Are Deep Neural Networks Adequate Behavioural Models of Human Visual
  Perception?
Deep neural networks (DNNs) are machine learning algorithms that have
revolutionised computer vision due to their remarkable successes in tasks like
object classification and segmentation. The success of DNNs as computer vision
algorithms has led to the suggestion that DNNs may also be good models of human
visual perception. We here review evidence regarding current DNNs as adequate
behavioural models of human core object recognition. To this end, we argue that
it is important to distinguish between statistical tools and computational
models, and to understand model quality as a multidimensional concept where
clarity about modelling goals is key. Reviewing a large number of
psychophysical and computational explorations of core object recognition
performance in humans and DNNs, we argue that DNNs are highly valuable
scientific tools but that as of today DNNs should only be regarded as promising
-- but not yet adequate -- computational models of human core object
recognition behaviour. On the way we dispel a number of myths surrounding DNNs
in vision science.
Felix A. Wichmann, Robert Geirhos
# Are Deep Neural Networks Adequate Behavioural Models of Human Visual Perception?

###### Abstract

Deep neural networks (DNNs) are machine learning algorithms that have revolutionised computer vision due to their remarkable successes in tasks like object classification and segmentation. The success of DNNs as computer vision algorithms has led to the suggestion that DNNs may also be good models of human visual perception. We here review evidence regarding current DNNs as adequate behavioural models of human core object recognition. To this end, we argue that it is important to distinguish between statistical tools and computational models, and to understand model quality as a multidimensional concept where clarity about modelling goals is key. Reviewing a large number of psychophysical and computational explorations of core object recognition performance in humans and DNNs, we argue that DNNs are highly valuable scientific tools but that as of today DNNs should only be regarded as promising--but not yet adequate--computational models of human core object recognition behaviour. On the way we dispel a number of myths surrounding DNNs in vision science.

## 1 Introduction

Computational modelling in vision science has a long and rich history dating back at least to Schade's photoelectric analog of the visual system and Reichardt's motion detector [108; 50; 101]. Computational models are useful because, first, a thorough and stringent quantitative understanding of an aspect of human visual perception implies we should be able to build a computational model of it. Second, a computational model can serve as a concrete, testable hypothesis of a theory and deepen our understanding through an iterative process of experimentation, model assessment and model improvement. Models in vision science come in many flavours, some borrowing computational elements such as filters or gain-control from engineering, some using information theory to motivate or derive properties of parts of the model, and others using Bayesian statistics to optimally read-out the activity within a model to derive the model decision: There is substantial diversity of models in vision science, and those models typically use whichever method or algorithm promises to be most helpful in a given context [16].

In computer vision a new class of algorithms from machine learning (ML), so-called deep neural networks or DNNs, have effectively revolutionised the field. DNNs were explicitly developed to solve complex, real-world pattern recognition problems and are now often able to correctly identify an object in a "typical" real-world photograph. DNNs entered centre stage in 2012 when a DNN named AlexNet, designed and trained by Krizhevsky et al. [71], comprehensively won the ImageNet Large Scale Visual Recognition Challenge (ILSVRC): Trained on 1.2 million images it was able to classify a set of 50,000 hitherto unseen images into 1,000 classes with an error rate of 16.4%--down from 25.8% in the previous year (by a non-DNN algorithm; error rates indicate top-5 error, i.e. whether the ground truth label was contained in the top five predictions of the model). Ever since
2012 the ILSVRC was won each year by a DNN, and DNNs are the de facto standard for pattern recognition in machine learning and computer vision1 In essence, a DNN is a nonlinear function approximator implemented as a very large collection of simple units which are connected to (typically a subset) of other units by variable connection strength, the so-called weights. The function of the DNN arises from the collective action of units, their connectivity pattern (the DNN architecture), the weights connecting units and their nonlinear activation function, i.e. how inputs to a unit are combined and transformed into its output passed to other units. DNNs are sometimes said to be based on neuroscience with units (neurons) connected to each other via variable weights (axons and dendrites with synapses of varying strength). The initial inspiration for neural networks did indeed come from neuroscience but DNNs only embody a highly simplified version of real neurons, their rich dynamics, intricate connectivity and dendritic processing complexity. The "neural network" part in the name of DNNs should thus be taken with more than a grain of salt [c.f. 27]. Accessible introductions to DNNs are, for example, LeCun et al. [76], Kriegeskorte [70] or Serre [112]. A comprehensive treatment of DNNs can be found in [47]. In a simplified cartoon-history, DNNs (with four or more layers) could be regarded as the children of (three-layer) connectionism popular from the mid 1980s to the late 1990s [105; 85], and as the grand-children of the (two-layer) perceptron popular from the late 1950s to the late 1960s [86; 104]2. A comprehensive overview of the more complex and multistranded historical development of deep learning is provided by Schmidhuber [109].

Footnote 1: Since 2017 ILSVRC is not run anymore given that DNNs have basically solved the challenge: State-of-the-art (SOTA) top-5 performance is less than 1.0% error. However, the ImageNet dataset still serves as a benchmark and is widely used as such.

Footnote 2: As we state, a highly simplified cartoon-history; we are aware of some of the other DNN milestones like the Neocognitron [33], LeNet [75] or HMax [103] which cannot be placed conveniently in the “family history” as presented above.

## 2 Deep Neural Networks as Tools in Science

DNNs are able to perform highly non-linear mappings from potentially very high dimensional inputs--like images with tens of thousands of pixels--to potentially high dimensional outputs--like the one thousand categories of ImageNet3. DNNs learn the non-linear and high-dimensional input-output mapping from massive amounts of training data alone: they learn which features and dimensions of the input, and their non-linear transformations and combinations, are relevant to solve a (classification) task. This ability to find non-linear, high-dimensional mappings makes DNNs a powerful tool in the sciences in general. Here we would like to draw a distinction between _tools_ and _models_--knowing that the distinction is somewhat blurry at its boundary. Tools are a means to an end, they play an important role in the scientific process but are not, in itself, of scientific interest. In general a model, on the other hand, is a concrete instance of a theory and is itself of scientific interest. Many statistical algorithms or methods and tests are tools: We use linear regression, or analysis of variance (ANOVA) for scientific inference but, typically, we do not take them to be scientific models of the phenomenon under investigation.

