Title: Spatial-frequency channels, shape bias, and adversarial robustness
Venue: NeurIPS 2023
Accepted: yes
Keywords: object recognition

critical band masking

spatial-frequency channels

shape bias

adversarial robustness
Abstract: What spatial frequency information do humans and neural networks use to recognize objects? In neuroscience, critical band masking is an established tool that can reveal the frequency-selective filters used for object recognition. Critical band masking measures the sensitivity of recognition performance to noise added at each spatial frequency. Existing critical band masking studies show that humans recognize periodic patterns (gratings) and letters by means of a spatial-frequency filter (or "channel") that has a frequency bandwidth of one octave (doubling of frequency). Here, we introduce critical band masking as a task for network-human comparison and test 14 humans and 76 neural networks on 16-way ImageNet categorization in the presence of narrowband noise. We find that humans recognize objects in natural images using the same one-octave-wide channel that they use for letters and gratings, making it a canonical feature of human object recognition. Unlike humans, the neural network channel is very broad, 2-4 times wider than the human channel. This means that the network channel extends to frequencies higher and lower than those that humans are sensitive to. Thus, noise at those frequencies will impair network performance and spare human performance. Adversarial and augmented-image training are commonly used to increase network robustness and shape bias. Does this training align network and human object recognition channels? Three network channel properties (bandwidth, center frequency, peak noise sensitivity) correlate strongly with shape bias (51% variance explained) and robustness of adversarially-trained networks (66% variance explained). Adversarial training increases robustness but expands the channel bandwidth even further beyond the human bandwidth. Thus, critical band masking reveals that the network channel is more than twice as wide as the human channel, and that adversarial training only makes it worse. Networks with narrower channels might be more robust.

Spatial-frequency channels, shape bias, and adversarial robustness

Abstract

What spatial frequency information do humans and neural networks use to recognize objects? In neuroscience, critical band masking is an established tool that can reveal the frequency-selective filters used for object recognition. Critical band masking measures the sensitivity of recognition performance to noise added at each spatial frequency. Existing critical band masking studies show that humans recognize periodic patterns (gratings) and letters by means of a spatial-frequency filter (or 'channel') that has a frequency bandwidth of one octave (doubling of frequency). Here, we introduce critical band masking as a task for network-human comparison and test 14 humans and 76 neural networks on 16-way ImageNet categorization in the presence of narrowband noise. We find that humans recognize objects in natural images using the same one-octave-wide channel that they use for letters and gratings, making it a canonical feature of human object recognition. Unlike humans, the neural network channel is very broad, 2-4 times wider than the human channel. This means that the network channel extends to frequencies higher and lower than those that humans are sensitive to. Thus, noise at those frequencies will impair network performance and spare human performance. Adversarial and augmented-image training are commonly used to increase network robustness and shape bias. Does this training align network and human object recognition channels? Three network channel properties (bandwidth, center frequency, peak noise sensitivity) correlate strongly with shape bias (51% variance explained) and robustness of adversarially-trained networks (66% variance explained). Adversarial training increases robustness but expands the channel bandwidth even further beyond the human bandwidth. Thus, critical band masking reveals that the network channel is more than twice as wide as the human channel, and that adversarial training only makes it worse. Networks with narrower channels might be more robust.

1 Introduction

The world can be visually perceived at many possible resolutions. It contains large and tiny objects, with coarse and fine features, so viewing it at different resolutions amplifies different features. Everyday human activities like reading, driving, and social interaction rely heavily on our ability to recognize objects. While doing so, what resolutions do we 'see' the world in? Answering this question will help us understand what features are useful for object recognition.

Spatial frequency of noise (cycles/image)

1.75

3.5

7.0

14.0

28.0

56.0

112.0

Noise standard deviation

0.0

0.02

0.04

0.08

0.16

18:32

Formally, this question has been studied by examining how the brain filters visual stimuli. The visual system detects periodic patterns or gratings by means of parallel visual filters, each tuned to a band of spatial frequency [1]. Experiments by Solomon & Pelli [2], and later by Majaj et al. [3], showed that letter recognition across a wide-range of stimulus conditions (alphabets, fonts, sizes, low- and high-pass noise) is mediated by the same single, narrow (1-octave-wide) visual filter, which they called a 'channel'.

However, unlike letters and gratings, the real-world contains objects and features of various sizes, so we would expect people to make use of a wider band of spatial frequency in their recognition. Using a critical band masking task, first developed by Fletcher to identify auditory channels [4], and later used by Solomon & Pelli to find letter-recognition channels [2], we find that surprisingly, this is not the case. People use the same channel while performing 16-way ImageNet recognition [5], making it a canonical feature of human object recognition.

This raises the question, what spatial frequencies do deep-neural-network-based object recognition systems use, and how do they compare to the human channel? Given that these networks are infamously susceptible to high-frequency adversarial perturbations, we hypothesize that their channel must be unlike the human channel. Testing neural-network-based recognizers with the same 16-way ImageNet recognition task as above, we find that this is true, across various architectures and training strategies. The neural network channel in the 76 networks we tested is at least twice as wide as the human channel.

We then ask if this large, systematic difference between humans and networks could explain two important and well-documented points of divergence in their behavior: adversarial robustness and texture-vs-shape bias. It is well known in the machine learning literature that computer vision systems are highly-susceptible to targeted noise, known as adversarial perturbation, that is often imperceptible to human observers [6]. Additionally, convolutional networks primarily rely on texture information when recognizing images [7-9] whereas transformer-based networks and humans rely on shape [9, 10]. We show here that the spatial frequency channel provides a helpful way of looking at these issues. Wang et al. [11] found that adversarial perturbations generally contain most of their power at high spatial frequencies. Moreover, Lieber at al. [12] showed that people use higher spatial frequencies while discriminating texture patches. We find that properties of the network channel correlate strongly with shape bias and the robustness of adversarially-trained networks, albeit in the wrong direction - adversarial training makes the networks' frequency-selectivity less human-like.

To summarize our contributions:

We introduce critical band masking as a task for network-human comparison. We present data from 14 humans and 76 neural networks performing 16-way ImageNet categorization in the presence of narrowband noise.

Using our data, we characterize, for the first time, the spatial frequency channel used for natural object recognition by humans and networks. Humans use the same narrow, one-octave-wide channel for objects, letters, and gratings [2, 3]. Thus, this channel is a canonical feature of human object recognition. The neural network channel, across architectures and training procedures is more than twice as wide as the human channel.

We show that three channel properties (bandwidth, center frequency, peak noise sensitivity) correlate strongly with shape bias and robustness of adversarially-trained networks. Thus, these well-documented human-vs-network differences may be rooted in differences between their spatial-frequency channel. Adversarial training increases robustness at the cost of widening the already-too-wide network channel.

Our human and network datasets as well as code required to reproduce our experiments are available publicly at https://github.com/ajaysub110/critical-band-masking .

2 Related work

Spatial-frequency channels. The visual system detects periodic patterns or gratings by means of parallel visual filters, each tuned to a band of spatial frequency [1]. Critical band masking studies [4] revealed that the same single, narrow filter also mediates the recognition of letters [2, 3, 13], faces, and novel shapes [14]. Artificial neural networks also have frequency-based preferences. They are biased towards learning low-frequency functions [15] and prone to shortcut learning in both spatial and frequency domains [16, 17]. Existing work also suggests that robustness of a network is related to its spatial-frequency preferences [11, 18-21].

Shape bias. Humans are well known to rely mainly on shape features for lexical learning and object recognition tasks [10, 7]. ImageNet-pretrained convolutional networks, on the other hand, are biased towards texture [22, 23]. Even though ImageNet-pretrained transformers, like humans, are shape-biased [9], texture-vs-shape bias of networks is thought to be influenced mainly by training data and its augmentations rather than network architecture [8].

Adversarial robustness. Adversarial attacks are small perturbations that cause inputs to be misclassified [6, 24]. Although these perturbations are often imperceptible to humans, humans can in some cases decipher adversarial examples [25-27]. Recent work suggests that adversarial robustness of networks relates to their spatial frequency tuning [28, 18, 29].

Comparing human and neural network vision. The origins of deep learning are strongly tied to neuroscience [30] and the modern convolutional network architecture was inspired by properties of primate visual cortex [31]. More recently, there have been parallel efforts both to use neural networks to improve models of visual neuroscience [32-34] and to improve network robustness by taking inspiration from the human visual system [35]. These lines of work strongly rely on recent advancements in model-human comparison metrics which compare networks and humans across behavior [36, 37] and neural representations [34, 38].

3 Methods

3.1 Critical band masking

Solomon & Pelli developed a critical band masking task (based on Fletcher's auditory masking paradigm [4]) to find the human spatial-frequency channel for letter recognition [2]. We adapted their task to find the channel used by 14 human and 76 neural network observers to recognize objects in naturalistic images. The idea behind the task is as follows. Grayscale ImageNet images were converted to low-contrast (20%) and perturbed with Gaussian noise that was filtered within various spatial-frequency bands. Threshold contrasts for 50% categorization accuracy measured independently for each spatial-frequency condition trace out a curve that describes how sensitive human letter recognition is to noise at each spatial-frequency. Bands that have high noise-sensitivity are more useful for recognition because blocking them with noise severely impairs performance. In this way, critical band masking reveals the spatial-frequency channel useful for object recognition. Fig. 1 illustrates this idea using a demo.

Images. In all our experiments, human observers recognized objects in images from ImageNet [5], a popular dataset for neural network analysis. Since memorizing all 1000 categories of the original ImageNet is intractable for human observers, we used 16-class ImageNet [22], a subset which, using the WordNet hierarchy [39], is labeled according to 16 higher-level categories: airplane, bear, bicycle, bird, boat, bottle, car, cat, chair, clock, dog, elephant, keyboard, knife, oven, and truck. Due to constraints on experiment length, we used a fixed set of 1100 randomly sampled images for all experiments, that were roughly equally distributed across all 16 categories.

Preprocessing. Images were first resized to 256 × 256 and center-cropped to 224 × 224 (the standard protocol while handling ImageNet images) (Fig. 2A) before being converted to grayscale because noise, which we will add, is ill-defined for color images. Then, they were reduced to 20% of their original contrast to ensure that adding high-strength noise would not result in pixel-clipping at floor/ceiling values which would result in the effective added noise being non-Gaussian. Fig 2B1 shows sample images after these transformations.

Noise generation and masking. To the preprocessed images, we added Gaussian noise of 5 strengths (standard deviations) ( 0 . 0 , 0 . 02 , 0 . 04 , 0 . 08 , 0 . 16 ), filtered into 7 octave-wide (doubling of frequency) spatial-frequency bands (centered at 1 . 75 , 3 . 5 , 7 . 0 , 14 . 0 , 28 . 0 , 56 . 0 , 128 . 0 cycles/image) corresponding to the seven successive levels of a laplacian pyramid [40]. This gives us a total of 29 distinct noise conditions: 4 non-zero strengths × 7 spatial frequencies + 1 zero strength (Fig. 2B2). Both strength and spatial-frequency were sampled uniformly at random such that the 1100 images in our dataset were roughly equally distributed across both the noise conditions (combination of strength and spatial frequency; ≈ 31 images per condition) and categories ( ≈ 68 images per category). Fig. 1 (smaller version in Fig. 2C) shows sample noise-masked images from our experiment for all 29 conditions as a demo. By following the instructions in the figure's caption, you should be able to see an inverted-U-shaped boundary between images you can and cannot recognize, peaking at 28-56 cycles/image, which represents your channel for object recognition.

3.2 Human psychophysics

14 human observers performed 16-way recognition of the noise-masked images for 1100 trials, divided into one training block of 50 trials and five test blocks of 210 trials. In each trial, the observer was first presented with a blank screen with a '+' at the center, which they were instructed to click to proceed. This ensured fixation at the center of the image at the start of presentation. Upon clicking, a randomly sampled image from our dataset was presented at the center of the screen (with a gray background) along with 16 buttons below it, representing the various categories (Fig. 2D). The observer was given unlimited time to identify the category of the image and click on the corresponding button. In training block trials, they would then see feedback on their response i.e., 'correct' if they were right and 'incorrect' along with the correct category if they were wrong. No feedback was given on test block trials (for screenshots of task, see Supplementary Material). We developed the study using LabJS [41], hosted it on JATOS [42], and recruited participants via Amazon Mechanical Turk. The experiment lasted roughly an hour and participants were paid $20 for their efforts. A standard IRB-approved (IRB-FY2016-404) consent form was signed by each observer, and demographic information was collected. All observers had either normal or corrected-to-normal vision. Data of observers who scored below 50% on the no-noise condition (0 strength, any spatial-frequency)

OR

Threshold noise SD for 50%

Spatial frequency of noise (cycles/image)

log2(            )Bandwidth (octaves)

Peak noise sensitivity

Center frequency

1/

A. Sample images from ImageNet

B1. Images after grayscale-conversion

& contrast reduction (20%)

B2. Gaussian noise at 5 strengths (y-axis), filtered

within 7 spatial frequency bands (x-axis)

airplane

bear

bicycle

bird

boat

bottle

car

cat

chair

clock

dog

elephant

keyboard

knife

oven

truck

D. Observer performs 16-way categorization

of noise-masked images (C)

for each noise condition

F. For each spatial frequency, compute threshold noise

SD for 50% accuracy, and fit Gaussian function to

obtain spatial-frequency channel

1.75

3.5

7.0

14.0

28.0

56.0

112.0

0.0

0.02

0.04

0.08

0.16

Spatial frequency of noise (cycles/image)

Noise SD

C. Noise-masked images for each

noise condition  (B1 + B2)

1.75

3.5

7.0

14.0

28.0

56.0

112.0

0.0

0.02

0.04

0.08

0.16

Spatial frequency of noise (cycles/image)

Noise SD

+

Spatial frequency (cyc/image)

Noise SD

% correct

0

100

20°0

80

0.04

0.02

60

80°0

40

0.16

0.08

20

0.16

0

1.75

3.5

7.0

14.0

28.0

56.0

112.0

1.753.57142856112

was discarded. Generally, researchers using online experiments recruit more than 100 participants. However, in our case, 14 was sufficient because we observed very small individual differences across participants (see Supplementary Material).

3.3 Neural network evaluation

We tested 76 pretrained neural networks on the same task that we used to test humans: 16-way categorization of noise-masked images from our critical band masking dataset (Fig. 2D). Networks and their pretrained weights were sourced primarily from PyTorch's torchvision library [43] and Geirhos et al.'s modelvshuman benchmark [36]. These networks spanned various architectures and training procedures (ImageNet-trained CNNs [43], self-supervised models [44-49], Big Transfer models [50], adversarially-trained models [51], vision transformers [52, 53], semi-weakly supervised models [54], Noisy Student [55], and VOneNet [35]) and hence, are a large, representative sample of the state of the art networks from deep learning literature. For a full list of the networks we tested, and the color coding used in figures, see Supplementary Material, and for network details, see [36]. We do not include the color codes in the main paper because with the exception of blue being used to represent adversarially-trained models, network-type is irrelevant to our analyses, i.e., our results apply to all networks unless specified. By default, all networks accepted 224 × 224 images, and output probabilities for all 1000 original Imagenet categories. Images were normalized to ImageNet pixel mean and variance before being input to the network, to respect training data statistics. Experiments run without normalization yielded very few networks (only 20 of 76) that performed above-threshold (>50% accuracy) even in the zero-noise condition. The probability of each coarse 16-class ImageNet category was computed as the average of the probabilities of the corresponding fine (1000-class ImageNet) categories (Supplementary Material of [22] justifies this choice). For each input image, the 16-class category with top-probability was selected as the network's response

and network accuracy (percent-correct) was calculated separately for each of the 29 noise conditions (strength, frequency combinations).

