Adversarial Robustness as a Prior for Learned Representations

ability of adversarial robustness as a goal beyond the standard security and reliability context.

2 Limitations of standard representations

Following standard convention, for a given deep network we define the representation R(x) ∈ Rk of a

given input x ∈ Rd as the activations of the penultimate layer of the network (where usually k (cid:28) d). The

prediction of the network can thus be viewed as the output of a linear classifier on the representation R(x).

2

We refer to the distance in representation space between two inputs (x1, x2) as the (cid:96)2 distance between their

representations (R(x1), R(x2)), i.e., (cid:107)R(x1) − R(x2)(cid:107)2.

A common aspiration in representation learning is to have that for any pixel-space input x, R(x) is

a vector encoding a set of “human-meaningful” features of x [Ben19; GBC16; BCV13]. These high-level

features would be linearly separable with respect to the classification task, allowing the classifier to attain

high accuracy.

Running somewhat counter to this intuition, however, we find that it is straightforward to construct

pairs of images with nearly identical representations yet drastically different content, as shown in Figure 2.

Finding such pairs turns out to be as simple as sampling two images x1, x2 ∼ D, then optimizing one of

them to minimize distance in representation space to the other:

x(cid:48)

1 = x1 + arg min

δ

(cid:107)R(x1 + δ) − R(x2)(cid:107)2.

(1)

Indeed, solving objective (1) yields images that have similar representations, but share no qualitative re-

semblance (in fact, x(cid:48)

1 tends to look nearly identical to x1). An example of such a pair is given in Figure 2.

Note that if representations truly provided an encoding of any image into high-level features, find-

ing images with similar representations should necessitate finding images with similar high-level features.

Thus, the existence of these image pairs (and similar phenomena observed by prior work [Jac+19]) lays bare

a misalignment between the notion of distance induced via the features learned by current deep networks,

and the notion of distance as perceived by humans.

Figure 2: A limitation of standard neural network representations: it is straightforward to construct pairs

of images (x(cid:48)

1, x2) that appear completely different yet map to similar representations.

3 Adversarial robustness as a prior

Our analysis in Section 2 and prior work [Jac+19] prompt the question:

How can we learn better-behaved representations?

In this work, we demonstrate that the representations learned by adversarially robust neural networks seem

to address many identified limitations of standard representations, and make significant progress towards

the broader goal of learning high-level, human-understandable encodings.

Adversarially robust deep networks and robust optimization.

In standard settings, supervised machine

learning models are trained by minimizing the expected loss with respect to a set of parameters θ, i.e., by

solving an optimization problem of the form:

θ∗ = min

θ

E

(x,y)∼D [Lθ(x, y)] .

(2)

We refer to (2) as the standard training objective—finding the optimum of this objective should guarantee

high performance on unseen data from the distribution. It turns out, however, that deep neural networks

3

x′1x2R(x′1)≈R(x2)trained with this standard objective are extraordinarily vulnerable to adversarial examples [Big+13; Sze+14]—

by changing a natural input imperceptibly, one can easily manipulate the predictions of a deep network to

be arbitrarily incorrect.

A natural approach (and one of the most successful) for defending against these adversarial examples

is to use the robust optimization framework: a classical framework for optimization in the presence of uncer-

tainty [Wal45; Dan67]. In particular, instead of just finding parameters which minimize the expected loss

(as in the standard objective), a robust optimization objective also requires that the model induced by the

parameters θ be robust to worst-case perturbation of the input:

θ∗ = arg min

E

θ

(x,y)∼D

(cid:20)

max

δ∈∆

Lθ(x + δ, y)

(cid:21)

.

(3)

This robust objective is in fact common in the context of machine learning security, where ∆ is usually

chosen to be a simple convex set, e.g., an (cid:96)p-ball. Canonical instantiations of robust optimization such as

adversarial training [GSS15; Mad+18]) have arisen as practical ways of obtaining networks that are invari-

ant to small (cid:96)p-bounded changes in the input while maintaining high accuracy (though a small tradeoff

between robustness and accuracy has been noted by prior work [Tsi+19; Su+18](also cf. Appendix Tables 4

and 5 for a comparison of accuracies of standard and robust classifiers)).

Robust optimization as a feature prior. Traditionally, adversarial robustness in the deep learning setting

has been explored as a goal predominantly in the context of ML security and reliability [BR18].