Footnote 3: In theory shallow, three-layer networks are already universal function approximators [58; 57]. In practice, however, with finite number of hidden units, finite datasets and computing power, shallow networks did not succeed in solving many interesting, large-scale or real-world problems. DNNs, on the other hand, are phenomenally successful at discovering such non-linear and high-dimensional mappings in practice.

**MODEL VS. TOOL**

**Tool:** Algorithm or statistical method which plays an important role in the scientific process but is not, in itself, of scientific interest; a means to an end.

**Model:** A concrete instance of a theory and itself of scientific interest. Different types of models exist such as statistical or mechanistic models as well as different modelling goals; see section 3.

As tools, DNNs excel in science: For example, DNNs have helped to speed up and improve single-molecule localisation microscopy [114], make fast and accurate 3D protein folding predictions [111], substantially accelerate climate science simulations [98], help in rapid gravitational wave
parameter estimation [20] and in applied mathematics deep reinforcement learning was used to find faster matrix multiplication algorithms [31]. In the neurosciences and vision science DNNs as tools have led to clear improvements of methods: DeepLabCut allows markerless pose estimation of single [84] and multiple animals [74], helping video-based observation and analysis of freely behaving animals. Simulation-based inference allows parameter inference in computational models that, without deep learning, would remain computationally intractable and has begun to see successful cognitive neuroscience applications [46, 8]. [44] argue that so-called generative adversarial networks (GANs) can be used to generate visual stimuli which are, on the one hand, complex and realistic but, at the same time, offer much more control than simply trying to find suitable stock or internet images.

The success of DNNs as tools goes beyond method improvements, however. An important additional role is to use DNNs for exploration, as was clearly and convincingly argued for by [16]4. One aspect of exploration are proof-of-concept or proof-of-principle demonstrations. [96], for example, showed that important aspects of intuitive physics can be acquired entirely through visual, bottom-up, learning. In a similar vein in the domain of gloss perception, [116] used unsupervised DNNs to demonstrate how perceptual dimensions like gloss--only imperfectly corresponding to distal physical properties--can be learned from the entangled proximal stimulus without the need for (Bayesian) prior knowledge or generative models. DNNs can thus be used to explore how richly structured our visual environment is, and how much about the (distal) 3D world could in principle be extracted from (proximal) 2D sensors in a purely discriminative fashion [see e.g. 115]5. Another exploratory aspect of DNNs is the generation of new hypotheses: In beautiful work [102] used a neural network to find a causal role for neurones in the macaque medial superior temporal (MST) area whose tuning properties had hitherto been regarded as puzzling. Their neural network analysis suggests that those neurones may play a role in the decision whether self- and scene motion signals arise from the same source or not--and should thus be either combined or analysed separately by downstream neurones. The usefulness of DNNs as tools in (vision) science is beyond doubt; their immense predictive power in high-dimensional input-output mappings is crucial for advanced method acceleration and development, for stimulus generation and for exploration as in proof-of-principle demonstrations or the generation and test of new computational hypotheses.

Footnote 4: We should note, however, that we differ from [16] in terminology but not in substance: We refer to DNNs for exploration as tools, rather than models. Clustering algorithms or principal-component-analysis (PCA), for example, are also exploratory statistical tools. We prefer to term them tools rather than models because they are typically used as a means to explore rather than a model of the underlying phenomenon.

Sometimes it is tempting to turn successful statistical and computational tools into theories--the _tools to theory heuristic_[43]. Scientists use the tools they use when working as metaphors for the workings of the phenomenon under study. Not perhaps in case of linear regression or ANOVA mentioned above, but a more general example mentioned by Gigerenzer is, e.g., the idea of the mind as a statistician by Brunswick, after Pearson had developed inferential statistics. In vision science a modern successor to this idea is the well-known Bayesian brain hypothesis: Bayesian statistics are a useful tool to analyse experimental data and combine them with prior beliefs. The Bayesian brain hypothesis asserts that the visual system itself applies the Bayesian probability calculus to sensory inputs--not only the scientist trying to understand the brain [c.f. 129]. Given their immense usefulness as tools in general, and their success in object recognition in computer vision in particular, it is thus perhaps not surprising that DNNs have also been proposed as computational models of human (core) object recognition in vision science [e.g. 127, 70, 72]6. We will evaluate DNNs as models of human core object recognition in section 4; first we will have a look at what we require of a good model in the next section.

Footnote 5: One may speculate how much Gibson would have appreciated DNNs as proof-of-principle tools, as he argued throughout his career that the visual input alone—the optic array—is sufficiently rich to allow visual behaviour [42] whereas many Bayesian or predictive coding accounts of vision typically stress the—allegedly—improverished nature of the visual input requiring prior knowledge and/or generative processes to accomplish visual perception. DNNs have clearly demonstrated that much more visual information can be obtained from images or videos alone than some vision scientists may have presumed.
What makes a good model a good model?

