Source-linked AI summary
Natural Jammers: When Non-Robust Features Become Antagonistic
Jiaming Zhang, Fuyao Zhang, Pengjun Xie, Wei Yang Bryan Lim
TL;DR
Prior accounts largely treat non-robust features as shortcuts that help standard models, leaving open whether such cues can instead mislead them on clean images. The paper analyzes standard–robust model disagreement and controlled spectral and geometric perturbations, finding both clean-image jamming and a stable aggregate prevalence that is redistributed under small transformations.
Problem
Prior work largely treats non-robust features as opportunistic shortcuts that help standard models, while the paper asks whether they can instead antagonize predictions on natural images.
Source: §1 · p. 1Method
The authors use disagreement between standard and robust models to identify the Jammed Set and test spectral–spatial locking through filtering, geometric perturbations, and frequency grafting.
Source: §1 · p. 1, §6 · p. 10Results
A 2% edge crop removes about one third of Jammed Set images, yet total jamming prevalence remains nearly unchanged as membership is redistributed.
Source: §1 · p. 2, §6 · p. 10Takeaways & Limitations
Small semantics-preserving transformations reshuffle jammed membership without reducing its overall rate, so natural non-robustness is redistributed rather than eliminated.
Source: §6 · p. 10The ViT–CNN comparison cannot separate architecture effects from training-recipe differences because the lenses differ in both.
Source: §4.2 · p. 8
Abstract
from arXiv · showhide
Deep neural networks are known to rely on non-robust features that align poorly with human perception. Prior work has largely framed these features as opportunistic shortcuts that help standard models on clean data. We show instead that non-robust cues can be antagonistic: they can act as Natural Jammers that actively mislead standard models on clean, unmodified images. Using disagreement between a standard model and robust models as an analysis lens, we identify a Jammed Set on which robust models outperform standard models. We provide causal evidence for Spectral-spatial Locking: jamming arises only when high-frequency components are precisely aligned with specific spatial structures. Disrupting this lock through spectral filtering or small geometric shifts can restore correct predictions. Crucially, we uncover a Substitution Paradox: while individual jammers are fragile to geometric shifts, the aggregate prevalence of jamming remains approximately stable and is redistributed rather than eliminated under such transformations. Our results reframe natural non-robustness as a failure field over the empirical model-data geometry: one that redistributes rather than disappears under small transformations.
1 Introduction
The paper challenges the view that non-robust cues only help standard models as shortcuts, showing that they can instead mislead standard predictions on clean images. It links this jamming to precise spectral–spatial alignment and argues that small transformations redistribute, rather than eliminate, aggregate vulnerability.
1 Introduction
- Prior work frames non-robust features as opportunistic shortcuts that help standard models reach correct decisions [Geirhos et al. [2020], Kauffmann et al. [2025], Eriksson et al. [2025]].The paper instead names antagonistic non-robust signals Natural Jammers.Source: §1 · p. 1
- On the Jammed Set, robustly trained models significantly outperform standard models on unmodified images because brittle cues can contradict the label.The paper uses robust models as a diagnostic lens for separating robust semantic cues from non-robust correlations.Source: §1 · p. 1, Figure 1 · p. 2
- Natural jamming depends on high-frequency patterns being precisely aligned with specific spatial configurations, a mechanism the authors call Spectral-Spatial Locking.The paper reports causal evidence for the mechanism through controlled experiments.Source: §1 · pp. 1–2
- Spectral filtering or minor geometric shifts can break the lock, render a jammer inert, and allow the model’s discriminative capacity to resurface.The paper names these effects the Cleansing Paradox and Sensitivity Inversion, respectively.Source: §1 · p. 2
- A 2% edge crop removes about one third of Jammed Set images, yet its total size remains nearly unchanged as jamming is redistributed.The paper describes this stable aggregate prevalence alongside the fragility of individual jammers as the Substitution Paradox.Source: §1 · p. 2
2 Landscape of Natural Non-Robustness
The paper models natural non-robustness through robust and non-robust latent subspaces and a four-set partition of clean-image predictions. Across evaluated architectures, the Jammed Set consistently accounts for a significant portion of the error manifold.
