to recognize the objects.

Here we show the converse, namely that when humans are tested on DNN fragile recognition images, they do not exhibit the same fragile response. This can be seen in our qualitative examples: DNN fragile recognition images and their incorrectly-classified counterparts are difficult to distinguish. To verify this, we randomly sample 40 DNN shrink FRIs generated from ImageNet. We present the correctly-classified FRI and the slightly changed image (both resized to $100 \times 100$ pixels) to separate groups of 20 subjects in Mechanical Turk [@buhrmester2011amazon]. The subjects annotate the images using one of our 10 supercategory labels. The results show a small gap in correct recognition: on average, success rates among humans for DNN fragile recognition images and incorrect counterparts differ by $14.5\%$. DNNs experience an average gap in confidence of $56\%$ for the same pairs.

Furthermore, we directly compare human and DNN minimal images of the same image. We use six of the original images from [@Ullman_etal_2016_PNAS] that were used to find human minimal images. We identify the DNN FRIs for these. Comparing DNN FRIs and human minimal images of the same region size, $P$, we find two additional differences: first, DNNs have more FRIs ($5.3$ 