Stretching Beyond the Obvious: A Gradient-Free Framework to Unveil the Hidden Landscape of Visual Invariance
Authors: Lorenzo Tausani
Paolo Muratore
Morgan Bruce Talbot
Giacomo Amerio
Gabriel Kreiman
Davide Zoccolan
Venue: ICLR 2026 Poster (2026)
Keywords: vision
visual invariance
feature visualization
human-AI alignment
deep convolutional neural networks
NeuroAI
psychophysics
computational neuroscience
robustness
adversarial attacks
evolutionary algorithm
gradient-free optimization
machine learning
Primary area: applications to neuroscience & cognitive science
TL;DR: Gradient-free optimization uncovers novel invariances in deep convolutional neural nets

Abstract: Uncovering which feature combinations are encoded by visual units is critical to understanding how images are transformed into representations that support recognition. While existing feature visualization approaches typically infer a unit's most exciting images, this is insufficient to reveal the manifold of transformations under which responses remain invariant, which is critical to generalization in vision.
Here we introduce Stretch-and-Squeeze (SnS), an unbiased, model-agnostic, and gradient-free framework to systematically characterize a unit’s maximally invariant stimuli, and its vulnerability to adversarial perturbations, in both biological and artificial visual systems. SnS frames these transformations as bi-objective optimization problems. To probe invariance, SnS seeks image perturbations that maximally alter (stretch) the representation of a reference stimulus in a given processing stage while preserving unit activation downstream (squeeze). To probe adversarial sensitivity, stretching and squeezing are reversed to maximally perturb unit activation while minimizing changes to the upstream representation.
Applied to CNNs, SnS revealed invariant transformations that were farther from a reference image in pixel-space than those produced by affine transformations, while more strongly preserving the target unit's response. The discovered invariant images differed depending on the stage of the image representation used for optimization: pixel-level changes primarily affected luminance and contrast, while stretching mid- and late-layer representations mainly altered texture and pose. 
By measuring how well the hierarchical invariant images obtained for $L_2$-robust (i.e., adversarially trained) networks were classified by humans and other observer networks, we discovered a substantial drop in their interpretability when the representation was stretched in deep layers, while the opposite trend was found for standard (i.e., not robustified) models. This indicates that $L_2$ adversarial training fails to increase the interpretability of high-level invariances, despite good perceptual alignment between humans and robustified models at the pixel level. This demonstrates how SnS can be used as a powerful new tool to measure the alignment between artificial and biological vision.

Published as a conference paper at ICLR 2026
STRETCHING BEYOND THE OBVIOUS: A GRADIENT- FREE FRAMEWORK TO UNVEIL THE HIDDEN LAND- SCAPE OF VISUAL INVARIANCE
Lorenzo Tausani', Paolo Muratore', Morgan B. Talbot Giacomo Amerio
Gabriel Kreiman 2.3 Davide Z
"Neuroscience Area, International School for Advanced Studies (SISSA), Trieste (Italy)
"Boston Children's Hospital, Harvard Medical School, Boston (USA)
*Center for Brains, Minds, and Machines, MIT, Cambridge (USA)
*Harvard-Ma MI' Program in Health Sciences and Technology, MIT, Cambridge (USA)
ABSTRACT
Uncovering which feature combinations encoded by visual units is critical to understanding how images are transformed into representations that support recognition. While existing feature visualization approaches typically infer unit's most exciting images, this is insufficient to reveal the manifold of transformations under which responses remain invariant, which is critical to generalization in vision. Here we introduce Sreetch-andSSqueeee (SnS), an unbiased, -annostgg,sttcc and gradient-free framework to systematically characterize unit's maximally invari- ant stimuli, and its vulnerability to adversarial perturbations, in both biological and artificial visual systems. SnS frames these transformations as bi-objective optimization problems. To probe invariance, SnS seeks image perturbations that maximally alter (stretch) the representation of a reference stimulus in a given processing stage while preserving unit activation downstream (squeeze). To probe adversarial sensitivity, stretching and squeezing are reversed to maximally perturb unit activation while minimizing changes to the upstream representation. Applied to CNNs, SnS revealed invariant transformations that were farther from a reference image in pixel-space than those produced by affine transformations, while more strongly preserving the target unit's response. The discovered invariant images differed depending on the stage of the image representation used for optimization: pixel-level changes primarily affected luminance and contrast, while stretching mid- and layer representations mainly altered texture and pose. By measuring how well the hierarchical invariant images obtained for L2-robust (i.e., adversarially trained) networks were classified by humans and other observer networks, we discovered substantial drop in their interpretability when the representation stretched in deep layers, while the opposite trend was found for standard (i.c., not robustified) models. This indicates that L2 adversarial training fails to increase the interpretability of high-level invariances, despite good perceptual alignment between humans and robustified models the pixel level. This demonstrates how SnS can be used as powerful new tool to measure the alignment between artificial and biological vision.
INTRODUCTION
Both visual neuroscience and deep learning seek understand image processing systems composed of millions of interacting functional units, whose activity patterns are shaped by their experience with natural image statistics (Matteucci et al. 2024: Barrett et al. 2019). This common goal raises fundamental question in both fields: which combination of image features do visual neurons become tuned for? Traditionally, this question has been addressed by developing feature visualization approaches that discover the "preferred" stimuli that maximally activate a given unit often referred to as the unit's 'ss most exciting images (MEIs) (Olah et al., 2017/Nguyen Nguyen et al. 2019 [el et al., 2023
Xiao & Kreiman 2019 Walker et al. 2019). MEIs, however, only reveal few instances within the

