Explicitly Modeling Subcortical Vision with a Neuro-Inspired Front-End Improves CNN Robustness

We thank the reviewer for the thoughtful and constructive feedback. We address the reviewer’s main concerns and questions below.

Comparison to broader computer vision methods

We agree that comparing against non-biological robustness methods is important. For this reason, we include both adversarial training and PRIME augmentation as strong baselines (Table 5). EVNet+PRIME outperforms both, indicating that the biological priors introduced by EVNets offer complementary and additive gains to established training-based defenses. We focus on these particular methods, because these remain the most effective and widely adopted methods for improving adversarial robustness and robustness to image corruptions. Adversarial training (e.g., PGD) is a long-standing standard for defending against white-box attacks, while PRIME outperforms other augmentation techniques on ImageNet-C [1]. In addition, earlier forms of data augmentations as used in PRIME have been shown to outperform 1000-fold increase on the training dataset for ImageNet-C, and large pretraining and even self-attention mechanisms for out-of-domain datasets such as ImageNet-R [2]. Furthermore, the objective of our work is not to present a new SOTA defense but to evaluate whether modeling the early visual system in greater detail enhances both robustness and brain alignment. Thus, comparing primarily against biologically-inspired and standard CNNs is most appropriate for isolating the effects of architectural priors. Moreover, many attention mechanisms are hypothesized to arise at higher cortical stages, beyond the scope of our subcortical and V1 front-ends [3]. Nonetheless, we acknowledge the importance of this comparison and will expand the discussion in the final version to better contextualize our findings within broader computer vision research.

Scaling in opposition to neuro-inspiration

We thank the reviewer for invoking Rich Sutton's "Bitter Lesson." While the lesson cautions against manual design in favor of scalable approaches in task-optimization regimes, we believe the story in neurally-aligned vision is more nuanced. In fact, prior work [4] suggests that bigger models are not necessarily more brain-like. Additionally, recent evidence from large-scale benchmarking [5] shows that neural alignment with the primate visual cortex saturates with scale, even as task performance and behavioral alignment continue to improve. Crucially, models with strong architectural priors such as CNNs achieve higher neural alignment, than scale-heavy models like ViTs, especially in low-data regimes. Furthermore, human vision itself is highly efficient, achieving strong generalization and robustness under tight biological constraints. Our work aims to mimic this efficiency by introducing compact, fixed-weight modules that encode inductive biases aligned with the structure of early primate vision. In resource-constrained applications, such efficient and interpretable models may offer practical advantages over large-scale transformers. We will explicitly discuss these tradeoffs and include a broader reflection on the tension between scaling and structure in the final manuscript.

Stochasticity during inference

We thank the reviewer for the insightful suggestion regarding removing stochasticity during inference. The Poisson-like nature of stochasticity shifts the activation distribution non-symmetrically. This way, removing stochasticity after training the model with it, impairs its performance (clean accuracy declined from 71.7% to 64.5%). This phenomenon is also present in VOneNets. On the other hand, the alternative strategy of averaging the logits of multiple stochastic forward passes per image, mirroring an ensemble strategy, is a valid one. When averaging over 3 forward passes increased ImageNet accuracy from 71.7% to 72.2%, corruption robustness from 41.5% to 42.4%, and OOD generalization from 38.7% to 39.2%. We will perform an extensive analysis to explore how performance is affected by the number of forward passes and include it in the final manuscript.

Empirical tuning curves

We agree with the reviewer that including real neural tuning curves would enhance Figure 2. Our model tuning curves were carefully fitted and aligned to mean LGN response properties from multiple studies, as described in Section 2.2 and Supplementary Material E.2. However, due to the heterogeneity of biological neurons, there is no single “canonical” response to compare against. Our goal was to model the average tuning behavior of foveal P and M cells. That said, we appreciate the need for transparency and will include representative empirical curves alongside our model fits in the Supplementary Material, along with citations and commentary.

