ImageNet-trained CNNs are not biased towards texture: Revisiting feature reliance through controlled suppression
Authors: Tom Burgert
Oliver Stoll
Paolo Rota
Begüm Demir
Venue: NeurIPS 2025 oral ()
Keywords: texture bias
feature reliance
shape vs. texture
model interpretability
Primary area: evaluation
TL;DR: We revisit the texture bias hypothesis in CNNs by proposing a domain-agnostic suppression protocol, finding that contrary to prior claims, CNNs primarily rely on local shape instead of texture features.

Abstract: The hypothesis that Convolutional Neural Networks (CNNs) are inherently texture-biased has shaped much of the discourse on feature use in deep learning. We revisit this hypothesis by examining limitations in the cue-conflict experiment by Geirhos et al. To address these limitations, we propose a domain-agnostic framework that quantifies feature reliance through systematic suppression of shape, texture, and color cues, avoiding the confounds of forced-choice conflicts. By evaluating humans and neural networks under controlled suppression conditions, we find that CNNs are not inherently texture-biased but predominantly rely on local shape features. Nonetheless, this reliance can be substantially mitigated through modern training strategies or architectures (ConvNeXt, ViTs). We further extend the analysis across computer vision, medical imaging, and remote sensing, revealing that reliance patterns differ systematically: computer vision models prioritize shape, medical imaging models emphasize color, and remote sensing models exhibit a stronger reliance on texture. Code is available at https://github.com/tomburgert/feature-reliance.

ImageNet-trained CNNs are not biased towards texture: Revisiting feature reliance through controlled suppression
Tom Burgert Oliver Stoll Paolo Rota', Begüm Demir BIFOLD', TU Berlin', University Trento
{t. owtgeertoosstoo www.o..ssoooo.oooooooooooo...o.o deoll, Stu-berrlu de, paolo rota@unitn.
Abstract
The hypothesis that Convolutional Neural Networks (CNNs) are inherently texture- biased has shaped much of the discourse on feature use deep learning. We revisit this hypothesis by examining limitations in the cue-conflict experiment by Geirhos et al. To address these limitations, we propose a domain-agnostic framework that quantifies feature reliance through systematic suppression of shape, texture, and color cues, avoiding the confounds forced-choic' con- flicts. By evaluating humans and neural networks under controlled suppression conditions, we find that CNNs are not inherently texture-biased but predomi- nantly rely local shape features. Nonetheless, this reliance can be substantially mitigated through modern training strategies or architectures (ConvNeXt, ViTs). We further extend the analysis across computer vision, medical imaging, and remote sensing, revealing that reliance patterns differ systematically: computer vision models prioritize shape, medical imaging models emphasize color, and remote sensing models exhibit a stronger reliance on texture. Code is available at https///ghhubbbcoo//oommnuttttte
Introduction
Convolutional neural networks (CNNs) have played a central role the development of deep learning Their success across range of computer vision (CV) benchmarks has contributed to the perception that they acquíre perceptual representations resembling those of humans [5]
models for visual recognition [1 [2]
6 7 However, growing body of work suggests that CNNs may process visual information fundamentally different ways [8]
[9 [T]] One of the most influential claims in this direction is that CNNs trained ImageNet are inherently biased towards texture [8], in contrast to humans who predominantly rely on shape cues (.]. This claim, first formalized by Geirhos et al. K through their cue-conffict experiment, has since shaped much of the discourse how to evaluate and interpret the use of features in deep neural networks.
In the cue-conflict experiment, images are synthesized by combining the shape of one object class with the texture another, using neural style transfer techniques [I2]. Models and humans are then presented with these hybrid images, and their predictions are analyzed to infer which visual cues they rely on. The observed divergence, with CNNs favoring texture and humans favoring shape, has become a dominant narrative for understanding human machine perceptual differences and has inspired a wide range of follow-up studies [13.
13
Although influential, the cuc-conffict experiment is based on assumptions that may limit the generaliz- ability and clarity of its findings. Conceptually, it reduces feature reliance binary choice between shape and texture, overlooking other potentially informative cues such as color, and tends to link salience with reliance implicitly. Methodologically. the generated stimuli entangle unintentionally
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

Cue-Conflict Setup Geirhos et al. [8]
Evaluating Feature Reliance through Suppression
dese RASTTAIIo
Preference Model gredicts elephent
shape refant
sppvessio
Reliance
Model
shapes cat texture wiephent
color rollant
Figure 1: Comparison of cue-conflict setup [8] (left) and our suppression-basee basee framework (right). While Geirhos et al. infer reliance through preference on hybrid images, our framework directly quantifies reliance by measuring accuracy under systematic suppression of texture, shape, or color.
multiple features, introduce texture cues across the image in spatially unbalanced manner, and rely on shape-based response interfaces that may bias human judgments. As discussed further in Section these conceptual and methodological limitations complicate conclusions about the feature use of models and humans.
In this work, argue for conceptual shift: from analyzing feature bias through forced-choice conflicts to assessing feature reliance through targeted suppression. This conceptual distinction reframes how feature preferences and reliance should be evaluated. A model may prefer certain cue in conflict, not because it is more predictive, but because it is more salient. Conversely, model may rely heavily on a feature in natural settings, even if does not dominate cue-conflict scenarios. To address the aforemeentioned limitations, we propose new domain-agnosio evaluation framework that quantifies performance degradation under systematic suppression of individual feature types (e.g.. shape, texture, and color), enabling empirical measurement of reliance. The proposed framework does not rely on adversarial inputs or neural style transfer, but instead uses direct suppre--upppessing transformations. By isolating individual feature contributions, our framework offers more reliable basis for interpreting model decisions and comparing representational strategies, both between humans and neural networks, and across model architectures and domains.
Our main contributions are as follows:
(1) We present re-examination of Geirhos et al.'s cue-conflict experiment aspects in their evaluation protocol that may limit its generalizability.
3 highlighting
(2) We introduce domain-agnostic framework for evaluating feature reliance through targeted feature suppression, enabling cleaner measurement of model dependence on individual visual cues without requiring confticting setups.
(3) Using the proposed framework, we systematically compare human and model feature reliance under controlled conditions. Our results challenge the texture bias hypothesis 3 by showing that CNNs are not inherently texture-biased; instead, they only exhibit pronounced sensitivity local shape, which can be mitigated through modern training strategies. Notably, models trained with vision-language supervision most closely match human behavior.
(4) We apply the same framework to assess domain-specinf differences in feature reliance, showing that models trained on CV, remote sensing (RS), and medical imaging (MI) datasets prioritize distinct visual cues depending domain characteristics.
2 Related Work
Understanding which features deep neural networks rely on for image classification has been long- standing research question. While carly interpretations of CNNs assumed hierarchical buildup from

---

low-level edges to complex shape representations [51, 6 ? more recent studies have challenged this view, suggesting that CNNs often rely disproportionately on local texture rather than global shape
[ [TO]. 8 18. Geirhos et al. g formalized this observation as the texture bias hypothesis, using a cue-conflict protocol to reveal divergent feature preferences between humans and CNNs.
Subsequent work investigated factors shaping feature reliance beyond architecture. Hermann et al.
1K showed that texture bias in CNNs arises primarily from training objectives and augmentations, with techniques like blurring and cropping increasing shape bias more than architectural changes.
Although shape features are present in deeper layers [15]. [14. they are not consistently used during classification. Transformer-bon -base models and vision- lanione models have shifted this discussion. Vision transformers (ViTs) exhibit lower texture bias due to their global attention mechanism [1).
20 and rision-language models show improved alignment with human-like shape use (21].
Various methods have attempted to enforce shape bias or suppress texture cues for improved ro-
bustness, including anisotropic filtering [22). edge encoding (3). style disentanglement (24), 25)
and shape-focused augmentations [26]]
77 However, stylization alone may improve robustness
independent of shape bias 128]. and neither shape nor texture bias reliably predicts generalization
[6]. These findings have motivated integrative approaches that combine diverse feature biases. Joint supervision [29]. ensembles K00, and adaptive recombination BiI aim to harness complementary features. Ge et al. 132 and Jain al. [7 show that disentangling and combining shape, texture, and color improve robustness and interpretability. Nonetheless, Lucieri et al. [33) caution that in domains like MI, cue entanglement is essential and biasing towards shape may be counterproductive.
Efforts to increase shape bias are often motivated by the broader goal of human-model alignment. Geirhos et al.
show that even robust models exhibit error patterns that diverge from humans, revealing persistent consistency gap. Muttenthaler et al. [36] further argue that alignment with human conceptual structure depends more on training signals than model scale, indicating that robustness and shape bias alone are insufficient proxies for human-like perception.
3 Rethinking Texture Bias: A Critical Look at Cue-Conftict Evaluation
The hypothesis that CNNs trained on ImageNet are biased towards texture was popularized by Geirhos et al. [. who introduced a cue-conflict evaluation protocol. In this protocol, images were generated by neural style transfer [12], combining the shape content (cue) of one class with the texture content (cue) of another. Predictions from both humans and CNNs on these images were then used infer whether classification decisions were driven more by shape texture features. Over time, the cue-conflict evaluation protocol has become a de facto standard for assessing feature bias in deep neural networks. While impactful, this protocol introduced several assumptions and limitations that have received limited attention. Conceptually, the protocol frames feature reliance choice. which may overlook other cues such as color and conflates preference with dependence. In addition, the stylized stimuli constrain the evaluation of feature bias to naturalistic images with a similar set of classes and cannot be generalized across datasets (e.g., flower classification) or domains (e.g., RS, MI). Beyond these conceptual limitations, the cue-conflict protocol exhibits three methodological concerns in its design and implementation:
as a binary shape-or-textue
(i) Lack of Feature Isolation. The texture cues within the cue-conflict images also preserved information beyond texture, including color and local shape structures (e.g., contours and parts of silhouettes). As result, the synthesized texture cue was not a pure representation of texture but a composite of multiple features, making difficult to attribute classification behavior to texture alone. An example can be seen in Figure 2a
(ii) Overloaded Texture Class Signals. The protocol consistently inserted texture cues not only into the object region but also into the image background. Since CNNs aggregate local statistics across spatial positions, this broad spatial distribution increases the signal strength of the texture class relative to the shape class. This spatial imbalance systematically biases CNNs towards texture-basse decisions, not because of intrinsic preference but due the dominant spatial availability of the texture signal. An example can be seen in Figure 25
(iii) Human Interface Bias Towards Shape. Participants in the human experiments selected the image class by clicking on buttons labeled with icons representing each category. These icons represented global shape characteristics (i.c., silhouettes), potentially guiding participants
3

---

towards matching shape features in the cue-conflict image with the icon. This response format potentially introduces bias towards shape decisions, especially when participants were unsure which feature to prioritize. The used icons are visualized in Figure 2c
(b)
(c)
Figure 2: Example images taken from the cue-conflict dataset g (a) Boat shape cue merged with
chair texture cue. (b) Airplane shape cue merged with clock texture cue. (c) Icons of the human interface to select classes.
These design choices may inadvertently influence CNNs towards texture-driven decisions and humans towards shape-based decisions and complicate drawing definitive conclusions about the actual feature reliance of models.
A Domain-Agnostic Framework for Feature Reliance
Accurately assessing how deep neural networks rely different visual features remains a central challenge understanding their behavior. While the cue-conffict evaluation protocol [ introduced a reliance test based feature bias, it imposes conceptual and methodological constraints that limit its generalizability. Rather than forcing models to choose between shape and texture, we propose to assess their reliance individual feature types by systematically suppressing them and measuring the resulting impact on classification performance. This shift enables a more flexible, generalizable, and semantically grounded analysis of feature in neural networks.
To evaluate the reliance of deep neural networks on individual visual features, we employ a set of image transformations that selectively suppress shape, texture, or color information while minimally affecting the remaining features. Each transformation is chosen for its ability to target a specific feature class. We define three feature types:
Shape refers to information carried by spatial arrangement and structural contours, including both global (object outline) and local (part-level) shape.
Texture is defined by repetitive patterns, high-frequency local variations, and fine-grained surface details.
Color denotes chromatic information independent of spatial layout or texture.
For each feature type, we include two complementary transformations that differ in their suppression mechanisms and preservation profiles, offering distinct but comparable perspectives on the targeted feature. The transformations
summarized in Table and briefly described the following. Patch 2X and Patch Rotation disrupt shape by modifying non-overlapping image patches:
Shuffle RM Shuffle randomizes spatial positions, while Rotation preserves locality of patches but breaks edge continuity. Both affect global or local shape, depending on the grid size. Bilateral Filtering [38] and Gaussian Blur reduce texture by smoothing high-freeuency details, with the former preserving edges more effectively. Grayscale removes chromatic cues entirely, while Channel Shuffle disrupts color correlations without altering intensity. In the following, we validate the suppression effects of these transformations using quantitative metrics.

