Parametric neural control differentiates top neural network models of primate visual cortex

TL;DR: Ten of the best deep-network models of primate visual cortex predict neural firing to natural images almost equally well — and this paper shows that this equivalence is an illusion. The authors turn each model's fitted "encoding axis" for a neural site into graded image perturbations that should push firing up or down, show those images to five macaques in closed-loop experiments (27,500+ synthesized stimuli, spanning early through high-level visual areas), and find the models diverge dramatically in whether they can actually steer the neurons. Adversarially trained models control best, but the strongest predictor of control is the spatial-frequency profile of a model's input gradients — not its prediction accuracy. Prediction and understanding come apart, measurably.

A note up front: only the abstract was available to me, not the full text. Everything below is grounded in the abstract plus necessary background; where I reason about mechanism or caveats beyond what the abstract states, I flag it.

The problem: a leaderboard that stopped discriminating

The dominant paradigm for linking deep networks to visual cortex works like this. You record from neurons in a monkey (or voxels in a human) while showing natural images. You take a pretrained vision model, extract its internal features for those same images, and fit a linear map from features to firing rates. If the fitted model predicts held-out responses well, you call it a good model of that brain area. Brain-Score and its relatives institutionalized this into leaderboards.

The uncomfortable fact, well known in the field for several years now, is that the leaderboard has saturated in a suspicious way. CNNs and transformers, supervised and self-supervised, small and enormous — a wide range of architecturally and algorithmically distinct models predict IT-cortex responses at nearly indistinguishable accuracy. The optimistic reading is convergence: many training recipes arrive at the same brain-like representation, so of course they all predict equally well. The pessimistic reading is that the metric is degenerate: linear regression from a high-dimensional feature bank onto neural responses is so flexible that it papers over deep representational differences.

This paper is a direct, causal test between those two readings. The answer is the pessimistic one.

Why prediction underdetermines the model

Here is the geometric intuition, which is the heart of the paper's logic.

When you fit an encoding model, you learn a weight vector w such that the predicted firing rate for image x is \hat{r}(x) = w^\top f(x), where f is the model's feature map. Natural images occupy a thin, curved manifold inside pixel space, and f maps that manifold into feature space. Regression only constrains w on the image of that manifold. Two models can produce identical predictions for every natural image while their axes w_1^\top f_1 and w_2^\top f_2 define completely different functions of the pixels — different tuning, different invariances, different sensitivities — everywhere off the manifold, and even in how they locally parameterize directions along it.

It's the classic curve-fitting trap, one level up: agreeing on the training distribution says little about agreeing on the underlying function. Two maps can mark every surveyed road identically and still disagree about all the terrain in between. To tell them apart you have to walk off the surveyed roads — and check against the actual ground.

Prior work had already used one model to drive neurons — Bashivan, Kar & DiCarlo's 2019 population-control experiments synthesized images from a single CNN and showed they could stretch IT firing beyond the natural range. What's genuinely new here is using control as a comparative instrument: run the same causal protocol through ten leading models with matched predictivity and see which ones' axes actually correspond to the neurons' tuning.

The mechanism: axis-aligned feature accentuation

The method, as described in the abstract, is "axis-aligned feature accentuation." (Feature accentuation exists as an interpretability technique from Fel and colleagues — perturbing a natural image to intensify a specific model feature while staying near the image — and this paper adapts it, pointing the accentuation along the fitted neural encoding axis rather than an arbitrary unit.)

The recipe you could sketch yourself:

1. Fit the encoding model. For a recorded neural site, fit w so that w^\top f(x) predicts firing on natural images. This defines the model's claim about what the neuron computes.
2. Accentuate along the axis. Starting from a seed image, optimize the pixels to increase (or decrease) w^\top f(x) by a graded, targeted amount — not maximal excitation, but a parametric family of stimuli predicted to land at specific firing levels, "within and beyond the natural-image range." This is the key upgrade over max-activation synthesis: it tests the whole tuning function, not just the peak.
3. Close the loop. Present the synthesized families to the animal and measure whether actual firing tracks predicted firing, per model.

The scale is what makes the comparison credible: over 27,500 controller stimuli, ten models, five macaques, with recordings targeting early, mid-, and high-level visual areas. That's enough coverage to separate "model X's axis is misaligned" from "this particular site was noisy."

What they found

Three results, in ascending order of interest.

1. Matched predictivity, divergent control. Despite near-identical natural-image prediction accuracy, "models diverged strongly in their ability to control neural firing using accentuated stimuli," and "most model encoding axes failed to capture the precise tuning of their corresponding neurons." This is the assumption-breaking headline. The convergence story — that all these models found the same brain-aligned parameterization — is false. Predictivity on natural images is an in-distribution metric; the axes it identifies are, for most models, wrong in the directions that matter causally.

