Natural Jammers: When Non-Robust Features Become Antagonistic

Jiaming Zhang; Fuyao Zhang; Pengjun Xie; Wei Yang Bryan Lim

cs.CVOct 26, 2026

Natural Jammers: When Non-Robust Features Become Antagonistic

Authors: Jiaming Zhang, Fuyao Zhang, Pengjun Xie, Wei Yang Bryan Lim

Organizations: Nanyang Technological University · Alibaba Group

Abstract

Deep neural networks are known to rely on non-robust features that align poorly with human perception. Prior work has largely framed these features as opportunistic shortcuts that help standard models on clean data. We show instead that non-robust cues can be antagonistic: they can act as Natural Jammers that actively mislead standard models on clean, unmodified images. Using disagreement between a standard model and robust models as an analysis lens, we identify a Jammed Set on which robust models outperform standard models. We provide causal evidence for Spectral-spatial Locking: jamming arises only when high-frequency components are precisely aligned with specific spatial structures. Disrupting this lock through spectral filtering or small geometric shifts can restore correct predictions. Crucially, we uncover a Substitution Paradox: while individual jammers are fragile to geometric shifts, the aggregate prevalence of jamming remains approximately stable and is redistributed rather than eliminated under such transformations. Our results reframe natural non-robustness as a failure field over the empirical model-data geometry: one that redistributes rather than disappears under small transformations.

Figures & tables

Figure 1: The Duality of Non-Robust Features. (Left) Spurious Shortcut ( $\mathcal{S}$ ): prediction relies on fragile non-robust cues and collapses when these cues are suppressed. (Right) Natural Jammer ( $\mathcal{J}$ ): non-robust cues interfere with semantics-aligned evidence, suppressing them partially restores correct predictions. This illustrates that non-robust cues can be antagonistic rather than merely supportive. Accuracies are measured with the primary lens (standard vs. robust ResNet-50, $\ell_{2}$ , $\epsilon=1$ ).

Model	$\mathcal{J}$ (Jammed)	$\mathcal{S}$ (Spurious)	$\mathcal{C}$ (Common)	$\mathcal{G}$ (Uninformative)
ResNet-18 ( $\ell_{2}$ )	2,448 (4.90%)	6,168 (12.34%)	28,712 (57.42%)	12,672 (25.34%)
ResNet-50 ( $\ell_{2}$ )	2,140 (4.28%)	5,002 (10.00%)	33,071 (66.14%)	9,787 (19.57%)
WRN-50-2 ( $\ell_{2}$ )	2,167 (4.33%)	4,698 ( 9.40%)	34,543 (69.09%)	8,592 (17.18%)
ResNet-18 ( $\ell_{\infty}$ )	2,502 (5.00%)	5,659 (11.32%)	29,221 (58.44%)	12,618 (25.24%)
ResNet-50 ( $\ell_{\infty}$ )	2,252 (4.50%)	4,306 ( 8.61%)	33,767 (67.53%)	9,675 (19.35%)
WRN-50-2 ( $\ell_{\infty}$ )	2,232 (4.46%)	4,145 ( 8.29%)	35,096 (70.19%)	8,527 (17.05%)

Table 1: Distribution of Feature Pathologies on ImageNet. Data is reported for

\epsilon=1.0

constraints. The proportions of

\mathcal{J}

and

\mathcal{S}

remain relatively stable across ResNet and WideResNet architectures, suggesting that jamming is not confined to a single architecture.

Figure 2: The Duality of Sensitivity. (a) In the spectral domain, a Cleansing Paradox is observed: removing high-frequencies restores accuracy for the Jammed Set (

\mathcal{J}

) while destroying it for the Spurious Set (

\mathcal{S}

). (b) In the spatial domain, zooming induces an Sensitivity Inversion transition, showing the reversal of dominance between

\mathcal{J}

and

\mathcal{S}

features. All curves use the primary lens.

Transfer	Native Toxicity	Transferred Toxicity
Scenario	(0% $\to$ X%)	(on new host)
$\mathcal{J}\to\mathcal{C}$	31.8% (0% $\to$ 31.8%)	0.17%

Table 2: Frequency Grafting: Toxicity Transfer Test. We graft the HF of Jammed images onto Common images. Native Toxicity represents the accuracy gain when HF is removed from the source host. Transferred Toxicity measures the rate at which the wrong label of the jammer infects a new semantic host.

Configuration	Jammed ( $\mathcal{J}$ )	Spurious ( $\mathcal{S}$ )	Common ( $\mathcal{C}$ )	Uninformative ( $\mathcal{G}$ )	Rob. Acc.
ResNet-18 Standard Accuracy: 69.76%
$\ell_{2},\epsilon=0.5$	2,639 (5.28%)	4,786 (9.57%)	30,094 (60.19%)	12,481 (24.96%)	65.5%
$\ell_{2},\epsilon=1.0$	2,448 (4.90%)	6,168 (12.34%)	28,712 (57.42%)	12,672 (25.34%)	62.3%
$\ell_{2},\epsilon=3.0$	1,924 (3.85%)	10,240 (20.48%)	24,640 (49.28%)	13,196 (26.39%)	53.1%
$\ell_{\infty},\epsilon=1.0$	2,502 (5.00%)	5,659 (11.32%)	29,221 (58.44%)	12,618 (25.24%)	63.5%
$\ell_{\infty},\epsilon=4.0$	1,867 (3.73%)	10,497 (21.00%)	24,383 (48.77%)	13,253 (26.51%)	52.5%

Table 3: Complete Cross-Model Landscape. Analysis on ImageNet validation set (

N=50,000

). Within each architecture block,

f_{\text{std}}

is fixed to that architecture’s standard model; each row uses a different robust model

f_{\text{rob}}

to define the quad-set partition on clean inputs.

