Non-robust features can mislead neural networks on real images
Natural Jammers: When Non-Robust Features Become Antagonistic
Computer Vision and Pattern RecognitionComputation and Language
Summary
Neural networks sometimes use tricky details invisible or unimportant to humans to recognize images. This paper shows these details, called non-robust features, can actively confuse standard neural networks even on normal photos. The authors find that certain small, high-frequency patterns combined with specific shapes cause this confusion, which they call jamming. Changing these patterns by slight shifts or filtering can help correct the networks’ mistakes, but overall, the problem shifts rather than disappears. This means the networks fail in a complex way linked to the geometry of the images and their features.
What this means in practice
- •For machine learning engineers: Improve model robustness in image recognition pipelines by detecting and mitigating natural jamming patterns that cause misclassification on clean images.
- •For computer vision developers: Use spectral or geometric preprocessing techniques to correct errors induced by subtle high-frequency jamming patterns in standard computer vision models.
Authors
Jiaming Zhang, Fuyao Zhang, Pengjun Xie, Wei Yang Bryan Lim
Abstract
Deep neural networks are known to rely on non-robust features that align poorly with human perception. Prior work has largely framed these features as opportunistic shortcuts that help standard models on clean data. We show instead that non-robust cues can be antagonistic: they can act as Natural Jammers that actively mislead standard models on clean, unmodified images. Using disagreement between a standard model and robust models as an analysis lens, we identify a Jammed Set on which robust models outperform standard models. We provide causal evidence for Spectral-spatial Locking: jamming arises only when high-frequency components are precisely aligned with specific spatial structures. Disrupting this lock through spectral filtering or small geometric shifts can restore correct predictions. Crucially, we uncover a Substitution Paradox: while individual jammers are fragile to geometric shifts, the aggregate prevalence of jamming remains approximately stable and is redistributed rather than eliminated under such transformations. Our results reframe natural non-robustness as a failure field over the empirical model-data geometry: one that redistributes rather than disappears under small transformations.