On Inherent Adversarial Robustness of Active Vision Systems
Authors: Amitangshu Mukherjee
Timur Ibrayev
Kaushik Roy
Venue: Accepted by TMLR ()

Abstract: Deep Neural Networks (DNNs) are susceptible to adversarial inputs, such as imperceptible noise and naturally occurring challenging samples. This vulnerability likely arises from their passive, one-shot processing approach. In contrast, neuroscience suggests that human vision robustly identifies salient object features by actively switching between multiple fixation points (saccades) and processing surroundings with non-uniform resolution (foveation). This information is processed via two pathways: the dorsal (where) and ventral (what) streams, which identify relevant input portions and discard irrelevant details. Building on this perspective, we outline a deep learning-based active dorsal-ventral vision system and adapt two prior methods, FALcon and GFNet, within this framework to evaluate their robustness. We conduct a comprehensive robustness analysis across three categories: adversarially crafted inputs evaluated under transfer attack scenarios, natural adversarial images, and foreground-distorted images. By learning from focused, downsampled glimpses at multiple distinct fixation points, these active methods significantly enhance the robustness of passive networks, achieving a 2-21 % increase in accuracy. This improvement is demonstrated against state-of-the-art transferable black-box attack. On ImageNet-A, a benchmark for naturally occurring hard samples, we show how distinct predictions from multiple fixation points yield performance gains of 1.5-2 times for both CNN and Transformer based networks. Lastly, we qualitatively demonstrate how an active vision system aligns more closely with human perception for structurally distorted images. This alignment leads to more stable and resilient predictions, with lesser catastrophic mispredictions. In contrast, passive methods, which rely on single-shot learning and inference, often lack the necessary structural understanding.

Published in Transactions on Machine Learning Research (12/2024)
On Inherent Adversarial Robustness of Active Vision Systems
Amitangshu Mukherjee
mukher44 @purdue. edu
Elmore Family School of Electrical and Computer Engineering
Purdue Universily
Timur Ibrayev
tibrayeo@purddu..oo edu
Elmore Family School of Electrical and Computer Engineering Purdue University
Kaushik Roy Elmore Farmll School of Electrical and Computer Engineering Purdue University
kaushik @xprrdue...mmmmm edu
Reviewed on OpenReview: https: // openreview. net/
net/forum? forum? id= 6VV712155V
Abstract
Deep Neural Networks (DNNs) susceptible to adversarial inputs, such as imperceptible noise and naturally occurring challenging samples. This vulncrability likely arises from their passive, one-shot processing approach. In contrast, neuroscience suggests that human vi- sion robustly identifies salient object features by actively switching between multiple fixation points (saccades) and processing surroundings with non-uniform resolution (foveation). This information processed via two pathways: the dorsal (where) and ventral (what) streams, which identify relevant input portions and discard irrelevant details. Building this perspective, we outline deep learning-base based active dorsal-ventral vision system and adapt two prior methods, FALcon and GFNet, within this framework to evaluate their robustness. We conduct a comprehensive robustness analysis across three categories; ad- versarially crafted inputs evaluated under transfer attack scenarios, natural adversarial im- images. By learning from focused, downsampled glimpses at
ages, and foreground-distonr multiple distinct fixation points, these aclive methods significantly enhance the robustness of passive networks, achieving 2-21% increase in accuracy. This improvement is demon- strated against stato-of-tho-art transfcrable black-box attack. On ImageNet-A, benchmark for naturally occurring hard samples, we show how distinct predictions from multiple fixa- tion points yield performance gains of 1.5-2 times for both CNN and Transformer based networks. Lastly, we qualitatively demonstrate how an active vision system aligns more closely with human perception for structurally distorted images. This alignment leads to more stable and resilient predictions, with lesser catastrophic mispredictions. In contrast, passive methods, which rely on single-shot learning and inference, often lack the necessary structural understanding.
1
Introduction
The human visual perception system is one of the most sophisticated and robust vision systems in the
animal kingdom (Ungerleider & Haxby 1994 Goodale
Milner 2004
Clark 2013
Shao et al.] 2024
The code available GitHub

---

Published in Transactions on Machine Learning Research (12/2024)
1. Active Vision System
The dorsal streum learns to localize objects by processing glimpses from random succudes, iteratively identifying imporiani points bused on salient features.
Stream
Spucial Awareness Deterrmeer object locarion and aunoment
Motion Detection Jrocks moving objects
Succade
T=1
fD
features: diccurd point
olgjccts
Courdinates eye movemtennyy
Saccadic Point
Saccade
T=1
f
No objects foutures: discar
(b) Peripheral Vision
Ofject features present:
Saceade
f
Input
contieae
Region
Ventral Stream
stream classifles object presens baved on the location goided the dursal
T=N
Object Idlettficationn- Receguisev lskerijlees offaccts
fv
Macaw
Form Representation - AAneyze slopv, color, lexture
stream instond of
Visual Memory- - -Sonee and retrieves vinaai information.
image.
(a] Two-Stream Hypothesis
(c) DL based Active Vision System
Figure 1: (1a) Mustraaes the dual-stream hepothesis, highlighting the distinct dorsal ("where") and ventral ('what") pathways along with their key corresponding features. (1b) Depicts peripheral vision, emphasizing the inherent mechanisms of saccades and foveation. Together, the peripheral vision and the two-stream model form active vision system. The corresponding DL-based active vision system is schematically shown in (1c). The dorsal stream learns to localize objects by assessing foveated features around random saccadic points and guides the ventral stream in object classification by removing background clutter.
relies on the active interplay of the eyes and two primary pathways: the dorsal (where/how) and ventral (what) streams. According to the two-stream hypothesis, these pathways have distinct specialized functions as depicted in the left. column of Figure Ta). The dorsal stream processes spatial information and guides actions by determining the location and movement of objects, essential for interacting with the environment. Conversely, the ventral stream handles object recognition and form representation, identifying objects based on shape, color, and texture. Additionally, the eyes, equipped with inherent properties such as foveation and saccades, enhance this system by serving the primary input for the human perception system, particularly in peripheral vision shown in Figure [b). Saccades rapid eye movements that shift the fovca's focus iteratively to different parts of the visual field, analyzing each area for relevant features. Foveation locks these points to process high- rishuttno details, enabling object recognition (Eckstein) (011). Integrating these functionalitics into the dual-stream model enhances the system into an active vision model (Curcio et al., 1990 Land Nilsson 2012). Thus in an active vision system, the dorsal stream iteratively directs saccades spatially significant. areas, separating the foreground from the background, which are then processed by the ventral stream for detailed recognition.
Humans, existing in 3D environment, understand objects by identifying and examining the structure from various viewpoints. Complex objects may require multiple views, unlike simpler ones, to provide a robust understanding of their nature. This process is illustrated in the right column of Figure [[c] with a deep learning-bart based active vision system. Given an input image with three random saccades, the dorsal stream (fD) analyzes the foveated glimpses for object features, discarding points without salient features. Relevant features prompt fovcation expansions to extract the foreground from the background, which is then passod to the ventral stream for object recognition. The dorsal st straam learns the concept of the object by viewing it from different saccadic points, determining which views enhance understanding and which to discard. This helps climinate unnccessary noise, allowing the ventral stream (fv) to focus solely on object features for better recognition, even in the presence of background clutter.
Contrary to active vision systems, current deep learning (DL) methods for image classification process the entire image in one shot, uniformly attending to each pixel. This approach is analogous the ventral stream analyzing the entire image for object recognition without the guidance of the dorsal stream, leading to the inclusion of both foreground and background features, shown in Figure (1b). While this passive
2

---

Published in Transactions on Machine Learning Research (12/2024)
Passive Vision System
Processing the entire image uniformly shot may increase vulnerabiliit various adversarial samples
Butterfly
Sea Lion
Plastic Bag
Mасиw
T
Adversarial
Naturally
Foreground
Input
(a) Learning
(b) Inference
2. Active Vision System-Inference
Advenarially crafied sampler
(b) Naturally Adversarial
Hard somples from ImageNeteA
Structural fragility from
Adversarial Sticker
Foreground distortion
1d Succade
2 Succade
6
fo
Fox Squirrel
Cauldron
Golden (52.5%)
Saluki (24.99 %)
Multiple distinct predictions on distinct saccndic points.
confideet correct prodictions catastrophic mispredictions
Butterfly
Goldfinch
Goldfinch
Figure 2: The upper part of the figure illustrates that passive vision systems, mimicking the 'what' path- way alone, are more vulnerable to adversarial inputs due to uniform image processing. The bottom part shows the active vision system's enhanced robustness across three categories: adversarially crafted samples (2a), naturally adversarial samples (2b), and foreground distorted images (2c). Active vision systems make multiple correct predictions despite non-uniform noise, identify object-relevant features, and result in less catastrophic mispredictions respectively.
analysis has achieved significant success with benign inputs (Krizhevsky al. 2012; Ren 2015 He
et al. 2017), struggles with adversarial inputs that include imperceptible noise ignored by human eyes (Szegedy et al. 2014 Goodfellow et al. 2015 Papernot et al., 2016). Depending their generation process, this imperceptible noise can spread across the image, alfecting both the background and foreground, or be tailored to harm only the foreground. Such malicious inputs have been detrimental to various
oriented applications (Athalye et al. 2017 Hosscini & Poovendran 2018 Joshi et al. 2019). Naturally occurring adversarial samples can also reduce classilication accuracy to zero, as shown ImageNet-A (Hendrycks al. 2021), where objects may be occluded, have a smaller foreground-tor srnground-to--backgrondd ratio, or exhibit real-world effects, underscoring the need for non-passive analysis akin to human vision for complex images.
To address these challenges, various methods have been proposed from both algorithmic and human periph- eral vision perspectives. Algorithmic approaches utilize deep learning principles such as Adversarial Training, Randomised Smoothing, Data Augmentation, etc. (Madry et al. 2018 Cohen et al.
2019
Andriushchenko
& Flammarion 2020 Yun et al. 2019 & Spratling 2023 Moosavi-Dezzin
et al. 2018
Yue et al.) 2023
Zhang et al.] 2018). Inspired by human vision, some research focuses on non-uniform visual processing to mitigate adversarial noise, exploring cortical fixations (Vuyyuru et al. 2020), peripheral blurring (Shah) eet al.
2023) primal visual cortex processing (Dapello et al. 2020),, and fovea-based texture transformation GGant al. 2021). These methods, modeled on single fixation point during training, primarily enhance
the ventral stream's passive approach.
Building on the principles of active vision, this work goes beyond the traditional single-point inference approach and advocates that the active vision system, due to the dorsal stream's dynamic focus, that is inherently more robust to various kinds of adversarial inputs. This idea is demonstrated part (2) of Figure 2 for three different categories of adversarial inputs: crafted adversarial samples, naturally adversarial images, and foreground object distortions. Carefully crafted adversaiial noise often has non-uniform distribution
3