---

Table Feature suppression transformations used in this work. Each feature suppressed using two transformations with differing strengths.
Feature Type
Transformation
Transformation 2
Shape
Patch Shuffle
Patch Rotation
Texture
Bilateral Filter
Gaussian Blur
Color
Grayscale
Channel Shuffle
Table 2: Quantitative validation of suppression transformations across 800 images of ImageNet. Each transformation is used with a fixed parameter setting (see Param ID legend below). Values report normalized metric scores. Arrows indicate desired direction: t higher is better, lower is better.
Transformation
Param ID
Texturel
Shapet
LVL
HFF
ESSIM1
GC1
Texture- Suppressinn
Bilateral Filter
A
0.521
0.796
0.548
0.493
0.737
0.855
Box Blur
B
0.193
0.363
0.237
0.148
0.436
0.289
Gaussian Blur
C
0.349
0.662
0.392
0.306
0.744
0.579
Median Filter
D
0.357
0.506
0.399
0.316
0.584
0,429
NLMeans Denoising
0,706
0.797
0.723
0.690
0.730
0.864
Transformation
Param ID
Texturef
Shapel
LVT
HFE1
ESSIMI
GCL
Shape-Suppressing
Patch Shuffle
1.000
0.176
1.000
1.000
0.205
0.147
Patch Rotation
1,000
0.293
1.000
1.000
0.339
0.247
Legend: A: d=11, a.=100 a,=75; B: k=11; C: k=11, a=2.0; D: k=11; E: h=20, tws=111 sws=11; I; F: grid-6.
4.1
Quantitative Validation of Suppression Transformations
While the individual transformations used in this work not novel, their selection for targeted feature suppression requires empirical justification. To validate that each transformation suppresses the intended visual feature (e.g.. texture, shape) while preserving others, quantify their effects
using four metrics: Local Variance (LV) (39 and High-Frequency Energy (HFE) [40 to assess texture suppression, and Edge-SSIM (ESSIM) 41 and Gradient Correlation (GC) to measure shape preservation. All metrics are normalized to the range [0, by dividing by the scores of the unsuppressed (i.e., original) image. Higher values of ESSIM and GC indicate better preservation of edge and structural information, while lower values of LV and HFE reflect stronger suppression of texture features. Further, we compute a harmonic mean across the two texture metrics (Texture) and the two shape metrics (Shape) for each transformation.
We test the effectiveness of the feature suppression transformations across 800 sampled images from the ImageNet validation set. For each transformation, we evaluate a representative parameter setting chosen balance suppression of the target feature and preservation of others. The respective parameters, such as kernel size or smoothing strength, are indexed by Param IDs in Table 2 with details listed below the table. A full ablation of different parameter settings is provided in the supplemental material (see Section Dj. In addition to our selected texture suppression transformations, we also compare common alternatives such as Non-Local Means Denoising [42 Box blur, and Median filtering [4] to ensure a fair comparison across standard smoothing techniques. Among sxttree-uppresssin methods, bilateral filtering yields the most balanced trade-off between reducing texture (LV: 0.54, HFE: 0.49) and preserving shape (ESSIM: 0.74, GC: 0.85). Gaussian Blur suppresses texture more uniformly but leads to a greater loss of shape information. Box blur and median filtering remove texture strongly, but at substantial cost to shape preservation. For shape suppression, we evaluate Patch Shuffle and Patch Rotation with a grid size of 6. These transformations preserve texture but substantially disrupt structural contours, making them suitable for assessing shape reliance. To complement the quantitative evaluation, qualitative visual examples of the suppression effects provided in the supplemental material (see Section
5

---

5 Experiments
5.1 Experiment I: Human vs. CNNs Feature Reliance
Experimental Setup. To compare human and model reliance on different visual features, we designed a controlled experiment inspired by Geirhos et al. [34. [ We constructed an ImageNet I 6-ke dataset by selecting 50 representative images for each of 16 entry-level categories derived from the
WordNet hierarchy [ (see |E for details). Images were selected based on the most confidently predicted samples in the ImageNet validation set [45] by ResNer50 [2] pretrained on ImageNetIk, ensuring balanced subclass coverage. For categories with insufficient confident predictions (airplane, knife, oven), additional samples were manually added. All images were resized to 224 x 224 pixels.
Humans were presented with image stimuli in randomized order under one of five conditions: original, global shape suppression, local shape suppression, texture suppression, or color suppression. Each feature was suppressed via a single transformation with fixed hyperparameters: Patch Shuffle with grid size 3 (global shape), grid size 6 (local shape), bilateral filtering with d=12,, =olor=100 and =pace=75 (texture), and grayscale conversion (color). See Section for justification. Each participant saw only one randomly chosen version of each image to avoid learning effects. The five suppression conditions of one image were split across groups of five participants to ensure balanced coverage. Twenty participants completed the study. Following Geirhos et [8) each trial included a 300 ms fixation square, 200 ms image presentation, and 200 ms pink noise mask (1/f spectral shape) to minimize feedback processing. Participants selected one of 16 categories via a 4 x 4 grid of alphabetically sorted class names. An additional "not clear" button was available for unrecognizable stimuli. Attention checks were administered every 100 trials, and failed trials were excluded. Additional details and interface screenshots can be found in the supplemental material.
Model evaluation mirrored the human protocol, evaluating their performance under the same five suppression conditions using the identical image set shown to humans. For each image, the class prediction was computed by summing softmax outputs over all ImageNet subclasses mapping to the same entry-level category. Only predictions above the threshold of 0.5 were considered correct. This procedure was chosen heuristically, complementary results using argmax to define class predictions are reported in the supplemental material and show nearly identical reliance profiles.
We evaluated several architectures: ResNet50-standard, trained from scratch with basic augmentations, Additional CNNs include MobileNetV3
and ResNet50-sota, trained with a modern recipe 46
47.. EfficientNet 3) EfficientNet 48), ConvMixer 49 ConvNeXt 4 and ConvNeXtV2 [50]
Transformer- based models include ViT [51. DeiT 122 Swin Tranfforsformrr
153, and CLIP ViT [54]
All models except ResNee55-sstanaat were obtained as pretrained checkpoints from the t timm library The detailed training procedures can be found in the supplemental material.
55
Results. Figure 3 presents a comparative overview of the performance of humans and CNNs under feature suppression, plotted as the relative accuracy (i.e., accuracy under suppression divided by baseline accuracy on original images). Separate subplots show results for each suppressed feature type. We highlight three representative CNNs: ResNet50-standard, ResNet50-sota, and ConVNeXtV2 alongside human performance. The results show that CNNs are not strongly reliant on texture: under texture suppression, ResNee55-standan retains 80% of its original performance, close to performance under global shape suppression (83%). The highest vulnerability is observed under local shape suppression, where accuracy drops to just 28%. Humans exhibit similar reliance profile with local shape suppression being most disruptive, but show higher robustness to it (76% retained accuracy). Interestingly, modern training strategies substantially mitigate this effect: the ResNet50-sota reaches 62% under local shape suppression, and CtV2 improves further to 65%. These results suggest that the heavy reliance on local shape observed in carlier CNNs is not architectural in nature but can be alleviated through better training regimes. A likely contributing factor is the inclusion of stronger regularization, improved data augmentations, and more extensive training schedules in the modern setup, which may encourage broader feature utilization beyond local patterns. Statistical significance tests confirming these differences are reported in the supplemental material.
Broadening the analysis to wider range of architectures (Table B) we observe that several models trained with state-of-the-aar recipes exhibit more balanced reliance profile. However, this trend is not universal: MonvMixer, EfficientNet, and MobileNet variants retain a strong dependence on local shape, indicating that improved training alone does not guarantee human-like feature use and that architectural inductive biases or capacity limitations may still play a role. Among transformer-

---

(a) Global Shape
Shape
(c)
Color
Humaro
Humora
Realeet Desta
Rasless Sarta
RasheutS-pdd
Car Sarguree
sirgores
1 12 SPP
Rodtinn df cervect Giae
Heation corred
Figure Relative accuracy under feature suppression for human observers and three CNNs ResNet50- standard, ResNet50-sota, ConvNcXiV2 on the curated ImageNet16 dataset. Each subplot shows performance under suppression of specific feature: (a) global shape via Patch Shuffle (grid=3); (b) local shape via Patch Shuffle (grid=6); (c) texture via bilateral filtering; and (d) color via grayscale.
Table 3:
Relative accuracy (accuracy under suppression divided by accuracy on original images) for each feature suppression type across models and human observers.
Global Shape
Local Shape
Architecture
Texture
Color
Original
#Params
Humans
0.965
0.763
0.979
0.999
0.969
ResNec50-standard
0.832
0.276
0.795
0.924
0.954
25.6M
ResNer50-sota
46
0.943
0.618
0.867
0.948
0,931
25.6M
ConvNeXt
0,938
0.606
0,910
0.961
0,934
28.6M
ConvNeXIV2
500
0,949
0,647
0,925
0,969
0.940
28.6M
EfficientNet
3
0.870
0.240
0.892
0,987
0.856
30.0M
EfficientNetV2
48
0.926
0,423
0.897
0.957
0.932
24.0M
MobileNetV3
0.795
0.217
0.761
0.859
0.881
5.4M
Conv
49
0.920
0,437
0,815
0.891
0.874
21.1M
VIT [1
0,930
0.636
0,921
0.977
0,929
86.6M
DeiT
52
0.938
0.730
0.926
0.969
0.932
86.6M
Swin
53
0,924
0.713
0.906
0,941
0.945
87.8M
CLIP VIT
0.959
0.758
0.949
0.984
0.936
86.6M
based models, the VIT demonstrates a feature reliance profile similar to ResNet50-sota across all suppression conditions, challenging the notion that transformers are inherently more shape-oriented than CNNs. Notably, the CLIP VIT model most closely matches human performance across all feature suppression conditions, suggesting that vision- saiionla supervision encourages more human-aligen representations. This may reflect the effect of contrastive vision-language training, which prioritizes alignment with high-level semantic concepts over low-level visual cues.
These findings challenge the texture bias hypothesis popularized by Geirhos et al. g as a fixed inductive bias of CNNs. Instead, the observed behavior the cue-conflict experiment may have reflected a dominant reliance on local shape features, rather than an inherent texture bias.
5.2 Experiment II: Domain-specifie Feature Reliance
While Section 5.1 focuses on comparing feature reliance between humans and CNNs on a fixed benchmark. this section explores how reliance on shape, texture, and color varies across domains. The same suppression-basee framework introduced earlier is applied to three representative visual domains: CV, MI, and RS. each case, we fix the architecture training protocol, including only the data augmentation techniques random resized crop and horizontal flip. For CV datasets, we either train from scratch or initialize models with prretrrined weights (standard training protocol) and then fine-tune on the respective datasets. For MI and RS, we train from scratch to allow disentangled comparison across domains. Additional results for and RS with pretrained models to simulate operational scenarios can be found in the supplemental material. Details about the hyperparameter, as well as an overview of the corresponding validation accuracies, provided in the supplemental material. In contrast to the previous experiment, in this
ResNet50 and apply the standard

