{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,18]],"date-time":"2026-03-18T09:45:11Z","timestamp":1773827111725,"version":"3.50.1"},"reference-count":118,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2022,11,1]],"date-time":"2022-11-01T00:00:00Z","timestamp":1667260800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2022,11,1]],"date-time":"2022-11-01T00:00:00Z","timestamp":1667260800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2022,7,18]],"date-time":"2022-07-18T00:00:00Z","timestamp":1658102400000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100000268","name":"Biotechnology and Biological Sciences Research Council","doi-asserted-by":"publisher","award":["BB\/M011224\/1"],"award-info":[{"award-number":["BB\/M011224\/1"]}],"id":[{"id":"10.13039\/501100000268","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Neural Networks"],"published-print":{"date-parts":[[2022,11]]},"DOI":"10.1016\/j.neunet.2022.07.003","type":"journal-article","created":{"date-parts":[[2022,7,20]],"date-time":"2022-07-20T22:19:56Z","timestamp":1658355596000},"page":"258-286","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":3,"special_numbering":"C","title":["Hierarchical binding in convolutional neural networks: Making adversarial attacks geometrically challenging"],"prefix":"10.1016","volume":"155","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-2540-7486","authenticated-orcid":false,"given":"Niels","family":"Leadholm","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Simon","family":"Stringer","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"78","reference":[{"key":"10.1016\/j.neunet.2022.07.003_b1","unstructured":"Abadi,\u00a0M., Barham,\u00a0P., Chen,\u00a0J., Chen,\u00a0Z., Davis,\u00a0A., Dean,\u00a0J., Devin,\u00a0M., Ghemawat,\u00a0S., Irving,\u00a0G., Isard,\u00a0M., Kudlur,\u00a0M., Levenberg,\u00a0J., Monga,\u00a0R., Moore,\u00a0S., Murray,\u00a0D. G., Steiner,\u00a0B., Tucker,\u00a0P., Vasudevan,\u00a0V., Warden,\u00a0P., .... Zheng,\u00a0X. (2016). TensorFlow: A system for large-scale machine learning. In Proceedings of the 12th USENIX symposium on operating systems design and implementation."},{"key":"10.1016\/j.neunet.2022.07.003_b2","series-title":"35th international conference on machine learning","article-title":"Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples","author":"Athalye","year":"2018"},{"issue":"12","key":"10.1016\/j.neunet.2022.07.003_b3","doi-asserted-by":"crossref","DOI":"10.1109\/TPAMI.2016.2644615","article-title":"SegNet: A deep convolutional encoder-decoder architecture for image segmentation","volume":"39","author":"Badrinarayanan","year":"2017","journal-title":"IEEE Transactions on Pattern Analysis and Machine Intelligence"},{"key":"10.1016\/j.neunet.2022.07.003_b4","doi-asserted-by":"crossref","DOI":"10.1371\/journal.pcbi.1006613","article-title":"Deep convolutional networks do not classify based on global object shape","author":"Baker","year":"2018","journal-title":"PLoS Computational Biology"},{"key":"10.1016\/j.neunet.2022.07.003_b5","series-title":"Advances in neural information processing systems, Vol. 2020-December","article-title":"Learning physical graph representations from visual scenes","author":"Bear","year":"2020"},{"key":"10.1016\/j.neunet.2022.07.003_b6","doi-asserted-by":"crossref","DOI":"10.1109\/TPAMI.2013.50","article-title":"Representation learning: A review and new perspectives","author":"Bengio","year":"2013","journal-title":"IEEE Transactions on Pattern Analysis and Machine Intelligence"},{"key":"10.1016\/j.neunet.2022.07.003_b7","unstructured":"Brendel,\u00a0W., & Bethge,\u00a0M. (2019). Approximating CNNs with Bag-of-Local-Features Models Works Surprisingly Well on ImageNet. In International conference on learning representations."},{"key":"10.1016\/j.neunet.2022.07.003_b8","unstructured":"Brendel,\u00a0W., Rauber,\u00a0J., & Bethge,\u00a0M. (2018). Decision-based adversarial attacks: Reliable attacks against black-box machine learning models. In 6th international conference on learning representations."