---

Published in Transactions on Machine Learning Research (12/2024)
across the entire input to match imperceptibility (PGD-like attacks) (Szegedy et al. 2014 Wang & He 2021
Dong et. al. 2018) elc. size (patch-based attacks) (Gao et al. 2020 constraints. By processing inputs through multiple saccades and foveated glimpses, active DL methods utilize the dorsal stream's 'where" functionality to make distinct predictions under non-uniform adversarial noise, directing saccades to identify significant areas and discard irrelevant ones. While one saccadic point might lead a misprediction fooled by the presence of adversarial noise, others often result in robust foveated glimpses, leading to correct predictions as shown in the leftmost column (a). For naturally adversarial samples, which are inherently challenging to classify, the dorsal stream's 's ability to assess different portions of the image aids in identifying the correct salient features. This capability often leads to correct predictions that would be difficult for a passive, ventral-only approach, as shown in the middle column (b). In the third category, as presented in the mosh column (c), we further explore the concept of visible adversarial samples by structurally distorting the foreground. This often leads to catastrophic mispredictions for passive methods. Although the active system may not see the complete objoct, it can still identify meaningful features by scparating parts from the background, resulting in less confident correct predictions or less catastrophic mispredictions (e.g., parts of Golden Retriever being misclassified a Saluki botukiibothh being dog breeds).
This work leverages the frameworks of Active Localization with Foveation and saccades (FALcon) [bbaayv et al. 2024b) and Glance and Focus Networks (GFNet) (Wang et al. 2020), analyzing them through the lens of an active vision system framework. While FALcon is designed for Weakly-Supervisee Object Localization and GFNet for budgeted and anytime inference, both exhibit an underlying active dorsal-ventral structure. However, their inherent adversarial robustness has not been studied prior to this work, making them ideal DL-bbaeed active vision candidates for this robust analysis. For evaluation, we employ black-box transfer attack sctup, where adversarially crafted samples are generated from surrogate models and transferred to the target active and passive vision models. Consistently, for the other two kinds of adversarial inputs, samples are passed for inference. It is important to note that we are not proposing an adversarial defense for a black-box scenario, nor do we claim robustness to query-based black-box attacks.
Hence, our contributions are highlighted as follows:
We present a novel analysis the inherent robustness of Active Vision systems across three different categories of adversarial inputs.
Our experiments demonstrate that active vision improves the ventral only passive vision's perfor- mance by 2-21% in accuracy against adversarial crafted inputs across various state-of-the-art transfer attacks )4.2) on ImageNet (Dong et al. 2009 in a black-box transfer attack sctup.
Through both quantitative and qualitative analyses, we highlight the salient learning aspects con- tributing to the inherent robustness of these methods, including glimpse-based focused learning at downsampled resolutions 4.3 and inference from distinct saccadic points |4.4
We provide similar detailed analysis for the naturally adversarial ImageNet-A dataset, demon- strating 1.5-2 times improvement over the passive ventral method. We provide qualitative results for diverse set of samples within this category.
We present qualitative results that highlight the benefits of implicit structured learning in ac- tive systems for handling foreground object distortion, leading to more human-aligned and interpretable predictions.
2
Related Work
Active Vision methods The methods discussed here explore the incorporation of active iterative strategies for input processing. RANeet (Mníh et al.) 2014) incorporates a recurrent attention network to selectively focus on different parts of the input sequence over multiple time steps excelling in sequential tasks. Saccader Elsayed et al. 2019) emulates saccadic eye movements to iteratively extract features from an image attending
Since this noise is imperceptible the human eye, we use adversarial sticker for illustration purposes to emphasize the high concentration of adversarial noise in that region.
4

---

Published in Transactions on Machine Learning Research (12/2024)
to finer details while enhancing performance. Glance and Focus Networks (GFNet) (Wang et al. 2020 constrained by computational budget, iteratively processes different glimpses in an image, refining predictions until confidently identifying the object. Foveated Transformer (Jonnalagadda et al. (022) uses pooling regions and dynamic fixation allocation based on Transformer attention based on past and present fixations for image classification. Recently, FABLE Qbbrayvv et al. 2024a) proposed localization framework that models the ventral stream as a supervised feature extractor and the dorsal stream as a. separate model trained via reinforcement learning. Building on this, FALcon (lbrayev et al., 2024b) enhances the approach by incorporating foveation and saccades, enabling dynamic and active vision for improved object localization and multi-object detection, even when trained on single-object images. In this study, we explore how the iterative interplay of foveation and saccades in a dorsal-ventral system enhances the inherent adversarial robustness of active methods across different adversarial inputs.
Towards bio-inspired mechanism for robustness The following methods address the adversarial inputs by functionally treating human eyes as pre-processing/ praeoosssing/raaasffommmaa /transformaaion stage. (Luo et al. 2015) demonstrates that applying CNNs to specifie foveated regions reduces the impact of adversarial perturbations by leveraging CNNs' robustness to object scale and translation, along with non-lineat responses in background regions. On ImageNet, this approach achieves accuracy close to unperturbed levels, even when perturbations are crafted with foveation in mind. R- R-Wa (Vuyyuru et al., 2020) advocates for biologically inspired mechanisms such as cortical fixations and retinal fixations incorporated in DNNs lead to adversarial robustness for small perturbations. VOneBlock (Dapello et al. 2020), illustrates that incorporating primary visual cortex processing at the forefront of CNNs enhances their resilience against image perturbations. Harrington et al. (Harrington & Deza, 2022 demonstrates that adversarially robust networks behave similarly texture peripheral vision models, thus promoting the latter's plausibility for adversarial robustness. (Gant et al., 2021) proposed a novel Foveated Texture Transform module in VGG-11 to enhance adversarial robustness without sacrificing standard accuracy. R-Blur (Shah et al.) 2023) simulates peripheral vision using adaptive Gaussian blurring and trains on these transformed input images, leading to improved adversarial robustness. While these methods simulate human peripheral processing, they do not replicate the iterative active learning process found in human vision. We provide a fresh perspective showing how mimicking human-like active vision processing naturally enhances DNN robustness against adversarial inputs.
Transfer attacks (Szegedy et al. 2014 introduced the vulnerabilities of neural networks to adversarial samples. (Papernot et al., 2016) introduced novel approach that leverages substitute models to craft transferable adversarial examples, emphasizing the need for robust defenses against such attacks. (Liu et al. 2017) conducted an extensive investigation into the transfcrability of adversarial samples on large-scale datasets like ImageNet. (Deng et al.] 2009). Recently, LGV (Gubri el al., 2022) exploited the weight space geometry of surrogate models to find flatter adversarial samples creating stronger transfer attacks. Token Gradient Regularization (TGR) (Zhang et al., 2023) introduces method that enhances the transferabilitt of adversarial attacks Vision Transformers (ViTs) by focusing on Token Gradient Regularization (TGR). This approach manipulates token-level gradients to create perturbations that effectively fool different VIT models, highlighting a significant vulnerability in these architcctures. In this study, we examine active vision methods under the lens of adversarial robustness in a black box transfer threat model and show the human-inspired active way of processing inputs in DNNs leads to inherent robustness.
3 Active Vision systems
In this section, we provide focused overview of the inference process and highlight key insights into the inherent robustness of two active vision systems: FALcon (Ibrayev et al. 2024b) and Glance and Focus Networks (GFNet) (Wang et al.) 2020). These methods simulate foveation by cropping glimpses from the image based on fixation (saccadic) points, without blurring the extracted glimpses. This approach can be interpreted as foveation with an extreme cut-off. For detailed learning processes, readers are directed to supplementary Sections 1.1 (FALcon) and 1.2 (GFNet). For the remainder of this manuscript, we will refer to saccadic points fixation points.
5

---

Published in Transactions on Machine Learning Research (12/2024)
Learning
H' x w
Dorsal Network
dx"
dx
Saceades FALcon learns to switch from the yellow fixation point to the red one.
absence of salient features
f
dly
dy
switch
dx'
salient fD
dx
Foveation FALcon leurns to expand different directions capturing the entire object.
features
dy"
Input: X
dy
Dorsal Network
switch
HXW W
Inference
Dorsal Network
Top predicted glimpse by NMS algorithm
Ventral Network
H" x W
Class Label
Climpses
NMS
Crop
f
fy
Restze
Input: X
FALcon The dorsal network discards less relevant fixation points. The most confident glimpse is passed the ventral network for the class label prediction.
HXW
Any Predictions
W"
Ventral Network
Adversarial Noise affects some of these points, but not all.
Glimpses
Class
Crop
fv
Label
Resize
Class
FALcon - Any Correct Predictions
Crop
fv
Label
Resize
Crop
Class
Beneficial for predicting multiple objects for hard samples.
fv
Label
Resize
Figure 3: The figure provides high-level overview of FALcon. During Learning, the dorsal network (fD) is trained to predict five distinct actions (four for expansion and one for swilching), enabling it to learn the importance of each fixation point illustrated by colored dots. Learning occurs in downsampled resolution of (H' x W'). During Inference, fo starts from each pre-defined multiple fixation point (20 red dots). If salient object features are present, fo performs the learned expansions to capture the object (4 colored dashed boxes, colored dots). The most confident. final foveated glimpse (red solid box) cropped (H" x W") and presented to the ventral (fv) for Top prediction. The system can produce distinct predictions referred to Any, which are beneficial for handling adversarial samples.
3.1 FALcon
Active Vision structure Both the dorsal fo and ventral fv streams are represneted by deep convolutional neural networks. During training, only In is trained to emulate the saccadic and foveated functions. For fv, any pre-trained network can be selected.
Inference During inference, the input image X is divided into grid cells, as illustrated in the first image at the bottom part of Figure 3 Each grid cell is considered as initial fixation point (red dot). The

---

Published in Transactions on Machine Learning Research (12/2024)
Learning p: Dorsal Network
Feature Encoders
fy= Ventral Network
Inference
Input: : X
1
Global Encoder
t=
2
01
Resize H'XW W
f
fv
P1 n
Yes
Glance Step
h
No
C2i
Local Encoder
t=
Zz
P2
02
Crop
fL
fy
P2
Yes
H X W
h
Focus Step
H'X W
D2
hv
2
No
Local Encoder
t=
S3l
Crop
fL
Zg
fy
P3
Ps n
Yes
0g
2
H' X W
Focus Step
D3
X4
h 3
No
Local Encoder
t
Z
P4
04
Crop
fL
Py
P4 >
Yes
H' W
Focus Step
Figure (Learning & Inference) The figure provides an overview of GFNet's operation. It begins by downsampling the input image a lower resolution for rapid prediction (p1), termed Glance t If the network lacks confidence (P1 77), it enters subsequent Focus steps until certainty is attained till (t = 4). Each focus step analyzes patch (H' x W") cropped from the original input (H x W) centered around (cx) illustrated by colored dots. These co-ordinates are determined by the dorsal network fn- The process is depicted for a sequence length of 4.
dorsal fn initiates from each point with pre-defined glimpse size to inspect salient object features. In the absence of salient features, the dorsal deems there is no potential object and hence switches to another fixation point. If the dorsal encounters any relevant features and hence assumes the presence of potential object, expands from the initial glimpse dimensions four independent directions to generate a sequence of foveated glimpses. Based on the expansion operations, each loveated glimpse cropped from the input image downsampled resolution of H' W', The sequence of expanding for a potential fixation point continues until the final foveated glimpse captures the entire object learning the structure implicitly. This process iterates for all potential points that could lead to various final foveated glimpses for the same object. This is illustrated by the colored dots and dashed colored boxes in the second image. For object localization, these final foveated glimpses undergo non-maximum suppression to yield the most confident prediction indicated by the solid red bounding box in the third image. The region corresponding to the most confident final foveated glimpse is cropped at standard dimensions H" x W" and then presented to the ventral network fv for class prediction. our evaluation, we refer this final class prediction label as Top. The remaining potential fixation points, except the most confident one, serve effect of non-uniform adversarial noise injected into images. This is illustrated at the bottom part of the figure under Any Predictions. In our experiments, we visually demonstrate how the noise affects some of these fixation points 4.4 but not all, resulting in enhanced robustness, which we quantitatively refer to as Any.
map to understand the
3.2 Glance and Focus Networks
Active Vision structure GFNet potrays a slightly more complex framework DL based active vision system. Both the dorsal fp and ventral fy streams are represented as deep recurrent neural networks to

---

Published in Transactions on Machine Learning Research (12/2024)
aggregate information from previous steps. For processing image features, both streams employ convolutional deep neural network based feature encoder backbones SC/L- In the training phase, all net net are trained.
Inference GFNet performs inference in two distinct steps a glance step and subsequent multiple focus steps (Figure 4p. In the glance step, the full-resolution image (H x W) is first downsampled to a much lower resolution (H' x W"). It. is then passed through the global encoder So and ventral network fv pathway to make a swift prediction based on the global features. If the confidence Pt exceeds the threshold Th where 7 is a pre-defined threshold (Huang al.) 2018 Yang et al.) 2020), the process halts. Concurrently, the dorsal network fD evaluates these features to predict the fixation point for the subsequent focus step. Each foveated glimpse is generated based on the most salient features of the object centered around the fixation point, denoted by the orange dot in the second glimpse. This H' x W" glimpse is cropped from the image and inputted into the local encoder fL ventral network fv pathway for prediction in the second step. Simultancously coordinates for the next. focus step are produced by the dorsal network. The iterative process persists until the network gains sufficient confidence its prodiction, process / T. To understand the robustness aspect through inference on transferred adversarial samples, we keep the early termination inactive, allowing inference to continue until f = T. This allows the ventral network to process glimpses cropped around distinct fixation points generated by the dorsal network, at each step assessing the imput in the presence of adversarial noise and background clutter. Both fa and fL process low dimensional inputs of H' x W with the former fine-tuned on these dimensional inputs for global step predictions. Exploiting this in our experiments, we demonstrate how learning in a downsampled resolution contributes to the robustness properties of such systems
reaches the end of the soquential
4 Adversarial crafted images
Adversarial transfer attack setup The section aims to illustrate that active vision networks GFNet (Wang et al. 2020) and FALcon (lbrayev et al. 2024b) exhibit higher levels of robustness against transferred adversarial images than base passive classifiers (He et al. 2015). We follow the protocol for a black box transfer attack threat model outlined in (Liu et al.) 2017 Mahmood al. 2021 Following this protocol, we define non-targeted transferability. Given surrogate Classifier S,, we generate an adversarial sample for image/label pair (r, which is denoted as Fade- This is with respect to the surrogale Classifier S and attack pair As,. The adversarial sample, Todv: is said to transfer to another target Classifier Ti if the adversarial sample is mispredicted. This is formalized as the following:
Tade As, (2. (I(add)) # ys
T((Fadv) #
(1)
Metrics We measure the non-targeted transferability by computing the percentage of adversarial examples generated using model S, but still correctly classified by the model T, (not transferred). We refer to this percentage as accuracy. A higher accuracy means less susceptibility to transferred adversarial samples and hence higher robustness under this setup. For a test set with N samples, the accuracy defined as:
N 1 (T.(dad))) =b}}
1
Acc
(2)
N
Remark In this study, focus solely empirically showcasing the inherent robustness of active vision methods. We do not propose any adversarial defense for black-box attack scenario or analyze the trans- ferability trends between surrogates and target samples. Therefore, we opt for standard accuracy (Acc,-1)) under transfer, where we denote s + I. as surrogate to target.
Scction (4.2) empirically demonstrates this via quantitative results. Sections 4.3) and 4.4 then focus on explaining the salient features that provides this inherent robustness, by analysing the internal mechanics of GFNet and FALcon, respectively, in the presence of transferred adversarial inputs.
8