2.2 Empirical Prevalence and Stability
- J accounts for 4.3%–5.0% across architectures and consistently represents a significant portion of the error manifold.The table reports feature-pathology distributions on ImageNet under ε = 1.0 constraints.Source: Table 1 · p. 3, §2.2 · p. 4
2 Landscape of Natural Non-Robustness
- The taxonomy assumes a latent representation decomposable into robust and non-robust subspaces, whose interaction can yield shortcuts or predictive failures.The analysis compares a standard classifier with an adversarially trained counterpart.Source: §2 · pp. 2–3
2.1 Formal Taxonomy: The Quad-Set Partition
- The partition distinguishes C, where both models are correct; S, where only the standard model is correct; J, where only the robust model is correct; and G, where neither is correct.The sets are defined using predictions on the original clean input.Source: §2.1 · p. 3
- Natural Jammers are non-robust signals whose predictive direction contradicts the semantic label, distinguishing J from the shortcut behavior represented by S.The paper frames J as antagonistic interaction between non-robust features and ground-truth logic.Source: §2.1 · p. 3
3 Spectral-Spatial Locking: The Core Evidence
The paper tests how spectral content and spatial structure jointly shape non-robust cues, using filtering, geometric transformations, and frequency grafting. The results support a fragile, host-dependent lock between high-frequency patterns and spatial configuration.
3.1 The Cleansing Paradox: Spectral Sensitivity
- At r = 30, S accuracy falls from 100.0% to 23.7%; at r = 50, J rises from 0.0% to 31.8% and C falls from 100.0% to 85.1%.The low-pass filtering results show opposite effects on S and J, while C degrades more gradually.Source: §3.1 · pp. 4–5
3.3 Frequency Grafting: A Causality Test
- Transplanted Jammed-image high frequencies show 0.17% transferred toxicity, versus 99.9% retention when reassembled with their own spectral components.Removing high frequencies from native jammed inputs yields a 31.8 percentage-point recovery, while transfer to a foreign host has little predictive influence.Source: Table 2 · p. 5, §3.3 · pp. 5–6
3.2 The Sensitivity Inversion: Spatial Localization
- Zooming increases J accuracy and decreases S accuracy, while C declines from 100% to 79.9%.The pattern is consistent with interfering cues near image boundaries or in object context; recovery also appears across six interpolation kernels and with a painted border.Source: §3.2 · p. 5
3.4 Formal Definition: Spectral–Spatial Locking
- Spectral–Spatial Locking requires spectral sensitivity, spatial fragility under semantics-preserving transformations, and failure to transfer across distinct samples.The definition characterizes a signal’s contribution as jointly dependent on its frequency support and spatial configuration.Source: §3.4 · p. 6
4 Substitution Paradox: Systemic Redistribution of Natural Non-Robustness
Using disagreement between standard models and robust-model analysis lenses, the section finds that jamming is prevalent but its image identities depend on the model and robustness recipe. Small geometric changes redistribute jammed identities while leaving their overall prevalence approximately stable.