In this work, we consider an alternative perspective on adversarial robustness—we cast it as a prior

on the features that can be learned by a model. Specifically, models trained with objective (3) must be

invariant to a set of perturbations ∆. Thus, selecting ∆ to be a set of perturbations that humans are robust

to (e.g., small (cid:96)p-norm perturbations) results in models that share more invariances with (and thus are

encouraged to use similar features to) human perception. Note that incorporating human-selected priors

and invariances in this fashion has a long history in the design of ML models—convolutional layers, for

instance, were introduced as a means of introducing an invariance to translations of the input [Fuk80].

In what follows, we will explore the effect of the prior induced by adversarial robustness on models’

learned representations, and demonstrate that representations learned by adversarially robust models are

better behaved, and do in fact seem to use features that are more human-understandable.

4 Properties and applications of robust representations

In the previous section, we proposed using robust optimization as a way of enforcing user-specified priors

during model training. Our goal was to mitigate the issues with standard representations identified in

Section 2. We now demonstrate that the learned representations resulting from training with this prior

indeed exhibit several advantages over standard representations.

Recall that we define a representation R(·) as a function induced by a neural network which maps in-

puts x ∈ Rn to vectors R(x) ∈ Rk in the representation layer of that network (the penultimate layer).

In what follows, we refer to “standard representations” as the representation functions induced by stan-

dard (non-robust) networks, trained with the objective (2)—analogously, “robust representations” refer to

the representation functions induced by (cid:96)2-adversarially robust networks, i.e. networks trained with the

objective (3) with ∆ being the (cid:96)2 ball:

θ∗

robust = arg min

θ

E

(x,y)∼D

(cid:20)

max

(cid:107)δ(cid:107)2≤ε

Lθ(x + δ, y)

(cid:21)

.

It is worth noting that despite the value of ε used for training being quite small, we find that robust op-

timization globally affects the behavior of learned representations. As we demonstrate in this section, the

benefits of robust representations extend to out-of-distribution inputs and far beyond ε-balls around the

training distribution.

4

Experimental setup. We train robust and standard ResNet-50 [He+16] networks on the Restricted Ima-

geNet [Tsi+19] and ImageNet [Rus+15] datasets. Datasets specifics are in in Appendix A.1, training details

are in in Appendices A.2 and A.3, and the performance of each model is reported in Appendix A.4. In the

main text, we present results for Restricted ImageNet, and link to (nearly identical) results for ImageNet

present in the appendices (B.1.4,B.3.2).

Unless explicitly noted otherwise, our optimization method of choice for any objective function will

be (projected) gradient descent (PGD), a first-order method which is known to be highly effective for

minimizing neural network-based loss functions for both standard and adversarially robust neural net-

works [ACW18; Mad+18].

Code for reproducing our results is available at https://git.io/robust-reps.

4.1

Inverting robust representations

As discussed in Section 2, for standard deep networks, given any input x, it is straightforward to find

another input that looks entirely different but has nearly the same representation (c.f. Figure 2). We noted

that this finding runs somewhat counter to the idea that these learned representations effectively capture

relevant input features. After all, if the representation function was truly extracting “high-level” features

of the input as we conceptualize them, semantically dissimilar images should (by definition) have different

representations. We now show that the state of affairs is greatly improved for robust representations.

Robust representations are (approximately) invertible out of the box. We begin by recalling the op-

timization objective (1) used in Section 2 to find pairs of images with similar representations, a simple

minimization of (cid:96)2 distance in representation space from a source image x1 to a target image x2:

x(cid:48)

1 = x1 + min

δ

(cid:107)R(x1 + δ) − R(x2)(cid:107)2.

(4)

This process can be seen as recovering an image that maps to the desired target representation, and hence is

commonly referred to as representation inversion [DB16b; MV15; UVL17]. It turns out that in sharp contrast

to what we observe for standard models, the images resulting from minimizing (4) for robust models are

actually semantically similar to the original (target) images whose representation is being matched, and this

behavior is consistent across multiple samplings of the starting point (source image) x1 (cf. Figure 3).

Representation proximity seems to entail semantic similarity.

In fact, the contrast between the invert-

ibility of standard and robust representations is even stronger. To illustrate this, we will attempt to match

the representation of a target image while staying close to the starting image of the optimization in pixel-

wise (cid:96)2-norm (this is equivalent to putting a norm bound on δ in objective (4)). With standard models, we

can consistently get close to the target image in representation space, without moving far from the source

image x1. On the other hand, for robust models, we cannot get close to the target representation while stay-

ing close to the source image—this is illustrated quantitatively in Figure 4. This indicates that for robust

models, semantic similarity may in fact be necessary for representation similarity (and is not, for instance,

merely an artifact of the local robustness induced by robust optimization).