As stated in the introduction, computational models are useful because, first, they force scientists to make assumptions explicit and specify dependencies within a model more precisely than is possible by language alone [c.f. 13]. Second, based on prior knowledge and previous insights they serve as concrete, experimentally testable hypotheses of theories and should explain data, processes or how processes interact. To model visual behaviour we traditionally employ mechanistic models: Models that capture human behaviour in terms of inputs and outputs, and whose computational ingredients are domain specific, i.e. informed by, or derived from, basic principles known and established in vision science. Typical mechanistic models of spatial vision, for example, employ spatial filters and divisive contrast gain-control as some of their computational and causal building blocks [e.g. 48, 110]. Mechanistic models in vision science come in different flavours, depending on how much they focus on behaviour versus how much they focus on neurophysiological realism. Mechanistic models of psychophysics are abstracted away from the details of the biological implementation--without, hopefully, being outright neurally implausible. If neural plausibility or realism is one of the goals of modelling, the models' ingredients or computational building blocks closely mimic the neuronal hardware and are linked to behaviour by linking propositions [118]. Statistical models, on the other hand, are only concerned with fitting and predicting data, that is, with the correct mapping between inputs and outputs. Typically they are generic and can be used in many different domains. DNNs used as tools as described in section 2 are a prime example of statistical models. However, we still prefer to refer to them as tools if used as a means to an end only, in order to separate this use from the way they are also claimed to be (statistical) _models_ of core object recognition (the ventral stream). Importantly, in the absence of any concrete computational domain knowledge, statistical models are often the only models one could possibly use and they thus often precede mechanistic models.

**STATISTICAL VS. MECHANISTIC MODEL**

**Statistical Model:** Concerned with fitting or predicting data, a correct input-output mapping; probabilistic model describing the relationship between the independent (input) and dependent (output) variables; general purpose.

**Mechanistic Model:** Attempts to find a mechanistic, causal relationship between inputs and outputs which predicts the data; typically uses domain specific components, processes or transformations.

Apart from different scientific goals leading to different types of models, there are multiple modelling desiderata--what we expect our model to be good at, whatever type of model it may be. For mechanistic models of behaviour the following desiderata are of particular importance: how well the model fits the data ("predictivity"), and how much the model aids understanding ("explanation"). In the following we expand on these modelling desiderata and discuss how well, in general, DNNs _as models_ fulfil them.

### Predictivity

Traditionally _goodness-of-fit_ was assessed when modelling: How well are my (already collected) data described by my model. Furthermore, if several models were compared, _model selection_ was applied to select the model offering the best trade-off between fitting the data and model complexity. With the advent of modern and highly adaptable ML classification algorithms the focus shifted from explaining past data (goodness-of-fit) to a more stringent test, namely predicting new data (often termed generalisation in ML). DNNs are trained--their parameters are optimised--on _training_ data but their performance is assessed how well they _predict_ the hitherto unknown _test_ data. On standard datasets such as ImageNet, or when used as tools in science, DNN prediction performance is often spectacularly good and the reason why DNNs are currently so popular. Predictivity can be measured at different levels: at an aggregate level (e.g. "do models achieve human-level accuracy?"), but also at a more fine-grained level, for instance asking whether models predict human response and error patterns at an individual stimulus/image level, which is a much stricter requirement [c.f. 49]. In the case of classification data, the latter can be measured by _error consistency_[40], an image-level metric to assess the degree of similarity between for instance human and machine error patterns: Whether humans and machines agree on which images are easy or difficult to classify [also see 97].
Good prediction performance, ideally both at the coarse and the fine-grained level, is undoubtedly an important desideratum of a good model. However, we argue below that it is only one aspect of a good model. Using prediction performance on a specific task as a _benchmark_ is exceedingly popular in computer vision and ML, and benchmarks are gaining traction in vision science, too. While benchmarks have fuelled a lot of progress, an over-reliance on benchmarks to measure progress can be problematic if model quality is erroneously thought of as a single dimension along which models can be ranked, turning science into a spectator sport; as we argue here, model assessment is multi-dimensional and a single rank does not do good models justice. Furthermore, benchmarks and rankings encourage small and short-term gains and discourage fundamental re-thinking and the exploration of novel directions which, typically, are initially accompanied by worse performance on a benchmark.

### Explanation

Beyond predictivity, an important desideratum of a good model is that it helps to _explain_ the data and how the building blocks of it are causally linked to the observed behaviour. Thus, a good model helps explain a scientific phenomenon, or at least aids in its interpretation and understanding. One way models act as an explanation and aid understanding is if they are simple--they have a limited number of parameters and contain building blocks or modules with identifiable sub-functions. Many of the mechanistic models in vision science are of this type and they appear to follow the adage of George Box:

Since all models are wrong the scientist cannot obtain a "correct" one by excessive elaboration. On the contrary following William of Occam he should seek an economical description of natural phenomena. Just as the ability to devise simple but evocative models is the signature of the great scientist so overelaboration and overparameterization is often the mark of mediocrity. [11, p. 792]

DNNs are made up from simple, well-understood, computational units, but their decisions result from the interplay of hundreds of thousands of units and millions of connections. As of today, DNN decisions remain largely opaque because the post-hoc methods developed to understand DNNs--and thus provide an explanation for their behaviour useful to a scientist--have not yet matured enough: Neither visualising maximally activating features [35, 9, 131] nor heatmap or saliency methods [65, 90, 2] sufficiently explain the functions learned by DNNs. While the methods may still mature and there also exist promising novel approaches which may help in the future, e.g. [17] or [15], for now DNNs provide not as much of an explanation and do not aid understanding as much as we would like them to--they should thus at best be regarded as _statistical_ models in vision science. It should not be left unmentioned, however, that it is not inconceivable that models of an organ as complex as the brain, and behaviours as complex as, for example, object recognition, cannot be modelled using a simple model--at least not whilst having adequate prediction performance. Highly nonlinear systems may require highly nonlinear models and both are notoriously difficult to understand and analyse. This is true for complex nonlinear mechanistic models as it is true for statistical models like DNNs. For successful models of visual perception there may not be a dichotomy between understandable "traditional" (mechanistic) models on the one hand and impenetrable (statistical) DNNs on the other: It is a matter of the complexity of the behaviour our model should predict. Thus however much we like simplicity it may well be that if we want computational models of complex visual behaviour we have to come to terms with Santiago Ramon Y Cajal's insight into nature:

