Original: Anatomically Constrained ResNets Exhibit Opponent Receptive Fields; So What?
Revised: Anatomically Constrained ResNets Exhibit Opponent Receptive Fields; So What?

Original: Anonymous Author(s)

Original: AfﬁliationAddress email

Original: Abstract
Revised: Abstract

Original: Primate visual systems are well known to exhibit varying degrees of bottlenecksin the early visual pathway.
Revised: Primate visual systems are well known to exhibit varying degrees of bottlenecks in the early visual pathway.

Original: Recent works have shown that the presence of a bottleneck between ‘retinal’ and ‘ventral’ parts of artiﬁcial models of visual systems,simulating the optic nerve, can cause the emergence of cellular properties that havebeen observed in primates: namely centre-surround organisation and opponency.
Revised: Recent works have shown that the presence of a bottleneck between ‘retinal’ and ‘ventral’ parts of artiﬁcial models of visual systems, simulating the optic nerve, can cause the emergence of cellular properties that have been observed in primates: namely centre-surround organisation and opponency.

Original: To date, however, state-of-the-art convolutional network architectures for classiﬁcation problems have not incorporated such an early bottleneck.
Revised: To date, however, state-of-the-art convolutional network architectures for classiﬁcation problems have not incorporated such an early bottleneck.

Original: In this paper, we askwhat happens if such a bottleneck is added to a ResNet-50 model trained to classifythe ImageNet data set.
Revised: In this paper, we ask what happens if such a bottleneck is added to a ResNet-50 model trained to classify the ImageNet data set.

Original: Do the emergent properties observed in simpler modelsstill appear in these considerably deeper and more complex models?
Revised: Our experiments show that some of the emergent properties observed in simpler models still appear in these considerably deeper and more complex models, however, there are some notable differences particularly with regard to spectral opponency.

Original: Does thebottleneck affect performance or robustness? Does the bottleneck  bias  the modelin some way?
Revised: The introduction of the bottleneck is experimentally shown to introduce a small but consistent shape bias into the network.

Original: or, does something else happen?
Revised: Tight bottlenecks are also shown to only have a very slight affect on the top-1 accuracy of the models when trained and tested on ImageNet.

Original:  Introduction and Motivation
Revised:  Introduction and Motivation

Original: Convolutional Neural Networks (CNNs) with a bottleneck designed to mimic the anatomical constraint imposed by the optic nerve have recently been shown to learn representations which moreclosely align with those found in primate visual systems.
Revised: Convolutional Neural Networks (CNNs) with a bottleneck designed to mimic the anatomical constraint imposed by the optic nerve have recently been shown to learn representations which more closely align with those found in primate visual systems.

Original: Speciﬁcally, Lindsey et al.
Revised: Speciﬁcally, Lindsey et al.

Original: [2019] showedthat a reduction in the number of channels or convolutional neurons in the second layer of a CNNgives rise to centre-surround receptive ﬁelds in the ﬁrst two layers followed by orientation selectivityin subsequent layers.
Revised: [2019] showed that a reduction in the number of channels or convolutional neurons in the second layer of a CNN gives rise to centre-surround receptive ﬁelds in the ﬁrst two layers followed by orientation selectivity in subsequent layers.

Original: Lindsey et al.
Revised: Lindsey et al.

Original: ’s experiments were based on a relatively simple model of thevisual system (aka ‘Retina-Net’) constructed with a model of the retina (the ﬁrst two layers up tothe bottleneck), a model of the ventral stream (stacked convolutional layers) and a pair of fullyconnected layers to produce a classiﬁcation.
Revised: ’s experiments were based on a relatively simple model of the visual system (aka ‘Retina-Net’) constructed with a model of the retina (the ﬁrst two layers up to the bottleneck), a model of the ventral stream (stacked convolutional layers) and a pair of fully connected layers to produce a classiﬁcation.

Original: These models were trained on a greyscale version of the
Revised: These models were trained on a greyscale version of the

Original: CIFAR-10 data set [Krizhevsky et al., 2009].
Revised: CIFAR-10 data set [Krizhevsky et al., 2009].

Original: Harris et al.
Revised: Harris et al.

Original: [2019, 2020] subsequently showed thatthe same network architecture (albeit with colour input) learns a simple opponent colour code in thebottleneck layer followed by a reduction in colour opponency in later layers.
Revised: [2019, 2020] subsequently showed that the same network architecture (albeit with colour input) learns a simple opponent colour code in the bottleneck layer followed by a reduction in colour opponency in later layers.

Original: Harris et al.
Revised: Harris et al.