---

Published in Transactions on Machine Learning Research (12/2024)
Table Inherent Robustness of Active Vision Methods
ResNet50
CutMix
FALcon-Top
Adv-Tx
GFNet:
Clean
76.15
78.60
72.97
47.91
75.88
Attack
Surrogate
Target
PGD
MIM
VMIIFGSM
P-IFGSM
TI-FGSM
Re
31.46
20.20
11.61
31.62
28.08
FALcon-Top
49.83
37.01
29.40
40.46
35.20
ResNet34
FALcon-Any
53.76
41.28
33.74
44.72
39.08
CutMix
43.47
30.92
21.32
41.34
38.78
PALcon-CutMix-
52.48
39.88
31.97
44.21
42.04
FA PALcon-CutMix-Any
55.86
43.95
36.25
48.07
45.96
Adv-Tx
47.63
47.37
47.16
46.85
46.43
GFNet
57.82
48.60
41.17
46.93
41.42
ResNet50
0.00
0.00
0.00
0.00
0.00
FALcon-Top
31.73
19.96
12.07
27.37
14.63
ResNet50
FALcon-Any
37.54
25.60
16.64
32.37
19.14
GFNet
51.85
42.16
32.33
43.33
34.30
Attack
Source
GeNe
FALcon-
FALcon-
Source
FALcon-
FALcon-
Top
Any
Top
Any
AutoPGD ResNet50
56.54
31.00
37.80
VGG16
52.98
57.11
Table 2: AutoPGD attacks transferred from ventral and dorsal architectures Active Vision System
4.1 Implementation details
We perform our extensive robustness analysis on Imagenet (Deng et al. 2009), standard benchmark for image classification. We utilize ImageNet pre-trained weights for GFNet and FALcon without any additional fine-tuning. Following the active vision structures highlighted in Section 3 we employ GFNets with Res- Net50 as both global fo and local fL encoders. These encoders provide relevant image features the dorsal and ventral streams which recurrent neural networks, illustrated in Figure 4 Both encoders are trained on downsampled resolution images of (96, 96) pixcls. For FALcon employ VGG16 (Simonyan) & Zisserman, 2015) as the dorsal fn stream, and ResNet50 as ventral fv. Please note that, unlike GFNet, the fv of FALcon is not involved during training. Instead, only the dorsal is trained on the downsampled images, while a pro-trained ResNet50 is employed as fv during inference on image resolutions of (224,224) as indicated by H x T Figure g This approach provides the flexibility to select various ventral streams and demonstrate how the FALcon framework can enhance the performance of the underlying passive ventral networks. We utilize TORCHATAACKS (Kim) 2020), an integrated library for generating adversarial attacks Ravikumar et al. 2022 with PYTORCH, to generate adversarial samples.
4.2 Inherent robustness in the Black-box transfer attack setup
In this section, we demonstrate the superior performance of active vision systems (c.g., FALcon and GFNet) over passive ventral ones (e.g,, supervised ResNet) in a black-box transfer altack setup. Adversarial samples generated from surrogate models are transferred to the unknown target models. For GFNet, we use the output from the final prediction step as described Section 3.2 For FALcon, we evaluate two types of predictions: Top, where the most confident prediction is matched with the ground truth, and Any, where any correct prediction from multiple outputs is considered. This enabled by inference from multiple

---

Published in Transactions on Machine Learning Research (12/2024)
distinct fixation points. The Any prediction strategy highlights the full potential of active systems, detailed in Section 3.1
Iterative attacks We generate adversarial samples from surrogate classifiers S; using iterative adversarial attacks such as PGD (Madry et al. 2018). MIM (Dong et al.) 2018), VMI-FGSM (Wang & He, 2021).
Patchwise-IFGSM (Gao et al.) 2020 and TI-FGSM (Dong et al.) 2019). In the first setup, ResNet34 is used for S and in the second setup, ResNet50 is used matching the ventral stream in the active vision networks. For GFNet, bessee samples attack both dorsal and ventral streams simultancously. FALcon, however, offers more control over which stream is targeted, detailed in Auto-PGD 2 We can also substitute FALcon's 's ventral stream; for instance, PALcon-CutMix-AAI
uses the default VGG16 fo stream but replaces the fv with a ResNet.50 trained using CutMix loss (Yun et al.) 2019). The performance is then evaluated based on any correct prediction matched with the ground truth. We conduct Loe attacks with 10 iterative steps, a = 2/255, and c = 8/255 for all six iterative attacks including Auto-PGD (Croce & Hein 2020). Adversarial samples are generated using the entire 50,000-sample ImageNet test set. The corresponding clean accuracy is presented at the top of Table
Quantitative analysis Table ① demonstrate that active vision systems consistently improve upon the underlying passive approach across all surrogate architectures and attacks. For instance, FALcon with a SuperviseedRResNeet55 and a CutMix-ResNet50 ventral stream shows steady performance improvements of approximately 11%-23% and 7%-15% in accuracy, respectively, over the corresponding passive ven- tral backbones, proportional to the attack strengths. Specifically, for a supervised ResiisedddRRee550,,, FALcon-Top improves performance by nearly 18% for PGD, while for CutMix, FALcon-Any achieves close to a 15% improvement for VMI. CutMix {Yun et al., 2019) has robustness properties stemming from its strong regu- Additionally, we consider an adversarially trained ResNet50 Madry et al.] (2018), which serves as an Oracle method de- noted as Adv-'Tx. Trained specifically for adversarial defense, this method offers the best-case performance on transferred samples on average. In the second sctup, we notice that FALcon and GFNet provide an additional shield, even when the altack is generated using the ventral backbonn and shared feature encoder respectively. While GFNet employs a more complex framework with recurrent dorsal and ventral streams sharing a convolutional backbone, FALcon-Top offers clear mcasure of quantitative improvement due to its active processing mechanism. As shown in Table 2 the non-zero results demonstrate robustness benefits even when generating Auto-PGD-based adversarial samples using each active vision system's 's crucial networks. This table indicates that generating samples based on FALcon's ventral stream is more effective than using its dorsal stream. This is pictorially explained in Scction A.1.3.
larized feature representations as indicated by the higher baselines than Hupperisse-ResNNee
Transfer attacks with Large Geometric Vicinity (LGV) The plot on Figure presents results based on a geometric space attack (Gubri et al. 2022). The intuition behind this attack is provided in in Appendix A.1.4] We follow a similar experimental setup outlined in the paper (Gubri al. 2022). ) combining LGV with PGD and BIM (Kurakin et al., 2018) on 1000 randomly sampled images from the ImageNet validation set. We report accuracy (Acc,-se), and the results indicate consistent trend similar to the iterative attacks for Seneervised-ResNeeiee Any improves upon Top by 3-4%, which in turn improves upon the baseline by 24-28% for BIM (orange) and PGD (blue), respectively. Couversely, when FALcon is paired with an adversarially trained ResNet50 (Madry et al.] 22018), we obscrve close to a 2% improvement on clean samples (notably low accuracy for adversarially trained models) but no significant. improvement for adversarial samples. This is expected, networks already trained on worst-case perturbed samples benefit less from active predictions based on distinct fixation points.
and MexxiirRReNNe5O. For instance, as depicted in the plot, MALcon-CutMix--
Transfer attacks with TraeneGradient Regularization (TGR) Setup We follow the experimental setup outlined in the original paper (Zhang et al.
2023) and present results on a test set of 1,000 randomly
selected images from the ImageNet validation set (Deng et al. 2009). The equation and the intuition behind this attack are provided in Equation (3) in Appendix A.1.5 The TGR. transferable attack plot in Figure 5 shows the accuracy (Acc,-r) of different target networks on adversarial samples transferred from various surrogate architectures, including Vision Transformers (ViT-B/16) (Dosovitakiy et al., 202I), and their variants PiT-B, and CaiT-S/24 TTuvron et al. 2021 Heo et al. 2021 In addition to the baseline methods previously studied, we employ several notable vision transformer architectures for image classification, such
10

---

Published in Transactions on Machine Learning Research (12/2024)
Performance
LGV based Transferable Attacks
Starccs
CAIT aaa
Accursty
Accuracy (%)
(b)
Veriants
Legend
Surre
Accuracy
Accuray [sl
CATT +24 PIT
LGV BIM
Reshtet50
FALcon-op
Any
FALcon TALcan-Cutttin
Cublii
SALcon Alvi-n-
Adv
(a)
Variants
SwinV2 TGR Performance
RVI-Tiny-Plus TGR Performance
Focal Mod TGR Performance
Soares
sauree
Surves
Accuratty
BLLAN Avy
Are
Verlants
Variants
Variants
(c)
Figure 5: (a) The scatter-line plot on the left shows accuracy improvements in LGV-based transfer attacks using a ResNet50 surrogate, with active models significantly outperforming passive ones, except for the adversarially trained ventral. The bar plots on the right (b) and bottom (c) illustrate the effect of Token Gradient Regularization on various ventral streams. While CNN-based streams show modest gains (b), significant improvements are seen in CNN (dorsal)-ViT (ventral) configurations (c).
as Swin V2 Transformer (Liu et al. 2022). Focal Modulation Networks (Yang et al. 2022) and Robust Vision Transformer (Mao et al. 2021; as ventral methods combined with FALcon's default VGG16 dorsal stream. The vision transformers examined are their corresponding tiny versions, with a parameter count close to 25 million parameters, comparable to the CNN baselines studied.
Results For PALcon-SwinV2-11
and FALcon-RVTT-plus-- provements adversarial samples transferred from VIT-B/16 and CaiT-S/24, with gains of 16% and 14%, respectively. For Focal Modulation networks, we see the active vision method shows significant gains mostly for CaiT-S/24 based samples. This highlights the effectiveness of a CNN-Transformec based dorsal-ventral active system in handling such token based transferable samples. For PiT-B-based adversarial samples, im- provements across all architectures range between 2-6%. Although CNN-based baselines also show steady gains, they are less pronounced compared to those with transformer-basee ventral backbones.
active systems demonstrate significant im-
Key takeaway Across various transferred adversarial samples, an active vision system consistently improves upon the underlying passive ventral stream for both CNN and Transformer based architectures. However, this approach shows limitations when applied to adversarially trained ventral streams (FALcon-AdvT) indicated by Figure 5 (a), highlighting the need for further research into adversarially trained active dorsal networks. In Appendix A.1.2 we provide an additional discussion on adversarially trained models.
In the following sections, we present the primary factors contributing this enhanced robustness: processing inputs down-sampled resolution (Section 4.3 and performing inference from different fixation points
(Section 4.4
11