Unfortunately, nature seems unaware of our intellectual need for convenience and unity, and very often takes delight in complication and diversity. [14, p. 240]

Ideally, models should be highly predictive, show human-like error patterns and aid understanding. In practice, all those desiderata appear difficult to achieve when modelling complex human visual behaviour. Different models may be preferable depending on the modelling purpose: DNNs if a highly predictive model is desirable even if it does not provide much of an explanation. At other times a simple, easy to understand mechanistic model which is not nearly as predictive may still be preferable. Thus a model may not only be either good or bad but can be both: Depending on the purpose, models can simultaneously be great and poor, useful and futile: Model assessment is multi-dimensional.
## 4 Adequately Modelling Visual Core Object Recognition

Model assessment is multi-dimensional--but how adequate are current DNNs as models of human perception? We here restrict ourselves to _core_ object recognition [23]: Our fast and seemingly effortless ability to classify objects in the real world or images (photographs) of objects to belong to a particular class or category at the entry level--a cat, elephant, car, house, aeroplane etc. Clearly, human object recognition is more than only classification (and thus more than core object recognition): We are also able to recognise individual exemplars from large and more or less homogenous classes, most obviously in face recognition [93] but also when recognising our cat amongst a dozen other cats in the garden, our car in a parking lot or our bike in the overcrowded bike-rack in front of a University building [for a review see, e.g. 77]. Obviously, there is also more to human vision than object recognition: We use vision to estimate properties of materials and scenes, assessing, for example, distances and surface angles, or use it to guide behaviour and to navigate. But notwithstanding how much else there is to vision, (core) object recognition is undoubtedly very important for perception:

At a functional level, visual object recognition is at the centre of understanding how we think about what we see.

Object identification is a primary end state of visual processing and a critical precursor to interacting with and reasoning about the world. [94, p. 76]

Furthermore, when assessing the adequacy of DNNs as models of human perception it is fair and appropriate to use a task that is not only important for humans and computationally complex, but also one where DNNs excel at. In computer vision, object recognition is continuing to set the standards for DNN performance. The combination of these factors--the importance of object recognition for human perception, the central role of object recognition within computer vision, and the fact that DNNs trained on object recognition are being proposed as models for primate ventral stream core object recognition--collectively render visual core object recognition perhaps the best task for comparing human against machine behaviour and thus assessing the adequacy of DNNs as models of a particularly important aspect of human visual perception. What needs to be successfully modelled in core object recognition are the following central, often replicated and most important findings [7]: The (rapid) recognition of objects under changes in orientation, illumination, partial occlusion as well as if distorted by (moderate levels of) visual noise.

### Robustness to 3D viewpoints

[127] performed an impressive and influential set of experiments in which they optimised the _architecture_ of their DNNs with respect to the performance of the DNN in their object recognition task. One of their main findings--not central to our discussion here--was a correlation between performance of the DNNs on their object recognition tasks and the DNNs' ability to also predict neuronal firing patterns in monkey inferior temporal cortex (IT). The stimuli used by Yamins et al. to test their DNNs were 64 rendered objects (8 exemplars from each of 8 categories) superimposed on natural images as background (note that the objects and their position were not matched to the background, however, resulting in, for example, a boat or table floating in mid air above a landscape). What is central to the current discussion is that Yamins et al. varied the object views: From easy, canonical views in the low variation condition to strong changes of the orientation of the objects in the high variation condition. We know that one of the strengths of human object recognition is its ability to cope with changes in orientation, as mentioned above. Not surprisingly, thus, observers performed reasonably well also in the high variation condition [127, Fig. 2B, p. 8621]. However, not only did human observers perform reasonably well in the high variation condition, but also their best DNN performed nearly as well (resulting from hierarchical modular optimization, HMO). This result suggested that DNNs may thus be on par with humans in their robustness to viewpoint or object orientation changes.

However, the stimuli used by [127] were, first, comparatively few and, second, not embedded in a natural background but only superimposed. [25] elegantly explored the viewpoint dependence of DNN object recognition systematically for a number of modern DNNs (VGG-16, Inception-v3, DenseNet-121 and five others). They found classification accuracy of all DNNs to be 3D view dependent--and strongly so: Whilst classification accuracy was typically between 70 and 80% for standard ImageNet images, performance dropped dramatically with slightly unusual viewpoints to
_below_ 20% for most DNNs, with the best performing DNN still below 50% accuracy7. Note that none of the problematic viewpoints for DNNs pose any difficulty for human observers: The difficult images for DNNs are quickly and effortlessly recognisable for us--at least the examples shown in the paper, see Fig. 1. Similar results were obtained in related studies by Alcorn et al. [3], Abbas and Deny [1] and Ibrahim et al. [61]. Alcorn et al. concluded that their work "revealed how DNNs' understanding of objects like'school bus' and 'fire truck' is quite naive--they can correctly label only a small subset of the entire pose space for 3D objects" (p. 8). It is as well to note that also the images used by all the studies cited above do not contain occlusions; the tested DNNs sometimes generalise poorly to novel 3D viewpoints despite seeing all the relevant objects in full view. In this regard, a 3D viewpoint robustness gap between humans and machines remains.

Footnote 7: [25] did not simply search for unusual viewpoints but optimised them to find views that are difficult for DNNs, a procedure similar to how adversarial images are generated, see section 4.4. This is the reason the authors call them _adversarial viewpoints_.

