Normalize Filters! Classical Wisdom for Deep Vision
Authors: Gustavo Perez
Stella X. Yu
Venue: NeurIPS 2025 poster ()
Keywords: convolutional neural networks
deep learning
filter normalization
codomain symmetry
Primary area: deep_learning
TL;DR: Deep learning image filters lack normalization. We propose filter normalization with learnable scaling and shifting, achieving significant improvements in intensity variation benchmarks.

Abstract: Classical image filters, such as those for averaging or differencing, are carefully normalized to ensure consistency, interpretability, and to avoid artifacts like intensity shifts, halos, or ringing. In contrast, convolutional filters learned end-to-end in deep networks lack such constraints. Although they may resemble wavelets and blob/edge detectors, they are not normalized in the same or any way. Consequently, when images undergo atmospheric transfer, their responses become distorted, leading to incorrect outcomes. We address this limitation by proposing filter normalization, followed by learnable scaling and shifting, akin to batch normalization. This simple yet effective modification ensures that the filters are atmosphere-equivariant, enabling co-domain symmetry. By integrating classical filtering principles into deep learning (applicable to both convolutional neural networks and convolution-dependent vision transformers), our method achieves significant improvements on artificial and natural intensity variation benchmarks. Our ResNet34 could even outperform CLIP by a large margin.  Our analysis reveals that unnormalized filters degrade performance, whereas filter normalization regularizes learning, promotes diversity, and improves robustness and generalization.

Normalize Filters! Classical Wisdom for Deep Vision
Gustavo Perez'
Stella X. Yu!
"llcctrical Engineering and Computer Sciences, University of California, Berkeley Computer Science and Engineering, University of Michigan (gperezs, stellayu/@berkeley edu, stellayu@umich. edu
Abstract
Classical image filters, such as those for averaging differencing, carefully normalized to ensure consistency, interpretability. and to avoid artifacts like inten- sity shifts, halos, ringing. In contrast, convolutional filters learned end-to-end in deep networks lack such constraints. Although they may resemble wavelets and blob/edge detectors, they not normalized in the same any way. Con- sequently, when images undergo atmospheric transfer, their responses become distorted, leading incorrect outcomes. We address this limitation by propos- ing filter normalization, followed by learnable scaling and shifting, akin to batch normalization. This simple yet effective modification ensures that the filters are atmosphere-equivariinn, enabling co-domain symmetry. By integrating classical filtering principles into deep learning (applicable both convolutional neural networks and convolution -eeeedddnnddeeeeenett vision transformers), our method achieves sig- nificant improvements on artificial and natural intensity variation benchmarks. Our ResNet34 could even outperform CLIP by large margin. Our analysis reveals that unnormalized filters degrade performance, whereas filter normalization regularizes learning, promotes diversity, and improves robustness and generalization.
Introduction
Image filtering a cornerstone of classical computer vision; averaging and differencing filters play fundamental role in noise reduction, edge detection, and feature extraction. These filters are meticulously designed and normalized to ensure consistent and interpretable results (Fig. D.
normalized filtering
extra
=unnormali filtering
filters
image
Un-norin alized derivative filter
blurring
Nomalized derivative filter
Difference: extra blur filter
unnormalized
normalized
difference
10 20 30
Figure 1: Filter normalization is critical in classical computer vision for consistency and interpretability, while unnormalized filters obtained by deep Iearning lack this property. Left: For checkerboard (Column 1) under uniform (Row 1) and varied (Row 2) illumination, we compare responses from normalized (Column 2) and unnormalized (Column 4) filters; the latter equals the sum of the former and extra blurring (Column 3). Right: For normalized and unnormalized Difference- of-Gaussian (DoG) filters, we show their horizontal profiles at the center row and their difference. Normalized DoG detects edges despite illumination changes, while unnormalized DoG introduces blurring that varies with illumination, overpowering edges with mean response shifts.
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

Filter normalization is critical because it prevents artifacts such as intensity shifts, halos, and ringing, which can distort the output and undermine the relia- bility of downstream tasks. For example, in Gaussian blurring, the filter kernel is normalized so that its weights sum to I, preserving the overall intensity of the image while smoothing out fine details. Similarly, Gaussian derivative filters are normalized so that its positive weights sum to +1 and negative weights sum to -1, enabling accurate edge detection and allow- ing edge strengths to be compared across different types of derivative filters. This careful normaliza- tion process has been hallmark of classical filtering, ensuring consistency and robustness across a wide range of applications (See Fig. D
Atmospheric transfer functions
neghow te orased (a-1)
Dinmer (Rokendgaa)
(ies sced pan baro
LUTE
Hollccancc
Fuffedarce
Nafuctarce
Figure 2: The same visual scene can be seen very differently under various atmospheric conditions. Lighting, shadows, and haze can be modeled by Atmospheric Transfer Func- tions (ATFs) (2). which map the physical re- flectance of scene to the luminance in the image. Varying gains and biases can simulate effects like brighter/dimmerrhaayy scenes.
In contrast, convolutional filters in deep networks are not explicitly designed but are instead learned end-to- end, emerging through an optimization process driven by data and training loss. While these filters may resemble wavelets, blob detectors, or edge detectors [4 14 29
40 32 18), they are not normalized in the same or any way as their classical counterparts. This lack of normalization deviates from the training distribution.
lead to unpredictable behavior, particularly when the input data
In Fig. D for the checkerboard under uniform and un- even illumination, the normalized Difference of Gaus- sian (DoG) filter consistently detects checker edges. In contrast, the unnormalized DoG filter, whose pos- itive weights sum to +2 and negative weights to -1, is equivalent to the sum of the normalized DoG and a
75
Top-1 accuracy (50
4138 1220) toand
452
25
4323 1eti
CLP 142099
normalized blur filter. This extra blurring causes the
response to shift with illumination and overwhelm the edge response of the normalized DoG.
D
D2
D2
Dg
Ds
Such illumination effects, commonly found in au- tonomous driving, medical imaging, and remote sens- ing, can be modeled as Atmospheric Transfer Func- tions (ATFs) 12) which linearly map the physical reflectance of scene to the luminance in the image. Varying the gain and bias of the linear map simulates real-world effects like brighter/dimmer//hry scenes (See Fig. 2. However, the responses of unnormalized filters to such intensity changes can become distorted, compromising the neural network's performance.
R34N R34
Figure 3: Feature normalization outper- forms larger ResNet and ViT models, in- cluding CL.IP, in accuracy and robustness on atmospheric transfer benchmarks. Ev- ery model trained on D. the original Im- ageNet dataset, but tested on D and its four ATF variations: Dc, Dr, DB, Ds. as illus- trated for the image example in Row 1. The response of ResNet34 filter with filter nor- malization (Row 3) remains more robust and informative than the one without normaliza- tion (Row 2) to such intensity transformation.
Data augmentation and instance normalization (33 are two common methods to address data distribu- tion shifts. However, the former requires anticipating domain shifts in advance and increases training com- plexity, while the latter assumes that all pixels in an image follow the same statistics and cannot handle spatially varying biases, e.g., Fig. T
We propose filter normalization, a novel approach that normalizes convolutional filters followed by learnable scaling and shifting, akin to batch normalization. This simple yet effective modification with consistent responses under varying conditions.
ensures that the filters are atmosphere-equivariin
Our extensive experiments on artificial and natural intensity variation benchmarks demonstrate that our approach is not only robust but also outperforms larger models of ResNet [13] and Vision Transformer (ViT) [10] architectures. Most strikingly, ResNet34 with feature normalization surpasses CLIP, the
2

---

extensively trained large vision- laiguale model, by an absolute 20% on ImageNet in hazy conditions (Fig. B}. Consistent gains are observed on ImageNet, ExDark, and LEGUS benchmarks. Our analysis further reveals that unnormalized filters degrade performance, whereas filter normalization regularizes learning and promotes diversity, leading to better robustness and generalization.
Our contributions. 1) Identifies unnormalized filters as a key limitation in deep learning, distorting responses under intensity variations. 2) Proposes filter normalization with learnable scaling/shifting, ensuring atmosphere equivariance. 3) Achieves consistent gains across CNNs and ViTs on intensity variation benchmarks, outperforming larger models, including CLIP. 4) Enhances robustness and generalization through diverse, interpretable filters.
2
Related work
Deep networks' performance can be severely impacted by atmospheric transformations (we use "atmospheric" in the context "The net effect of the viewing conditions, including additive and multiplicatiive effects" (2). To mitigate this, various approaches have been developed such as architecture modifications to achieve equivariance to some transformations, normalization layers to enhance network robustness to instance-level perturbations, and data augmentations to improve robustness and generalization.
Equivariance and invariance to transformations. Several works have proposed modifications to deep neural networks to achieve equivariance invariance to specific transformations. For instance, 22 [9] introduced model modifications to achieve equivariance to rotations, [6 used circular harmonics to achieve equivariance rotation and translation, [1] achieved invariance to translation and equivariance to rotation and scale, while [23 15
focus on image denoising.
Complex-valus valued deep learning has also been studied to achieve codomain symmetry to geometric and color transformations [30]. 4 another approach that achieves equivariance through transformations on scaling and rotation manifold. To the best of our knowledge, other than [5 6 existing methods focus on geometric transformations and overlook atmospheric variations like gain-bias shifts, Closest to work, [15] proposes equivariant networks to gain and bias. However, proposed normalization also provides practical invariance to bias, leading to improved robustness.
Normalization layers. Instance Normalization (IN) [33 layers can be added to the network to reduce gettacce-ppeifii biases, improving robustness to multiplicative and additive effects. However, IN may not fully address covariate shift, leading to suboptimal training. On the other hand, batch normalization (BN) [16] layers reduce covariate shift, but fail to address instance- speciffc biases. Other normalization techniques, such as group normalization (GN) [38]. which balances the benefits of BN and IN by dividing channels into groups, have also been proposed. However, these methods operate on feature activations, whereas our approach introduces a data-agnostic modification to the convolutional layer by normalizing filter weights. This allows our method to address instance-specific biases while still enabling training with BN to handle covariate shift, resulting in improved training.
Data augmentation. Atmospheric effects are frequently addressed with data augmentations, which a common technique for improving model robustness. Automated augmentation strategies like RandAuggent g and AutoAugment [7] have been proposed to reduce the search space of data perturbations. However, they increase training complexity and require prior knowledge of the target domain since it is challenging to account for all possible variations in the deployment data. In contrast, our approach provides inherent robustness to these perturbations, eliminating the need for extensive data augmentation.
Deep network architectures. CNN architectures such as ResNets [33 have been successful due to their ability capture spatial hierarchies and local correlations. ViTs [10] on the other hand, employ an attention- based mechanism that allows for global interactions between image regions, enabling more flexible and context-depender feature extraction. However, more recent architectures like ConvNeXt [20 have demonstrated comparable performance to ViTs, while maintaining the efficiency and interpretability of traditional CNNs. Other approaches like Convolutional Vision Transformer (CvT) 37 improve ViT's by adding convolutions. Our approach can be applied to any convolution- based architecture, and we show that leaner models with our normalized convolutions outperform large attention-bau based models like CLIP (26 in robustness to atmospheric corruptions.
3