},{"key":"10.1016\/j.neunet.2022.07.003_b9","unstructured":"Brendel,\u00a0W., Rauber,\u00a0J., K\u00fcmmerer,\u00a0M., Ustyuzhaninov,\u00a0I., & Bethge,\u00a0M. (2019). Accurate, reliable and fast robustness evaluation. In Advances in neural information processing systems, Vol. 32."},{"key":"10.1016\/j.neunet.2022.07.003_b10","series-title":"MONet: Unsupervised scene decomposition and representation","author":"Burgess","year":"2019"},{"key":"10.1016\/j.neunet.2022.07.003_b11","series-title":"On evaluating adversarial robustness","author":"Carlini","year":"2019"},{"key":"10.1016\/j.neunet.2022.07.003_b12","series-title":"Proceedings of the 37th international conference on machine learning","article-title":"A simple framework for contrastive learning of visual representations","author":"Chen","year":"2020"},{"key":"10.1016\/j.neunet.2022.07.003_b13","series-title":"ICLR","article-title":"Robust overfitting may be mitigated by properly learned smoothing","author":"Chen","year":"2021"},{"key":"10.1016\/j.neunet.2022.07.003_b14","unstructured":"Cheung,\u00a0B., Livezey,\u00a0J. A., Bansal,\u00a0A. K., & Olshausen,\u00a0B. A. (2015). Discovering hidden factors of variation in deep networks. In 3rd international conference on learning representations."},{"issue":"3","key":"10.1016\/j.neunet.2022.07.003_b15","doi-asserted-by":"crossref","DOI":"10.1103\/PhysRevX.8.031003","article-title":"Classification and geometry of general perceptual manifolds","volume":"8","author":"Chung","year":"2018","journal-title":"Physical Review X"},{"issue":"1","key":"10.1016\/j.neunet.2022.07.003_b16","doi-asserted-by":"crossref","DOI":"10.1038\/s41467-020-14578-5","article-title":"Separability and geometry of object manifolds in deep neural networks","volume":"11","author":"Cohen","year":"2020","journal-title":"Nature Communications"},{"key":"10.1016\/j.neunet.2022.07.003_b17","unstructured":"Croce,\u00a0F., Andriushchenko,\u00a0M., & Hein,\u00a0M. (2020). Provable robustness of relu networks via maximization of linear regions. In AISTATS 2019 - 22nd international conference on artificial intelligence and statistics."},{"key":"10.1016\/j.neunet.2022.07.003_b18","unstructured":"Croce,\u00a0F., & Hein,\u00a0M. (2020). Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In Proceedings of the 37th international conference on machine learning. [ISSN: 23318422]."},{"key":"10.1016\/j.neunet.2022.07.003_b19","doi-asserted-by":"crossref","unstructured":"Dapello,\u00a0J., Marques,\u00a0T., Schrimpf,\u00a0M., Geiger,\u00a0F., Cox,\u00a0D., & DiCarlo,\u00a0J. (2020). Simulating a Primary Visual Cortex at the Front of CNNs Improves Robustness to Image Perturbations. In 34th conference on neural information processing systems.","DOI":"10.1101\/2020.06.16.154542"},{"key":"10.1016\/j.neunet.2022.07.003_b20","unstructured":"Dhamdhere,\u00a0K., Yan,\u00a0Q., & Sundararajan,\u00a0M. (2019). How important is a neuron?. In 7th international conference on learning representations."},{"key":"10.1016\/j.neunet.2022.07.003_b21","doi-asserted-by":"crossref","DOI":"10.1016\/j.tics.2007.06.010","article-title":"Untangling invariant object recognition","author":"DiCarlo","year":"2007","journal-title":"Trends in Cognitive Sciences"},{"key":"10.1016\/j.neunet.2022.07.003_b22","series-title":"Proceedings of the IEEE computer society conference on computer vision and pattern recognition","article-title":"Boosting adversarial attacks with momentum","author":"Dong","year":"2018"},{"key":"10.1016\/j.neunet.2022.07.003_b23","doi-asserted-by":"crossref","DOI":"10.7554\/eLife.55978","article-title":"What do adversarial images tell us about human vision?","volume":"9","author":"Dujmovi\u0107","year":"2020","journal-title":"ELife"},{"key":"10.1016\/j.neunet.2022.07.003_b24","doi-asserted-by":"crossref","DOI":"10.1037\/rev0000103","article-title":"The emergence of polychronization and feature binding in a spiking neural network model of the primate ventral visual system","author":"Eguchi","year":"2018","journal-title":"Psychological Review"},{"key":"10.1016\/j.neunet.2022.07.003_b25","unstructured":"Elsayed,\u00a0G. F., Papernot,\u00a0N., Shankar,\u00a0S., Kurakin,\u00a0A., Cheung,\u00a0B., Goodfellow,\u00a0I., & Sohl-Dickstein,\u00a0J. (2018). Adversarial examples that fool both computer vision and time-limited humans. In Advances in neural information processing systems, Vol. 2018-December."