Supplementary Material A Neural Explained Variance We evaluated how well responses to given images in candidate CNNs explain responses of single V1

However, when using a CNN to model the ventral stream, the visual spatial extent of the model's input is of key importance to ensure that it is correctly mapped to the data it is trying to We set the high attack strength at 4 times the low value, which brought standard ImageNet trained CNNs to nearly chance performance. Still, even this higher perturbation strength remained practically imperceptible (Fig. B.3 left). The Adversarial Robustness Toolkit [96] was used for computing the attacks. VOneResNet50 improves robustness to white box attacks in a wide range of perturbation strengths. Adding the VOneBlock to ResNet50 consistently improves robustness under all constraints and attack strength--VOneResNet50 V alues are mean and SD (n=3 seeds).White box PGD-L Further attack optimization does not overturn results.