---

3
Filter normalization for deep learning
We have shown that unnormalized filters obtained by deep learning lack consistency and interpretabil- ity with respect to atmospheric transfer functions (Fig. T We will first relate an arbitrary filter to normalized filters followed by scaling and shifting. We then prove atmosphere equivariance of normalized filters.
3.1 Any linear filter is both averaging and differencing
We connect a convolutional filter with weights classical averaging (blur) and differencing (derivative) filters. The filter response, y, to k inputs Tir.. is defined as:
y = [(:; w))
Σ WAY:
We divide into positive and negative parts. Let 1()) denote the indicator function which outputs I if the input positive and otherwise. Let denote the Hadamard product (multiplication of elements). We have:
w = w w
(2)
w + = 1(w > 0)
(3)
w (-w) 1(w < 0)
(4)
where both w and w are nonnegative k 1 vectors. The L1 norm || ||| these vectors is simply the total sum of their respective weights. We will use L norm exclusively throughout this paper, with || || as || for short.
We define the positive weight ratio of a filter, denoted by as the ratio between the algebraic sum and the total absolute sum of all the weights (See Fig. 4). We have:
0.1
3200
0.0
0.5 Figure 4: Convolutional filters learned in CNNs are unnormalized, leaning more toward differencing than aver- aging. The distribution of the positive (6) weight ratio of filters for each model optimized for ImageNet classification is skewed towards 0, indicating that most filters primarily perform differencing.
-0.5
r(w)= Σ
1|w
||
(5)
E1= hay
1
||
Σ wy 1|w 11 || =
|||||| rr(w).
straightforward to prove the following properties.
1. |r(w]] $ 1.
2. r(w) =1 11 (-1) when and only when all non-zero weights of w are positive (negative).
3. r(w) 2 when and only when I|w
In classical computer vision, there are two types of filters: averaging and differencing filters, each type normalized properly to ensure consistency and interpretability:
averaging: ||w 11, || 0 r(w) =
differencing: || |=-||11, 1, ||=0||=,,,, r(w)
(8)
That is, an averaging filter produces a normalized weighted average its inputs, and a differencing filter produces the difference between two normalized weighted sums, one using positive weights and the other negative weights.
We show that an unnormalized filter w is weighted sum of differencing filter and an averaging filter (Fig. I. Without loss of generality, we assume | ||l ||: otherwise, we can study w instead. We have:
+
||w
+ +[Iw
||
differencing filter
averaging filler
Therefore, general filter behaves between averaging and differencing, and the closer its positive weight ratio is to 0 (1), the more dominant differencing (averaging) it becomes.

---

3.2 Filter normalization
Consider the input intensity x modulated by a scalar gain factor g and a scalar offset o:
x x g 12-46
(10)
[ 1), the image looks brighter (dimmer) with an expanded (reduced) range; g < 1 and o>> 0, the image looks brighter and hazy with reduced contrast (Fig. 2 For any unnormalized filter w, the response becomes
If g2 (g<1),
fl x 0) g [1x) + o- ||l||| r(w)).
(11)
If all filters in a layer are unnormalized, each response is scaled by the filter's 's total weight sum, [[]])[(w) thereby altering the feature representation at that layer. However, if all filters are normal- ized, their responses are scaled uniformly by the same gain factor g, that is, they produce consistent and interpretable responses with respect to intensity changes.
We address this limitation by proposing filter normalization, followed by learnable scaling and shifting, akin batch normalization. A convolutional filter of kernel size in deep learning is parametrized by weight wo and scalar offset b. Given an arbitrary filter w, we first normalize its positive and negative parts individually:
y Wa0 b ||00||
T2
Σ
w
Wi |||||
24
+
(12)
[
w
w
W
It +
(13)
+
+
scaling
shifting
filter normalization
where E a small constant (e.g., 10 10-6) 9) to ensure numerical stability. This is followed by learnable scaling and shifting b, which model response weighting [|w|]|
and offset b, respectively.
This normalization step enforces the filter to become either averaging if w is all positive, or differenc- ing if w has both positive and negative weights:
1. Averaging filters are equivariant to both gain and offset: f(g x +)) = gg. f(x) + o, where | = 1 and r(w) 1.
2. Differencing filters are invariant to offset and equivariant to gain: f(g + g f(z). where |w/| = 1 and r(w)= = O.
This decomposition ensures dimosspere-equivaatie
and enable co-domain symmetry, meaning the filter response transforms in predictable, structured way under affine transformations of the input intensity x, via gain g and offset o, (i.e., global illumination changes.) Averaging filters respond to both contrast and brightness, while differencing filters respond only to contrast.
4 Experiments
Our approach normalizes convolution filters in deep networks to climinate artifacts and enhance robustness to atmospheric perturbations. While we demonstrate its effectiveness on ResNets [3), the method is broadly applicable to any model with convolutional layers. We evaluate approach artificially corrupted ImageNet [9] and CIFAR [77] datasets for image classification tasks, as well as on natural data with intensity variations, including low-light and astronomy datasets. Additionally, we perform extensive analyses, ablations, and comparisons with alternative techniques such as data augmentation and normalization layers.
4.1 Results on artificially corrupted benchmarks
We use the original ImageNet-Il kk 9 and CIFAR-10 [17] training sets to train our models. ImageNet- Ik contains 10 categories, with 50K and 10K training and testing images respectively. We denote the original evaluation sets of these datasets D.
million training images, 50K validation images, and 1,000 classes. CIFAR-10 has
We propose four additional evaluation sets by applying random gain and bias perturbations to D. 1) De has constant random gain-bias corruptions to the entire image: क + B, where E is the
5

---

Dc Du Da
D5 Figure 5: Top: our corrupted evaluation bench- marks simulate realistic scenarios with vary- ing global and local illumination sources and atmospheric effeets. We add corruptions to Ima- geNet original validation set (D). The first three (DC.L. sets apply random atmospheres (See Fig. 2 in constant, linear, and blob fashion. Ds applies a constant random variation with a fixed shift. Bottom: our approach provides more ro- bust results on the corrupted datasets and sur- -iiiiiiiiiinuuiviinntt networks across architectures while maintain- ing performance the original test set. We train vanilla (R20) and normalization-con -qquivarann the original CIFAR-10 training set and show classification accuracy on D, Dc, DL, Dg, and Ds. Our approach (R20N) achieves significantly lower accuracy drop com- pared vanilla R20 and norm-equívariant R20E, See complete CIFAR-10 results in Appendix A.
gainibias fields
passes vanilla and
nets (R20E) [15]
Accomee
75
R20
R26E INom equ.varant Nets)
R20N (Ouns)
comuupeed image, and Unif 1.3) and B Unif(- 00.3, 0.3) calculated to have maximum variation of =30% from the original image x intensity. 2) has gain- -ias corruption in a smooth linearly decreasing fashion: f x @ Lo + Lg, where denotes the Hadamard product, L, is linearly varying field with values [ao: 0n) [an]]w] where Org, (r ~ Unif(0.5, 1.5), and L different linear 0.5), both fields with the same random direction. 3) Dg has the gain-hias perturbation in a blob with a fixed but decaying radius centered on a random pixel in the image: ã= = @ B, + Bg. where B, and Bg are blob fields calculated with a cubic decay over radius of 0.8 the size of the image. De, Dr, Dg simulate global and local atmospheric effects such variations in illumination caused by the environment or artificial light sources, calibration, or artifacts from sensor defects (See Fig. 2). 4) Ds perturbation is also constant as in Dc, but with a fixed strong shifted bias to increase the data distribution shift: ã 1arr + B + Y), where ~ (0.7 1.3), 3 Unif( 0033, 0.3) and = 1.
field with values [Bo 31] where 30, 31 Unif[n
We anticipate that four corrupted evaluation introduces a uniform perturbation across the entire image, Dr, applies linearly varying gain and bias, while D3 B imposes perturbation with cubic decay from randomly selected set of coordinates. On the other hand, Ds also applies a uniform corruption, but with an additional fixed bias shift, which further increases the divergence between the testing data distribution and the original training set.
will exhibit increasing levels of difficulty; De
Our normalized convolutions are more robust across architectures on CIFAR-10. We evaluate our normalized convolutions (R20N) on CIFAR with vanilla ResNets [3] (R20). Additionally, we compare to norm-equivariant nets 15 (R20E), which the most recent baseline and closest related to our method. Norm-equivariant networks replace ordinary convolutional layers with affine-constrained convolutions and traditional activation functions like ReLU with channel-wise sort pooling layers to preserve aawaiizationequivarianne
by design, allowing the network to handle changes in input scale and shift. Following their official implementation [15), we replace the vanilla convolutions and activations in the ResNets with affine convolutions and sort pooling layers, respectively.
Original bext
Modorata compuptin
Strong comuuption
Figure 6: Feature quality from unnormalized convolutions drops under atmospheric pertur- bations. We show the t-SNE visualization of a R20 last layer's features with moderate and strong levels of corruption on CIFAR- 10. Top: A vanilla R20 fails under atmospheric perturbations (De), while Bottom: our approach maintains the fea- ture quality even with strong perturbations (De with maximum variation of +100%).
We train the three models (R20, R20F, R2ON) using SGD with a learning rate of 0.1, a cosine anncaling schedule for 200 epochs, and batch size of 128. Fig. bottom shows our approach's

---

80
Accora
75
30
4%
8%
10% 20%
% training data
25
Figure 7: Low-shot training benefits from nor- malized convolutions. We show the accuracy on the De set when training with fewer labeled images (indicated by %). Our approach generates more robust features against atmospheric effects, while also avoiding artifacts that can occur with unnormalized convolutions.
Evaluation
Figure 8: Features from our normalized convo- lutions improve downstream classification on ViTs. We show the accuracy of small ViTs on CIFAR-10 when trained using feature maps from R44 as input. ViTs are more robust than vanilla ResNets, but using feature maps from our normal- ized convolutions reduces the performance drop against atmospheric effects (Dc. DL, DB, Ds).
Table 1: Our approach surpasses vanilla CNNs and ViT-based architectures on the corrupted ImageNet-Ik. We show Top-1 accuracy on the original validation set (D) and our proposed benchmarks (Dc, Dr, DB B, Ds) for various pre- trained ResNets, ViTs, and CLIP (LAION), Our method provides more robust results on the cor- rupted datasets while maintaining close perfor- mance the original set (D). Notably, R34N (22M params.) outperforms larger models like ResNet101, ViT-large, and CLIP.
Model
N par (M)
D
De
Dr.
Dp
Ds
Figure 9: Our convolutions maintain their fo- cus on salient regions despite the presence of atmospheric effects. Grad-CAM visualizations
R34
73.3
68.6
64.5
36.8
2.1
R50
26
76.1
69.0
63.1
21.8
0.6
R101
15
45
77.4
69.1
62.9
34.0
1.1
VIT-B
10
87
75.7
66.5
61.3
39.6
0,7
VIT-L 10
304
79.3
72.8
67.7
41.8
1.1
show that vanilla R34 trained on ImageNet loses
CLIP-B/32
26
151
60.2
58.4
56.4
52.3
14.3
focus on relevant regions under strong corruptions
CLIP-L/14
428
68.
67.4
66.7
65.6
49.1
R34N (purs)
22
73.2
72.8
71.7
68.1
67.0
(top), while our R34N produces more stable fea- ture representations (bottom).
Trained on LAJON 18 Zcot-shot classification accuracy)
superior robustness to atmospheric effects, outperforming vanilla R20 and norn-equivariant R20E. See complete results with larger models in Table AT
To further analyze the impact of corruptions on feature representations, we visualize the last layer features 1IFAR-10's test set using t-SNE [34]. As shown in Fig. totpp vanilla R20 struggles to produce discriminative features in the presence of atmospheric variations (De ). whereas our approach (Fig. (o-bootom) preserves features more effectively even under severe corruptions (Dc with max. variation of 100%). In Appendix De varying the amount of corruption.
1.1.1 1.... we show the performance of R20 and R20N on
Low-shot learning benefits from normalized convolutions. We investigate the benefits of our approach to other tasks. Our proposed convolutions not only produce equivariant features gain and offset variations but also reduce the number of artifacts produced by unnormalized contrast filters. We expect these features be particularly advantageous in low-data regimes. Table A2 shows our normalized convolutions outperforming on the original evaluation set D for very low data regimes. Additionally, Fig. 7 andd Table A3 show the effectiveness of our approach on De, outperforming a vanilla R20 when trained with limited data. Notably, the performance gain between our approach and the baseline widens as the amount labeled data decreases (14.4% difference with 4% data).
Features from normalized convolutions improve downstream classification on VITs. For this set of experiments we train a small ViT 39 on CIFAR- 10 with x 4 patch size, layers, heads, and training hyperparameters matching those in ResNet experiments. Fig. and Table A4 show that, although vulnerable to atmospheric effects, ViT' exhibit greater robustness than vanilla ResNets in this task. For instance, the small VIT achieves 80.6% accuracy the D3 benchmark, outperforming a vanilla R44.
Next, we experiment using ResNet feature maps as input to the VIT. We use the feature maps of the last convolutional layer (16 x 16) as input to the ViT with the same 4 x patch size. In Fig. and Table we show that using feature maps from normalized convolutions (R44N,) mitigates the impact of perturbations, outperforming the original ViT by 3.8% (84.4% vs. 80.6%) on Ds
7