},{"key":"10.1016\/j.neunet.2022.07.003_b26","unstructured":"Ford,\u00a0N., Gilmer,\u00a0J., Carlini,\u00a0N., & Cubuk,\u00a0E. D. (2019). Adversarial examples are a natural consequence of test error in noise. In 36th international conference on machine learning, Vol. 2019-June."},{"key":"10.1016\/j.neunet.2022.07.003_b27","series-title":"The relationship between high-dimensional geometry and adversarial examples","author":"Gilmer","year":"2018"},{"key":"10.1016\/j.neunet.2022.07.003_b28","series-title":"Deep learning","author":"Goodfellow","year":"2016"},{"key":"10.1016\/j.neunet.2022.07.003_b29","unstructured":"Goodfellow,\u00a0I., Schlens,\u00a0J., & Szegedy,\u00a0C. (2015). Explaining and Harnessing Adversarial Examples. In International conference on learning representations."},{"key":"10.1016\/j.neunet.2022.07.003_b30","unstructured":"Gowal,\u00a0S., Huang,\u00a0P.-S., van\u00a0den Oord,\u00a0A., Mann,\u00a0T., & Kohli,\u00a0P. (2021). Self-Supervised Adversarial Robustness for the Low-Label, High-Data Regime. In International conference on learning representations."},{"key":"10.1016\/j.neunet.2022.07.003_b31","series-title":"Uncovering the limits of adversarial training against norm-bounded adversarial examples","author":"Gowal","year":"2020"},{"key":"10.1016\/j.neunet.2022.07.003_b32","doi-asserted-by":"crossref","first-page":"31","DOI":"10.1016\/S0896-6273(00)80820-X","article-title":"The temporal correlation hypothsis of visual feature integration: Still alive and well","volume":"24","author":"Gray","year":"1999","journal-title":"Neuron"},{"key":"10.1016\/j.neunet.2022.07.003_b33","series-title":"4th international conference on learning representations","article-title":"Binding via reconstruction clustering","author":"Greff","year":"2016"},{"key":"10.1016\/j.neunet.2022.07.003_b34","series-title":"Proceedings of the IEEE computer society conference on computer vision and pattern recognition, Vol. 2016-December","first-page":"770","article-title":"Deep residual learning for image recognition","author":"He","year":"2016"},{"key":"10.1016\/j.neunet.2022.07.003_b35","series-title":"Proceedings of the IEEE computer society conference on computer vision and pattern recognition, Vol. 2019-June","article-title":"Why relu networks yield high-confidence predictions far away from the training data and how to mitigate the problem","author":"Hein","year":"2019"},{"key":"10.1016\/j.neunet.2022.07.003_b36","series-title":"Proceedings of the 37th international conference on machine learning","article-title":"Data-efficient image recognition with contrastive predictive coding","author":"H\u00e9naff","year":"2020"},{"issue":"1","key":"10.1016\/j.neunet.2022.07.003_b37","doi-asserted-by":"crossref","DOI":"10.1038\/s41467-021-26751-5","article-title":"Unsupervised deep learning identifies semantic disentanglement in single inferotemporal face patch neurons","volume":"12","author":"Higgins","year":"2021","journal-title":"Nature Communications"},{"key":"10.1016\/j.neunet.2022.07.003_b38","unstructured":"Hinton,\u00a0G., Sabour,\u00a0S., & Frosst,\u00a0N. (2018). Matrix capsules with EM routing. In 6th international conference on learning representations."},{"issue":"5","key":"10.1016\/j.neunet.2022.07.003_b39","doi-asserted-by":"crossref","DOI":"10.1016\/S0896-6273(02)01091-7","article-title":"View from the top: Hierarchies and reverse hierarchies in the visual system","volume":"36","author":"Hochstein","year":"2002","journal-title":"Neuron"},{"key":"10.1016\/j.neunet.2022.07.003_b40","unstructured":"Huang,\u00a0Y., Gornet,\u00a0J., Dai,\u00a0S., Yu,\u00a0Z., Nguyen,\u00a0T., Tsao,\u00a0D., & Anandkumar,\u00a0A. (2020). Neural Networks with Recurrent Generative Feedback. In 34th conference on neural information processing systems."