Parametric neural control differentiates top neural network models of primate visual cortex

Only the abstract of this paper was available to me; everything below is grounded in that abstract plus standard background on the field, and I flag where I'm reconstructing context rather than reporting the paper's details.

TL;DR: Ten leading deep-network models of primate visual cortex predict neural responses to natural images almost equally well — which has been widely taken to mean they've converged on the same brain-like representation. This paper builds a causal test: use each model's fitted "encoding axis" for a neuron to synthesize images predicted to parametrically dial that neuron's firing up and down, then show those images to five macaques in closed loop. Despite matched predictivity, the models diverge sharply in whether the real neurons actually follow. Adversarially trained models control neurons best, but the deeper predictor of control isn't robustness per se — it's the spatial-frequency structure of the model's input gradients. If this holds, correlational benchmarks like Brain-Score are measuring something much weaker than we thought, and "which model is most brain-like" has a new, causal answer key.

The plateau problem

The dominant paradigm for linking deep networks to visual cortex works like this: show a monkey a few thousand natural images while recording neurons (say, in V4 or IT), pass the same images through a pretrained network, and fit a linear readout from the network's features to each neuron's firing rate. The quality of that fit — held-out predictive accuracy — is the alignment score. This is the engine behind Brain-Score and a decade of "CNNs are the best model of the ventral stream" results.

The awkward fact, visible for several years now, is that this metric has saturated. Wildly different models — supervised CNNs, self-supervised transformers, CLIP-style contrastive models, adversarially trained networks — all predict neural responses to natural images with nearly indistinguishable accuracy. The comfortable interpretation has been convergence: many training routes, one brain-aligned representation. The uncomfortable alternative is that the metric itself is weak — that predicting responses within the natural image distribution, through the smoothing lens of a fitted linear map, simply can't distinguish representations that are actually quite different.

Here's the intuition for why the comfortable interpretation might fail. Fitting a linear readout on natural images is like fitting a function using only samples from a narrow shell of a very high-dimensional space. Many different functions agree on that shell. Two models can assign a neuron the same predicted responses on every natural image you'll ever show it, while parameterizing the direction of maximal sensitivity — the axis in image space along which the neuron's firing changes fastest — completely differently. Natural-image prediction never probes those directions directly. To distinguish the models, you have to leave the shell.

The key idea: turn the encoding axis into a control knob

The paper's move is to convert each model's fitted encoding model from a passive predictor into an active controller, and then check whether the brain obeys.

Concretely (reconstructing the mechanism from the abstract's description of "axis-aligned feature accentuation"): after fitting the linear readout, each neuron corresponds to an axis \mathbf{w} in the model's feature space — the direction along which the model claims that neuron's firing varies. The composite function \hat{r}(x) = \mathbf{w}^\top \phi(x), where \phi is the network's feature map and x is an image, is differentiable end to end. So you can take a seed image and do gradient-based optimization on pixels to push \hat{r}(x) up or down by graded amounts — producing a family of "accentuated" stimuli that, according to that model, should sweep the neuron's firing rate parametrically, within and beyond the range evoked by natural images. Then you present those stimuli to the actual macaque, closed-loop, and measure whether firing tracks the prediction.

This is a genuinely different question from prediction. Prediction asks: given images from the world, do model and neuron covary? Control asks: does the model know which specific pixel changes this neuron cares about? The first is a statement about correlations over a distribution; the second is a statement about the local geometry of the neuron's tuning function — its gradient in image space. Two models can match on the first and differ arbitrarily on the second.

The lineage here is worth noting. Closed-loop image synthesis for neurons isn't new — XDREAM/"evolved images" (Ponce et al. 2019) and Bashivan et al.'s 2019 "neural population control" showed you can synthesize images that drive neurons beyond natural levels. What's new in framing is using synthesis as a comparative, parametric assay across models: not "can a model drive this neuron?" but "which of ten models, all tied on predictivity, actually captured the neuron's tuning axis?" — with graded up-and-down control as the readout rather than just maximization. The scale is serious for primate electrophysiology: over 27,500 controller stimuli from ten models, tested in five macaques, across early, mid-, and high-level visual areas.

Result one: matched prediction, divergent control

The headline finding is the dissociation itself. Models with nearly indistinguishable natural-image predictivity "diverged strongly in their ability to control neural firing," and the abstract states plainly that most model encoding axes failed to capture the precise tuning of their neurons. The convergence inference is dead: equal encoding accuracy does not mean equal — or even adequate — brain alignment.

