Adversarially trained neural representations may already be as robust as corresponding biological neural representations
Chong Guo, Michael J. Lee, Guillaume Leclerc, Joel Dapello, Yug Rao, Aleksander Madry, James J. DiCarlo
q-bio.NC, cs.LG
2022-06-19
A closed-loop proxy model delivers optimizer-found perturbations straight to macaque IT cortex: adversarially trained units edge out biological sites, and category preference flips at tiny budgets.
Primate vision is treated as the gold standard of robust perception, and a broad belief follows from it: mimic the neural representations of the primate visual system, and artificial vision will inherit its robustness. The belief went untested because adversarial examples are found by gradient-based optimization, and you cannot backprop into a brain. This paper, from MIT's McGovern Institute together with Aleksander Madry's group, closes the gap with a closed-loop method for generating and delivering adversarial images directly to primate visual cortex, then measures how biological neurons actually compare with robustly trained networks.
The attack maintains a proxy model of IT and improves it daily. The base network is a ResNet50 adversarially trained at ℓ₂ ε=2; features from layer 4.0 are linearly mapped, with channel-factorized weights, onto 21 recorded IT sites. On day 0 the proxy generates perturbations by PGD (100 steps) on 1,000 clean ImageNet images. Over six days, clean images, perturbed images and the recorded neural responses are fed back to fine-tune the proxy, about 100k samples by day 5, and fresh perturbations are generated against the improved model. Images are shown at 8 degrees of visual field for 100 ms while two 99-channel Utah arrays record IT activity. As the proxy improved, the perturbation actually realized on real neurons at ε=1 grew 2.7-fold from day 1 to day 5, far exceeding model-free baselines such as Gaussian noise or cross-class interpolation. That comparison explains why earlier robustness tests on brains, which mostly used random noise, systematically underestimated neuronal sensitivity.
The comparison metric is normalized adversarial sensitivity: the response change induced by the perturbation divided by the site's response variability across clean images. DNN units are measured with white-box PGD, taking the maximum over 100 random restarts of 250 steps each.
| Subject | Result | |
| --- | --- | --- |
| Vanilla ResNet50 units | sensitivity over 10x baseline variation | |
| Macaque IT sites (n=21) | about 10x less sensitive than vanilla ResNet50, still clearly attackable | |
| AT-ResNet50 / AT-WideResNet50-4 (ε=3) | slightly less sensitive than IT sites |
The asymmetry matters: attacks on IT go through an approximate model, so the biological measurement is a lower bound on true sensitivity, and further work can only raise it. Even under this conservative estimate, both adversarially trained networks already edge out the IT sites.
Category preference falls apart at small budgets. On average ε=4.0±1.6 suffices to drive a non-preferred image's response up to the level of the site's most preferred categories (216±60 Hz); at ε=10 the average response reaches 310±60 Hz, above any natural preferred category. These super-stimuli often do not even look like the semantic categories the site preferred. For scale, human subjects detected ε=1 perturbations at 51% accuracy (chance 50%, n=50), and ε=1.73 equals flipping one pixel from black to white.
"Biological vision is more robust" can no longer be cited as a premise. Adversarial training caught up with individual IT sites without copying brain representations, which shifts the burden onto neuro-inspired approaches to explain why the gold standard itself gives in at ε=2.5-scale budgets. The closed loop is also a first for neuroscience: optimizer-found adversarial images delivered to living cortex. Category selectivity, a foundational concept in IT research, turns out not to be a locally stable property.
The sample is 21 IT sites in a single region, so extrapolation to the whole visual system is limited. Unit-level sensitivity is not behavior: the authors note that unknown error-correction at the population level or in downstream areas could keep the animal's recognition intact. The proxy asymmetry favors the conclusion directionally, but the margin between the AT networks and the IT sites is slight; stronger attacks or more recording sites could still reorder the ranking.