},{"key":"10.1016\/j.neunet.2022.07.003_b41","series-title":"Proceedings - 30th IEEE conference on computer vision and pattern recognition","article-title":"Densely connected convolutional networks","author":"Huang","year":"2017"},{"key":"10.1016\/j.neunet.2022.07.003_b42","series-title":"Neural information processing systems","article-title":"Adversarial examples are not bugs, they are features","author":"Ilyas","year":"2019"},{"key":"10.1016\/j.neunet.2022.07.003_b43","doi-asserted-by":"crossref","DOI":"10.1098\/rsfs.2018.0021","article-title":"A new approach to solving the feature binding problem in primate vision","volume":"8","author":"Isbister","year":"2018","journal-title":"Interface Focus"},{"key":"10.1016\/j.neunet.2022.07.003_b44","unstructured":"Jacobsen,\u00a0J. H., Smeulders,\u00a0A., & Oyallon,\u00a0E. (2018). I-RevNet: Deep invertible networks. In 6th international conference on learning representations."},{"key":"10.1016\/j.neunet.2022.07.003_b45","series-title":"The robust manifold defense: Adversarial training using generative models","author":"Jalal","year":"2017"},{"key":"10.1016\/j.neunet.2022.07.003_b46","unstructured":"Jang,\u00a0U., Jah,\u00a0S., & Jah,\u00a0S. (2020). On the Need for Topology-Aware Generative Models for Manifold-Based Defenses. In International conference on learning representations."},{"key":"10.1016\/j.neunet.2022.07.003_b47","series-title":"On the geometry of adversarial examples","author":"Khoury","year":"2018"},{"issue":"10","key":"10.1016\/j.neunet.2022.07.003_b48","doi-asserted-by":"crossref","DOI":"10.1167\/9.10.8","article-title":"Globally inconsistent figure\/ground relations induced by a negative part","volume":"9","author":"Kim","year":"2009","journal-title":"Journal of Vision"},{"key":"10.1016\/j.neunet.2022.07.003_b49","unstructured":"Kingma,\u00a0D. P., & Ba,\u00a0J. L. (2015). Adam: A method for stochastic optimization. In 3rd international conference on learning representations."},{"key":"10.1016\/j.neunet.2022.07.003_b50","series-title":"Learning Multiple Layers of Features from Tiny Images","author":"Krizhevsky","year":"2009"},{"key":"10.1016\/j.neunet.2022.07.003_b51","series-title":"Advances in neural information processing systems, Vol. 32","article-title":"Brain-like object recognition with high-performing shallow recurrent ANNs","author":"Kubilius","year":"2019"},{"key":"10.1016\/j.neunet.2022.07.003_b52","doi-asserted-by":"crossref","unstructured":"Kurakin,\u00a0A., Goodfellow,\u00a0I. J., & Bengio,\u00a0S. (2019). Adversarial examples in the physical world. In 5th international conference on learning representations.","DOI":"10.1201\/9781351251389-8"},{"key":"10.1016\/j.neunet.2022.07.003_b53","unstructured":"Laidlaw,\u00a0C., Singla,\u00a0S., & Feizi,\u00a0S. (2021). Perceptual Adversarial Robustness: Defense Against Unseen Threat Models. In International conference on learning representations."},{"key":"10.1016\/j.neunet.2022.07.003_b54","doi-asserted-by":"crossref","DOI":"10.1038\/nature14539","article-title":"Deep learning","author":"Lecun","year":"2015","journal-title":"Nature"},{"key":"10.1016\/j.neunet.2022.07.003_b55","doi-asserted-by":"crossref","unstructured":"Lecun,\u00a0Y., Bottou,\u00a0L., Bengio,\u00a0Y., & Haffner,\u00a0P. (1998). Gradient-based learning applied to document recognition. In Proceedings of the IEEE (November), (pp. 1\u201346). http:\/\/dx.doi.org\/10.1109\/5.726791.","DOI":"10.1109\/5.726791"},{"key":"10.1016\/j.neunet.2022.07.003_b56","article-title":"Gradient masking of label smoothing in adversarial robustness","volume":"9","author":"Lee","year":"2021","journal-title":"IEEE Access"},{"key":"10.1016\/j.neunet.2022.07.003_b57","unstructured":"Li,\u00a0Z., Brendel,\u00a0W., Walker,\u00a0E. Y., Cobos,\u00a0E., Muhammad,\u00a0T., Reimer,\u00a0J., Bethge,\u00a0M., Sinz,\u00a0F. H., Pitkow,\u00a0X., & Tolias,\u00a0A. S. (2019). Learning from brains how to regularize machines. In Advances in neural information processing systems, Vol. 32."