---

Published in Transactions on Machine Learning Research (12/2024)
Table 3: Effect of glimpse-base based learning on downsampled resolutions.
PGD
MIFGSM
Setting
Surrogate
Target
Resolution
(96,96)
(128, 128)
(96,96)
(128,128)
ResNet50
52.42
64.42
52.42
64.42
Clean
GFNet
75.88
76.70
75.88
76.70
ResNet50
46.03
54.10
41.05
45.73
ResNet34
GFNet
57.82
55.46
48.60
44.72
2
ResNet50
46.00
51.41
41.07
42.31
ResNet50
GFNet
51.85
45.98
42.16
34.76
ResNet50
13.24
19.64
8.17
12.33
ResNet34
GFNet
34.40
36.24
24.30
24.95
3
ResNet50
0.30
0.13
0.35
0.16
ResNet50
GFNet
17.96
12.12
10.63
6.80
4.3 Effects of glimpse- based downsampling (case study: GFNet)
In this section, we use GFNet to explore how learning image representations based on glimpses at down- sampled resolution contributes to the inherent robustness. Downsampling inherently causes reduction in features. Adversarial imperceptible noise is crafted based on the image in ils original resolution (e-g. 224 x 224). Hence downsampling the image, distorts the noise along with it, thereby reducing its overall impact on predictions. As result, it probable to think that an inherent robustness offered by models processing an image via downsampled resolution stems from the distortions on the non-uniform adversarial noise. To analyse this factor we organize experiments this section into settings:
Setting 1 Effect of processing dounsampled clean images Images from the test set are used for evaluation without any adversarial attack. The images downsampled to (96, 96) and (128, 128) and inference is performed.
Setting 2 Reduction of efficacy of adversarial noise post doumsampling: Adversarial images are first generated from full resolution images of (224, 224) and then downsampled to (96, 96) and (128, 128), separately, for inference. for an active vision method such as the GFNet, this an inherent step of their learning and inference pipeline. However, for passive vision methods, we resize the adversarial inputs to match the resolutions separately.
Setting 3 Generating adversarial attacks on dounsampled images The images are downsampled to lower resolutions first and then adversarial inputs are generated. These adversarial downsampled inputs then passed for inference on both passive and active target models. Since downsampling is performed first, the adversarial effect is not downgraded.
For the passive target baseline, we use a ResNet50 pre-trained on ImageNet at resolutions of 224 x 224. For GFNets, we infer with two separate models trained on 96 x 96 and 128 x 128 resolutions. Notably, we maintain consistency by evaluating GFNets on images of matching resolutions. To illustrate downsampling effects, passive basclines are tested on downsampled images of and 128 resolutions (scc Table 3 For simplicity, we further refer to GFNets trained on 96 96 dimensions as 'GFNet-96".
Results Table 3 presents quantitative results, focusing Acc.- The best performing models high- lighted in bold. For Setting 1, passive model trained on a higher resolution suffers drop in performance when evaluated al dlonnsampled inpul, unlike GFNets trained for downsampled resolutions. Setting 2 shows that simply downsampling adversarial images to lower resolutions is beneficial. This indicates along with the image resolution, the imperceptible adversarial noise also probably gets downsampled thereby reducing its effect on model predictions even when T, is same S.. Furthermore, under this setting, GFNet-96 ex- hibits greater inherent. robustness than GFN when compared to their corresponding passive baselines.
12

---

Published in Transactions on Machine Learning Research (12/2024)
Initial
Potential
Correct
Incorrect
Clean
Adversarial
(1)
(2)
(a)
(b)
(c)
(d)
(e)
Figure 6: Figure illustrates Initial Fixation Point Maps (IFPM) to show the efficacy of performing inference from multiple fixation points. An IFPM is a visual representation that depicts the spatial locations of the initial starting positions of FALcon. (b) illustrates all initial fixations points via gridding for both clean and adversarial inputs. (c & d) show the potential and evaluated initial fixation points for clean sample. Similarly, (e & f) show the same for adversarial sample. An evaluated IFPM can consist of both correct and incorrect points as denoted by 2f. Adversarial noise spreads non-uniformly across an image and affects different initial points differently. This is indicated by the reduced number of potential (c to e) and correct. points (d to f) from a clean to an adversarial sample. Still, the presence of positive number of correct points (I) underscores the inherent robustness an active method.
For Setting 3, it is evident that all target models suffer drop in performances indicating that generating adversarial inputs resolutions corresponding to target models leads to more potent attacks. Remarkably, GFNet-96 and GFNet-128 demonstrate performance improvements close to 3x and 2x, respectively for ResNet34 as S, compared to their corresponding passive baselines on downsampled adversarial samples. This further emphasizes the effectiveness learning in a downsampled regime even under the presence of adversarial attacks.
4.4 Effect of distinct fixation points (case study: FALcon)
In this section, we use FALcon to demoustrate the eflect of processing an image from distinct fixation points on the robustness of active vision methods. The capability of FALcon to consider various fixation points is used extract interpretable visualization results. Moreover, since the ventral model is not fine-tuned during training, it allows for fair comparison with passive bascline network.
4.4.1 Initial Fixation Point Map
In order understand the impact of adversarial noise on regions of the image that influence model pre- dictions, define Initial Fixation Point Map (IFPM). IFPM displays the distribution of initial fixation points based on how each of them affects the decision-making of FALcon throughout the inference process. Figure d shows IFPMs generated for both clean and adversarial images. As described in Section 3.1 FAL- con processes every input from multiple ini fixation points. Red dots indicate all initial fixation points, equally distributed over the image dimensions. Each point is then presented to the dorsal, which retains only those, indicated by blue dots, that potentially resulted the capture of an object through the series of expanding foveated glimpses.
The ventral processes the final foveated glimpses that resulted from potential points to determine the class label of an object. As result, various fixation points result in FALcon making correct incorrect output predictions, indicated by green and magenta dots, respectively. By obtaining IFPM for clean and adversarial versions of the same image, we illustrate how the adversarial noise impacts FALcon in terms of its capacity to make correct predictions from various fixation points.
13

---

Published in Transactions on Machine Learning Research (12/2024)
Benign Inputs
Adversarial Inputs
(a)
(b)
(c)
(d)
Input
ResNet34
ResNet50
FALcon
ResNet34
ResNet50
FALcon
(1)
(2)
(3)
Figure 8: The figure illustrates vulnerabilities of passive methods to adversarial samples. For passive hoth (b,c,e,f), occlusion maps are provided, highlighting areas responsible for model predictions. For FALcon (d.g), the final foveated glimpses along with the corresponding initial fixation points are presented. Even though adversarial noise affects an image non-uniformly, passive methods struggle to evade the noise they process the entire image with equal importance. Contrary, the final foveated glimpse highlights the effect of adversarial noise, guided by the corresponding fixation point.
Results IFPMs illustrated in Figur that de- spite the addition of advensarial noise, multiple ini- tial fixation points result in correct final predictions (d & f). IFPM clearly indicates the reduced num- ber of potential and correct points for an adversarial sample compared
25444
Samples
Potential
22740
0.72
20000
the corresponding clean sample (c to e) and (d to f). Due to its non-unifornity and imperceptible criteria, the adversarial noise does not allect each point equally. Hence, multiple fixation points lead to correct class predictions. This visually explains the reason for the improved performance of an active method over a passive one, supporting the quantitative results presented in the previous sec- tions. Although noise affects the method, its inher- ent processing from multiple fixations makes it less susceptible (f). In the second sample (2f), notice of magenta fixation point far away from the object. This is not present for the clean sample and is a false positive due to the addition of the noise. Yet, around the object, we can see multiple green points indicating correct prediction. This validates the hypothesis presented in the first column in Figure
Number of Samples
18931
16729
22000
Pretabn
9160
5000
Clean
PGD
MIM
Attack Figure 7: Precision of predictions: The number of po- tential and correct prediction points decreases as at- tack strength incrcases, reflecting the quantitative re- sults presented in Table 1.
2 (a).
14

---

Published in Transactions on Machine Learning Research (12/2024)
Adversarial Inputs
Fixation Point Variations Different initial fivation points produce
Correct
Incorrect
different predictions due adversarial noise.
Input
ResNet50
FALcon
FALcon
FALcon
FALcon
FALcon
(1)
(2)
The figure illustrates how the final foveated glimpse changes with different fixation points in the presence of adversarial noise. In sample (1), most predictions are correct (indicated by the solid green box), whereas in sample (2), the opposite is observed (indicated by the solid red box). This variation occurs due to the relative position of the initial fixation point and the regions most influenced by adversarial noise, as shown in the occlusion maps for ResNet50. Final foveated glimpses with larger background-tor songgrooundtt-forrrooue to-forrgoond ratio, especially when capturing adversarial noise, typically result in misprodictions by the ventral stream. Precision of predictions In addition to accuracy (Acc,-se): the ratio of correct/potentaal points serves as another metric for evaluating enhanced robustness. Here, potential points are defined as the sum of true positives (green) and false positives (magenta) as illustrated by an Initial Fixation Point Map (IFPM). For this analysis, we generated attacks on 1,000 images using ResNet34 as the suroggat model. As shown in Figure 7 the high ratio observed for clean samples decreases for adversarial samples, depending on the strength of the attack. Despite this, the persistence of high number of true positives quantitatively justiffes FALcon's improved performance on adversarial samples. This trend is consistent with the results presented in Table 1 for iterative attacks.
Figure 9:
4.4.2 Explaining adversarial vulnerability of passive methods
Setup As mentioned carlier, the probable cause of adversarial vulnerability the passive vision methods is that. they process an input in one-shot with uniform resolution, where every input pixel is treated with the same importance. This is visually demonstrated in this section via occlusion maps. Figure S iillustrates occlusion maps for passive methods (b,c.e.f) and the final foveated glimpse for FALcon (d.g). An occlusion map is visual heatmap indicating key regions of image when occluded, affect the model performance. The darker the region, the higher contribution it has on the final prediction. Occlusion maps are generated based on prediction labels. We first generate the adversarial sample and then generate the occlusion map based on the predicted adversarial label. We use ResNet34 as the surrogate model and PGD as the candidate adversarial attack. The occlusion maps under ResNet50 (f) are based on the transferred adversarial samples from ResNet34. Similarly, for FALcon, we present the final foveated glimpse and the initial fixation point based the transferred adversarial samples (g). Green solid boxes refer to correct predictions.
Results For the clean samples, FALcon correctly predicts all three instances (d). The dark region (1c) aligns with the body of the correct class (tench), resulting in correct classification for ResNet50. But as indicated in (1f), the dark region shifts and does not align with the body of the object after the injection of adversarial noise leading to an incorrect prediction. For FALcon, although the final foveated glimpse captures the corresponding dark region, the initial fixation point directed towards the head of the object (Figure 1g). This indicates that FALcon was initially guided by more salient features of the object before encountering the probable adversarial patch later. Additionally, downsampling likely mitigates the impact
15

---

Published in Transactions on Machine Learning Research (12/2024)
Catastrophic Mispredictions ImageNet-A by Passive Vision Systems
MeLcon-RRsNeele
ResNet50
Living Entities mis predicted as Non-Living Entities
Junco 31 %
Bald Eagle 85 %
Junco 49 %
Rottweiler 82
Pelican 48 %
American Robin 34
Toaster 98
Airliner 80
Wheel Barrow
Digital
Jigsaw Puzzle 49
Mis- predicting Foreground for Background
Goldfinch 35 %
Airliner %
Wheel-barrow
Jellyfish 38
Golden Retriever
Garbage Truck 90
Sea Lion 94 %
Volcano 44 %
Cliff 74
Shipwreck 98
Valley 23 %
Obelisk 95 %
Consequences per predictions
American Black Bear 35 Garter Snake 51 %
Garter Snake 33
Chameleon 91 %
Chameleon
Tarantula 47
%
Bison Starfish 57 %
Wheelbarrow 24
Acorn Grasshopper 36 % Yellow lady's slipper %
Figure 10: Figure illustrates three categories of catastrophic predictions made by passive vision systems on ImageNet-A. The correct prediction label with the final fovcated glimpse is shown in green, while mispre- diction labels are presented at the bollom of each image. In the first row, living entities are misclassified non-living entities. The second shows passive systems getting confused by backgrounds, and the third row highlights fatal consequences caused by catastrophic mispredictions.
of the adversarial patch on the dorsal stream. The final loveated glimpse captures the entire object, with the foreground occupying the majority of the glimpse, thereby minimizing the effect of the adversarial spot in the background and resulting in confident, correct prediction for the ventral stream. For (3g), FALcon similarly to ResNet50 focuses the dark region (3f) makes incorrect prediction highlighted by the red box not capturing the goldfish at all. This suggests that although less vuinerable, there is still room for further improvement for these active vision methods.
Fixation point variations The FALcon framework allows us to select initial fixation points to begin the inference process. In the first row, second column of Figure g the occlusion map reveals dark spot representing adversarial noise shown earlier. Since this noise contained in small portion of the background, multiple fixation points the body of the tench lead to correct predictions. However, in the second image, the uneven distribution of noise results in multiple incorrect final foveated predictions by the ventral stream. The glimpses suggest that the dorsal stream is misled, capturing both foreground and background, and consequently fails to effectively guide the ventral stream.
5 Natural adversarial images
Active Vision for hard samples this section, we provide insights into the enhanced adversarial robust- ness of active vision systems when applied naturally occurring images from the benchmark ImageNet-A dataset (Hendrycks et al. 2021). Unlike adversarially crafted samples, this dataset contains naturally occur-
16