---

Published as a conference paper at ICLR 2026
vast set of images that strongly activate unit (Nguyen et al. poor insight into the manifold of transformations under which the unit's ' activity remains invariant.
2016 Cadena et al. 2018), offering
To overcome this limitation, we developed Stretch-and-S5 and-Squeezee (SnS), unbiased, model-agnostic method to probe visual invariance in both artificial and biological neurons. Building upon an existing framework for finding MEIs (Xiao & Kreiman 2020), SnS optimization exploits evolutionary algorithms, but with a different objective: to find invariant or adversarial images. SnS integrates the search for invariant images and adversarial examples within a unified optimization objective, generating image perturbations starting from reference image (e.g., a MEI of the unit). To probe unit's invariance, SnS explicitly looks for images that are maximally distinct from this reference stimulus in the representation of chosen visual processing stage, while preserving the response of a target unit downstream. This allows SnS to sample the invariance manifolds of the selected unit when the representation of an effective stimulus (either a MEI or natural image) is stretched at different processing stages. As a result, our approach reveals the actual image variation axes the unit is able to tolerate, providing richer, more veridical description of its invariance landscape, as compared to traditional tests based on predefined (e.g., affine) transformations (Goodfellow et al. 2009 Kheradpisheh et al., 2016;; Engstrom et al. 2019c). In our study, carried out comprehensive tests of the effectiveness of SnS to achieve the goals listed above, using a popular CNN (ResNet50) as a benchmark. To study invariances of the whole model with respect specific image classes, we applied SnS to the network's 's readout units, as they are selective for the object categories the model has learned to classify (e.g., a 'cup' neuron). We found dramatic differences among the invariance landscapes of these units when stretching the representations at different depths of the processing hierarchy. Stretching early, middle, and late representations yielded invariant images that differed from the reference (and among themselves) in terms of luminance/contrast, texture, and pose, respectively. We also discovered important differences in these hierarchical invariances between the standard and an adversarially trained version of the network. Like previous studies (Feather et al., 2023) we found that invariant images from the L2-robust network were more recognizable by human subjects and other observer networks. However, we identify striking point of divergence: while robust CNN invariances become less interpretable when stretching at deeper layers, those of standard networks become more intrepretable, causing the robust network's ' advantage to erode in later layers. Importantly, being gradient-free and model-agnostic, SnS can uncover the invariance fields of units in "black-box" image processing systems, where access hidden units is either absent very limited. Neurophysiologists face this scenario when they want to infer the tuning properties of biological visual neurons. To test the applicability of SnS in neurophysiology experiments, we verified that the method works even if the experimenter can record the activity of just small fraction of the units in the processing stage where the stretching is applied.
RELATED WORKS
feature visualization, invariance, and adversarial examples. The question of functional interpretability and feature visualization in deep learning has predominantly been approached by employing gradient- optimization for image synthesis, taking advantage of the complete analytical description and differentiability of the network (Olah et al. 2017, Nguyen ct al. 2019 Fel et al. 2023). While most studies have focused on finding the MEIs of CNNs' units, recent efforts have started to also explore their invariance landscapes. Most of them have focused on providing a local measure of model invariance around a given input, probing the shape of the representation manifold in the vicinity of a chosen image (Berardino et al.) 2017] Hénaff & Simoncelli 2015). Another prominent approach relies on discovering model metamers i.e., synthesized stimuli that match the internal representation of a reference (natural) image in a specific layer of a network (Mahendran & Vedaldi (2015). Using metamers, Feather et al. (2023) were able to demonstrate that standard CNNs display highly idiosyneratic invariances at the top layers of processing, with metamers being unintelligible to human observers or other neural networks. In contrast, CNNs trained to be robust to adversarial images (i.e., imperceptibly modified inputs capable of altering CNN object classification (Szegedy et al., 2013)) yielded metamers that were substantially more interpretable by human observers. This shows how invariance and adversarial vulnerability are conceptually related (Jacobsen et al. 2020). For instance, adversarially trained ("robust") networks can craft subtle image perturbations that not only fool the network but also impair (Gaziv et al.) (023) enhance (Talbot et al. 2025) human object recognition, thereby reinforcing the perceptual parallels between robust network representations and invariance in human vision.
Probing CNN representations:
2

---

Published as a conference paper at ICLR 2026
Applications to visual neuroscience. Advances in CNN interpretability have also impacted neu- roscience, which has long suffered from a lack of effective methods to investigate the functional tuning of visual neurons in higher cortical areas. By leveraging the strong functional analogy between CNNs trained for image classification and the primate object recognition pathway (known as the ventral stream (DiCarlo et al. (2012)). it is possible create digital twins of the ventral stream using CNNs (aaiins et al. 2014] Yamins& & DiCarlo 2016); [chrimpf et al., 2018). This allows employing gradient-based optimization
synthesize images that modulate the activity of biological neurons (Bashivan et al. 2019) or investigate properties like adversarial robustness in visual neurons (Guo
al.) 2022). The digital twin paradigm has also been extended beyond primate vision, informing models of the auditory cortex (Kell et al. 2018) and visual processing in rodents (Nayebi et al. 2023
Walker et al.) 2019 Tong et al., (023). importantly, related gradient-based techniques (Cadena et al. 2018) have also been used to map invariance in individual neurons, for instance, by looking for
images that maximally activate a mouse primary visual neuron while being maximally distinct in pixel space (Ding al. 2023). Other recent approaches (Baromi et al. 2023 Bashiri et al. (025)) used Compositional Pattern- Producing Networks (CPPNs) to map dow-dimelsional (1 and 2d) invariance Sattern-Producing manifolds of digital twin neurons of macaque primary visual cortex, successfully recovering visual invariances established by previous neurophysiological and computational work (Schwartz et al.
2006 Sharpee 2013).
Obviously, these approaches have an intrinsic limitation: they are only as good as the fidelity of the digital twin at capturing the selectivity of visual neurons. To overcome this constraint, gradientless feature visualization methods like XDREAM have successfully synthesized effective MEIs for units in both the primate ventral stream (Ponce et al. 2019) and artificial neural networks (Xiao & Kreiman 2019) by relying on evolutionary algorithms. While recent work has also begun to explore the feature landscape around the MEIs obtained with XDREAM (Wang Ponce (0226), current gradientless approaches have not been systematically applied to characterize the invariance of visual tuning in artificial and biological architectures. Hence the novelty of SnS, which is, to the best of our knowledge, the first gradientless approach to systematically infer the invariance manifolds of visual units.
3 METHODS
3.1 THE STRETCH-AND-SQUEER ALGORITHM (SNS)
SnS consists of three key components: generative model v, a test (or subject) network ø and gradient-free optimizer (Fig. [T]. The generative model is pretrained deep neural network (Dosovitskiy& & Brox 2016) that maps n- n--imensiinall vectors & E IR"' (referred to as codes) to RGB 4096. Crucially, the generative model ab was trained on naturalistic stimuli and embodies a powerful prior over the distribution of possible images. We use the Covariance Matrix Adaptation Evolutionary Strategy (CMA-ES) optimizer (Hansen et al. 2003) to adjust the codes and iteratively improve on our objective. At each iteration the optimizer yields new set of codes gi+1 IR"" which in turn is used generate a new batch of images. A core tenet of the SnS algorithm is the relational construction of its fitness function. We start by introducing two layer indices K and l for our test network ó. where for convention we include the input stage as O, and the measuring function T(æ o²)) E Rd. which returns the activations al of all the d units layer f, when the network & is presented with stimulus æ. We then identify a reference stimulus Fee from which we construct the pair of reference states (afer afcr) as
images: +6 (<) E X C RCCH In all the experiments,
a of = r (Dret, @**() Lastly, we introduce two optimization objectives as either the minimization Lequeeze maximization (i.c. minimization of the negative) Lstreth of the euclidean distance of given state a" = T (x, )²*) from the corresponding reference state:
C Chrotcc aaa, = - a" afer ll2: Liqueeze (a" afce)) = + a" - affe lll.
(I)
Then, for given choice of layer indices k., l and reference states n.t. indicating with X' C CCXHW the set of input images, we define f: X -> IR2 as:
3