2. Adversarially trained models win — but robustness isn't the explanation. The two adversarially trained models in the pool showed a consistent control advantage. This resonates with a well-known ML observation: adversarially robust classifiers have perceptually aligned gradients — perturb an image along a robust model's gradient and you get semantically meaningful changes (a more dog-like dog), whereas a standard model's gradient looks like high-frequency confetti. If your control method literally follows the model's pixel gradients, gradient quality is destiny. But the abstract adds a twist: "adversarial robustness was only weakly predictive of neural control across other models." So robustness per se isn't the causal ingredient.

3. The gradient's spatial-frequency spectrum is the best predictor. What predicted control best was "the spatial frequency structure of the input gradient: the distribution of pixels influencing each encoding axis." Models whose encoding-axis gradients concentrate energy at spatial frequencies neurons actually care about — coherent, mid/low-frequency structure rather than pixel-level noise — controlled neurons well, regardless of how they were trained.

Why is finding 3 the most interesting? Because it's a cheap, in-silico, differentiable diagnostic. If it holds up, you don't need a monkey to estimate whether your model's encoding axes are brain-aligned — you can compute the gradient spectrum of w^\top f(x) on your laptop. It also suggests a research direction: regularize or architect models toward brain-appropriate gradient spectra and test whether control improves, closing a loop between interpretability research (perceptually aligned gradients) and systems neuroscience.

What changes if this holds

Predictivity benchmarks need a causal companion. The field has been quietly relying on "predicts held-out neural responses" as a proxy for "captures the neural computation." This paper provides a concrete demonstration, at meaningful scale, that the proxy fails exactly where a model of the brain should be strongest: specifying which stimulus changes will move a neuron. Expect control-based evaluation to become a standard second axis, and expect a lot of Brain-Score-adjacent claims to be re-examined.

A new interpretation of the "convergence" literature. Results showing many models cluster together on representational similarity metrics should be read as statements about in-distribution behavior on natural images, not about shared parameterizations of visual space.

A bridge between robust ML and neuroscience. The idea that adversarial robustness relates to biological vision has been floated for years (robust models are more human-like on some perceptual metrics; texture-vs-shape bias, etc.). This is arguably the strongest causal evidence yet on the neural side — and simultaneously a refinement of it, since robustness itself is only weakly predictive. The load-bearing property looks like gradient geometry.

Where to be skeptical

I couldn't read the full text, so these are the questions I'd take into the paper rather than criticisms of it:

• Is the confound between adversarial training and gradient spectrum resolved? The two adversarially trained models presumably also have the best gradient spectra. The claim that spectrum beats robustness as a predictor rests on how much variance the other eight models provide, and whether the spectrum predictor was decided ex ante or discovered post hoc. Check how many models populate the middle of the spectrum→control regression.
• Control failure vs. optimization failure. When a model fails to drive a neuron, is the model's axis wrong, or did the accentuation optimizer produce off-manifold artifacts (aliasing, high-frequency junk) that neurons ignore for uninteresting reasons? The two are related — bad gradients cause bad synthesis — but the interpretation differs: "misaligned representation" vs. "representation fine, but not extractable by gradient-following." The gradient-spectrum result is compatible with both readings. Look for controls like frequency-matched perturbations or synthesis regularizers applied uniformly.
• Axis identifiability. The fitted w depends on regression choices (regularization, layer selection, dimensionality). A model could "fail" control because the fitting procedure picked a degenerate axis among many equally predictive ones, not because no aligned axis exists in its feature space. How robust are the rankings to the mapping procedure?
• Graded control vs. peak activation. The parametric, bidirectional design (drive firing to targeted levels, including suppression and beyond-natural excitation) is stronger than max-activation tests — but also harder, and the failures may concentrate in the extrapolation regime. Which regime differentiates models most?

None of these threaten the central negative result — matched predictivity, divergent causal control — which is robust to almost any reading. They mainly affect how to interpret why models differ.

Where to spend your time

When you open the paper: the methods defining axis-aligned feature accentuation (how "graded, within and beyond the natural range" is operationalized, and what regularization the synthesis uses), and the cross-model control-comparison figure, which is the paper's core evidence. Then the analysis relating gradient spatial-frequency spectra to control — that's the part with legs, both as a proxy metric for the field and as a design target for building models that don't just predict visual cortex, but actually parameterize images the way it does.