We also find that even when δ is highly constrained (i.e. when we are forced to stay very close to the

source image and thus cannot match the representation of the target well), the solution to the inversion

problem still displays some salient features of the target image (c.f. Figure 5). Both of these observations

suggest that the representations of robust networks function much more like we would expect high-level

feature representations to behave.

Inversion of out-of-distribution inputs. We find that the inversion properties uncovered above hold

even for out-of-distribution inputs, demonstrating that robust representations capture general features as

opposed to features only relevant for the specific classification task. In particular, we repeat the inversion

experiment (simple minimization of distance in representation space) using images from classes not present

in the original dataset used during training (Figure 6 right) and structured random patterns (Figure 14 in

Appendix B.1): the reconstructed images consistently resemble the targets.

5

Figure 3: Visualization of inputs that are mapped to similar representations by models trained on the Re-

stricted ImageNet dataset. Target (x2) & Source (x1): random examples image from the test set; Robust and

Standard (x(cid:48)

1): result of minimizing the objective (4) to match (in (cid:96)2-distance) the representation of the target

image starting from the corresponding source image for (top): a robust (adversarially trained) and (bottom):

a standard model respectively. For the robust model, we observe that the resulting images are perceptually

similar to the target image in terms of high-level features (even though they do not match it exactly), while

for the standard model they often look more similar to the source image which is the seed for the optimiza-

tion process. Additional results in Appendix B.1, and similar results for ImageNet are in Appendix B.1.4.

Interpolation between arbitrary inputs. Note that this ability to consistently invert representations into

corresponding inputs also translates into the ability to semantically interpolate between any two inputs. For

any two inputs x1 and x2, one can (linearly) interpolate between R(x1) and R(x2) in representation space,

then use the inversion procedure to get images corresponding to the interpolate representations. The re-

sulting inputs interpolate between the two endpoints in a perceptually plausible manner without any of

the “ghosting” artifacts present in input-space interpolation. We show examples of this inversion as well as

experimental details in Appendix A.5.

4.2 Direct feature visualization

A common technique for visualizing and understanding the representation function R(·) of a given net-

work is optimization-based feature visualization [OMS17], a process in which we maximize a specific feature

(component) in the representation with respect to the input, in order to obtain insight into the role of the

feature in classification. Concretely, given some i ∈ [k] denoting a component of the representation vector,

we use gradient descent to find an input x(cid:48) that maximally activates it, i.e., we solve:

x(cid:48) = arg max

δ

R(x0 + δ)i

(5)

for various starting points x0 which might be random images from D or even random noise.

Visualization “fails” for standard networks. For standard networks, optimizing the objective (5) often

yields unsatisfying results. While we can easily find images for which the ith component of R(·) is large

(and thus the optimization problem is tractable), these images tends to look meaningless to humans, of-

ten resembling the starting point of the optimization. Even when these images are non-trivial, they tend

to contain abstract, hard-to-discern patterns (c.f. Figure 7 (bottom)). As we discuss later in this section,

regularization/post-processing of visualizations does improve this state of affairs, though not very signifi-

cantly and potentially at the cost of suppressing useful features present in the representation post-hoc.

Robust representations allow for direct visualization of human-recognizable features. For robust rep-

resentations, however, we find that easily recognizable high-level features emerge from optimizing objec-

6

Target ( )x2Source ( )x1Robust ( )x′1Standard ( )x′1e

c

a

p

s

.

p

e

r

n

i

e

c

n

a

t

s

i

d

n

M

i

1.2

1

0.8

0.6

0.4

0.2

0

21

Robust network

Standard network

ε for robust opt. (Eq. (3))

23

25

Allowed (cid:96)2 distance from source image

27

29

Figure 4: Optimizing objective (4) with PGD and an (cid:96)2-norm constraint around the source image. On the

x-axis is the radius of the constraint set, and on the y-axis is the distance in representation space between

the minimizer of objective (4) within the constraint set and the target image, normalized by the norm of the

representation of the target image: i.e., a point (xi, yi) on the graph corresponds to yi = min(cid:107)δ(cid:107)2≤xi

(cid:107)R(x +

δ) − R(xtarg)(cid:107)2/(cid:107)R(xtarg)(cid:107)2. Notably, we are unable to closely match the representation of the target image

for the robust network until the norm constraint grows very large, and in particular much larger than the

norm of the perturbation that the model is trained to be robust against (ε in objective (3)).