---

CV Shape Suppression
(b) Texture Suppression
(e) Suppression
Heap pod IPo aoatl
Tranton No Suggressoo
natort dryet (aversind
Thattmn 7e No
2.1
04
2.4
2.4
inapeel Desroodda
than SAMIU
CR7eC1011 (peroiiee)
obbedhic spacrs aad
82
cal rpit (ansoiee
2050 braratecc
wite preze
Gr4 S3m
(d) MI Shape Suppression
(e) MI Texture Suppression
(i) MI Color Suppression
Tratton (SN. Suppenaaerr
beadendd thar scraoo)
dwetroed then sratey
patiened Jhen woatee rehaerii thom iramn!
Soscmean: Fanm tosugh
AbcSTrR: Plo SOROCT
Semuirent (onmoo
cepraveet yrav contee) petvenal tham acateon
0.2
an acrecch
(g) RS Shape Suppression
(h) RS Texture Suppression
(i) RS Color Suppression
BEcing Fractten Ov. No Sugerssccn
3.0
patetre: Pian 109021 soudh 2
petirri star scrnnct
acanch
22
deophee conich
Suc b3e Par scrnch
desiglin (fom acracio
Figure 4: Feature suppression results across three domains. Top row (a-c): ResNet50 pretrained on ImageNet and fine-tuned on CV datasets. Middle row (d-f): ResNet50 trained from scratch on MI datasets from MedMNIST-v2. Bottom row (g-i): ResNet50 trained from scratch high-resolution RS datasets. Columns correspond to: (a, d, g) shape suppression (Patch Shuffle), (b, e, h) texture suppression (Bilateral Filter), and (c, i) color suppression (Grayscale).
experiment, suppression strength is treated as continuous hyperparameter and systematically varied to obtain suppression curves that characterize feature reliance across domains. To reduce redundancy, report results using one representative suppression technique per feature type in the main paper. Results using alternative suppression methods per feature type are included the supplemental material and exhibit qualitatively similar patterns across domains.
To visualize comain-speciffc suppression sensitivity, we present composite figure of per-domain results in Figure showing the effect of suppressing shape, texture, and color for datasets from each domain. To ensure comparability across datasets with different numbers of classes and baseline accuracies, we standardize performance by rescaling: chance-level accuracy is mapped to 0, and baseline accuracy (i.e., accuracy on original images) is mapped to 1. Relative accuracy under suppression is then expressed on this normalized scale, facilitating direct comparison of feature reliance across domains and datasets. Finally, to synthesize the findings, we aggregate suppression curves in domain-level comparison (Figure 5) by averaging results across datasets within each domain.
Computer Vision (CV), Figure shows suppression results for five standard CV benchmarks (Im- ageNet [45) Caltech101 [56) Flowers [57]. Oxford-IIIT-Pet [58]. STL10 (59). Across datasets, we observe that shape suppression induces the strongest performance degradation, especially as the patch shuffle grid size increases. This confirms a pronounced reliance on local shape information in pretrained CNNs. In contrast, texture suppression via bilateral filtering has minimal effect, and color suppression through grayscale conversion yields only minor degradation, indicating that CNNs fine-tuned on these datasets are largely robust to the removal of texture and color cues. These results
8

---

Shape Suppression
(b) Texture Suppression
(e) Color Suppression
Frectum ba No Suggrssion
1.8
scnocs)
Cr O.ttenaree
Orid Stee
422ha
Figure 5: Domain-averaged feature suppression curves for CV, MI, and RS. (a) Shape suppression via Patch Shuffle. (b) Texture suppression via bilateral filtering (c) Color suppression via grayscale.
consistent with our human comparison study and suggest that local shape continues to dominate feature reliance in natural image classification tasks. For completeness, the supplemental material includes results for models trained from scratch as well as class-wise analysis for ImageNet, which confirms that the global reliance patterns are consistent across categories.
Medical Imaging (MI). Figure 41-f summarizes results on five datasets from the MedMNIST-v2 collection [60]: PathMNIST, RetinaMNIST, BloodMNIST, DermaMNIST, and ChestMNNST. We use the standardized 224 x 224 pixels version to ensure consistency with the experimental setup. Across these datasets, suppression effects are more heterogeneous than in CV. While shape serpeesuppsssse degrades performance, the impact is generally less pronounced, and texture suppression yields moderate performance drops in datasets such as PathMNIST and BloodMNIST, but relatively little effect in RetinaMNIST and DermaMNIST. By contrast, color suppression induces substantial decline in classification accuracy for most datasets, reflecting the strong diagnostic role of chromatic cues, except in ChestMNIST, which contains only grayscale images. Taken together, these results suggest that feature reliance in MI varies substantially across datasets, with common trend towards greater dependence on color information.
suppression
Remote Sensing (RS), Figure 4g-i reports suppression curves for five very-high-resolutiov RGB datasets: UCMerced 611, RSD46-WHU 622 DeepGlobe [63]. PatternNet [64], and AID 655). As in MI, shape suppression impacts performance, but the degradation less pronounced than in the CV domain, indicating lower reliance on local shape. In contrast to CV and MI. texture suppression leads to substantial performance degradation across all datasets, suggesting that fine-grained surface patterns are critical for RS classification. Surprisingly, color suppression also results in notable performance drops, despite the use of RGB imagery only. This likely reflects strong correlations between chromatic cues and semantic land cover categories. Overall, RS models exhibit a pronounced reliance on texture and color, and comparatively less dependence on local shape, reflecting the distinct statistical structure and spatial semantics of RS imagery.
Cross- Moos--Dmminn Comparison. To synthesize these observations, Figure 5 presents the domain- averaged suppression curves for each feature, including 1-sigma error bars. Three clear trends emerge. First, CV models are most reliant on local shape, especially when trained from scratch, while Ima- geNet pretraining induces slightly greater robustness. Second, MI models exhibit stronger dependence on color, consistent with the nature of some medical tasks (e.g., in dermatology, histopathology) which often require interpreting chromatic cues. Third, RS models exhibit the highest texture reliance among the three tested domains. This may reflect the nature of many RS classes that are defined by texture-like patterns ge.g., fields, residential areas), rather than by distinct global contours. These patterns confirm that feature reliance is shaped not only by architecture and training regime, but also by the visual and semantic properties of the task domain.
Finally, to validate the observed feature reliance patterns, we conduct complementary experiments on CV datasets with simultaneous suppression of two features (see Section L5 in the supplemental material). Results confirm the trends of single-feature suppression: performance is highest when only shape is preserved, reduced when only texture remains, and nearly lost when only color is available. In summary, the findings highlight that domain characteristics, alongside architecture and training regime, play crucial role in shaping feature reliance. While prior work emphasized cehhitectur-innuccad biases, our results suggest that data properties equally govern the perceptual strategies that models adopt.

---

6
Conclusion
This paper revisited the widely cited claim that CNNs trained on ImageNet are inherently biased towards texture. We identify critical conceptual and methodological limitations in the cue-conflict experiment popularized by Geirhos al. [8] that support this hypothesis. Further, we propose a new framework for evaluating feature reliance based targeted suppression rather than forced-choice preference. Using this framework, we find no evidence for an inherent texture bias in CNNs, but instead observed pronounced reliance on local shape features. Nonetheless, we show that this reliance can be substantially mitigated through modern training strategies. Across domains, we find that feature reliance varies substantially: CV models prioritize shape, MI models rely more evenly on color, and RS models exhibit strong texture sensitivity. These findings challenge the notion of fixed architectural biases and instead position feature reliance as flexible property shaped by optimization objectives and domain-specifts semantics, offering new directions for designing models that better align with human perceptual strategies. At the same time, the relative contributions of architectural components and training strategies to these reliance patterns remain to be systematically evaluated.
Limitations. Our framework relies operational definitions of shape, texture, and color based on specific transformations, but features are continuous and interdependent, limiting perfect isolation. In practice, suppression only reduces rather than eliminates features: texture suppression residual low-level features perceptible as texture, while shape suppression does not fully remove all shape cues. This reflects the inherent trade-off of reducing one feature while preserving others, making absolute removal unattainable. The applied suppression techniques may also introduce artifacts that affect model behavior independently of the targeted features (e.g., block-like structures from Patch Shuffle, smoothing from filtering). Further, the results obtained with pretrained models may reflect effects of similarities between suppression transformations and augmentation techniques (e.g., Cutout and Patch Shuffle). Finally, our human experiments employed a controlled forced-choice design with brief exposures and limited set of categories to ensure comparability. While necessary for experimental control, these constraints may not fully reflect the richness and adaptability of human visual perception real-world settings.
leave
Acknowledgements
We thank Johanna Vielhaben and Gene Hoxha for suggesting the addition of quantitative experiments to validate the feature suppression techniques, Liliann Lehrke for valuable guidance on the design of the human study, and Christopher Olk for helpful discussions in selecting the title. This work was partly supported by EU Horizon projects ELIAS (No. 101 101120237) and ELLIOT (No. 101214398).
References
[1] Alex Krizhevsky, Ilya Sutskever, and Geoffrey E Hinton. ImageNet classification with deep con- volutional neural networks. In Advances in Neural Information Processing Systems, volume 25, 2012.
[2] K. He, X. Zhang, S. Ren, and J. Sun. Deep residual learning for image recognition. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 770-778, 2016.
[3] Mingxing Tan and Quoc Le. Efficientnet: Rethinking model scaling for convolutional neural networks. In International Conference on Machine Learning, pages 6105-61 14, 2019.
[4] Zhuang Liu, Hanzi Mao, Chao-Yuaa Wu, Christoph Feichtenhofer, Trevor Darrell, and Saining Xie. A convnet for the 2020s. In Proceedings of the IEEE/VV Conference on Computer Vision and Pattern Recognition, pages 11976-11986, 2022.
[5] Yann LeCun, Yoshua Bengio, and Geoffrey Hinton. Deep learning. Nature, 521(7553) 2015.
[6] Jonas Kubilius, Stefania Bracci, and Hans P Op de Beeck. Deep neural networks as computa- tional model for human shape sensitivity. PLOS computational biology, 10(4)e 2016. Publisher: Public Library of Science San Francisco, CA USA.
10