},{"key":"10.1016\/j.neunet.2022.07.003_b58","series-title":"34th conference on neural information processing systems","article-title":"Object-centric learning with slot attention","author":"Locatello","year":"2020"},{"issue":"2","key":"10.1016\/j.neunet.2022.07.003_b59","doi-asserted-by":"crossref","DOI":"10.1016\/j.neuron.2018.03.009","article-title":"Revealing detail along the visual hierarchy: Neural clustering preserves acuity from V1 to V4","volume":"98","author":"Lu","year":"2018","journal-title":"Neuron"},{"key":"10.1016\/j.neunet.2022.07.003_b60","unstructured":"Lukasik,\u00a0M., Bhojanapalli,\u00a0S., Menon,\u00a0A., & Kumar,\u00a0S. (2020). Does label smoothing mitigate label noise?. In Proceedings of the 37th international conference on machine learning."},{"key":"10.1016\/j.neunet.2022.07.003_b61","unstructured":"Madry,\u00a0A., Makelov,\u00a0A., Schmidt,\u00a0L., Tsipras,\u00a0D., & Vladu,\u00a0A. (2018). Towards deep learning models resistant to adversarial attacks. In 6th international conference on learning representations."},{"key":"10.1016\/j.neunet.2022.07.003_b62","series-title":"Vision: A Computational Investigation Into the Human Representation and Processing of Visual Information","author":"Marr","year":"1982"},{"key":"10.1016\/j.neunet.2022.07.003_b63","series-title":"Proceedings of the IEEE computer society conference on computer vision and pattern recognition","article-title":"DeepFool: A simple and accurate method to fool deep neural networks","author":"Moosavi-Dezfooli","year":"2016"},{"key":"10.1016\/j.neunet.2022.07.003_b64","unstructured":"Mu,\u00a0N., & Gilmer,\u00a0J. (2019). MNIST-C: A Robustness Benchmark for Computer Vision. In ICML 2019 workshop on uncertainty and ro- bustness in deep learning."},{"key":"10.1016\/j.neunet.2022.07.003_b65","unstructured":"Nair,\u00a0V., & Hinton,\u00a0G. E. (2010). Rectified linear units improve Restricted Boltzmann machines. In ICML 2010 - proceedings, 27th international conference on machine learning."},{"key":"10.1016\/j.neunet.2022.07.003_b66","unstructured":"Nassar,\u00a0J., Sokol,\u00a0P., Chung,\u00a0S., Harris,\u00a0K., & Park,\u00a0I. (2020). On 1\/n neural representation and robustness. In 34th conference on neural information processing systems."},{"key":"10.1016\/j.neunet.2022.07.003_b67","series-title":"Proceedings, twenty-first international conference on machine learning","article-title":"Feature selection, L1 vs. L2 regularization, and rotational invariance","author":"Ng","year":"2004"},{"key":"10.1016\/j.neunet.2022.07.003_b68","series-title":"ICLR","article-title":"Bag of tricks for adversarial training","author":"Pang","year":"2021"},{"key":"10.1016\/j.neunet.2022.07.003_b69","series-title":"Transferability in machine learning: from phenomena to black-box attacks using adversarial samples","author":"Papernot","year":"2016"},{"key":"10.1016\/j.neunet.2022.07.003_b70","series-title":"Proceedings of the 2017 ACM on asia conference on computer and communications security","article-title":"Practical black-box attacks against machine learning","author":"Papernot","year":"2017"},{"key":"10.1016\/j.neunet.2022.07.003_b71","unstructured":"Pereyra,\u00a0G., Tucker,\u00a0G., Chorowski,\u00a0J., Kaiser,\u00a0L., & Hinton,\u00a0G. (2019). Regularizing neural networks by penalizing confident output distributions. In 5th international conference on learning representations."},{"key":"10.1016\/j.neunet.2022.07.003_b72","unstructured":"Rauber,\u00a0J., Brendel,\u00a0W., & Bethge,\u00a0M. (2017). Foolbox: A Python toolbox to benchmark the robustness of machine learning models. In Reliable machine learning in the wild workshop, 34th international conference on machine learning. URL."