Figure 5: A visualization of the final solutions to the optimizing objective (4) with PGD when constraining

the solution to lie in an (cid:96)2 ball around the source image for an adversarially robust neural network. We note

that even the radius of the constraint set is small and we cannot match the representation very well, salient

features of the target image still arise.

Figure 6: Robust representations yield semantically meaningful embeddings. Target: random images from

the test set (col. 1-5) and from outside of the training distribution (6-10); Result: images obtained from

optimizing inputs (using Gaussian noise as the source image) to minimize (cid:96)2-distance to the representations

of the corresponding image in the top row. (More examples appear in Appendix B.1.)

tive (5) directly, without any regularization or post-processing. We present the results of this maximization

in Figure 7 (top): coordinates consistently represent the same concepts across different choice of starting

input x0 (both in and out of distribution). Furthermore, these concepts are not merely an artifact of our

visualization process, as they consistently appear in the test-set inputs that most strongly activate their

7

Constraint = 2Constraint = 8Constraint = 32Constraint = 128Target imageTargetResultTest setOut-of-distributionTargetResultTest setOut-of-distributionFigure 7: Correspondence between image-level patterns and activations learned by standard and robust

models on the Restricted ImageNet dataset. Starting from randomly chosen seed inputs (noise/images),

we use PGD to find inputs that (locally) maximally activate a given component of the representation vector

(cf. Appendix A.6.1 for details). In the left column we have the seed inputs x0 (selected randomly), and in

subsequent columns we visualize the result of the optimization (5), i.e., x(cid:48), for different activations, with

each row starting from the same (far left) input x0 for (top): a robust (adversarially trained) and (bottom): a

standard model. Additional visualizations in Appendix B.3, and similar results for ImageNet in B.3.2.

corresponding coordinates (Figure 8).

Figure 8: Maximizing inputs x(cid:48) (found by solving (5) with x0 being a gray image) and most or least ac-

tivating images (from the test set) for two random activations of a robust model trained on the Restricted

ImageNet dataset. For each activation, we plot the three images from the validation set that had the highest

or lowest activation value sorted by the magnitude of the selected activation.

The limitations of regularization for visualization in standard networks. Given that directly optimiz-

ing objective (5) does not produce human-meaningful images, prior work on visualization usually tries to

regularize objective (5) through a variety of methods. These methods include applying random transforma-

tions during the optimization process [MOT15; OMS17], restricting the space of possible solutions [NYC15;

Ngu+16; Ngu+17], or post-processing the input or gradients [Oyg15; Tyk16]. While regularization does

in general produce better results qualitatively, it comes with a few notable disadvantages that are well-

8

Seeds ( )x0Maximizing different coordinates ( )iStandardRobustActivation 444(“long fish”)Activation 939 (“insect legs”)Maximized from noiseMost activatedLeast activatedMaximized from noiseMost activatedLeast activatedrecognized in the domain of feature visualization. First, when one introduces prior information about

what makes images visually appealing into the optimization process, it becomes difficult to disentangle

the effects of the actual model from the effect of the prior information introduced through regulariza-

tion2. Furthermore, while adding regularization does improve the visual quality of the visualizations, the

components of the representation still cannot be shown to correspond to any recognizable high-level fea-

ture. Indeed, Olah, Mordvintsev, and Schubert [OMS17] note that in the representation layer of a standard

GoogLeNet, “Neurons do not seem to correspond to particularly meaningful semantic ideas”—the corre-

sponding feature visualizations are reproduced in Figure 9. We also provide examples of representation-

layer visualizations for VGG16 (which we found qualitatively best among modern architectures) regu-

larized with jittering and random rotations in Figure 10. While these visualizations certainly look better

qualitatively than their unregularized counterparts in Figure 7 (bottom), there remains a significantly large

gap in quality and discernability between these regularized visualizations and those of the robust network

in Figure 7 (top).

Figure 9: Figure reproduced from [OMS17]—a vi-

sualization of a few components of the represen-

tation layer of GoogLeNet. While regularization

(as well as Fourier parameterization and colorspace

decorrelation) yields visually appealing results, the

visualization does not reveal consistent semantic

concepts.