---

[7] Samuel Ritter, David GT Barrett, Adam Santoro, and Matt M Botvinick, Cognitive psychology for deep neural networks: A shape bias case study. International Conference on Machine Learning, pages 2940-2949, 2017.
[8] Robert Geirhos, Patricia Rubisch, Claudio Michaelis, Matthias Bethge, Felix A. Wichmann, and Wieland Brendel. ImageNet-trained CNNs are biased towards texture; increasing shape bias improves accuracy and robustness. In International Conference on Learning Representations, 2019.
[9] Nicholas Baker, Hongjing Lu, Gennady Erlikhman, and Philip J Kellman. Deep convolutional networks do not classify based on global object shape. PLoS computational biology, 14(12):
e1 e1006613, 2018. Publisher: Public Library of Science San Francisco, CA USA.
[10] Wieland Brendel and Matthias Bethge. Approximating CNNs with Bag-of-local-Fees models works surprisingly well on ImageNet. In International Conference on Learning Repre- sentations, 2019.
[11] Barbara Landau, Linda B Smith, and Susan Jones. The importance of shape early lexical learning. Cognitive Development, 3(3):299-321, 1988.
[12] Leon A Gatys, Alexander S Ecker, and Matthias Bethge. Image style transfer using convolutional neural networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Puttern Recognition, pages 2414-2423, 2016.
[13] Katherine Hermann, Ting Chen, and Simon Kornblith. The Origins and Prevalence of Texture Bias in Convolutional Neural Networks. In H. Larochelle, M. Ranzato, R. Hadsell, M. F. Balcan, and H. Lin, editors, Advances in Neural Information Processing Systems, volume 33, pages 19000-19015, 2020.
[14] Katherine Hermann and Andrew Lampinen. What shapes feature representations? Exploring datasets, architectures, and training. In H. Larochelle, M. Ranzato, R. Hadsell, M. F. Balcan, and H. Lin, editors, Advances in Neural Information Processing Systems, volume 33, pages 9995-10006, 2020.
[15] Md Amirul Islam, Matthew Kowal, Patrick Esser, Sen Jia, Björn Ommer, Konstantinos G. Derpanis, and Neil Bruce. Shape or Texture: Understanding Discriminative Features in CNNs. In International Conference on Learning Representations, 2021.
[16] Paul Gavrikov and Janis Keuper. Can Biases in ImageNet Models Explain Generalization? In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 22184 22194, 2024.
[17] Saachi Jain, Dimitris Tsipras, and Aleksander Madry. Combining diverse feature priors. In International Conference Machine Learning, pages 9802 9832, 2022.
[18] Ajay Subramanian, Elena Sizikova, Najib Majaj, and Denis Pelli. Spatial-frequee channels, shape bias, and adversarial robustness. In Advances in Neural Information Processing Systems, volume 36, pages 1137-4149 2023.
[19] Muhammad Muzammal Naseer, Kanchana Ranasinghe, Salman H Khan, Munawar Hayat, Fahad Shahbaz. Khan, and Ming-Hsuan Yang. Intriguing properties of vision transformers. Advances in Neural Information Processing Systems, 34:23296 2021.
[20] Shikhar Tuli, Ishita Dasgupta, Erin Grant, and Thomas I. Griffiths. Are convolutional neural networks or transformers more like human vision? arXiv preprint arXiv:2105.07197, 2021.
[21] Paul Gavrikov, Jovita Lukasik, Steffen Jung, Robert Geirhos, Muhammad Jehanzeb Mirza, Margret Keuper, and Janis Keuper. Can We Talk Models Into Seeing the World Differently? In International Conference on Learning Representations, 2025.
[22] Shiok Mishra, Anshul Shah, Ankan Bansal, Janit Anjaria, Jonghyun Choi, Abhinav Shrivastava, Abhishek Sharma, and David Jacobs. Learning visual representations for transfer learning by suppressing texture. In British Machine Vision Conference, 2022.
11

---

[23] Narges Honarvar Nazari and Adriana Kovashka. The role of shape for domain generalization on sparsely-texture images. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 5120-5130, 2022.
[24] Hyeonseob Nam, HyunJae Lee, Jongchan Park, Wonjun Yoon, and Donggeun Yoo. Reducing Domain Gap by Reducing Style Bias. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 8690-8699, 2021.
[25] Dhruva Kashyap, Sumukh K. Aithal, Rakshith C, and Natarajan Subramanyam. Towards Domain Adversarial Methods to Mitigate Texture Bias. In International Conference Learning Representations Workshop, 2022.
[26] Sangjun Lee, Inwoo Hwang, Gi-Cheon Kang, and Byoung-Tak Zhang, Improving Robustness Texture Bias via Shape-Focused
Focused Augmentation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops, pages 4323-4331, 2022.
[27] Aditay Tripathi, Rishubh Singh, Anirban Chakraborty, and Pradeep Shenoy. Edges to shapes to concepts: Adversarial augmentation for robust vision. In Proceedings of the IEEE/CVF Conference Computer Vision and Patlern Recognition, pages 24470-24479, 2023.
[28] Chaithanya Kumar Mummadi, Ranjitha Subramaniam, Robin Hutmacher, Julien Vitay, Volker Fischer, and Jan Hendrik Metzen. Does enhanced shape bias improve neural network robustness common corruption? In International Conference on Learning Representations, 2021.
[29] Yingwei Li, Qihang Yu, Mingxing Tan, Jieru Mei, Peng Tang, Wei Shen, Alan Yuille, and cihang xie. TexturTexture Debiased Neural Network Training, In International Conference on Learning Representations, 2021.
[30] Kenneth T Co, Luis sal adversarial robustness of texture and shape-biased models. In IEEE International Conference on Image Processing, pages 799-803, 2021.
Leslie Kanthan, Ben Glocker, and Emil C Lupu. Univer-
[31] Xinkuan Qiu, Meina Kan, Yongbin Zhou, Yanchao Bi, and Shiguang Shan. Shape-biased CNNs are Not Always Superior in Winter Conference on Applications of Computer Vision, pages 2326 2335, 2024.
Robustness. Proceedings of the IEEE/CVF
[32] Yunhao Ge, Yao Xiao, Zhi Xu, Xingrui Wang, and Laurent Itti. Contributions of shape, texture, and color in visual recognition. In European Conference on Computer Vision, pages 369-386, 2022.
[33] Adriano Lucieri, Fabian Schmeisser, Christoph Peter Balada, Shoaib Ahmed Siddiqui, Andreas Dengel, and Sheraz Ahmed. Revisiting the shape-bias of deep learning for dermoscopic skin lesion classification. In Annual Conference on Medical Image Understanding and Analysis, pages 46-66 46-61,22 2022.
[34] Robert Geirhos, Carlos RM Temme, Jonas Rauber, Heiko H Schütt, Matthias Bethge, and Felix A Wichmann. Generalisation in humans and deep neural networks. Advances in Neural Information Processing Systems, 31, 2018.
[35] Robert Geirhos, Kantharaju Narayanappa, Benjamin Mitzkus, Tizian Thieringer, Matthias Bethge, Felix A Wichmann, and Wieland Brendel. Partial success in closing the gap between human and machine vision. Advances in Neural Information Processing Systems, 34:23885- 23899, 2021.
[36] Lukas Muttenthaler, Jonas Dippel, Lorenz Linhardt, Robert A. Vandermeulen, and Simon Kornblith. Human alignment of neural network representations. In International Conference on Learning Representations, 2023.
[37] Tiange Luo, Tianle Cai, Mengxiao Zhang, Siyu Chen, Di He, and Liwei Wang. Defective Convolutional Networks. arXiv preprint 1rXiv:1911.08443 2019. _eprint: 1911.08432.
[38] Carlo Tomasi and Roberto Manduchi. Bilateral filtering for gray and color images. In Interna- tional Conference on Computer Vision, pages 839-846. IEEE, 1998.
12

---

[39] Robert M Haralick, Karthikeyan Shanmugam, and Its' Hak Dinstein. Textural features for image classification. IEEE Transactions on Systems, Man, and Cybernetics, 00:610-621, 1973.
[40] Rafael C Gonzales and Paul Wintz. Digital image processing. Aadison-Wesley Longman Publishing Co., Inc., 1987.
[41] Zhou Wang, Alan C Bovik, Hamid R Sheikh, and Eero Simoncelli. Image quality assessment: from error visibility to structural similarity. IEEE Transactions on Image Processing, 13(4): 600-612, 2004, Publisher: IEEE.
[42] Antoni Buades, Bartomeu Coll, and J-M Morel. A non-local algorithm for image denoising. In IEEE Computer Society Conference on Computer Vision and Pattern Recognition, volume pages 60 60-65,200 2005.
[43] Thomas Huang, GJTGY Yang, and Greory Tang. A fast two-dimensional median filtering algorithm. IEEE transactions on Acoustics, Speech, and Signal Processing, 27(1):13-18, 1979.
[44] George A Miller. WordNet: lexical database for English. Communications of the ACM, 38 (11):39-4) 41, 1995.
[45] Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 248-255, 2009.
[46] Ross Wightman, Hugo Touvron, and Herve Jegou. ResNet strikes back: An improved training procedure in timm. Advances in Neural Information Processing Systems Workshop, 2021.
[47] Andrew Howard, Mark Sandler, Grace Chu, Liang-Chich Chen, Bo Chen, Mingxing Tan, Weijun Wang. Yukun Zhu, Ruoming Pang, Vijay Vasudevan, and others. Searching for mobilenetv3. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 1314-1324, 2019.
[48] Mingxing Tan and Quoe Le. Efficientnetv2: Smaller models and faster training. In International Conference Machine Learning, pages 10096-10106, 2021.
[49] Asher Troekman and J. Zico Kolter. Patches Are All You Need? Transactions on Machine Learning Research, 2023. ISSN 2835-8856.
[50] Sanghyun Woo, Shoubhik Debnath, Ronghang Hu, Xinlei Chen, Zhuang Liu, In So Kweon, and Saining Xie. Convnext v2: Co-designing and scaling convnets with masked autoencoders. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 16133-16142, 2023.
[51] Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image is worth 16x16 words: Transformers for image recognition at scale. In International Conference on Learning Representations, 2021.
[52] Hugo Touvron, Matthieu Cord, Matthijs Douze, Francisco Massa, Alexandre Sablayrolles, and Hervé Jégou. Training data-efficient image transformers & distillation through attention. In International Conference Machine Learning, pages 10347-10357, 2021.
[53] Ze Liu, Yutong Lin, Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang, Stephen Lin, and Baining Guo. Swin Transformer: Hierarchical Vision Transformer Using Shifted Windows. In Proceedings of the IEEE/CVF International Conference on Computer Vision. pages 10012-10022, 2021.
[54] Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, and others. Learning transferable visual models from natural language supervision. In International Conference on Machine Learning, pages 8748 8763, 2021.
[55] Ross Wightman. PyTorch Image Models, 2019. URL htRll.ttts:///ttii htattp:://gitaaa..om/////////// pytorch- ince--imaee--ae models Publication Title: GitHub repository.
13