3.4 Metrics

Having collected data from humans and neural networks on our critical band masking task, we move to analysis. Accuracies (% correct for 16-way categorization) of each human observer and neural network were computed independently for each noise condition in our experiment. Fig. 2E summarizes this metric as a sample heatmap (in this case, for a sample human observer). Each cell in the heatmap represents a single noise condition (combination of standard deviation (SD) and spatial frequency; a cell in Figs. 1 and 2C), and its color, the categorization accuracy of the observer on that condition. For all analyses henceforth, we average across human participants because the cross-observer variance was very small (see Supplementary Material).

Channel properties: center frequency, bandwidth, and peak noise sensitivity. Next, we use the heatmap to estimate the observer's spatial frequency channel. The threshold noise strength (SD) for 50% accuracy was computed separately for each of the seven spatial frequency bands (column in the heatmap). These thresholds, depicted as black points in Fig. 2F, are a measurement of noise sensitivity i.e., how much noise of each spatial frequency has to be added for the observer's accuracy to drop to 50%. Fitting a Gaussian function then yields a curve that captures the noise sensitivity of recognition across spatial frequency bands. This curve is a suitable representation for the spatial frequency channel because it captures the importance of each spatial frequency band in the image for recognition by measuring how noise added to each band affects performance. The Gaussian function has been used extensively to describe spatial-frequency tuning in the brain [3] and also yields good fits across all human and network data (see Supplementary Material).

The fitting procedure is as follows. The threshold values computed earlier are first mapped to linear indices ( { > 0 . 16 , 0 . 16 , 0 . 08 , 0 . 04 , 0 . 02 } →

{ 0 , 1 , 2 , 3 , 4 } ). A Gaussian function f ( x ) = Ae -( x -µ ) 2 2 σ 2 having 3 parameters: peak height ( A ), mean ( µ ), and standard deviation ( σ ) is then fit to the thresholds. These fitted parameters then used to calculate three properties that characterize the channel: bandwidth in octaves (log full-width at half-max = 2 σ √ ln 4 ), center frequency (frequency for peak noise sensitivity = 1 . 75 × 2 µ ), and peak noise sensitivity (scaled reciprocal of channel height = 2 A -4 ). An octave is a doubling of frequency. Fig. 2F illustrates the rescaled Gaussian channel (black curve) and its three parameters (orange, maroon, green) for a sample observer, along with formulae to calculate the three channel properties.

Shape bias. In a later section, we study how the above-derived channel properties correlate with two important and well-documented behavioral differences between humans and neural networks. The first of these is texture-vs-shape bias which measures how much an observer relies on texture vs shape cues for object recognition. Empirically, Geirhos et al. [7] measured an observer's shape bias by examining their response during a task that involved 16-way categorization (same categories that we use) of cue-conflict images. These images contain shape information from one category and texture information from another (e.g., a cat with an elephant's texture; Fig. 3). They defined shape bias as the fraction of images in their dataset categorized by an observer according to the shape category, and measured human shape bias as 0.99, meaning they categorize almost 100% of the images by shape. For all our shape bias analyses, we used cue-conflict images from their dataset to measure the shape bias of all 76 networks. All shape bias scores were averaged across object categories to obtain a single number for each network. Additionally, we use their measurement of human shape bias (0.99) because it is reliable and replicable [36].

Adversarial robustness (whitebox accuracy). Adversarial robustness of a neural network measures how resistant it is to adversarial attacks, stimulus perturbations generated specifically to fool the network. To measure robustness of our networks, we generated adversarial perturbations for 1000 images (each belonging to a different category) from the ImageNet validation dataset using projected gradient descent (PGD; ∥ L ∞ ∥ = 0 . 1 , max. iterations = 32), and measured the network's accuracy

in classifying those images. In our analysis, we use this measure, whitebox accuracy, computed using the PGD implementation from the Adversarial Robustness Toolbox [56]. Additionally, as a comparison, we also measured the accuracy of all networks on 1000-way classification of all 50,000 available unperturbed ImageNet validation set images.

4 Results

4.1 Humans recognize objects in natural images using the same spatial frequencies that they use for letters and gratings.

The classic one-octave-wide spatial frequency band has appeared frequently in human psychophysics literature, as the channel for grating detection [1], and letter recognition [2] across various stimulus conditions (alphabets, fonts, sizes, low- and high-pass noise) [3]. It is a surprising result that of all the spatial frequency information available in the stimulus, the visual system would rely on such a narrow band for recognition. However, letters and gratings are largely homogeneous objects, and it is not obvious that those results will generalize well to the recognition of diverse, heterogeneous, noisy objects in the real world. From our critical band masking analyses, we report a surprising result. Humans use the same narrow, one-octave-wide spatial frequency band to recognize objects in natural images that they use for letter and grating recognition, making this channel a canonical feature of human object recognition. In Fig. 4 we show accuracy heatmaps of humans for the various noise conditions averaged across observers (A, left), and a Gaussian channel fit to thresholds from this heatmap (B, black curve). The bandwidth (see 3.4) of the human channel is 1.00 octave, consistent with previous measurements of 1-2 octaves for grating/sinusoid detection [57], and 1 . 6 ± 0 . 7 octaves for letter recognition [3].

Spatial frequency of noise (cycles/image)

Threshold noise SD for 50% correct

% correct

Spatial frequency of noise (cycles/image)

Noise SD

A

B

Nhumans=14; Nnetworks=76

Humans (averaged)

ResNet-50

4.2 The neural network channel is 2-4 times as wide as the human channel.

Having seen the same channel in humans across a variety of stimuli and stimulus conditions, a natural next question is: how about neural-network-based object recognition systems? On repeating the same critical band masking experiment and analyses on our set of 76 neural networks (accuracy heatmap for a sample network ResNet-50 shown in Fig. 4A, right), we plot the channel for networks alongside the human one in Fig. 4B. We observe that the network channel, across the various architectures and training procedures used in our set, is ≈ 2-4 times as wide as the human channel (1.00 octaves), ranging from 2.30 (ViT-B) to 5.98 (resnet50-l2-eps1, an adversarially-trained network). In other words, neural networks are susceptible to noise at both high and low spatial frequencies that doesn't affect human performance.

4.3 Channel properties correlate strongly with shape bias, and with robustness of adversarially-trained networks.

We then ask if this stark difference between the spatial frequencies networks and humans use for recognition correlates with two other important and well-documented differences in human and

network behavior - shape bias and adversarial robustness. Humans are well-known to rely primarily on shape cues for object recognition and other visual tasks [10, 7]. Neural networks, on the other hand, show a lot of variance - convolutional networks use texture cues [7, 8], while other architectures such as transformers are shape-biased [9, 58]. Likewise, neural networks are generally strongly sensitive to tiny perturbations to their input that might be imperceptible to humans, called adversarial perturbations [6]. Fig. 5 plots each property of the spatial frequency channel against shape bias and whitebox accuracy (see 3.4 for metric details), along with line-fits (only significant fits with p < 0 . 05 / 18 (Bonferroni-corrected) shown).

GLYPH<c=9,font=/AAAAAD+DejaVuSans>GLYPH<c=6,font=/AAAAAD+DejaVuSans>GLYPH<c=8,font=/AAAAAD+DejaVuSans>

GLYPH<c=8,font=/AAAAAD+DejaVuSans>GLYPH<c=6,font=/AAAAAD+DejaVuSans>GLYPH<c=15,font=/AAAAAD+DejaVuSans>

GLYPH<c=8,font=/AAAAAD+DejaVuSans>GLYPH<c=6,font=/AAAAAD+DejaVuSans>GLYPH<c=14,font=/AAAAAD+DejaVuSans>

GLYPH<c=8,font=/AAAAAD+DejaVuSans>GLYPH<c=6,font=/AAAAAD+DejaVuSans>GLYPH<c=12,font=/AAAAAD+DejaVuSans>

GLYPH<c=18,font=/AAAAAD+DejaVuSans>GLYPH<c=26,font=/AAAAAD+DejaVuSans>GLYPH<c=19,font=/AAAAAD+DejaVuSans>!GLYPH<c=23,font=/AAAAAD+DejaVuSans>GLYPH<c=3,font=/AAAAAD+DejaVuSans>GLYPH<c=20,font=/AAAAAD+DejaVuSans>GLYPH<c=27,font=/AAAAAD+DejaVuSans>GLYPH<c=19,font=/AAAAAD+DejaVuSans>$

GLYPH<c=8,font=/AAAAAD+DejaVuSans>GLYPH<c=6,font=/AAAAAD+DejaVuSans>GLYPH<c=10,font=/AAAAAD+DejaVuSans>

GLYPH<c=8,font=/AAAAAD+DejaVuSans>GLYPH<c=6,font=/AAAAAD+DejaVuSans>GLYPH<c=8,font=/AAAAAD+DejaVuSans>

GLYPH<c=9,font=/AAAAAF+DejaVuSans>GLYPH<c=6,font=/AAAAAF+DejaVuSans>GLYPH<c=8,font=/AAAAAF+DejaVuSans>

GLYPH<c=16,font=/AAAAAD+DejaVuSans>GLYPH<c=26,font=/AAAAAD+DejaVuSans>GLYPH<c=19,font=/AAAAAD+DejaVuSans>GLYPH<c=31,font=/AAAAAD+DejaVuSans>GLYPH<c=31,font=/AAAAAD+DejaVuSans>GLYPH<c=23,font=/AAAAAD+DejaVuSans>GLYPH<c=29,font=/AAAAAD+DejaVuSans>GLYPH<c=3,font=/AAAAAD+DejaVuSans>GLYPH<c=21,font=/AAAAAD+DejaVuSans>GLYPH<c=23,font=/AAAAAD+DejaVuSans>GLYPH<c=31,font=/AAAAAD+DejaVuSans>%GLYPH<c=23,font=/AAAAAD+DejaVuSans>#GLYPH<c=3,font=/AAAAAD+DejaVuSans>GLYPH<c=24,font=/AAAAAD+DejaVuSans>#

(GLYPH<c=3,font=/AAAAAF+DejaVuSans>GLYPH<c=19,font=/AAAAAF+DejaVuSans>GLYPH<c=21,font=/AAAAAF+DejaVuSans>GLYPH<c=21,font=/AAAAAF+DejaVuSans>%"GLYPH<c=19,font=/AAAAAF+DejaVuSans>GLYPH<c=21,font=/AAAAAF+DejaVuSans>)

(GLYPH<c=3,font=/AAAAAE+DejaVuSans>GLYPH<c=19,font=/AAAAAE+DejaVuSans>GLYPH<c=21,font=/AAAAAE+DejaVuSans>GLYPH<c=21,font=/AAAAAE+DejaVuSans>%"GLYPH<c=19,font=/AAAAAE+DejaVuSans>GLYPH<c=21,font=/AAAAAE+DejaVuSans>)

GLYPH<c=8,font=/AAAAAF+DejaVuSans>GLYPH<c=6,font=/AAAAAF+DejaVuSans>GLYPH<c=15,font=/AAAAAF+DejaVuSans>

GLYPH<c=8,font=/AAAAAF+DejaVuSans>GLYPH<c=6,font=/AAAAAF+DejaVuSans>GLYPH<c=14,font=/AAAAAF+DejaVuSans>

GLYPH<c=8,font=/AAAAAF+DejaVuSans>GLYPH<c=6,font=/AAAAAF+DejaVuSans>GLYPH<c=12,font=/AAAAAF+DejaVuSans>

GLYPH<c=8,font=/AAAAAF+DejaVuSans>GLYPH<c=6,font=/AAAAAF+DejaVuSans>GLYPH<c=10,font=/AAAAAF+DejaVuSans>

GLYPH<c=18,font=/AAAAAE+DejaVuSans>GLYPH<c=26,font=/AAAAAE+DejaVuSans>GLYPH<c=27,font=/AAAAAE+DejaVuSans>$GLYPH<c=23,font=/AAAAAE+DejaVuSans>GLYPH<c=20,font=/AAAAAE+DejaVuSans>

GLYPH<c=8,font=/AAAAAF+DejaVuSans>GLYPH<c=6,font=/AAAAAF+DejaVuSans>GLYPH<c=8,font=/AAAAAF+DejaVuSans>

GLYPH<c=16,font=/AAAAAF+DejaVuSans>GLYPH<c=26,font=/AAAAAF+DejaVuSans>GLYPH<c=19,font=/AAAAAF+DejaVuSans>GLYPH<c=31,font=/AAAAAF+DejaVuSans>GLYPH<c=31,font=/AAAAAF+DejaVuSans>GLYPH<c=23,font=/AAAAAF+DejaVuSans>GLYPH<c=29,font=/AAAAAF+DejaVuSans>GLYPH<c=3,font=/AAAAAF+DejaVuSans>GLYPH<c=21,font=/AAAAAF+DejaVuSans>GLYPH<c=23,font=/AAAAAF+DejaVuSans>GLYPH<c=31,font=/AAAAAF+DejaVuSans>$GLYPH<c=23,font=/AAAAAF+DejaVuSans>"GLYPH<c=3,font=/AAAAAF+DejaVuSans>GLYPH<c=24,font=/AAAAAF+DejaVuSans>"

Center frequency (c/image)

Bandwidth (octaves)

Peak noise sensitivity

Shape bias

Whitebox accuracy

Best fit to all network points

Best fit to adversarially-trained network points

Best fit to non-adversarially-trained network points

Only significant (p < 0.05/18) fits shown in each figure.

B.

A.