Figure 10: A visualization of the first four compo-

nents of the representation layer of VGG16 when

regularization via random jittering and rotation is

applied. Figure produced using the Lucida visual-

ization library.

ahttps://github.com/tensorflow/lucid/

4.2.1 Natural consequence: feature manipulation

The ability to directly visualize high-level, recognizable features reveals another application of robust rep-

resentations, which we refer to as feature manipulation. Consider the visualization objective (5) shown in the

previous section. Starting from some original image, optimizing this objective results in the corresponding

feature being introduced in a continuous manner. It is hence possible to stop this process relatively early to

ensure that the content of the original image is preserved. As a heuristic, we stop the optimization process

as soon as the desired feature attains a larger value than all the other coordinates of the representation. We

visualize the result of this process for a variety of input images in Figure 11, where “stripes” or “red limbs”

are introduced seamlessly into images without any processing or regularization 3.

5 Related Work

Inverting representations. Previous methods for inverting learned representations typically either solve

an optimization problem similar to (1) while imposing a “natural image” prior on the input [MV15; Yos+15;

UVL17] or train a separate model to perform the inversion [KW15; DB16b; DB16a]. Note that since these

methods introduce priors or additional components into the inversion process, their results are not fully

faithful to the model. In an orthogonal direction, it is possible to construct models that are analytically

invertible by construction [DKB14; DSB17; JSO18; Beh+18]. However, the representations learned by these

models do not seem to be perceptually meaningful (for instance, interpolating between points in the repre-

sentation space does not lead to perceptual input space interpolations [JSO18]). Another notable distinction

between the inversions shown here and invertible networks is that the latter are an exactly invertible map

2In fact, model explanations that enforce priors for purposes of visual appeal have been often found to have little to do with the

data or the model itself [Ade+18].

3We repeat this process with many additional random images and random features in Appendix B.4.

9

Figure 11: Visualization of the results from maximizing a chosen (left) and a random (right) representation

coordinate starting from random images for the Restricted ImageNet dataset. In each figure, the top row has

the initial images, and the bottom row has a feature added. Additional examples in Appendix B.4.

from Rd → Rd, while the former shows that we can approximately recover the original input in Rd from a

representation in Rk for k (cid:28) d.

Feature visualization. Typical methods for visualizing features or classes learned by deep networks fol-

low an optimization-based approach, optimizing objectives similar to objective (5). Since this optimization

does not lead to meaningful visualizations directly, these methods incorporate domain-specific input pri-

ors (either hand-crafted [NYC15] or learned [Ngu+16; Ngu+17]) and regularizers [SVZ13; MOT15; Oyg15;

Yos+15; Tyk16; OMS17] to produce human-discernible visualizations. The key difference of our work is

that we avoid the use of such priors or regularizers altogether, hence producing visualizations that are fully

based on the model itself without introducing any additional bias.

Semantic feature manipulation. The latent space of generative adversarial networks (GANs) [Goo+14]

tends to allow for “semantic feature arithmetic” [RMC16; Lar+16] (similar to that in word2vec embed-

dings [Mik+13]) where one can manipulate salient input features using latent space manipulations. In a

similar vein, one can utilize an image-to-image translation framework to perform such manipulation (e.g.

transforming horses to zebras), although this requires a task-specific dataset and model [Zhu+17]. Some-

what orthogonally, it is possible to utilize the deep representations of standard models to perform semantic

feature manipulations; however such methods tend to either only perform well on datasets where the in-

puts are center-aligned [Upc+17], or are restricted to a small set of manipulations [GEB16].

6 Conclusion

We show that the learned representations of robustly trained models align much more closely with our ide-

alized view of neural network embeddings as extractors of human-meaningful, high-level features. After

highlighting certain shortcomings of standard deep networks and their representations, we demonstrate

that robust optimization can actually be viewed as inducing a human prior over the features that models

are able to learn. In this way, one can view the robust representations that result from this prior as feature

extractors that are more aligned with human perception.

In support of this view, we demonstrate that robust representations overcome the challenges identified

for standard representations: they are approximately invertible, and moving towards an image in repre-

sentation space seems to entail recovering salient features of that image in pixel space. Furthermore, we

show that robust representations can be directly visualized with first-order methods without the need for

post-processing or regularization, and also yield much more human-understandable features than stan-

dard models (even when they are visualized with regularization). These two properties (inversion and

direct feature visualization), in addition to serving as illustrations of the benefits of robust representations,

also enable direct modes of input manipulation (interpolation and feature manipulation, respectively).