---

Published as a conference paper at ICLR 2026
C (T (x,, Ø4) L G Lsqueee (T (2t, Φ6)
a
f +
and introduce the bi-objective minimization problem: ming (Ji(z), f2())), where x: = =/ (E).
We define Esss as the formal solution to such bi-objective optimization problem in the Pareto sense, i.e. Esss is the collection of Pareto-optimal solutions x² X. In particular, denoting solution I1 f-dominant with respect to 22 by æ o Ø2, where we write æ و #2 < f( S fi (22) and Di for which the inequality holds strictly, we can write the Es5 collection of solutions
Ess (x" X E X:
x =0
In practice, for each round of optimization, we sorted the fitness scores by organizing them in Pareto fronts (Deb) (20T)) (see Supplementary Material, Section A.3 for further details). In order make our formulation more transparent to different components, we introduce the following shorthand notation for Eas and refer equation B for its exact definition:
Catretch (T a"e)) Cequeeze (T(x,, Φ²), a afer)
E = arg min øEA
(4)
While this formulation is general and in principle supports arbitrary choices for the layer indices n.t and f, as well for the corresponding reference states a in our experiments we restricted the scope of the optimization problem to investigate specific properties of the test network & (e.g. robustness, invariance) by making the following design choices. First, singled out a target unit u in layer é (see below for details) and considered x* E X' the maximally exciting stimulus (i.e., the MEI) for our target unit, computed via 500 iterations of the XDREAM algorithm (Ponce al.] 2019). Our reference state for layer l was then ofef = T(x", [K) E R, i.e. the scalar activation of the target readout unit for its MEI. We then explored the set of solutions Esus as we varied
In particular, we can express both the search for adversarial attacks or invariant stimulus for our target unit ufarg as the following two optimization problems:
Einv arg min 2E
c Catretch (T (x) ((x"", "())),"))))))))"""""")"))"))"" +1 afarl
(5)
Exdy arg min #Ex
Lgqueezo (x, xd)) P(x=, x²))) ;))))-(as -lay afer
(6)
where we have used I' (ax, oG) = at and wrote L = o
This dual formalization reflects the fact that both invariance and robustness relate changes high order representations to changes at the input level (Fig.[p). However, remark that key flexibility of SnS is that its general formalization for the stretch and squeeze objectives allows computation not only in the input pixel space, but also in any intermediate representation stages and of the network. This allows probing invariance (or adversarial attacks) at different levels of feature abstraction.
For the characterization of invariance, set this representation space three distinct hierarchical levels within ResNet50: (i) = 0, i.e., the input pixel space (denoted low_levell 1). (ii) a mid-level convolutional layer (1st convolutional stage in layer 3, mi mid_leve layer (7th convolutional stage of layer 4, hi shigghleeww 1). Our primary target units v were chosen in the final readout layer (fully connected), as these units are selective for specific object categories, allowing us to study the invariance of the whole network to transformations of the image classes those neurons are tuned to. To demonstrate SnS's generalizability beyond category-selectiv units, we also performed optimizations targeting units within mid d_leveleeee___eeeeeee___ and high_leve, which are potentially more analogous to biological neurons the visual system. In these cases, the input-side restricted distance was computed in pixel space (i.e. A 0). For adversarial attack generation, our analysis to the configuration targeting readout layer units and defining input distance in pixel space. SnS optimizations were conducted on the units of two specific instances of ResNet50, subject network: the standard prageanee-retrriieee model available in PyTorch (Paszke et al. 2019).. and robust counterpart generated via adversarial training with Ta perturbation norm constraint
and (iii) deep convolutional
4