R 2 =0.29

GLYPH<c=11,font=/AAAAAD+DejaVuSans>GLYPH<c=8,font=/AAAAAD+DejaVuSans>

GLYPH<c=12,font=/AAAAAD+DejaVuSans>GLYPH<c=8,font=/AAAAAD+DejaVuSans>

GLYPH<c=13,font=/AAAAAD+DejaVuSans>GLYPH<c=8,font=/AAAAAD+DejaVuSans>

GLYPH<c=16,font=/AAAAAD+DejaVuSans>GLYPH<c=26,font=/AAAAAD+DejaVuSans>GLYPH<c=19,font=/AAAAAD+DejaVuSans>GLYPH<c=31,font=/AAAAAD+DejaVuSans>GLYPH<c=31,font=/AAAAAD+DejaVuSans>GLYPH<c=23,font=/AAAAAD+DejaVuSans>GLYPH<c=29,font=/AAAAAD+DejaVuSans>GLYPH<c=3,font=/AAAAAD+DejaVuSans>GLYPH<c=21,font=/AAAAAD+DejaVuSans>GLYPH<c=23,font=/AAAAAD+DejaVuSans>GLYPH<c=31,font=/AAAAAD+DejaVuSans>%GLYPH<c=23,font=/AAAAAD+DejaVuSans>#GLYPH<c=3,font=/AAAAAD+DejaVuSans>GLYPH<c=24,font=/AAAAAD+DejaVuSans>#

GLYPH<c=23,font=/AAAAAD+DejaVuSans>"&GLYPH<c=23,font=/AAAAAD+DejaVuSans>GLYPH<c=31,font=/AAAAAD+DejaVuSans>GLYPH<c=21,font=/AAAAAD+DejaVuSans>)GLYPH<c=3,font=/AAAAAD+DejaVuSans>GLYPH<c=4,font=/AAAAAD+DejaVuSans>GLYPH<c=21,font=/AAAAAD+DejaVuSans>)GLYPH<c=21,font=/AAAAAD+DejaVuSans>GLYPH<c=29,font=/AAAAAD+DejaVuSans>GLYPH<c=23,font=/AAAAAD+DejaVuSans>$GLYPH<c=7,font=/AAAAAD+DejaVuSans>GLYPH<c=27,font=/AAAAAD+DejaVuSans>GLYPH<c=30,font=/AAAAAD+DejaVuSans>GLYPH<c=19,font=/AAAAAD+DejaVuSans>GLYPH<c=25,font=/AAAAAD+DejaVuSans>GLYPH<c=23,font=/AAAAAD+DejaVuSans>GLYPH<c=5,font=/AAAAAD+DejaVuSans>

GLYPH<c=8,font=/AAAAAD+DejaVuSans>GLYPH<c=6,font=/AAAAAD+DejaVuSans>GLYPH<c=8,font=/AAAAAD+DejaVuSans>

GLYPH<c=8,font=/AAAAAD+DejaVuSans>GLYPH<c=6,font=/AAAAAD+DejaVuSans>GLYPH<c=10,font=/AAAAAD+DejaVuSans>

GLYPH<c=8,font=/AAAAAD+DejaVuSans>GLYPH<c=6,font=/AAAAAD+DejaVuSans>GLYPH<c=12,font=/AAAAAD+DejaVuSans>

GLYPH<c=8,font=/AAAAAD+DejaVuSans>GLYPH<c=6,font=/AAAAAD+DejaVuSans>GLYPH<c=14,font=/AAAAAD+DejaVuSans>

GLYPH<c=8,font=/AAAAAD+DejaVuSans>GLYPH<c=6,font=/AAAAAD+DejaVuSans>GLYPH<c=15,font=/AAAAAD+DejaVuSans>

GLYPH<c=9,font=/AAAAAD+DejaVuSans>GLYPH<c=6,font=/AAAAAD+DejaVuSans>GLYPH<c=8,font=/AAAAAD+DejaVuSans>

GLYPH<c=18,font=/AAAAAD+DejaVuSans>GLYPH<c=26,font=/AAAAAD+DejaVuSans>GLYPH<c=19,font=/AAAAAD+DejaVuSans>!GLYPH<c=23,font=/AAAAAD+DejaVuSans>GLYPH<c=3,font=/AAAAAD+DejaVuSans>GLYPH<c=20,font=/AAAAAD+DejaVuSans>GLYPH<c=27,font=/AAAAAD+DejaVuSans>GLYPH<c=19,font=/AAAAAD+DejaVuSans>$

GLYPH<c=10,font=/AAAAAD+DejaVuSans>

GLYPH<c=8,font=/AAAAAD+DejaVuSans>

GLYPH<c=10,font=/AAAAAD+DejaVuSans>

GLYPH<c=9,font=/AAAAAD+DejaVuSans>

GLYPH<c=10,font=/AAAAAD+DejaVuSans>

GLYPH<c=10,font=/AAAAAD+DejaVuSans>

GLYPH<c=16,font=/AAAAAD+DejaVuSans>GLYPH<c=26,font=/AAAAAD+DejaVuSans>GLYPH<c=19,font=/AAAAAD+DejaVuSans>GLYPH<c=31,font=/AAAAAD+DejaVuSans>GLYPH<c=31,font=/AAAAAD+DejaVuSans>GLYPH<c=23,font=/AAAAAD+DejaVuSans>GLYPH<c=29,font=/AAAAAD+DejaVuSans>GLYPH<c=3,font=/AAAAAD+DejaVuSans>GLYPH<c=20,font=/AAAAAD+DejaVuSans>GLYPH<c=19,font=/AAAAAD+DejaVuSans>GLYPH<c=31,font=/AAAAAD+DejaVuSans>GLYPH<c=22,font=/AAAAAD+DejaVuSans>(GLYPH<c=27,font=/AAAAAD+DejaVuSans>GLYPH<c=22,font=/AAAAAD+DejaVuSans>%GLYPH<c=26,font=/AAAAAD+DejaVuSans>GLYPH<c=3,font=/AAAAAD+DejaVuSans>GLYPH<c=4,font=/AAAAAD+DejaVuSans> GLYPH<c=21,font=/AAAAAD+DejaVuSans>%GLYPH<c=19,font=/AAAAAD+DejaVuSans>'GLYPH<c=23,font=/AAAAAD+DejaVuSans>$GLYPH<c=5,font=/AAAAAD+DejaVuSans>

GLYPH<c=18,font=/AAAAAD+DejaVuSans>GLYPH<c=26,font=/AAAAAD+DejaVuSans>GLYPH<c=19,font=/AAAAAD+DejaVuSans>!GLYPH<c=23,font=/AAAAAD+DejaVuSans>GLYPH<c=3,font=/AAAAAD+DejaVuSans>GLYPH<c=20,font=/AAAAAD+DejaVuSans>GLYPH<c=27,font=/AAAAAD+DejaVuSans>GLYPH<c=19,font=/AAAAAD+DejaVuSans>$

GLYPH<c=10,font=/AAAAAD+DejaVuSans>

*GLYPH<c=9,font=/AAAAAD+DejaVuSans>

GLYPH<c=17,font=/AAAAAD+DejaVuSans>

GLYPH<c=23,font=/AAAAAD+DejaVuSans>GLYPH<c=19,font=/AAAAAD+DejaVuSans>GLYPH<c=28,font=/AAAAAD+DejaVuSans>GLYPH<c=3,font=/AAAAAD+DejaVuSans>GLYPH<c=31,font=/AAAAAD+DejaVuSans> GLYPH<c=27,font=/AAAAAD+DejaVuSans>$GLYPH<c=23,font=/AAAAAD+DejaVuSans>GLYPH<c=3,font=/AAAAAD+DejaVuSans>$GLYPH<c=23,font=/AAAAAD+DejaVuSans>GLYPH<c=31,font=/AAAAAD+DejaVuSans>$GLYPH<c=27,font=/AAAAAD+DejaVuSans>%GLYPH<c=27,font=/AAAAAD+DejaVuSans>'GLYPH<c=27,font=/AAAAAD+DejaVuSans>%)

GLYPH<c=18,font=/AAAAAD+DejaVuSans>GLYPH<c=26,font=/AAAAAD+DejaVuSans>GLYPH<c=19,font=/AAAAAD+DejaVuSans>!GLYPH<c=23,font=/AAAAAD+DejaVuSans>GLYPH<c=3,font=/AAAAAD+DejaVuSans>GLYPH<c=20,font=/AAAAAD+DejaVuSans>GLYPH<c=27,font=/AAAAAD+DejaVuSans>GLYPH<c=19,font=/AAAAAD+DejaVuSans>$

GLYPH<c=11,font=/AAAAAD+DejaVuSans>GLYPH<c=8,font=/AAAAAD+DejaVuSans>

GLYPH<c=12,font=/AAAAAD+DejaVuSans>GLYPH<c=8,font=/AAAAAD+DejaVuSans>

GLYPH<c=13,font=/AAAAAD+DejaVuSans>GLYPH<c=8,font=/AAAAAD+DejaVuSans>

GLYPH<c=23,font=/AAAAAD+DejaVuSans>"&GLYPH<c=23,font=/AAAAAD+DejaVuSans>GLYPH<c=31,font=/AAAAAD+DejaVuSans>GLYPH<c=21,font=/AAAAAD+DejaVuSans>)GLYPH<c=3,font=/AAAAAD+DejaVuSans>GLYPH<c=4,font=/AAAAAD+DejaVuSans>GLYPH<c=21,font=/AAAAAD+DejaVuSans>)GLYPH<c=21,font=/AAAAAD+DejaVuSans>GLYPH<c=29,font=/AAAAAD+DejaVuSans>GLYPH<c=23,font=/AAAAAD+DejaVuSans>$GLYPH<c=7,font=/AAAAAD+DejaVuSans>GLYPH<c=27,font=/AAAAAD+DejaVuSans>GLYPH<c=30,font=/AAAAAD+DejaVuSans>GLYPH<c=19,font=/AAAAAD+DejaVuSans>GLYPH<c=25,font=/AAAAAD+DejaVuSans>GLYPH<c=23,font=/AAAAAD+DejaVuSans>GLYPH<c=5,font=/AAAAAD+DejaVuSans>

GLYPH<c=10,font=/AAAAAD+DejaVuSans>

GLYPH<c=8,font=/AAAAAD+DejaVuSans>

GLYPH<c=10,font=/AAAAAD+DejaVuSans>

GLYPH<c=9,font=/AAAAAD+DejaVuSans>

GLYPH<c=10,font=/AAAAAD+DejaVuSans>

GLYPH<c=10,font=/AAAAAD+DejaVuSans>

GLYPH<c=16,font=/AAAAAD+DejaVuSans>GLYPH<c=26,font=/AAAAAD+DejaVuSans>GLYPH<c=19,font=/AAAAAD+DejaVuSans>GLYPH<c=31,font=/AAAAAD+DejaVuSans>GLYPH<c=31,font=/AAAAAD+DejaVuSans>GLYPH<c=23,font=/AAAAAD+DejaVuSans>GLYPH<c=29,font=/AAAAAD+DejaVuSans>GLYPH<c=3,font=/AAAAAD+DejaVuSans>GLYPH<c=20,font=/AAAAAD+DejaVuSans>GLYPH<c=19,font=/AAAAAD+DejaVuSans>GLYPH<c=31,font=/AAAAAD+DejaVuSans>GLYPH<c=22,font=/AAAAAD+DejaVuSans>(GLYPH<c=27,font=/AAAAAD+DejaVuSans>GLYPH<c=22,font=/AAAAAD+DejaVuSans>%GLYPH<c=26,font=/AAAAAD+DejaVuSans>GLYPH<c=3,font=/AAAAAD+DejaVuSans>GLYPH<c=4,font=/AAAAAD+DejaVuSans> GLYPH<c=21,font=/AAAAAD+DejaVuSans>%GLYPH<c=19,font=/AAAAAD+DejaVuSans>'GLYPH<c=23,font=/AAAAAD+DejaVuSans>$GLYPH<c=5,font=/AAAAAD+DejaVuSans>

GLYPH<c=18,font=/AAAAAD+DejaVuSans>GLYPH<c=26,font=/AAAAAD+DejaVuSans>GLYPH<c=19,font=/AAAAAD+DejaVuSans>!GLYPH<c=23,font=/AAAAAD+DejaVuSans>GLYPH<c=3,font=/AAAAAD+DejaVuSans>GLYPH<c=20,font=/AAAAAD+DejaVuSans>GLYPH<c=27,font=/AAAAAD+DejaVuSans>GLYPH<c=19,font=/AAAAAD+DejaVuSans>$

GLYPH<c=10,font=/AAAAAD+DejaVuSans>

*GLYPH<c=9,font=/AAAAAD+DejaVuSans>

GLYPH<c=10,font=/AAAAAD+DejaVuSans>

GLYPH<c=8,font=/AAAAAD+DejaVuSans>

GLYPH<c=17,font=/AAAAAD+DejaVuSans>

GLYPH<c=23,font=/AAAAAD+DejaVuSans>GLYPH<c=19,font=/AAAAAD+DejaVuSans>GLYPH<c=28,font=/AAAAAD+DejaVuSans>GLYPH<c=3,font=/AAAAAD+DejaVuSans>GLYPH<c=31,font=/AAAAAD+DejaVuSans> GLYPH<c=27,font=/AAAAAD+DejaVuSans>$GLYPH<c=23,font=/AAAAAD+DejaVuSans>GLYPH<c=3,font=/AAAAAD+DejaVuSans>$GLYPH<c=23,font=/AAAAAD+DejaVuSans>GLYPH<c=31,font=/AAAAAD+DejaVuSans>$GLYPH<c=27,font=/AAAAAD+DejaVuSans>%GLYPH<c=27,font=/AAAAAD+DejaVuSans>'GLYPH<c=27,font=/AAAAAD+DejaVuSans>%)

GLYPH<c=18,font=/AAAAAD+DejaVuSans>GLYPH<c=26,font=/AAAAAD+DejaVuSans>GLYPH<c=19,font=/AAAAAD+DejaVuSans>!GLYPH<c=23,font=/AAAAAD+DejaVuSans>GLYPH<c=3,font=/AAAAAD+DejaVuSans>GLYPH<c=20,font=/AAAAAD+DejaVuSans>GLYPH<c=27,font=/AAAAAD+DejaVuSans>GLYPH<c=19,font=/AAAAAD+DejaVuSans>$

GLYPH<c=11,font=/AAAAAD+DejaVuSans>GLYPH<c=8,font=/AAAAAD+DejaVuSans>

GLYPH<c=12,font=/AAAAAD+DejaVuSans>GLYPH<c=8,font=/AAAAAD+DejaVuSans>

GLYPH<c=13,font=/AAAAAD+DejaVuSans>GLYPH<c=8,font=/AAAAAD+DejaVuSans>

GLYPH<c=16,font=/AAAAAD+DejaVuSans>GLYPH<c=26,font=/AAAAAD+DejaVuSans>GLYPH<c=19,font=/AAAAAD+DejaVuSans>GLYPH<c=31,font=/AAAAAD+DejaVuSans>GLYPH<c=31,font=/AAAAAD+DejaVuSans>GLYPH<c=23,font=/AAAAAD+DejaVuSans>GLYPH<c=29,font=/AAAAAD+DejaVuSans>GLYPH<c=3,font=/AAAAAD+DejaVuSans>GLYPH<c=21,font=/AAAAAD+DejaVuSans>GLYPH<c=23,font=/AAAAAD+DejaVuSans>GLYPH<c=31,font=/AAAAAD+DejaVuSans>%GLYPH<c=23,font=/AAAAAD+DejaVuSans>#GLYPH<c=3,font=/AAAAAD+DejaVuSans>GLYPH<c=24,font=/AAAAAD+DejaVuSans>#

GLYPH<c=23,font=/AAAAAD+DejaVuSans>"&GLYPH<c=23,font=/AAAAAD+DejaVuSans>GLYPH<c=31,font=/AAAAAD+DejaVuSans>GLYPH<c=21,font=/AAAAAD+DejaVuSans>)GLYPH<c=3,font=/AAAAAD+DejaVuSans>GLYPH<c=4,font=/AAAAAD+DejaVuSans>GLYPH<c=21,font=/AAAAAD+DejaVuSans>)GLYPH<c=21,font=/AAAAAD+DejaVuSans>GLYPH<c=29,font=/AAAAAD+DejaVuSans>GLYPH<c=23,font=/AAAAAD+DejaVuSans>$GLYPH<c=7,font=/AAAAAD+DejaVuSans>GLYPH<c=27,font=/AAAAAD+DejaVuSans>GLYPH<c=30,font=/AAAAAD+DejaVuSans>GLYPH<c=19,font=/AAAAAD+DejaVuSans>GLYPH<c=25,font=/AAAAAD+DejaVuSans>GLYPH<c=23,font=/AAAAAD+DejaVuSans>GLYPH<c=5,font=/AAAAAD+DejaVuSans>