---

[56] Li Fei-Fei, R. Fergus, and P. Perona. Learning Generative Visual Models from Few Training Examples: An Incremental Bayesian Approach Tested on 101 Object Categories, In Conference on Computer Vision and Pattern Recognition Workshop, pages 178-178, 2004.
[57] Maria-Elena Nilsback and Andrew Zisserman. Automated flower classification over large number of classes. In Indian Conference on Computer Vision, Graphics & Image Processing, pages 722-729. IEEE, 2008.
[58] Omkar M Parkhi, Andrea Vedaldi, Andrew Zisserman, and CV Jawahar. Cats and dogs. In IEEE Conference on Computer Vision and Pattern Recognition, pages 3498-3505, 2012.
[59] Adam Coates, Andrew Ng, and Honglak Lee. An analysis of single-layer networks in unsuper- vised feature learning. In Proceedings of the International Conference on Artificial Intelligence and Statistics, pages 215-223 JMLR Workshop and Conference Proceedings, 2011.
[60] Jiancheng Yang. Rui Shi, Donglai Wei, Zequan Liu, Lin Zhao, Bilian Ke, Hanspeter Pfister, and Bingbing Ni. MedMNIST v2-A large-scale lightweight benchmark for 2D and 3D biomedical image classification. Scientific Data, 10(1):41, 2023. Publisher: Nature Publishing Group UK London.
[61] Yi Yang and Shawn Newsam. Bag-of-visual-worts and spatial extensions for land-use clas- sification. In Proceedings of the 18th SIGSPATIAL International Conference on Advances in Geographic Information Systems, pages 270-279, 2010.
[62] Yang Long, Yiping Gong, Zhifeng Xiao, and Qing Liu. Accurate object localization in remote sensing images based on convolutional neural networks. IEEE Transactions on Geoscience and Remote Sensing, (585))248--2498 2017.
[63] llke Demir, Krzysztof Koperski, David Lindenbaum, Guan Pang. Jing Huang, Saikat Basu, Forest Hughes, Devis Tuia, and Ramesh Raskar. Deepglobe 2018: challenge to parse the earth through satellite images. In Proceedings of the IEFE Conference on Computer Vision and Puttern Recognition Workshops, pages 172-181, 2018
[64] Weixun Zhou, Shawn Newsam, Congmin Li, and Zhenfeng Shao. PatternNet: A benchmark dataset for performance evaluation of remote sensing image retrieval. ISPRS Journal of Photogrammetry and Remote Sensing, 145:197-209, 2018
[65] Gui-Song Xia, Jingwen Hu, Fan Hu, Baoguang Shi. Xiang Bai, Yanfei Zhong, Liangpei Zhang, and Xiaoqiang Lu. AID: A benchmark data set for performance evaluation of aerial scene classification. IEEE Transactions on Geoscience and Remote Sensing, 55(7):3965- -9805,---91--10 2017.
[66] Pauli Virtanen, Ralf Gommers, Travis E. Oliphant, Matt Haberland, Tyler Reddy, David Couraaeeau, Evgeni Burovski, Pearu Peterson, Warren Weckesser, Jonathan Bright, Stéfan J. van der Walt, Matthew Brett, Joshua Wilson, K. Jarrod Millman, Nikolay Mayorov, Andrew R. J. Nelson, Eric Jones, Robert Kern, Eric Larson, C Carey, ilhan Polat, Yu Feng, Eric W. Moore, Jake VanderPlas, Denis Laxalde, Josef Perktold, Robert Cimrman, Ian Henriksen, F. A. Quintero, Charles R. Harris, Anne M. Archibald, Antônio Ribeiro, Fabian Pedregosa, Paul Mulbregt, and SciPy 1.0 Contributors. SciPy 1.0: Fundamental Algorithms for Scientific Computing in Python. Nature Methods, 17:261-272, 2020.
14

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes].
The introduction and abstract clearly state the paper's core contributions: critical re-evaluation of the cue-conflict protocol, the introduction of a suppression-bas framework for assessing feature reliance, the empirical comparison of human and model reliance, and further analysis across different visual domains. These claims are directly supported by the theoretical arguments in Section Section 4 and the empirical findings in Section
Justification:
B the methodological framework in
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine include aspirational goals as motivation long is clear that these goals are not attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes].
The paper includes a dedicated paragraph for limitations at the end of the conclusion (Section G which acknowledges several key constraints. Specifically, it discusses the imperfect isolation of visual features due to their interdependent nature, potential artifacts introduced by suppression transformations (e.g., block structures smoothing effects), and the constrained generalizability of the human study due to a controlled forced-choice setup with a limited category set and brief stimulus exposure.
Justification:
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section in their paper.
The paper should point any strong assumptions and how robust the results are to violations of these assumptions (e.g.. independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested few datasets with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they seale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimess.
15

---

While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?
Answer: [NA].
Justification:
The paper does not include theoretical results.
Guidelines:
The answer NA means that the paper does not include theoretical results,
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that affects the main claims and/or conclusions of the paper (regardless whether the code and data are provided or not)?
Question:
Answer: [Yes].
Justification: The paper provides sufficient methodological detail reproduce the main experimental results. It specifies all datasets used (e.g.. ImageNet1 MedMNIST, RS benchmarks), feature suppression transformations with hyperparameters (e.g.. Patch Shuffle grid sizes, bilateral filter settings), model architectures (including training recipes and pretrained sources), and evaluation procedures for both human and model experiments. For the human study, participant design, timing protocols, category sets, and interface descriptions are clearly outlined. Additional implementation details, ablations, and visual examples are provided in the supplemental material. Together, these descriptions enable reproduction of the core results and validation of the paper's main claims. Upon acceptance, our code will be made publicly available.e containing the necessary scripts or CLI commands to reproduce the experiments. Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
16

---

While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily new algorithm, the paper should make it clear how to reproduce that algorithm. (b) the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is new model (e.g.. a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility. the case of closed-source models, may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers have some path reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes].
Justification: Upon acceptance, our code will be made publicly available, which contains the full implementation of the proposed suppression-based evaluation framework, scripts for reproducing all key experiments, and instructions for environment setup and execution. The code also contains the tool for the human study interface. All datasets used are publicly available, and instructions for accessing them are provided.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips cc/
Sublic/guides httee//uiieee/eeeubiieeeeeeeeeee
for more details.
While we encourage the release of code and data, we understand that this might be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https
//nip. http://pwwcccgguude///ee/eeeeeee SoodeSuummmomSmmmmamoa ss ssionoolicy) for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing much information possible in supplemental material (appended to the paper) recommended, but including URLs to data and code is permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes].
The paper provides all essential training and test details necessary to under- stand the experimental results. It describes dataset preprocessing, suppression methods with fixed parameters, and evaluation protocols. For model experiments, distinguishes
Justification:
17

---

between models trained from scratch and those finetuned from pretrained checkpoints (e.g., from timm), and explicitly describes the timm training augmentations, optimizers. and archifecture-speccffi configurations. Details such as how suppression conditions were balanced across human participants and models are given in the main text, while additional hyperparameter settings and ablations are included in the supplemental material.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, or as supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [Yes].
Justification: For the human vs. CNN comparison (Figure Table statistical significance is assessed using paired t-tests between human and model performance under each suppres- sion condition and is presented in the supplemental material. For the domain comparison experiments (Figure 5 I-sigma error bars are reported across datasets within each domain reflect inter-datase variability in suppression sensitivity.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
It should be clear whether the error bar is the standard deviation or the standard error of the mean.
OK to report 1-sigma error bars, but one should state The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that out of range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes].
Justification: We dedicated section in the supplemental material to hardware specifications, memory and runtime.
Guidelines:
The answer NA means that the paper does include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
18

---

The paper should provide the amount of compute required for each of the individual experimental runs as well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurlPS Code of Ethics
Answer: [Yes].
Justification: The research adheres to the NeurlPS Code Ethics. All datasets used are publicly available. The human study was conducted in accordance with institutional ethical guidelines. All participants provided informed consent prior to participation. The experiments do not involve sensitive data, privacy risks, unfair bias against individuals or groups. Results are reported transparently, with limitations and assumptions clearly stated.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics. If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g.. there special consid- eration due to laws or regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [NA].
Justification: The paper presents foundational research on evaluating feature reliance in image classifiers through controlled suppression. It does not introduce application-spea speciifc systems deployment scenarios that would entail direct societal impact.
Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No. they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious unintended uses (e.g.. disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional unintentional) misuse of the technology.
If there negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms monitor how system learns from feedback over time, improving the efficiency and accessibility ML).
11. Safeguards
Question: Does the paper describe safeguards that have been put in place for responsible release of data models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
19

---

Answer: [NA].
Justification: The paper does not release any new models or datasets with high risk of misuse. All experiments are conducted using publicly available models (e-g., from timm) and datasets that are standard in the community and pose no known safety concerns. The feature suppression framework evaluation-focused and not inherently dual-use.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model. for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes].
Justification: All datasets used this work are publicly available and distributed under open licenses. All software packages, models, and datasets used properly cited in the paper with references to their original sources and licenses where applicable.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset used and, if possible, include URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (c.g., website). the copyright and terms of service of that source should be provided.
If assets released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, wwwppsswithhheoooccoppap thcode. com/ datasets has curated licenses for some datasets. Their licensing guide can help determine the license dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if has changed) should be provided.
If this information is not available online, the authors are encouraged to reach out to the asset's creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes].
Justification: The paper introduces a new evaluation framework based on targeted feature suppression and provides accompanying code and configuration files for reproducibility. The supplemental material includes the usage instructions, dataset preprocessing steps, transformation parameters, and experiment scripts. No new datasets or models are released, and all components are based on existing, publicly available assets.
Guidelines:
The answer NA means that the paper does not release new assets.
20

---

Researchers should communicate the details of the dataset/codeemmodel as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [Yes].
Justification: The paper includes a detailed description of the experimental procedure for the human study in the main text and provides the full participant instructions and interface screenshots in the suppiemental material. Participants were volunteers and were not financially compensated. The study followed institutional ethical guidelines, and informed consent was obtained from all participants.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Question:
Answer: [Yes].
Justification: A detailed description of the risk assessment and consent procedures is provided in the supplemental material. The study involved low-risk visual classification task with adult participants, with no foreseeable harm. All participants were volunteers and provided informed consent. The study followed the ethical protocols of our institution and adhered to all relevant institutional guidelines. A review was conducted in accordance with our institution's standard ethics procedures, and no ethical concerns were identified.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Question: Does the paper describe the usage of LLMSs if is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used
21

---

only for writing, editing, or formatting purposes and does not impact the core methodology. scientific rigorousness, or originality of the research, declaration is required.
Answer: [NA].
Justification: The core method development in this research does not involve LLMs as any important, original, or non-standard components.
Guidelines:
The answer NA means that the method development in this research does not involve LLMs as any important, original, or non-standard components.
Please refer to our LLM policy ttttp::/neeurps..oo http:://reariigsccoooooerrreeeep / for what should or should be described.
22