---

Published in Transactions on Machine Learning Research (12/2024)
ring, unmodified images that are difficult for standard passive classifiers to classify correctly, often reducing their accuracy this challenging set to near zero. The high variability in these images arises from factors such as occlusions, unusual poses, backgrounds that confuse classifiers, or complex scenes with multiple objects where the primary object is not contrally located or is partially obscured. When humans encounter complex scenes; we assess the scene multiple times, ilerating from various viewpoints to evaluate each detail before predicting its contents. This iterative and detailed evaluation process, emulated by active vision systems, allows for better handling of the complexity and variability in ImageNet-A, a principle not shared by current passive classification networks. Hence, empirically show the need for active vision in handling hard samples.
Catastrophic mispredictions by passive classifters This is qualitatively explained in Figure 10 which shows the catastrophic nature of mispredictions made by passive classifiers on this set as opposed to FALcon. We visually categorize the nature of these mispredictions in three separate rows. The final foveated glimpse includes the initial fixation point prediction on the image, the correct active prediction in green (FALcon) at the top, and the incorrect. passive prediction in red at the bottom.
In the first row, show samples where passive methods classify living entities non-living entities, poten- tially leading to grave accidents in autonomous perception systems. The second row features samples where backgrounds have confused passive classifiers. In the third row, we present mispredictions that could be fatal for users. For example, in the second image of the third row, a passive vision system incorrectly classifying a garter snake as harmless object could prove fatal for an individual relying on the system for navigation.
Quantitative performance ImageNet-A In this scction, provide quantitalive results sup- porting the advocacy of active vi- sion for ImageNet-A. Figure [1 il- lustrates this effect. On the extreme left, a passive ResNet50 shows an accuracy of almost zero on this set, However, using the same ResNet50 as the ventral stream, FALcon im- proves performance to 5.32% (Top) and 7.47% (Any). For GFNet, this performance is 3.34%. GFNet's slightly lower performance due to its operation in a downsampled im- age regime, where images with low ratio experi- ence significant fcature shear.
Active Vision Performance on ImageNet-A
Legend
70
Baseline
FALcon-Top
FALcon-Any
GFNet
Accuracy (%)
H
Ubject-to-backgree
Previously, we observed that strong ventral stream complements the dorsal stream for enhanced robustness against. adversarially crafted samples. A similar phe- nomenon is again seen here. For CutMixxResNet5i (Yun et al. 2019) Adv-T ResNet50 (Madry et al. 2018 and Robust Vision Transformer- Tiny (Mao et al. 2021). FALcon improves perfor- from 7.00%, 1.88%, 14.12% to 10.37%, 3.79%, 17.16% (Top) and 13.72% 5.04%, 21.76% (Any) respectively, improving the performance of all passive networks by 1.5x. The efficacy of the "Any" predictions highlights the approach's 's strength for hard samples with complex scenes. Figure in Appendix Section A.2 provides qualitative intuition that aligns with the quantitative results.
ResNet50 Sup ResNet50- ResNiet50-Adv.T RVT-Plus-Tiny-Sup Ventral Stream Architecture-Training
Plot demonstrating the efficacy of Active Vision on ImageNet-A. The X-axis represents the architecture and training con- figuration of the ventral streams, while the Y-axis indicates accuracy across configurations. Active models with Supervised and CutMix pre- trained ventral streams outperform those with Adv-T pre-trained ven- tral streams.
Figure 11:
17

---

Published in Transactions on Machine Learning Research (12/2024)
Key takeaway Natural adversarial samples pose significant challenge to passive classifiers. Active vision systems, with their ability to infer objects from various fixation points and make distinct multiple predictions, significantly improve the performance of underlying passive CNN and Transformer baselines. For ImageNet- A, we observe performance improvements even with Adv-T, unlike with adversarial samples, as adversarial training has less impact on naturally challenging samples compared to adversarially crafted ones. Notably, both ResNet50-Sup and Cuttii show greater performance gains than Res-ett0-Adv-T.
6 Foreground distorted images
Human aligned active vision for foreground distortions In this section, qualitatively analyze the impact of foreground object distortions on the predictions of both active and passive vision systems. Unlike imperceptible adversarial noise that spreads non-uniformly across the image or naturally adversarial samples with varying degrees of adversity, these distortions visibly alter the structure of the foreground object.
Humans rely heavily on the structural configuration of objects to understand and identify them from various viewpoints. A visible deformation or distortion can significantly affect our confidence in recognizing an object. For instance, referring to each image in Figure 12. we may still be able to identify a golden retriever despite its parts being dispersed across the scene, though our confidence might waver. A clean image of a golden retriever might prompt confident identification, whereas distorted image might lead us to say, 'I can see a golden retriever, but in parts dispersed across the scene." It is interesting to observe how DL-based systems predict these distorted adversarial images.
This section examines the response of these systems to such distortions and compares the performance of passive versus active processing. Our objective is to assess how well these systems align with human vision in handling visible structural distortions and to demonstrate how the human-aligned perception of an active vision system leads to more stable and interpretable predictions.
Setup The upper part of Figure 12 illustrates two methods for generating foreground-distorter images: (a) Image Shuffling and (b) Composite Images. For image shuffling, we divide an image into equal-sized patches and randomly shuffle them. If the foreground-tow -o-bk--oobb ratio is high, this process structurally distorts the object. For composite images, we use the Grab-cut algorithm (Rother et al. 2004) to extract the foreground, disassociate these parts, and paste them onto random backgrounds.
For evaluation, we use passive ResNet50 and select FALcon our candidate active vision model. Unlike GFNet, which predicts based on salient object parts, FALcon captures the entire object by gradually foveating on salient features and implicitly learning the structure, stopping when no further improvement is possible. This makes FALcon idcal for analyzing whether its predictions remain human-aligned despite foreground distortions. To comprehensively assess this, we conduct two-fold paired experiments: image shuflligg and composite images. By concurrently applying these distortions, we aim to observe and compare the prediction trends of the two systems, thereby determining the robustness and human-alignment of their predictions.
Qualitative analysis For the undistorted sample of a golden retriever, both FALcon and ResNet50 make correct predictions with confidences of 75.39% and 41 41.56, respectively. After image shuffling, FAL.con makes multiple distinct predictions based on each localized part, each with lower confidence than the whole object. The face, being the most distinctive part, has the highest confidence among the parts. Low-confidence predictions (< 50%) can be thresholded, as shown in Figure 12 (c). Tn contrast, the passive classifie'ss 's con- fidence abnormally increases, a phenomenon supported by litcrature (Tao et al.] 2024 Chowdhury et al., 2024). This likely occurs because standard classifiers, trained on various image crops during data augmenta- tion, rely on specific object parts for correct prediction rather than the overall structure. Thus, even when the image is shuffled and the structure is distorted, the discriminative parts still load to strong predictions.
A similar instance is shown with a white wolf sample. For the second permulation of the image, the active method makes a categorical misprediction based on the localized facial part, identifying it as a 'Russian wolthound, which is still a 'wolf-looking' dog breed. This misprediction is interpretable and less catastrophic, as evidenced by the provided sample of an actual Russian wolfhound. Image shuffling, the first of the two fold experiment indicates that passive methods rely mostly on parts for discrimination and lack structural
18

---

Published in Transactions on Machine Learning Research (12/2024)
Foreground Distortions
Image Shuffling
Golden Retriever 75.39 %
Golden confidence
DNN
71.85 %
56.53 %
28.53 %
18.47 %
FALcon
1. Patches
Permute
Golden Retriever 41.56 %
(a)
Confidence thresholding lower
(b)
Compusite Images
confident predictions
Plastic with confidence 49.04
DNN
52.5
35.22
Saluki 24.99 %
FALcon
catastrophle inspredictions
1. Foreground extraction plus dissociations
2. Random Backgrounds
White wolf 87 %
White wolf 82
Polar bear 54 %
Permutation-1
Water
White wolf 94 %
background confuses passive classifter for biased prediction.
(a)
(c)
White wolf
Russian wolfhound 87 %
White wolf %
Schooner 17 %
(b)
White wolf 88 %
Interpretable mispredictions
Permutation-Il
White wolf 98 %
Russian wolfhound
The figure illustrates two methods of creating foreground distortions and their effects on the predictions of active and passive vision systems. In (a) Image Shuflling, the image is divided into patches and then randomly permuted. In (b) Composite Images, the foreground is extracted from the original images, dissociated into parts, and then pasted onto random backgrounds. Across these two sets of distortions, active vision systems exhibit more stable, interpretable predictions and fewer catastrophic mispredictions compared to passive vision systems.
Figure 12:
understanding. In contrast, active methods, while affected by distortions, make lower-confident correct predictions or interpretable, less catastrophic mispredictions.
In composite images, the same foreground extracted, dissociated into parts, and then pasted onto random backgrounds, which likely unfamiliar for passive classifiers associate with the foreground. As seen in both samples, passive classifiers fail miserably, making predictions that not remotely correlated with the actual foreground. On the other hand, active vision systems make lower-confidence correct predictions or interpretable, less catastrophic mispredictions based on the part localized by the dorsal stream. These predictions are also human-aligned; without seeing the original full image of a white wolf, humans might similarly infer that the parts belong to a wolf or a similar-looking dog breed like a Siberian husky or an Eskimo dog. For the corresponding composite image as well, the localized part resemble the body of a polar bear. Conversely, passive classifiers might make nonsensical predictions, such identifying a polar bear's body part schooner, type of sailing vessel, which is clearly catastrophic error.
19

---

Published in Transactions on Machine Learning Research (12/2024)
Key takeaway Thus, predictions indicate that across two different sets of foreground distortions, active sys- tems showcase more resilient, stable, and human-aligned predictions. In contrast, passive systems, with their non-structured learning, and one shot way of inference, produce confident, erratic, and often catastrophic mispredictions.
7 Conclusions
In this work, we outline a deep learning-base active vision framework and advocate for its inherent ro- bustness. Specifically, we adapt two existing Approaches-FAT.onn Ibrayev et al. (2024b) and GFNet Wang ctt al. 2020) into the active dorsal-ventral framework, demonstrating their robustness against three cate- gories: adversarially crafted samples, naturally adversarial samples, and foreground-distorteed images. In a black-box transfer attack setup, we attribute the enhanced robustness to two key factors: (1) glamese-based processing at downsampled rosolutions and (2) inference from multiple fixation points. Using GFNet, we show how downsampling mitigates the impact of adversarial noise. With FALcon, demonstrate how multiple fixation points help avoid mispredictions due to the non-uniformity of adversarial noise. Employ- ing various state-of-the-ar adversarial transfer attacks, we observe consistent performance improvements of 2-21% % over passive methods, except when using non-adversarially trained ventral networks. We extend this understanding to natural adversarial samples, which model real-world challenges like object occlusions, unusual poses, and complex backgrounds that confuse passive classifiers. FALcon's flexible framework allows swapping different ventral streams, leading to performance enhancement of 1.5x, even with an adversar- ially trained ventral stream. We further investigate the robustness of image classifiers against foreground distortions, using FALcon our active vision model due to its capability to capture entire objects in undis- turbed images. Through a two-fold experiment, we visually demonstrate how the predictions of an active vision model are stable, resilient, and more alian- compared to the catastrophic mispredictions of passive classifiers. A potential future direction will be to explore optimized white-box attacks and defense mochanisms tailored to active vision systems. This exploration could lead deeper undorstanding of how to enhance these inherently robust systems, further strengthening their adversarial robustness.
Acknowledgments
This work was supported in part by, the Center for the Co-Design of Cognitive Systems (CoCoSys), a DARPA-sponsored JUMP 2.0 center, the Semiconductor Research Corporation (SRC), and the National Science Foundation.
References
Maksym Andriushchenko and Nicolas Flammarion. Understanding and improving fast adversarial training. NewrIPS, 2020.
Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. Synthesizing robust adversarial examples. In International Conference on Machine Learning, 2017.
Sayeed Shafayet Chowdhury, Soumyadeep Chandra, and Kanshik Roy. Toward visual syntactical under- standing. IEEF Access, 12, 2024. doi: 10. Cttp:/ACCESS.2024...00
A Clark. Whatever next? predictive brains, situated agents, and the future of cognitive science. Behavioral and Brain Sciences, 36(3):181-204, 2013.
Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. In Proceedings of the 36th International Conference on Machine Learning, 2019.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free atlacks. In ICML, 2020.
Christine A Curcio, Kenneth R Sloan, Robert Kalina, and Anita E Hendrickson. Human photoreceptor topography. Journal of comporative neurology, 292( (9)(4):47-552, 1990.
20