Result two: it's the gradients, not the robustness

The two adversarially trained models in the pool showed a consistent control advantage. Anyone who has followed the "perceptually aligned gradients" literature will feel a click of recognition here: adversarially robust networks are known to have input gradients that look like meaningful image structure — edges, object parts — rather than the high-frequency pixel speckle that characterizes standard networks' gradients. And feature accentuation is gradient ascent on pixels. A model whose gradients are high-frequency noise will, when asked to accentuate an encoding axis, produce imperceptible-looking adversarial-style perturbations — changes that live in directions the model is sensitive to but the biological visual system (with its optics, retinal sampling, and contrast sensitivity function) may barely register. A model whose gradients carry structured, lower-frequency content will produce perturbations that actually change what the image looks like, and thus can actually move a neuron.

But the paper adds a sharper twist: adversarial robustness itself was only weakly predictive of control across the other models. The better predictor was the spatial-frequency structure of the input gradient — the distribution of pixels influencing each encoding axis — measured directly. This is a nicer scientific claim than "robust models win." It says the causally relevant property is a measurable geometric feature of the model's pixel-space sensitivity, and adversarial training is just one route to it. Presumably other routes (architectural priors, blur augmentation, different training data statistics) could get you there too. It also reframes the perceptually-aligned-gradients phenomenon: those gradients aren't just aesthetically pleasing, they're biologically load-bearing — they determine whether the model's claimed tuning axes are real axes of the primate visual system.

Why this matters beyond monkey electrophysiology

Three consequences if the result holds.

Benchmarking. The field's primary alignment metric — held-out predictivity on natural images — is now demonstrably unable to distinguish models that differ in a causally testable way. This doesn't make Brain-Score useless, but it caps what it can tell you: it's a necessary condition, not a discriminating one. Expect "controllability" or gradient-based diagnostics to enter the model-comparison toolkit. Notably, the gradient spatial-frequency measure requires no animal at all — it's a cheap in-silico statistic that (per this paper) predicts an expensive in-vivo outcome. That's the kind of proxy that gets adopted.

Interpretability. Feature accentuation and feature visualization are standard tools for interrogating what units in a network encode. This paper is a rare validation loop in the other direction: the fidelity of these gradient-based visualizations, when applied to brain-fitted axes, can be checked against actual biological neurons. The finding that most models' axes fail the check is a warning for anyone treating a fitted encoding axis as "the neuron's tuning function."

The convergence debate. There's an active argument (platonic representation hypothesis, contrastive-alignment results) that large models trained on natural data converge to a shared representation. This result is a concrete counterexample at the level that matters for neuroscience: convergence in predictive readout does not imply convergence in the underlying parameterization. The disagreement was hiding off-distribution, and you needed a causal probe to see it.

What to be skeptical about

The abstract is all I had, so the following are the questions I'd take to the full text rather than known weaknesses.

Effect sizes are unstated. "Diverged strongly" and "consistent advantage" need numbers. How well does even the best model control neurons — near the ceiling implied by neural noise, or far below? If adversarially trained models control only modestly better than chance, the story is "everything fails, some fail less," which is a different headline.

The linear readout is a choice. The encoding axis being tested is model features composed with a fitted linear map. Control failure could reflect a bad model or an ill-conditioned fit (regularization, dataset size, which layer was used). One would want evidence that the readout fitting itself doesn't drive the ranking — e.g., that swapping fitting procedures preserves the model ordering.

Off-manifold confounds. Accentuated stimuli beyond the natural range may introduce artifacts (contrast, spectral content, spatial extent) that differentially affect neurons independent of the intended feature. The parametric, bidirectional design (suppress as well as amplify) is the right defense; I'd check how carefully low-level image statistics were matched across models' stimuli — especially since the punchline is itself about spatial frequency.

Correlational punchline inside a causal paper. The gradient-frequency result is, ironically, an across-model correlation with n = 10 models, two of which share the adversarial-training property. Ten points is thin for distinguishing "gradient spectrum" from any other property that covaries with it across this particular model pool. The claim would be far stronger with an intervention: take one architecture, manipulate gradient frequency content directly (e.g., via training-time input blurring or gradient regularization) while holding robustness roughly fixed, and show control tracks the manipulation. Whether the paper does anything like this, I can't tell from the abstract — it's the first thing I'd look for.

Which areas? The abstract says early, mid, and high-level areas were targeted, but not whether the model ranking is stable across the hierarchy. It would be surprising and interesting if the same models best control V1 simple cells and IT face-ish neurons.

Where to spend your time in the paper

Two places. First, the methods defining axis-aligned feature accentuation — the details of how graded targets are set, how perturbations are regularized, and how "control" is quantified determine whether the cross-model comparison is fair, and the technique itself is reusable for anyone doing closed-loop experiments (in brains or in other networks). Second, the input-gradient spatial-frequency analysis — this is the mechanistic claim with legs beyond this study, and the one whose evidential strength (correlational across 10 models vs. something more interventional) most determines how much the field should update. If the gradient-spectrum proxy replicates across model families, it becomes a free, differentiable target: you could plausibly train models toward controllable, brain-aligned axes without ever touching an electrode.