Light adaptation pooling size

Indeed, the biological visual system includes both global and local light adaptation. In early experiments, we implemented a local light adaptation layer using a Gaussian filter. However, during Bayesian optimization, the filter radius consistently grew toward the size of the image, effectively becoming global. To avoid unnecessary compute, we opted for global luminance normalization. That said, we emphasize that our model retains multiple local adaptation mechanisms such as DoG filters and a contrast normalization layer, which provide spatially localized gain control and surround modulation. We will clarify this design choice and include ablation results in the Supplementary Material.

Skip connections

We appreciate the creative architectural suggestion and agree that skip connections from the SubcorticalBlock to the downstream CNN could reflect known projections from LGN to V2. While direct skips from the pixels to V1 are less biologically plausible, incorporating LGN-V2 bypasses is indeed worth exploring. We plan to investigate this for the final version. Such modifications could offer greater flexibility for the network to use or ignore early features depending on the context.

Trainable front-ends

We fully acknowledge the potential benefits of allowing early blocks to be fine-tuned. However, our focus was on designing a fixed-weight front-end that is biologically grounded and not driven by task-based optimization. This approach improves interpretability and alignment with neuroscientific models, and is motivated by prior work showing that fixed-weight architectures like the VOneBlock can achieve competitive robustness. Nonetheless, we agree that enabling training of these early modules is a promising direction. Prior work [6] has shown the utility of this strategy by introducing trainable divisive normalization in a VOneNet-style architecture leads to both enhanced robustness and improved alignment with V1 recordings, as measured by BrainScore. More broadly, letting the front-end adapt to the task might allow neural-like operations to emerge rather than be hand-specified. For example, [7] showed that DoG-like filters can emerge when a convolutional network is constrained by architectural bottlenecks similar to the primate optic tract. This suggests a compelling hybrid route of initialization with biological priors followed by task-dependent fine-tuning thereby balancing biological plausibility and representational flexibility. We will elaborate on this in the revised Discussion and highlight the possibility of initializing from neuro-inspired weights but allowing task-driven fine-tuning.

References

[1] A. Modas, R. Rade, G. Ortiz-Jiménez, S.-M. Moosavi-Dezfooli, and P. Frossard, ‘PRIME: A Few Primitives Can Boost Robustness to Common Corruptions’, in Computer Vision -- ECCV 2022, 2022, pp. 623–640.

[2] D. Hendrycks et al., ‘The Many Faces of Robustness: A Critical Analysis of Out-of-Distribution Generalization’, in 2021 IEEE/CVF International Conference on Computer Vision (ICCV), 2021, pp. 8320–8329.

[3] S. J. Luck, L. Chelazzi, S. A. Hillyard, and R. Desimone, ‘Neural Mechanisms of Spatial Selective Attention in Areas V1, V2, and V4 of Macaque Visual Cortex’, Journal of Neurophysiology, vol. 77, no. 1, pp. 24–42, 1997.

[4] J. Kubilius et al., ‘Brain-Like Object Recognition with High-Performing Shallow Recurrent ANNs’, in Advances in Neural Information Processing Systems, 2019, vol. 32.

[5] A. Gokce and M. Schrimpf, ‘Scaling Laws for Task-Optimized Models of the Primate Visual Ventral Stream’. 2025.

[6] A. Cirincione et al., ‘Implementing Divisive Normalization in CNNs Improves Robustness to Common Image Corruptions’, in SVRHM 2022 Workshop @ NeurIPS, 2022.

[7] J. Lindsey, S. A. Ocko, S. Ganguli, and S. Deny, ‘The effects of neural resource constraints on early visual representations’, in International conference on learning representations, 2019, vol. 77

We thank the reviewer for the thoughtful and constructive feedback. We address the reviewer’s main concerns and questions below.

