[1] LECUN Y, BOTTOU L, BENGIO Y et al. Gradient-based learning applied to document recognition[J]. Proceedings of the IEEE, 86, 2278-2324(1998).

[2] KRIZHEVSKY A, SUTSKEVER I, HINTON G E. ImageNet classification with deep convolutional neural networks[J]. Communications of the ACM, 60, 84-90(2017).

[3] HE K M, ZHANG X Y, REN S Q et al. Deep residual learning for image recognition[C], 770-778(2016).

[4] SZEGEDY C, VANHOUCKE V, IOFFE S et al. Rethinking the inception architecture for computer vision[C], 2818-2826(2016).

[5] HUANG G, LIU Z, VAN DER MAATEN L et al. Densely connected convolutional networks[C], 2261-2269(2017).

[6] SZEGEDY C, ZAREMBA W, SUTSKEVER I et al. Intriguing properties of neural networks[webpage]. arXiv, 1312-6199(2013). https：//arxiv.org/abs/1312.6199

[7] ILYAS A, SANTURKAR S, TSIPRAS D et al. Adversarial examples are not bugs， they are features[webpage]. arXiv, 1905-02175(2019). https：//arxiv.org/abs/1905.02175

[8] [8] 8林点， 潘理， 易平. 面向图像识别的卷积神经网络稳定性研究进展［J］. 网络与信息安全学报， 2022， 8（3）：111-122. doi: 10.11959/j.issn.2096-109x.2022037LIND， PANL， YIP. Research on the robustness of convolutional neural networks in image recognition［J］. Chinese Journal of Network and Information Security， 2022， 8（3）：111-122.（in Chinese）. doi: 10.11959/j.issn.2096-109x.2022037

[9] DZIUGAITE G K, GHAHRAMANI Z, ROY D M. A study of the effect of JPG compression on adversarial images[webpage]. arXiv, 1608-00853(2016). https：//arxiv.org/abs/1608.00853

[10] VINCENT P, LAROCHELLE H, BENGIO Y et al. Extracting and composing robust features with denoising autoencoders[C], 1096-1103(2008).

[11] XU W, EVANS D, QI Y. Feature squeezing： detecting adversarial examples in deep neural networks[webpage]. arXiv, 1704-01155(2017). https：//arxiv.org/abs/1704.01155

[12] TSIPRAS D, SANTURKAR S, ENGSTROM L et al. Robustness may be at odds with accuracy[webpage]. arXiv, 1805-12152(2018). https：//arxiv.org/abs/1805.12152

[13] XIE C H, TAN M X, GONG B Q et al. Adversarial examples improve image recognition[C], 816-825(2020).

[14] CARLINI N, WAGNER D. Adversarial examples are not easily detected： bypassing ten detection methods[C], 3-14(3).

[15] ULLMAN S, ASSIF L, FETAYA E et al. Atoms of recognition in human and computer vision[J]. Proceedings of the National Academy of Sciences of the United States of America, 113, 2744-2749(2016).

[16] HUBEL D H, WIESEL T N. Receptive fields， binocular interaction and functional architecture in the cat’s visual cortex[J]. The Journal of Physiology, 160, 106-154(1962).

[17] ZADOR A M. A critique of pure learning and what artificial neural networks can learn from animal brains[J]. Nature Communications, 10, 3770(2019).

[18] MARBLESTONE A H, WAYNE G, KORDING K P. Toward an integration of deep learning and neuroscience[J]. Frontiers in Computational Neuroscience, 10, 94(2016).

[19] NAYEBI A, GANGULI S. Biologically inspired protection of deep networks from adversarial attacks[webpage]. arXiv, 1703-09202(2017). https：//arxiv.org/abs/1703.09202

[20] LINDSAY G W, MILLER K D. How biological attention mechanisms improve task performance in a large-scale visual system model[J]. eLife, 7, 38105(2018).

[21] HASANI H, SOLEYMANI M, AGHAJAN H. Surround modulation： a bio-inspired connectivity structure for convolutional neural networks[J]. Advances in Neural Information Processing Systems(2019).

[22] REDDY M V, BANBURSKI A, PANT N et al. Biologically inspired mechanisms for adversarial robustness[webpage]. arXiv, 2006-16427(2020). https：//arxiv.org/abs/2006.16427

[23] KIM E, REGO J, WATKINS Y et al. Modeling biological immunity to adversarial examples[C], 4665-4674(2020).

[24] DAPELLO J, MARQUES T, SCHRIMPF M et al. Simulating a primary visual cortex at the front of CNNs improves robustness to image perturbations[J]. Advances in Neural Information Processing Systems, 33, 13073-13087(2020).

[25] JONES J P, PALMER L A. An evaluation of the two-dimensional Gabor filter model of simple receptive fields in cat striate cortex[J]. Journal of Neurophysiology, 58, 1233-1258(1987).

[26] ADELSON E H, BERGEN J R. Spatiotemporal energy models for the perception of motion[J]. Journal of the Optical Society of America A, 2, 284(1985).

[27] VINTCH B, MOVSHON J A, SIMONCELLI E P. A convolutional subunit model for neuronal responses in macaque V1[J]. The Journal of Neuroscience, 35, 14829-14841(2015).

[28] CADENA S A, DENFIELD G H, WALKER E Y et al. Deep convolutional models improve predictions of macaque V1 responses to natural images[J]. PLoS Computational Biology, 15(2019).

[29] SCHRIMPF M, KUBILIUS J, HONG H et al. Brain-Score： which Artificial Neural Network for Object Recognition is most Brain-Like？[J]. bioRxiv(2018).

[30] KUBILIUS J, SCHRIMPF M, HONG H et al. Brain-like object recognition with high-performing shallow recurrent ANNs[webpage]. arXiv, 1909-06161(2019). https：//arxiv.org/abs/1909.06161

[31] EL-SHAMAYLEH Y, KUMBHANI R D, DHRUV N T et al. Visual response properties of V1 neurons projecting to V2 in macaque[J]. The Journal of Neuroscience, 33, 16594-16605(2013).

[32] SOFTKY W R, KOCH C. The highly irregular firing of cortical cells is inconsistent with temporal integration of random EPSPs[J]. The Journal of Neuroscience, 13, 334-350(1993).

[33] LINDSEY J, OCKO S A, GANGULI S et al. A unified theory of early visual representations from retina to cortex through anatomically constrained deep CNNs[webpage]. arXiv, 1901-00945(2019). https：//arxiv.org/abs/1901.00945

[34] SIMONYAN K, ZISSERMAN A. Very deep convolutional networks for large-scale image recognition[webpage]. arXiv, 1409-1556(2014). https：//arxiv.org/abs/1409.1556