---

Published as a conference paper at ICLR 2026
Image
Generator
Codes
Subject Network
Robustness
Invariance
SqUeeee
sarger spacs
squeszze
stratch
ruprosentatton space
Neural Recordings
Gradient Free Optimization
Pamssoon nomber
The Stretch-and-Squeet (SnS) algorithm. (a) Overview of the SnS algorithm: candidate stimuli are synthetized from latent codes via the image generator, and the activation response of larget units is recorded and used fitness score by the optimizer, that adjusts Dual fitness objectives in SnS. To probe invariance (right), SnS maximizes stimulus distance from a reference in the representation space (stretch) and minimizes the variation in the activation of target unit (squeeze). Conversely, to synthesize adversarial examples (left), SnS minimizes changes in the representation space, while maximizing the variation in the activation of the target unit.
Figure I:
set of codes. (b)
of (Engstrom et al. 2019a). SnS invariances studied also in ResNet18 and VGG16_br bn (see Section 3.2) and Vision Transformers (ViT, see Supplementary Material, Section
Initialization strategies were adapted based the optimization goal: for adversarial attacks, the search was initialized from the MEI æ", for invariance experiments, initialization began from random normally distributed vectors. For additional details regarding the computational experiments we refer to Supplementary Material, Section A
3.2 INTERPRETABILITY OF THE INVARIANT IMAGES BY HUMANS AND OBSERVER NETWORKS
To assess whether the invariant images produced by SnS retain sufficient information for correct classification by other visual systems, we tested the ability of humans or other observer neural networks to classify them, using a 12-alternative forced choice task (AFC). We used several distinct pretrained architectures observer networks (ResNet18, VGG16 bn. 2, DenseNet161. ResNeXt50 _3xx4,2 Shufflenet_v2_xx 22_x1_0),,___ both standard obtained from Py Pyrchh (Paszke al., 2 and robust (all L2, 3), obtained from Salman al. (2020). To assess human recognizability of invariant images, we recruited 25 human participants using the online Prolific platform. Details on the procedures run these interpretability experiments reported in Supplementary Material, Section
imagrneet-retrrineed
RESULTS
4.1
SNS GENERATES EFTECTIVE ADVERSARIAL AND INVARIANT IMAGES
We first validated the SnS framework by generating invariant and adversarial images for a sample of 77 readout units of La-robust ResNet50 using their MEIs x* as reference images, and applying the stretching (to achieve invariance) or the squeezing (to achieve adversarial images) to the pixel representation (see Section 3.1). For each unit, 10 independent invariant and adversarial images were synthesized, each with a different initialization seed, and distance metrics with respect to the reference MEI were aggregated as the mean over the synthesized images. These metrics were then further aggregated across units mean + SD and reported in Fig. As shown in the figure, SnS successfully generated effective adversarial examples (top left). These stimuli substantially suppressed the activation of the readout units relative to their MEIs (mean reduction of 111% + 7%), being displaced from the MEIs by a mean Lg distance of 72 - 12 pixels. This relatively large pixel budget reflects both the network robustness and stringent unit-silencing objective stricter criterion than mere misclassification. Consistent with Tsipras et al. (2018) and Gaziv et al. (2023). perturbations semantically relevant, not noise-like (Fig.)
5

---

Published as a conference paper at ICLR 2026
The invariant images generated by SnS (bottom right of Fig. were also very effective, yielding only a minor drop of the units' activation relative to the MEIs (mean reduction of 34% = 11%). At the same time, they substantially departed from the MEIs, with mean L2 pixel distance (271 + 32 pixels) that considerably exceeded the median distance between ImageNet images, reported by Gazzy et al. (2023). More impressively, SnS discovered image transforma- tions that were more extreme (in terms of pixel distance) than those achieved by applying the MEI standard data augmentations (col- ored dots/lines), while altering the activation of the readout units substantially less than the most
140
mes mage La disteroe (iragehhen
Irvariance lask
Artverssral bask
Rotation 10" 45", 90", 138". 180")
extreme augmentations (darker dots). This in-
120-
Translation 10% 5%, 10% 25% 50%
dicates that SnS can discover the actual axes of
Activation decrement relative to
the most exciting image (%)
Scaling (0%, 20% 40%, 60% 80%1
image variation unit learned to tolerate, explor- ing invariance manifolds more precisely than traditional tests with predetermined (e.g., affine) transformations. The same result was obtained
100-
when applied SnS discover invariant and adversarial images for subset of readout units, but taking highly effective natural images as ref- erences instead of the MEIs (see Fig. SSh). See
60-
20-
also Fig. [S5p for additional examples of invari-
ant and adversarial images obtained using as references either MEIs or natural images. The
50
150
200
350
ability to obtain invariant and adversarial images enabled intrinsically by the dual loss formu- lation of the SnS optimization. Indeed, when images are synthesized using only one of the two loss components at time, results diverge drastically from those of SnS (see Fig. [S6 in Section Dof of the Supplementary Materials).
Euclidean distance from the MEI (pixels)
Figure 2: SnS generates effective adversarial and invariant examples. The average activation reduction (# SD) of n = 77 readout units of a L2- robust ResNet50 (relative to their MEIs) plotted against the L2 pixel distance from the MEIs, when the latter were transformed with SnS to yield either adversarial or invariant images, or were subjected to affine transformations (rotation, translation and scaling). The pixel distance refers to 224 224 RGB images with values between and 1.
Finally, we note that SnS successfully generated invariant images also for units in intermediate convolutional layers (Supplementary Material, Section D. This demonstrates its applicability to the analysis of latent representations that are more analogous to those of biological neurons.
4.2 SNS REVEALS SAYER-SPECIES INVARIANT MANIFOLDS
Next, we compared the kinds of invariant images that SnS discovered by stretching the MEI rep- resentations of the 77 readout units at different processing stages along a L2-robust ResNet50 ie. in the pixel space (as done in Fig. 2). as well as in an intermediate deep 1esyye___coovv convolutional layer. Qualitatively, this yielded different sorts of invariances (Fig. Stretching in the pixel-space produced mainly luminance and contrast changes; stretching mid-level representations mainly affected texture and color; stretching high-level representations tended to produce abstract variations like viewpoint changes or multiple object instances. The same qualitative differences were observed when SnS used produce invariant images for 77 readout units of standard ResNet50 (Fig. (3), although, in this case, the images appeared to be less inter- pretable than those obtained for the robust counterpart. Also, the images lacked the high -reeuuryy patterns that are typically found in the MEIs of standard networks units (Engstrom et al. 2019b). suggesting that the SnS generator strongly regularizes the image search towards natural statisties.
(_nyer3__ovv))) and a
The qualitative descriptions above are just approximate semantic labels to concisely describe image transformations that are, in fact, too rich and complex to be readily captured by a textual description (e.g., stretching in pixel space also produced size changes). To quantify these observations more objectively, we applied PCA to the invariant images yielded by SnS. We then used the first principal components feature vectors train Support Vector Classifier (SVC) to classify the invariant images according to the layer where the SnS stretching was applied (for details see Supplementary Material, Section A.4). As shown in Fig. 3. few components were enough to yield above

