[1] Y LECUN, L BOTTOU, Y BENGIO et al. Gradient-based learning applied to document recognition. Proceedings of the IEEE, 86, 2278-2324(1998).

[2] A KRIZHEVSKY, I SUTSKEVER, G E HINTON. ImageNet classification with deep convolutional neural networks. Communications of the ACM, 60, 84-90(2017).

[3] K M HE, X Y ZHANG, S Q REN et al. Deep residual learning for image recognition, 770-778(2016).

[4] C SZEGEDY, V VANHOUCKE, S IOFFE et al. Rethinking the inception architecture for computer vision, 2818-2826(2016).

[5] G HUANG, Z LIU, L VAN DER MAATEN et al. Densely connected convolutional networks, 2261-2269(2017).

[6] C SZEGEDY, W ZAREMBA, I SUTSKEVER et al. Intriguing properties of neural networks. arXiv, 1312-6199(2013). https：//arxiv.org/abs/1312.6199

[7] A ILYAS, S SANTURKAR, D TSIPRAS et al. Adversarial examples are not bugs， they are features. arXiv, 1905-02175(2019). https：//arxiv.org/abs/1905.02175

[8] [8] 8林点， 潘理， 易平. 面向图像识别的卷积神经网络稳定性研究进展［J］. 网络与信息安全学报， 2022， 8（3）：111-122. doi: 10.11959/j.issn.2096-109x.2022037LIND， PANL， YIP. Research on the robustness of convolutional neural networks in image recognition［J］. Chinese Journal of Network and Information Security， 2022， 8（3）：111-122.（in Chinese）. doi: 10.11959/j.issn.2096-109x.2022037

[9] G K DZIUGAITE, Z GHAHRAMANI, D M ROY. A study of the effect of JPG compression on adversarial images. arXiv, 1608-00853(2016). https：//arxiv.org/abs/1608.00853

[10] P VINCENT, H LAROCHELLE, Y BENGIO et al. Extracting and composing robust features with denoising autoencoders, 1096-1103(2008).

[11] W XU, D EVANS, Y QI. Feature squeezing： detecting adversarial examples in deep neural networks. arXiv, 1704-01155(2017). https：//arxiv.org/abs/1704.01155

[12] D TSIPRAS, S SANTURKAR, L ENGSTROM et al. Robustness may be at odds with accuracy. arXiv, 1805-12152(2018). https：//arxiv.org/abs/1805.12152

[13] C H XIE, M X TAN, B Q GONG et al. Adversarial examples improve image recognition, 816-825(2020).

[14] N CARLINI, D WAGNER. Adversarial examples are not easily detected： bypassing ten detection methods, 3-14(3).

[15] S ULLMAN, L ASSIF, E FETAYA et al. Atoms of recognition in human and computer vision. Proceedings of the National Academy of Sciences of the United States of America, 113, 2744-2749(2016).

[16] D H HUBEL, T N WIESEL. Receptive fields， binocular interaction and functional architecture in the cat’s visual cortex. The Journal of Physiology, 160, 106-154(1962).

[17] A M ZADOR. A critique of pure learning and what artificial neural networks can learn from animal brains. Nature Communications, 10, 3770(2019).

[18] A H MARBLESTONE, G WAYNE, K P KORDING. Toward an integration of deep learning and neuroscience. Frontiers in Computational Neuroscience, 10, 94(2016).

[19] A NAYEBI, S GANGULI. Biologically inspired protection of deep networks from adversarial attacks. arXiv, 1703-09202(2017). https：//arxiv.org/abs/1703.09202

[20] G W LINDSAY, K D MILLER. How biological attention mechanisms improve task performance in a large-scale visual system model. eLife, 7, 38105(2018).

[21] H HASANI, M SOLEYMANI, H AGHAJAN. Surround modulation： a bio-inspired connectivity structure for convolutional neural networks. Advances in Neural Information Processing Systems(2019).

[22] M V REDDY, A BANBURSKI, N PANT et al. Biologically inspired mechanisms for adversarial robustness. arXiv, 2006-16427(2020). https：//arxiv.org/abs/2006.16427

[23] E KIM, J REGO, Y WATKINS et al. Modeling biological immunity to adversarial examples, 4665-4674(2020).

[24] J DAPELLO, T MARQUES, M SCHRIMPF et al. Simulating a primary visual cortex at the front of CNNs improves robustness to image perturbations. Advances in Neural Information Processing Systems, 33, 13073-13087(2020).

[25] J P JONES, L A PALMER. An evaluation of the two-dimensional Gabor filter model of simple receptive fields in cat striate cortex. Journal of Neurophysiology, 58, 1233-1258(1987).

[26] E H ADELSON, J R BERGEN. Spatiotemporal energy models for the perception of motion. Journal of the Optical Society of America A, 2, 284(1985).

[27] B VINTCH, J A MOVSHON, E P SIMONCELLI. A convolutional subunit model for neuronal responses in macaque V1. The Journal of Neuroscience, 35, 14829-14841(2015).

[28] S A CADENA, G H DENFIELD, E Y WALKER et al. Deep convolutional models improve predictions of macaque V1 responses to natural images. PLoS Computational Biology, 15(2019).

[29] M SCHRIMPF, J KUBILIUS, H HONG et al. Brain-Score： which Artificial Neural Network for Object Recognition is most Brain-Like？. bioRxiv(2018).

[30] J KUBILIUS, M SCHRIMPF, H HONG et al. Brain-like object recognition with high-performing shallow recurrent ANNs. arXiv, 1909-06161(2019). https：//arxiv.org/abs/1909.06161

[31] Y EL-SHAMAYLEH, R D KUMBHANI, N T DHRUV et al. Visual response properties of V1 neurons projecting to V2 in macaque. The Journal of Neuroscience, 33, 16594-16605(2013).

[32] W R SOFTKY, C KOCH. The highly irregular firing of cortical cells is inconsistent with temporal integration of random EPSPs. The Journal of Neuroscience, 13, 334-350(1993).

[33] J LINDSEY, S A OCKO, S GANGULI et al. A unified theory of early visual representations from retina to cortex through anatomically constrained deep CNNs. arXiv, 1901-00945(2019). https：//arxiv.org/abs/1901.00945

[34] K SIMONYAN, A ZISSERMAN. Very deep convolutional networks for large-scale image recognition. arXiv, 1409-1556(2014). https：//arxiv.org/abs/1409.1556