Adversarial robustness does not entail human-aligned categorization

Adversarial robustness does not entail human-aligned categorization

The paper by Itay Reznik, Raz Lapid, Moshe Sipper and Tal Golan argues that adversarial robustness alone does not guarantee that image classifiers categorize images as people do. The authors tested four adversarially robust ImageNet classifiers against category choices from 60 participants, using controversial stimuli designed to make robust classifiers disagree. On one set of stimuli, the models predicted individual participants’ choices at near-chance accuracy, while other participants’ majority judgments predicted them much more accurately. On stimuli designed around other model pairs, all four classifiers predicted human responses above chance, but less accurately than other participants’ judgments. The authors report a similar pattern for 17 additional RobustBench models: model-participant agreement was lower than participant-participant agreement on the same images. The distinction matters because performance on adversarial robustness does not, in these experiments, amount to matching human categorization. The authors therefore argue that robustness and human alignment should be evaluated as distinct properties of visual recognition systems. Their results concern the stimuli, models and participant judgments tested; the abstract does not establish how the findings extend to other images or settings. An open question is whether this model-human mismatch persists beyond AI

Publication: 72b5cf28-a697-485e-875a-99c092c9ebb3

attribution — pass: The reading correctly attributes the paper to Itay Reznik, Raz Lapid, Moshe Sipper and Tal Golan. It keeps the central conclusion framed as the authors' argument rather than as established fact or EM opinion.

Authors:Itay Reznik, Raz Lapid, Moshe Sipper, Tal Golan

summary — uncertain: The final summary sentence is cut off: 'persists beyond AI'. It reads as garbled. Smallest repair: complete it to match the question, e.g. 'beyond the controversial stimuli and models tested'. The central terms 'adversarial robustness', 'controversial stimuli', 'ImageNet', 'RobustBench' and 'near chance' are never explained. A non-specialist cannot tell what robustness means or why it might be expected to produce human-like judgments. Add brief plain-language glosses or term-library tooltips for these. 'On one set of stimuli' is also vague; the source specifies stimuli optimized to elicit disagreement with another model.

We generated 1,008 controversial stimuli by optimizing latent inputs to a pretrained GAN to elicit high-confidence disagreements between pairs of robust ImageNet classifiers.

date — pass: The original publication date, 2026-10-31, matches the arXiv v1 submission date. It is not the later feed date of 2026-11-03.

[Submitted on 31 Oct 2026]

support — pass: All claims and their excerpts match the abstract. The significance statement is limited to these experiments, and the limitations correctly note that only the abstract is available and that generalization is not established. Minor omission: the abstract also reports weak positive model-human correspondence for the two convolutional models. Mentioning it would preserve nuance, but its absence does not contradict the source.

An analysis incorporating model prediction strength and participants' reported confidence found weak positive model-human correspondence for the two convolutional models.

media — pass: The selected media is the verified direct arXiv abstract page for this paper. It is the most direct access to the source.