Measuring the tendency of CNNs to Learn Surface Statistical Regularities
Not on the map. Why?
Abstract (arXiv)
Deep CNNs are known to exhibit the following peculiarity: on the one hand they generalize extremely well to a test set, while on the other hand they are extremely sensitive to so-called adversarial perturbations. The extreme sensitivity of high performance CNNs to adversarial examples casts serious doubt that these networks are learning high level abstractions in the dataset. We are concerned with the following question: How can a deep CNN that does not learn any high level semantics of the dataset manage to generalize so well? The goal of this article is to measure the tendency of CNNs to learn surface statistical regularities of the dataset. To this end, we use Fourier filtering to construct datasets which share the exact same high level abstractions but exhibit qualitatively different surface statistical regularities. For the SVHN and CIFAR-10 datasets, we present two Fourier filtered variants: a low frequency variant and a randomly filtered variant. Each of the Fourier filtering schemes is tuned to preserve the recognizability of the objects. Our main finding is that CNNs exhibit a tendency to latch onto the Fourier image statistics of the training dataset, sometimes exhibiting up to a 28% generalization gap across the various test sets. Moreover, we observe that significantly increasing the depth of a network has a very marginal impact on closing the aforementioned generalization gap. Thus we provide quantitative evidence supporting the hypothesis that deep CNNs tend to learn surface statistical regularities in the dataset rather than higher-level abstract concepts.
Key facts. Cited by 87 papers in the map (data through 14 Oct 2026). First posted on arXiv 30 Nov 2017.
Builds on
No reference list yet.
Built on by
Citing papers per year: 2021: 31; 2022: 22; 2023: 18; 2024: 5; 2025: 4; 2026: 7.
87 papers.
Sort:
By area:
- 2021Vision Transformers are Robust Learnerscited by 207
- 2021Partial success in closing the gap between human and machine visioncited by 185
- 20223D Common Corruptions and Data Augmentationcited by 119
- 2021Rethinking Architecture Design for Tackling Data Heterogeneity in Federated Learningcited by 111
- 2021Towards Interpreting and Mitigating Shortcut Learning Behavior of NLU Modelscited by 78
- 2023On the Foundations of Shortcut Learningcited by 65
- 2022MulT: An End-to-End Multitask Learning Transformercited by 48
- 2023A Survey on Transferability of Adversarial Examples across Deep Neural Networkscited by 44
- 2021Robust Contrastive Learning Using Negative Samples with Diminished Semanticscited by 43
- 2021Spectral Bias in Practice: The Role of Function Frequency in Generalizationcited by 37
- 2021A Little Robustness Goes a Long Way: Leveraging Robust Features for Targeted Transfer Attackscited by 34
- 2021Does enhanced shape bias improve neural network robustness to common corruptions?cited by 32
38 more
- 2023Downstream-agnostic Adversarial Examplescited by 32
- 2021Exploring the Efficacy of Automatically Generated Counterfactuals for Sentiment Analysiscited by 30
- 2023Towards Trustworthy and Aligned Machine Learning: A Data-centric Survey with Causality Perspectivescited by 30
- 2023Don't blame Dataset Shift! Shortcut Learning due to Gradients and Cross Entropycited by 30
- 2021Test time Adaptation through Perturbation Robustnesscited by 28
- 2022Domain Generalization by Learning and Removing Domain-specific Featurescited by 28
- 2023What do neural networks learn in image classification? A frequency shortcut perspectivecited by 28
- 2021Dynamic Inference with Neural Interpreterscited by 24
- 2021Robustness via Cross-Domain Ensemblescited by 23
- 2021Closer Look at the Transferability of Adversarial Examples: How They Fool Different Models Differentlycited by 22
- 2022Causal Balancing for Domain Generalizationcited by 20
- 2021Meta Adversarial Training against Universal Patchescited by 19
- 2021Universal Adversarial Perturbations Through the Lens of Deep Steganography: Towards A Fourier Perspectivecited by 18
- 2022The worst of both worlds: A comparative analysis of errors in learning from data in psychology and machine learningcited by 17
- 2021Multimodal Scale Consistency and Awareness for Monocular Self-Supervised Depth Estimationcited by 16
- 2024Understanding Bias in Large-Scale Visual Datasetscited by 15
- 2021Toward Learning Human-aligned Cross-domain Robust Models by Countering Misaligned Featurescited by 14