---

Published in Transactions on Machine Learning Research (12/2024)
Joel Dapello, Tiago Marques, Martin Schrimpf, Franziska Geiger, David Cox, and James DiCarlo. Simulat- ing a primary visual cortex at the front of cnns improves robustness to image perturbations. In Advances in Neural Information Processing Systems, 2020.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. IEEE Conference on Computer Vision and Pattern Recognition, 2009.
Y. Dong, F. Liao, T. Pang, H. Su, J. Zhu, X. Hu, and J. Li. Boosting adversarial attacks with momentum. In CVPR, 2018.
Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu. Evading defenses to transferable adversarial examples by iranslation-invaiiane attacks. Proceedings of the IEEE Computer Society Conference on Computer Vision and Pattern Recognátion, 2019.
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Un- terthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby, An image is worth 16x16 words: Transformers for image recognition at scale. In ICLR, 2021.
Miguel Eckstein. Visual search: A retrospective. Journal of vision, 11(5):14-14, 2011.
Gamaleldin F. Elsayed, Simon Kornblith, and Quoc V. Le. Saccader: Improving accuracy of hard attention models for vision. In Newral Information Processing Systems, 2019.
Jonathan M Gant, Andrzej Banburski, and Arturo Deza. Evaluating the adversarial robustness of foveated texture transform module in a CNN. In SVRHM 2021 Workshop @ NeurIPS, 2021.
Lianli Gao, Qilong Zhang, Jingkuan Song, Xianglong Liu, and Heng Tao Shen. Patch wise attack for fooling doep neural network. In ECCV, 2020.
M A Goodale and A D Milner. Sight unseen: An exploration of conscious and unconscious vision. Oxford University Press, 2004.
lan J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. ICLR, 2015.
Martin Gubri, Maxime Cordy, Mike Papadakis, Yves Le Traon, and Koushik Sen. Lgv: Boosting adversarial example transferability from large geometric vicinity. In ECCV, 2022.
Anne Harrington and Arturo Deza. Finding biological plausibility for adversarially robust features via metameric tasks. In International Conference on Learning Representations, 2022.
Kaiming He, Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2015.
Kaiming He, Georgia Gkioxari, Piotr Dollár, and Ross Girshick. Mask r-cnn. In 2017 IEEE International Conference on Computer Vision (ICCV), 2017.
Dan Hendrycks, Kevin Zhao, Steven Basart, Jacob Steinhardt, and Dawn Song. Natural adversarial exam- ples. CVPR, 2021.
Byeongho Heo, Sangdoo Yun, Dongyoon Han, Sanghyuk Chun, Junsuk Choe, and Seong Joon Oh. Rethinking spatial dimensions of vision transformers. ICCV, 2021.
Hossein Hosseini and Radha Poovendran. Semantic adversarial examples. 2018 IEEE/CVE Conference on Computer Vision and Pattern Recognition Workshops (CVPRW), 2018.
Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q. Weinberger. Densely connected con- volutional networks. In 2017 IEEE Conference on Computer Vision and Pottern Recognition (CVPR), 2017.
21

---

Published in Transactions on Machine Learning Research (12/2024)
Gao Huang, Danlu Chen, Tianhong Li, Felix Wu, Laurens van der Maaten, and Kilian Weinberger. Multi- scale dense networks for resource efficient image classification. In ICLR, 2018.
Timur Tbrayev, Amitangshu Mukherjee, Sai Aparna Aketi, and Kaushik Roy. Towards two-stream foveation- based active vision learning. IEEE Transactions on Cognitive and Developmental Systems, 2024a.
Timur Ibrayev, Manish Nagaraj, Amitangshu Mukherjee, and Kaushik Roy, Exploring foveation and saccade for improved weakly-superriseed localization. In Proceedings of The 2nd Gaze Meets ML workshop, volume 226 of Proceedings of Machine Learning Research, pp. 61-89. PMLR, 16 Dec 2024b. URI. https://
proceedings. mlr. wwwppeeeepaaee gress/v226/ibrangg http://////baaa/aaaa.aa html
Aditya Jonnalagadda, William Yang Wang, B. S. Manjunath, and Miguel P. Eckstein. Foveater: Foveated transformer for image classification, 2022.
Ameya Joshi, Amitangshu Mukherjee, Soumik Sarkar, and Chinmay Hegde. Semantic adversarial attacks: Parametric transformations that fool deep classifiers. 2019 CEE//CVF International Conference Com- puter Vision (ICCV), 2019.
Hoki Kim. Torchattacks: A pytorch repository for adversarial attacks. arXiv preprint 0rX:::2010001950, 2020.
Alex Krizhevsky, Πyya Sutskever, and Geoffrey E Hinton. Imagenet classification with deep convolutional neural networks. In Advonces in Neural Information Processing Systems, 2012.
Alexey Kurakin, lan J Goodfellow, and Samy Bengio. Adversarial examples in the physical world. In Artificial intelligence safety and security, pp. 99-112. Chapman and Hal//CRC, 2018.
Michael F Land and Dan-Eric Nilsson. Animal eyes. OUP Oxford, 2012.
Lin Li and Michael W. Spratling. Data augmentation alone improve adversarial training. In ICLR, 2023.
Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song. Delving into transfcrable adversarial examples and black-box tacks.. In ICLR, 2017.
Liu, Han Hu, Yutong Lin, Zhuliang Yao, Zhenda Xie, Yixuan Wei, Jia Ning, Yue Cao, Zheng Zhang, Li Dong, Furu Wei, and Baining Guo. Swin transformer v2: Scaling up capacity and resolution. In CVPR, 2022.
Yan Luo, Xavier Boix, Gemma Roig, Tomaso A. Poggio, and Qi Zhao. Foveation-based mechanisms alleviate adversarial examples. ArXiv, 1.6692,, 2015.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In ICLR, 2018
K. Mahmood, R. Mahmood, and M. van Dijk. On the robustness of vision transformers to adversarial examples. In 2021 IEEE/CVF International Conference on Computer Vision (ICCV), oct 2021.
Xiaofeng Mao, Gege Qi, Yuefeng Chen, Xiaodan Li, Ranjic Duan, Shaokai Ye, Yuan Hc, and Hui Xuc. Towards robust vision transformer. CVPR, 2021.
Volodymyr Mnih, Nicolas Manfred Otio Heess, Alex Graves, and Koray Kavukcuoglu. Recurrent models of visual attention. In Neural Information Processing Systems, 2014.
Seyed-Mohsen Moosavi-Dezfooke Alhussein Fawzi, Jonathan Uesato, and Pascal Frossard. Robustness via curvature regularization, and vice versa. CVPR, 2018
Nicolas Papernot, Patrick Medanicl, Ian J. Goodfellow, Somesh Jha, Z. Berkay Colik, and Ananthram Swami. Practical black-box attacks against machine learning. Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Securily, 2016.
22

---

Published in Transactions on Machine Learning Research (12/2024)
Deepak Ravikumar, Sangamesh D Kodge, Isha Garg, and Kaushik Roy. Trend: Transferability based robust ensemble design. IEEF Transactions on Artificial Intelligence, 2022.
Shaoqing Ren, Kaiming He, Ross Girshick, and Jian Sun. Faster r-cnn: Towards real-time object detection with region proposal networks. In NeurIPS, 2015.
Carsten Rother, Vladimir Kolmogorov, and Andrew Blake. Grabcut: Interactive foreground extraction using iterated graph cuts. ACM Transactions on Graphics (TOG), 2004.
Muhammad A Shah, Aqsa Kashaf, and Bhiksha Raj. Training on foveated images improves robustness adversarial allacks. In Thirly-sevenlh Conference on Neural Informalion Processing Systems, 2023.
Z Shao, L Ma, B Li, and D M Beck. Leveraging the human ventral visual stream to improve neural network robustness. arXiv preprint erx:22240 2426044400 2024.
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. In 3rd International Conference on Learning Representations, (ICLR), 2015.
Christian Szegedy, Wojeiech Zaremba, Tlya Sutskever, Joan Bruna, Dumitru Erhan, Tan Goodfellow, and Rob Fergus. Intriguing properties of neural networks, 2014.
Chun Tao, Timur Ibrayev, and Kaushik Roy. Towards image semantics and syntax sequence learning, 2024. URL https://arxiv..rr http://wwwrrr/bb///1.1115..
Hugo Touvron, Matthieu Cord, Alexandre Sablayrolles, Gabriel Synnaeve, and Herv'e J J'egou. Going deeper with image transformers. ICCV, 2021.
L G Ungerleider and J V Haxby. 'what' and 'where' in the human brain. Current Opirioon in Neurobiology, 4(2):157-108 165, 1994.
Manish Reddy Vuyyuru, Andrzej Banburski, Nishka Pant, and Tomaso Poggio. Biologically inspired mech- anisms for adversarial robustness. In Advances in Neural Information Processing Systems, 2020.
Xiaosen Wang and Kun He. Enhancing the transferability of adversarial attacks through variance tuning. CVPR, 2021.
Yulin Wang. Kangchen Lv, Rui Huang, Shiji Song, Le Yang, and Gao Huang. Glance and focus: dynamic approach to reducing spatial redundancy in image classification. In Advances in Neural Information Processing Systems, 2020.
Jianwei Yang, Chunyuan Li, Xiyang Dai, and Jianfeng Gao. Focal modulation networks, 2022.
Le Yang, Yizeng Han, Xi Chen, Shiji Song, Jifeng Dai, and Gao Huang, Resolution adaptive networks for efficient inference. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 2020.
Xinli Yue, Ningping Mou, Qian Wang, and Lingchen Zhao. Revisiting adversarial robustness distillation from the perspective of robust fairness. In Thirbg-seventh Conference on Neural Information Processing Systems, 2023.
S. Yun, D. Han, S. Chun, S. Oh, Y. Yoo, and J. Choe. Cutmix: Regularization strategy to train strong classifiers with localizable features. In 2019 IEEE/CVF International Conference on Computer Vision (ICCV), 2019.
Hongyi Zhang, Moustapha Cisse, Yann N. Dauphin, and David Lopez-Paz. mixup: Beyond empirical risk minimization. In ICLR, 2018.
Jianping Zhang, Yizhan Huang, Weibin Wu, and Michael R Lyu. Transferable adversarial attacks on vision transformers with token gradient regularization. In CVPR, 2023.
23

