Neither classical adversarial training nor training on a version of ImageNet designed to reduce the reliance on texture helps a lot, but modifying the network architecture can increase the accuracy on ImageNet-A from around 5% to 15%.
most recent paper, Weight Agnostic Neural Networks looks at what happens when you do architecture search over neural nets initialized with random weights to try and better understand how much work structure is doing in neural nets.
(Section link.)
Wow, 15% sounds really low. How well do people perform on said dataset?
This reminds me of:
https://www.lesswrong.com/posts/s4mqFdgTfsjfwGFiQ/who-s-an-unusual-thinker-that-you-recommend-following#9m26yMR9TtbxCK7m5
Given that there was a round of manual review, I would expect human accuracy to be over 80% and probably over 90%.
You can download the dataset here and see how well you can classify them yourself.