- 2022Simplicity Bias Leads to Amplified Performance Disparitiescited by 11
- 2021Detecting Spurious Correlations with Sanity Tests for Artificial Intelligence Guided Radiology Systemscited by 10
- 2021Phy-Q as a measure for physical reasoning intelligencecited by 10
- 2022On the Origins of the Block Structure Phenomenon in Neural Network Representationscited by 10
- 2023Rapid Network Adaptation: Learning to Adapt Neural Networks Using Test-Time Feedbackcited by 10
- 2022Practical No-box Adversarial Attacks with Training-free Hybrid Image Transformationcited by 9
- 2021Characterizing and Improving the Robustness of Self-Supervised Learning through Background Augmentationscited by 8
- 2021Impact of Spatial Frequency Based Constraints on Adversarial Robustnesscited by 8
- 2022Investigating and Explaining the Frequency Bias in Image Classificationcited by 8
- 2022Exploring Adversarial Robustness of Vision Transformers in the Spectral Perspectivecited by 8
- 2021Adversarial Perturbations Are Not So Weird: Entanglement of Robust and Non-Robust Features in Neural Network Classifierscited by 7
- 2021Disrupting Model Training with Adversarial Shortcutscited by 7
- 2021Natural Adversarial Objectscited by 7
- 2022Fourier-Based Augmentations for Improved Robustness and Uncertainty Calibrationcited by 7
- 2023Linear CNNs Discover the Statistical Structure of the Dataset Using Only the Most Dominant Frequenciescited by 7
- 2023ProtoArgNet: Interpretable Image Classification with Super-Prototypes and Argumentation [Technical Report]cited by 7
- 2021Pulling Up by the Causal Bootstraps: Causal Data Augmentation for Pre-training Debiasingcited by 6
- 2025DDB: Diffusion Driven Balancing to Address Spurious Correlationscited by 6
- 2021Counterfactual Maximum Likelihood Estimation for Training Deep Networkscited by 5
- 2022InBiaseD: Inductive Bias Distillation to Improve Generalization and Robustness through Shape-awarenesscited by 5
- 2023How many dimensions are required to find an adversarial example?cited by 5
50 most cited of 87 All 87 (JSON)
- 2026Towards Quantifying Benchmark Optimization in ASR Models20 Aug 2026
- 2026Revisiting Shape and Texture Reliance with Category-Separability-Calibrated Suppression13 Jul 2026
- 2026Can Machines Really See Objects in Images? A Study Based on Syntactic Distance and Visual Self-Referential Instances28 Jun 2026
- 2026Fourier Features Let Agents Learn High Precision Policies with Imitation Learning10 Jun 2026
- 2026Low-Frequency Shortcuts in Texture-Driven Visual Learning2 Jun 2026
- 2026Early High-Frequency Injection for Geometry-Sensitive OOD Detection20 May 2026
- 2026HSFM: Hard-Set-Guided Feature-Space Meta-Learning for Robust Classification under Spurious Correlations31 Mar 2026
- 2025FREQuency ATTribution: benchmarking frequency-based occlusion for time series data23 Jun 2025
- 2025DDB: Diffusion Driven Balancing to Address Spurious Correlations21 Mar 2025
- 2025Beyond Accuracy: What Matters in Designing Well-Behaved Image Classification Models?21 Mar 2025
- 2025Generalizable Image Repair for Robust Visual Control7 Mar 2025
- 2024Evil twins are not that evil: Qualitative insights into machine-generated prompts11 Dec 2024
38 more
- 2024Understanding Bias in Large-Scale Visual Datasets2 Dec 2024
- 2024Spectral Wavelet Dropout: Regularization in the Wavelet Domain27 Sep 2024
- 2024Revisiting Spurious Correlation in Domain Generalization17 Jun 2024
- 2024Persistent Classification: A New Approach to Stability of Data and Adversarial Examples11 Apr 2024
- 2023ProtoArgNet: Interpretable Image Classification with Super-Prototypes and Argumentation [Technical Report]26 Nov 2023
- 2023Harnessing Synthetic Datasets: The Role of Shape Bias in Deep Neural Network Generalization10 Nov 2023
- 2023A Survey on Transferability of Adversarial Examples across Deep Neural Networks26 Oct 2023
- 2023On the Foundations of Shortcut Learning24 Oct 2023
- 2023SPADE: Sparsity-Guided Debugging for Deep Neural Networks6 Oct 2023
- 2023Rapid Network Adaptation: Learning to Adapt Neural Networks Using Test-Time Feedback27 Sep 2023
- 2023Can We Reliably Improve the Robustness to Image Acquisition of Remote Sensing of PV Systems?21 Sep 2023
- 2023Don't blame Dataset Shift! Shortcut Learning due to Gradients and Cross Entropy24 Aug 2023
- 2023Towards Trustworthy and Aligned Machine Learning: A Data-centric Survey with Causality Perspectives31 Jul 2023
