mlsanityData to 7 Oct 2026

An Extended Study of Human-like Behavior under Adversarial Training

arXiv 2303.12669 ↗First posted 22 Mar 2023cs.CV cs.AI cs.LGcited by 9

Not on the map. Why?

Abstract (arXiv)

Neural networks have a number of shortcomings. Amongst the severest ones is the sensitivity to distribution shifts which allows models to be easily fooled into wrong predictions by small perturbations to inputs that are often imperceivable to humans and do not have to carry semantic meaning. Adversarial training poses a partial solution to address this issue by training models on worst-case perturbations. Yet, recent work has also pointed out that the reasoning in neural networks is different from humans. Humans identify objects by shape, while neural nets mainly employ texture cues. Exemplarily, a model trained on photographs will likely fail to generalize to datasets containing sketches. Interestingly, it was also shown that adversarial training seems to favorably increase the shift toward shape bias. In this work, we revisit this observation and provide an extensive analysis of this effect on various architectures, the common ℓ2- and ℓ_∞-training, and Transformer-based models. Further, we provide a possible explanation for this phenomenon from a frequency perspective.

Key facts. Cited by 9 papers in the map (data through 7 Oct 2026). Builds on 37 of its 42 references that are in the map. First posted on arXiv 22 Mar 2023.

Builds on

37 of 42 references.

References · 37

  1. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,456
  2. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 29,915
  3. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
  4. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  5. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  6. 2013Intriguing properties of neural networkscited by 5,114
  7. 2019Benchmarking Neural Network Robustness to Common Corruptions and Perturbationscited by 2,857
  8. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  9. 2018ImageNet-trained CNNs are biased towards texture; increasing shape bias improves accuracy and robustnesscited by 1,430
  10. 2019Learning Robust Global Representations by Penalizing Local Predictive Powercited by 1,010
  11. 2021Scaling Vision Transformerscited by 993
  12. 2019Big Transfer (BiT): General Visual Representation Learningcited by 766
25 more
  1. 2017Evasion Attacks against Machine Learning at Test Timecited by 686
  2. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 682
  3. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 530
  4. 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 499
  5. 2019Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attackcited by 333
  6. 2020Do Adversarially Robust ImageNet Models Transfer Better?cited by 315
  7. 2020Watch your Up-Convolution: CNN Based Generative Deep Neural Networks are Failing to Reproduce Spectral Distributionscited by 278
  8. 2020Attacks Which Do Not Kill Training Make Adversarial Learning Strongercited by 242
  9. 2018Generalisation in humans and deep neural networkscited by 237
  10. 2021Improving Robustness using Generated Datacited by 233
  11. 2019Billion-scale semi-supervised learning for image classificationcited by 232
  12. 2023Better Diffusion Models Further Improve Adversarial Trainingcited by 207
  13. 2022Patches Are All You Need?cited by 201
  14. 2021Data Augmentation Can Improve Robustnesscited by 193
  15. 2021Partial success in closing the gap between human and machine visioncited by 185
  16. 2019Improving Robustness Without Sacrificing Accuracy with Patch Gaussian Augmentationcited by 105
  17. 2020Beyond accuracy: quantifying trial-by-trial behaviour of CNNs and humans by measuring error consistencycited by 77
  18. 2022A Light Recipe to Train Robust Vision Transformerscited by 64
  19. 2021Improving robustness against common corruptions with frequency biased modelscited by 34
  20. 2021SpectralDefense: Detecting Adversarial Attacks on CNNs in the Fourier Domaincited by 30
  21. 2021A Frequency Perspective of Adversarial Robustnesscited by 28
  22. 2022FrequencyLowCut Pooling -- Plug & Play against Catastrophic Overfittingcited by 28
  23. 2022CNN Filter DB: An Empirical Investigation of Trained Convolutional Filterscited by 20
  24. 2022Adversarial Robustness through the Lens of Convolutional Filterscited by 9
  25. 2021Impact of Spatial Frequency Based Constraints on Adversarial Robustnesscited by 8

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 4; 2024: 3; 2025: 0; 2026: 2.

9 papers.

  1. 2023Spatial-frequency channels, shape bias, and adversarial robustnesscited by 28
  2. 2024Can We Talk Models Into Seeing the World Differently?cited by 23
  3. 2024Can Biases in ImageNet Models Explain Generalization?cited by 20
  4. 2024How Do Training Methods Influence the Utilization of Vision Models?cited by 3
  5. 2023On the Interplay of Convolutional Padding and Adversarial Robustnesscited by 1
  6. 2023Is Certifying ℓp Robustness Still Worthwhile?cited by 1
  7. 2026On the Reliability of Cue Conflict and Beyondcited by 1
  8. 2026Rethinking Brain Decoding with CLIP: The Role of Adversarial Robustnesscited by 1
  9. 2023Don't Look into the Sun: Adversarial Solarization Attacks on Image Classifierscited by 0