### Robustness to image distortions

Core object recognition performance should not only be (largely) viewpoint invariant but also robust against other image distortions such as, for example, moderate levels of visual noise. [37] systematically explored this issue for three DNNs (ResNet-152, VGG-19 and GoogLeNet) using 13 different image distortions or degradations. To several of the image distortions DNNs were clearly much less robust than the psychophysically tested human observers; the discrepancy was particularly pronounced for uniform noise, low-pass and high-pass filtering and the so-called Eidolon distortions [66]. In the case of uniform noise, for example, human observers were still around 50-60% correct at a noise variance for which all tested DNNs were essentially at chance performance (6.25% in a 16-fold identification task). Including the image distortions in the training of the DNNs led to super-human performance for the DNNs on the very distortion included in the training, but there was little to no generalisation to other distortions: Even training on undistorted images and images
with low contrast, low-pass and high-pass filtering, phase noise, image rotation and salt-and-pepper noise did not help the DNNs to cope with uniform noise. Thus [37] concluded there is a large robustness gap between DNNs and human observers in their core object recognition ability in the face of image distortions, a conclusion that is corroborated by many other robustness studies [e.g. 6, 124, 53, 67, 54, 60, 62].

However, progress in deep learning is sometimes remarkably swift and thus [41] re-assessed robustness to image distortions--termed out-of-distribution (OOD) robustness in ML--in 52 "classic" and state-of-the-art (SOTA) DNNs of 2021 using a total of 17 OOD datasets and more than 85.000 psychophysical trials in the laboratory. Overall different DNN architectures and training regimes appear to have little systematic influence on DNN robustness, but DNNs trained on at least 14 million images showed near human OOD robustness, with two models even surpassing humans in an aggregate measure of OOD robustness across the 17 datasets. What remained, however, was that none of the DNNs comes close to human robustness to low-pass filtering, consistent with all what we know about the different image features used by DNNs and humans during object recognition and discussed in the next section 4.3. We should also add that most of the DNN architectures popular in vision science--for example AlexNet, VGG, ResNets, DenseNets, Inception--show poor and clearly sub-human OOD robustness if only trained on ImageNet. The lack of OOD robustness of these DNNs should be kept in mind if one compares one or some of them to human performance or neural systems. Furthermore, while increased OOD robustness through training on large-scale datasets is indeed an impressive achievement of ML, we require more than just similar overall prediction performance if we want to assess DNNs as adequate model of human behaviour: We also require _error consistency_ even for "only" statistical models, as we argued in section 3.1 above. With respect to error consistency there remains a large gap between _all_ of the 52 DNNs and human behaviour: Whilst the 90 human observers showed large agreement which images they felt were easy or difficult to recognise, human-machine error consistency is only at about half the value of human-to-human consistency even for the best DNNs [see Fig. 1 (d), p. 5, in 41]. Given the large remaining gap in error consistency between SOTA DNNs and human observers it appears safe to conclude that even the highly OOD robust DNNs appear to process images differently from human observers.

Figure 1: Visualisation of 3D viewpoint dependence of object categorisation of DNNs. The first column shows the real images from a “natural” viewpoints (correct classification; green label below images). The second column shows the rendered images from a viewpoint optimised to lead to wrong classification (“adversarial viewpoints”). Columns 3 to 6 show real images again but taken to approximate the adversarial viewpoints of column 2 (wrong classification; red or orange labels depending on DNN confidence in classification). _Figure source: [25], Fig. 5, page 9 with kind permission from the authors_.
### Image features underlying object recognition

Initially it was widely believed that DNNs recognise objects based on their shape--similar to how humans recognise objects: "[T]he network acquires complex knowledge about the kinds of shapes associated with each category. [...] High-level units appear to learn representations of shapes occurring in natural images" [70, p. 429] or that intermediate DNN layers recognise "parts of familiar objects, and subsequent layers [...] detect objects as combinations of these parts" [76, p. 436]. However, systematic investigations now seriously challenge this view that DNNs, like humans, recognise objects via their shape. [5] conducted a series of experiments in which DNNs (AlexNet and VGG-19) had to classify silhouettes of objects, silhouettes filled with the texture of another object, glass figurines and outline figures. For all stimulus variations DNNs performed poorly, suggesting that DNNs rely much more on surface characteristics like texture than human observers and lack global shape sensitivity. Similar results were obtained by [12] who successfully trained a ResNet-variant they termed "BagNet" on ImageNet. BagNet exclusively relies on a bag-of-local features--no shape encoding possible--but still performed similar to several standard DNNs like VGG-16, ResNet-152 or DenseNet-169 in terms of interactions between image parts, sensitivity to features and errors.

Whilst the previous two studies assessed only DNN performance--either to changed stimuli or using a DNN architecture only capable of using local image patches for classification--in our own work we compared human behaviour directly with DNN classifications ("DNN behaviour"). We used style-transfer algorithms [36, 59] to create cue-conflict stimuli, combining the shape of one object with the local surface characteristics (texture) of another, e.g. the shape of a cat with the texture (or skin) of an elephant [38]. Human observers in a large-scale psychophysical study predominantly classified the cue-conflict stimuli almost exclusively according to their shape, whereas ImageNet-trained DNNs showed a strong texture bias (57.1%-82.8% depending on architecture), indicating that they do not classify objects according to their shape as humans do. Importantly, human-machine comparisons need to be careful and fair: To ensure a core object recognition comparison in this and all our behavioural experiments presentation time was limited to 200 ms (a single fixation) and all images were immediately followed by a high-contrast 1/f noise mask to minimise, as much as psychophysically possible, feedback influences on perception. Finally, observers had to respond quickly to ensure perceptual rather than cognitive responses: core object recognition.

**Shape vis. Texture bias**

**Shape bias:** The tendency to classify images according to their global shape ("cat" in the example here).

**Texture bias:** The tendency to classify images according to their local texture-like characteristics ("elephant" in the example here).