---

Published as a conference paper at ICLR 2026
(Robuct Reshiet50)
b
(Standard Res
NEI
Invariant Images
HCI
Invariant Images
Stratching in Planl Space
Stratching
Plut Space
Stretching Layes' owee
Stretching
Discrimation ion
Stancard -Iayer3_oom)
Standard Poell Space
Layera CORNS
Standord Laycr4_coww
Robust Plxal Space
Robust Layer3 convl
Streishing In Layead conet
Robust Layena conk?
Layart, conv?
Numreer of Princioal Components,
Figure 3: SnS discovers layer-specific invariances. (a) Example MEI and associated invariant images obtained for a readout neuron ("cup") in L2-robust ResNet50 and computed for three different choices of the stretching representational stages (rows). Multiple results are shown for different random initialization seeds (columns) (b) Same as (a) but for a standard ResNet50. (c) Accuracy of a SVC in discriminating the three classes of invariant images produced by stretching pixel-, mid-, and high-level representations as function of the number of principal components fed to the classifier.
chance performance (i.e., 33.3% correct), and few of components enabled near-perfect discrimination for the standard network (red) and above 80% correct for the robust network (green).
To characterize how the invariant images generated by stretching a given processing stage were represented across the network, we measured their L2 distance from their reference MEIs in the representation provided by each layer of the network (see Supplementary Material, Section A.5.2 for detail). In addition to demonstrating the effectiveness of SnS to explore invariances far away from their reference MEI and heterogeneous across multiple runs (see Section A.5.2 for detail), the representational distance between the invariant images and their MEIs was preserved in the layers that were adjacent to the one where the stretching was applied, revealing a clear hierarchical pattern (Fig. S3 a..). Stretching in the pixcl-space yielded invariant images that remained dissimilar from the MEIs the first layers of the network; stretching in mid and deep convolutional layers yielded images that were more different from the MEIs in the central and final portions of the network.
Yet another way to characterize the invariance manifolds is to estimate their intrinsic dimension (ID). We did so for an example readout unit of L2-robust ResNet50, using both PCA and 2NN-ID, state-of-the-art nonlinear estimator (Facco et al.] 2017) (see Section F in the Supplementary Material). 2NN-ID yielded ID estimates one order of magnitude lower than PCA, indicating that the geometry of the three manifolds was highly nonlinear (Fig. S8) Both methods, however, revealed a consistent ID ranking across stretching layers: lowest for the pixel space, highest for mid layers, and lower again for deep layers pattern mirroring previously reported trends in the ID of image representations across deep CNNs and visual cortex (Ansuini et al. 2019 Muratore et al. 2022a)
Hierarchical invariances are robust to representation subsampling. To assess SnS's applicability neuroscience, where only a small neuronal subpopulation is typically recorded from a visual area, we generated the invariant images using heavily subsampled hidden layer representations. Both qualitative inspection and representational distance analysis revealed that the resulting invariances closely resembled those obtained using the full layer representation, supporting SnS's potential for neuroscience experiments (see Supplementary Material, Section G for further details).
4.3 INVARIANT IMAGES FOR ROBUST AND STANDARD NETWORKS ARE PERCEPTUALLY DIFFERENT
We next evaluated how recognizable the invariant images generated by SnS were by humans and other CNNs. In our tests, invariant images for both kinds of networks (i.e., standard and Lg-robust) were generated by stretching the low- (pixel), mid- and high-level representations of the same set of natural images sampled from 12 different Imagenet categories (Fig. 4p) Human subjects performed a 12-AFC classification task on these invariant images, their reference images, and MEI controls (Fig. 44, top; for details see Section 3.2 and Supplementary Section (B). Invariant images from the robust network (all generation stages) were significantly more recognizable by humans than their standard network counterparts (Fig. 4b, compare the green to the red boxes; p 0.001, Supplementary
7

---

Published as a conference paper at ICLR 2026
Robust obeervers
Standard abservers
Steakh Wt.
Paan casta
Layer romet
Lappnt rowe?
Plan Lapery connt
Lopus coee
Robuat observers
Standard observers
100
Fadd $3900
Sandand
crrcet 2t tame
Rob
wost Aetivtt
Amsrectte Shel
0.2
Labe
Figure 4: Interpretability of the invariant images by humans and other networks. (a) Illustration of the human classification task with the invariant images generated by SnS for standard and L2- robust networks. (b) Classification accuracies of humans (averaged across subjects and categories) displayed for each experimental condition. (c) Classification accuracies across multiple Lz-robust (left) and standard (right) networks. (d) Correlation coefficient between average human performances and the performances of each observer model. For each architecture, the darker color indicates the robust model and the lighter color indicates the standard version. (e) Analysis from (c) extended to multiple architectures: ResNet50, ResNet18, and VGG16 bn. Solid lines indicate the average between different observer networks (translucent lines).
Invariant images from the L2-robust network were recognizable when stretching was applied to earlier-layer representations, with pixel-space stretching yielding the highest discrimination accuracy. Interestingly, an opposite trend was observed for the standard network: invariant images from a late layer were more recognizable than those from a middle layer or from pixel space (p 0.001 for each of the above comparisons: see Supplementary Material Table [2). These findings provide a more granular understanding of the perceptual misalignment between humans and CNNs, extending beyond what classic feature visualization tools can reveal with direct comparison of MEIs. In fact, human participants classified the MEIs obtained for the robust network (Fig.El Db cyan box) with an accuracy comparable that achieved on the natural images encoded by the corresponding readout units (Fig. Dp, blue box). By comparison, human classification of the MEIs obtained for the standard network was relatively poor (Fig- 4b. pink box). Therefore, considering only MEIs' interpretability. the L2 robustification process would seem very effective in increasing the alignment of image classification between ResNet50 and human observers. SnS reveals instead that this alignment gradually deteriorates when considering invariant images obtained by stretching the representation in progressively deeper layers, with the interpretabilityy gap between the robust and standard networks progressively narrowing. Interestingly, this also shows how SnS can uncover trends that are complementary to those found by previous approaches aimed at assessing invariance, such computation of metamers (Feather et al. 2023). Similarly, SnS provides complementary tool to test model alignment with human perception with respect to previous approaches which study alignment through model disagreement (Wang & Simoncelli, 20088) Golan et al., (2020), as well as to other approaches that have examined human interpretability of parametric image transformations at the pixel or patch level (Ullman et al. 2016, Malik et al. 2023).
Material Table $2
The same classification task was administered to various observer CNNs (both standard and Lz- robust). The alignment with the accuracy trends found in humans was relatively high for all robust observer networks (compare Fig. 4p to 4c.left, while their standard counterparts displayed a more heterogeneous degree of consistency with human choices (compare Fig. 4 to 4 rright). As a result, correlations with human perception were very high and statistically significant for all robust networks, but only for fraction the standard ones (Fig. (d). Similarly to humans, all Lg Lg-rubust observer networks better classified the invariant images obtained for Lg-rob ResNet50 than for its standard
8