Reviews:
[{"review_id": "Ttl0JlHYBF", "reviewer": "Reviewer_CRhF", "summary": "The authors argue that the texture bias results (Geirhos et al.) are based upon the cue-conflict experimental framework with major limitations, e.g. texture feature often containing local shape structures, overloaded texture signals compared to shape signals, biased UI for experimentation. They introduced a suppression-based framework that disentangles texture, shape, and color better, with suppression strength validated by metrics. They then measured the human and model performance while suppressing global/local shape, texture and color and found that CNNs mainly rely on local shape. In addition, the reliance patterns differ across computer vision, medical image and remote sensing domains.", "questions": "Questions:\n- Please report more statistics on human study that reflects variations in the data, e.g. CI, noise ceiling. 20 subjects are low; compute a post-hoc power estimate.\n- Artifacts of block edges when using patch shuffle. Would models be strongly influenced by these artifacts in the images? Please design a control for artifacts", "limitations": "N/A", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strength\n- Quality\n    - Convincing method critique of the cue-conflict experiment (which doesn’t control variables)\n    - Nice suppression-based design with clear metrics on validating suppression\n    - Extensive experimentation with many model architectures and domains\n- Clarity: very well-written\n- Originality: the critique and the new framework is novel\n- significance: directly challenges a highly-cited claims with a more precise claim of what exactly models rely on\n\nWeaknesses:\n- It might be more interesting if you can plot the ROC curve as a function of the hyper parameters for feature suppression - however, I understand that you fixed the hyper parameters in order to make sure the suppression is high for one cue but not the other. It will be great to clarify\n- It would be more convincing to train models on cue-suppressed images and test on full-cue images. This would resemble an ablation study", "was_revised": true, "final_justification": "The paper is technically solid. The authors' rebuttal addressed all my concerns. I also believe the work shows an impactful result that directly challenges a widely cited result.", "rebuttal": "We thank the reviewer for their careful reading, constructive critique, and detailed suggestions. We appreciate the recognition of our contributions and are grateful for the opportunity to clarify key aspects of the paper and further strengthen our claims. Below, we address each point raised in detail.\n\n**Plotting the ROC curve as a function of the hyper parameters for feature suppression:**\nWe thank the reviewer for raising the point about a more in-depth ablation studying the effects of hyperparameter strength. We were not entirely certain what was meant by the reference to a “ROC curve,” but we considered two possible interpretations. (i) If the comment referred to a more detailed quantitative validation of suppression effects under different suppression strengths, we would like to highlight Figure 8 in the supplemental material, which provides a hyperparameter ablation across several texture suppression techniques using high-frequency energy (HFE) for texture suppression and gradient correlation (GC) for shape preservation. This analysis supported the fixed settings used in the main paper (4.1, Table 2). (ii) Alternatively, if the reviewer referred to how model performance degrades with increasing suppression strength, we note that such an analysis is included in Figure 4, where we vary the suppression strength (e.g., kernel size, σ) for the domain-level comparison experiment. Due to resource constraints, this could not be replicated for the human study, where we selected a single validated suppression strength per feature type. If none of the two interpretations matched the intended concern, we would be happy to provide any additional analysis the reviewer finds relevant.\n\n**Ablation study training on cue-suppressed images and testing on full-cue images:**\nWe thank the reviewer for this thought-provoking suggestion. We spent considerable time reflecting on its implications within our team and conducted the requested experiments across all four vision datasets for which quick retraining was feasible (Caltech101, Flowers102, OxfordIIITPet, STL10).\n\nUpon deeper consideration, we realized that this setup (i.e., training exclusively on cue-suppressed images and evaluating on full-cue images) raises a conceptual distinction that is somewhat orthogonal to the main aim of our study. Our framework is designed to investigate what models rely on after training, not what they need during training to generalize. The proposed ablation study targets the latter: removing a feature type during learning and asking whether generalization to full-cue data still occurs. In contrast, our suppression-based evaluation probes which cues are functionally relevant to models that have already converged to a fit on the original distribution. These are distinct questions: learning without access to a particular feature type likely impairs generalization capacity, but this does not necessarily inform which features the model will rely on once generalization is achieved.\n\nNevertheless, to empirically assess this contrast, we trained ResNet-50 models from scratch following the same protocol as in Experiment 5.2 with the only difference that the training augmentation pipeline consistently applied one of the four suppression transformations (global shape, local shape, texture, color) with a probability of 1.0. This ensured that the respective visual cue was entirely absent during training. We then evaluated the models on full-cue images. All models trained under suppression exhibited substantially reduced performance. This suggests that withholding a specific cue during training hinders the model’s ability to develop robust internal representations that generalize to the full distribution.\n\n| Dataset    | No Global Shape | No Local Shape | No Texture | No Color | All cues |\n|------------|----------------------------|----------------------------|------------------------|----------------------|---------------------|\n| Caltech101 | 0.0851                     | 0.0790                     | 0.0838                 | 0.0524               | 0.7972              |\n| OxfordIIPet | 0.1179                    | 0.1102                    | 0.1089      | 0.1088.          | 0.6214              |\n| Flowers102 | 0.2951                     | 0.2863                     | 0.2657                 | 0.1118               | 0.5186              |\n| STL10      | 0.4300                     | 0.4040                     | 0.3760                 | 0.3860               | 0.7800              |\n\nA technical note: For the color-suppression setting, observed that normalization statistics are tightly tied to the training distribution. We therefore recomputed mean and standard deviation values for grayscale images and used them consistently in both training and testing. The grayscale-trained models were evaluated on grayscale test images to avoid distribution mismatch.\n\n**More statistics to support results: CI, noise ceiling and post-hoc power estimate:**\nWe acknowledge that the sample size in the human study (n = 20) is limited, reflecting practical constraints during data collection. We agree that careful statistical treatment is essential in such settings and thank the reviewer for the concrete suggestions.\n\nIn response, we have expanded the statistical analysis as follows:\n\n- We computed 95% confidence intervals for human performance, model performance, and their differences (see Table below).\n- We estimated the noise ceiling to assess inter-subject and inter-model consistency. The item-wise human noise ceiling was 0.542 ± 0.055, and the model noise ceiling was 0.646 ± 0.015. \n- We conducted a post-hoc power analysis to enrich the t-test results in the supplemental material (updated Table visualized in this response). Despite the small sample size, the observed effect sizes are large, resulting in maximal statistical power in all conditions.\n\n| Feature Suppression | Human Accuracy (CI)     | ResNet Accuracy (CI)    | Difference (Human - ResNet, CI) |\n|---------------------|-------------------------|--------------------------|----------------------------------|\n| Global Shape        | 0.965 (±0.0067)         | 0.832 (±0.0102)          | 0.133 (±0.0121)                  |\n| Local Shape         | 0.763 (±0.0092)         | 0.276 (±0.0141)          | 0.487 (±0.0168)                  |\n| Texture             | 0.979 (±0.0064)         | 0.795 (±0.0073)          | 0.184 (±0.0097)                  |\n| Color               | 0.999 (±0.0052)         | 0.924 (±0.0035)          | 0.075 (±0.0063)                  |\n\n| Suppression Type       | t-value | p-value | Cohen's d | Power  |\n|------------------------|--------:|--------:|----------:|-------:|\n| Global Shape           |  24.762 |  0.0001 |     12.38 | 1.0000 |\n| Local Shape            |  48.157 |  0.0000 |     24.08 | 1.0000 |\n| Texture                |  79.651 |  0.0000 |     39.83 | 1.0000 |\n| Color                  |  17.382 |  0.0004 |      8.69 | 1.0000 |\n\n\nWe will enrich the statistical results in the supplemental material accordingly by including these extended analyses.\n\n**Artifacts of block edges when using patch shuffle and design of control:**\nWe agree that disentangling the effects of block-edge artifacts from the intended suppression of local shape continuity is nontrivial. To the best of our knowledge, there is no perfect way to isolate the influence of block structures without also introducing some level of micro distortion to the image’s shape features.\n\nNevertheless, to probe this question more carefully, we designed a control experiment aimed at partially disentangling these two factors. For grid sizes 2, 4, and 8, we constructed a variant of the PatchShuffle condition in which we superimpose only the 2-pixel-wide block boundaries (1 pixel on either side) onto the original image, preserving the spatial layout of all underlying content. This overlay mimics the grid structure introduced by PatchShuffle but does not shuffle any patches. The images with grid overlay are generated by applying patch shuffle to an image, extracting the 2-pixel wide grid of block structure and pasting it onto a copy of the original image. \n\nWe emphasize that even this overlay condition introduces brief shape discontinuities, as the superimposed grid lines may slightly interrupt edge continuity at the boundaries. As such, the overlay condition still jointly reflects two effects: (i) the presence of artificial block edges, and (ii) minor local shape disruption. Nonetheless, the stronger degradation observed under PatchShuffle suggests that major performance drops are not driven solely by block artifacts, but by the combined disruption of local spatial structure.\n\nWe will include both the visual examples of this control condition and the corresponding quantitative results in the supplemental material of the revised version. The results for three representative models are shown below:\n| Model            | Grid Size | PatchShuffle Overlay | PatchShuffle |\n|------------------|-----------|-----------------------|--------------|\n| **ResNet50-standard** | 2         | 0.950                 | 0.921        |\n|                  | 4         | 0.809                 | 0.548        |\n|                  | 8         | 0.540                 | 0.069        |\n|        |       |       |           |\n| **ResNet50-sota**     | 2         | 0.983                 | 0.980        |\n|                  | 4         | 0.870                 | 0.837        |\n|                  | 8         | 0.554                 | 0.344        |\n|        |       |       |           |\n| **ConvNeXtV2**        | 2         | 0.991                 | 0.983        |\n|                  | 4         | 0.957                 | 0.859        |\n|                  | 8         | 0.911                 | 0.347        |\n\nWe hope this analysis addresses the reviewer’s concerns, and we remain open to further suggestions if additional clarification or controls are desired."}, {"review_id": "o1gQ8FufFX", "reviewer": "Reviewer_hYxc", "summary": "This paper challenges the experimental designs and conclusions of Geirhos et al.’s cue-conflict experiment. Instead of doing cue-conflict experiments using style transfer, the paper proposes to use controlled suppression, and measure performance degradation of pre-trained vision models vs. human to understand the bias of models. The paper finds that the CNNs are not inherently biased towards texture, but rather, more biased towards local shape. Additionally, the paper suggests that the domain the models are trained on can also impact the dependence on various features.", "questions": "In general, I'm curious to know if the suppression operations can be done by off-the-shelf deep networks, and whether they are better candidates for doing suppressions.\n1. Can segmentation models be used for \"texture suppression\" by replacing the objects with masks, and making the color of each mask the average pixel values of the original region?\n2. Can advanced image editing tools be used for perturbing object shapes while keeping textures intact?", "limitations": "The limitations are adequately addressed by the authors.", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strength:\n1. The idea of the paper is well-motivated, the authors start from the limitations of the Geirhos et al. and propose a new experimental setup to account for the limitations. The paper brings a new perspective that challenges the previously held ideas.\n2. The experimental design is convincing, with sufficient details provided.\n3. The paper is very well written, it was a pleasant read.\n\nI'm not aware of any pronounced weakness.", "was_revised": true, "final_justification": "I agree with the authors that the suggestions may be more suitable for future work, and I keep my positive score.", "rebuttal": "We are pleased that the motivation and design of our framework were clear and well received. Below, we address the reviewer’s suggestions regarding potential alternative suppression methods.