Supplementary Material for Biologically Inspired Mechanisms for Adversarial Robustness

Results from these preliminary experiments were not reported in the paper but we report the results here in the supplementary materials. The standard bounding boxes were used as provided with the ImageNet dataset. If images had 0 bounding boxes, they were discarded for this dataset. See Section 2 in the main paper and consult Bashivan et al. (2019) for full details on the sampling procedure and chosen parameters. Code from Bashivan et al. (2019) was open-sourced at Biological measurements (Gattass et al. (1981, 1988)) have demonstrated that in primates, the As described in the paper, we employed two baseline models ('ResNet' and'coarse fixations') and two The'ResNet' baseline model directly feeds the full image through a standard ResNet architecture (32x32 for CIFAR10 or 320x320 for ImageNet).