Model performance across individual corruptions

We thank the reviewer for pointing out this omission. We will include figures in the Supplementary Material that display model accuracy across different corruption severities and types. Notably, our functional analysis of the SubcorticalBlock suggests that its integration offers greater robustness to contrast and brightness corruptions compared to others. However, this is not observed in practice, EVNets achieve an accuracy of 32.1% (31.6% in VOneNets and 39.4% in ResNet50) for contrast and 62.0% for brightness (64.3% in VOneNets and 66.4% in ResNet50). Although these corruptions are primarily related to changes in luminance and contrast, it is important to acknowledge the additional loss of information that occurs due to encoding quantization in 8-bit RGB with gamma correction. Reducing contrast before saving an image increases quantization error, resulting in more pronounced discretization artifacts. Similarly, increasing brightness leads to overexposed images, where pixel values are clipped to the maximum allowable value, further contributing to information degradation. Ideally, if brightness were adjusted by scaling an image by a constant, without any value clipping nor gamma correction, the light-adaptation layer of the SubcorticalBlock would generate the same activation map as for the original image. Considering that this mapping does not reflect true brightness variations, it is not surprising that the gains in brightness robustness are similar to those observed with other types of corruption.

Field of View Changes

In our models, the field of view (FoV) defines the portion of the visual field occupied by the object being classified. The original 8deg FoV in VOneNet was chosen as a rough dataset-wide average, but ImageNet exhibits substantial variability in object size and framing. Moreover, standard ImageNet training involves random cropping, sometimes reducing the input to as little as 8% of the original image, further increasing the variation in apparent FoV during training. In earlier experiments on Tiny ImageNet, we used a 2deg FoV for 64×64 images, corresponding to 32 pixels per degree (ppd), which closely matches the 28 ppd used in the original VOneNet and follows precedents in adapting VOneNets to this dataset [1–3]. To maintain consistent resolution across input sizes, we selected a 7deg FoV for ImageNet-scale images, which keeps the spatial resolution and allows for fair comparison across different input scales while keeping receptive field sizes fixed. Although we did not include a direct baseline with an 8deg FoV for comparison, our VOneNet implementation with a 7deg FoV actually improves over the original VOneNet in clean accuracy (72.9% vs. 71.7%), mean corruption accuracy (40.4% vs. 40.0%), and adversarial robustness (51.5% vs. 51.1%, based on comparable attack conditions) [1]. These results suggest that the change in FoV did not negatively impact performance and may have modestly improved it.

Clarification of tuning property gains

We agree that the manuscript would benefit from a deeper discussion of how subcortical computations influence V1 tuning properties, and we will expand on this point in the revised Discussion section. The observed improvements in V1 alignment, particularly for surround modulation and RF size, stem from the normalization stages implemented in the SubcorticalBlock. These mechanisms enforce local competition and approximate extraclassical phenomena which the VOneBlock alone cannot capture due to its purely classical RF structure. Our results suggest that upstream normalization acts as a surrogate for some of the missing recurrent (and possibly feedback) processes in V1, enhancing the biological plausibility and functional fidelity of the V1 responses observed downstream. This supports the idea that some extraclassical properties can emerge from subcortical preprocessing alone.

Reason behind robustness improvements and need for biological parameterization

We agree that further insights into the source of robustness gains are valuable, and we will expand on this point in the revised Discussion section. As noted in prior work using the VOneNet architecture and changing the V1 properties [3], corruption robustness is not dependent on exactly matching biological parameter distributions but rather on the broader structure and covariance between some of these properties. In the case of subcortical computations, our hypothesis is that normalization layers promote local competition and dynamic range compression, which are known to improve robustness by reducing sensitivity to input perturbations. Meanwhile, the DoG filtering improves features selectivity, while performing low-pass filtering, mitigating high-frequency noise.

Evaluating neural predictivity of subcortical neurons

We acknowledge the reviewer’s suggestion to assess alignment with subcortical recordings. However, our SubcorticalBlock is designed to match the average response properties of primate LGN neurons, and does not attempt to capture their full variability or even single-unit responses, in contrast with the VOneBlock. Because of this design choice, applying RSA or linear predictivity on existing single-unit LGN datasets would not be meaningful as our model lacks the heterogeneity required for such comparisons. We believe that future work should focus on expanding the dimensionality and diversity of the SubcorticalBlock before using it in predictive frameworks.