},{"key":"10.1016\/j.neunet.2022.07.003_b73","series-title":"2nd international conference on learning representations","article-title":"Neuronal synchrony in complex-valued deep networks","author":"Reichert","year":"2014"},{"key":"10.1016\/j.neunet.2022.07.003_b74","series-title":"Lecture notes in computer science (including subseries lecture notes in artificial intelligence and lecture notes in bioinformatics)","article-title":"U-net: Convolutional networks for biomedical image segmentation","author":"Ronneberger","year":"2015"},{"key":"10.1016\/j.neunet.2022.07.003_b75","series-title":"Proceedings of the IEEE computer society conference on computer vision and pattern recognition, Vol. 2019-June","article-title":"Decoupling direction and norm for efficient gradient-based l2 adversarial attacks and defenses","author":"Rony","year":"2019"},{"key":"10.1016\/j.neunet.2022.07.003_b76","doi-asserted-by":"crossref","unstructured":"Rusak,\u00a0E., Schott,\u00a0L., Zimmermann,\u00a0R. S., Bitterwolf,\u00a0J., Bringmann,\u00a0O., Bethge,\u00a0M., & Brendel,\u00a0W. (2020). A Simple Way to Make Neural Networks Robust Against Diverse Image Corruptions. In Lecture notes in computer science, Vol. 12348 LNCS.","DOI":"10.1007\/978-3-030-58580-8_4"},{"issue":"3","key":"10.1016\/j.neunet.2022.07.003_b77","doi-asserted-by":"crossref","DOI":"10.1007\/s11263-015-0816-y","article-title":"ImageNet large scale visual recognition challenge","volume":"115","author":"Russakovsky","year":"2015","journal-title":"International Journal of Computer Vision"},{"key":"10.1016\/j.neunet.2022.07.003_b78","unstructured":"Sabour,\u00a0S., Frosst,\u00a0N., & Hinton,\u00a0G. E. (2017). Dynamic routing between capsules. In Advances in neural information processing systems."},{"key":"10.1016\/j.neunet.2022.07.003_b79","unstructured":"Samangouei,\u00a0P., Kabkab,\u00a0M., & Chellappa,\u00a0R. (2018). Defense-Gan: Protecting classifiers against adversarial attacks using generative models. In 6th international conference on learning representations."},{"key":"10.1016\/j.neunet.2022.07.003_b80","series-title":"Enhancing the transformer with explicit relational encoding for math problem solving","author":"Schlag","year":"2019"},{"key":"10.1016\/j.neunet.2022.07.003_b81","unstructured":"Schott,\u00a0L., Rauber,\u00a0J., Bethge,\u00a0M., & Brendel,\u00a0W. (2019). Towards the first adversarially robust neural network model on MNIST. In 7th international conference on learning representations."},{"key":"10.1016\/j.neunet.2022.07.003_b82","series-title":"Label smoothing and logit squeezing: A replacement for adversarial training?","author":"Shafahi","year":"2019"},{"key":"10.1016\/j.neunet.2022.07.003_b83","unstructured":"Simonyan,\u00a0K., Vedaldi,\u00a0A., & Zisserman,\u00a0A. (2014). Deep inside convolutional networks: Visualising image classification models and saliency maps. In 2nd international conference on learning representations."},{"key":"10.1016\/j.neunet.2022.07.003_b84","unstructured":"Simonyan,\u00a0K., & Zisserman,\u00a0A. (2015). Very deep convolutional networks for large-scale image recognition. In 3rd international conference on learning representations."},{"key":"10.1016\/j.neunet.2022.07.003_b85","unstructured":"Singh,\u00a0C., Yu,\u00a0B., & James\u00a0Murdoch,\u00a0W. (2019). Hierarchical interpretations for neural network predictions. In 7th international conference on learning representations."},{"key":"10.1016\/j.neunet.2022.07.003_b86","unstructured":"Song,\u00a0Y., Nowozin,\u00a0S., Kushman,\u00a0N., Kim,\u00a0T., & Ermon,\u00a0S. (2018). PixelDefend: Leveraging generative models to understand and defend against adversarial examples. In 6th international conference on learning representations."},{"key":"10.1016\/j.neunet.2022.07.003_b87","series-title":"Advances in neural information processing systems","article-title":"Training very deep networks","author":"Srivastava","year":"2015"},{"key":"10.1016\/j.neunet.2022.07.003_b88","article-title":"Dropout: A simple way to prevent neural networks from overfitting","volume":"15","author":"Srivastava","year":"2014","journal-title":"Journal of Machine Learning Research"},{"key":"10.1016\/j.neunet.2022.07.003_b89","series-title":"Advances in neural information processing systems, Vol. 32","article-title":"Untangling in invariant speech recognition","author":"Stephenson","year":"2019"},{"issue":"7765","key":"10.1016\/j.neunet.2022.07.003_b90","doi-asserted-by":"crossref","DOI":"10.1038\/s41586-019-1346-5","article-title":"High-dimensional