---

Table Accuracy per contrast level. We bin the ImageNet- Ik test set into contrast levels (based on pixel standard deviation). R34N maintains more stable accuracy across the contrast spectrum compared the baseline, which drops sharply at the extreme contrast values. Top row: example images from the uncorrupted test set for the lowest-contrast bin (left), the middle bin (center), and the hoghest bin (right). Bottom: accuracy table showing performance for each contrast bin.
Model
Lowest
Contrast
Contrast
Contrast
Contrast 5
Contrast
Contrast
Contrast 8
Highest
R34
65.4%
74.0%
74.8%
75.2%
73.2%
70.8%
70.7%
67.9%
63.3%
R34N
69.2%
74.1%
74.6%
74.5%
73.3%
71.1%
71.1%
67.3%
71.4%
Our approach achieves consistent gains across CNNs and ViTs on ImageNet. We train R34 with our normalized convolutions from scratch the original ImageNet- Ik training set for 90 epochs, a batch size of 256, and SGD with an initial learning rate of 0.1 divided by 10 every 30 epochs. In Table we show that our approach (R34N) is more resilient atmospheric corruptions, with up to 5% performance drops on our proposed benchmarks (Dc. Dr. Dn, Ds), whereas a vanilla R34 suffers significant drops of up 97% on the most corrupted datasets. Additionally, Grad-CAM [28 visualizations in Fig. | show that R34 loses focus from salient regions under corruptions while our R34N produces more stable representations.
Notably, our R34N with 22M parameters achieves better results than larger models like ResNet101 (45M), VTT-B (87M), and CLIP [26] (151M) trained on much larger datasets like LAION (27). Although CLIP used here as a zero-shot classifier and our R34N is trained specifically for ImageNet classification, the comparison is fair and meaningful because both models face the same unseen coruptiinn at test time. fact, the comparison disadvantages our method, as CLIP was trained on 400M diverse images and likely encountered many degradations that our model has not seen. Despite this, R34N outperforms CLIP on intensity corruptions, highlighting the effectiveness of our filter normalization approach. On the original test set D, specialist models like R34N and R34 outperform generalist models like CLIP-B (~73% vs. 60.2% reflecting their domain-specific focus, However, on corrupted sets, specialist baselines collapse (e.g.. R34 drops from 73.3% to 2. 1)), while CLIP-B drops but to a higher accuracy (from 60% to 14.3%). In contrast, R34N achieves 67.0% on corrupted sets, far surpassing both R34 and CLIP-B. This demonstrates that the robustness gain comes from the architecture itself, not from exposure to corruptions or tradeoffs on original clean performance.
Robustness on original NetgeNet images across low and high contrast. To evaluate robustness to natural variation, we partition the uncorrupted ImageNet- k test set into nine contrast bins defined by pixel-level standard deviation.
shown in Table R34N exhibits notably more consistent accuracy across contrast levels, while the baseline model suffers substantial degradation at the extremes. These results highlight the improved robustness R34N to natural, realistic atmospheric conditions.
4.2 Results on natural data
Our normalized convolutions are more robust under extreme low light conditions on ExDark dataset. We evaluate our approach on the Exclu- sively Dark (ExDark) Image Dataset (2T). which con- Figure 10: Samples from the ExDark dataset. tains over 7, 7,000 images captured in 10 different low-light conditions. We focus on the images labeled as "low light" (Fig. 10). to validate the robustness of our approach extreme low-light scenes. The ExDark dataset provides image-level labels for 10 classes, which are related to ImageNet categories. Specifically, the ExDark classes are a coarser version the ImageNet categories (e.g., Dx has "dog" class, while ImageNet has multiple classes for different dog species). We do zero-shot evaluation on ExDark using a vanilla R34 and our R34N, both trained on ImageNet. We map the ImageNet labels to the coarser ExDark labels and evaluate the models. Our R34N achieves 34.2% classification accuracy, outperforming R34 (28.3%).
8

---

Our normalized convolutions generalize better across galaxies in astronomy data from LEGUS. Star cluster classification from galaxies is active research area astrophysics, as it provides insights into the process of star formation [2 D. As new telescopes like the James Webb (JWST) continue to capture new data, models that can generalize across galaxies becomes increasingly important.
a) NGC628 (left) and NGC1313 (right) from HST
We explore the potential of our normalized convolu- tions using the LEGUS dataset [3]. which contains data from 34 galaxies captured by the Hubble tele- scope (HST) with spectral channels and ~15,000 annotated star clusters and other sources. We evalu- ate the robustness to varying luminance conditions by training and evaluating on different targets. Specifi- cally, we use galaxies NGC628 and NGC1313 which have a noticeable difference in intensity (Fig. TT).
b) A single star cluster with its 5 spectral bands
275W 336W 435W 555W 814W
Figure 11: Astronomy data suffers from significant intensity variations, similar to atmospheric effects on standard pho- tographs. a) Galaxies NGC628 (left) and NGC1313 (right) from HST data, showing higher luminance in NGC1313 due to back- ground light caused by dust and gas. b) A star cluster crop with its five spectral bands (275W-814W) from the LEGUS dataset.
We train a R18 on NGC628 using around 2,000 object-centered patches of size 32 x 32 x 5 from coordinates provided in LEGUS (See Fig. (). to classify them into one of four morphological classes. We use training hyperparameters as in (25) and eval-
uate on galaxy NGC1313 sources. Our results show an accuracy of 50.2% with vanilla R R18, while our R RI8N improves accuracy to 51.9%.
4.3 Analysis and ablation studies
Unnormalized filters learn less diverse representa- tions. Normalization can promote diversity by fore- ing the filters to lie on a specific manifold. We study filter similarity using guided backpropagation [31] to visualize filter gradients with respect to the images on the ImageNet validation set. Then, we compute the correlation matrix of the guided backpropagation maps of each filter in layer and plot the histogram of its off- off-diagonal elements. Low values from the off-diagonal elements indicate less similar features.
0.10
RH
0.10
Loar 21 31
0.05
0.05
0.00
0.0
0.5
Filter similarity
Figure 12: Unnormalized filters produce less diverse features. We compare the filter similarity histograms of a vanilla R34)and our R34N trained on ImageNet. Left: The his- togram for the last eight convolutional layers shows that R34N has a more skewed distri- bution towards lower similarity values than vanilla R34. Right: Consistent with [35]. layer- wise histograms reveal that vanilla R34 produces more similar features in later layers, whereas R34N does not exhibit this trend.
Fig. 12 shows that our R34N learns less correlated features, with histogram more skewed towards zero
Unnormalized filters produce more errors. We investigate the relationship between a filter's level of "unnormalization" and misclassifications. First, we calculate the positive weight ratio [)) of the filters in the first layer of ImageNet pretrained R34. We expect this metric to be 0 for normalized differencing filters (See Fig. leftt... Then, focusing on the first layer, where gain and bias effects are largest, we find the Top 100 images on De that maximize the response for each filter and calculate the number of misclassified ones by the network.
In Fig. 13 -iigh we show that for a R34, the images with higher response from filters with higher [r(w)) are more likely to be misclassified. For instance, filters with highest [r(w)] misclassify ~67% of the images, while the least unnormalized misclassify 330% Our R34N avoid this issue by design.
Are data augmentations enough? To evaluate the effectiveness of data augmentation, we train a vanilla R20 and our proposed R20N using atmospheric augmentations on CIFAR-10. We use random gain-bias augmentations with a maximum variation of + 10% from the original image intensity to simulate the case where we want to approximate the testing data distribution but we do not know the exact distribution (c.g., +30% maximum variation on Dc).

---

Jound
60
Perorrs
0.5
40
20
20
5 D2
0.0
0.5
Evaluation sets
[r(w]
[r(w)
Figure 13: Unnormalized filters misclassify more
Figure 14: Instance normalization improves robustness to atmospheric effects but may not fully address covariate shift, leading to suboptimal training. We compare a vanilla R44 trained on CIFAR-10 with instance nor- malization layers to vanilla R44 with batch normalization and our R44N. We get best re- sults on most benchmarks while maintaining
often. We investigate how filter weight normaliza-
tion affects emror rates in a pretrained R34. Left: We show the histogram of (r(w)) from all filter weights in the network. We want this ratio to be O if the
filters are differencing, or 1 they are averaging fil- ters. The peak in O from our R34N indicates all our filters are differencing and normalized, while vanilla ResNets possess many unnormalized. Right: We find that images triggering strong responses from "less normalized" filters (i.e., higher (r(w)) are more often misclassified. Our convolutions avoid this by design.
original test set accuracy (D). Our approach differs from instance norm. two ways: inde- pendent normalization of positive and negative weights, reducing artifacts; and normalizing weights, not activations.
Our results in Table 3 show that data augmentation provides significant robustness, even with lower gain-bias variation than the test set. However, when data distributions differ substantially, as in Ds. data augmentation falls short, with our R20N achieving 91 % accuracy vs. 77% from R20.
Table 3: Training with data augmentations helps but struggles with significantly different data distributions. We train a R20 with and without gain-bias augmentations and evaluate on our proposed benchmarks. Left: Without needing gain-bias augmentations, our R20N beats vanilla R20 in all corrupted datasets. Right: While using augmentations improves accuracy across all benchmarks for vanilla R20, it struggles to generalize significantly different data distributions, such as Ds.
Without data augmentations
With data augmentations
Model
D
Dc
D₁
Dn
Ds
Model
D
De
Dr.
Dg
Ds
R20
91.4
87.9
84.2
82,9
38.1
R20
91.9
91.6
90.8
88.0
76.9
R20N (ours)
91.5
91.1
89.6
85.5
89.5
R20N (ours)
91.9
91.7
90.8
87.1
90.8
Comparison to instance normalization (IN). IN reduces -pstafce-specific biases, improving robustness against atmospheric variations as shown in Fig. [4] In contrast, R22 with BN suffers significant accuracy drops (~60%). However, IN may not fully address covariate shift, leading to suboptimal training (89.0% 91.4% accuracy on the original training by addressing internal covariate shift but does not improve codomain symmetry like IN and our approach. Our method lets us use BN while taking care of the atmospheric effects, achieving improved performance on most benchmarks while maintaining accuracy on D.
with R20+BN). BN stabilizes
While both IN and our approach mitigate instance-specian biases, ours offers two key distinctions: 1) independent normalization of weights, which reduces artifacts that can occur when instance statistics not representative of atmospheric corruptions; and 2) normalization of weights rather than activations, providing a more targeted correction by directly correcting the filter's response to atmospheric corruptions, rather than indirectly adjusting the activations.
Negligible computational overhead. Filter normalization's 's potential expressivity loss is addressed by learnable scale and shift parameters, adding only 0.08% parameters to an R34. Notably, this increase unnecessary with batch normalization since these parameters are learned in the batchnorm layers. Our approach also incurs almost no inference-time overhead; only a +0.06 ms per image increase for R34, when measured on ImageNet's validation set using an RTX 2080 Ti.
Summary. We identify unnormalized filters as a key deep learning limitation and propose filter normalization, ensuring atmospheric equivariance. We achieve consistent gains across CNNs and ViT',, outperforming larger models like CL.P, while enhancing robustness and generalization. Code available at: https///tthbb..ooooccccs//ooaaat
10