Need for the VOneBlock

In early experiments, we evaluated a version of our model that only includes the SubcorticalBlock. While it retained some robustness benefits, it consistently underperformed the full EVNet architecture in corruption robustness. This suggests that the VOneBlock and SubcorticalBlock confer complementary inductive biases, with one targeting contrast and luminance invariance (Subcortical) and the other contributing spatial and orientation-specific processing. We will include the corresponding ablation results in the final Supplementary Material.

VOneNet + PRIME

Our intent was not to benchmark EVNet against VOneNet under all conditions, but to examine how architectural and training-based robustness strategies interact. Since the impact of combining biologically inspired front-ends with PRIME had not been studied before, we focused on EVNet+PRIME to highlight its cumulative gains. That said, as including VOneResNet50+PRIME in our study would be interesting, we will include these results in our final manuscript.

Adversarial Robustness on Ablations

Due to computational constraints and the high cost of performing Monte Carlo PGD attacks with 32 samples per iteration under stochastic noise, we did not include adversarial robustness results for all ablations. However, we agree this would offer valuable insight, particularly in understanding the role of specific mechanisms (e.g., contrast normalization, light adaptation) under gradient-based attacks. We will include these evaluations in the final manuscript and update the Supplementary Material accordingly.

References

[1] A. Baidya, J. Dapello, J. J. DiCarlo, and T. Marques, ‘Combining Different V1 Brain Model Variants to Improve Robustness to Image Corruptions in CNNs’, in SVRHM 2021 Workshop @ NeurIPS, 2021.

[2] A. Cirincione et al., ‘Implementing Divisive Normalization in CNNs Improves Robustness to Common Image Corruptions’, in SVRHM 2022 Workshop @ NeurIPS, 2022.

[3] R. Barbulescu, T. Marques, and A. L. Oliveira, ‘Contribution of V1 Receptive Field Properties to Corruption Robustness in CNNs’, in ECAI 2024, IOS Press, 2024, pp. 658–665.

We thank the reviewer for their constructive feedback and for highlighting the strengths of our work, including the scientific soundness of the SubcorticalBlock and the manuscript’s clarity. We address the reviewer’s main concerns and questions below.

Generalization to Other Architectures

Our initial focus on ResNet-50 and EfficientNet-B0 was shaped both by computational constraints and by the precedent established in prior work on VOneNets [1], which demonstrated that biologically inspired front-ends can generalize well across diverse CNN backbones, including AlexNet and CORNet. Nonetheless, to further assess the generality of EVNets, we are conducting new experiments applying the EVNet front-end to other simpler back-end architectures, such as AlexNet, and will include these results in the final version.

Implementation Details and Parameter Summary

We agree that greater transparency in parameterization would be helpful. In the final version, we will include a table summarizing all SubcorticalBlock parameters, including DoG kernel sizes, surround inhibition values, and parameters derived from our neurophysiologically-constrained hyperparameter tuning. While many values were derived through empirical alignment with subcortical data (see Table E5 in Supp. E.2), we acknowledge the need for easier reference.

Connection to Classical Computer Vision Literature

We appreciate the reviewer’s suggestion to better contextualize our approach within the classical computer vision literature. In the final version, we will add references and discussion on early computational models of center-surround mechanisms and DoG-based edge and contrast processing (e.g., Marr & Hildreth [2]), as well as their influence on tasks such as boundary detection and color constancy. We agree that this will provide valuable historical perspective and highlight the continuity between classical vision and modern biologically-inspired deep learning

Field of View Changes

In our models, the field of view (FoV) defines the portion of the visual field occupied by the object being classified. The original 8deg FoV in VOneNet was chosen as a rough dataset-wide average but ImageNet exhibits substantial variability in object size and framing. Moreover, standard ImageNet training involves random cropping, sometimes reducing the input to as little as 8% of the original image, further increasing the variation in apparent FoV during training. In earlier experiments on Tiny ImageNet, we used a 2deg FoV for 64×64 images, corresponding to 32 pixels per degree (ppd), which closely matches the 28 ppd used in the original VOneNet and follows precedents in adapting VOneNets to this dataset [3–5]. To maintain consistent resolution across input sizes, we selected a 7deg FoV for ImageNet-scale images, which allows for fair comparison across different input scales while keeping receptive field sizes fixed. Although we did not include a direct baseline with an 8deg FoV for comparison, our VOneNet implementation with a 7deg FoV actually improves over the original VOneNet in clean accuracy (72.9% vs. 71.7%), mean corruption accuracy (40.4% vs. 40.0%), and adversarial robustness (51.5% vs. 51.1%, based on comparable attack conditions) [1]. These results suggest that the change in FoV did not negatively impact performance and may have modestly improved it.