\n\n**On using off-the-shelf networks for suppression (e.g., segmentation + region masking):**\nThis is an insightful suggestion. Using pre-trained segmentation networks to identify object regions and replace them with uniform patches (e.g., mean color) could serve as a structured and potentially stronger form of texture suppression that avoids the risk of destructing edges, especially in the context of natural images. This approach would reduce reliance on manually parameterized transformations and may allow for finer control over suppression granularity. However, it depends on reliable segmentation, which may not generalize well across domains such as remote sensing or medical imaging, where segmentation may be less reliable and object structure less clearly defined. On the other hand, many datasets in CV have panoptic segmentation masks (e.g., COCO), which could be also used for a follow up work. We will note it explicitly as a potential extension in future work.\n\n**On using advanced editing tools for shape suppression while preserving texture:**\nWe agree that tools from image editing or generation, such as warping or shape-specific inpainting, may offer targeted shape perturbation while avoiding the block-structured artefacts that arise when using Patch Shuffle. Our current framework employs interpretable, model-free transformations chosen to minimize domain-specific artifacts and avoid the complexities introduced by generative or network-based editing tools. However, with ongoing advances in controllable image synthesis, this line of investigation is increasingly viable and we consider it a valuable direction for future refinement of the framework.\n\n**Future work direction:**\nTo reflect the reviewer’s suggestions, we will expand the conclusion section to mention segmentation-based and generation-based suppression strategies as promising extensions to increase the precision and applicability of our framework (starting from L320)."}, {"review_id": "w1UXwQh7Wv", "reviewer": "Reviewer_mrhF", "summary": "The paper revisits the \"texture bias\" hypothesis introduced by Geirhos et al. CNNs preferentially rely on texture over shape. The authors argue that the classic cue‐conflict evaluation (combining one class's shape with another's texture via neural style transfer) conflates salience with reliance and entangles multiple features. To address these limitations, they propose a domain-agnostic suppression framework: for each feature class (shape, texture, colour), two targeted image transformations systematically suppress that feature while preserving others. They validate these transformations quantitatively.\n\nUsing this framework, they conduct two large‐scale experimental studies:\n\n1. Human vs. CNN feature reliance on the ImageNet16 dataset (50 images × 16 classes), comparing human observers to a range of CNNs (ResNets, EfficientNets, ConvNeXts) and transformers (ViT, Swin, CLIP-ViT). They show that (a) all models—including humans—are most vulnerable to local shape suppression, not texture; (b) modern training recipes and vision-language supervision mitigate this reliance; and (c) CNNs are not inherently texture-biased.\n\n2. Cross-domain analysis on computer-vision (ImageNet, Flowers, Pets, etc.), medical imaging (MedMNIST-v2), and remote-sensing (UCMerced, DeepGlobe, etc.). They find that CV models prioritise shape, MI models lean on colour, and RS models depend heavily on texture.\n\nOverall, the paper challenges a prevailing narrative, presents a clear empirical protocol, and sheds light on how feature reliance varies across different architectures, training strategies, and domains.", "questions": "- **Thresholding rationale (line 206):** Why choose a 0.5 softmax threshold for correctness? How do results differ if you use argmax instead?\n\n- **Visualisations for MI and RS samples:** You include two ImageNet examples of suppressed images; please provide analogous visualisations for all medical imaging and remote sensing datasets as well. They need not match the scale of the ImageNet figures but should illustrate key transformations in those domains.\n\n- **Attribution to earlier work for the patch-shuffle idea for analysing shape bias** The patch‐shuffle technique used to disrupt shape traces back to earlier work [1], which further cites [2] for the idea. The current manuscript lacks explicit attribution to either papers or any other prior work that first introduced the use of the patch-shuffle idea for shape analysis.\n\n- **Effect of patch rotation:** How much effect does patch rotation have on suppressing shape? How much do results vary if you shuffle the patches but do not rotate them? My guess would be that patch rotation has a larger effect when the grid size is small (3x3) but a smaller effect when it's large (6x6).\n\n**[1]** Mummadi, Chaithanya Kumar, et al. \"Does enhanced shape bias improve neural network robustness to common corruptions?.\" arXiv preprint arXiv:2104.09789 (2021).\n\n**[2]** Luo, Tiange, et al. \"Defective Convolutional Networks.\" arXiv preprint arXiv:1911.08432 (2019).", "limitations": "yes", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 4, "significance": 4, "originality": 4, "strengths_and_weaknesses": "### **Strengths:**\n- **Novelty of protocol:** The proposed protocol of targeted feature suppression yields a more direct and generalizable measure of reliance than the shape-cue conflict protocol.\n\n- Human evaluation is used as a baseline, and comparisons are made with various CNN and transformer architectures.\n\n- Analysis extends beyond natural images to medical imaging and remote sensing, revealing domain-specific reliance patterns.\n\n- **Clarity of writing and organisation:** The paper is well–structured and easy to read. It has clear figures, tables, and supplemental material.\n\n### **Weaknesses:**\n- **Unrealistic training setup in specialised domains:** The authors train ResNet-50 from scratch on Medical Imaging and Remote Sensing datasets to “reflect realistic usage in specialised domains” (lines 250–251). However, in histopathology (e.g., PathMNIST), researchers almost invariably initialise CNNs with ImageNet-pretrained weights. In Multiple Instance Learning (MIL), practitioners typically use a frozen ResNet-50 (initialised with ImageNet weights) to extract embeddings. Moreover, realistic workflows employ not only geometric augmentations but also photometric variants (e.g., ColorJitter), which can reduce colour bias. While it's common to not use any data augmentation when using a frozen backbone in MIL (mostly to save GPU memory), other setups do apply it. From what I could find, it is generally common to fine-tune ImageNet-pretrained models with extensive data augmentation in both MI and RS domains; thus, experimenting under that paradigm would be better.\n\n- **Lack of class-wise analysis in Experiment II:** For the experiments in Experiment II, especially ImageNet-1K, a more fine-grained, per-class evaluation (or reporting the proportion of classes supporting the hypothesis of reliance on local shape over texture) would clarify whether this effect holds uniformly across all categories or only emerges in a subset.", "was_revised": true, "final_justification": "I commend the authors on their thorough rebuttal and the additional experiments, which satisfactorily address all of my initial concerns and fully clarify the questions I raised. Moreover, having reviewed the other reviewers’ comments, I find no outstanding issues or unresolved critiques. Consequently, I am confident that the manuscript now meets all expectations, and I hereby raise my score to 6.", "rebuttal": "We thank the reviewer for their detailed and insightful comments. Below, we provide a point-by-point response addressing all raised questions and suggestions.\n\n**Unrealistic training setup in specialised domains:**\nWe thank the reviewer for this valuable clarification. We agree that our phrasing regarding “realistic usage in specialized domains” (L250–251) was too strong. Our primary motivation for training from scratch in medical imaging (MI) and remote sensing (RS) was to allow a disentangled comparison across domains, avoiding potential reliance profiles introduced by ImageNet pretraining. However, we fully acknowledge that in many operational workflows, practitioners in both domains often initialize from ImageNet-pretrained backbones, especially in histopathology (e.g., PathMNIST) or MIL settings. Hence, we will revise the mentioned section to “For MI and RS, we train from scratch to allow a disentangled comparison across domains. Additional results for MI and RS with pre-trained models to simulate operational scenarios can be found in the supplemental material”.\n\nTo address this point, we followed the reviewer’s suggestion and repeated the domain-specific suppression experiments with ImageNet-pretrained ResNet-50 backbones for both domains. The setup and suppression protocols follow those of Figure 4 in the main paper. As a proxy for the new plots that we will integrate into the final version, the following three tables report accuracy degradation under increasing suppression strength for shape, texture, and color suppression, respectively. Each table compares performance for models trained from scratch (first value in each cell) versus pretrained ImageNet weights fine-tuned on the datasets (second value in each cell). The overall reliance patterns remain broadly consistent. However, as observed in the CV domain, ImageNet pretraining tends to subtly increase shape reliance and decrease reliance on texture and color in RS (e.g., up to 7% stronger shape reliance, up to 20% less texture/color reliance). In MI, pretraining yields mixed effects: for BloodMNIST it increases shape reliance under strong suppression (e.g., by 20% for grid-size 8), whereas for PathMNIST it amplifies sensitivity to texture suppression. This reinforces the importance of considering both training paradigms when analyzing feature reliance, and we will ensure that this is clearly reflected in the revised manuscript.\n\n**Shape Suppression**\n\n| Dataset      | 2           | 4           | 6           | 8           | 10          | \n|--------------|-------------|-------------|-------------|-------------|-------------|\n| PatternNet   | 0.99 / 0.99 | 0.94 / 0.93 | 0.85 / 0.83 | 0.73 / 0.69 | 0.64 / 0.58 |\n| AID          | 0.91 / 0.95 | 0.78 / 0.79 | 0.67 / 0.66 | 0.57 / 0.52 | 0.50 / 0.43 | \n|          |          |          |          |          |          |\n| BloodMNIST   | 0.88 / 0.93 | 0.67 / 0.83 | 0.56 / 0.65 | 0.47 / 0.26 | 0.42 / 0.04 |\n| PathMNIST    | 0.99 / 1.00 | 0.96 / 0.98 | 0.93 / 0.95 | 0.87 / 0.91 | 0.81 / 0.86 |\n\n**Texture Suppression**\n\n| Dataset      | 4           | 6           | 8           | 10          | 12          |\n|--------------|-------------|-------------|-------------|-------------|-------------|\n| PatternNet   | 0.99 / 0.99 | 0.88 / 0.92 | 0.74 / 0.80 | 0.57 / 0.69 | 0.46 / 0.58 | \n| AID          | 0.94 / 0.96 | 0.82 / 0.90 | 0.68 / 0.82 | 0.56 / 0.69 | 0.47 / 0.58 | \n|          |          |          |          |          |          |\n| BloodMNIST   | 1.00 / 0.95 | 0.98 / 0.83 | 0.92 / 0.73 | 0.81 / 0.61 | 0.73 / 0.52 | \n| PathMNIST    | 1.00 / 1.00 | 0.99 / 0.94 | 0.89 / 0.82 | 0.81 / 0.74 | 0.75 / 0.70 |\n\n**Color Suppression**\n\n| Dataset      | 0.2         | 0.4         | 0.6         | 0.8         | 1.0         |\n|--------------|-------------|-------------|-------------|-------------|-------------|\n| PatternNet   | 1.00 / 1.00 | 0.98 / 0.99 | 0.85 / 0.90 | 0.64 / 0.66 | 0.52 / 0.53 |\n| AID          | 1.00 / 1.00 | 0.97 / 0.99 | 0.86 / 0.94 | 0.71 / 0.82 | 0.58 / 0.73 |\n|          |          |          |          |          |          |            |\n| BloodMNIST   | 0.56 / 0.70 | 0.08 / 0.23 | 0.00 / 0.00 | 0.00 / 0.00 | 0.00 / 0.00 |\n| PathMNIST    | 0.26 / 0.94 | 0.00 / 0.82 | 0.00 / 0.49 | 0.01 / 0.30 | 0.10 / 0.21 |\n\n**Class-wise analysis for ImageNet in Experiment II:**\nWe thank the reviewer for this valuable suggestion. We have now conducted this analysis to examine whether the observed feature reliance patterns in Experiment II (specifically on ImageNet-1K) generalize across classes or are driven by a subset.\n\nTo this end, we evaluated class-wise performance under local shape suppression (patch-shuffle, grid size 6), texture suppression (bilateral filter, kernel size 12) and color suppression. We computed the relative accuracy for each of the 1,000 ImageNet classes under the suppression conditions and visualized the distributions using kernel density estimates (KDEs). The class-level distributions confirm the global trend: the KDE for texture-suppressed scores is clearly shifted toward higher values (mean = 0.62) than that for local-shape-suppressed scores (mean = 0.24), with only modest overlap between the two distributions (approximately 25–30%).\n\nTo quantify class consistency, we computed the proportion of classes for which the relative feature importance followed the global pattern. We find:\n- 88.0% of classes exhibit greater local shape than texture reliance\n- 94.2% exhibit greater local shape than color reliance\n- 77.6% exhibit greater texture than color reliance\n\nThis supports that the effect is not limited to a few outlier categories but holds broadly across the dataset.\n\nTo complement the quantitative analysis, we also identified representative outlier classes. Classes where the model exhibits unusually low reliance on local shape include corn, Appenzeller (cheese), bookstall, spider's web, zebra, guacamole, and stone wall. Classes with unusually strong texture reliance include Chesapeake Bay retriever, Crotalus cerastes, stingray, bath towel, Alligator mississippiensis, and bolete. For color reliance, outliers include sunglass, tank suit, ladle, coffeepot, chain, and tam-tam.\n\nWe will include the KDE plot and the results of this class-wise analysis in the final version to provide a more granular understanding of per-class feature reliance.