---

Acknowledgments
This project was supported, in part, by NSF 2215542, NSF 2313151, and Bosch gift funds to S. Yu at UC Berkeley and the University of Michigan, with additional compute support provided by the NAIRR Pilot under CIS240431.
References
[1] A. Adamo, G. Östlin, and E. Zackrisson. Probing cluster formation under extreme conditions: massive star clusters in blue compact galaxies. Monthly Notices of the Royal Astromomical Society, 417(3):1904-1112 10 2011.
[2] E. H. Adelson.
Lightness perception and lightness illusions, 1999.
[3] D. Calzetti, Lee, E. Sabbi, and A. Adamo. Legacy extragalactic uv survey (legus) with the hubble space telescope. i. survey description. The Astronomical Journal, 149(51):25, 2015.
[4] R. Chakraborty, Xing. and S. X. Surreal: Complex-valeee learning as principled transformations on a scaling and rotation manifold. IEEE Transactions on Neural Networks Learning Systems, (3(3))940-955) 2022.
[5] T. S. Cohen and M. Welling. Steerable CNNs. International Conference on Learning Representations (ICLR), 2017.
[6] Cotogni and C. Cusano. Offset equivariant networks their applications. Neurocomputingg 502:1 10- 119, 2022.
E. D. Cubuk, B. Zoph, Mané, Vasudevan, and V. Le. Autoaugment: Learning augmentation strategies from data. In IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 113-123. Computer Vision Foundation IEEE, 2019.
[8] E. Cubuk, B. Zoph. Shlens, and Q. Le. Randaugment: Practical automated data augmentation with a reduced search space. In H. Larochelle, M. Ranzato, R. Hadsell, M. Balcan, and H. Lin, editors, Advances in Newral Information Processing Systems (NeurIPS), volume 33, pages 18613-1888 18624, Curran Associates, Inc., 2020.
[9] J. Deng, W. Dong, R. Sacher, L..J. Li, K. Li, and I.. Fei-Fei. ImageNet: A large-scale hicrarchical image datahase. In IEEF/CVF Conference Computer Vision and Pattern Recognition (CVPR), 2009.
[10] A. Dosovitskiy, L. Beyer, A. Kolesnikov, D. Weissenbom, X. Zhai, T. Unterthiner, M. Dehghani, M. Min- derer, G. Heigold, S. Gelly, J. Uszkoreit, and N. Houlsby, An image is worth 16x16 words: Transformers for image recognition scale. International Conference Learning Representations (ICLR), 2021.
[11] C. Esteves, C. Blanch-Blaeettte, X. Zhou, and K. Danilidis. Polar transformer networks. In International Conference on Learning Representations (ICLR), 2018.
[12] K. Glatt, E. K. Grebel, and A. Koch. Ages and Luminosities of Young SMC/LMC Star Clusters and the recent Star Formation History of the Clouds. Astron. Astrophys., 517:A50, 2010.
[13] K. He, Zhang, Ren, Conference on Computer Vision and Pattern Recognition (CVPR), 2016.
Sun. Deep residual learning for image recognition. JEEE/CVF
[14] D. Hendrycks and Dietterich. Benchmarking neural network robustness to common corruptions and perturbations. Proceedings of the International Conference on Learning Representations, 2019.
[15] S. Herbreteau, F. Moebel, and C. Kervrann. caimalization-qquiaaftt neural networks with application image denoising. Advances Neural Information Processing Systems (NeurIPS), volume 36, pages 5706-5728, 2023.
[16] S. loffe C. Szegedy. Batch normalization: Accelerating deep network training by reducing internal covariate shift. CoRR, abs/1502.03167, 2015.
[17] A. Krizhevsky, Learning multiple layers of features from tiny images. pages 32-33, 2009.
[18] Y. LeCun, B. Boser. J. S. Denker. D. Henderson. R. E. Howard, W. Hubbard, and L. D. Jackel. Backpropa- gation applied to handwritten zip code recognition. Neural computation, 1(4):541-551, 1989.
[19] J. Li, Z. Yang, H. Liu, and D. Cai, Deep rotation equivariant network. Neurocomput, 290(C):26 33, May 2018.

---

[20] Z. Liu, H. Mao, C.-Y. Wu, C. Feichtenhofer, T. Darrell, and S. Xie. A convnet for the 2020s. IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2022.
[21] Y. P. Loh and C. Chan. Getting to know low-light images with the exclusively dark dataset. Computer Vision and Image Understanding, 178:30-42, 2019.
[22] H. Mo and G. Zhao. Ric-cnn: Rotation-invarian coordinate convolutional neural network. Pattern Recogn.. 146(C). Feb. 2024.
[23] S. Mohan, Z. Kadkhodaie, E. P. Simoncelli, and C. Fernandez-Granda. Robust and interpretable blind image denoising via bies-free convolutional neural networks. In International Conference on Learning Representations (ICLR), 2020.
[24] C. Olah, A. Mordvintsev, and L.. Schubert. Feature visualization. Distill, 2(1 1):77, 2017.
[25] G. Perez, M. Messa, D. Calzetti, S. Maji, D. E. Jung, A. Adamo, and M. Sirressi. StareNet: Machine learning for star cluster identification. The Astrophysical Journal, (07 feb 2021.
[26] A. Radford, J. W. Kim, C. Hallacy, A. Ramesh, G. Goh, S. Agarwal, G. Sastry, A. Askell, P. Mishkin.
J. Clark, G. Krueger, and I. Sutskever. Learning transferable visual models from natural language supervision. In M. Meila and T. Zhang, editors, Proceedings of the 38th International Conference on Machine Learning, volume 139 of Proceedings of Machine Learning Research, pages 8748 8763, PMLR, 18 18-24 Jul 2021.
[27] C. Schuhmann, R. Beaumont, R. Vencu, C. W. Gordon, R. Wightman, M. Cherti, T. Coombes, A. Katta, C. Mullis, M. Wortsman, P. Schramowski, S. R. Kundurthy, K. Crowson, L. Schmidt, R. Kaczmarczyk, and J. Jitsev. LAION-5b: An open large-scale dataset for training next generation image-lext models. In Thirty-sixth Conference on Neural Information Processing Systems Datasets and Benchmarks Track, 2022.
[28] R. R. Selvaraju, M. Cogswell, A. Das, R. Vedantam, D. Parikh, and D. Batra. Grad-cam: Visual explamations from deep networks via gradient-based localization. In IEEE International Conference on Computer Vision (ICCV), pages 618-626, 2017.
[29] K. Simonyan, A. Vedaldi, and A. Zisserman. Deep inside convolutional networks: Visualising image classification models and saliency maps. arXiv preprint arXiv:13126608 2013.
[30] U. Singhal, Y. Xing, and S. X. Yu. Co-domain symmetry for complex-valuee deep learning. In IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 681-690, June 2022.
[31] J. T. Springenberg, A. Dosovitskiy, T. Brox, and M. A. Riedmiller. Striving for simplicity: The all convolutional net. In International Conference on Learning Representations (ICLR), 2015.
[32] N. Srivastava, F. Mansimov, and R. Salakhudinov. Unsupervised learning of video representations using Istms. arXiv preprint arxiv: /02.044680 2015.
[33] D. Ulyanov, A. Vedaldi. and V. S. Lempitsky. Instance normalization: The missing ingredient for fast stylization. ArXiv, abs/1607.0802 08002,, 2016.
[34] L. van der Maaten and G. Hinton. Visualizing data using t-SNE, Journal of Machine Learning Research, 9:2579-2605, 2008.
[35] X. Wang and S. X. Yu. Tied block convolution: Leaner and better enns with shared thinner filters. Proceedings of the AAAI Conference on Artificial Intelligence, 35:10227 10235, May 2021.
[36] E.E. Worrall, S. J. Garbin, D. Turmukhambetov, and G.J. Brostow. Harmonic Networks: Deep Translation and Rotation Equivariance. In /EEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 7168 7177. IEEE Computer Society, July 2017.
[37] H. Wu, Xiao, N. Codella, M. Liu, X. Dai, L. Yuan, and L. Zhang. Cvt: Introducing convolutions to vision transformers. arXiv preprint arXiv:2103. 2021.
[38] Y. Wu and K. He. Group normalization. In Proceedings of the European Conference on Computer Vision (ECCV), September 2018
[39] K. Yoshioka. vision-transffrmmrs--iilll
Training vision transformers (vit) and related models on cifar- 10. wtw/ http:////....ettooo//////sooooo. transformers- cifar10, 2024.
[40] J. Yosinski, J. Clune, A. Nguyen, T. Fuchs, and H. Lipson. Understanding neural networks through deep visualization. arXiv preprint arXiv: 150600657, 2015.
[41] M. D. Zeiler and R. Fergus. Visualizing and understanding convolutional networks. European conference computer vision, pages 818 833, 2014.
12

---

Normalize Filters! Classical Wisdom for Deep Vision Supplementary material
Table of Contents
A
Supporting experiments
14
Classification on C CIEAR-10
14
A.2
Low-shot learning
Downstream classtication with ViTS
A.4
Comparison to normalization layers
14
A.5
Normalization soft regularization
15
A.6
Non-linearing impacts
15
A.7
Further experimental validation
16
B
R34 training curves on ImageNef
17
Feature visualizations
13

---

A Supporting experiments
A.1 Classification on CIFAR-10
Table Al: Accuracy on CIFAR-10. We train the models on the original training sets and evaluate them on the original test set (D) and our proposed benchmarks (DC.L. Our method provides more robust results with all models on the corrupted datasets while maintaining the same performance on the original test set.
Model (vanilla [T3 norm-eeuiv
IS
Jours)
R20
R20E
R20N
R32
R32E
R32N
R44
R44E
R44N
91.4
88.6
92.0
89.7
92.0
89.0
87.9
85.3
91.1
87.7
86.5
89.7
86.7
92.6
D2
84.2
82.5
89.6
84.3
84.0
90.4
86.4
83.6
92.0
DB
82.9
77.0
85.5
80.1
76.2
87.6
87.3
80.6
87.8
Ds
38.1
32.3
89.5
28.6
27.8
88.8
49.5
52.2
90.2
A.1.1 Ablation with increasing corruption
Here we show the accuracy of vanilla R20 and our proposed R20N evaluated on the corrupted CIFAR- 10 evaluation set De with varying amounts of corruption. In Fig. Al we can see that our R20N is more robust increasing amounts of gain and bias perturbations.
That (%)
80
60
20%
40%
60%
80%
100%
Corruption
Figure A1: Our normalized convolutions are more robust to increasing levels of corruption. A vanilla R20 and proposed R2ON trained on the original CIFAR- 10 training set and evaluated the corrupted evaluation set De with increasing levels of gain and bias corruption.
A.2 Low-shot learning
Table shows our normalized convolutions outperforming on the original evaluation set D for very low data regimes. In Table. AA we show results for low-show training experiments. Our approach suffers less from reduced training data. Notably, the performance gap between our approach and the baseline widens as the amount of labeled data decreases. See for more details.
Table A2: Low-shot training results D. Accuracy the D evaluation set in very low data regimes (indicated by %). Our approach suffers less from reduced training data.
% train data
1%
2%
4%
6%
8%
10%
R20
41.4
51.0
61.6
68.0
74.0
75.4
R2UN (ours)
46.3
55.8
67.0
69,9
75.0
75.6
A.3
Downstream classification with ViTs
In Table. A4 we show experiments downstream classification with ViT's using R20. R32, and R44 features as input. We compare to our features using normalized convolutions. See $4.1 for more details.
A.4 Comparison to normalization layers
In Table, A5 we present the results with different normalization layers for R20, R32, and R44 on CIFAR- 10. Specifically, show results with instance normalization (IN), batch normalization (BN),
14

