Finding Biological Plausibility for Adversarially Robust Features via Metameric Tasks

TL;DR

This study investigates whether adversarially robust neural network representations align with human peripheral vision, finding that they resemble texture-based processing and could explain robustness to adversarial attacks.

Contribution

It provides psychophysical evidence that robust network features mimic human peripheral texture processing, linking robustness to biological plausibility.

Findings

Robust representations are less distinguishable in peripheral vision.

Performance trends on robust and texture models are similar across visual field.

Non-robust representations show minimal change across the visual field.

Abstract

Recent work suggests that representations learned by adversarially robust networks are more human perceptually-aligned than non-robust networks via image manipulations. Despite appearing closer to human visual perception, it is unclear if the constraints in robust DNN representations match biological constraints found in human vision. Human vision seems to rely on texture-based/summary statistic representations in the periphery, which have been shown to explain phenomena such as crowding and performance on visual search tasks. To understand how adversarially robust optimizations/representations compare to human vision, we performed a psychophysics experiment using a set of metameric discrimination tasks where we evaluated how well human observers could distinguish between images synthesized to match adversarially robust representations compared to non-robust representations and a texture synthesis model of peripheral vision (Texforms). We found that the discriminability of robust representation and texture model images decreased to near chance performance as stimuli were presented farther in the periphery. Moreover, performance on robust and texture-model images showed similar trends within participants, while performance on non-robust representations changed minimally across the visual field. These results together suggest that (1) adversarially robust representations capture peripheral computation better than non-robust representations and (2) robust representations capture peripheral computation similar to current state-of-the-art texture peripheral vision models. More broadly, our findings support the idea that localized texture summary statistic representations may drive human invariance to adversarial perturbations and that the incorporation of such representations in DNNs could give rise to useful properties like adversarial robustness.