. Ganguli, and S. Deny, ‘The effects of neural resource constraints on early visual representations’, in International conference on learning representations, 2019, vol. 77"}]

Author rebuttal:

Meta-review: The paper introduces Early Vision Networks (EVNets), which combine biologically-inspired subcortical processing (retina and LGN) with existing V1-inspired modules to improve CNN robustness. The key contribution is a fixed-weight SubcorticalBlock that systematically integrates Difference-of-Gaussians filtering, contrast normalization, and neural noise, calibrated to neurophysiological data, with the goal of enhancing both brain alignment and robustness to corruptions and domain shifts.

The reviewers generally found the idea scientifically sound and well-motivated, with clear writing, code availability, and some notable robustness gains. Strengths include stronger alignment with V1 benchmarks and improved robustness to image perturbations. Weaknesses centered on limited novelty (building heavily on VOneNet with only incremental extensions), relatively weak or incomplete baseline comparisons (e.g., not fully evaluated against other SOTA robustness methods or newer architectures), and limited insight into why the observed improvements arise. Some reviewers also flagged missing implementation details and limited ablation coverage.

The authors’ rebuttal and subsequent exchanges clarified their novelty claims (emphasizing systematic integration of subcortical pathways and empirically constrained hyperparameters), provided additional baseline results (including PRIME and adversarial training), and committed to expanding analyses (e.g., ablations, parameter tables, classical vision literature, and more architectures). These responses addressed several clarity concerns and convinced most reviewers that the work represents a meaningful, if incremental, advance. Still, skepticism remains regarding originality relative to prior VOneNet work and the magnitude of robustness improvements.

After discussion, two reviewers maintained strong support based on the quality of execution and multidisciplinary relevance, while one reviewer remained cautious about novelty but acknowledged that the rebuttal improved their assessment. Overall, the consensus is that the contribution, though incremental, is solid and of interest to the NeurIPS community, with sufficient empirical support and reproducibility.

Given all this, the AC recommends the paper be accepted. The work is not a major breakthrough but provides a useful addition to the growing line of bio-inspired models, and the community can benefit from its careful integration of subcortical mechanisms. The authors are encouraged to strengthen their comparisons and better contextualize the novelty in the camera-ready version.
Decision: Accept (poster)