---

Table A3: Low-shot training results on De. Accuracy on the De evaluation set when training with fewer labeled images (indicated by %). Our approach suffers less from reduced training data. Notably, the performance gap between our approach and the baseline widens as the amount of labeled data decreases (bottom row).
% train data
4%
6%
8%
10%
20%
40%
60%
80%
R20
51.5
60.2
68.6
68.8
78.0
82.4
85.6
87.4
R20N (ours)
65.9
69.2
74.1
74.2
81.7
85.8
88.6
89.3
Gain
+14.4
+9.0
+3.5
+3.4
+3.7
+3.4
+3.0
+1.9
Table A4: Downstream classification on ViTs. We evaluate the performance small ViT 33 on CIFAR-10 10 on our proposed benchmarks using the raw image as input (left column) and feature maps from ResNets. ViT exhibits more robustness than vanilla ResNets (Table [A]], but using feature maps from our normalized convolutions significantly reduces the performance drop after perturbations compared to all the other baselines.
VIT 39 input type
Image (l) E R32x32
ResNet feature maps (f E R 16611)
R20
R2ON,
R32,
R32N,
R44,
R44N,
De
85.4
86.4
88.8
84.7
88.5
85.9
89.4
D2
83.1
82.4
87.2
80.4
87.6
81.1
88.0
Dp
80.2
79.2
80.2
77.6
81.9
79.2
82.6
Ds 80.6
39.9
84.4
32.6
84.7
28.7
84,4
and without any normalization layer (x), where get the best results on most benchmarks while maintaining original test set accuracy. See 4.3 for more details.
Table A5: Ablation with normalization layers. We train ResNets on CIFAR-10 with different normalization layers using vanilla convolutions and normalized convolutions. We get best results on most benchmarks while maintaining original test set accuracy.
ResNer20 IN
ResNer20N (ours)
ResNet32
ResNer32N (ours)
ResNet44
ResNet44N (ours)
BN
IN
BN
BN
BN
IN
D
89.0
89.4
91.4
88.1
90.1
91.5
88.8
90.0
92.0
89.6
90.7
92.0
89.2
90.5
93.2
90.4
90.7
93.2
De
87.7
86.6
Dr
83.8
87.5
84.2
86.3
88.3
89.6
82.7
88.4
84.3
87.9
89.1
90.4
82.7
89.2
86.4
88.3
89.9
92.0
Dn
85.5
83.6
Ds
43.5
84.0
38.1
85.9
79.4
89.5
42.9
88.1
28.6
85.9
79.2
88.8
43.2
89.3
49.5
86.9
85.4
90.2
A.5
Normalization as soft regularization
We compare our approach to weight normalization through soft regularization. Specifically, given the set of convolutional filter weights in a CNN, where each filter weight a 3D tensor w IR Cx X the regularization term is given by
Σ (11- 1|++1||++1111 1|w -[]] III. NEW
R(W)-
(14)
The total loss function with regularization can be written Liota! L + RWW, where 0.01 controls the strength of the regularization. We add this regularization to the loss during training of a R20 on CIFAR-10 using the same hyperparameters from $ 4.1 In Table A6 we show that regularization improves robustness over vanilla training (second row), but our approach yields significantly better results (bottom row). While regularization may reduce (r(w) does not guarantee (r(w) 0 for all filters like our approach (Fig. 13).
A.6 Non-lincarity impacts
Our proposed method ensures atmosphere--quuivariance the convolutional layer level. That is, prior to any non-linear activation, filter responses transform in structured and predictable way under global intensity shifts (gain and bias). This forms the foundation for building robustness to such transformations throughout the network.
15

---

Table A6: Our normalized convolutions beat normalization as soft regularization. Adding the soft regularization (V) improves the robustness of vanilla R20 (see first two rows), but our approach surpasses soft regularization (see the two bottom rows), Underlined values show the best accuracy against their non-regularized counterpart, while bold values show the best overall.
soft
Model
reg.
D
De
D1
Dg
D)
R20
91.4
87.9
84.2
82.9
38.1
R20
92.0
88.8
85.9
84.1
48.8
R2ON
91.5
91.1
89.6
85.5
89,5
R20N
92.0
91.5
90.5
86.0
89.0
It is important to clarify that, while individual layers are equivariant, the goal of the full network to achieve invariance atmospheric transformations-juss as classical CNNs preserve spatial equivariance locally but aim for global translational invariance in their final semantic outputs. Non- linearities such as ReLU serve this pupose: they progressively reduce sensitivity irrelevant variations (e.g., illumination), transforming equivariant features into invariant representations through depth and learned hierarchy.
What makes our approach effective is that starting from an amoospere-equivariane basis makes the job of learning invariance easier and more structured. This is evident in experiments (Table B). where models using filter normalization without any data augmentation outperform baselines with augmentation, by a large margin (e.g.. +14% accuracy Ds). This suggests that the network is better able to learn invariances downstream when the early layers encode meaningful, interpretable transformations.
In short, while non-lincarities do break strict equivariance, they play a necessary and constructive role in turning structured responses into invariant representations. Our method complements this process by providing a more robust and interpretable foundation at the convolutional level.
We did further experiments on different types of activation functions, specifically Tanh and Sigmoid, in place of ReLU. Our results on CIFAR- 10 De with R20 and our R20N model show that our method consistently outperforms the vanilla R20 model, regardless of the activation function used (see Table A7).
Table A7: Filter normalization provides robustness benefits that are complementary to the choice of activation function, demonstrated by experiments.
Model
Tanh
Sigmoid
R34
90.5% 91.5% %
88.1% 91.5%
R34N
This suggests that our filter normalization approach provides robustness benefits that are complemen- tary to the choice of activation function.
A.7 Further experimental validation
Our method is specifically designed to address atmospheric transformations i.e., global additive and multiplicative corruptions such as changes in brightness, contrast, and haze (see Eq. [0 and Fig. 2) We already evaluate our method across range of comuptiio types and intensities (see also Fig. A.I.T.
ImageNet-C [14] includes severe and often localized distortions (e.g., noise, blur, digital artifacts) that fall outside the atmospheric transformation family we explicitly target. Our method outperforms on some categories such as brightness and underperforms on others such as snow, all with a very small margin. While we acknowledge these results, we emphasize that ImageNet-P, proposed in the same paper, offers more direct test of our model's 's design goals: ImageNet-P applies smooth, progressive perturbations, especially in the "weather" category (e.g., brightness and snow), aligning well with our focus on global intensity transformations.
Robustness measured using the Flip Rate (FR)-the fraction of samples whose predicted class changes at the highest perturbation level compared to the clean version: FR = I (f(z)) #
16

---

)x) where 30 is the corrupted image at the maximum perturbation level (30), and n are all images included the "weather" category, which includes brightness and snow modifications (See Table A8).
The flip rate of vanilla R34 is 41.3%, while R34N with normalized convolutions achieves 40.0% flip rate (lower is better).
Table A8: Results on ImageNet-P. We show the Top-1 accuracy (f) and the Flip Rate (FR 4) for ImageNet-P, focusing on weather corruptions (i.e., brightness and snow). The flip rate of a vanilla R34 is 41.3%, while our R34N with normalized convolutions achieves 40.0% flip rate (lower is better). While both metrics show consistent trends, the FR gap is more pronounced than the accuracy gap, making it more sensitive indicator of perturbation robustness.
Model
Accuracy (1) Flip Rate (FR 4)
R34
44.7
41.3
R34N
44.9
40.0
B R34 training curves ImageNet
Here we show the training curves of the vanilla R34 and our R34N on ImageNet-Ik. We train both networks from scratch on the original ImageNet-Ik training set for 90 epochs, a batch size of 256, and SGD with an initial learning rate of 0.1 divided by 10 every 30 epochs. In Fig. A2 we can see that our R34N exhibits more stable validation accuracy throughout training.
80
resnet334
resnet34N
Top-1 error (%)
60
20
40
60
80
Epoch
Figure A2: Filter normalization regularizes learning showing more stable validation accuracy during training. ResNet34 training curve on ImageNet- 1k with the hyperparameters described in the ImageNet experiments in 4.1
C Feature visualizations
In Fig. A3 show the learned filters from the first layer of R34 (left) and R34N (right) models, trained on ImageNet-1k kk using the hyperparameters in $ 34.1 Our model with normalized convolutions
(R34N) exhibits more diverse features, consistent with the results in Fig. 12
R34
R34N (ours)
Figure A3; Filter visualizations, Learned filters from the first layer of R34 (left) and R34N (right) models, trained on ImageNet-Ik. Our R34N exhibits more diverse features.
17

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: [NA]
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine to include aspirational goals as motivation long is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [NA]
Justification: We investigated the possible computational overhead of our proposed method but found negligible. Additionally, we present the settings where our approach is beneficial.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
the paper. The authors should use their best
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [NA]
18

---

Justification: [NA]
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that affects the main claims and/or conclusions of the paper (regardless whether the code and data are provided or not)?
Answer: [Yes]
Justification: [NA]
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how to reproduce that algorithm.
(b) the contribution is primarily a new model architecture, the paper should describe the architccture clearly and fully.
(c) If the contribution is new model (e.g., a large language model), then there should either way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reprodueibility. the case of closed-source models, may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
19

---

Answer: [Yes]
Justification:
Our code will made publicly available upon publication.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips.cr cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https
/ cpipp/.ccppullc//uuuii wwwtc//gguie///eeeeceoocc CoodeSubeiiieeee ssi wsionnolli onnolicy)))) for more details.
The authors should provide instructions on data access and preparation, including how access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: [NA]
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, or as supplemental material.
7. Experiment statistical significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [No]
Justification: Error bars are not included due to computational constraints.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, statistical significance tests, at least for the experiments that support main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
should be clear whether the error bar is the standard deviation the standard error of the mean.
20

---

It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of enrors is not verified.
For asymmetric distributions, the authors should be careful to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of exccution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: [NA]
Guidelines:
The answer NA means that the paper does include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, cloud provider, including relevant memory and storage.
The paper should provide the amount compute required for each of the individual experimental runs well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary failed experiments that didn't make into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics
Answer: [Yes]
Justification: [NA]
Guidelines:
The answer NA means that the authors have reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- eration due to laws or regulations in their jurisdiction).
Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer:
[NA]
Justification: We do not foresee any potential negative societal impacts arising from our work.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
21

---

The conference expects that many papers will be foundational research and not tied particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms monitor how system learns from feedback over time, improving the efficiency and accessibility of MI..
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification:
This work does not pose such risks.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Lieenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: [NA]
Guidelines:
The answer NA means that the paper does existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (c.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode. com com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
22