_Image source: [38] with permission from the authors._

The above result still held at least in 2021 when [41] re-assessed, amongst other performance measures, shape and texture bias of 52 DNNs. Amongst the 52 DNNs were a large variety of different SOTA DNN architectures and training variants, including adversarial training, selfsupervision and image-text training (CLIP). Some modern DNNs--adversarially trained, CLIP--exhibited a more human-like (stronger) shape bias than previous DNNs, but even they remain substantially more texture biased than human observers [41, Fig. 3]. A recent study by Malhotra et al. [81] again confirms that humans, but not the DNNs investigated, have a shape bias even when learning novel stimuli for which texture is more predictive. The authors argue that the human shape bias is likely resulting from an inductive bias for shape [c.f. 89, 128]. [56] identified data augmentation as an important factor in increasing shape bias. Furthermore, [32] generated synthetic DNN metamers: Stimuli that are physically different but have indistinguishable activity at a certain layer of a DNN. While metamers for the early layers were recognisable by human observers, the activity of later layer DNN metamers were not metameric for humans, pointing to a different representation of objects in DNNs and humans. Most DNNs do not use the same image features as humans do when recognising objects; but more recent models increasingly rely on object shapes and less on texture-like characteristics [21].
### Susceptibility to adversarial attacks

What are adversarial examples, and why are they problematic?In a nutshell, [117] showed that for standard DNNs, _any_ image of category A can be made to be misclassified to belong to _any_ arbitary category B through a tiny perturbation, often so small that it is invisible to the human eye. Despite a decade of enormous research efforts to make DNNs robust against adversarial attacks, no principled defense mechanism has been found to date. The current best defense is brute-force _adversarial training_[80], which increases the perturbation needed to fool a DNN (an approach that may or may not achieve human-level robustness in the future). Adversarial examples are arguably one of the most pressing open problems of deep learning research, and researchers have started to ask whether adversarial examples exist for human perception, too. Typical methods to find adversarials for DNNs cannot be applied to human perception which is stochastic, sequence dependent and does not provide gradients. Despite those practical challenges, answering the question of whether there are adversarial examples for humans is highly relevant to the debate around DNNs as models of human visual perception [e.g. 28], since this would either indicate strong similarities or strong differences.

The crocodile conjecture: Humans don't suffer from adversarial examples.Do adversarial examples for humans exist? Strictly speaking the answer is unknown, but we believe it to be exceedingly unlikely that proper adversarial examples exist for humans. Unfortunately, while adversarial examples do have a precise definition, other types of images have in recent years been described in some way or another as "adversarial". Here we first precisely define what a convincing adversarial example for humans would be, applying the same definition that is used to define machine adversarials for a deep neural network \(f\). Starting from an arbitrary image \(i\) with ground truth label \(l\) for which \(f(i)=l\) holds (i.e. the original image is correctly classified by the model), an untargeted \(\epsilon\)-adversarial image is an image \(i+\delta\) such that \(f(i+\delta)\neq l\) and \(||\delta||_{p}\leq\epsilon\). This adversarial example is _untargeted_ since the perturbation \(\delta\) (which is small according to some \(L_{p}\) norm, typically \(p\in\{0,1,2,\infty\}\)) just needs to fool the model into classifying \(i+\delta\) as any class except for the original one. In the case of a _targeted_ adversarial, on the other hand, a target class \(l^{\prime}\) with \(l^{\prime}\neq l\) is chosen beforehand, and then any image \(i+\delta\) such that \(f(i+\delta)=l^{\prime}\) is called a targeted adversarial example (subject to the same constraints as above, i.e. \(f(i)=l\) and \(||\delta||_{p}\leq\epsilon\)).

If we transfer this to human visual perception, this would mean that if humans are indeed susceptible to \(\epsilon\)-targeted adversarial examples, then for an arbitrary image \(i\) such as the bananas in Figure 2 there would be a small perturbation \(\delta\) (\(||\delta||_{p}\leq\epsilon\)) such that a human observer would classify \(i+\delta\) as an arbitrary but pre-specified other class, such as a crocodile. If \(\epsilon\) is large enough, this is trivially possible: We simply replace the banana image by a crocodile image. Hence, the crucial aspect is that the perturbation bounded by \(\epsilon\) needs to be small. A standard ResNet-50 model, for example, can be fooled into classifying the banana image into a baseball/power drill/crocodile image with \(\epsilon=0.01\) (using the \(L_{\infty}\) norm and the [0, 1] image range), as shown in Figure 2. This means that while every pixel may be changed, the maximum allowed perturbation is 0.01/1 or 1% for each pixel. For humans, we believe it is impossible to find a perturbation \(\delta\) subject to \(||\delta||_{\infty}\leq 0.01\) that yields a "crocodile" classification for the banana image. We call this the _crocodile conjecture_ (no adversarial examples for
humans).8 Given the many other types of images that have been termed "adversarial", we believe it is important to be precise when considering what a convincing adversarial example for human visual perception would constitute. In the following, we will attempt to explain what adversarial examples are _not_: neither hard images, nor ambiguous images, nor visual illusions.

Footnote 8: We would love to be proven wrong; thus for anyone attempting to achieve this, a convincing demonstration would consist of a forced choice paradigm where the choices are either banana or crocodile, with viewing times of at least 100–200 ms, foveal presentation, \(\epsilon=0.01\) and \(p=\infty\).

What adversarial examples are not: hard images.To err is human, and making errors is a part of perception, whether biological or artificial. A popular image dataset refers to natural, unmodified images that are particularly hard, i.e. images on which making errors is likely, as "Natural Adversarial Examples" [55]. While the dataset is great, the name is not: these hard images have nothing to do with adversarial examples.