4 Substitution Paradox: Systemic Redistribution of Natural Non-Robustness
- Robust models serve as analysis lenses for disagreement-based partitions, not as ground-truth oracles.The section tests whether conclusions persist across multiple robust lenses spanning architectures and robustness recipes.Source: §4 · p. 6
4.1 Prevalence Across Architectures
- The Jammed Set occupies a few percent of ImageNet validation, while the Spurious Set occupies roughly 7–20%, depending on ϵ.Across the evaluated architectures and robustness recipes, |J| is relatively stable compared with |S|.Source: §4.1 · p. 7, Table 3 · p. 7
4.2 Model-Specific Vulnerabilities
- Jammed-set agreement is moderate within architectures (IoU ≈0.40–0.47) and typically below 0.15 across architectures.The cross-architecture agreement can be even smaller between CNNs and ViTs, indicating that jammed identity depends on model inductive bias and robustness recipe.Source: §4.2 · p. 7, Figure 3 · p. 8
- On the Jammed Set, standard models are typically more confident than robust models across CNNs, while ViTs show a reversal.The comparison cannot separate architecture from training recipe because the ViT and CNN lenses differ in both.Source: §4.2 · pp. 7–8, Table 4 · p. 8
4.3 The Substitution Paradox
- The transformation analysis evaluates both the standard model and robust lens on transformed inputs to define the transformed Jammed Set.The experiments use small semantics-preserving geometric changes, including edge crops of up to 8%.Source: §4.3 · pp. 8–9
- A 2% crop yields IoU(J, JT) = 0.46, with about one third of original jammed images replaced by new ones.Across crop ratios, |JT| remains approximately 2.2k and |ST| approximately 5.1k; the 2% re-run moves 738 of 2,140 jammers out and brings 873 new images in.Source: Table 5 · p. 9, §4.3 · p. 9
- Across small semantics-preserving geometric transformations, jammed and spurious identities change substantially while their set sizes remain approximately unchanged.The authors characterize this as redistribution rather than elimination of non-robust vulnerability.Source: §4.3 · p. 9
5 Related Work
Prior work has framed non-robust features as useful shortcuts and has debated how their role depends on learning paradigms, but has largely studied them under intentional adversarial perturbations. This paper examines clean natural images and connects spectral and geometric sensitivities through Spectral–spatial Locking and the redistribution of failures.
5.1 Adversarial Robustness and Non-robust Features
- Prior accounts treat non-robust features as useful shortcuts for standard classification, while later work disputes how broadly that usefulness extends across learning paradigms.Kim et al. [2021] find that only a subset of decomposable non-robust features drives adversarial predictions; Li et al. [2023] argue their usefulness is paradigm-specific.Source: §5.1 · pp. 9–10
- The cited debate studies features under intentional adversarial perturbations, whereas this paper asks whether they mislead standard models on clean natural images.It identifies a Jammed Set where robust models outperform standard models and presents Spectral–Spatial Locking as the driving mechanism.Source: §5.1 · p. 10
5.2 Spectral and Geometric Bias in Generalization
- Prior work links spectral bias, weak geometric invariance, and texture bias to models’ reliance on high frequencies, fragile transformations, and local patterns.The passages associate geometric fragility with aliasing in downsampling layers Zhang [2019] and describe texture bias as prioritizing local patterns over global shapes Geirhos et al. [2018], Hermann et al. [2020].Source: §5.2 · p. 10
- The paper connects frequency and spatial alignment through Spectral–spatial Locking and frames stable aggregate jamming with underspecification and divergent failure modes under distribution shifts.The broader connections cited include D’Amour et al. [2022] on underspecification and Taori et al. [2020], Arjovsky et al. [2019], and Sagawa et al. [2019] on distribution shifts.Source: §5.2 · p. 10
6 Conclusion
Non-robust features can antagonize standard models on clean images: robust models outperform them on the Jammed Set. Small semantics-preserving transformations reshuffle jammed membership while leaving its overall prevalence stable.
6 Conclusion
- On the Jammed Set, robust models outperform standard models on clean, unmodified inputs.The analysis uses a standard-versus-robust partition of ImageNet-Val.Source: §6 · p. 10
- Frequency filtering, geometric perturbations, and frequency grafting provide evidence for spectral–spatial locking.Source: §6 · p. 10
- Small semantics-preserving transformations reshuffle jammed membership while overall jamming prevalence remains stable.Jammed identities are highly model-dependent at the system level.Source: §6 · p. 10