---

Published in Transactions on Machine Learning Research (12/2024)
A
Appendix
A.1 Adversarially crafted samples
A.1.1 DesNet121 as surrogate model
We provide additional results this section with DenseNet121 Acc, is provided as the metrics for comparison.
(Huang et al. 2017 as the surrogate model.
Table 4: Transferability results with DenseNet121 as Surrogate Model
Surrogate
Target
PGD
VMI
PIFGSM
DenseNet121
ResNet50
30.91
12.33
30.45
FALcon-RResNet5--TTp
43.19
20.0
35.70
FALcon-ResNett0-AAny
47.30
23.80
39.56
Table 4 presents results using adversarial samples transferred from DenseNet121 (Huang al. 2017): architecture distinet from the ResNet family. These results, evaluated across all 50,000 test samples of ImageNet et with various iterative Linf norm attacks, demonstrate consistent improvements, further supporting our findings.
A.1.2 Discussion with adversarially trained model
In this scction, we briefly examine the role of an adversarially trained model (Madry et al. 2018 bascline in our analysis, alongside the robustness properties observed in active vision system. We present results for both adversarially crafted samples (Section 4 and naturally adversarial samples (Section 5 summarizing key insights across various types of adversarial inputs.
Accuracy on non-perturbed clean samples The clean accuracy of an adversarially trained (Adv-T) model is lower than that of a standard classifier, a known trade-off resulting from adversarial training. This effect is evident in the clean accuracy results Table
Black box transfer attack setup- In Table 1 we present Adv-T* as an oracle method, trained to defend against worst-case perturbed samples within the L-o0 norm ball. The model shows minimal performance drop, even as the potency of adversarial attacks varies, with negligible decline compared to nominal accuracy. Therefore, a black-box transfer attack sctup not the most effective approach for testing such a robust model.
Comparison with active vision systems- Table [ we can see For attacks like PGD and MIM, GFNet outperforms Adv-T*, while FALcon-CutMix shows stronger performance on PGD and PI- FGSM attacks. However, active vision systems with non-robust ventral methods, such as CutMix ResNet50 and supervised ResNet50, as well as these passive ventral methods alone, experience noticeable performance drop compared to clean accuracy, with results varying based on the atlack's strength. This approach effectively highlights key performance trends for analysis.
Active vision system with Adv-T as ventral method In Figure 5 (a), for transferred attacks from LGV, we observe noticeable improvements when adversarial samples are transferred from a surrogate supervised ResNet50, as highlighted in Section However, for clean samples, there is a slight improvement.
Natural Adversarial samples- In Section 5 we show that for naturally hard samples, passive adversarially robust. Re performs worse than a passive CutMix ResNet50. When integrated into an active setup, the framework improves performance on these samples; however, the gain is smaller than that achieved with CutMix or supervisod ResNet50 the same sctup. This reflects the limitations adversarially trained models face with naturally occurring samples, a drawback not shared by inherently robust active vision systems.
24

---

Published in Transactions on Machine Learning Research (12/2024)
Dorsal-Surrogate Adversarial sample
Surrogate
Model
(a)
f
Dortav-to-Active
White box
Transfer
Active Vision System
Distinct Predictions
Attack
fv
Ventral-to-AAtive
Clean Sample
fv
(b)
Surrogate
Model
Ventral-Surrogote Adversarial sample
Figure 13: The figure illustrates the impact of generating adversarial samples using surrogate models with architectures matching cither the dorsal or ventral networks. The adversarial sticker each sample high- lights the concentration of adversarial noise, depending whether the dorsal or ventral network was used as the surrogate. 'Dorsal-to-Activee (a) indicates an adversarial sample generated using the dorsal surrogate model and then transferred to attack the active vision system, with a similar setup applied for the ventral model (b). Only one transfer attack generated each time. The distinct predictions reveal the variation in responses due to the different adversarial samples.
This discussion highlights that while an adversarially robust model serves as a strong baseline for adversarially crafted scenarios, it has drawbacks when applied to clean and naturally hard samples, as it is optimized for worst-case perturbations, In contrast, the bio-inspired active vision system demonstrates inherent robustness across diverse adversarially crafted and naturally hard samples, showing substantial gains by improving upon the underlying passive ventral stream. These two approaches orthogonal: the adversarially robust model provides best-case performance on specific optimized inpuls, while the active vision system delivers gains across a broader range of input types without being optimized for any particular kind.
A.1.3 Transfer attacks illustration
This section details the sctup outlined in Table 2 under Section 4 In a black-box transfer attack sctup, the specific configuration of the underlying model remains unknown. However, to evaluate the efficacy of the active vision system, we generate adversarial samples by transferring attacks using surrogate dorsal (fD) and ventral (fv) streams. For FALcon, fn represented by VGG16, and fv by ResNet50, as described in Section 4.2 This approach allows to assess which stream serves more effective surrogate for adversarial sample generation. The lower section of Table [ presents results when samples are crafted based on the ventral stream, ResNet50. Similarly, for Large Geometric Vicinity (LGV) (Gubri et al.) 2022). transferred samples are generated using the surrogate ventral stream (ResNet50), with results illustrated in Figure (a).
A.1.4
Transferability from Large Geometric Vicinity (LGV)
The paper introduces technique called Transferability from Large Geometric Vicinity (LGV) Gubbi al., 2022 to enhance the transferability of adversarial attacks in black box transfer setup. This is illustrated in Figure 1 of (Gubri et al.) 2022). The method starts with initial pretrained surrogate model and gathers multiple weight sets for few additional training epochs with constant and high lcarning rate. This is done to enhance the geometric diversity of the surrogate models within a wide weight optimum. A wide weight optimum refers to a region the weight space of a neural network where many configurations of weights result in similar, low loss values. In this region, the loss landscape flatter or broader, mcaning that small changes in the weights do not drastically increase the loss. Wide optima are often preferred because they represent solutions that more likely to capture general patterns in the data rather than overfitting
25

---

Published in Transactions on Machine Learning Research (12/2024)
to specific instances. This increases the likelihood of finding adversarial examples that are transferable to different models. Thus this approach leverages two geometric properties related to transferability:
Wider Weight Optima: Models situated within broader weight optimum serve as more effective surrogates.
Effective Surrogate Ensemble Subspace: Identifying a subspace within this wider optimum facilitates the crcation of an effective surrogate ensemble.
In our experimental setup in 4 we use ResNet50 as the surrogate model, matching the ventral stream of FALcon. Additionally, ResNet50 aligns with the feature encoders of GFNet, serving as feature extractors for both the ventral and dorsal streams. The results are presented
A.1.5 Token Gradient Regularization (TGR)
The TGR method, introduced in (Zhang et al. 2023 provides gradient based transfer attack algorithm for Vision Transformers (ViT) (Dosovitskiy et al. 2021 and its variants such as Class-Attention in Image Transformers (CaiT) (Tovroon et al. 2021] and Pooling based Vision Transformer (PiT) (Heo et al., 2021 This algorithm, represented as TGR(-) removes tokens with extreme values and reduces variance in back- propagated gradients. It utilizes token gradient information from both the Attention and Query-Key- Keyaaeee Value components within an attention block, as well from the MLP component within the MLP block, to generate adversarial samples Gradadv- This is illustrated in Figure 1 of (Zhang et al. function combines gradient information as follows:
2023
The TGR
Gradado = TGR(GraddRv Gr, GradMLP,k,
adv adv I++
sgn(Gradado))
(3)
Here, k denotes the top-k bottom-k imput gradients with highest and lowest values respectively which denote the extreme tokens. The scaling factor for gradients is and a is a hyper-paramcter to control the step size. This method is effective against CNN models as well. And hence forms a strong transfer attack for both CNN and Transformer based backbones.
A.1.6 Surrogate models for Token Gradient Regularization (TGR)
We follow the experimental setup of the original Token Gradient Regularization paper (Zhang et al., 2023 for selecting surrogate architectures. This paper demonstrated that transferable attacks, leveraging back- propagated gradients through attention blocks in specific surrogate vision transformers, are highly effective against other target vision transformer models. Additionally, it showed that transformer-based adversarial samples can successfully transfer to CNNs, making this approach effective for attacking CNN models as well. Following their setup, we chose a Vision Transformer (ViT) (Dosovitskiy et al. 2021) and its variants, including the Pooling-based Vision Transformer (PiT) (Heo et al. 2021) and Class-Attention in Image Transformers (CaiT) (Touvron et al. 2021), surrogate models. We provide some intuition regarding the surrogate models.
VIT The Vision Transformer (VIT) architecture splits an image into fixed-size patches, treats each patch as a token, and applies a standard transformer model to these tokens, enabling direct application of transformer layers image data without convolutional processing. In VIT-B/16, "B" stands for the Base model size, indicating a standard configuration with 12 transformer layers, and '16" refers to the patch size (16x16 pixels) into which the image is divided before processing.
The Pooling-based Vision Transformer (PiT) modifics the Vision Transformer architecture by adding pooling layers between transformer blocks, which gradually reduce the spatial dimensions, similar to CNNs. This pooling improves efficiency and generalization. In PiT-B, the 'B" stands for
PiT
26

---

Published in Transactions on Machine Learning Research (12/2024)
Benign Inputs
Adversarial Inputs
Input
(b)
SwinV2
(c)
FALcon
(d)
SwinV2
(e)
FALcon
The figure illustrates the effects of adversarial noise from the TGR attack using the surrogate CaiT-S/24 transformer architecture. The target models include passive, ventral-only Swin V2 transformer and active vision model with FALcon's VGG16 dorsal and the same Swin V2 transformer ventral. Similar to Figure 8, this figure shows visualizations where the passive model is consistently misled, focusing darker background regions rather than the intended foreground,
Figure 14:
seen in occlusion maps under column (d). Although the active system is impacted by the adversarial noise evident from the differing bounding box predictions compared to the benign inputs in column (c), it still guides the ventral stream to the correct classification in column (e).
Base model size, indicating a standard configuration with a specific number layers and attention heads.
CaiT The Class-Attention in Image Transformers (CaiT) enhances the standard Vision Trans- former by introducing class-attention layers the end of the network, which focus on aggregating global information for classification, and LayerScale mechanisms within each transformer block, which help stabilize deeper models by scaling the outputs of layers for better training. In CaiT- S/24, 'S' stands for Small model size, indicating smaller configuration with fewer parameters, and '24" specifics the number of transformer layers in the network. This setup enables CaiT to go deeper while remaining stable and efficient.
While ViT-B uses 12 layers, CaiT-S/24 uses 24 layers, which makes CaiT-S/24 a deeper model despite being labeled as "Small" (S) due to its elficient configuration.
A.1.7 Target models for Token Gradient Regularization (TGR)
In this subsection, we provide some intuition regarding the transformer based target models for the TGR setup Figure (c). For transformer based target ventral models, we use Swin Transformer V2 (Liu et al. 2022), Robust Vision Transformer (Mao et al., (2021), and Focal Modulation Networks (Yang al. 2022). And mentioned in Section 4 we use the tiny versions of these transformers for evaluation.
27

---

Published in Transactions on Machine Learning Research (12/2024)
Benign Inputs
Benign Inputs
Adversarial Inputs
Adversarial Inputs
stream affected localizes object.
The dorsal stream, impacted by adversurial noise, shifts focms the background. This lends ventral make an incurrect prediction.
additiion of adversarial noise, the ventral stream makes an incorrect prediction.
Figure 15: The figure highlights failure modes of a dual-stream active vision system. In both columns, the top row shows correct predictions on benign inputs, while the second row visualizes mispredictions. On the left, mispredictions occur when the ventral stream is impacted by adversarial noise, despite correct localization by the dorsal stream. On the right, adversarial noise affects the dorsal stream, shifting its focus to the background, leading the ventral stream to misclassify based features from this misdirected region.
Swin V2 The Swin Transformer V2 an updated version of the Swin Transformer that processes images shifted windows, cnabling efficient hicrarchical feature extraction. This design enhances image classification by effectively capturing both local and global features within the image.
RVT Robust Vision Transformer identified weaknesses transformer models for adversarial ro- bustness and introduced novel techniques, such as position-aware atlention scaling and patch-wise augmentation, to enhance robustness across various shifts. These innovations make RVT more resilient vision transformer, especially under adversarial and distributional shifts.
Focal Mod Focal Modulation Networks introduce focal modulation mechanism that replaces the conventional self-attention approach, aligning more closely with human-like foature-based attention instead of spatial attention. This approach enhances the model's ability to learn aligned features, resulting in a stronger learned representation for various vision-based tasks.
For target ventral architectures in a teansformer-basedd transfer attack, such as TGR, we selected an improved standard Vision Transformer Swin V2, a robust vision transformer in RVT, and the Focal Modulation Network, which inspired by neuroscience for enhancod fcature representation. For each ventral model, we added FALcon's learned VGG16-based dorsal stream (fn) to create active vision counterparts. FALcon- SwinV2-Ting refers to dual stream active vision system, with SwinV2-Tin ventral stream fv and FALcon's is VGG-16 based fo dorsal stream. Figure 5 (c) illustrates these improvements, showing consistent trends similar to those observed with CNN-based transfer attacks and ventral backbones.
A.1.8 TGR visualizations
We have included additional visualizations using TGR with CaiT-S/24 the surrggtte architecture. The target model comprises a passive Swin Transformer V2 Liu et al. (022) and an active vision model com- bining FALcon's VGG16 dorsal stream with the same Swin V2 as the ventral stream. Figure [4] presents occlusion map visualizations similar to those in Figure g while Figure [5 illustrates failure modes critical understanding active system behavior. Figure demonnttrats generalization of the visualizations from CNN-based iterative attacks on CNN targets a similar transformer-bast based scenario, showing consistent effects in this setup.
28