---

Published as a conference paper at ICLR 2026
counterpart, with this difference narrowing for higher-order invariances. This demonstrates that, despite the L2 robustification process, the invariance landscape of ResNet50 readout units remained idiosyncratic and not fully generalizable to other human and artificial observers. This conclusion held true also when standard networks were used as observers, although, for some models, the interpretability gap between invariant images obtained for robust and standard networks was narrower (Fig. 4e. right), Similar trends were found when SnS was used to uncover the hierarchical invariances of two different subject networks (ResNet18 and VGG bn, again L2-robust and standard; Fig. 4b)
We also applied SnS to produce hierarchical invariant images for the readout units of -obbust ResNet50. In this case as well, we obtained layer-specific invariant manifolds that were easily separa- ble in pixel space (Fig. SSOOh and b). However, unlike Lp-robustification, L -robstificattinn yielded invariant images whose interpretability by -rouut observer networks remained consistently high or even increased with stretching depth (Fig. (STOp). This indicates that 7o adversarial training yields invariance manifolds that are, overall, more interpretable than those produced by L2 robustification.
To demonstrate the flexibility of the SnS framework, we performed the same interpretability ex- periment on invariant images evolved for readout units of a vision transformer (ViT). Similar to CNNs, the nature and interpretability of ViT invariances depended on the hierarchical level at which the representation was stretched. Invariances generated from pixel space were substantially less interpretable than those from mid- and high-level representations, which were remarkably similar and more interpretable. This observation aligns with the view that ViTs learn less strictly hierarchical and more globally-integrate features than CNNs (Dosovitskiy al. (2020); ; Fig. [$1 in Section of the Supplementary Material). Taken together, the results of Fig. 4 and Fig. [1 indicate that the level of transferability of the invariances obtained for the readout units of generator network depends on three key factors: 1) the architecture of the generator (i.e., CNNs vs. vision transformers); 2) its training procedure (robustified vs. standard, in the case of CNNs); and 3) the hierarchical stage at which the representation is stretched to produce the invariant images.
5 DISCUSSION
We introduced Stretch-and SS-ueeee,,,,, a novel, model-agnostic framework that reconceptualizes how we probe invariance of visual representations. Instead of testing pre-defined transformations (e.g.. affine) or imposing strict representational identity (as with metamers (Feather et al., (023)), SnS discovers the actual manifold of transformations a unit tolerates by maximizing stimulus dissimilarity in chosen representational space while preserving the target unit's activation. This exploration of functionally equivalent yet representationally distinct inputs allows SnS to map broader, potentially more "ecologically" relevant stretch of a unit's 's response manifold and its boundaries. Compared to other approaches aimed at uncovering invariant manifolds (Cadena et al. 2018 Baroni et al. 2023), SnS is distinguished by its gradient- and model- aagnol-aenoticc fornulation, a critical advantage for applications in neuroscience, especially in cases where reliable digital twin models are unavailable. Moreover, differently from these previous approaches, which have been applied to explore only the low-dimensional invariance fields of visual neurons in early processing stages (i.e, primary visual cortex), SnS operates in a highly expressive search space (i.e., the latent code space with dimension d = 4096), which imposes only a soft constraint on the dimensionality of the invariant manifolds. This allows sufficient expressivity to effectively map the complex invariant fields of high-order units, such as CNNs' readout neurons, thus characterizing the invariances of the entire model with respect to the object categories it has learned to classify.
The hierarchical application of SnS shows that CNN units in readout layers are not necessarily highly robust to the standard transformations (scaling, translation, etc) often applied to probe invariance (DiCarlo et al., 2012, Goodffllow et al. 2009 Kheradpisheh et al. 2016 Engstrom et al., 2019c) (Fig. 2 Rather, they strongly tolerate image changes along radically different axes of abstraction
(Fig. 3) from low-level properties (e.g., luminance) to mid-level features (e.g., texture) and, finally, to high-level semantic variations (e.g., object pose). This illustrates how the invariance is built hierarchically, and how this process is intertwined with the process of building feature selectivity in the first place: while sensitivity to increasingly complex combinations of visual features emerges across CNN layers, from the standpoint of a readout unit, it is the insensitivity to those same, increasingly complex visual properties that is progressively gained. In other words, while a visual

