Robustified ANNs Reveal Wormholes Between Human Category Percepts
Not on the map. Why?
Abstract (arXiv)
The visual object category reports of artificial neural networks (ANNs) are notoriously sensitive to tiny, adversarial image perturbations. Because human category reports (aka human percepts) are thought to be insensitive to those same small-norm perturbations -- and locally stable in general -- this argues that ANNs are incomplete scientific models of human visual perception. Consistent with this, we show that when small-norm image perturbations are generated by standard ANN models, human object category percepts are indeed highly stable. However, in this very same "human-presumed-stable" regime, we find that robustified ANNs reliably discover low-norm image perturbations that strongly disrupt human percepts. These previously undetectable human perceptual disruptions are massive in amplitude, approaching the same level of sensitivity seen in robustified ANNs. Further, we show that robustified ANNs support precise perceptual state interventions: they guide the construction of low-norm image perturbations that strongly alter human category percepts toward specific prescribed percepts. These observations suggest that for arbitrary starting points in image space, there exists a set of nearby "wormholes", each leading the subject from their current category perceptual state into a semantically very different state. Moreover, contemporary ANN models of biological visual processing are now accurate enough to consistently guide us to those portals.
Key facts. Cited by 6 papers in the map (data through 14 Oct 2026). Builds on 17 of its 38 references that are in the map. First posted on arXiv 14 Aug 2023.
Builds on
17 of 38 references.
References · 17
- 2015Deep Residual Learning for Image Recognitioncited by 52,096
- 2014Explaining and Harnessing Adversarial Examplescited by 7,364
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
- 2013Intriguing properties of neural networkscited by 5,155
- 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
- 2016Photo-Realistic Single Image Super-Resolution Using a Generative Adversarial Networkcited by 1,908
- 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,451
- 2017Ensemble Adversarial Training: Attacks and Defensescited by 840
- 2019On Evaluating Adversarial Robustnesscited by 447
- 2019Adversarial Attacks and Defenses in Images, Graphs and Text: A Reviewcited by 237
- 2019Adversarial Robustness through Local Linearizationcited by 146
- 2019Brain-Like Object Recognition with High-Performing Shallow Recurrent ANNscited by 90
5 more
- 2021Deepfakes Generation and Detection: State-of-the-art, open challenges, countermeasures, and way forwardcited by 82
- 2018Adversarial Examples that Fool both Computer Vision and Time-Limited Humanscited by 73
- 2020Fundamental Tradeoffs between Invariance and Sensitivity to Adversarial Perturbationscited by 55
- 2014Deep Neural Networks Rival the Representation of Primate IT Cortex for Core Visual Object Recognitioncited by 50
- 2018Humans can decipher adversarial imagescited by 31
Built on by
Citing papers per year: 2024: 3; 2025: 3.
6 papers.
- 2024Adversarial Robustness Limits via Scaling-Law and Human-Alignment Studiescited by 38
- 2024Discriminating image representations with principal distortionscited by 8
- 2024Feature Accentuation: Revealing 'What' Features Respond to in Natural Imagescited by 5
- 2025Noninvasive precision modulation of high-level neural population activity via natural vision perturbationscited by 1
- 2025Wormhole Dynamics in Deep Neural Networkscited by 1
- 2025Get RICH or Die Scaling: Profitably Trading Inference Compute for Robustnesscited by 0
- 2025Get RICH or Die Scaling: Profitably Trading Inference Compute for Robustness8 Oct 2025
- 2025Wormhole Dynamics in Deep Neural Networks20 Aug 2025
- 2025Noninvasive precision modulation of high-level neural population activity via natural vision perturbations5 Jun 2025
- 2024Discriminating image representations with principal distortions20 Oct 2024
- 2024Adversarial Robustness Limits via Scaling-Law and Human-Alignment Studies14 Apr 2024
- 2024Feature Accentuation: Revealing 'What' Features Respond to in Natural Images15 Feb 2024