What adversarial examples are not: ambiguous images.Just as the existence of hard images is normal, so is the existence of ambiguous images. Examples include the famous rabbit-duck image [63], hybrid images consisting of conflicting high- and low spatial frequencies [92] or an image that resembles both a cat and a dog as in [29] (Figure 1 in arXiv v1 and v2, Figure Supp. 1 in arXiv v3), or multistable images [e.g. 107]. Convincing adversarial examples are not tied to inherently ambiguous images--in fact, adversarial examples are problematic for DNNs precisely because they can be found for arbitrary images.

What adversarial examples are not: visual illusions.While the precise definition of visual illusions is subject to debate [119], it commonly involves a discrepancy between perception and "reality". According to this definition, adversarial examples--if humans were susceptible to them!--might be considered a new type of visual illusion. Importantly, however, the reverse is not true: None of the visual illusions we know are adversarial examples. Like ambiguous images, known visual illusions are non-general; illusions are very particular stimuli or images like the particular configuration of shapes in case of the Kanisza triangle, a particular configuration of luminances (reflectances) in case of lightness and brightness illusions, or a particular viewing angle as in the case of the Necker cube. No (known) visual illusion matches the definition of an adversarial example.

Relevance of machine adversarials for humans.While no proper adversarials for humans are known, a number of studies investigated whether machine adversarials contain patterns that have relevance to humans, too. [130] showed that humans can sometimes anticipate the predictions of deep learning models to adversarial patterns--which is very different from being susceptible to adversarial patterns (also see [28] for control experiments). Furthermore, [29] showed that human classification

Figure 2: The crocodile conjecture: there are no adversarial examples for humans, i.e. it is impossible to make humans classify the bananas in the left image as a crocodile with a tiny perturbation. The original banana image (left) is adversarially modified (by adding tiny perturbations) such that a ResNet-50 then classifies the resulting perturbed adversarial images as either baseball, power drill or African crocodile (depending on the perturbation). Results based on the pre-trained torchvision [82] ResNet-50 implementation and the targeted \(L_{\infty}\) PGD attack with \(\epsilon=0.01\) implemented by Foolbox [99]. _Image source for original banana image (left): Photo by Rodrigo dos Reis on Unsplash, licensed under the Unsplash license._
decisions at short presentation times (63-71 ms)9 are influenced, to a certain degree, by intermediate-size perturbations that are adversarial to deep learning models. Thus intermediate-size (rather than small-size) adversarial perturbations are more than just arbitrary noise to humans. Unfortunately, the study is often erroneously interpreted as showing that there are adversarial examples for humans. The study's design choices purposefully target a regime where humans are highly prone to making errors (baseline classification performance for the choice between two classes is at around 75%, where 50% is chance level), and the study only used semantically related classes (dog/cat, cabbage/broccoli, spider/snake), not arbitrary ones. These are sensible choices for studying small effects under extreme conditions, but this is different from human core object recognition [23]. [29] studied edge cases, using a paradigm that cannot test general perception for arbitrary classes (e.g. banana/crocodile) under conditions where the original image can be categorized with high accuracy.

Footnote 9: In addition images were not shown in the central fovea (approx. 2 degrees of visual angle) but were rather large, extending to 14.2 degrees of visual angle and thus into the periphery.

Taken together, we believe that humans don't have adversarials that can turn any arbitrary image (such as a banana) into an arbitrary other category (such as a crocodile) with only a tiny perturbation--the crocodile conjecture. Humans rely heavily on shape when recognising objects, and object shape and boundaries cannot be significantly changed using tiny perturbations only. Adversarial examples are a profound problem for DNNs, but not for humans.

## 5 Discussion and Open Issues

Status quo: Not adequate, but promising.As described in Section 4, in spite of their excellent prediction performance on standard image datasets like ImageNet, current DNNs see the world differently from human observers. We have reviewed evidence that DNNs still lack robustness to changes in object pose (Section 4.1) and image distortions (Section 4.2), make non-human-like errors as assessed by error consistency (last paragraph of Section 4.2), exhibit a lack of human-level shape bias (Section 4.3) and show a worrying and non-human susceptibility to adversarial images (Section 4.4). These behavioural differences can be exemplified in the following thought experiment: We could generate a dataset containing only adversarial images and images with slightly different 3D viewpoints. While human classification performance would be largely unaffected, DNN performance, on the other hand, could be driven to 0% correct. Conversely, given the low error-consistency between DNNs and humans, we could select a subset of non-adversarially distorted images for which human performance is consistently poor but DNN performance excellent. In effect we could (almost) create a double-dissociation between DNNs and human observers in terms of core object recognition
performance--impossible if both DNNs and humans recognised images similarly. These profound behavioural differences indicate that current DNNs are not yet adequate behavioural models of human core object recognition. At the same time, we would like to stress that assessing the (in)adequacy of DNNs as models of human core object recognition behaviour can only be a snapshot in time--it is true as of today. This does not mean that DNNs are forever, or for theoretical reasons, incapable of becoming adequate models of human core object recognition. In fact, for all of the current challenges described in Section 4, the tremendous pace of progress in deep learning will very likely lead to improvements. Indeed, DNNs struggle with certain distortions--but even so, more recent models have come a long way from AlexNet performance and even show more human-aligned error patterns [41]. Indeed, DNNs are susceptible to adversarial perturbations--but even so, adversarial training keeps improving robustness [80, 18]. Not always are the same models successful along all desired dimensions--for instance, adversarially trained models perform particularly poorly when exposed to rotated or low-contrast images [41]--but the pace of progress overall is substantial and we are keen to see how the next generation of deep learning models might become more behaviourally faithful.