---

Published in Transactions on Machine Learning Research (12/2024)
Employing a more robust ventral stream rectifies mispredictions
Ventral
ResNet50-Sup
ResNet50-CutMix
ResNet50-Sup Fox Squirrel 9 %
ResNet50-CutMix
Active
Flatworm 36 %
Sta 85 %
Lion 41 %
(a)
Passive
Nail 69 %
Stick Insect 59 %
Bald Eagle 10 %
Fox Squirrel 64 %
Active
Porcupine 39 %
Bear 39 %
Submarine 37
Alligator 61 %
(b)
Passive
Bald Eagle 43 %
Bald Eagle 48 %
Submarine 97 %
Submarine 37 %
Figure 16: The dorsal stream captures the object in all cases, and better ventral stream improves upon the predictions. The SraNee50-CCutMe ventral stream rectifies mispredictions made by ResNed50-Sup ventral stream. The quantification of this effect is shown in the bar plot on in Section 5.
A.2 Natural adversarial Images
The figure 16 shows qualitative results, with ventral stream training configurations and passive incorrect predictions displayed the bottom of each image. CutMix, being more robust ventral stream than a standard ResNet50, improves predictions, with the stable dorsal stream correctly localizing objects in all cases.
29


Reviews:
[{"review_id": "ubOQajOVEp", "reviewer": "Reviewer_MhiE", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths\n\nDescription of multiple adversarial inputs is good.\n\nI generally think the hypothesis is good and interesting and worth exploring.\n\nThe fixation map analysis is interesting and highlights the hypothesis being tested with these model architectures.\n\nWeaknesses\n\nWhile I feel like the description of FalCON is useful for the reader, Figure 3 is essentially what is presented in Ibrayev et al, 2023. Not only did it create this method, it simultaneously discusses the link to foveation and saccade. The same is true for GFNet (Wang et al, 2020). Moreover, I think some description of FalCON and GFNet are helpful, but they are too long for a paper which should largely be novel contribution by you.\n\nThere’s a number of acronyms or datasets that are never defined. Are there citations for Swin2 or RVT? I think some definition or intuition on PiT-B, ViT-B/16 or CaiT-S/24 would be helpful. For those in the field, it may be obvious, but in the future, these baselines will surely change.\n\nI think table 2 would benefit from at least one comparison to a passive classifier that is robust to adversarial inputs, like those outlined by the author at the bottom of page 2.\n\nThere are just a lot of model architectures floating around, and it’s unclear why each were chosen for the respective task: ResNet34, ResNet50, VGG, VIT, CAIT, PIT.\n\nIn Section 4.3, “Hence downsampling the image, distorts the noise along with it, thereby reducing its overall impact on predictions.” Is there any reason why images are downsampled for GFNet except to be computationally efficient? This downsampling step doesn’t seem necessary for Dorsal & Ventral processing, and is just an artifact of GFNet. Moreover, why isn’t the adversarial component just applied to the downsampled images?\n\nIn Figure 8, as a human, I don’t even know what item (3) is supposed to be classified as. This is the same for Figure 9. Generally, this analysis is very bespoke and difficult to assess how generalizable it is.\n\nThis paper is also quite long and could be pared down substantially, or items moved to the supplement.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The authors hypothesize that dorsal/ventral image classification algorithms are likely robust to adversarial inputs. They then test this hypothesis with previously published GFNet and FALcon architectures.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "There’s too much text in Figure 1. If the figure legend is not sufficient to explain what the diagrams show, the message needs to be pared down and refined. Just something simple: Dorsal stream = localize object, ventral stream = classifies object. As a computer vision engineer without extensive neuroscience background, I have to keep referring back to understand this work.\n\nFigure 5 needs to be more digestible by the reader. There’s a lot of acronyms, and it’s unclear what each of the models and datasets are. \n\nIn Figure 5b,c, the figure legends are on top of the result bars. Do these have to be bars? Can it just be a scatter plot? This would be similar to 5a, but without the lines\n\nFor Table 1 and Table 2, it would be great to compare to other robustness approaches, many of which are cited at the bottom of page 2.\n\nFigure 11a’s color palate and grid is inconsistent with other paper figures.\n\nIt’d be great to have some visualization of what Large Genometric Vicinity and Token-Grandient Regularization attacks look like, potentially in Figure 5.\n\n“For FALcon we employ VGG16 Simonyan & Zisserman (2015) as the dorsal f_{D} stream…” - Why VGG? This is not the best architecture.\n\nWhat is the MIM attack? I don’t see it defined.\n\nFigure 7 needs more of a figure legend–”Predictions of predictions” is not sufficient.\n\nThe fixation map analysis is interesting–aren’t these related to the Saccadic Points defined in Figure 1? It feels like that vocabulary word stopped being used.\n\nFigure 10 is superfluous–why is this figure needed to understand subsequent analysis?\n\nAgain, figure 11 would benefit from any other algorithm that has been proposed to be robust to adversarial inputs.\n\nEditorial Changes\n\nSlight nit: I think the vocabulary words: foveation, saccades, dorsal, and ventral can be introduced and defined in the introduction, not the abstract. (Not critical though)", "broader_impact_concerns": "Adversarial inputs to images have been thought of as methods to preserve anonymity for people that do not want to be subject to automated classification or detection, particularly for surveillance purposes. Here you are providing algorithms to subvert these protections.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "WYXBe0C79Q", "reviewer": "Reviewer_zPwx", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n\n- The findings are interesting but not too surprising. However, I see a that the community could profit from these experiments.\n- The paper is well-written and I like the short key takeaway sections very much.\n- The authors extensively describe necessary background in active vision systems (i.e., the FALcon and GFNet architectures and their biological motivation) which makes the paper self-contained.\n\nWeaknesses:\n\n- (W1) In my opinion the performed experiments could be more detailed to further back the claims made in the paper:\n    - (W1.1) The main result table (Table 1) are interesting but I would suggest that the authors evaluate also evaluate a whitebox attack scenario where adversarial perturbations are directly calculated for the model. It would be interesting if the robustness claims made by the authors also hold in this setting.\n    - (W1.2) The chosen attack methods discussed in Section 4.2 is debatable. In my opinion, there is too much focus on FGSM/PGD attacks and their variants. I am missing evaluation of other well-established attacks like the Carlini-Wagner attack [1] or universal adversarial perturbations [2].\n    - (W1.3) Table 1 shows ResNet50 perturbations evaluated on a ResNet50 architecture (target and surrogate model are the same). Would it not be more interesting to evaluate the ResNet50 perturbations on a ResNet34 architecture instead?\n    - (W1.4) Results in Section 5 and 6 are only backed by examples and is missing an extensive quantitative evaluation.\n    - (W1.5) The title of the paper is in my opinion an exaggeration. The authors show that active vision systems are slightly more robust than passive models but not that they are completely robust to adversarial attacks. I would suggest that the authors consider a title that describes what is done in the paper and is less flashy.\n- (W2) Add some sentences that explain the intuition for the used transfer attacks (LGV and TGR).\n- (W3) Overall, the paper needs further polishing before it can be published. The type-setting can be improved at many places (see requested changes for some examples).\n\nReferences:\n\n[1] Carlini, Nicholas, and David Wagner. \"Towards evaluating the robustness of neural networks.\" *2017 IEEE symposium on security and privacy (SP)*. IEEE, 2017.\n\n[2] Moosavi-Dezfooli, Seyed-Mohsen, et al. \"Universal adversarial perturbations.\" *Proceedings of the IEEE conference on computer vision and pattern recognition*. 2017.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper discusses the adversarial robustness of active vision systems. These active vision systems are inspired by neuroscience and perform identify features by “actively switching between multiple fixation points”. This happens by using two pathways: the dorsal pathway, that focusses on where the object is and the ventral pathway which is used to classify the object. Two existing active vision methods are used in the paper: FALcon and GFNet. The authors analyse how robust these active vision models are to adversarial attacks (in detail, transfer attacks that calculate an adversarial perturbation on a surrogate model). It is shown that these active vision models are somewhat more robust to adversarial examples than deep learning models that process the image in a single forward pass (e.g., the ResNet). Furthermore, the robustness to natural adversarial images and foreground distorted images is discussed.", "claims_and_evidence_yn": "No", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "- Address weaknesses (W1.1)-(W1.5).\n- Address weakness (W2)\n- Further polish the paper (W3). Here are some suggestions on how to do this:\n    - The figures are very helpful in explaining the work but have very low resolution. Also, captions are sometimes to small. There are typos („mis prediction“) and some figures can be further improved (e.g., the frames of the heatmaps in Figure 8 look uneven)\n    - The definition of the accuracy (Equation 2) is wrong. Here Iverson brackets or an indicator function should be used around the expression $T_i(x_{advj})=y_j$. Also, $x_{advj}$ is a bad choice for a variable name. Furthermore, the $Acc_{s\\rightarrow t}$ should be included in the equation. What is meant with $s\\rightarrow t$?\n    - Fix the following typographic issues:\n        - Capitalization of section titles is somewhat inconsistent (e.g., “Natural Adversarial images”). Also, words like “Active Vision” or “Active Localization” are sometimes capitalized for no reason.\n        - Citations are wrongly formatted almost everywhere: I suggest authors use the Latex commands `\\citep{}` and `\\citet{}` to properly include the citations in the sentence.\n        - Paragraph titles are sometimes followed by a “:”.\n        - Optional: It would be better if references mention the long conference name instead of the abbreviation (e.g., ICML).\n    - Table 2 is too wide.", "broader_impact_concerns": "No concerns.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "Qa9FgnWiZe", "reviewer": "Reviewer_6bhc", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "S1: I think is is excellent how this paper tests against adversarial examples in the form of pixel perturbations, natural adversarial images, and foreground distortion. I also think that it is great that CNNs and transformers were used.\n\nS2: I find the paper to be very thorough and to have high quality experiments. I am struggling to think of ideas for things to include that were not already done. Nonetheless, see below. \n\nS3: It's well-written with high-quality figures\n\nWeaknesses: I think that the right way to understand this paper is as a basic science one. I'm reviewing it as such. But it would have also been nice to compare and/or compete with SOTA adversarial training and randomized smoothing baselines.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "Summary: This paper works to design an inherently adversarially robust artificial vision systems using inspiration from biological vision. Specifically, they implement an artificial version of dual stream dorsal (where) and ventral (what) vision system in which images are processed as a series of random saccades. This can naturally handle threats involving distractor objects. Their implementation based on FALcon and GFNet incorporates foveation and saccades.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "Minor: consider citing [https://arxiv.org/abs/1511.06292](https://arxiv.org/abs/1511.06292)\n\nMinor: Consider adding a figure to illustrate the attacks in table 2. \n\nMajor: Figure 3 is almost unreadable because of text size. Also figure 11a. \n\nMedium: I think that this paper does enough. But I also idealistically wish that somewhat more had been done to find flaws with their methods -- perhaps attacks optimized under transformations (e.g. foveation) and that targeted salient features?", "broader_impact_concerns": "Concerns: None\n\nOverall thoughts: I think that this paper is clearly of a high quality. With some minor changes, I believe that it would be ready for publication. I think that it will be valuable to the vision and robustness fields. Unfortunately, I have not followed vision robustness research closely in the past two years, but based on my knowledge, this paper seems like it will provide distinct value.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: The paper investigates whether an active vision based system, abstractly inspired by the human visual processing stream, is more robust against black box adversarial transfer attacks (i.e., the adversarial inputs were not crafted with gradient access to the model under test). The paper finds that this is indeed the case, which may be due to at least two main aspects: one, the model uses multiple "fixation points", and discards information outside these fixation points, and two, the model uses downsampled patches at these fixation points. Downsampling can be interpreted as a low-pass filter operation, which can be effective against many adversarial attacks that use high-frequency patterns, and similarly the sequential nature of the active vision model is not considered explicitly by most adversarial attacks. Accordingly, the paper finds good empirical results against a number of different black-box transfer attacks. Whether there would be any gains against attacks with gradient access that specifically target the sequential active vision system, remains an important open question (that is beyond the focus of this paper).

I agree with the reviewers that the paper is ready for publication at TMLR and that it is interesting for the wider community - ideally also to spark more work on the aspects that the paper does not answer. The paper is well written and includes a good description of the two main prior methods and the adversarial attacks used, as well as an interesting discussion of insights from human neuroscience that are relevant for computer vision, both of which add value to the community beyond the specific findings.
Decision: Accept (poster)