Original: [2020]further demonstrated that the general trend that the bottleneck induces opponency was true across arange ofdata sets from CIFAR-10 to ImageNet [Russakovsky et al., 2015].
Revised: [2020] further demonstrated that the general trend that the bottleneck induces opponency was true across a range of

Original: Modern neural networks for solving large-scale classiﬁcation problems like ImageNet look verydifferent to the aforementioned ‘Retina-Net’ and its colour variant, and do not incorporate any formof bottleneck near the input layer.
Revised: Modern neural networks for solving large-scale classiﬁcation problems like ImageNet look very different to the aforementioned ‘Retina-Net’ and its colour variant, and do not incorporate any form of bottleneck near the input layer.

Original: At the same time, other recent research has demonstrated that theremay be beneﬁts to better modelling of the visual system in state-of-the-art models.
Revised: At the same time, other recent research has demonstrated that there may be beneﬁts to better modelling of the visual system in state-of-the-art models.

Original: For example,
Revised: For example,

Original: Geirhos et al.
Revised: Geirhos et al.

Original: [2019] show that CNNs trained on ImageNet are biased towards texture information incontrast to Human observers who make classiﬁcations predominantly according to shape information.
Revised: [2019] show that CNNs trained on ImageNet are biased towards texture information in contrast to Human observers who make classiﬁcations predominantly according to shape information.

Original: They subsequently show that promoting a shape bias in trained models can improve both accuracyand robustness.

Original: Dapello et al.

Original: [2020] show that simulating the function performed by the primaryvisual cortex over the input increases robustness to adversarial attacks in which images which have

Original: N BN
Revised: N BN

Original: W
Revised: W

Original: H
Revised: H

Original: W
Revised: W

Original: H. . .
Revised: H. . .

Original: Retina
Revised: Retina

Original: ResNet-  been imperceptibly (to a human) adjusted such that the classiﬁcation given by the trained network isno longer correct.
Revised: ResNet- They subsequently show that promoting a shape bias in trained models can improve both accuracy and robustness. Dapello et al. [2020] show that simulating the function performed by the primary visual cortex over the input increases robustness to adversarial attacks in which images which have been imperceptibly (to a human) adjusted such that the classiﬁcation given by the trained network is no longer correct.

Original: Their model for simulating V1 (V1Block) is based on the classical observations(for example by Hubel and Wiesel [2004]) that the receptive ﬁelds of cells in V1 are orientationselective (modelled as Gabor ﬁlters) and that these cells can be described as either simple or complex(modelled with different acitvation functions).
Revised: Their model for simulating V1 (V1Block) is based on the classical observations (for example by Hubel and Wiesel [2004]) that the receptive ﬁelds of cells in V1 are orientation selective (modelled as Gabor ﬁlters) and that these cells can be described as either simple or complex (modelled with different acitvation functions).

Original: Parameters for the Gabor ﬁlters in the V1Block aresampled according to known distributions from the neuroscience literature rather than being learned.
Revised: Parameters for the Gabor ﬁlters in the V1Block are sampled according to known distributions from the neuroscience literature rather than being learned.

Original: The model also assumes that the input to the V1Block is just the normalised pixel values (subtract 0.5and divide by 0.5 for each RGB colour channel) and eschews any notion of processing performed bythe retina itself, or by the Lateral Geniculate Nucleus (LGN).
Revised: The model also assumes that the input to the V1Block is just the normalised pixel values (subtract 0. and divide by 0.5 for each RGB colour channel) and eschews any notion of processing performed by the retina itself, or by the Lateral Geniculate Nucleus (LGN).

Original: In particular, since convolutional neurons already reﬂect many of the functional properties of cellsfound in the early visual system, it is prudent to ascertain whether more simple modiﬁcations, suchas the bottleneck explored by Lindsey et al.
Revised: Since convolutional neurons already reﬂect many of the functional properties of cells found in the early visual system, it is prudent to ascertain whether more simple modiﬁcations, such as the bottleneck explored by Lindsey et al.

Original: [2019], Harris et al.
Revised: [2019] and Harris et al.

Original: [2019, 2020], can be used to thesame effect.
Revised: [2019, 2020], can be used to the same effect.

Original: This paper starts to ask what happens if we place a bottleneck at the beginning of aperformant classiﬁcation network trained on the ImageNet data set.
Revised: This paper starts to ask what happens if we place a bottleneck at the beginning of a performant classiﬁcation network trained on the ImageNet data set.

Original: Does the bottleneck inducesimilar emergence of primate-like cell types?
Revised: We ﬁrst show that the bottleneck induces similar emergence of relevant cell types, but with some important differences.

Original: How does the bottleneck affect classiﬁcation accuracyof the networks?
Revised: In particular, we ﬁnd that very tight bottlenecks give rise to cells that are perhaps better described as luminance opponent rather than colour opponent. In addition, we ﬁnd that the stark differences between receptive ﬁelds of cells in networks with different bottlenecks, observed by Lindsey et al. [2019], are more nuanced with centre-surround receptive ﬁelds seeming to emerge for all bottlenecks. We further show that the introduction of the bottleneck introduces a small but consistent shape bias.