---

Published as a conference paper at ICLR 2026
system strives gain selectivity for increasingly complex visual features, it must also become invariant to those same features' combinations.
Our comparison of the invariant images generated for standard and robustly-trained ResNet50 extends prior work on the topic (Feather et al. 2023) with an innovative characterization. The superior semantic coherence and cross-system recognizability (by humans and other CNNs) of the invariances obtained for robust networks strongly corroborates that adversarial training sculpts representations
towards human-aligned perceptual features (Engstrom et al.) 2019b; Gaziv al. 2023 Feather
et al. 2023). However, unlike computation of MEIs or metamers (Feather et al. (023). J, SnS reveals additional trends that are consistent across all human and CNN observers: there are opposite trends for the interpretability of the invariant images generated for the Lg-robust and the standard networks as a function of stretching depth (Fig. f. e). Specifically, we show that stretching low-level representations invariances in robustly trained networks, whereas it produces poorly interpretable invariances in standard networks. Conversely, stretching high-level representations enhances interpretability in standard networks but decreases it in L2-robust networks. These trends are different from those obtained by testing the interpretability of metamers (see Table S3).. This is not surprising, given that metamers are invariant images that minimize the distance from target natural image in a given layer, rather than maximizing it, as SnS does. Thus, while SnS pushes the search for invariant images the boundaries of the invariance manifold, metamers explore much narrower neighborhood of the target image (see Table TS). Hence the complementary nature of the two approaches.
generates human-interprette
Finally, the model-agnostic and gradientless nature of SnS positions it as a powerful new tool for neuroscience, particularly for systems where high-fidelity "digital twins" may be hard to develop. Our demonstration of SnS's s efficacy with simulated sparse neural recordings directly addresses a critical experimental constraint, paving the way for in vivo applications. This could lead to the discovery of new, hierarchical invariances in biological visual systems, extending our understanding of visual object representations in both primates (DiCarlo et al. 2012 Ponce et al., 2019) and other species (Muratore et al. 2025 2022h Tafazoli et al. 2017] Tong et al. 2023: Soto & Wasserman 2016
Wood & Wood 2015 Schluessel et al. 2012).
Limitations and broader impacts. While SnS has proven effective in uncovering novel, meaningful invariances, it presents opportunities for refinement and broader application. One avenue is to use SnS for further, more extensive geometric characterizations of the invariance manifolds, expanding the work presented in Supplementary Material, Section[F] Another interesting direction is to apply SnS to characterize invariance in other modalities, such as audition, using a generator capable of producing audio waveforms or spectrograms from a low-dimensional latent code e.g. SpecGAN, WaveGAN (Donahue et al., 2018). Returning to the visual domain, work has demonstrated SnS' generative capabilities using eight different neural models (Fig. 4 and [SII]. belonging to three different architectural families, with parameter counts spanning roughly an order of magnitude (from 11.7M for ResNet-16 18 to 86.6M for ViT). This provides a strong test of our framework 's generalizability. although future work could test SnS with even larger models (e.g., DINO (Caron et al.. 202T). VIT22- B (Dehghani et al. 2023)). Finally, by pinpointing where the perceptual misalignement between robustified networks and humans is strongest (i.e., in higher-order invariances), SnS could guide the development of models that achieve more human-aligned invariance. For instance, one could design a visual diet where "good" (i.c., human- like) and "bad" (i.c., nonhuman- linke) invariant images are explicitly used in the training of the network.
In terms of application to neuroscience studies, while SnS' robustness to significant representational subsampling provides a strong foundation for its neuroscientifie applicability. the next step is direct validation in biological systems. Future research should focus on adapting SnS for in vivo experiments, addressing issues such as neural signal variability, the limited duration of neuronal recordings, and the need to optimize stimulus presentation in closed loop experiments, similarly to what was already achieved with XDREAM (Ponce et al. 2019). One challenge will be to leverage the wealth of neuronal data afforded by high-density silicon probes (Siegle et al. 2021).. that can simultancously record from hundreds to thousands of units. One strategy would be to apply SnS in parallel to multiple recorded neurons with non-olellap receptive fields (RFs), thus independently evolving the distinct portions of the image processed by each unit. Conversely, for neurons with overlapping RF's, one could first screen them using natural images (Ponce et al. (019) to search for subpopulations of units with similar selectivity, SnS could then be applied to the subpopulation to find the collective invariance field of the neuronal ensemble.
10

---

Published as a conference paper at ICLR 2026
REPRODUCIBILITY STATEMENT
To enhance the reproducibility of our research, we provide the following resources. The SnS algorithm is described in detail within the main paper's Methods Section 3.1 with its corresponding pseudocode available in the Supplementary Material (see Algorithm T). Furthermore, the complete source code used conduct the experiments is available at httpps//giiuub.coo/oooooooo low.//ocooooaaaaaaaSSS-- while experimental data were open sourced at Tausani et al. (2025). For clarity on our experimental setup, a general description of the experimental parameters can be found the methods section. For more granular understanding. further information methodological details, hyperparameter settings and the computational resources used reported in Supplementary Material, Section [A] The Supplementary Material also includes comprehensive section on the statistical analysis employed in our experiments (see Section B.I.
7 ETHICS STATEMENT
The human behavioral study was conducted under a pre-existing, approved Institutional Review Board (IRB) protocol. The task, which involved participants viewing images computer screen and making responses by clicking buttons, presented no more than minimal risk. Further details, including a complete reproduction of test instructions and information on participant compensation, are provided in Supplementary Material Section B
8 ACKNOWLEDGEMENTS
We would like to thank Sebastiano Quintavalle for his help in implementing the code, and Eu- genio Piasini for his suggestions the Pareto front optimization. This work funded by the European Union NexIGenerationEU NRRM4C2-I1LJ in the framework of the PRIN Project no. 2022WX3FM5,
(DZ), by NIGMS Award T32GM144273 (MT), by NIH grant R01EY02600 (GK), and by the NSF Center for Brains. Minds, and Machines NSF CCF- C2F-1231216 (GK). The content of this paper is solely the responsibility of the authors and does not necessarily represent the official views of any of the above organizations.