geometry of population responses in visual cortex","volume":"571","author":"Stringer","year":"2019","journal-title":"Nature"},{"key":"10.1016\/j.neunet.2022.07.003_b91","series-title":"Proceedings of the IEEE computer society conference on computer vision and pattern recognition","article-title":"Disentangling adversarial robustness and generalization","author":"Stutz","year":"2019"},{"key":"10.1016\/j.neunet.2022.07.003_b92","series-title":"Improved adversarial robustness via logit regularization methods","author":"Summers","year":"2019"},{"key":"10.1016\/j.neunet.2022.07.003_b93","series-title":"Proceedings of the IEEE computer society conference on computer vision and pattern recognition, Vol. 2016-December","article-title":"Rethinking the inception architecture for computer vision","author":"Szegedy","year":"2016"},{"key":"10.1016\/j.neunet.2022.07.003_b94","unstructured":"Szegedy,\u00a0C., Zaremba,\u00a0W., Sutskever,\u00a0I., Bruna,\u00a0J., Erhan,\u00a0D., Goodfellow,\u00a0I., & Fergus,\u00a0R. (2014). Intriguing properties of neural networks. In 2nd international conference on learning representations."},{"key":"10.1016\/j.neunet.2022.07.003_b95","series-title":"ICLR","article-title":"Biologically inspired sleep algorithm for increased generalization and adversarial robustnes in deep neural networks","author":"Tadros","year":"2020"},{"key":"10.1016\/j.neunet.2022.07.003_b96","series-title":"A boundary tilting persepective on the phenomenon of adversarial examples","author":"Tanay","year":"2016"},{"key":"10.1016\/j.neunet.2022.07.003_b97","unstructured":"Tram\u00e8r,\u00a0F., Behrmann,\u00a0J., Carlini,\u00a0N., Papernot,\u00a0N., & Jacobsen,\u00a0J. H. (2020). Fundamental Tradeoffs between Invariance and Sensitivity to Adversarial Perturbations. In 37th international conference on machine learning, Vol. PartF168147-13."},{"key":"10.1016\/j.neunet.2022.07.003_b98","series-title":"Advances in neural information processing systems, Vol. 32","article-title":"Adversarial training and robustness for multiple perturbations","author":"Tram\u00e8r","year":"2019"},{"key":"10.1016\/j.neunet.2022.07.003_b99","series-title":"On adaptive attacks to adversarial example defenses","author":"Tram\u00e8r","year":"2020"},{"key":"10.1016\/j.neunet.2022.07.003_b100","series-title":"The space of transferable adversarial examples","author":"Tram\u00e8r","year":"2017"},{"issue":"2","key":"10.1016\/j.neunet.2022.07.003_b101","doi-asserted-by":"crossref","DOI":"10.1016\/S0959-4388(96)80070-5","article-title":"The binding problem","volume":"6","author":"Treisman","year":"1996","journal-title":"Current Opinion in Neurobiology"},{"key":"10.1016\/j.neunet.2022.07.003_b102","article-title":"Feature binding, attention and object perception","author":"Treisman","year":"1998","journal-title":"Philosophical Transactions of the Royal Society, Series B (Biological Sciences)"},{"key":"10.1016\/j.neunet.2022.07.003_b103","series-title":"ICLR","article-title":"Robustness may be at odds with accuracy","author":"Tsipras","year":"2019"},{"key":"10.1016\/j.neunet.2022.07.003_b104","series-title":"Advances in neural information processing systems, Vol. 32","article-title":"Are disentangled representations helpful for abstract visual reasoning?","author":"van Steenkiste","year":"2019"},{"issue":"1","key":"10.1016\/j.neunet.2022.07.003_b105","doi-asserted-by":"crossref","first-page":"95","DOI":"10.1016\/S0896-6273(00)80825-9","article-title":"The what and why of binding: The modeler\u2019s perspective","volume":"24","author":"Von Der Malsburg","year":"1999","journal-title":"Neuron"},{"key":"10.1016\/j.neunet.2022.07.003_b106","unstructured":"Vuyyuru,\u00a0M., Banburski,\u00a0A., Pant,\u00a0N., & Poggio,\u00a0T. (2020). Biologically Inspired Mechanisms for Adversarial Robustness. In 34th conference on neural information processing systems."