---

If this information is not available online, the authors are encouraged to reach out to the asset's creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification:
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/mmoel as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsoureing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification: This work does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included the main paper.
According the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question:
Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification:
This work does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such the institution conducting the review.
16. Declaration of LLM usage
23

---

Question: Does the paper describe the usage of LLMs if it is important, original, or non-standard component of the core methods this research? Note that if the LLM used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, or originality of the research, declaration is not required.
Answer: [NA]
Justification: The core method development in this research does not involve LLMs.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs any important, original, non-standard components.
Please refer to our LLM policy fattps://neurda: /00p://ccc...cc.eeeee/e////////0 for what should or should not be described.
24


Reviews:
[{"review_id": "DWlHCi4oD2", "reviewer": "Reviewer_t7kj", "summary": "The paper addresses the issue of deep learning models' reduced robustness to intensity variations in images, which stems from the unnormalized nature of learned convolutional filters. It proposes a novel Filter Normalization method that decomposes convolutional filters into their averaging filter and differencing filter components and normalizes them individually. This modification is designed to ensure that filters exhibit atmosphere-equivariance, leading to consistent and interpretable responses under varying illumination conditions. Experiments on both artificially corrupted and natural datasets demonstrate that this approach significantly enhances model robustness and generalization across various CNN and Vision Transformer architectures. The authors claim that this method, by integrating classical filtering principles, enables leaner models to outperform larger, unnormalized counterparts, including CLIP, on these specific benchmarks.", "questions": "- __Clarify Theoretical Concepts:__ Provide clear mathematical definitions for \"co-domain symmetry\" and \"atmosphere-equivariance.\" Elaborate on how Equation (11) directly translates to the broader concept of atmosphere-equivariance for deep networks.\n\n- __Address Non-linearity Impacts:__ Discuss the implications of non-linear activation functions (e.g., ReLU) on the proposed filter normalization's effects and the concept of \"interpretable responses\" throughout the entire network.\n\n- __Refine CLIP Comparison:__ Rephrase claims regarding CLIP's \"outperformance\" to explicitly acknowledge and emphasize the vast disparity in training data scale (ImageNet-1k vs. LAION-5B).\n\n- __Strengthen Experimental Validation:__ Evaluate the proposed method on well-established public robustness benchmarks, particularly relevant subsets of ImageNet-C (e.g., brightness, contrast, haze). Expand the natural data experiments beyond just inline text, presenting them in comprehensive tables that compare all baselines where applicable.", "limitations": "yes", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 4, "originality": 3, "strengths_and_weaknesses": "# Strengths\n\n### 1. Addresses a Critical Problem in Deep Learning\nThe paper tackles the significant and long-standing issue of robustness in neural networks, particularly concerning image intensity variations, which is crucial for real-world applications like autonomous driving and medical imaging.\n\n### 2. Novelty and Effectiveness of Filter Normalization\nThe core idea of normalizing convolutional filters by separating positive and negative parts and applying learnable scaling and shifting is novel. This approach is well-motivated by classical filter theory. Its effectiveness is demonstrated by consistent performance gains across CNNs and Vision Transformers on both artificial and natural benchmarks.\n\n### 3. Simplicity and Broad Applicability\nThe proposed method is simple to implement (\"simple yet effective modification\") and can be readily integrated into various convolution-based architectures, suggesting high potential for wide adoption and future development in different domains\n\n# Weaknesses\n\n### 1. Ambiguous Definition and Proof of Co-domain Symmetry and Atmosphere-Equivariance\nThe paper claims that its method ensures \"atmosphere-equivariant, enabling co-domain symmetry\", but it lacks clear mathematical definitions for these terms. While Equation (11) demonstrates linearity for individual filter responses, the logical connection between this and the general concept of \"atmosphere-equivariance\" or \"co-domain symmetry\" for the entire network remains insufficiently elaborated.\n\n### 2. Insufficient Consideration of Non-linearities\nThe theoretical derivations for consistent responses (e.g., Equation 11) apply primarily to linear convolutional layers. The paper does not adequately discuss how the proposed filter normalization impacts or interacts with non-linear activation functions (like ReLU) within deep networks, which could dilute the \"interpretable responses\" and overall equivariance in a multi-layer network.\n\n### 3. Unfair Comparison with CLIP\nThe paper strongly highlights outperforming CLIP on corrupted datasets. However, this comparison is unfair as CLIP (zero-shot) models are pre-trained on significantly larger datasets (e.g., LAION-5B) compared to the ImageNet-1k training of the proposed R34N. While the R34N demonstrates efficiency, presenting this as a direct outperformance of a model trained on orders of magnitude more data is misleading and should be heavily qualified. I'm not saying the necessity of a fair comparison, but the authors should not claim like \"better than CLIP trained on much larger datasets\".\n\n### 4. Limited Scope and Public Credibility of Experimental Results\nThe majority of reported performance gains are on custom-designed, artificially corrupted ImageNet and CIFAR-10 datasets. These simulated atmospheric effects might be overly simplistic and not fully representative of complex real-world conditions. While some results on natural datasets like ExDark and LEGUS are provided, they are limited (presented inline, not in comprehensive tables, and not compared against all baselines). Moreover, the absence of evaluations on well-established public benchmarks for robustness, such as relevant subsets of ImageNet-C (e.g., brightness, contrast, haze), diminishes the credibility and generalizability of the reported performance.", "was_revised": true, "final_justification": "The authors' responses adequately address the theoretical and non-linearity concerns, and their re-framing of the CLIP comparison is reasonable. I strongly recommend that the authors change the claim on the CLIP comparison.\nMoreover, the authors adequately added some important additional experiments.\n\nFor these reasons, I increase my rating by 1.\nThank you.", "rebuttal": "Thank you for your valuable feedback and comments. We appreciate your acknowledgement that our work addresses a critical problem in Deep Learning, its novelty, effectiveness, simplicity, and broad applicability. We address your concerns and questions in the response below.\n\n> **Clarify Theoretical Concepts:** Provide clear mathematical definitions for \"co-domain symmetry\" and \"atmosphere-equivariance.\" Elaborate on how Equation (11) directly translates to the broader concept of atmosphere-equivariance for deep networks.\n\nThank you for raising the concern about the clarity of our definitions of co-domain symmetry and atmosphere-equivariance. We agree these terms need more precise explanation.\n\nIn classical signal processing, spatial equivariance is well understood: A convolutional filter responds consistently to translations of the input. Our filter normalization extends this structured response into the co-domain, i.e., the filter output space under intensity changes.\n\nWe define co-domain symmetry as follows: A filter exhibits co-domain symmetry if its response transforms in a predictable, structured way under affine transformations of the input intensity $x$, via gain ($g$) and offset ($o$).\n\nOur method ensures that normalized filters decompose into two interpretable components:\n\n1. Averaging filters respond linearly to both gain and offset: $f(g \\cdot x + o) = g \\cdot f(x) + o$, where $|w| = 1$ and $r(w) = 1$.\n\n2. Differencing filters are invariant to offset and equivariant to gain: $f(g \\cdot x + o) = g \\cdot f(x)$, where $|w| = 1$ and $r(w) = 0$.\n\nThis decomposition yields atmosphere-equivariance, meaning that under global illumination changes (such as haze, shadows, or lighting shifts), the response of each filter changes in a predictable and interpretable way. For averaging filters, both contrast and brightness shift the output, while differencing filters respond only to contrast. This behavior is particularly desirable in scenarios where the semantic structure of the scene should be invariant to lighting conditions.\n\nWe will clarify these definitions in the revision and illustrate them more explicitly in the discussion around Eq. (11).\n\n> **Address Non-linearity Impacts:** Discuss the implications of non-linear activation functions (e.g., ReLU) on the proposed filter normalization's effects and the concept of \"interpretable responses\" throughout the entire network\n\nThank you for raising the question regarding the role of non-linearities (e.g., ReLU) and their impact on the proposed filter normalization and interpretability of responses.\n\nOur proposed method ensures atmosphere-equivariance at the convolutional layer level. That is, prior to any non-linear activation, filter responses transform in a structured and predictable way under global intensity shifts (gain and bias). This forms the foundation for building robustness to such transformations throughout the network.\n\nIt is important to clarify that, while individual layers are equivariant, the goal of the full network is to achieve invariance to atmospheric transformations—just as classical CNNs preserve spatial equivariance locally but aim for global translational invariance in their final semantic outputs. Non-linearities such as ReLU serve this purpose: they progressively reduce sensitivity to irrelevant variations (e.g., illumination), transforming equivariant features into invariant representations through depth and learned hierarchy.\n\nWhat makes our approach effective is that starting from an atmosphere-equivariant basis makes the job of learning invariance easier and more structured. This is evident in our experiments (Lines 311–318 and Table 2), where models using filter normalization without any data augmentation outperform baselines with augmentation, by a large margin (e.g., +14% accuracy on $D_S$). This suggests that the network is better able to learn invariances downstream when the early layers encode meaningful, interpretable transformations.\n\nIn short, while non-linearities do break strict equivariance, they play a necessary and constructive role in turning structured responses into invariant representations.  Our method complements this process by providing a more robust and interpretable foundation at the convolutional level.\n\nWe did further experiments on different types of activation functions, specifically Tanh and Sigmoid, in place of ReLU. Our results on CIFAR-10 $D_C$ with R20 and our R20N model show that our method consistently outperforms the vanilla R20 model, regardless of the activation function used:\n\n| Model | Tanh | Sigmoid |\n| ----------- | ----------- | ----------- |\n| R34 | 90.5% | 88.1% | \n| R34N (ours) | **91.5%** | **91.5%** |\n\nThis suggests that our filter normalization approach provides robustness benefits that are complementary to the choice of activation function.  We will include these experiments in the final version of our paper.\n\n> **Refine CLIP Comparison:** Rephrase claims regarding CLIP's \"outperformance\" to explicitly acknowledge and emphasize the vast disparity in training data scale (ImageNet-1k vs. LAION-5B).\n\nWe appreciate the reviewer’s point and fully acknowledge that comparing our R34N model—trained on ImageNet-1k for supervised classification—to CLIP, a foundation model trained on the much larger LAION-5B dataset using contrastive vision-language pretraining, involves substantial differences in scale, objective, and intended use.\n\nThat said, if the comparison is “unfair,” we would argue it is unfair to our disadvantage: CLIP is trained on several orders of magnitude more data with broader supervision, yet still shows notable vulnerability to simple intensity corruptions, where our much smaller model remains robust. From this perspective, the comparison is not only informative but also conservative, demonstrating that large-scale pretraining does not guarantee robustness to common low-level variations.\n\nOur intent is not to claim general superiority over CLIP, but to highlight complementary strengths: CLIP excels in semantic generalization and zero-shot transfer, while our method targets physical robustness to real-world image degradations. We believe this suggests that classical filtering principles—like those embedded in our filter normalization—may provide value even when incorporated into large-scale models, particularly CNN-based ones such as CvT [2] and ConvNeXt [3].\n\nWe will revise the manuscript to more clearly acknowledge the training scale differences and provide a balanced discussion of this comparison.\n\n[2] Wu, et al. CvT: Introducing Convolutions to Vision Transformers. ICCV 2021.\n\n[3] Liu, et al. A ConvNet for the 2020s. CVPR 2022.