GLYPH<c=8,font=/AAAAAD+DejaVuSans>GLYPH<c=6,font=/AAAAAD+DejaVuSans>GLYPH<c=8,font=/AAAAAD+DejaVuSans>

GLYPH<c=8,font=/AAAAAD+DejaVuSans>GLYPH<c=6,font=/AAAAAD+DejaVuSans>GLYPH<c=10,font=/AAAAAD+DejaVuSans>

GLYPH<c=8,font=/AAAAAD+DejaVuSans>GLYPH<c=6,font=/AAAAAD+DejaVuSans>GLYPH<c=12,font=/AAAAAD+DejaVuSans>

GLYPH<c=8,font=/AAAAAD+DejaVuSans>GLYPH<c=6,font=/AAAAAD+DejaVuSans>GLYPH<c=14,font=/AAAAAD+DejaVuSans>

GLYPH<c=8,font=/AAAAAD+DejaVuSans>GLYPH<c=6,font=/AAAAAD+DejaVuSans>GLYPH<c=15,font=/AAAAAD+DejaVuSans>

GLYPH<c=9,font=/AAAAAD+DejaVuSans>GLYPH<c=6,font=/AAAAAD+DejaVuSans>GLYPH<c=8,font=/AAAAAD+DejaVuSans>

GLYPH<c=10,font=/AAAAAD+DejaVuSans>

GLYPH<c=8,font=/AAAAAD+DejaVuSans>

GLYPH<c=10,font=/AAAAAD+DejaVuSans>

GLYPH<c=9,font=/AAAAAD+DejaVuSans>

GLYPH<c=10,font=/AAAAAD+DejaVuSans>

GLYPH<c=10,font=/AAAAAD+DejaVuSans>

GLYPH<c=16,font=/AAAAAD+DejaVuSans>GLYPH<c=26,font=/AAAAAD+DejaVuSans>GLYPH<c=19,font=/AAAAAD+DejaVuSans>GLYPH<c=31,font=/AAAAAD+DejaVuSans>GLYPH<c=31,font=/AAAAAD+DejaVuSans>GLYPH<c=23,font=/AAAAAD+DejaVuSans>GLYPH<c=29,font=/AAAAAD+DejaVuSans>GLYPH<c=3,font=/AAAAAD+DejaVuSans>GLYPH<c=20,font=/AAAAAD+DejaVuSans>GLYPH<c=19,font=/AAAAAD+DejaVuSans>GLYPH<c=31,font=/AAAAAD+DejaVuSans>GLYPH<c=22,font=/AAAAAD+DejaVuSans>(GLYPH<c=27,font=/AAAAAD+DejaVuSans>GLYPH<c=22,font=/AAAAAD+DejaVuSans>%GLYPH<c=26,font=/AAAAAD+DejaVuSans>GLYPH<c=3,font=/AAAAAD+DejaVuSans>GLYPH<c=4,font=/AAAAAD+DejaVuSans> GLYPH<c=21,font=/AAAAAD+DejaVuSans>%GLYPH<c=19,font=/AAAAAD+DejaVuSans>'GLYPH<c=23,font=/AAAAAD+DejaVuSans>$GLYPH<c=5,font=/AAAAAD+DejaVuSans>

GLYPH<c=18,font=/AAAAAD+DejaVuSans>GLYPH<c=26,font=/AAAAAD+DejaVuSans>GLYPH<c=19,font=/AAAAAD+DejaVuSans>!GLYPH<c=23,font=/AAAAAD+DejaVuSans>GLYPH<c=3,font=/AAAAAD+DejaVuSans>GLYPH<c=20,font=/AAAAAD+DejaVuSans>GLYPH<c=27,font=/AAAAAD+DejaVuSans>GLYPH<c=19,font=/AAAAAD+DejaVuSans>$

GLYPH<c=10,font=/AAAAAD+DejaVuSans>

*GLYPH<c=9,font=/AAAAAD+DejaVuSans>

GLYPH<c=10,font=/AAAAAD+DejaVuSans>

GLYPH<c=8,font=/AAAAAD+DejaVuSans>

GLYPH<c=17,font=/AAAAAD+DejaVuSans>

GLYPH<c=23,font=/AAAAAD+DejaVuSans>GLYPH<c=19,font=/AAAAAD+DejaVuSans>GLYPH<c=28,font=/AAAAAD+DejaVuSans>GLYPH<c=3,font=/AAAAAD+DejaVuSans>GLYPH<c=31,font=/AAAAAD+DejaVuSans> GLYPH<c=27,font=/AAAAAD+DejaVuSans>$GLYPH<c=23,font=/AAAAAD+DejaVuSans>GLYPH<c=3,font=/AAAAAD+DejaVuSans>$GLYPH<c=23,font=/AAAAAD+DejaVuSans>GLYPH<c=31,font=/AAAAAD+DejaVuSans>$GLYPH<c=27,font=/AAAAAD+DejaVuSans>%GLYPH<c=27,font=/AAAAAD+DejaVuSans>'GLYPH<c=27,font=/AAAAAD+DejaVuSans>%)

GLYPH<c=18,font=/AAAAAD+DejaVuSans>GLYPH<c=26,font=/AAAAAD+DejaVuSans>GLYPH<c=19,font=/AAAAAD+DejaVuSans>!GLYPH<c=23,font=/AAAAAD+DejaVuSans>GLYPH<c=3,font=/AAAAAD+DejaVuSans>GLYPH<c=20,font=/AAAAAD+DejaVuSans>GLYPH<c=27,font=/AAAAAD+DejaVuSans>GLYPH<c=19,font=/AAAAAD+DejaVuSans>$

GLYPH<c=11,font=/AAAAAE+DejaVuSans>GLYPH<c=8,font=/AAAAAE+DejaVuSans>

GLYPH<c=12,font=/AAAAAE+DejaVuSans>GLYPH<c=8,font=/AAAAAE+DejaVuSans>

GLYPH<c=13,font=/AAAAAE+DejaVuSans>GLYPH<c=8,font=/AAAAAE+DejaVuSans>

GLYPH<c=23,font=/AAAAAE+DejaVuSans>!%GLYPH<c=23,font=/AAAAAE+DejaVuSans>GLYPH<c=31,font=/AAAAAE+DejaVuSans>GLYPH<c=21,font=/AAAAAE+DejaVuSans>)GLYPH<c=3,font=/AAAAAE+DejaVuSans>GLYPH<c=4,font=/AAAAAE+DejaVuSans>GLYPH<c=21,font=/AAAAAE+DejaVuSans>)GLYPH<c=21,font=/AAAAAE+DejaVuSans>GLYPH<c=29,font=/AAAAAE+DejaVuSans>GLYPH<c=23,font=/AAAAAE+DejaVuSans>#GLYPH<c=7,font=/AAAAAE+DejaVuSans>GLYPH<c=27,font=/AAAAAE+DejaVuSans>GLYPH<c=30,font=/AAAAAE+DejaVuSans>GLYPH<c=19,font=/AAAAAE+DejaVuSans>GLYPH<c=25,font=/AAAAAE+DejaVuSans>GLYPH<c=23,font=/AAAAAE+DejaVuSans>GLYPH<c=5,font=/AAAAAE+DejaVuSans>

GLYPH<c=8,font=/AAAAAE+DejaVuSans>GLYPH<c=6,font=/AAAAAE+DejaVuSans>GLYPH<c=8,font=/AAAAAE+DejaVuSans>

GLYPH<c=8,font=/AAAAAE+DejaVuSans>GLYPH<c=6,font=/AAAAAE+DejaVuSans>GLYPH<c=10,font=/AAAAAE+DejaVuSans>

GLYPH<c=8,font=/AAAAAE+DejaVuSans>GLYPH<c=6,font=/AAAAAE+DejaVuSans>GLYPH<c=12,font=/AAAAAE+DejaVuSans>

GLYPH<c=8,font=/AAAAAE+DejaVuSans>GLYPH<c=6,font=/AAAAAE+DejaVuSans>GLYPH<c=14,font=/AAAAAE+DejaVuSans>

GLYPH<c=8,font=/AAAAAE+DejaVuSans>GLYPH<c=6,font=/AAAAAE+DejaVuSans>GLYPH<c=15,font=/AAAAAE+DejaVuSans>

GLYPH<c=9,font=/AAAAAE+DejaVuSans>GLYPH<c=6,font=/AAAAAE+DejaVuSans>GLYPH<c=8,font=/AAAAAE+DejaVuSans>

GLYPH<c=10,font=/AAAAAE+DejaVuSans>

GLYPH<c=10,font=/AAAAAE+DejaVuSans>

GLYPH<c=18,font=/AAAAAE+DejaVuSans>GLYPH<c=26,font=/AAAAAE+DejaVuSans>GLYPH<c=27,font=/AAAAAE+DejaVuSans>$GLYPH<c=23,font=/AAAAAE+DejaVuSans>GLYPH<c=20,font=/AAAAAE+DejaVuSans>

(GLYPH<c=3,font=/AAAAAE+DejaVuSans>GLYPH<c=19,font=/AAAAAE+DejaVuSans>GLYPH<c=21,font=/AAAAAE+DejaVuSans>GLYPH<c=21,font=/AAAAAE+DejaVuSans>%"GLYPH<c=19,font=/AAAAAE+DejaVuSans>GLYPH<c=21,font=/AAAAAE+DejaVuSans>)

GLYPH<c=10,font=/AAAAAE+DejaVuSans>

*GLYPH<c=9,font=/AAAAAE+DejaVuSans>

GLYPH<c=10,font=/AAAAAE+DejaVuSans>

GLYPH<c=8,font=/AAAAAE+DejaVuSans>

GLYPH<c=18,font=/AAAAAE+DejaVuSans>GLYPH<c=26,font=/AAAAAE+DejaVuSans>GLYPH<c=27,font=/AAAAAE+DejaVuSans>$GLYPH<c=23,font=/AAAAAE+DejaVuSans>GLYPH<c=20,font=/AAAAAE+DejaVuSans>

(GLYPH<c=3,font=/AAAAAE+DejaVuSans>GLYPH<c=19,font=/AAAAAE+DejaVuSans>GLYPH<c=21,font=/AAAAAE+DejaVuSans>GLYPH<c=21,font=/AAAAAE+DejaVuSans>%"GLYPH<c=19,font=/AAAAAE+DejaVuSans>GLYPH<c=21,font=/AAAAAE+DejaVuSans>)

GLYPH<c=11,font=/AAAAAE+DejaVuSans>GLYPH<c=8,font=/AAAAAE+DejaVuSans>

GLYPH<c=12,font=/AAAAAE+DejaVuSans>GLYPH<c=8,font=/AAAAAE+DejaVuSans>

GLYPH<c=13,font=/AAAAAE+DejaVuSans>GLYPH<c=8,font=/AAAAAE+DejaVuSans>

GLYPH<c=16,font=/AAAAAE+DejaVuSans>GLYPH<c=26,font=/AAAAAE+DejaVuSans>GLYPH<c=19,font=/AAAAAE+DejaVuSans>GLYPH<c=31,font=/AAAAAE+DejaVuSans>GLYPH<c=31,font=/AAAAAE+DejaVuSans>GLYPH<c=23,font=/AAAAAE+DejaVuSans>GLYPH<c=29,font=/AAAAAE+DejaVuSans>GLYPH<c=3,font=/AAAAAE+DejaVuSans>GLYPH<c=21,font=/AAAAAE+DejaVuSans>GLYPH<c=23,font=/AAAAAE+DejaVuSans>GLYPH<c=31,font=/AAAAAE+DejaVuSans>$GLYPH<c=23,font=/AAAAAE+DejaVuSans>"GLYPH<c=3,font=/AAAAAE+DejaVuSans>GLYPH<c=24,font=/AAAAAE+DejaVuSans>"

GLYPH<c=23,font=/AAAAAE+DejaVuSans>!%GLYPH<c=23,font=/AAAAAE+DejaVuSans>GLYPH<c=31,font=/AAAAAE+DejaVuSans>GLYPH<c=21,font=/AAAAAE+DejaVuSans>)GLYPH<c=3,font=/AAAAAE+DejaVuSans>GLYPH<c=4,font=/AAAAAE+DejaVuSans>GLYPH<c=21,font=/AAAAAE+DejaVuSans>)GLYPH<c=21,font=/AAAAAE+DejaVuSans>GLYPH<c=29,font=/AAAAAE+DejaVuSans>GLYPH<c=23,font=/AAAAAE+DejaVuSans>#GLYPH<c=7,font=/AAAAAE+DejaVuSans>GLYPH<c=27,font=/AAAAAE+DejaVuSans>GLYPH<c=30,font=/AAAAAE+DejaVuSans>GLYPH<c=19,font=/AAAAAE+DejaVuSans>GLYPH<c=25,font=/AAAAAE+DejaVuSans>GLYPH<c=23,font=/AAAAAE+DejaVuSans>GLYPH<c=5,font=/AAAAAE+DejaVuSans>

GLYPH<c=8,font=/AAAAAE+DejaVuSans>GLYPH<c=6,font=/AAAAAE+DejaVuSans>GLYPH<c=8,font=/AAAAAE+DejaVuSans>

GLYPH<c=8,font=/AAAAAE+DejaVuSans>GLYPH<c=6,font=/AAAAAE+DejaVuSans>GLYPH<c=10,font=/AAAAAE+DejaVuSans>

GLYPH<c=8,font=/AAAAAE+DejaVuSans>GLYPH<c=6,font=/AAAAAE+DejaVuSans>GLYPH<c=12,font=/AAAAAE+DejaVuSans>

GLYPH<c=8,font=/AAAAAE+DejaVuSans>GLYPH<c=6,font=/AAAAAE+DejaVuSans>GLYPH<c=14,font=/AAAAAE+DejaVuSans>

GLYPH<c=8,font=/AAAAAE+DejaVuSans>GLYPH<c=6,font=/AAAAAE+DejaVuSans>GLYPH<c=15,font=/AAAAAE+DejaVuSans>

GLYPH<c=9,font=/AAAAAE+DejaVuSans>GLYPH<c=6,font=/AAAAAE+DejaVuSans>GLYPH<c=8,font=/AAAAAE+DejaVuSans>

GLYPH<c=18,font=/AAAAAE+DejaVuSans>GLYPH<c=26,font=/AAAAAE+DejaVuSans>GLYPH<c=27,font=/AAAAAE+DejaVuSans>$GLYPH<c=23,font=/AAAAAE+DejaVuSans>GLYPH<c=20,font=/AAAAAE+DejaVuSans>