},{"key":"10.1016\/j.neunet.2022.07.003_b107","doi-asserted-by":"crossref","DOI":"10.7554\/eLife.42512","article-title":"Image content is more important than bouma\u2019s law for scene metamers","volume":"8","author":"Wallis","year":"2019","journal-title":"ELife"},{"key":"10.1016\/j.neunet.2022.07.003_b108","series-title":"Perturbations, optimization, and statistics","first-page":"311","article-title":"11 Adversarial perturbations of deep neural networks","author":"Warde-Farley","year":"2016"},{"key":"10.1016\/j.neunet.2022.07.003_b109","doi-asserted-by":"crossref","DOI":"10.1016\/j.cell.2020.10.024","article-title":"The Tolman-Eichenbaum machine: Unifying space and relational memory through generalization in the hippocampal formation","volume":"183","author":"Whittington","year":"2020","journal-title":"Cell"},{"key":"10.1016\/j.neunet.2022.07.003_b110","series-title":"Fashion-MNIST: a novel image dataset for benchmarking machine learning algorithms","author":"Xiao","year":"2017"},{"key":"10.1016\/j.neunet.2022.07.003_b111","unstructured":"Xiao,\u00a0C., Zhong,\u00a0P., & Zheng,\u00a0C. (2020). Enhancing Adversarial Defense by k-Winners-Take-All. In International conference on learning representations 2020."},{"key":"10.1016\/j.neunet.2022.07.003_b112","doi-asserted-by":"crossref","DOI":"10.1016\/j.patrec.2017.08.007","article-title":"UP-CNN: Un-pooling augmented convolutional neural network","author":"Xu","year":"2019","journal-title":"Pattern Recognition Letters"},{"key":"10.1016\/j.neunet.2022.07.003_b113","doi-asserted-by":"crossref","DOI":"10.1109\/TNNLS.2018.2886017","article-title":"Adversarial examples: Attacks and defenses for deep learning","author":"Yuan","year":"2019","journal-title":"IEEE Transactions on Neural Networks and Learning Systems"},{"key":"10.1016\/j.neunet.2022.07.003_b114","series-title":"British machine vision conference 2016, Vol. 2016-September","article-title":"Wide residual networks","author":"Zagoruyko","year":"2016"},{"key":"10.1016\/j.neunet.2022.07.003_b115","series-title":"AISec 2017 - proceedings of the 10th ACM workshop on artificial intelligence and security","article-title":"Efficient defenses against adversarial atacks","author":"Zantedeschi","year":"2017"},{"key":"10.1016\/j.neunet.2022.07.003_b116","series-title":"Lecture notes in computer science (including subseries lecture notes in artificial intelligence and lecture notes in bioinformatics)","article-title":"Visualizing and understanding convolutional networks","author":"Zeiler","year":"2014"},{"issue":"1","key":"10.1016\/j.neunet.2022.07.003_b117","article-title":"Humans can decipher adversarial images","volume":"10","author":"Zhou","year":"2019","journal-title":"Nature Communications"},{"issue":"17","key":"10.1016\/j.neunet.2022.07.003_b118","doi-asserted-by":"crossref","first-page":"6594","DOI":"10.1523\/JNEUROSCI.20-17-06594.2000","article-title":"Coding of border ownership in monkey visual cortex","volume":"20","author":"Zhou","year":"2000","journal-title":"The Journal of Neuroscience"}],"container-title":["Neural Networks"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0893608022002593?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0893608022002593?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2025,10,12]],"date-time":"2025-10-12T02:00:34Z","timestamp":1760234434000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S0893608022002593"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,11]]},"references-count":118,"alternative-id":["S0893608022002593"],"URL":"https:\/\/doi.org\/10.1016\/j.neunet.2022.07.003","relation":{},"ISSN":["0893-6080"],"issn-type":[{"value":"0893-6080","type":"print"}],"subject":[],"published":{"date-parts":[[2022,11]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"Hierarchical binding in convolutional neural networks: Making adversarial attacks geometrically challenging","name":"articletitle","label":"Article Title"},{"value":"Neural Networks","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.neunet.2022.07.003","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2022 The Author(s). Published by Elsevier Ltd.","name":"copyright","label":"Copyright"}]}}