Original: Does a bottleneck in this setting increase robustness of  the model to adversarialattacks or does it induce some kind of bias in the function performed by the network?
Revised: Finally, we consider the adversarial robustness of our models, showing that the bottleneck slightly improves robustness to natural adversarial examples but actually reduces robustness measured as a worst-case accuracy following multiple attacks.

Original:  Early Visual Representations in Anatomically Constrained ResNets
Revised:  Early Visual Representations in Anatomically Constrained ResNets

Original: In order to add a bottleneck to an existing model, we propose pre-pending the ‘Retina’ portion of themodel from Lindsey et al.
Revised: In order to add a bottleneck to an existing model, we propose pre-pending the ‘Retina’ portion of the model from Lindsey et al.

Original: This consists of two convolutional layers with 32 channels and
Revised: This consists of two convolutional layers with 32 channels and

Original: N BN channels respectively, where N BN is the bottleneck width.
Revised: N BN channels respectively, where N BN is the bottleneck width.

Original: Unlike the model of Lindsey et al.[2019] which uses a kernel size of 9 , we choose the kernel size to ensure a large enough receptiveﬁeld whilst preserving consistency with the ﬁrst layer of the target model where possible (e.g. 7 fora ResNet).
Revised: Unlike the model of Lindsey et al. [2019] which uses a kernel size of 9 , we choose the kernel size to ensure a large enough receptive ﬁeld whilst preserving consistency with the ﬁrst layer of the target model where possible (e.g. 7 for a ResNet).

Original: Padding is chosen such that the resolution of the output is the same as the resolution ofthe input.
Revised: Padding is chosen such that the resolution of the output is the same as the resolution of the input.

Original: In this way the bottleneck acts as a kind of parameterised pre-processing of the input.
Revised: In this way the bottleneck acts as a kind of parameterised pre-processing of the input.

Original: Wetrained constrained variants of a ResNet-50 (depicted in Figure 1) for the range of bottleneck widthsused by Lindsey et al.
Revised: We trained constrained variants of a ResNet-50 (depicted in Figure 1) for the range of bottleneck widths used by Lindsey et al.

Original: [2019] ( N BN ∈ { 1 , 2 , 4 , 8 , 16 , 32 } ) on the ImageNet Large Scale Visual
Revised: [2019] ( N BN ∈ { 1 , 2 , 4 , 8 , 16 , 32 } ) on the ImageNet Large Scale Visual

Original: Recognition Challenge (ILSVRC) [Russakovsky et al., 2015] data set.
Revised: Recognition Challenge (ILSVRC) [Russakovsky et al., 2015] data set.

Original: We trained three repeats ofeach model variant, giving 18 models in total.
Revised: We trained three repeats of each model variant, giving 18 models in total.

Original: The training regime is described in Appendix D.
Revised: The training regime is described in Appendix D.

Original: We ﬁrst computed the distribution of opponent cell types following the approach from Harris et al.[2019, 2020] in the second retina layer (Retina-2) and ﬁrst ResNet layer (ResNet-1).

Original: This approachconsists of presenting a set of stimuli which vary in hue to the cell in order to obtain a hue responsecurve.

Original: The cell is colour opponent if the response curve crosses the baseline response of the cellto a zero stimulus.

Original: Interestingly, our results showed that networks with N BN = 1 have no colouropponent cells in either of the layers we studied.

Original: This contrasts with the ﬁnding of Harris et al.

Original: [2019,2020], who showed that almost all cells in the retina layers of their more constrained networks werecolour opponent.

Original: We presume that the range of colour stimuli in ImageNet is sufﬁciently broadthat when restricted to one channel, better performance can be obtained with a luminance opponentencoding than a colour opponent one.

Original: To test this, we additionally present a set of stimuli which vary

Original: [Figure]
Revised: [Figure]

Original: BN 0 .0 .0 .0 .0 .1 .

Original: P
Revised: P

Original: e r ce n t ag e
Revised: e r ce n t ag e

Original: Luminance
Revised: Luminance

Original: Colour
Revised: Colour

Original: Both(a
Revised: Both

Original: [Figure]
Revised: [Figure]

Original: Retina-2 opponent cell distribution   32 N BN 0 .0 .0 [-.
-]
Revised: cell distribution   32 N BN 0 .0 .0 [-.
-].0 .0 .1 .

Original: P
Revised: P

Original: e r ce n t ag e
Revised: e r ce n t ag e

Original: Luminance
Revised: Luminance

Original: Colour
Revised: Colour

Original: Both
Revised: Both

Original: [Figure]
Revised: [Figure]

Original:  distribution 
Revised: We ﬁrst computed the distribution of opponent cell types following the approach from Harris et al.

Original: [Figure]
Revised: [2019, 2020] in the second retina layer (Retina-2) and ﬁrst ResNet layer (ResNet-1).