Gabor Filter Bank Changes

Regarding the Gabor Filter Bank (GFB), we extended its spatial frequency (SF) range to better match empirical V1 distributions. In the original VOneNet implementation, the range of SFs processed by the GFB was sampled from a binned empirical distribution of V1 receptive field preferences [5], but was constrained by the Nyquist frequency of the model. For 224×224 images, the Nyquist frequency, $f_N$, along the diagonal is given by $\frac{1}{2\sqrt(2)} px^{-1}$. With the original 8deg FoV, this yields $f_N$ = 9.9cpd, and maximum SF used in the GFB was 5.6 cpd, as the next bin (8 cpd) was considered too close to the Nyquist limit to be reliably represented. By decreasing the FoV to 7deg, we increase the model’s resolution, and the Nyquist frequency rises to 11.3cpd. This allows us to safely include higher-frequency components in the GFB, expanding the range of SFs modeled to 8cpd, and thus achieving better coverage of the empirical V1 SF distribution, while maintaining a similar safety margin with respect to the Nyquist limit. This modification enhances the biological plausibility of the GFB’s tuning properties without altering the overall architecture of the VOneBlock

Ablations

Our initial ablation strategy focused on understanding how individual components modulate the behavior of a linear P-cell pathway, which we used as a baseline due to its known dominance in ventral stream projections [7]. Omitting the P pathway would remove both chromatic information and high-acuity processing, making the ablated model qualitatively unlike the full system. On the other hand, omitting the M pathway did not significantly affect performance, which is aligned with the hypothesis that it does not contribute significantly to ventral stream processing. However, we agree that including a P-cell ablation improves completeness and interpretability, and we have, in the meanwhile, trained one seed of a EVResNet50 with the P-cell pathway omitted. This model achieves an accuracy of 62.6% (vs. 71.7% on the full EVResNet50) on the ImageNet validation set, a mean corruption accuracy of 35.6% (vs. 41.5% on EVResNet50) and a mean out-of-domain accuracy of 33.9 (vs. 38.7% on EVResNet50). We appreciate the suggestion to evaluate the impact of each component on V1 response properties. To support a deeper understanding of their individual contributions to V1 alignment, we will add a table with ablation results to the Supplementary Material. We will also extend the ablation results to other backend architectures used.

Statistical Significance

While some improvements may appear modest (e.g., sub-percentage gains), the consistency of results across seeds and benchmarks (e.g., shape bias, corruption robustness) suggest genuine benefits. Evaluating statistical significance between different models would require training a much larger number of seeds.

Parameters introduced by the Subcortical layer

Regarding model complexity, we emphasize that the SubcorticalBlock introduces no trainable parameters. All components, DoG filters, normalization stages, and noise generators, are parameterized based on biological priors and remain fixed during training. The complete SubcorticalBlock configuration relies on six hyperparameters (see Supplementary Table E6), which are optimized to align model responses with empirical subcortical properties.

Reference list formatting

We thank the reviewer for the suggestion. In the final camera-ready version, we will ensure that all author names are listed in full in the References section.

References

[1] J. Dapello, T. Marques, M. Schrimpf, F. Geiger, D. Cox, and J. J. DiCarlo, ‘Simulating a Primary Visual Cortex at the Front of CNNs Improves Robustness to Image Perturbations’, in Advances in Neural Information Processing Systems, 2020, vol. 33, pp. 13073–13087.