(GLYPH<c=3,font=/AAAAAE+DejaVuSans>GLYPH<c=19,font=/AAAAAE+DejaVuSans>GLYPH<c=21,font=/AAAAAE+DejaVuSans>GLYPH<c=21,font=/AAAAAE+DejaVuSans>%"GLYPH<c=19,font=/AAAAAE+DejaVuSans>GLYPH<c=21,font=/AAAAAE+DejaVuSans>)

GLYPH<c=10,font=/AAAAAE+DejaVuSans>

GLYPH<c=10,font=/AAAAAE+DejaVuSans>

GLYPH<c=16,font=/AAAAAE+DejaVuSans>GLYPH<c=26,font=/AAAAAE+DejaVuSans>GLYPH<c=19,font=/AAAAAE+DejaVuSans>GLYPH<c=31,font=/AAAAAE+DejaVuSans>GLYPH<c=31,font=/AAAAAE+DejaVuSans>GLYPH<c=23,font=/AAAAAE+DejaVuSans>GLYPH<c=29,font=/AAAAAE+DejaVuSans>GLYPH<c=3,font=/AAAAAE+DejaVuSans>GLYPH<c=20,font=/AAAAAE+DejaVuSans>GLYPH<c=19,font=/AAAAAE+DejaVuSans>GLYPH<c=31,font=/AAAAAE+DejaVuSans>GLYPH<c=22,font=/AAAAAE+DejaVuSans>'GLYPH<c=27,font=/AAAAAE+DejaVuSans>GLYPH<c=22,font=/AAAAAE+DejaVuSans>$GLYPH<c=26,font=/AAAAAE+DejaVuSans>GLYPH<c=3,font=/AAAAAE+DejaVuSans>GLYPH<c=4,font=/AAAAAE+DejaVuSans> GLYPH<c=21,font=/AAAAAE+DejaVuSans>$GLYPH<c=19,font=/AAAAAE+DejaVuSans>&GLYPH<c=23,font=/AAAAAE+DejaVuSans>#GLYPH<c=5,font=/AAAAAE+DejaVuSans>

GLYPH<c=18,font=/AAAAAE+DejaVuSans>GLYPH<c=26,font=/AAAAAE+DejaVuSans>GLYPH<c=27,font=/AAAAAE+DejaVuSans>$GLYPH<c=23,font=/AAAAAE+DejaVuSans>GLYPH<c=20,font=/AAAAAE+DejaVuSans>

(GLYPH<c=3,font=/AAAAAE+DejaVuSans>GLYPH<c=19,font=/AAAAAE+DejaVuSans>GLYPH<c=21,font=/AAAAAE+DejaVuSans>GLYPH<c=21,font=/AAAAAE+DejaVuSans>%"GLYPH<c=19,font=/AAAAAE+DejaVuSans>GLYPH<c=21,font=/AAAAAE+DejaVuSans>)

GLYPH<c=10,font=/AAAAAE+DejaVuSans>

*GLYPH<c=9,font=/AAAAAE+DejaVuSans>

GLYPH<c=17,font=/AAAAAE+DejaVuSans>

GLYPH<c=18,font=/AAAAAE+DejaVuSans>GLYPH<c=26,font=/AAAAAE+DejaVuSans>GLYPH<c=27,font=/AAAAAE+DejaVuSans>$GLYPH<c=23,font=/AAAAAE+DejaVuSans>GLYPH<c=20,font=/AAAAAE+DejaVuSans>

(GLYPH<c=3,font=/AAAAAE+DejaVuSans>GLYPH<c=19,font=/AAAAAE+DejaVuSans>GLYPH<c=21,font=/AAAAAE+DejaVuSans>GLYPH<c=21,font=/AAAAAE+DejaVuSans>%"GLYPH<c=19,font=/AAAAAE+DejaVuSans>GLYPH<c=21,font=/AAAAAE+DejaVuSans>)

R 2 =0.48

R 2 =0.30

GLYPH<c=11,font=/AAAAAF+DejaVuSans>GLYPH<c=8,font=/AAAAAF+DejaVuSans>

GLYPH<c=12,font=/AAAAAF+DejaVuSans>GLYPH<c=8,font=/AAAAAF+DejaVuSans>

GLYPH<c=13,font=/AAAAAF+DejaVuSans>GLYPH<c=8,font=/AAAAAF+DejaVuSans>

GLYPH<c=23,font=/AAAAAF+DejaVuSans>!%GLYPH<c=23,font=/AAAAAF+DejaVuSans>GLYPH<c=31,font=/AAAAAF+DejaVuSans>GLYPH<c=21,font=/AAAAAF+DejaVuSans>)GLYPH<c=3,font=/AAAAAF+DejaVuSans>GLYPH<c=4,font=/AAAAAF+DejaVuSans>GLYPH<c=21,font=/AAAAAF+DejaVuSans>)GLYPH<c=21,font=/AAAAAF+DejaVuSans>GLYPH<c=29,font=/AAAAAF+DejaVuSans>GLYPH<c=23,font=/AAAAAF+DejaVuSans>#GLYPH<c=7,font=/AAAAAF+DejaVuSans>GLYPH<c=27,font=/AAAAAF+DejaVuSans>GLYPH<c=30,font=/AAAAAF+DejaVuSans>GLYPH<c=19,font=/AAAAAF+DejaVuSans>GLYPH<c=25,font=/AAAAAF+DejaVuSans>GLYPH<c=23,font=/AAAAAF+DejaVuSans>GLYPH<c=5,font=/AAAAAF+DejaVuSans>

GLYPH<c=10,font=/AAAAAF+DejaVuSans>

GLYPH<c=10,font=/AAAAAF+DejaVuSans>

GLYPH<c=16,font=/AAAAAF+DejaVuSans>GLYPH<c=26,font=/AAAAAF+DejaVuSans>GLYPH<c=19,font=/AAAAAF+DejaVuSans>GLYPH<c=31,font=/AAAAAF+DejaVuSans>GLYPH<c=31,font=/AAAAAF+DejaVuSans>GLYPH<c=23,font=/AAAAAF+DejaVuSans>GLYPH<c=29,font=/AAAAAF+DejaVuSans>GLYPH<c=3,font=/AAAAAF+DejaVuSans>GLYPH<c=20,font=/AAAAAF+DejaVuSans>GLYPH<c=19,font=/AAAAAF+DejaVuSans>GLYPH<c=31,font=/AAAAAF+DejaVuSans>GLYPH<c=22,font=/AAAAAF+DejaVuSans>'GLYPH<c=27,font=/AAAAAF+DejaVuSans>GLYPH<c=22,font=/AAAAAF+DejaVuSans>$GLYPH<c=26,font=/AAAAAF+DejaVuSans>GLYPH<c=3,font=/AAAAAF+DejaVuSans>GLYPH<c=4,font=/AAAAAF+DejaVuSans> GLYPH<c=21,font=/AAAAAF+DejaVuSans>$GLYPH<c=19,font=/AAAAAF+DejaVuSans>&GLYPH<c=23,font=/AAAAAF+DejaVuSans>#GLYPH<c=5,font=/AAAAAF+DejaVuSans>

GLYPH<c=18,font=/AAAAAF+DejaVuSans>GLYPH<c=26,font=/AAAAAF+DejaVuSans>GLYPH<c=27,font=/AAAAAF+DejaVuSans>$GLYPH<c=23,font=/AAAAAF+DejaVuSans>GLYPH<c=20,font=/AAAAAF+DejaVuSans>

(GLYPH<c=3,font=/AAAAAF+DejaVuSans>GLYPH<c=19,font=/AAAAAF+DejaVuSans>GLYPH<c=21,font=/AAAAAF+DejaVuSans>GLYPH<c=21,font=/AAAAAF+DejaVuSans>%"GLYPH<c=19,font=/AAAAAF+DejaVuSans>GLYPH<c=21,font=/AAAAAF+DejaVuSans>)

GLYPH<c=10,font=/AAAAAF+DejaVuSans>

*GLYPH<c=9,font=/AAAAAF+DejaVuSans>

GLYPH<c=10,font=/AAAAAF+DejaVuSans>

GLYPH<c=8,font=/AAAAAF+DejaVuSans>

GLYPH<c=17,font=/AAAAAF+DejaVuSans>

GLYPH<c=23,font=/AAAAAF+DejaVuSans>GLYPH<c=19,font=/AAAAAF+DejaVuSans>GLYPH<c=28,font=/AAAAAF+DejaVuSans>GLYPH<c=3,font=/AAAAAF+DejaVuSans>GLYPH<c=31,font=/AAAAAF+DejaVuSans> GLYPH<c=27,font=/AAAAAF+DejaVuSans>#GLYPH<c=23,font=/AAAAAF+DejaVuSans>GLYPH<c=3,font=/AAAAAF+DejaVuSans>#GLYPH<c=23,font=/AAAAAF+DejaVuSans>GLYPH<c=31,font=/AAAAAF+DejaVuSans>#GLYPH<c=27,font=/AAAAAF+DejaVuSans>$GLYPH<c=27,font=/AAAAAF+DejaVuSans>&GLYPH<c=27,font=/AAAAAF+DejaVuSans>$)

GLYPH<c=18,font=/AAAAAF+DejaVuSans>GLYPH<c=26,font=/AAAAAF+DejaVuSans>GLYPH<c=27,font=/AAAAAF+DejaVuSans>$GLYPH<c=23,font=/AAAAAF+DejaVuSans>GLYPH<c=20,font=/AAAAAF+DejaVuSans>

(GLYPH<c=3,font=/AAAAAF+DejaVuSans>GLYPH<c=19,font=/AAAAAF+DejaVuSans>GLYPH<c=21,font=/AAAAAF+DejaVuSans>GLYPH<c=21,font=/AAAAAF+DejaVuSans>%"GLYPH<c=19,font=/AAAAAF+DejaVuSans>GLYPH<c=21,font=/AAAAAF+DejaVuSans>)

R 2 =0.12

R 2 =0.14

R 2 =0.12

GLYPH<c=16,font=/AAAAAE+DejaVuSans>GLYPH<c=26,font=/AAAAAE+DejaVuSans>GLYPH<c=19,font=/AAAAAE+DejaVuSans>GLYPH<c=31,font=/AAAAAE+DejaVuSans>GLYPH<c=31,font=/AAAAAE+DejaVuSans>GLYPH<c=23,font=/AAAAAE+DejaVuSans>GLYPH<c=29,font=/AAAAAE+DejaVuSans>GLYPH<c=3,font=/AAAAAE+DejaVuSans>GLYPH<c=21,font=/AAAAAE+DejaVuSans>GLYPH<c=23,font=/AAAAAE+DejaVuSans>GLYPH<c=31,font=/AAAAAE+DejaVuSans>$GLYPH<c=23,font=/AAAAAE+DejaVuSans>"GLYPH<c=3,font=/AAAAAE+DejaVuSans>GLYPH<c=24,font=/AAAAAE+DejaVuSans>"

GLYPH<c=16,font=/AAAAAE+DejaVuSans>GLYPH<c=26,font=/AAAAAE+DejaVuSans>GLYPH<c=19,font=/AAAAAE+DejaVuSans>GLYPH<c=31,font=/AAAAAE+DejaVuSans>GLYPH<c=31,font=/AAAAAE+DejaVuSans>GLYPH<c=23,font=/AAAAAE+DejaVuSans>GLYPH<c=29,font=/AAAAAE+DejaVuSans>GLYPH<c=3,font=/AAAAAE+DejaVuSans>GLYPH<c=20,font=/AAAAAE+DejaVuSans>GLYPH<c=19,font=/AAAAAE+DejaVuSans>GLYPH<c=31,font=/AAAAAE+DejaVuSans>GLYPH<c=22,font=/AAAAAE+DejaVuSans>'GLYPH<c=27,font=/AAAAAE+DejaVuSans>GLYPH<c=22,font=/AAAAAE+DejaVuSans>$GLYPH<c=26,font=/AAAAAE+DejaVuSans>GLYPH<c=3,font=/AAAAAE+DejaVuSans>GLYPH<c=4,font=/AAAAAE+DejaVuSans> GLYPH<c=21,font=/AAAAAE+DejaVuSans>$GLYPH<c=19,font=/AAAAAE+DejaVuSans>&GLYPH<c=23,font=/AAAAAE+DejaVuSans>#GLYPH<c=5,font=/AAAAAE+DejaVuSans>

GLYPH<c=17,font=/AAAAAE+DejaVuSans>

GLYPH<c=10,font=/AAAAAD+DejaVuSans>

GLYPH<c=8,font=/AAAAAD+DejaVuSans>

GLYPH<c=10,font=/AAAAAE+DejaVuSans>

GLYPH<c=8,font=/AAAAAE+DejaVuSans>

GLYPH<c=23,font=/AAAAAE+DejaVuSans>GLYPH<c=19,font=/AAAAAE+DejaVuSans>GLYPH<c=28,font=/AAAAAE+DejaVuSans>GLYPH<c=3,font=/AAAAAE+DejaVuSans>GLYPH<c=31,font=/AAAAAE+DejaVuSans> GLYPH<c=27,font=/AAAAAE+DejaVuSans>#GLYPH<c=23,font=/AAAAAE+DejaVuSans>GLYPH<c=3,font=/AAAAAE+DejaVuSans>#GLYPH<c=23,font=/AAAAAE+DejaVuSans>GLYPH<c=31,font=/AAAAAE+DejaVuSans>#GLYPH<c=27,font=/AAAAAE+DejaVuSans>$GLYPH<c=27,font=/AAAAAE+DejaVuSans>&GLYPH<c=27,font=/AAAAAE+DejaVuSans>$)

GLYPH<c=23,font=/AAAAAE+DejaVuSans>GLYPH<c=19,font=/AAAAAE+DejaVuSans>GLYPH<c=28,font=/AAAAAE+DejaVuSans>GLYPH<c=3,font=/AAAAAE+DejaVuSans>GLYPH<c=31,font=/AAAAAE+DejaVuSans> GLYPH<c=27,font=/AAAAAE+DejaVuSans>#GLYPH<c=23,font=/AAAAAE+DejaVuSans>GLYPH<c=3,font=/AAAAAE+DejaVuSans>#GLYPH<c=23,font=/AAAAAE+DejaVuSans>GLYPH<c=31,font=/AAAAAE+DejaVuSans>#GLYPH<c=27,font=/AAAAAE+DejaVuSans>$GLYPH<c=27,font=/AAAAAE+DejaVuSans>&GLYPH<c=27,font=/AAAAAE+DejaVuSans>$)

Networks show a large range of shape bias scores. Although most are clustered around 0.1-0.2 (10-20% of cue-conflict images categorized by shape), a few classes of networks are more strongly shape biased: ViTs (green, violet-red), scaled-up CNNs (BiTs in purple, Noisy Student in dark gray). Channel bandwidth strongly accounts for these differences, single-handedly explaining 29% of the variance, with a slope of -0 . 22 ± 0 . 04 . Networks with a smaller channel bandwidth are more shape biased. This trend is also supported by the human result (black star in middle panel of Fig. 5A). Humans are the most shape biased and have the smallest bandwidth. Center frequency and peak noise sensitivity also account for some of the variance: a linear model with center frequency, bandwidth and peak noise sensitivity accounts for 51% of the cross-network variance in shape bias, which is surprising given that shape is often thought to be a complex feature of objects.