Original: Pomegranate
Revised: This approach consists of presenting a set of stimuli which vary in hue to the cell in order to obtain a hue response curve. The cell is colour opponent if the response curve crosses the baseline response of the cell to a zero stimulus. Interestingly, our results showed that networks with N BN = 1 have no colour opponent cells in either of the layers we studied.

Original: Pineapple
Revised: This contrasts with the ﬁnding of Harris et al. [2019, 2020], who showed that almost all cells in the retina layers of their more constrained networks were colour opponent. We presume that the range of colour stimuli in ImageNet is sufﬁciently broad that when restricted to one channel, better performance can be obtained with a luminance opponent encoding than a colour opponent one.

Original: Even are in luminance (i.e. full ﬁeld grey-scale stimuli with values ranging from zero to one) and performthe same process of comparing to the baseline (response of the cell to constant stimulus of 0 .
Revised: To test this, we additionally present a set of stimuli which vary in luminance (i.e. full ﬁeld grey-scale stimuli with values ranging from zero to one) and perform the same process of comparing to the baseline (response of the cell to constant stimulus of 0 .

Original: 5 forthis experiment) to infer luminance opponency.
Revised: 5 for this experiment) to infer luminance opponency.

Original: Note that any cell whose response is linear in thesense that extremes of input value correspond to extremes of response will be classiﬁed as luminanceopponent.
Revised: Note that any cell whose response is linear in the sense that extremes of input value correspond to extremes of response will be classiﬁed as luminance opponent.

Original: It is therefore appropriate to say that any cells which are not luminance opponent are tosome degree non-linear.
Revised: It is therefore appropriate to say that any cells which are not luminance opponent are to some degree non-linear.

Original: Figures 2a and 2b give the results for this experiment in the Retina-2 and ResNet-1 layers respectively.
Revised: Figures 2a and 2b give the results for this experiment in the Retina-2 and ResNet-1 layers respectively.

Original: The results show that the vast majority of colour opponent cells are also luminance opponent,particularly in the more constrained networks.
Revised: The results show that the vast majority of colour opponent cells are also luminance opponent, particularly in the more constrained networks.

Original: In the Retina-2 layer, there is an increase in cells whichare luminance opponent, but not colour opponent, for networks with N BN < 4 .
Revised: In the Retina-2 layer, there is an increase in cells which are luminance opponent, but not colour opponent, for networks with N BN < 4 .

Original: This in turn suggestsan increase in the linearity of cell response for these networks, which accords with the ﬁndings of
Revised: This in turn suggests an increase in the linearity of cell response for these networks, which accords with the ﬁndings of

Original: Lindsey et al.
Revised: Lindsey et al.

Original: [2019], Harris et al.
Revised: [2019], Harris et al.

Original: Almost all cells in the ﬁrst ResNet layer are luminanceopponent.
Revised: Almost all cells in the ﬁrst ResNet layer are luminance opponent.

Original: In both layers, approximately half of the cells are also colour opponent in networks with allbut the tightest bottlenecks, where the percentage of colour opponent cells drops to zero.
Revised: In both layers, approximately half of the cells are also colour opponent in networks with all but the tightest bottlenecks, where the percentage of colour opponent cells drops to zero.

Original: Ultimately,the pattern in the colour opponent cell distribution shown by Harris et al.
Revised: Ultimately, the pattern in the colour opponent cell distribution shown by Harris et al.

Original: [2019, 2020] is replacedwith a similar pattern in luminance opponent cell distribution in these networks.
Revised: [2019, 2020] is replaced with a similar pattern in luminance opponent cell distribution in these networks.

Original: We explore thesecells further and ﬁnd some evidence that they exhibit centre-surround organisation in Appendix A.
Revised: We explore these cells further and ﬁnd some evidence that they exhibit centre-surround organisation in Appendix A.

Original: In the neuroscience literature, the distinction between luminance opponency and colour opponency isoften unclear.
Revised: In the neuroscience literature, the distinction between luminance opponency and colour opponency is often unclear.

Original: For example, it has been argued that many of the cells which preferred achromaticstimuli in Monkey V1, described by Hubel and Wiesel [1968], may be better described as colouropponent but with imbalanced cone response such that they are also responsive to luminance [Johnsonet al., 2001, Lennie et al., 1990, Schluppeck and Engel, 2002, Shapley and Hawken, 2011].
Revised: For example, it has been argued that many of the cells which preferred achromatic stimuli in Monkey V1, described by Hubel and Wiesel [1968], may be better described as colour opponent but with imbalanced cone response such that they are also responsive to luminance [Johnson et al., 2001, Lennie et al., 1990, Schluppeck and Engel, 2002, Shapley and Hawken, 2011].

Original: Wetherefore must ascertain whether the luminance opponent cells are still able to convey valuableinformation regarding the colour of the input.
Revised: We therefore must ascertain whether the luminance opponent cells are still able to convey valuable information regarding the colour of the input.