[2] D. Marr, E. Hildreth, and S. Brenner, ‘Theory of edge detection’, Proceedings of the Royal Society of London. Series B. Biological Sciences, vol. 207, no. 1167, pp. 187–217, 1980.

[3] A. Baidya, J. Dapello, J. J. DiCarlo, and T. Marques, ‘Combining Different V1 Brain Model Variants to Improve Robustness to Image Corruptions in CNNs’, in SVRHM 2021 Workshop @ NeurIPS, 2021.

[4] A. Cirincione et al., ‘Implementing Divisive Normalization in CNNs Improves Robustness to Common Image Corruptions’, in SVRHM 2022 Workshop @ NeurIPS, 2022.

[5] R. Barbulescu, T. Marques, and A. L. Oliveira, ‘Contribution of V1 Receptive Field Properties to Corruption Robustness in CNNs’, in ECAI 2024, IOS Press, 2024, pp. 658–665.

[6] Russell L. De Valois, Duane G. Albrecht, and Lisa G. Thorell. “Spatial Frequency Selectivity of Cells in Macaque Visual Cortex”. In: Vision Research 22 (1982), pp. 545–559.

[7] Nassi, J., Callaway, E. Parallel processing strategies of the primate visual system. Nat Rev Neurosci 10, 360–372 (2009).

We thank the reviewer for their assessment and appreciate the recognition of our work’s theoretical grounding and our efforts to replicate biological receptive field properties. We address the main points of concern below.

Novelty

While it is true that individual components of our model (e.g., DoG filters and normalization mechanisms) have been previously explored, our contribution lies in the systematic integration of these components into a unified module that simulates responses of subcortical neurons of primate retina and LGN. Crucially, this is not a heuristic assembly: we introduce a novel, neurophysiologically-constrained hyperparameter tuning procedure that calibrates the SubcorticalBlock according to average empirical response property values. This represents a methodological advancement over prior work, which often relied on loosely inspired architectural motifs without systematic alignment to subcortical physiology. Additionally, EVNets establishes a modular architecture, in the form of a CNN, that explicitly models the early visual cascade from the retina up to V1, enabling a layer-wise commitment to biological function. This fills a notable gap in the literature and in platforms like BrainScore, which, despite its +100 benchmarks for measuring alignment across the whole ventral stream, still lack tools for evaluating subcortical alignment partially because no models have made this level of biological commitment until now. Therefore, while the building blocks may not be individually novel, their integrated and parameter-constrained formulation, as well as the broader architectural strategy of EVNets, represent a meaningful step forward.

Baselines and Comparisons

We agree that comparing against non-biological robustness methods is important. For this reason, we include both adversarial training and PRIME augmentation as strong baselines (Table 5). EVNet+PRIME outperforms both, indicating that the biological priors introduced by EVNets offer complementary and additive gains to established training-based defenses. We focus on these particular methods, because these remain the most effective and widely adopted methods for improving adversarial robustness and robustness to image corruptions. Adversarial training (e.g., PGD) is a long-standing standard for defending against white-box attacks, while PRIME outperforms other augmentation techniques on ImageNet-C [1]. In addition, earlier forms of data augmentations as used in PRIME have been shown to outperform 1000-fold increase on the training dataset for ImageNet-C, and large pretraining and even self-attention mechanisms for out-of-domain datasets such as ImageNet-R [2]. Furthermore, the objective of our work is not to present a new SOTA defense but to evaluate whether modeling the early visual system in greater detail enhances both robustness and brain alignment. Thus, comparing primarily against biologically-inspired and standard CNNs is most appropriate for isolating the effects of architectural priors. As for the backend architectures used, in Supplementary Material D.2, we show results for EVNets using an EfficientNet-B0 backend, in which the robustness benefits persist, and we will be including an additional backend architecture in the final manuscript.