Figure 3: Jammed Set IoU Analysis ( $\ell_{\infty}$ ). Top row : intra-architecture agreement when changing only robustness budget ( $\epsilon=1$ vs $\epsilon=4$ ). Bottom : cross-architecture IoU matrix. Agreement is modest within the same architecture and collapses across architectures, indicating that jammed identity is model-dependent.

		Jammed ( $\mathcal{J}$ )			Spurious ( $\mathcal{S}$ )
Config	$\boldsymbol{\epsilon}$	RN-18	RN-50	WRN-50-2	RN-18	RN-50	WRN-50-2
$\ell_{2}$	0.5	.457 / .440	.511 / .509	.545 / .556	.571 / .349	.624 / .412	.684 / .459
$\ell_{2}$	1.0	.470 / .402	.517 / .464	.555 / .531	.601 / .303	.661 / .368	.710 / .427
$\ell_{2}$	3.0	.491 / .318	.544 / .384	.574 / .449	.678 / .217	.726 / .267	.770 / .323
$\ell_{\infty}$	1.0	.468 / .418	.513 / .485	.554 / .550	.588 / .316	.643 / .382	.698 / .445
$\ell_{\infty}$	4.0	.490 / .319	.538 / .394	.577 / .464	.680 / .206	.717 / .270	.760 / .321

Table 4: Confidence Comparison: Standard vs Robust Models. Each cell reports

f_{\text{std}}

f_{\text{rob}}

mean confidence (max softmax on predicted class). ViT entries use

\ell_{\infty}

\epsilon

=1.0 only.

	Set Size		IoU vs. Original
Crop	$\|\mathcal{J}_{T}\|$	$\|\mathcal{S}_{T}\|$	$\mathcal{J}$	$\mathcal{S}$
0% (original)	2,140	5,002	1.00	1.00
2%	2,289	5,193	0.46	0.58
4%	2,268	5,208	0.42	0.54
6%	2,276	5,127	0.38	0.51
8%	2,291	5,159	0.35	0.49

Table 5: Structural Fragility + Substitution Paradox. Minimal edge crops substantially change the identity of jammed/spurious samples (IoU drops sharply), yet the prevalence (set size) remains approximately stable.

Neural Network Robustness

Neural network robustness studies how models withstand adversarial inputs, data shifts, noise, and hardware faults while maintaining reliable predictions.

See all 237 papers

Neural Variability Enhances Artificial Network Robustness
Jun 11, 2026Robin Preble, Praveen Venkatesh, Stefan Mihalas +1Distribution Shift Robustness Neural Network Robustness
Department of Computer Science, Western Washington University, Bellingham, WA 98225 · Allen Institute, Seattle, WA 98195
Suppress and Diversify: Refining Robust Pathways for Corruption Robustness
Aug 7, 2026Jiangang Yang, Wenhui Shi, Xiaoran Xu +4Image Corruption Robustness Neural Network Robustness
Institute of Microelectronics, Chinese Academy of Sciences, Beijing, China · University of Chinese Science, Beijing, China
Useful nonrobust features are ubiquitous in biomedical images
Apr 24, 2026Coenraad Mouton, Randle Rabe, Niklas C. Koser +4Healthcare Neural Network Robustness
Section Biomedical Imaging, Department of Radiology and Neuroradiology, University Hospital Schleswig-Holstein, Kiel University · Faculty of Engineering, North-West University, South Africa

Jun 11, 2026J/K move · Enter open · S save

Neural Variability Enhances Artificial Network Robustness

Robin Preble, Praveen Venkatesh, Stefan Mihalas, Kameron Decker Harris

Department of Computer Science, Western Washington University, Bellingham, WA 98225 · Allen Institute, Seattle, WA 98195

Distribution Shift Robustness Neural Network Robustness Adversarial Robustness Corruption Robustness Noise Robustness

Open paper AskPDF arXiv

Neural responses in cortex exhibit substantial trial-to-trial variability in response to repeated stimuli, while peripheral sensory neurons respond far more consistently, leading many to wonder whether stochasticity may carry meaning. Existing work has argued that noise and signal correlations may be optimized for discrimination in animals, whereas artificial neural network (ANN) studies have shown similar benefits of noise in machine learning tasks, although most ANN work has neglected the effects of correlations. Here we investigate whether correlated noise improves the robustness of artificial neural networks to adversarial attacks and naturalistic image modifications. Using the covariance of activations under modified versus clean inputs, we find that structured noise may significantly improve network robustness. Robustness to naturalistic image modifications benefits most from structure, but this structure transfers poorly across modification types. In contrast, noise structure from adversarial attacks can generalize to other kinds of attacks. These results suggest that structured noise in ANN activations generally improves robustness, establishing a biologically plausible strategy for creating robust artificial neural networks that only relies on local information.

Abstract

Neural Network Robustness

Explore similar work

Neural Variability Enhances Artificial Network Robustness

Suppress and Diversify: Refining Robust Pathways for Corruption Robustness

Useful nonrobust features are ubiquitous in biomedical images