When we look at how well channel properties account for variance in whitebox accuracy (adversarial robustness), we see no such pattern (Fig. 5B). Of the three, only noise sensitivity shows a significant

GLYPH<c=18,font=/AAAAAD+DejaVuSans>GLYPH<c=26,font=/AAAAAD+DejaVuSans>GLYPH<c=19,font=/AAAAAD+DejaVuSans>!GLYPH<c=23,font=/AAAAAD+DejaVuSans>GLYPH<c=3,font=/AAAAAD+DejaVuSans>GLYPH<c=20,font=/AAAAAD+DejaVuSans>GLYPH<c=27,font=/AAAAAD+DejaVuSans>GLYPH<c=19,font=/AAAAAD+DejaVuSans>$

GLYPH<c=18,font=/AAAAAF+DejaVuSans>GLYPH<c=26,font=/AAAAAF+DejaVuSans>GLYPH<c=27,font=/AAAAAF+DejaVuSans>$GLYPH<c=23,font=/AAAAAF+DejaVuSans>GLYPH<c=20,font=/AAAAAF+DejaVuSans>

fit (gray dotted line in rightmost plot in Fig. 5B). However, in these plots, we see some interesting patterns when we separately consider adversarially-trained networks (blue-colored points of any shade) and other networks. Increasing intensity of blue represents the same network architecture (ResNet-50) subjected to increasing amounts of adversarial training to yield a monotonic rise in their measured L2-adversarial robustness ( ϵ ∈ { 0 , 0 . 01 , 0 . 03 , 0 . 05 , 0 . 1 , 0 . 25 , 0 . 5 , 1 , 3 , 5 } ; see [51] for details). Since these points clearly differ visually in our plots from other networks, we fit two more lines, one to only adversarially-trained networks (dark blue, dotted), and the other to only the remaining (dark red, dotted). Interestingly, this yields strong fits for bandwidth and peak noise sensitivity cases. For adversarially-trained networks, the three channel properties together account for 66% of the cross-network variance in whitebox accuracy. Networks with higher bandwidth and higher peak noise-sensitivity are more adversarially robust.

As an aside, we suspect that the bimodal nature of whitebox accuracy results is because unlike the case of shape bias, most networks we tested have poor adversarial robustness, and hence lie on the flat portion of its psychometric function, while strongly adversarially-trained networks lie on the steep portion. Therefore, fitting lines to these two groups separately might be akin to fitting two lines to describe a non-linear psychometric function.

4.4 Adversarial training expands the channel further beyond the human bandwidth

Embedded in our correlational results above is an important causal relationship. Given that the adversariallytrained networks we test differ only in terms of the amount of adversarial training (measured using L2robustness), we can analyze the effect that the amount of adversarial training has on channel properties. Firstly, as shown in Fig. 6, increasing L2-robustness ( ϵ ) corresponds to a monotonic increase in whitebox accuracy and a gradual decrease in ImageNet validation set accuracy. Secondly, we observe that as L2-robustness and whitebox accuracy of adversarially-trained networks increase, their bandwidth increases too, moving away from the human bandwidth. This means that networks that are more robust to adversarial attacks (according to both L2-robustness and whitebox accuracy) are in fact more sensitive to noise added in a larger set of spatial frequency bands that humans are not sensitive to. Thus, adversarial training in effect, makes them more susceptible to another kind of adversarial attack (filtered noise perturbation).

5 Discussion

Having shown that neural network spatial-frequency channels diverge from the canonical one-octavewide channel found in humans, we propose that critical band masking should be added to the toolbox of metrics for model-human comparison. Our dataset of 14 humans and 76 networks on 16-way categorization raises important questions about which spatial frequencies matter for object recognition.

Every one of the 76 networks we tested has a wide critical band. We tested all the networks from Geirhos et al. [36] which is the largest comparison of networks and humans on object recognition. That study included most of the popular network kinds, spanning a wide range of conditions: convolutional networks and transformers, shallow and deep networks, supervised and self-supervised training, standard and adversarially-trained networks. Thus, the conclusions of this paper are based on a representative sample of popular network designs. More work is required to explore the effects of diverse kinds of training data and augmentation.

L2-adversarial robustness (

ε

)

Channel bandwidth (octaves)

Human bandwidth

Accuracy (%correct)

ImageNet accuracy

Network bandwidth

Whitebox accuracy

Increasing adversarial training

GLYPH<c=9,font=/AAAAAE+DejaVuSans>GLYPH<c=8,font=/AAAAAE+DejaVuSans>

(GLYPH<c=10,font=/AAAAAE+DejaVuSans>

GLYPH<c=9,font=/AAAAAE+DejaVuSans>GLYPH<c=8,font=/AAAAAE+DejaVuSans>

(GLYPH<c=9,font=/AAAAAE+DejaVuSans>

GLYPH<c=9,font=/AAAAAE+DejaVuSans>GLYPH<c=8,font=/AAAAAE+DejaVuSans>

GLYPH<c=8,font=/AAAAAE+DejaVuSans>

GLYPH<c=16,font=/AAAAAE+DejaVuSans> GLYPH<c=22,font=/AAAAAE+DejaVuSans>GLYPH<c=22,font=/AAAAAE+DejaVuSans># GLYPH<c=20,font=/AAAAAE+DejaVuSans>GLYPH<c=22,font=/AAAAAE+DejaVuSans>' GLYPH<c=6,font=/AAAAAE+DejaVuSans>GLYPH<c=18,font=/AAAAAE+DejaVuSans>GLYPH<c=10,font=/AAAAAE+DejaVuSans>GLYPH<c=6,font=/AAAAAE+DejaVuSans>

GLYPH<c=30,font=/AAAAAE+DejaVuSans>GLYPH<c=21,font=/AAAAAE+DejaVuSans>#!"GLYPH<c=29,font=/AAAAAE+DejaVuSans>GLYPH<c=24,font=/AAAAAE+DejaVuSans>!!GLYPH<c=3,font=/AAAAAE+DejaVuSans>" GLYPH<c=20,font=/AAAAAE+DejaVuSans>GLYPH<c=23,font=/AAAAAE+DejaVuSans>GLYPH<c=24,font=/AAAAAE+DejaVuSans>GLYPH<c=30,font=/AAAAAE+DejaVuSans>GLYPH<c=25,font=/AAAAAE+DejaVuSans>GLYPH<c=25,font=/AAAAAE+DejaVuSans>GLYPH<c=3,font=/AAAAAE+DejaVuSans>GLYPH<c=4,font=/AAAAAE+DejaVuSans>GLYPH<c=24,font=/AAAAAE+DejaVuSans>GLYPH<c=31,font=/AAAAAE+DejaVuSans>!GLYPH<c=27,font=/AAAAAE+DejaVuSans>GLYPH<c=28,font=/AAAAAE+DejaVuSans>GLYPH<c=30,font=/AAAAAE+DejaVuSans>GLYPH<c=29,font=/AAAAAE+DejaVuSans>GLYPH<c=5,font=/AAAAAE+DejaVuSans>

GLYPH<c=10,font=/AAAAAE+DejaVuSans>

GLYPH<c=8,font=/AAAAAE+DejaVuSans>

GLYPH<c=10,font=/AAAAAE+DejaVuSans>

GLYPH<c=9,font=/AAAAAE+DejaVuSans>

GLYPH<c=10,font=/AAAAAE+DejaVuSans>

GLYPH<c=10,font=/AAAAAE+DejaVuSans>

GLYPH<c=17,font=/AAAAAE+DejaVuSans>GLYPH<c=26,font=/AAAAAE+DejaVuSans>GLYPH<c=20,font=/AAAAAE+DejaVuSans>GLYPH<c=29,font=/AAAAAE+DejaVuSans>GLYPH<c=29,font=/AAAAAE+DejaVuSans>GLYPH<c=24,font=/AAAAAE+DejaVuSans>GLYPH<c=28,font=/AAAAAE+DejaVuSans>GLYPH<c=3,font=/AAAAAE+DejaVuSans>GLYPH<c=21,font=/AAAAAE+DejaVuSans>GLYPH<c=20,font=/AAAAAE+DejaVuSans>GLYPH<c=29,font=/AAAAAE+DejaVuSans>GLYPH<c=23,font=/AAAAAE+DejaVuSans>%GLYPH<c=27,font=/AAAAAE+DejaVuSans>GLYPH<c=23,font=/AAAAAE+DejaVuSans>"GLYPH<c=26,font=/AAAAAE+DejaVuSans>GLYPH<c=3,font=/AAAAAE+DejaVuSans>GLYPH<c=4,font=/AAAAAE+DejaVuSans>GLYPH<c=30,font=/AAAAAE+DejaVuSans>GLYPH<c=22,font=/AAAAAE+DejaVuSans>"GLYPH<c=20,font=/AAAAAE+DejaVuSans>$GLYPH<c=24,font=/AAAAAE+DejaVuSans>!GLYPH<c=5,font=/AAAAAE+DejaVuSans>

GLYPH<c=8,font=/AAAAAE+DejaVuSans>GLYPH<c=7,font=/AAAAAE+DejaVuSans>GLYPH<c=8,font=/AAAAAE+DejaVuSans>

GLYPH<c=8,font=/AAAAAE+DejaVuSans>GLYPH<c=7,font=/AAAAAE+DejaVuSans>GLYPH<c=9,font=/AAAAAE+DejaVuSans>

GLYPH<c=8,font=/AAAAAE+DejaVuSans>GLYPH<c=7,font=/AAAAAE+DejaVuSans>GLYPH<c=10,font=/AAAAAE+DejaVuSans>

GLYPH<c=8,font=/AAAAAE+DejaVuSans>GLYPH<c=7,font=/AAAAAE+DejaVuSans>GLYPH<c=11,font=/AAAAAE+DejaVuSans>

GLYPH<c=8,font=/AAAAAE+DejaVuSans>GLYPH<c=7,font=/AAAAAE+DejaVuSans>GLYPH<c=12,font=/AAAAAE+DejaVuSans>

GLYPH<c=8,font=/AAAAAE+DejaVuSans>GLYPH<c=7,font=/AAAAAE+DejaVuSans>GLYPH<c=13,font=/AAAAAE+DejaVuSans>

GLYPH<c=8,font=/AAAAAE+DejaVuSans>GLYPH<c=7,font=/AAAAAE+DejaVuSans>GLYPH<c=14,font=/AAAAAE+DejaVuSans>

GLYPH<c=8,font=/AAAAAE+DejaVuSans>GLYPH<c=7,font=/AAAAAE+DejaVuSans>GLYPH<c=15,font=/AAAAAE+DejaVuSans>

GLYPH<c=19,font=/AAAAAE+DejaVuSans>GLYPH<c=26,font=/AAAAAE+DejaVuSans>GLYPH<c=27,font=/AAAAAE+DejaVuSans>"GLYPH<c=24,font=/AAAAAE+DejaVuSans>GLYPH<c=21,font=/AAAAAE+DejaVuSans>GLYPH<c=30,font=/AAAAAE+DejaVuSans>

&GLYPH<c=3,font=/AAAAAE+DejaVuSans>GLYPH<c=20,font=/AAAAAE+DejaVuSans>GLYPH<c=22,font=/AAAAAE+DejaVuSans>GLYPH<c=22,font=/AAAAAE+DejaVuSans># GLYPH<c=20,font=/AAAAAE+DejaVuSans>GLYPH<c=22,font=/AAAAAE+DejaVuSans>'

When comparing biological vision and artificial neural networks, there are two questions to be asked: what can artificial networks learn from biology, and how can neural networks inform our understanding of biology [59, 34]. Needless to say, the origins of deep learning relied heavily on knowledge of biology [30]. But can biology impact the evolution of neural networks? Dapello et al. [35] showed that making the first layer's tuning match biological V1 tuning improves robustness. The critical band idea is central to understanding hearing and vision. Here we show that the critical bands, which are a measure of tuning, are different between humans and networks, and that this difference strongly explains robustness (shape bias and adversarial robustness) of networks. Thus, the results presented here are evidence that narrowing the machine critical band to match that of humans may make neural networks even more robust.

The critical band masking paradigm characterizes the object recognition channel by measuring sensitivity to frequency-filtered noise [4, 2]. Our experiments use this approach to study how spatial frequency selectivity relates to noise robustness, a core topic in machine learning research. Indeed, Geirhos et al. [36] found that adversarial training of networks in the presence of high-frequency noise decreases their overall noise sensitivity. An alternative approach determines what spatial frequencies are used to recognize objects, by filtering the image itself, i.e., removing some frequencies instead of adding filtered noise to mask them [60, 18, 36]. The two approaches yield different results in humans [3], which we will explore in future work.

Li et al. [18] found that adversarially-robust object recognition models rely mainly on low spatialfrequency information in images (also see [15]). Our observations qualitatively agree with their results. Our network channel is indeed centered on a low-frequency band, and adversarial training expands its bandwidth. More work is needed to quantitatively compare the two approaches.

6 Conclusions

In this paper, we introduce the critical band masking paradigm to study what spatial frequency information humans and neural networks use to recognize objects in natural images. To this end, we use a noise-masked ImageNet object recognition task. First, we find that humans use the same canonical one-octave-wide channel to recognize objects in natural images that they use for letter and grating recognition. Second, the neural network channel is 2-4 times wider than the human channel i.e., network performance is impaired by high and low spatial frequency noise to which humans are immune. Furthermore, properties of the spatial frequency channel correlate strongly with shape bias (explaining 51% cross-network variance) and robustness of adversarially-trained networks (explaining 66% variance). Finally, we find that adversarial training increases robustness but further widens the already-too-wide network channel. Overall, critical band masking allows systematic frequency-based analysis of both network and human object recognition performance, revealing important differences in noise sensitivity. The critical band offers a spatial-frequency-based explanation of shape bias and adversarial robustness. Thereby, our paper provides evidence suggesting that efforts to make a network more robust should look for ways to narrow its critical band. While our results are based on a large, representative sample of popular network designs, more work is required to explore the effects of diverse kinds of training data and augmentations. Such experiments would also help determine if the relationship between channel properties and robustness is also causal.

Acknowledgments and Disclosure of Funding

We thank Furkan Özçelik and Ozhan Dehghani for ongoing work, and Eero Simoncelli, James Elder, Maria Pombo, Paul Gavrikov, our five anonymous reviewers, and audience at VSS, COSYNE, and ECVP for helpful comments and suggestions. A.S. additionally thanks Jiaming Xu and Chianna Cohen for being dinner companions during the pre-deadline slog. Our work was funded by grants from the National Eye Institute, National Institutes of Health (R01-EY027964 to D.G.P. and R01EY031446 to N.J.M.). It was also supported by a National Institutes of Health core vision grant (P30-EY013079). We are also grateful to NYU's High Performance Computing (HPC) cluster for enabling our neural network experiments and analysis.

References

Fergus W Campbell and John G Robson. Application of fourier analysis to the visibility of gratings. The Journal of physiology , 197(3):551, 1968.

Joshua A Solomon and Denis G Pelli. The visual filter mediating letter identification. Nature , 369(6479):395-397, 1994.

Najib J Majaj, Denis G Pelli, Peri Kurshan, and Melanie Palomares. The role of spatial frequency channels in letter identification. Vision research , 42(9):1165-1184, 2002.