Original: To do this, we propose performing gradient ascent

Original: [Figure]

Original: [-Sh a p e B i a s 32 N BN 74 .74 .74 .
 A cc u r a c y-] on a random input in Fourier space, following Olah et al.
Revised: [-Sh a p e B i a s 32 N BN 74 .74 .74 .
 A cc u r a c y-]To do this, we propose performing gradient ascent on a random input in Fourier space, following Olah et al.

Original: [2017], to obtain super stimuli which thenetworks classify with high conﬁdence as a range of classes which are characterised by a particularcolour.
Revised: [2017], to obtain super stimuli which the networks classify with high conﬁdence as a range of classes which are characterised by a particular colour.

Original: Figure 3 shows these stimuli for a range of fruit classes in the ImageNet data set for modelswith N BN = 1 and N BN .
Revised: Figure 3 shows these stimuli for a range of fruit classes in the ImageNet data set for models with N BN = 1 and N BN .

Original: From the ﬁgure we can see that the networks with a single ( N BN = 1 )luminance opponent channel in the bottleneck layer still make use of colour to inform their decisions,learning the characteristic red of a strawberry, yellow of a lemon, green of an apple, and so on. 
Revised: From the ﬁgure we can see that the networks with a single ( N BN = 1 ) luminance opponent channel in the bottleneck layer still make use of colour to inform their decisions, learning the characteristic red of a strawberry, yellow of a lemon, green of an apple, and so on. This is possible since these luminance opponent cells may still have a broad non-opponent hue response that uniquely encodes colour over at least part of the hue wheel. [Figure] [Figure]

Original:  It is clear from Figure 3 that neither of the models is particularly biased towards shape in thatthe super stimuli have appropriate textures and colours but not shapes.
Revised: i a [Figure] [Figure] It is clear from Figure 3 that neither of the models is particularly biased towards shape in that the super stimuli have appropriate textures and colours but not shapes.

Original: To quantify this, we nowmeasure the shape bias of the models.
Revised: To quantify this, we now measure the shape bias of the models.

Original: Following Geirhos et al.
Revised: Following Geirhos et al.

Original: [2019], we evaluate the models onthe ‘StylizedImageNet’ data set 1 , which contains images with a texture-shape cue conﬂict, requiringnetworks to recognise objects based on shape rather than texture.
Revised: [2019], we evaluate the models on the ‘StylizedImageNet’ data set 3 , which contains images with a texture-shape cue conﬂict, requiring networks to recognise objects based on shape rather than texture.

Original: Figure 4 shows that networkswith tighter bottlenecks exhibit a small increase in shape bias.
Revised: Figure 4 shows that networks with tighter bottlenecks exhibit a small increase in shape bias.

Original: The model with a bottleneck widthof 1 trained on ImageNet achieves the highest shape bias, outrunning a standard (i.e. without ourmodiﬁcation) ResNet-50 model.
Revised: The model with a bottleneck width of 1 trained on ImageNet achieves the highest shape bias, outrunning a standard (i.e. without our modiﬁcation) ResNet-50 model.

Original: Note, however, that the shape bias of all of the models is far lowerthan the models trained with the approach from Geirhos et al.
Revised: Note, however, that the shape bias of all of the models is far lower than the models trained with the approach from Geirhos et al.

Original:  What Effect Does a Bottleneck Have on Performance?
Revised:  What Effect Does a Bottleneck Have on Performance?

Original: In this section we explore whether the changes in function induced by the bottleneck correspondto any tangible improvement in performance.
Revised: In this section we explore whether the changes in function induced by the bottleneck correspond to any tangible improvement in performance.

Original: The most obvious ﬁrst step is to consider the effectof the bottleneck on the accuracy of the model.
Revised: The most obvious ﬁrst step is to consider the effect of the bottleneck on the accuracy of the model.

Original: Figure 5 shows that networks with bottleneckwidth of 4 or greater all achieve validation set performance that is within the margin of error (onestandard deviation) of the others and that networks with tighter bottlenecks show a small but cleardrop in performance.
Revised: Figure 5 shows that networks with bottleneck width of 4 or greater all achieve validation set performance that is within the margin of error (one standard deviation) of the others and that networks with tighter bottlenecks show a small but clear drop in performance.

Original: Importantly, all of the networks perform within 2% of theResNet-50 withoutour modiﬁcation compared to the pre-trained version provided in torchvision ( 76 . 15% ), which hasminor differences in the training procedure that might explain this.
Revised: Importantly, all of the networks perform within 2% of the pre-trained ResNetwithout our modiﬁcation provided in torchvision ( 76 . 15% ), which has minor differences in the training procedure that might explain this.

Original: This contrasts with the networksconsidered by Dapello et al.
Revised: This contrasts with the networks considered by Dapello et al.

Original: [2020] which show a larger reduction of around 4 .
Revised: [2020] which show a larger reduction of around 4 .