Impact on neuroscience and machine learning

While EVNets belong to the broader category of bio-inspired models, they target a distinct and underexplored segment of the visual hierarchy. Unlike prior work focusing on high-level cortical motifs like recurrence (e.g., CORnet, hGRU, ConvRNNs), our architecture explicitly models early vision through a modular assembly of empirically constrained subcortical and V1-like components. This focus on simulating retinal and LGN computations fills a gap left by most prior biologically-inspired CNNs, which typically begin at or beyond V1. Moreover, as shown in our work, such early vision modules are not mutually exclusive with cortical models, they are instead complementary. EVNets provide a foundation that can be integrated with cortical motifs, potentially yielding even greater brain alignment and robustness gains. From a neuroscience perspective, our findings demonstrate that (1) enhanced V1 tuning and extra-classical properties can emerge solely from upstream (subcortical) computations; and that (2) compositionality of biologically grounded modules can improve overall alignment without additional supervised fitting. On the other hand, from a ML perspective, we show that (1) explicitly modeling subcortical mechanisms can serve as a robustness-enhancing architectural prior, and that (2) these neuro-inspired priors are orthogonal to training-based methods, as shown by additive improvements when EVNets are combined with PRIME. Thus, the work contributes insights into how biological fidelity at early stages can inform both our understanding of visual representations and robust ML design. In sum, we believe our paper contributes a meaningful advance by introducing a novel, empirically aligned model of subcortical processing, demonstrating emergent V1 phenomena from upstream modules and by showing robustness gains that are complementary to SOTA training methods. We hope these clarifications will help the reviewer reconsider the novelty and impact of our work.

References

[1] A. Modas, R. Rade, G. Ortiz-Jiménez, S.-M. Moosavi-Dezfooli, and P. Frossard, ‘PRIME: A Few Primitives Can Boost Robustness to Common Corruptions’, in Computer Vision -- ECCV 2022, 2022, pp. 623–640.

[2] D. Hendrycks et al., ‘The Many Faces of Robustness: A Critical Analysis of Out-of-Distribution Generalization’, in 2021 IEEE/CVF International Conference on Computer Vision (ICCV), 2021, pp. 8320–8329.

We hope you had a chance to read our rebuttal. Please let us know if there are any remaining questions or concerns about our work that we could help clarify. We would be happy to provide further details if needed.

@Reviewer g9Dr -- could you please let us know whether the rebuttal addresses your concerns? I am especially eager to hear your thoughts regarding baseline comparisons. Thanks

Dear Authors,

Thank you for your detailed response to my review. I appreciate your elaboration of the model's novelty, comparison to stronger baselines and clarifying the contribution to machine learning / neuroscience. Here are my thoughts after reading your rebuttal and other reviews.

1. Model's novelty: I agree with the authors that the proposed combination of M and P cells, DoG filter convolution, contrast normalization and neural stochasticity is not arbitrary and appreciate the resemblance to biological anatomical constraints. I believe the introduction of M and P cell pathways along with DoG filter-based convolution is the main innovation, since divisive contrast normalization and neuronal stochasticity have been widely studied in prior work. It would be great if the authors could please emphasize this in their submission. I'm still unconvinced that these interventions meet the originality standards of the main conference track at NeurIPS.

2. Robustness improvements produced by EVNet: I thank the authors for highlighting Table 5 with robustness results compared against PRIME and Adversarial Training. I see comparison to VOneNet in the top part of the table but the authors don't compare EVNet + PRIME / AT with VOneNet + PRIME / AT. I think this is an important comparison to make especially since Table 4 shows that VOneResNet50 is largely outperforming EVResNet-50 on adversarial robustness. Overall, I don't see clear trends that EVNet is better than ResNet-50 and VOneResNet-50.

3. Contributions to ML / Neuroscience: Thanks to the authors for highlighting their efforts to bridge the gap in simulating the retinal and thalamocortical pathways in CNNs. This is a significant contribution, I agree with the authors that prior work mostly focuses on just retinal / V1 modeling.

In summary, the author rebuttal certainly improved my understanding of their contributions and addressed some of my critiques. However, I maintain my stance of low novelty and unclear gains wrt VOneNet that shares a bunch of components with EVNet. I am raising my score since some of my concerns were addressed, but still feel that the paper has significant room for improvement before acceptance at NeurIPS owing to the mixed improvement signals over VOneNet and potentially low novelty.