\n\n**Thresholding rationale (line 206):**\nIn our main experiments, we applied a 0.5 softmax threshold to determine correctness. This was chosen heuristically to ensure that predictions reflect not only the top class but also a minimal level of confidence, particularly under suppression. We acknowledge that this introduces an implicit confidence calibration assumption. \n\nTo assess the sensitivity of our results to this threshold, we re-computed the scores using a plain argmax decision rule, which always selects the top-scoring class regardless of confidence. As expected, absolute accuracies are slightly higher under argmax, but the relative pattern of degradation across suppression types and models remains qualitatively consistent, supporting the robustness of our findings. \n\nBelow we report both versions side by side for three representative models:\n| Model Variant                      | Global Shape | Local Shape | Texture | Color  | Original |\n| --- | --- | --- | --- | --- | --- |\n| **ResNet50-standard (Softmax > 0.5)** | 0.832        | 0.276       | 0.795   | 0.924  | 0.954    |\n| **ResNet50-standard (Argmax)**        | 0.880        | 0.361       | 0.840   | 0.944  | 0.962    |\n|--------------------------------|--------|-------|-------|-------|-------|\n| **ResNet50-sota (Softmax > 0.5)**     | 0.943        | 0.618       | 0.867   | 0.948  | 0.931    |\n| **ResNet50-sota (Argmax)**            | 0.949        | 0.665       | 0.904   | 0.965  | 0.940    |\n|--------------------------------|--------|-------|-------|-------|-------|\n| **ConvNeXtV2 (Softmax > 0.5)**        | 0.949        | 0.647       | 0.925   | 0.969  | 0.940    |\n| **ConvNeXtV2 (Argmax)**               | 0.979        | 0.748       | 0.956   | 0.984  | 0.944    |\n\nWe will add the results to the supplemental material.\n\n**Visualizations for MI and RS samples:**\nWe thank the reviewer for the suggestion. We will include visualizations of two representative samples per domain (MI and RS) for each suppression type, analogous to those shown for computer vision.\n\n**Attribution to earlier work for the patch-shuffle idea for analysing shape bias:**\nWe thank the reviewer for pointing this out. We fully agree that the use of PatchShuffle for analyzing shape disruptions should be properly attributed. We will update the section on our feature suppression framework and acknowledge their contribution by explicitly citing both [1] and [2] in L147-L149.\n\n**Effect of patch rotation:**\nWe thank the reviewer for raising this interesting question. To compare the effects of patch-shuffling versus patch-rotation on shape suppression at different grid sizes, we conducted an analysis on 100 randomly sampled ImageNet images. We computed shape preservation scores using the ESSIM metric for both PatchShuffle and PatchRotation across grid sizes of 3×3, 6×6, 9×9, and 12×12.\n\n| Grid Size | PatchShuffle | PatchRotation |\n|-----------|---------------|----------------|\n| 3×3       | 0.251         | 0.312          |\n| 6×6       | 0.190         | 0.306          |\n| 9×9       | 0.136         | 0.305          |\n| 12×12     | 0.093         | 0.335        |\n\nThe reviewer’s hypothesis is partially confirmed: patch rotation alone leads to moderate shape suppression, but with diminishing returns at higher grid sizes. In contrast, PatchShuffle more strongly suppresses shape information across all grid sizes. Interestingly, for very large grids, PatchRotation even shows a slight increase in shape preservation, likely due to re-emergence of global contours, consistent with observations in Figure 6c of the supplemental material."}, {"review_id": "9K27yzjC1F", "reviewer": "Reviewer_rbD7", "summary": "Previous work empirically establishes that CNNs are biased towards textures. This paper offers a critique on the nature and setting of the experiments presented in previous work. It also offers a new experimental methodology to show that CNNs and Transformers are not biased towards textures, but like humans, they are biased towards local shapes, at least in the computer vision domain.\n\nThree feature types are identified: shape, texture, and color. Several feature suppression transformations for each type are proposed and validated. Experiments evaluate the classification accuracy, under feature suppression, for human behaviour and several models. Additional experiments evaluate and compare different domains.\n\nModels with similar architectures that employed more involved training strategies, such as data augmentation, showed less bias towards local shape. Results show that the medical imaging domain is biased towards color, while remote sensing models are more affected by changes in texture.", "questions": "Could you please provide reasoning that might help me reduce any of the four concerns I have raised as weaknesses?", "limitations": "Yes, limitations are adequately addressed. Perhaps some additional considerations related to the concerns raised in this review should have been mentioned.", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 4, "clarity": 4, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n1. Results provide interesting and actionable insights\n2. Quantitative validation of suppression transformations helps justify the experimental methodology\n3. Statistical significance tests increases the strength of the claim\n4. Thorough coverage of different model types and domains\n\nWeaknesses:\n1. Observing the visual examples in the Appendix, the proposed suppression transformations for texture still retain low frequency information, which, to the human eye at least, seem to still give away a lot of texture. The LV and HFE metrics, understandably, do not seem to capture this\n2. The causes for the suggested inductive biases are not explained. As shown in some cases, if the architecture (and not the nature of the task domain or the lack of an adequate training strategy) causes some of the bias, which characteristics cause it? This analysis might seem outside of the scope of this work, but in its absence, the validity of the methodology takes more importance and I am concerned that, similarly to the previous work, it might not have been validated enough\n3. To which extent do the data augmentations resemble the suppression transformations used? If we are training models using similar transformations, then we might just be overfitting to them. Thus, other suppression techniques might yield very different results. In particular, the Mixup, Cutout, and Cutmix augmentations can resemble some of the transformations\n4. As pointed out in the limitations, feature types seem to be interdependent. What if the observed biases only exist in the presence of other features. For example, what if local shapes are not as relevant in the absence of texture or color? Such behavior might produce different conclusions", "was_revised": true, "final_justification": "I no longer have concerns about the interdependence of feature types. I believe the paper will be much stronger with the additional results proposed by the authors. As for the other concerns, I think addressing them as suggested will be a great idea.\n\nAlthough I agree with the comments in the rebuttal and I am not as concerned about the points raised, I am still not completely satisfied. It seems to me like we are retaining more texture information than other types of information. This is a completely subjective opinion of course, and that is what leads me to the next concern: what is preventing this work from being criticized in the future and replaced by a different methodology that arrives at a different conclusion? As a counterargument: this methodology is definitely much more solid than previous work.\n\nI will keep my overall score but I will raise the quality to excellent and originality to good.", "rebuttal": "We thank the reviewer for their thoughtful and constructive feedback, as well as for their careful reading of our work. We particularly appreciate the recognition of our methodological contributions and the detailed suggestions regarding limitations and interpretation. We respond to each of the points raised below.\n\n**Visual examples of texture suppression still exhibit some degree of texture.**\nWe acknowledge the reviewer’s observation that the proposed texture suppression transformations, while quantitatively validated, may retain some degree of low-level visual features that could still be perceived as texture by the human eye. This is consistent with the fact that our suppression metrics (e.g., LV and HFE) do not approach zero, reflecting a deliberate trade-off: suppression strength was selected to reduce texture while preserving shape, particularly to avoid compromising classification signals through over-smoothing. Notably, this limitation is symmetric: shape suppression (e.g., via PatchShuffle) also does not fully eliminate all shape information. Absolute suppression of individual feature types is rarely achievable due to their interdependence, and our goal is not to remove a feature entirely but to degrade it sufficiently to observe relative reliance. We will make this point more explicit in the limitations section in L325.\n\n**The causes for the suggested inductive biases are not explained.**\nWhile this work focuses on quantifying feature reliance rather than identifying its underlying causes, we acknowledge the importance of understanding what drives the observed differences across models. As the reviewer notes, architectural characteristics (e.g., convolutional locality, depth, attention mechanisms) and training strategies (e.g., augmentations, regularization) likely contribute in complex ways to feature reliance. A more systematic ablation study, isolating specific architectural components and optimization choices, would be needed to identify these causal factors more precisely. We consider this an important direction for future work that we will add to our conclusion in L320. That said, our current results already suggest that reliance tendencies are not rigid architectural properties: ConvNeXtV2, a convolutional model, exhibits reliance patterns more aligned with transformers and vision-language models, highlighting the significant role of training procedures.\n\n**To which extent do the data augmentations resemble the suppression transformations used? If we are training models using similar transformations, then we might just be overfitting to them.**\nWe thank the reviewer for raising an important limitation that was not previously discussed. Some suppression transformations, particularly those targeting shape (e.g., PatchShuffle), may share structural similarities with augmentation techniques such as Cutout, CutMix or other geometric data augmentation techniques. This resemblance could lead to inflated robustness in models trained with such augmentations, not due to generalized feature use but because of exposure to similar distortions during training. To mitigate this risk, we deliberately excluded such augmentation strategies from all training pipelines for models trained from scratch. Advanced augmentation techniques are only present in models imported from external sources (e.g., pretrained variants from the timm library), where the training protocol was not under our direct control. While we believe that the exact degree of overlap is difficult to quantify, we acknowledge this as a valid concern and will include it as an explicit limitation in L325. \n\n**Interdependence of feature types: What if the observed biases only exist in the presence of other features?**\nThe potential interdependence between feature types is a valuable consideration and suggests a meaningful extension of our evaluation. To assess whether the observed feature reliance patterns persist when multiple features are suppressed simultaneously, we conducted an additional experiment using joint suppression for the CV datasets.\n\nSpecifically, we tested three suppression combinations: color + texture (leaving only shape), color + shape (leaving only texture), and shape + texture (leaving only color). For each case, we computed the accuracy fraction as a function of increasing suppression strength, analogous to the plots shown in Figure 4. Due to NeurIPS 2025 constraints, we summarize the results only for ImageNet in the table below (in the Figure all datasets are evaluated), reporting the model's accuracy fraction at each suppression level:\n\n| Suppression Type / strength         | 0     | 2     | 4     | 6     | 8     | 10    | 12    |\n|-------------------------------------|-------|-------|-------|-------|-------|-------|-------|\n| Color + Texture (only Shape preserved)   | 1.000 | 0.714 | 0.592 | 0.511 | 0.451 | 0.396 | 0.339 | \n| Color + Shape   (only Texture preserved) | 1.000 | 0.578 | 0.219 | 0.079 | 0.026 | 0.015 | 0.010 |\n| Shape + Texture (only Color preserved)   | 1.000 | 0.415 | 0.121 | 0.043 | 0.016 | 0.010 | 0.007 |\n\nThese results confirm and extend the patterns seen in single-feature suppression: accuracy is the highest when only shape is preserved, lower when only texture is available, and nearly lost when only color remains. This supports the interpretation that feature reliance remains consistent even when features are suppressed in combination. While these values are reported for ImageNet, the final version of the paper will include corresponding figures for all computer vision datasets in the supplemental material."}]

Author rebuttal:

Meta-review: a) The authors challenge the claim that ANN are biased towards textures in the task of image classification. They raise several concerns about the previously used methodology and resolve them to provide a better view of the interaction between shapes and textures in ANNs and in humans.

b) The paper challenges a widely accepted claim.
- the methodology is acknowledged to be better by all reviewers
- extensive exp validation on ANNs and Humans and using mutiliple datasets
- use of appropriate metrics

c) minor / resolved during the rebuttal period

d) The authors revisit an impactful previous work by highlighting drawbacks and limitations and proposing a methodology that resolve these. The results go against the previous claim showing that ANNs are not biased towards textures. The impact of the previous work justifies to put this paper forward with an oral presentation (or at least a spotlight).

e) Initially, all reviewers add a positive opinion about this submission. The rebuttal period resolves most of their concerns improving their opinion about the paper.
Decision: Accept (oral)