Original: 5% reaching anaccuracy of 71 .
Revised: 5% reaching an accuracy of 71 .

Original: 7% (although again note that there areminor differences in the training procedure).
Revised: 7% (although again note that there are differences in the training procedure).

Revised: Note that in addition to small differences in training procedure, our bottleneck layers do not make use of modern conventions such as BatchNorm which are known to provide important performance beneﬁts, particularly in deeper networks.

Revised: [Figure]

Revised: [Figure]

Original:  Robustness to natural adversarial examples We now consider robustness to the ImageNet-A dataset [Hendrycks et al., 2019], which contains 7500 naturally occurring images which are consistentlymis-classiﬁed by pre-trained models.
Revised: et [Figure] Robustness to natural adversarial examples We now consider robustness to the ImageNet-A data set [Hendrycks et al., 2019], which contains 7500 naturally occurring images which are consistently mis-classiﬁed by pre-trained models.

Original: The images correspond to 200 ImageNet classes in whichnormal models (ResNet50, VGG16, etc) have a top-1 accuracy of more than 90% using the ImageNetvalidation data set.
Revised: The images correspond to 200 ImageNet classes in which normal models (ResNet50, VGG16, etc) have a top-1 accuracy of more than 90% using the ImageNet validation data set.

Original: The ImageNet-A data set typically results in a top-1 accuracy of around 2-3%on the same models.
Revised: The ImageNet-A data set typically results in a top-1 accuracy of around 2-3% on the same models.

Original: Figure 6 shows the top-1 accuracy of our models on the ImageNet-A data set.
Revised: Figure 6 shows the top-1 accuracy of our models on the ImageNet-A data set.

Original: Figure 11 from the appendix shows the Area Under the Response Rate Accuracy curve (AURRA)which measures how calibrated the models are (how a model’s conﬁdence in its prediction relatesto its accuracy).
Revised: Figure 11 from the appendix shows the Area Under the Response Rate Accuracy curve (AURRA) which measures how calibrated the models are (how a model’s conﬁdence in its prediction relates to its accuracy).

Original: Both of these ﬁgures illustrate that the tighter bottlenecks do induce slightly betterperformance on this task.
Revised: Both of these ﬁgures illustrate that the tighter bottlenecks do induce slightly better performance on this task.

Original: Robustness to L ∞ constrained artiﬁcial attacks To study a more general notion of adversarialrobustness, we follow the guidelines given by Carlini et al.
Revised: Robustness to L ∞ constrained artiﬁcial attacks To study a more general notion of adversarial robustness, we follow the guidelines given by Carlini et al.

Original: We use FoolBox [Rauber et al. ,2017, 2020] to compute the worst case performance of the models under a range of attacks.We [Figure]
Revised: We use FoolBox [Rauber et al., 2017, 2020] to compute the worst case performance of the models under a range of attacks.

Original: [Figure]

Original: [Figure] cc u r [Figure] c y 1 8 explore a range of perturbations using different L ∞ thresholds between 0 and 1.0.
Revised: We explore a range of perturbations using different L ∞ thresholds between 0 and 1.0.

Original: The attacks include
Revised: The attacks include

Original: Project Gradient Descent, which was utilised by Dapello et al.
Revised: Project Gradient Descent, which was utilised by Dapello et al.

Original: [2020] to demonstrate improvedrobustness of their model.
Revised: [2020] to demonstrate improved robustness of their model.

Original: A full description of the speciﬁc attacks is given in Appendix C. Figure 7shows the robust accuracy, the worst-case performance following all attacks, of the models acrossdifferent L ∞ perturbation budgets.
Revised: A full description of the speciﬁc attacks is given in Appendix C. Figureshows the robust accuracy, the worst-case performance following all attacks, of the models across different L ∞ perturbation budgets.

Original: Results were computed by sampling 10000 images from the
Revised: Results were computed by sampling 10000 images from the

Original: ImageNet validation set uniformly for each class.
Revised: ImageNet validation set uniformly for each class.

Original: The results show that the increased opponency andsmall increase in shape bias actually correspond to a decrease in robustness to targeted adversarialexamples.
Revised: The results show that the increased opponency and small increase in shape bias actually correspond to a decrease in robustness to targeted adversarial examples.

Original: In Appendix B, we further show that the CIFAR-10 trained models from Harris et al.[2019, 2020] show no signiﬁcant difference in adversarial robustness as a function of bottleneck.
Revised: In Appendix B, we further show that the CIFAR-10 trained models from Harris et al. [2019, 2020] show no signiﬁcant difference in adversarial robustness as a function of bottleneck.

Original:  Discussion
Revised:  Discussion

Original: In this paper we have explored the addition of a bottleneck to ImageNet trained ResNet-50 models.
Revised: In this paper we have explored the addition of a bottleneck to ImageNet trained ResNet-50 models.