Harvey Fletcher. Auditory patterns. Reviews of modern physics , 12(1):47, 1940.

Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, et al. Imagenet large scale visual recognition challenge. International journal of computer vision , 115:211-252, 2015.

Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. International Conference on Learning Representations , 2014.

Robert Geirhos, Patricia Rubisch, Claudio Michaelis, Matthias Bethge, Felix A Wichmann, and Wieland Brendel. Imagenet-trained cnns are biased towards texture; increasing shape bias improves accuracy and robustness. arXiv preprint arXiv:1811.12231 , 2018.

Katherine Hermann, Ting Chen, and Simon Kornblith. The origins and prevalence of texture bias in convolutional neural networks. Advances in Neural Information Processing Systems , 33:19000-19015, 2020.

Shikhar Tuli, Ishita Dasgupta, Erin Grant, and Thomas L Griffiths. Are convolutional neural networks or transformers more like human vision? arXiv preprint arXiv:2105.07197 , 2021.

Barbara Landau, Linda B Smith, and Susan Jones. Syntactic context and the shape bias in children's and adults' lexical learning. Journal of Memory and Language , 31(6):807-825, 1992.

Haohan Wang, Xindi Wu, Zeyi Huang, and Eric P Xing. High-frequency component helps explain the generalization of convolutional neural networks. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages 8684-8694, 2020.

Justin D Lieber, Gerick M Lee, Najib J Majaj, and J Anthony Movshon. Sensitivity to naturalistic texture relies primarily on high spatial frequencies. Journal of vision , 23(2):4-4, 2023.

Ipek Oruç and Michael S Landy. Scale dependence and channel switching in letter identification. Journal of Vision , 9(9):4-4, 2009.

˙ Ipek Oruç and Jason JS Barton. Critical frequencies in the perception of letters, faces, and novel shapes: Evidence for limited scale invariance for faces. Journal of Vision , 10(12):20-20, 2010.

Nasim Rahaman, Aristide Baratin, Devansh Arpit, Felix Draxler, Min Lin, Fred Hamprecht, Yoshua Bengio, and Aaron Courville. On the spectral bias of neural networks. In International Conference on Machine Learning , pages 5301-5310. PMLR, 2019.

Robert Geirhos, Jörn-Henrik Jacobsen, Claudio Michaelis, Richard Zemel, Wieland Brendel, Matthias Bethge, and Felix A Wichmann. Shortcut learning in deep neural networks. Nature Machine Intelligence , 2(11):665-673, 2020.

Shunxin Wang, Raymond Veldhuis, Christoph Brune, and Nicola Strisciuglio. Frequency shortcut learning in neural networks. In NeurIPS 2022 Workshop on Distribution Shifts: Connecting Methods and Applications , 2022.

Zhe Li, Josue Ortega Caro, Evgenia Rusak, Wieland Brendel, Matthias Bethge, Fabio Anselmi, Ankit B Patel, Andreas S Tolias, and Xaq Pitkow. Robust deep learning object recognition models rely on low frequency information in natural images. PLOS Computational Biology , 19(3):e1010932, 2023.

Dong Yin, Raphael Gontijo Lopes, Jon Shlens, Ekin Dogus Cubuk, and Justin Gilmer. A fourier perspective on model robustness in computer vision. Advances in Neural Information Processing Systems , 32, 2019.

Paul Gavrikov, Janis Keuper, and Margret Keuper. An extended study of human-like behavior under adversarial training. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 2360-2367, 2023.

Antonio A Abello, Roberto Hirata, and Zhangyang Wang. Dissecting the high-frequency bias in convolutional neural networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 863-871, 2021.

Robert Geirhos, Carlos RM Temme, Jonas Rauber, Heiko H Schütt, Matthias Bethge, and Felix A Wichmann. Generalisation in humans and deep neural networks. Advances in neural information processing systems , 31, 2018.

Nicholas Baker, Hongjing Lu, Gennady Erlikhman, and Philip J Kellman. Deep convolutional networks do not classify based on global object shape. PLoS computational biology , 14(12):e1006613, 2018.

Anh Nguyen, Jason Yosinski, and Jeff Clune. Deep neural networks are easily fooled: High confidence predictions for unrecognizable images. In Proceedings of the IEEE conference on computer vision and pattern recognition , pages 427-436, 2015.

Gamaleldin Elsayed, Shreya Shankar, Brian Cheung, Nicolas Papernot, Alexey Kurakin, Ian Goodfellow, and Jascha Sohl-Dickstein. Adversarial examples that fool both computer vision and time-limited humans. Advances in neural information processing systems , 31, 2018.

Vijay Veerabadran, Josh Goldman, Shreya Shankar, Brian Cheung, Nicolas Papernot, Alexey Kurakin, Ian Goodfellow, Jonathon Shlens, Jascha Sohl-Dickstein, Michael C Mozer, et al. Subtle adversarial image manipulations influence both human and machine perception. Nature Communications , 14(1):4933, 2023.

Zhenglong Zhou and Chaz Firestone. Humans can decipher adversarial images. Nature communications , 10(1):1334, 2019.

Rémi Bernhard, Pierre-Alain Moëllic, Martial Mermillod, Yannick Bourrier, Romain Cohendet, Miguel Solinas, and Marina Reyboz. Impact of spatial frequency based constraints on adversarial robustness. In 2021 International Joint Conference on Neural Networks (IJCNN) , pages 1-8. IEEE, 2021.

Shishira R Maiya, Max Ehrlich, Vatsal Agarwal, Ser-Nam Lim, Tom Goldstein, and Abhinav Shrivastava. A frequency perspective of adversarial robustness. arXiv preprint arXiv:2111.00861 , 2021.

Kunihiko Fukushima and Sei Miyake. Neocognitron: A new algorithm for pattern recognition tolerant of deformations and shifts in position. Pattern recognition , 15(6):455-469, 1982.

Maximilian Riesenhuber and Tomaso Poggio. Hierarchical models of object recognition in cortex. Nature neuroscience , 2(11):1019-1025, 1999.

Daniel LK Yamins and James J DiCarlo. Using goal-driven deep learning models to understand sensory cortex. Nature neuroscience , 19(3):356-365, 2016.

Seyed-Mahdi Khaligh-Razavi and Nikolaus Kriegeskorte. Deep supervised, but not unsupervised, models may explain it cortical representation. PLoS computational biology , 10(11):e1003915, 2014.

Martin Schrimpf, Jonas Kubilius, Ha Hong, Najib J Majaj, Rishi Rajalingham, Elias B Issa, Kohitij Kar, Pouya Bashivan, Jonathan Prescott-Roy, Franziska Geiger, et al. Brain-score: Which artificial neural network for object recognition is most brain-like? BioRxiv , page 407007, 2018.

Joel Dapello, Tiago Marques, Martin Schrimpf, Franziska Geiger, David Cox, and James J DiCarlo. Simulating a primary visual cortex at the front of cnns improves robustness to image perturbations. Advances in Neural Information Processing Systems , 33:13073-13087, 2020.

Robert Geirhos, Kantharaju Narayanappa, Benjamin Mitzkus, Tizian Thieringer, Matthias Bethge, Felix A Wichmann, and Wieland Brendel. Partial success in closing the gap between human and machine vision. Advances in Neural Information Processing Systems , 34:23885-23899, 2021.

Jenelle Feather, Guillaume Leclerc, Aleksander M ˛ adry, and Josh H McDermott. Model metamers illuminate divergences between biological and artificial neural networks. bioRxiv , pages 2022-05, 2022.

Nikolaus Kriegeskorte, Marieke Mur, and Peter A Bandettini. Representational similarity analysisconnecting the branches of systems neuroscience. Frontiers in systems neuroscience , page 4, 2008.

George A Miller. Wordnet: a lexical database for english. Communications of the ACM , 38(11):39-41, 1995.

Peter J Burt and Edward H Adelson. The laplacian pyramid as a compact image code. In Readings in computer vision , pages 671-679. Elsevier, 1987.

Felix Henninger, Yury Shevchenko, Ulf K Mertens, Pascal J Kieslich, and Benjamin E Hilbig. lab. js: A free, open, online study builder. Behavior Research Methods , pages 1-18, 2021.

Kristian Lange, Simone Kühn, and Elisa Filevich. " just another tool for online studies'(jatos): An easy solution for setup and management of web servers supporting online studies. PloS one , 10(6):e0130834, 2015.

Sébastien Marcel and Yann Rodriguez. Torchvision the machine-vision package of torch. In Proceedings of the 18th ACM international conference on Multimedia , pages 1485-1488, 2010.

Zhirong Wu, Yuanjun Xiong, Stella X Yu, and Dahua Lin. Unsupervised feature learning via non-parametric instance discrimination. In Proceedings of the IEEE conference on computer vision and pattern recognition , pages 3733-3742, 2018.

Kaiming He, Haoqi Fan, Yuxin Wu, Saining Xie, and Ross Girshick. Momentum contrast for unsupervised visual representation learning. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages 9729-9738, 2020.

Xinlei Chen, Haoqi Fan, Ross Girshick, and Kaiming He. Improved baselines with momentum contrastive learning. arXiv preprint arXiv:2003.04297 , 2020.

Ishan Misra and Laurens van der Maaten. Self-supervised learning of pretext-invariant representations. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages 6707-6717, 2020.

Yonglong Tian, Chen Sun, Ben Poole, Dilip Krishnan, Cordelia Schmid, and Phillip Isola. What makes for good views for contrastive learning? Advances in neural information processing systems , 33:6827-6839, 2020.

Ting Chen, Simon Kornblith, Mohammad Norouzi, and Geoffrey Hinton. A simple framework for contrastive learning of visual representations. In International conference on machine learning , pages 1597-1607. PMLR, 2020.

Alexander Kolesnikov, Lucas Beyer, Xiaohua Zhai, Joan Puigcerver, Jessica Yung, Sylvain Gelly, and Neil Houlsby. Big transfer (bit): General visual representation learning. In Computer Vision-ECCV 2020: 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceedings, Part V 16 , pages 491-507. Springer, 2020.

Hadi Salman, Andrew Ilyas, Logan Engstrom, Ashish Kapoor, and Aleksander Madry. Do adversarially robust imagenet models transfer better? Advances in Neural Information Processing Systems , 33:35333545, 2020.

Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv:2010.11929 , 2020.

Ross Wightman et al. Pytorch image models, 2019.

I Zeki Yalniz, Hervé Jégou, Kan Chen, Manohar Paluri, and Dhruv Mahajan. Billion-scale semi-supervised learning for image classification. arXiv preprint arXiv:1905.00546 , 2019.

Qizhe Xie, Minh-Thang Luong, Eduard Hovy, and Quoc V Le. Self-training with noisy student improves imagenet classification. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages 10687-10698, 2020.

Maria-Irina Nicolae, Mathieu Sinn, Minh Ngoc Tran, Beat Buesser, Ambrish Rawat, Martin Wistuba, Valentina Zantedeschi, Nathalie Baracaldo, Bryant Chen, Heiko Ludwig, et al. Adversarial robustness toolbox v1. 0.0. arXiv preprint arXiv:1807.01069 , 2018.

Colin Blakemore and Fergus W Campbell. On the existence of neurones in the human visual system selectively sensitive to the orientation and size of retinal images. The Journal of physiology , 203(1):237260, 1969.

Mostafa Dehghani, Josip Djolonga, Basil Mustafa, Piotr Padlewski, Jonathan Heek, Justin Gilmer, Andreas Steiner, Mathilde Caron, Robert Geirhos, Ibrahim Alabdulmohsin, et al. Scaling vision transformers to 22 billion parameters. arXiv preprint arXiv:2302.05442 , 2023.

Yann LeCun, Yoshua Bengio, and Geoffrey Hinton. Deep learning. nature , 521(7553):436-444, 2015.

David H Parish and George Sperling. Object spatial frequencies, retinal spatial frequencies, noise, and the efficiency of letter discrimination. Vision research , 31(7-8):1399-1415, 1991.