Overall, our findings highlight robust optimization as a framework to enforce feature priors on learned

models. We believe that further exploring this paradigm will lead to models that are significantly more

human-aligned while enabling a wide range of new modes of interactions.

10

“Stripes” (selected)“Red limbs” (random)References

[ACW18] Anish Athalye, Nicholas Carlini, and David A. Wagner. “Obfuscated Gradients Give a False

Sense of Security: Circumventing Defenses to Adversarial Examples”. In: International Confer-

ence on Machine Learning (ICML). 2018.

[Ade+18]

Julius Adebayo et al. “Sanity checks for saliency maps”. In: Neural Information Processing Systems

(NeurIPS). 2018.

[Bau+19] David Bau et al. “Inverting Layers of a Large Generator”. In: ICLR Debugging Machine Learning

Models Workshop. 2019.

[BB19]

[BCV13]

[BDS19]

Wieland Brendel and Matthias Bethge. “Approximating CNNs with Bag-of-local-Features mod-

els works surprisingly well on ImageNet”. In: International Conference on Learning Representa-

tions (ICLR). 2019.

Y. Bengio, A. Courville, and P. Vincent. “Representation Learning: A Review and New Perspec-

tives”. In: (2013).

Andrew Brock, Jeff Donahue, and Karen Simonyan. “Large Scale GAN Training for High Fi-

delity Natural Image Synthesis”. In: International Conference on Learning Representations (ICLR).

2019.

[Beh+18]

Jens Behrmann et al. “Invertible residual networks”. In: arXiv preprint arXiv:1811.00995. 2018.

[Ben19]

[Big+13]

[BR18]

[CW08]

Yoshua Bengio. Talk Abstract: Learning High-Level Representations for Agents. Abstract for talk

given at MIT. 2019. URL: https : / / calendar . mit . edu / event / yoshua _ bengio _ learning _

high-level_representations_for_agents#.XYozli2ZNhF.

Battista Biggio et al. “Evasion attacks against machine learning at test time”. In: Joint European

conference on machine learning and knowledge discovery in databases (ECML-KDD). 2013.

Battista Biggio and Fabio Roli. “Wild patterns: Ten years after the rise of adversarial machine

learning”. In: 2018.

Ronan Collobert and Jason Weston. “A unified architecture for natural language processing:

Deep neural networks with multitask learning”. In: Proceedings of the 25th international conference

on Machine learning. 2008, pp. 160–167.

[Dan67]

John M. Danskin. The Theory of Max-Min and its Application to Weapons Allocation Problems. 1967.

[DB16a]

[DB16b]

[DKB14]

Alexey Dosovitskiy and Thomas Brox. “Generating images with perceptual similarity metrics

based on deep networks”. In: neural information processing systems (NeurIPS). 2016.

Alexey Dosovitskiy and Thomas Brox. “Inverting visual representations with convolutional

networks”. In: Computer Vision and Pattern Recognition (CVPR). 2016.

Laurent Dinh, David Krueger, and Yoshua Bengio. “Nice: Non-linear independent components

estimation”. In: arXiv preprint arXiv:1410.8516. 2014.

[Don+14]

Jeff Donahue et al. “Decaf: A deep convolutional activation feature for generic visual recogni-

tion”. In: International conference on machine learning (ICML). 2014.

[DSB17]

[Eng+19]

[Fuk80]

Laurent Dinh, Jascha Sohl-Dickstein, and Samy Bengio. “Density estimation using real NVP”.

In: International Conference on Learning Representations (ICLR). 2017.

Logan Engstrom et al. Robustness (Python Library). 2019. URL: https://github.com/MadryLab/

robustness.

Kunihiko Fukushima. “Neocognitron: A self-organizing neural network model for a mecha-

nism of pattern recognition unaffected by shift in position”. In: Biological cybernetics (1980).

[GBC16]

Ian Goodfellow, Yoshua Bengio, and Aaron Courville. Deep Learning. MIT Press, 2016.

[GEB16]

Leon A Gatys, Alexander S Ecker, and Matthias Bethge. “Image style transfer using convolu-

tional neural networks”. In: computer vision and pattern recognition (CVPR). 2016.

11

[Gei+19]

Robert Geirhos et al. “ImageNet-trained CNNs are biased towards texture; increasing shape

bias improves accuracy and robustness.” In: International Conference on Learning Representations.

2019.

[Gir+14]

Ross G...