Original: We have shown that cells in the bottleneck layer of models with tight bottlenecks learn opponentreceptive ﬁelds in accordance with the CIFAR-10 results of Harris et al.
Revised: We have shown that cells in the bottleneck layer of models with tight bottlenecks learn opponent receptive ﬁelds in accordance with the CIFAR-10 results of Harris et al.

Original: In contrast tothose results, the opponent cells we ﬁnd here are best described as luminance opponent rather thancolour opponent.
Revised: In contrast to those results, the opponent cells we ﬁnd here are best described as luminance opponent rather than colour opponent.

Original: That said, we have shown that these luminant opponent cells still exhibit some formof spectral response and that, even in the extreme case of N BN = 1 , the model is able to learn aboutcolour.
Revised: That said, we have shown that these luminant opponent cells still exhibit some form of spectral response and that, even in the extreme case of N BN = 1 , the model is able to learn about colour.

Original: Whether the cells in networks with tight bottlenecks have centre-surround receptive ﬁelds ofthe kind observed by Lindsey et al.
Revised: Whether the cells in networks with tight bottlenecks have centre-surround receptive ﬁelds of the kind observed by Lindsey et al.

Original: [2019] is unclear, although there is some evidence that they do.
Revised: [2019] is unclear, although there is some evidence that they do.

Original: Itis, however, clear that the Retina-2 cells respond more linearly in networks with tight bottlenecks,echoing the ﬁnding of Lindsey et al.
Revised: It is, however, clear that the Retina-2 cells respond more linearly in networks with tight bottlenecks, echoing the ﬁnding of Lindsey et al.

Original: We have further shown that these differences in functioncorrespond to a small but consistent increase in the shape bias of the networks.
Revised: We have further shown that these differences in function correspond to a small but consistent increase in the shape bias of the networks.

Original: Our investigation into the performance of the different bottlenecked models is surprising in thesense that it perhaps asks more questions than it answers.
Revised: Our investigation into the performance of the different bottlenecked models is surprising in the sense that it perhaps asks more questions than it answers.

Original: At the outset our hypothesis was that thebottleneck might encourage both shape bias as well as adversarial robustness; the typical natureof centre-surround opponent cells observed in prior studies would for example suggest that theearly network would perform isotropic band-pass ﬁltering (like a Laplacian of Gaussian) which onepresumes would naturally bias to towards shape representations 2 .
Revised: At the outset our hypothesis was that the bottleneck might encourage both shape bias as well as adversarial robustness; the typical nature of centre-surround opponent cells observed in prior studies would for example suggest that the early network would perform isotropic band-pass ﬁltering (like a Laplacian of Gaussian) which one presumes would naturally bias to towards shape representations 4 .

Original: In terms of accuracy, the differentbottlenecks only have a mild effect with the tightest bottlenecks (below 8) having slightly worseperformance.
Revised: In terms of accuracy, the different bottlenecks only have a mild effect with the tightest bottlenecks (below 8) having slightly worse performance.

Original: The results of testing the models on natural adversarial examples indicates that thetightest bottlenecks do perform better on the ImageNet-A data set (both in terms of accuracy andcalibration).
Revised: The results of testing the models on natural adversarial examples indicates that the tightest bottlenecks do perform better on the ImageNet-A data set (both in terms of accuracy and calibration).

Original: However, it is unclear whether this increase corresponds to an increase in robustness ormerely indicates that the type of function learned differs for tighter bottlenecks.
Revised: However, it is unclear whether this increase corresponds to an increase in robustness or merely indicates that the type of function learned differs for tighter bottlenecks.

Original: In any case, the worstcase accuracy, computed after a set of targeted adversarial attacks, shows that adversarial robustnessactually decreases slightly as the bottleneck is tightened.
Revised: In any case, the worst case accuracy, computed after a set of targeted adversarial attacks, shows that adversarial robustness actually decreases slightly as the bottleneck is tightened.

Original: A Receptive Field Visualisations
Revised: A Receptive Field Visualisations

Original: [Figure] Figure 8 shows the receptive ﬁeld visualisations in grey-scale and colour for cells in the Retina-2layer of networks with N BN = 1 and N BN = 32 .
Revised: Figure 8 shows the receptive ﬁeld visualisations in grey-scale and colour for cells in the Retinalayer of networks with N BN = 1 and N BN = 32 .

Original: These are computed by taking the gradient of theresponse of the centre neuron to a blank stimulus (constant value of zero) and then applying min /max normalisation to obtain an image.
Revised: These are computed by taking the gradient of the response of the centre neuron to a blank stimulus (constant value of zero) and then applying min / max normalisation to obtain an image.

Original: The results show that the cells in networks with N BN = 1are somewhat centre-surround, but with quite a small extent.
Revised: The results show that the cells in networks with N BN =are somewhat centre-surround, but with quite a small extent.

