we observe in the data augmentation and regularization experiment in the previous section. This is because in Figure \[fig:pooling\_invariance\]b we report change in the output label rather than change in the correctness as in previous experiments. See Figure \[fig:pooling\_fris\]b for the effect of pooling on FRI occurrence, which is in accordance to previous results.

Finally, we control that the differences we observe between lack of invariance and FRIs are not caused by use of zero-padding in one case and not the other. In Figure \[fig:pooling\_padding\], we evaluate FRIs with zero-padding instead of up-scaling the cropped region. The results support the same conclusions as for FRIs with up-scaling.

Comparing fragile recognition in Humans and DNNs {#sec:Human_recognition_compared_with_DNN_minimal_images}
================================================

In this section, we further compare the FRIs found for DNNs with the human minimal images found by [@Ullman_etal_2016_PNAS]. Recall that minimal images are equivalent to strict shrink FRIs of small size. Both humans and DNNs are susceptible to small image changes, but these two sets of fragile images are not necessarily the same in humans and in DNNs. As shown by [@Ullman_etal_2016_PNAS; @Ben-Yosef_etal_2018_Cognition], when DNNs are trained and tested on human minimal images, [*i*.*e*. ]{}images that humans can still recognize, DNNs are unable 