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis study applies a well-established procedure from psychophysics, critical band masking, to an object recognition task on which human and a wide range of neural networks are compared.\nThe core finding is that while humans use roughly the same spatial frequency channels for object recognition as they do for e.g. letter / grating recognition, all 76 investigated neural networks use much wider channels (more than twice as wide as the human channel).\nThis means that humans and neural networks rely on different spatial frequencies for object recognition.\n\nSTRENGTHS:\n* Overall, I really liked this study - it has a simple yet effective protocol, clear findings, and approaches a novel question through sound experiments.\n* The proposed approach is applicable to the analysis of future networks, i.e. it is sufficiently general such that it can be used by follow-up studies / on general architectures\n* Successful transfer of psychophysical method to the study of neural networks\n* The paper is very well-written, easy to follow, clearly structured and has good visualizations\n* Human data will be made publicly available upon publication\n\nWEAKNESSES:\nSignificance testing:\n* Figure 6 does not correct for multiple comparisons. I would like to know which of the plotted effects still hold after Bonferroni correction by dividing the alpha level (.05) by 18, i.e. the number of comparisons (6 plots x 3 fits), resulting in a corrected alpha level of 0.0027777. I would encourage the authors to update the figure with a corrected version.\n\nHuman experimental weaknesses:\n* In human visual perception, spatial frequency is measured in cycles per degree of visual angle and depends on the distance to the monitor. If I understand correctly, the setup is employed with unknown distance between observers and monitor.\n* No information on monitor calibration, which is very important in experiments where stimuli of reduced contrast are shown. E.g., many monitors have settings that \"enhance\" contrast, which is not unlikely to have an impact on human experimental performance. Did the authors take this into account?\n* Human experiments with reduced contrast are best performed in a setting where contrast adaptation can take place. In the present study, however, the screen constantly changes from grey to bright white and back to grey again.\n* Given the online study setup, how did the authors ensure normal / corrected-to-normal vision (beyond self-reporting, where online participants have monetary incentives for inaccurate reporting)?\n* Two of the 16 observers (supplementary Figure 2) do not seem to perform well at all on the simple task\n\nQUESTIONS:\n### Questions:\n* What is going on with the two outlier observers in Figure 2 (1st column, bottom two rows)?\n* Given that some networks have severely reduced performance at 20% contrast, I'm wondering whether there might be a possible interaction of the experimental findings with the contrast level. As a supplementary experiment, it might be interesting to test the core findings separately for (a) networks which only show a minor performance detriment when reducing images to 20% contrast and (b) the rest of the networks.\n\n### Major opportunities for improvement:\n(The study is already quite solid, and I am in favor of publication. These suggestions go beyond what is currently done in the paper. If at least one of them can be addressed, I would be happy to increase my score further.)\n* \"we propose that critical band masking should be added to the toolbox of metrics for model-human comparison.\": I agree, and I was wondering whether the authors plan to facilitate this. For instance, they could release their stimuli as part of an open-source testbed (e.g., as a fork of  / addition to the model-vs-human toolbox, or in any other way).\n* The authors show that properties of critical bands are correlated with important properties like shape bias / adversarial robustness. Going beyond a correlation, I was wondering whether a causal link could be established, e.g. by reducing the signal-to-noise ratio of non-human channels in the input during training, leading to changed critical bands (e.g., more human-like ones), and then showing that the properties of interest (shape bias / adversarial robustness / ...) change accordingly.\n* The reasons for the human-model divergence are not yet understood. It would be interesting to know why this divergence arises, and whether it is a property of the architecture, the training procedure, or something else.\n\n\n### Minor questions:\n* line 86: should this be \"human object recognition\"?\n* why \"roughly equally distributed across all 16 categories\"? What was the exact distribution, and why was it not exactly equally distributed? (Background: performance can be above chance level 1/16 when categories aren't exactly equally distributed)\n\nLIMITATIONS:\nThe authors don't have a section on limitations. In accordance with the checklist, the authors are encouraged to describe the limitations of their approach, in particular related to the experimental choices mentioned in the \"weaknesses\" section above.", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 5, "SOUNDNESS_CORRECTNESS": 2, "DATE": "2023-06-14"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe authors propose to measure the differences in how humans and models rely on spectral information to recognize objects by using critical band masking to ablate. They conduct a human study revealing that humans detect objects with the same channels they use to detect letters and grating. On the other hand, models show a significantly wider channel. They further correlate the properties of the channel to robustness and shape bias, e.g. showing that AT results in an even wider channel.\n\nSTRENGTHS:\n### Originality\nThe paper explores a less common yet highly important research direction. Some \"model\" findings were partially reported in literature, but for the most part the findings are highly original.\n\n### Quality\nThe submission is of high quality (minor weaknesses see below). The authors rigorously conduct (well-documented) human experiments and benchmark 76 ImageNet models to arrive at their conclusions.\n\n### Clarity\nThe paper is very well written. Key points are communicated clearly through writing and figures.\n\n### Significance\nThe authors share many findings, that may be of great interest to the NeurIPS community. In particular, they measure the human critical channel and show that models measure higher bandwidths. Adversarial Training increases the channel even further. Generally, they find correlations between channel properties and shape-bias/robustness that may lead to a new perspective on robustness but also shows another misalignment between humans and models.\n\nWEAKNESSES:\n### Method\n- Evaluation only on ImageNet: I never thought I would make this as a weakness but here we go ... previous work has shown that the frequency band of adversarial attacks is not always HF (the authors arrive at the same conclusion in L230ff) but also highly depends on the dataset [2,3,4]. Given that this paper \"only\" presents an empirical evaluation I am not sure if the findings (about models and in particular robustness) scale to other datasets. At the very least this is a limitation that should be discussed.\n- Poor choice of robust networks: The authors choose $\\ell_2$-AT trained ResNets as robust networks and attack them with $\\ell_\\infty$ attacks. However, AT is notoriously poor at generalizing to new attacks. A better choice would have been $\\ell_\\infty$-AT trained ResNets. There may also be some differences in the evaluation as [1] showed that the norm differently affects performance on high/lowpass data. I don't expect this to flip observations, but it would be a more appropriate choice.\n- Minor: uncommon choice of parameters for robustness analysis. A more common choice would be $\\epsilon=4/255$ via 20-step PGD or better the AutoAttack suite. This probably won't impact the observations at all but may be easier to relate to.\n\n### Novelty \n- Some claims/observations in the submitted draft were already published. This does not invalidate the (exceeding) contributions of this paper, but the respective works should at least be mentioned. [2] already performed band-masking to study the critical bands of CNNs, [1] discussed how frequencies interact with shape-bias.\n\n\n### Others\n- The authors use 76 pretrained models only partially citing them. The Paper Checklist clearly states to cite all the used assets.\n\n- Authors do not discuss limitations\n\n- Minor: The authors repeatedly claim that transformers are shape-biased. This is not inherently true. It may hold if pretrained on large datasets such as ImageNet21k, but out of the box they don't perform much better, e.g. [1] shows that XCiT just barely performs better than ResNets in shape-bias when only trained on ImageNet1k.\n\n[1] Paul Gavrikov, Janis Keuper, Margret Keuper. \"An Extended Study of Human-Like Behavior Under Adversarial Training\". CVPR-W, 2023.\n[2] Antonio A. Abello, Roberto Hirata, and Zhangyang Wang. \"Dissecting the high-frequency bias in convolutional neural networks\". CVPR-W, 2021.\n[3] Remi Bernhard, Pierre-Alain Moellic, Martial Mermillod, Yannick Bourrier, Romain Cohendet, Miguel Solinas, and Marina Reyboz. \"Impact of spatial frequency based constraints on adversarial robustness\". IJCNN, 2021.\n[4] Guillermo Ortiz-Jimenez, Apostolos Modas, Seyed-Mohsen Moosavi-Dezfooli, and Pascal Frossard. \"Hold me tight! influence of discriminative features on deep network boundaries\". NeurIPS, 2020.\n\nQUESTIONS:\n- Are there any insights on whether improving the alignment between the model critical channel compared to humans would improve robustness or shape-bias, i.e. is there evidence of causality and not only correlation? \n- Did the authors attempt to encourage alignment in training?\n- Are there any observations on other datasets?\n\nLIMITATIONS:\nThe authors do not discuss limitations explicitly. One salient limitation is the evaluation of ImageNet. As discussed above certain frequency properties may not carry over to other datasets.\n\nI don't see any potential negative societal impact of their work.", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 5, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-04"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper presents an analysis of neural network response to object classification from the perspective of frequency components. The authors use an analytic tool based on critical band masking, which is a technique borrowed from neuroscience. \nThe focus of the network to use certain frequency bands for object classification is related to the frequency capabilities of the human visual system, then with shape bias and adversarial robustness of classification networks. \nThe contributions/novelty is in the neuroscientific technique used to analyze the network responses and behavior. The contributions are related to comparison of the frequency bad usage in the human visual system (HSV), neural networks and adversarially-trained networks, with limited contribution in terms of practical insights or indications/suggestions on how these observations would be usable.\n\nSTRENGTHS:\n-\tUse of a novel approach to analyze neural networks: the critical band masking technique is borrowed from neuroscience (very popular in auditory system analysis) and used to analyze the response of networks. The approach is novel and interesting.\n-\tExtent of models considered in the analysis (although the transformers are only slightly covered)\n\nWEAKNESSES:\n-\tUsefulness and outlook of the results: while the experimental results present an interesting view on the neural networks frequency selectivity for object classification, their significance and possible usage are not clear nor explicitly covered. Networks have a different behavior/frequency selectivity (not surprisingly I would say) nut no indication of how one should take over these findings and use them.\n-\tRelation between HVS and neural networks: the paper reads with an implicit assumption that the human visual system and neural networks for vision tasks are comparable systems. They are actually very different (with the second showing only some conceptual resemblance with the first), in terms of processing the data, energy-efficiency, ‘training’ etc. The results show that they behave differently (as expected) but do not address substantial differences between the two systems. I see a missed answer to important questions, as ‘why should we compare these systems and what do we gain from this analysis’?\n-\tDetails about the methodology are missing: e.g. is the analysis done taking into account both magnitude and phase of the spectrum, or only the magnitude? Phase is for instance shown important for object classification [1].\n-\tPlacement in the literature is very limited – references are outdated: missing references of works that study the network from a frequency perspective, relating the frequency spectrum with robustness and bias problems ([2,3,4,5], to mention a few).\n\n[1] Chen et al. Amplitude-phase recombination: Rethinking robustness of convolutional neural networks in frequency domain, ICCV 2021. \n\n[2] Yin D. et al. A fourier perspective on model robustness in computer vision. In NeurIPS, 2019.\n\n[3] Maiya et al. A frequency perspective of adversarial robustness, 2022.\n\n[4] Wang et al. Frequency shortcut learning in neural networks.  NeurIPS 2022 Workshop on Distribution Shifts\n\n[5] Wang et al. High-frequency component helps explain the generalization of convolutional neural networks. In CVPR, 2020.\n\nQUESTIONS:\n-\tCan the authors clarify details about the method and experimental analysis, such as the use of magnitude and phase of the spectrum?\n-\tCan the authors clarify the motivations why neural networks based vision models have to be compared with the human visual system of the brain, and why aspects such as energy efficiency, memory, and ‘training’? are not taken into account?\n-\tHow does the work related to actual existing work on frequency analysis of neural networks in vision tasks?\n-\tHow the achieved results fall within the current progress in understanding neural network learning and application, and how they can be used to improve models for vision task?\n-\tAre 16 human observers enough to have significant results? This is glossed over very briefly in the paper, but not analyses are provided to support the claims.\n\nLIMITATIONS:\nThe authors do not discuss limitations explicitly.\nAbout ethics, the authors say that humans are used for experiments and that a consent form has been signed, but there is no evidence of how this form is written, what the users agree with, and who approved the experiments.", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-04"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis work presents an empirical analysis of the sensitivity of humans and neural networks to critical band masking. This is the process of perturbing specific spatial frequencies, and determining which frequencies and at what magnitude, will lead to recognition errors. This in turns identifies the frequencies/magnitudes that a visual system “filters out” or “relies on” when performing recognition. The main finding is that neural networks are sensitive to a larger set of noise frequencies/magnitudes than human participants. Further, the paper presents evidence that adversarial-trained networks are sensitive to an even bigger set of frequencies/magnitudes, and correlation-based analyses indicating that more human-like networks that are sensitive to a narrow set of frequencies (smaller bandwidth) have a bigger shape bias.\n\nSTRENGTHS:\nOriginality\n- Critical band masking-based analysis has previously been done to analyze recognition of letters and gratings. The novelty for this paper comes from its critical band masking-based for ImageNet-like object recognition for 16 humans and 76 different neural networks.\n\nQuality\n- The design of the study is mostly sound: 1100 images from 16 categories of ImageNet with various kinds of added noise are used as the test set. Careful steps were taken to avoid clipping as a result of added noise. 16 participants are sufficient due to the small variability between subjects (Figure 2 in supplement).\n- The evidence for the claims of bigger channel bandwidth than humans, inverse correlation of bandwidth and shape bias, and increased bandwidth with, are sound regarding the 76 networks evaluated in this paper. Figures 4 5 6 contain clear evidence of these claims\n\nClarity\n- The paper is well written and mostly easy to follow. The plots in Figure 5 and 6 are quite condensed, containing a lot of information, but with the text and captions the reader can mostly parse them well.\n\nWEAKNESSES:\nQuality\n- The practical motivation behind using grayscale images reduced to 20% contrast makes sense, however, this represents a testing condition outside of the training data domain of these neural networks. A control experiment where the performance discrepancy between testing on standard RGB data and contrast reduced grayscale is quantified would justify this choice of test setting.\n- While the paper does investigate a diverse set of networks, one confounding factor that at least should be mentioned and ideally should be investigated in an analysis paper like this is the effect of training data and data augmentation on spatial frequency sensitivity. The design of the neural network itself is not the only factor. \n    * The neural networks used in this paper are primarily trained on ImageNet, but there are other datasets, for example Office-Home, with images from different domains for each object, and therefore different spatial frequency characteristics. Training on such data will likely result in different spatial frequency sensitivity. \n    * There might be straightforward steps like band-pass filtering or adding noise to the input data at training time, that might effectively reduce the range of frequencies a model is sensitive to.\n- The paper lacks a related work section. While it does mention a variety of prior work throughout the draft, it would be beneficial to include a separate section that would cover prior work on topics like: spatial frequency sensitivity of humans and neural networks, shape bias, adversarial robustness, and comparing humans and neural networks more broadly. The main benefit is to help the reader understand exactly where the proposed work lies relative to prior methods.\n\nSignificance\n- While it is interesting to see a comparison of spatial frequency sensitivity of networks to humans for object recognition, and to identify it as an emerging phenomenon for a variety of ImageNet-trained models, I’m concerned about what exactly is the significance of these findings for deep learning practitioners. How should researchers rethink their work going forward as a result of these findings?\n- As mentioned in the quality section, after reading this paper there is a sense of it not going quite far enough in the analysis. How pervasive is the phenomenon of a wider spatial frequency sensitivity of neural networks? It would be more impactful if it is demonstrated that this is a general phenomenon despite training data or simple mitigation strategies.\n- The observations about adversarial robustness are focused on one type of white-box adversarial attack, which is the least practically plausible.\n\nQUESTIONS:\n- What exactly is the significance of the findings presented in this work? What should be the main takeaway for researchers working on deep learning methodology for visual recognition, regarding how their future work should be affected by these findings? Is it necessarily better if the \"channel\" (as defined in this paper) is more human-like, and if so, why?\n- Given that filtered noise perturbation significantly alters the visual appearance of an image, so much so that it appears to be quite easy to identify images with such an attack, what is the significance of identifying the susceptibility to such attacks of adversarial-trained models (described in L298)?\n- What is the significance of the current findings abound frequency sensitivity, in light of the fact that the effect of training dataset choice and some basic techniques could be used to improve it?. How pervasive is this emerging phenomenon of a wider spatial frequency sensitivity of neural networks?\n\nLIMITATIONS:\nThe authors have adequately addressed the limitations.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-05"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nI have read the authors' rebuttal and will maintain my already very high rating.\n\nThis paper discovers a new fact (which should be replicated by others) about human vision: That we use the same frequency band for objects as we do for words and gratings. It seems remarkable that this has not been tested before, but a cursory google search didn’t turn up any previous result like this. Second, the paper shows that 76 deep network vision systems use a much wider band of frequencies than humans. Finally, the paper shows that aspects of these frequencies predict both shape bias and robustness against adversarial examples.\n\nSTRENGTHS:\n-This is one of those papers that one wishes one had written. The result about the human bandwidth is *Nature*-worthy! \n\n-The sequence of experiments: First human psychophysics, then network “psychophysics”, then showing that these measurements of noise-sensitivity (mean, std dev., and peak noise sensitivity) account for fairly large amounts of variance in the networks’ adversarial robustness and shape-sensitivity are both logical and surprisingly revealing. \n\n-The fact that these measurements account for 53% of the variance in shape-bias is remarkable, given that these are relatively low-level, and don’t have any necessary relationship to shape.\n\nWEAKNESSES:\nJust a few comments here:\nInclude the heat map key in the supplementary material (figure 2).\nYou should run some more experiments with adversarially-trained networks (see below).\n\nQUESTIONS:\nThe x axis for peak noise sensitivity in Figure 6 seems incorrect, based on the definition in Figure 2F, For example, for humans, it looks to be 1/(0.03), or about 33. It’s only after checking the supplementary material that this is made clear. It’s actually 1/(0.02*2^A), where A is the fitted parameter. This should be made clearer in the main text.\n\nDid you use MTurk’s ratings of workers? It seems like subjects 9 and 13 were only marginally engaged in the task. I would have thrown them out. \n\nI think you should reverse Figures 1 and 2. Also (if possible) 5 & 6. In both cases, you refer to the later one before the other.\n\nLIMITATIONS:\nDespite using 76 different networks, they only use ResNet50 for the adversarially-trained networks. It would be good to add a couple of other networks of different types (e.g., ViT, etc.) to see that this still holds. This could be added to the supplementary material.", "TITLE": "Official Review", "RECOMMENDATION": 10, "REVIEWER_CONFIDENCE": 5, "SOUNDNESS_CORRECTNESS": 4, "DATE": "2023-07-05"}