\n\n> Strengthen Experimental Validation: Evaluate the proposed method on well-established public robustness benchmarks, particularly relevant subsets of ImageNet-C (e.g., brightness, contrast, haze). Expand the natural data experiments beyond just inline text, presenting them in comprehensive tables that compare all baselines where applicable.\n\nThank you for the suggestion to strengthen our experimental validation using established robustness benchmarks. Our method is specifically designed to address atmospheric transformations—i.e., global additive and multiplicative corruptions such as changes in brightness, contrast, and haze (see Eq. 10 and Fig. 2). We already evaluate our method across a range of corruption types and intensities (see also Fig. A.1.1 in the Appendix).\n\nImageNet-C includes severe and often localized distortions (e.g., noise, blur, digital artifacts) that fall outside the atmospheric transformation family we explicitly target.  Our method outperforms on some categories such as brightness and underperforms on others such as snow, all with a very small margin.  While we acknowledge these results, we emphasize that ImageNet-P, proposed in the same paper, offers a more direct test of our model’s design goals: ImageNet-P applies smooth, progressive perturbations, especially in the \"weather\" category (e.g., brightness and snow), aligning well with our focus on global intensity transformations.\n\nRobustness is measured using the Flip Rate (FR)—the fraction of samples whose predicted class changes at the highest perturbation level compared to the clean version:  $FR = \\frac{1}{n}\\sum_{i=1}^n \\mathbb{1}(f(x_i) \\neq f(x_i^{30}))$, where $x_i^{30}$ is the corrupted image at the maximum perturbation level (30), and $n$ are all images included in the ”weather” category, which includes brightness and snow modifications (See results below). \n\n| Model | FR weather ($\\downarrow$) |\n| ----------- | ----------- |\n| R34 | 41.3% | \n| R34N (ours) | **40.0%** |\n\nThe flip rate of a vanilla R34 is 41.3%, while our R34N with normalized convolutions achieves 40.0% flip rate (lower is better).\n\nLastly, we further assess generalization to natural variation by binning the ImageNet-1k test set into 9 contrast levels (based on pixel standard deviation). R34N maintains more stable accuracy across the contrast spectrum compared to the baseline, which drops sharply at extreme values (see Fig. X).  This confirms the model's improved robustness to natural realistic atmosphere conditions.\n\n| Model | Lowest | Contrast 2 | Contrast 3 | Contrast 4 | Contrast 5 | Contrast 6 | Contrast 7 | Contrast 8 | Highest|\n| ----------- | ----------- | ----------- | ----------- | ----------- | ----------- | ----------- | ----------- | ----------- | ----------- |\n|R34 \t| 65.4% |  74.0% | 74.8% | 75.2% | 73.2% | 70.8% | 70.7% | 67.9% | 63.3%|\n|R34N \t| **69.2%** | 74.1% | 74.6% | 74.5% | 73.3% | 71.1% | 71.1% | 67.3% | **71.4%**|\n\nWe will include new plots, statistical analyses, and representative image examples in the final version of the paper.\n\n[1] Hendrycks, et al. Benchmarking Neural Network Robustness to Common Corruptions and Perturbations. ICLR 2019."}, {"review_id": "e5TKHK8y6J", "reviewer": "Reviewer_j6NF", "summary": "The paper proposes to separate and normalize filters in convolutional layers into positive and negative filters to help mitigating against gain and bias. They show experiments with a neural networks modified this way and compare with other computer vision models .", "questions": "1. Would it be possible to also add a fine-tuned CLIP for comparison\n2. Would it be possible to add a non-customized dataset to actually see how the modification to the filters behave when corruptions are not just gain and bias?", "limitations": "yes", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 4, "significance": 3, "originality": 3, "strengths_and_weaknesses": "**Strengths**\n* Simple modification to convolutional layers with apparent gains in robustness and interpretation\n\n**Weaknesses**\n* experiment could include other corruptions beyond these customized datasets.\n* comparison of ResNet fine-tuned with CLIP on zero-shot is somewhat misleading, and perhaps not the best choice. We know that CLIP does not do well on robustness to covariate shift, I am not sure what the experiment shows for the actual topic of the paper.\n* not widely accepted use of the word \"atmosphere\"  effect, The paper even shows some experiments on astronomy data taken from space.", "was_revised": true, "final_justification": "Authors also addressed enough of issues, and my score was already at 5 which I will keep.", "rebuttal": "Dear reviewer j6NF,\n\nThank you for your valuable feedback and comments. We appreciate your recognition of our method’s simplicity and the gains it provides in robustness and interpretation. We address your concerns and questions in the response below.\n\n> Experiment could include other corruptions beyond these customized datasets.\n\nThank you for the suggestion to strengthen our experimental validation using established robustness benchmarks. Our method is specifically designed to address atmospheric transformations—i.e., global additive and multiplicative corruptions such as changes in brightness, contrast, and haze (see Eq. 10 and Fig. 2). We already evaluate our method across a range of corruption types and intensities (see also Fig. A.1.1 in the Appendix).\n\nImageNet-C includes severe and often localized distortions (e.g., noise, blur, digital artifacts) that fall outside the atmospheric transformation family we explicitly target.  Our method outperforms on some categories such as brightness and underperforms on others such as snow, all with a very small margin.  While we acknowledge these results, we emphasize that ImageNet-P, proposed in the same paper, offers a more direct test of our model’s design goals: ImageNet-P applies smooth, progressive perturbations, especially in the \"weather\" category (e.g., brightness and snow), aligning well with our focus on global intensity transformations.\n\nRobustness is measured using the Flip Rate (FR)—the fraction of samples whose predicted class changes at the highest perturbation level compared to the clean version:  $FR = \\frac{1}{n}\\sum_{i=1}^n \\mathbb{1}(f(x_i) \\neq f(x_i^{30}))$, where $x_i^{30}$ is the corrupted image at the maximum perturbation level (30), and $n$ are all images included in the ”weather” category, which includes brightness and snow modifications (See results below). \n\n| Model | FR weather ($\\downarrow$) |\n| ----------- | ----------- |\n| R34 | 41.3% | \n| R34N (ours) | **40.0%** |\n\nThe flip rate of a vanilla R34 is 41.3%, while our R34N with normalized convolutions achieves 40.0% flip rate (lower is better).\n\nLastly, we further assess generalization to natural variation by binning the ImageNet-1k test set into 9 contrast levels (based on pixel standard deviation). R34N maintains more stable accuracy across the contrast spectrum compared to the baseline, which drops sharply at extreme values (see Fig. X).  This confirms the model's improved robustness to natural realistic atmosphere conditions.\n\n| Model | Lowest | Contrast 2 | Contrast 3 | Contrast 4 | Contrast 5 | Contrast 6 | Contrast 7 | Contrast 8 | Highest|\n| ----------- | ----------- | ----------- | ----------- | ----------- | ----------- | ----------- | ----------- | ----------- | ----------- |\n|R34 \t| 65.4% |  74.0% | 74.8% | 75.2% | 73.2% | 70.8% | 70.7% | 67.9% | 63.3%|\n|R34N \t| **69.2%** | 74.1% | 74.6% | 74.5% | 73.3% | 71.1% | 71.1% | 67.3% | **71.4%**|\n\nWe will include new plots, statistical analyses, and representative image examples in the final version of the paper.\n\n[1] Hendrycks, et al. Benchmarking Neural Network Robustness to Common Corruptions and Perturbations. ICLR 2019.\n\n> Comparison of ResNet fine-tuned with CLIP on zero-shot is somewhat misleading, and perhaps not the best choice. We know that CLIP does not do well on robustness to covariate shift, I am not sure what the experiment shows for the actual topic of the paper.\n\nWe appreciate the reviewer’s point and fully acknowledge that comparing our R34N model—trained on ImageNet-1k for supervised classification—to CLIP, a foundation model trained on the much larger LAION-5B dataset using contrastive vision-language pretraining, involves substantial differences in scale, objective, and intended use.\n\nThat said, if the comparison is “unfair,” we would argue it is unfair to our disadvantage: CLIP is trained on several orders of magnitude more data with broader supervision, yet still shows notable vulnerability to simple intensity corruptions, where our much smaller model remains robust. From this perspective, the comparison is not only informative but also conservative, demonstrating that large-scale pretraining does not guarantee robustness to common low-level variations.\n\nOur intent is not to claim general superiority over CLIP, but to highlight complementary strengths: CLIP excels in semantic generalization and zero-shot transfer, while our method targets physical robustness to real-world image degradations. We believe this suggests that classical filtering principles—like those embedded in our filter normalization—may provide value even when incorporated into large-scale models, particularly CNN-based ones such as CvT [2] and ConvNeXt [3].\n\nWe will revise the manuscript to more clearly acknowledge the training scale differences and provide a balanced discussion of this comparison.\n\n[2] Wu, et al. CvT: Introducing Convolutions to Vision Transformers. ICCV 2021.\n\n[3] Liu, et al. A ConvNet for the 2020s. CVPR 2022.\n\n> Not widely accepted use of the word \"atmosphere\" effect, The paper even shows some experiments on astronomy data taken from space.\n\nWe borrowed the term 'atmosphere' from Adelson’s work on Lightness Perception and Lightness Illusions [4], where it is defined as 'The net effect of the viewing conditions, including additive and multiplicative effects, may be termed an “atmosphere.”' We find this term suitable for our purposes. However, as the reviewer pointed out, we agree it may cause confusion when applied to domain-specific data, such as astronomy images. To clarify, we will specify in the paper that the term 'atmospheric effects' is particularly relevant to natural color images.\n\n[4] Adelson. Lightness Perception and Lightness Illusions. MIT Press, 2000.\n\n**Questions:**\n> Would it be possible to also add a fine-tuned CLIP for comparison\n\nUnfortunately, fine-tuning CLIP is not feasible for the length of the discussion period. We included zero-shot CLIP as a baseline since it is a widely used approach for image classification."}, {"review_id": "s6tTsePw8V", "reviewer": "Reviewer_qNTu", "summary": "This paper introduces a new filter normalization technique to enhance the capability of image processing of deep convolutional networks. Classical / human-crafted image filters are usually normalized to maintain consistency, interpretability, and to avoid visual artifacts. Well the data-driven image filters usually do not have this feature. However, the lack of normalization would lead to distorted filter responses, especially under atmospheric / lighting change environment. The proposed method discovers that all the convolutional filters can be reformulated as a combination of averaging filter and differencing filter, and hence proposes to normalize any given / learnt convolutional filter to ensure the consistency and interpretability. Extensive experiments on a wide range of application show the effectiveness of the proposed filter normalization method.", "questions": "This paper is technically sound and well formulated. The authors are suggested to address the weakness in the weakness session during rebuttal period.", "limitations": "yes", "rating": 4, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "### Strength\n\n1. The proposed method comes with a clear and elegant formulation and solid derivation and proof. \n2. The observation of the unnormalized convolutional filter in deep learning is critical and useful. This fact could potentially discover some intrinsic features of convolutional deep neural networks. \n3. The paper is strongly motivated and clearly structured. The proposed method could be applied to many real application problems such as photo editing, intensity correction, astronomic image processing, etc. \n4. The extensive experiments show that the proposed method has achieved the beset performance across different application scenarios. \n\n\n### Weakness\n\n1. The header of section 3.1 \"Any filter is both averaging and differencing\" is not guaranteed. It should be better rephrased as \"any linear / convolutional filter ... \"\n2.  The experiment on data augmentation on CIFAR-10 with only atmospheric augmentations may not be very representative.  First, the data size of CIFAR and the image size are both small. Recent advances in image processing are all conducted on large scale high resolution data. It is suggested to make more thorough experiments on those dataset to make augmentation conclusion. Second, the experiment results do not show a clear trend that data augmentation techniques make model suffer, even though the performance on D_s alone is not as good as expected.", "was_revised": true, "final_justification": "I would like to keep my original ratings for this submission as the authors have adopted the comments and addressed the weakness.", "rebuttal": "Dear reviewer qNTu,\n\nThank you for your valuable feedback and comments. We appreciate your recognition of our method's clear and elegant formulation, solid derivation, strong motivation, well-structured presentation, and comprehensive experiments. We also appreciate your acknowledgment of the importance and usefulness of our observation regarding unnormalized filters in deep networks. Below, we address the concerns and questions you raised.