Original: In contrast, the cells in networks with
Revised: In contrast, the cells in networks with

Original: N BN = 32 have much smoother receptive ﬁelds that are sensitive to changes over a much largerregion of the input.
Revised: N BN = 32 have much smoother receptive ﬁelds that are sensitive to changes over a much larger region of the input.

Original: Although it is true that we ﬁnd exclusively centre-surround cells in the networkswith N BN = 1 , we also ﬁnd some centre-surround cells in the networks with N BN = 32 .
Revised: Although it is true that we ﬁnd exclusively centre-surround cells in the networks with N BN = 1 , we also ﬁnd some centre-surround cells in the networks with N BN = 32 .

Original: To try to better understand the functions performed by these cells, we plot the response of each cell toan example input in Figure 9.
Revised: To try to better understand the functions performed by these cells, we plot the response of each cell to an example input in Figure 9.

Original: The results show that when N BN = 1 , the Retina-2 cells preserve mostof the edge information in the image (with perhaps a mild edge enhancement effect) and respondin accordance with the brightness of the input (albeit inverted for two of the cells).
Revised: The results show that when N BN = 1 , the Retina-2 cells preserve most of the edge information in the image (with perhaps a mild edge enhancement effect) and respond in accordance with the brightness of the input (albeit inverted for two of the cells).

Original: In contrast, the
Revised: In contrast, the

Original: Retina-2 cells in networks with N BN = 32 distort the input heavily, performing speciﬁc colouropponent edge detection functions.
Revised: Retina-2 cells in networks with N BN = 32 distort the input heavily, performing speciﬁc colour opponent edge detection functions.

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: B CIFAR-10 Adversarial Robustness
Revised: B CIFAR-10 Adversarial Robustness

Original: To determine the adversarial robustness of the models trained on CIFAR-10 from Harris et al.
Revised: To determine the adversarial robustness of the models trained on CIFAR-10 from Harris et al.

Original: [2019,2020], we perform the same suite of attacks as in our ImageNet experiments (outlined in Appendix C)but over the whole CIFAR-10 test set.
Revised: [2019, 2020], we perform the same suite of attacks as in our ImageNet experiments (outlined in Appendix C) but over the whole CIFAR-10 test set.

Original: Figure 10 shows the worst case accuracy for these modelsfollowing all attacks.
Revised: Figure 10 shows the worst case accuracy for these models following all attacks.

Original: The results again show that no signiﬁcant difference is obtained through theintroduction of a bottleneck.
Revised: The results again show that no signiﬁcant difference is obtained through the introduction of a bottleneck.

Original: C Artiﬁcial Adversarial Attacks
Revised: C Artiﬁcial Adversarial Attacks

Original: We use the following adversarial attacks with L ∞ perturbation budgets between 0.0 and 1.1.
Revised: We use the following adversarial attacks with L ∞ perturbation budgets between 0.0 and 1.1.

Original: Eachattack uses the FoolBox [Rauber et al., 2020] implementation with default parameters.
Revised: Each attack uses the FoolBox [Rauber et al., 2020] implementation with default parameters.

Original: • Fast Gradient Sign Method [Goodfellow et al., 2015] • Projected Gradient Descent [Madry et al., 2018]
Revised: • Fast Gradient Sign Method [Goodfellow et al., 2015] • Projected Gradient Descent [Madry et al., 2018]

Original: • Basic Iterative Method [Kurakin et al., 2017] • Additive Uniform Noise • DeepFool [Moosavi-Dezfooli et al., 2016]
Revised: • Basic Iterative Method [Kurakin et al., 2017] • Additive Uniform Noise • DeepFool [Moosavi-Dezfooli et al., 2016]

Original: D Model Training
Revised: D Model Training

Original: Models were trained on the ImageNet 2012 training set on nodes equipped with four NVidia Quadro
Revised: Models were trained on the ImageNet 2012 training set on nodes equipped with four NVidia Quadro

Original: RTX 8000 GPUs.
Revised: RTX 8000 GPUs.

Original: The following setup was used:
Revised: The following setup was used:

Original: Batch size: Optimiser: SGD with the following: initial lr: 0.
Revised: Batch size: Optimiser: SGD with the following: initial lr: 0.

Original: momentum: 0.
Revised: momentum: 0.

Original: weight decay: 1eschedule: lr drops by factor of 10 at 30 and 60 epochs epochs: Data Augmentation: Random resized cropping to 224x random horizontal ﬂipping normalisation using standard ImageNet mean and s.d.
Revised: weight decay: 1eschedule: lr drops by factor of 10 at 30 and 60 epochs epochs: Data Augmentation: Random resized cropping to 224x random horizontal ﬂipping normalisation using standard ImageNet mean and s.d.

Original: Code and all trained models will be made available following de-anonymisation of the manuscript.
Revised: Code and all trained models will be made available following de-anonymisation of the manuscript.