Excitement vs. disappointment.Deep learning is often described as a revolution, and just like with any revolution there is tremendous excitement and simultaneously profound disappointment. Vision science is no different: on the one hand, the ability of DNNs to fit neural data has led to the assessment that "deep hierarchical neural networks are beginning to transform neuroscientists' ability to produce quantitatively accurate computational models of the sensory systems" [126, p. 364] or claims beyond core object recognition that "[d]deep neural networks provide the current best models of visual information processing in the primate brain" [88, p. 1]. On the other hand, behavioural shortcomings have also led to the assessment that there are "deep problems with neural network models of human vision" [10, p. 1]. We believe that both of those perspectives are understandable, and that some--not all--of these seemingly contradictory accounts can be reconciled through greater clarity about the goal of a particular model. Model quality is not a one-dimensional construct: some models are good in some regards and poor in others. In particular, DNNs are the best _predictive_ models in the history of core object recognition models--on computer vision benchmarks. At the same time, they struggle to show human-like performance on more challenging, human vision
inspired performance tests like 3D viewpoint variation or distortion robustness and have low error consistency with humans; furthermore, currently DNNs are also probably among the most inscrutable models, which constitutes a challenge towards the modelling goal of _explanation_.

Future direction: Vision science for deep learning.In Section 2, we talked about the deep learning as tools in science and vision science. Later, we have seen numerous examples of the value of vision science for deep learning: to understand how they work, where they fail, and how they see the world. Psychophysical studies have revealed current limitations of DNNs that are of interest not only to those interested in building better behavioural models, but better deep learning models in general. Careful and fair comparisons (c.f. 34) are the hallmark of vision science, and the field with its strong scientific foundation has much to offer to deep learning, which is still a predominantly engineering-driven area. In return, we may hope to develop better behavioural models of human visual perception, benefiting from rapid advances in deep learning and the field's engineering ingenuity [79, 95]. Interesting developments in the direction of better vision science inspired methods for scrutinising deep learning include generating _controversial stimuli_[45] to distinguish between candidate models [related to the idea of maximum differentiation competition, or MAD, by 122], using crowding measures to assess the importance of local vs. global features [24], and using a comparative biology approach when comparing human and machine visual perception [78], just to name a few. We are convinced that deep learning can benefit from vision science just as much as vision science can benefit from deep learning methods. This will be particularly true if we move beyond core object recognition to visual perception in general. Some of the challenges ahead are well articulated in [73] and [22]; a more sceptical position regarding DNNs as (only) models of perception and cognition is provided by [83].
Future direction: Understanding inductive biases.In machine learning the necessity to make assumptions in order to learn anything useful has been formalised by the _no free lunch theorem_[125]. But understanding the inductive bias of a particular deep learning model--i.e., the set of assumptions that the model makes ahead of being exposed to data--is often incredibly challenging, and there are many complex interactions between, for instance, model architecture and dataset. In spite of those challenges, we believe that it will be very important to improve our understanding of the assumptions that perceptual systems make. Humans, for instance, are far from being a tabula rasa at birth [128], we have a highly structured brain with appropriate inductive bias to help us learn rapidly and robustly from comparatively little data--while deep neural networks, at the moment, still sometimes require more data than a human can possibly be exposed to during their lifetime [60]. There is much that remains to be understood: How do models and tasks interact with datasets (also see box on MYTH: MORE (OF THE SAME) DATA IS ALL WE NEED)? What are the inductive biases of biologically-inspired filters [19, 30]? We witness that "recent work in AI [...] increasingly favoured computational architectures (for example, graph nets and tranformers) that implement an inductive bias towards relational, compositional processing" [96, p. 1263], while standard, simpler convolutional networks are becoming less and less relevant. In a similar direction, [106] introduced capsule networks arguing that DNNs should have an inductive bias for explicit representation of geometric relationships of objects, which helps in order to be viewpoint invariant [68]. As a final question, may we require an explicit mid-level representation, the _pre-semantic_ experience of the world [91, 4]? Currently DNNs are trained _end-to-end_, from pixels to semantics in one model using one objective function. Should we explicitly train DNNs on psychologically inspired mid-level representations, and then go from them to semantics? Building more adequate models of visual perception will likely require increasing attention to the various explicit and implicit assumptions, or inductive biases, made by different models.

## 6 Conclusion

A decade ago no researcher in vision science would have foreseen the phenomenal progress made by machine learning researchers in the field of neural networks. DNNs are spectacularly successful tools for (vision) science but also promising (statistical) models of core object recognition in terms of their prediction performance on standard computer vision image datasets. However, it is also fair to say that few researchers foresaw the substantial problems remaining for DNNs despite their excellent prediction performance on standard computer vision image datasets: their lack of robustness to object pose and image distortions, their non-human-like errors as assessed by error consistency, their as of now ill-understood dependence on the minutiae of the training images, their lack of human-like shape encoding as well as their susceptibility to adversarial images. Last but not least we are still lacking reliable tools to turn well-predicting but complex and non-transparent DNNs into human-understandable explanations--a desideratum of a scientific model beyond purely statistical models. We argue, thus, that as of today DNNs should be regarded as promising--but not yet adequate--models of human core object recognition performance.

AcknowledgmentsWe would like to thank, in alphabetic order, Guillermo Aguilar, Bart Anderson, Blair Bilodeau, Wieland Brendel, Stephane Deny, Roland Fleming, Tim Kietzmann, Thomas Klein, Been Kim, Pang Wei Koh, Simon Kornblith, David-Elias Kunstle, Marianne Maertens, Sascha Meyen, Lisa Schut, Heiko Schutt, Kate Storrs and Uli Wannek for helpful discussions and/or valuable feedback on aspects of the manuscript, and Roland Zimmermann for toolbox advice. Furthermore, the authors are particularly indebted to Frank Jakel and his numerous critical and insightful comments on previous versions of our manuscript. All opinions expressed in this article are our own and are not necessarily shared by any of the colleagues we thank here.

Felix Wichmann is a member of the Machine Learning Cluster of Excellence, funded by the Deutsche Forschungsgemeinschaft (DFG, German Research Foundation) under Germany's Excellence Strategy - EXC number 2064/1 - Project number 390727645.