- 2023Downstream-agnostic Adversarial Examples23 Jul 2023
- 2023What do neural networks learn in image classification? A frequency shortcut perspective19 Jul 2023
- 2023Towards Robust Aspect-based Sentiment Analysis through Non-counterfactual Augmentations24 Jun 2023
- 2023RFiD: Towards Rational Fusion-in-Decoder for Open-Domain Question Answering26 May 2023
- 2023Assessment of the Reliablity of a Model's Decision by Generalizing Attribution to the Wavelet Domain24 May 2023
- 2023LSFSL: Leveraging Shape Information in Few-shot Learning13 Apr 2023
- 2023How many dimensions are required to find an adversarial example?24 Mar 2023
- 2023Linear CNNs Discover the Statistical Structure of the Dataset Using Only the Most Dominant Frequencies3 Mar 2023
- 2023Fourier Sensitivity and Regularization of Computer Vision Models31 Jan 2023
- 2022Domain Generalization by Learning and Removing Domain-specific Features14 Dec 2022
- 2022Simplicity Bias Leads to Amplified Performance Disparities13 Dec 2022
- 2022A novel feature-scrambling approach reveals the capacity of convolutional neural networks to learn spatial relations12 Dec 2022
- 2022Bridging the visual gap in VLN via semantically richer instructions27 Oct 2022
- 2022Robust Self-Supervised Learning with Lie Groups24 Oct 2022
- 2022Bias Challenges in Counterfactual Data Augmentation12 Sep 2022
- 2022Exploring Adversarial Robustness of Vision Transformers in the Spectral Perspective20 Aug 2022
- 2022An Overview and Prospective Outlook on Robust Training and Certification of Machine Learning Models15 Aug 2022
- 2022Is current research on adversarial robustness addressing the right problem?31 Jul 2022
- 2022Tutorial on the development of AI models for medical image analysis14 Jul 2022
- 2022InBiaseD: Inductive Bias Distillation to Improve Generalization and Robustness through Shape-awareness12 Jun 2022
- 2022Causal Balancing for Domain Generalization10 Jun 2022
- 2022Leveraging Systematic Knowledge of 2D Transformations2 Jun 2022
- 2022MulT: An End-to-End Multitask Learning Transformer17 May 2022
- 2022Investigating and Explaining the Frequency Bias in Image Classification6 May 2022
- 2022The worst of both worlds: A comparative analysis of errors in learning from data in psychology and machine learning12 Mar 2022
50 newest of 87 All 87 (JSON)
- 2021Vision Transformers are Robust Learnerscited by 207
- 2021Partial success in closing the gap between human and machine visioncited by 185
- 20223D Common Corruptions and Data Augmentationcited by 119
- 2021Rethinking Architecture Design for Tackling Data Heterogeneity in Federated Learningcited by 111
- 2021Towards Interpreting and Mitigating Shortcut Learning Behavior of NLU Modelscited by 78
- 2023On the Foundations of Shortcut Learningcited by 65
- 2022MulT: An End-to-End Multitask Learning Transformercited by 48
- 2023A Survey on Transferability of Adversarial Examples across Deep Neural Networkscited by 44
- 2021Robust Contrastive Learning Using Negative Samples with Diminished Semanticscited by 43
- 2021Spectral Bias in Practice: The Role of Function Frequency in Generalizationcited by 37
- 2021A Little Robustness Goes a Long Way: Leveraging Robust Features for Targeted Transfer Attackscited by 34
- 2021Does enhanced shape bias improve neural network robustness to common corruptions?cited by 32
12 most cited of 84 All 84 (JSON)
- 2026Towards Quantifying Benchmark Optimization in ASR Models20 Aug 2026
- 2026Revisiting Shape and Texture Reliance with Category-Separability-Calibrated Suppression13 Jul 2026
- 2026Can Machines Really See Objects in Images? A Study Based on Syntactic Distance and Visual Self-Referential Instances28 Jun 2026
- 2026Low-Frequency Shortcuts in Texture-Driven Visual Learning2 Jun 2026
- 2026Early High-Frequency Injection for Geometry-Sensitive OOD Detection20 May 2026
- 2026HSFM: Hard-Set-Guided Feature-Space Meta-Learning for Robust Classification under Spurious Correlations31 Mar 2026
- 2025FREQuency ATTribution: benchmarking frequency-based occlusion for time series data23 Jun 2025
- 2025Beyond Accuracy: What Matters in Designing Well-Behaved Image Classification Models?21 Mar 2025
- 2025Generalizable Image Repair for Robust Visual Control7 Mar 2025
- 2024Evil twins are not that evil: Qualitative insights into machine-generated prompts11 Dec 2024
- 2024Understanding Bias in Large-Scale Visual Datasets2 Dec 2024
- 2024Spectral Wavelet Dropout: Regularization in the Wavelet Domain27 Sep 2024
12 newest of 84 All 84 (JSON)