Zhenan Shao¹, Tianyu Ren¹, Chengxiao Wang¹, Diane M. Beck¹; ¹University of Illinois, Urbana-Champaign

Despite matching or even surpassing human performance on object recognition, deep convolutional neural networks (DCNNs) are strikingly vulnerable to almost imperceptible image perturbations generated by adversarial attacks. Recent work shows that explicitly aligning DNNs to human neural representations improves adversarial robustness, raising the question of what mechanism underlies human robustness and drives those gains. One line of work has attributed human robustness to a reliance on low spatial frequencies (LSF), known to support holistic shape processing, whereas DCNNs overemphasize easily disrupted high-frequency details. Neural alignment could therefore be instilling LSF biases. However, recent work (Subramanian et al., 2023) revealed that humans instead rely on a narrow mid-frequency “human channel” for object recognition. Here we test whether neural alignment improves robustness by inducing spatial frequency (SF) biases (LSF or the human channel), and whether such a bias is sufficient for robustness. We first used adaptive adversarial attacks to probe SF reliance of DCNNs aligned to successive regions of the human ventral visual stream (VVS), which previously showed hierarchical robustness gains. We show that neural alignment produces systematic SF reliance changes: DCNNs aligned to higher-level VVS regions increases reliance on both LSF and the human channel while reducing reliance on high frequencies. We then test the sufficiency of SF bias by imposing targeted LSF or human-channel biases during training, using both SF filtering and a noise-based augmentation method that suppresses specific SF bands with controlled strength. Across all conditions, these biases fail to improve adversarial robustness or produce more human-like representational geometry. Our findings indicate that while neural alignment induces both LSF and human-channel preferences, neither alone suffices for inducing benefits observed with neural alignment. Therefore, such SF preferences may emerge from broader computational goals of the human visual system rather than serving as the primary mechanism that confers adversarial robustness.