\n\n> The header of section 3.1 \"Any filter is both averaging and differencing\" is not guaranteed. It should be better rephrased as \"any linear / convolutional filter ... \"\n\nThank you for the suggestion. We completely agree that specifying 'linear filter' adds precision and will improve clarity to the title of section 3.1. We will adopt this rephrased title in the final version.\n\n> The experiment on data augmentation on CIFAR-10 with only atmospheric augmentations may not be very representative. First, the data size of CIFAR and the image size are both small. Recent advances in image processing are all conducted on large scale high resolution data. It is suggested to make more thorough experiments on those dataset to make augmentation conclusion. Second, the experiment results do not show a clear trend that data augmentation techniques make model suffer, even though the performance on D_s alone is not as good as expected.\n\nThank you for your insightful comment. While our results on CIFAR-10 don't show a clear trend of data augmentation techniques hurting model performance, our approach achieves similar robustness without the need for data augmentations. This demonstrates a key advantage of our method, as it eliminates the need for data augmentation and the associated computational costs. Additionally, our approach avoids the challenges of designing effective augmentations, which can require domain-specific knowledge. To further validate our findings, we will include experiments on ImageNet in the final version, when computational resources permit."}, {"review_id": "03lzDa8c0q", "reviewer": "Reviewer_PcoK", "summary": "This paper uncovers that filter kernels in convolutional neural networks (CNNs) are usually not normalized (meaning that the sum of all positive respectively all negative components is 0 or 1 respectively 0 or -1). Classic results from image processing show that such filters are not equivariant to gain and bias changes to their input, which could hinder generalization to gains and biases which were not seen during training. A simple formulation to normalize the filters in the abovementioned way is proposed, and the subsequent equivariance to gain and bias (and even invariance to bias in the usual case of filters with both positive and negative components) is proven. Very extensive evaluation demonstrates that these properties actually improve image classification accuracy under unseen gains and biases in many cases, and various analyses show that this method makes networks substantially more well-behaved.", "questions": "1. Looking at Eq. 1, I wonder whether and how these results also apply to fully connected layers?\n2. Line 174f: To a cursory reader, it might be non-obvious that after the normalization, is is guaranteed that w.l.o.g., $||w^+|| = 1$ and $||w^-|| =$ either 1 or 0, and hence $r(w)$ is either 0 or 1, thus the filter is either strictly averaging or strictly differencing, and Eq. 11 can be used to prove the equivariance and invariance guarantees. I suggest clearly describing this reasoning and really \"hammering it in\", as I believe it is a key step to understanding your contribution.\n3. If I'm not mistaken, the theoretical equivariance and invariance results only cover spatially uniform gain and bias. As you're also evaluating on spatially varying gain and bias, is it possible to elaborate on that? Do you just assume local spatial uniformity since filter kernels are usually small? If yes, I think this should be mentioned in the paper.\n4. What is meant by \"co-domain symmetry\", mentioned in various places in the paper?\n5. Line 212f: Is there a reason why you introduce sort pooling layers? In general, I would appreciate a more complete description of all tested architectures, including network width, depth, activation functions, pooling layers, residual connections, and the use of batch normalization in the interest of reproducibility.\n6. Lines 214 & 243: Is there a specific reason why you chose SGD over Adam?\n7. Lines 326f: \"Artifacts reduction\" and \"a more targeted correction\" are rather handwavy justifications for the superiority of filter normlization over instance normalization. In addition, no intuition to what this actually means is provided. I suggest you either elaborate on this or remove these claims.\n\nFurthermore, here are some minor questions and potential improvements:\n- Lines 191 & 202: I don't understand what the $\\mathbf{1}()$ function in the definitions of $\\tilde{x}$ is doing.\n- Lines 194 & 198: Shouldn't it be the Hadamard product $\\circ$ in the definitions of $\\tilde{x}$ here?\n- Fig. 5: Please add small labels to the vertical axes of the plots so one can grasp how large the accuracy improvement really is.\n- Fig. 6: Could you specify in the paper what \"moderate\" and \"strong\" corruption are concretely?\n- Fig. 9: Similarly, could you specify which corruption you used here?", "limitations": "In many cases, it appears that image classification accuracy actually doesn't improve that much when introducing filter normalization. Big improvements are mostly seen when the bias is very high (evaluation set $D_S$), only few images are used for training (Fig. 7), or the ExDark dataset is used.", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n1. The paper is well-written, introduces the problems with non-normalized filters very clearly, relates them nicely to classic results from image processing, and formally proves its claims.\n2. The proposed change to CNNs is very non-invasive, elegant, and simple to implement. It could thus enjoy widespread adoption.\n3. The evaluation is very extensive and doesn't hide the fact that in some cases, this method doesn't actually improve performance, but at least retains it. In addition, various behavioral analyses of the networks provide interesting insights, e.g., on hidden feature distribution or saliency.\n\nWeaknesses:\n1. I think section 3 could be streamlined a bit more to make it even easier to digest and follow. For some ideas, see my questions below.\n2. The mix of evaluation plots and tables, also including the supplementary material, seems a bit messy.", "was_revised": true, "final_justification": "The authors promise to fix various ambiguous or unclear phrasings both the other reviewers and I stumbled over, further improving their already well-written manuscript. All my technical concerns, as well as a major concern about the influence of nonlinearities brought up by reviewer t7kj, were addressed. Even though the evaluation is weak in some aspects (as pointed out by other reviewers) and the experiments show that this method mostly helps in extreme cases where data augmentation is insufficient (see limitations above), I think that alone constitutes a substantial and interesting enough contribution.", "rebuttal": "Dear reviewer PcoK,\n\nThank you for your valuable feedback and comments. We appreciate your recognition of our paper's clear presentation of the problems with non-normalized filters, its connection to classic results from image processing, and the formal proof of our claims. We are also grateful for your praise of our proposed method's simplicity, elegance, and potential for widespread adoption. Additionally, we appreciate your acknowledgment of the thoroughness of our evaluation, including the insightful behavioral analyses that provide a deeper understanding of the networks. We address your concerns and questions in the response below.\n\n> I think section 3 could be streamlined a bit more to make it even easier to digest and follow. For some ideas, see my questions below.\n\nWe appreciate the reviewer's suggestions below for streamlining section 3 and will incorporate them to improve clarity and readability.\n\n> The mix of evaluation plots and tables, also including the supplementary material, seems a bit messy.\n\nThank you for your feedback about this. We agree that the current presentation of evaluation plots and tables, including the supplementary material, could be improved. With a large number of results to report, we strive to strike a balance between clarity and concision. In the final version, we will make every effort to polish the presentation, potentially moving some results to the appendix to enhance the overall flow and readability.\n\n**Questions:**\n> Looking at Eq. 1, I wonder whether and how these results also apply to fully connected layers?\n\nGreat suggestion. Since fully connected (FC) layers can be viewed as a special case of convolutional layers, we ran a simple experiment to explore the effects of normalizing the linear layer in the classifier of an R20 trained on CIFAR-10, where our initial findings show a slight increase in accuracy. Interestingly, this raises connections to classical wisdom on classifier design, such as maximizing margin with weight regularization, similar to SVMs. This potential link highlights opportunities for future work, where we can further analyze and explore the relationships between normalization and classifier performance.\n\n> Line 174f: To a cursory reader, it might be non-obvious that after the normalization, is s guaranteed that w.l.o.g.,  and  either 1 or 0, and hence  is either 0 or 1, thus the filter is either strictly averaging or strictly differencing, and Eq. 11 can be used to prove the equivariance and invariance guarantees. I suggest clearly describing this reasoning and really \"hammering it in\", as I believe it is a key step to understanding your contribution.\n\nWe will follow the reviewer’s suggestion and describe this part more clearly to facilitate the understanding of our contribution.\n\n> If I'm not mistaken, the theoretical equivariance and invariance results only cover spatially uniform gain and bias. As you're also evaluating on spatially varying gain and bias, is it possible to elaborate on that? Do you just assume local spatial uniformity since filter kernels are usually small? If yes, I think this should be mentioned in the paper.\n\nThank you for pointing this out! We indeed assumed local spatial uniformity, which holds reasonably well given the small size of filter kernels. You are correct that this assumption might not strictly hold for spatially varying gain and bias. Notably, our experiments show that the gain in accuracy from our method compared to vanilla ResNets is more pronounced for spatially varying cases. For instance, our R34N obtains a 4.2% gain in accuracy on $D_C$, whereas the gains on $D_L$ and $D_B$   are 7.2% and 31.3%, respectively. This suggests that our method provides more significant benefits when dealing with spatially varying corruptions, particularly those with faster spatial variations like $D_B$. We'll make sure to clarify this assumption and its implications in the paper to provide further context.\n\n> What is meant by \"co-domain symmetry\", mentioned in various places in the paper?\n\nIn classical signal processing, spatial equivariance is well understood: A convolutional filter responds consistently to translations of the input. Our filter normalization extends this structured response into the co-domain, i.e., the filter output space under intensity changes.\n\nWe define co-domain symmetry as follows: A filter exhibits co-domain symmetry if its response transforms in a predictable, structured way under affine transformations of the input intensity $x$, via gain ($g$) and offset ($o$).\n\nWe will clarify these definitions in the revision and illustrate them more explicitly in the discussion around Eq. (11).\n\n> Line 212f: Is there a reason why you introduce sort pooling layers? In general, I would appreciate a more complete description of all tested architectures, including network width, depth, activation functions, pooling layers, residual connections, and the use of batch normalization in the interest of reproducibility.\n\nWe added affine convolutions and sort pooling layers for a fairer comparison with norm-equivariant nets [15]. We will add a section in the appendix giving more details about the architecture used for this experiment. \n\n[15] Herbreteau, et al. Normalization-equivariant neural networks with application to image denoising. NeurIPS, 2023.\n\n> Lines 214 & 243: Is there a specific reason why you chose SGD over Adam?\n\nNot really. We followed implementations from PyTorch official examples. \n\n> Lines 326f: \"Artifacts reduction\" and \"a more targeted correction\" are rather handwavy justifications for the superiority of filter normlization over instance normalization. In addition, no intuition to what this actually means is provided. I suggest you either elaborate on this or remove these claims.\n\nRegarding \"artifacts reduction\", we observed that instance normalization can sometimes introduce undesirable artifacts in the output, particularly when the instance statistics are not representative of the atmospheric corruptions. On the other hand, by \"more targeted correction\", we mean that normalizing the weights rather than activations allows our approach to directly correct the filter's response to atmospheric corruptions, rather than indirectly adjusting the activations. We will further analyze our claims and expand on these points in the final version of the paper.\n\n**Minor comments:** We will carefully consider all minor comments and revise the paper accordingly for the final version."}]

Author rebuttal:

Meta-review: This paper proposes to normalize the convolution filter in deep neural networks (including ConvNets and ViT) motivated by classical image processing. They demonstrated that normalizing the filters benefits the learning of the model. Overall, the reviewers are supportive of the paper. During the discussion period, reviewers requested several additional comparisons and discussed whether the compared baselines are fair. The authors have promised to address and add these discussions. Finally, the AC would like to point out that “atmosphere-equivariant” is not formally defined. Strictly speaking, equivariance is defined with respect to a group action, which isn’t explicitly stated. The AC understands that some works use a less formal usage of "equivariance". It is better to be clear.
Decision: Accept (poster)