---

Published as a conference paper at ICLR 2026
REFERENCES
Alessio Ansuini, Alessandro Laio, Jakob H Macke, and Davide Zoccolan. Intrinsic dimension of data representations in deep neural networks. Advances in Neural Information Processing Systems, 32, 2019.
Luca Baroni, Mohammad Bashiri, Konstantin F Willekee Ján Antolik, and Fabian H Sinz. Learning invariance manifolds of visual sensory neurons. In NeurlPS workshop on symmetry and geometry in neural representations, pp. 301-326. PMLR, 2023.
David GT Barrett, Ari Morcos, and Jakob H Macke. Analyzing biological and artificial neural networks: challenges with opportunities for synergy? Current opinion in neurobiology. 55:55-64, 2019.
Mohammad Bashiri, Luca Baroni, Ján Antolik, and Fabian H. Sinz. Learning and aligning single- neuron invariance manifolds in visual cortex. In International Conference on Learning Represen- tations (ICLR), 2025.
Pouya Bashivan, Kohitij Kar, and James J DiCarlo. Neural population control via deep image synthesis. Science, 364(6439) 2019.
Yoav Benjamini and Yosef Hochberg. Controlling the false discovery rate: a practical and powerful approach multiple testing. Journal of the Royal Statistical Sociery: Series B (Methodological), 57(1):289-300, 1995.
Alexander Berardino, Valero Laparra, Johannes Ballé, and Eero Simoncelli. Eigen-distortions of hierarchical representations. Advances neural information processing systems, 30, 2017.
Santiago A. Cadena, Marissa A. Weis, Leon A. Gatys, Matthias Bethge, and Alexander S. Ecker. Diverse feature visualizations reveal invariances early layers of deep neural networks. In Proceedings of the European Conference on Computer Vision (ECCV), September 2018.
Mathilde Caron, Hugo Touvron, Ishan Misra, Hervé Jégou, Julien Mairal, Piotr Bojanowski, and
Armand Joulin. Emerging properties in self-supervised vision transformers, 2021. URL https/
//arxiv. wxrxiv.orc//bs/22106 14294
Francesco Croce, Maksym Andriushchenko, Vikash Sehwag, Edoardo Debenedetti, Nicolas Flam- marion, Mung Chiang, Prateek Mittal, and Matthias Hein. Robustbench: standardized adversarial robustness benchmark. arXiv preprint arXiv:2010.09677 2020.
Joel Dapello, Tiago Marques, Martin Schrimpf, Franziska Geiger, David Cox, and James DiCarlo. Simulating a primary visual cortex the front of cnns improves robustness to image perturbations. Advances in Neural Information Processing Systems, 33: 11110337787777 2020.
Joshua R De Leeuw. jspsych: A javascript library for creating behavioral experiments in web browser. Behavior research methods, 47:1-12, 2015.
Kalyanmoy Deb. Multi-objective Optimisation Using Evolutionary Algorithms: An Introduction, pp. URL
3-34. Springer London, 2011. ISBN 97808872965288. doi: 10. http://dx: doi. http://ww......r.........../3333
Mostafa Dehghani, Josip Djolonga, Basil Mustafa, Piotr Padlewski, Jonathan Heek, Justin Gilmer, Andreas Steiner, Mathilde Caron, Robert Geirhos, Ibrahim Alabdulmohsin, Rodolphe Jenatton, Lucas Beyer, Michael Tschannen, Anurag Amab, Xiao Wang, Carlos Riquelme, Matthias Minderer, Joan Puigcerver, Utku Evci, Manoj Kumar, Sjoerd van Steenkiste, Gamaleldin F. Elsayed, Aravindh Mahendran, Fisher Yu, Avital Oliver, Fantine Huot, Jasmijn Bastings, Mark Patrick Collier, Alexey Gritsenko, Vighnesh Birodkar, Cristina Vasconcelos, Yi Tay. Thomas Mensink, Alexander Kolesnikov, Filip Pavetić. Dustin Tran, Thomas Kipf. Mario Lučić, Xiaohua Zhai, Daniel Keysers, Jeremiah Harmsen, and Neil Houlsby. Scaling vision transformers to 22 billion parameters, 2023. URL /attps://arxe www.wawwwww....ooeeaaaaae..a.r /ts.///33333 05442
Misha Denil, Babak Shakibi, Laurent Dinh, Mare' Aurelio Ranzato, and Nando De Freitas. Predicting parameters in deep learning. Advances in neural information processing systems, 26, 2013.
12

---

Published as a conference paper at ICLR 2026
James J. DiCarlo, Davide Zoccolan, and Nicole C. Rust. How does the brain solve visual object recognition? Neuron, 73(3):415 434, February 2012. ISSN 0896-6273, doi: 10.1016//.neuron 2012.01.010. BRRh:tt:://at doi wttp:oo.og........11 10160...0111110 mee.oo 2012 01.00101100 010
Zhiwei Ding, Dat T Tran, Kayla Ponder, Erick Cobos, Zhuokun Ding, Paul G Fahey, Eric Wang, Taliah Muhammad, Jiakun Fu, Santiago A Cadena, et al. Bipartite invariance in mouse primary visual cortex. bioRxiv, 2023.
Chris Donahue, Julian McAuley, and Miller Puckette. Adversarial audio synthesis. arXiv preprint arXiv:1802.04208, 2018.
Alexey Dosovitskiy and Thomas Brox. Generating images with pereeptual similarity metrics based on deep networks. Advances neural information processing systems, 29, 2016.
Alexey Dosovitskiy. Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x16 16 words: Transformers for image recognition scale. arXiv preprint arXiv:2010.11999 2020.
Logan Engstrom, Andrew Ilyas, Hadi Salman, Shibani Santurkar, and Dimitris Tsipras. Robustness (python library), 2019a. URL htttts::/t/gtt/ti com www.////awaaa//o..o....o htt.:/aabbbbusttee...
Logan Engstrom, Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Brandon Tran, and Aleksander Madry. Adversarial robustness prior for learned representations, 2019b. URL https
Logan Engstrom, Brandon Tran, Dimitris Tsipras, Ludwig Schmidt, and Aleksander Madry, Exploring the landscape of spatial robustness. In International conference on machine learning, pp. 1802- 1811. PMLR, 2019c.
Elena Facco, Maria d' d'Errico, Alex Rodriguez, and Alessandro Laio. Estimating the intrinsic di- mension of datasets by minimal neighborhood information. Scientific reports, 7(1):12140, 2017.
Jenelle Feather, Guillaume Leclere, Aleksander Madry, and Josh H McDermott. Model metamers reveal divergent invariances between biological and artificial neural networks. Nat. Neurosci, 26 (11):2017-2034, November 2023.
Thomas Fel, Ivan F Rodriguez Rodriguez, Drew Linsley, and Thomas Serre. Harmonizing the object recognition strategies deep neural networks with humans. Advances in neural information processing systems, 35:9432-94444 9446, 2022.
Thomas Fel, Thibaut Boissin, Victor Boutin, Agustin Picard, Paul Novello, Julien Colin, Drew Linsley, Tom Rousseau, Rémi Cadène, Lore Goetschalckx, et al. Unlocking feature visualization for deep network with magnitude constrained optimization. Advances in Neural Information Processing Systems, 01137711-37822 2023.
Félix-Antoine Fortin, François-Michel De Rainville, Marc-André Gardner, Marc Parizeau, and Christian Gagné. DEAP: Evolutionary algorithms made easy. Journal of Machine Learning Research, 13:2171-2175, jul 2012.
Guy Gaziv, Michael Lee, and James DiCarlo. Strong and precise modulation of human percepts via robustified anns. Advances Neural Information Processing Systems, 36:65936-665 65947, 2023.
Tal Golan, Prashant Raju, and Nikolaus Kriegeskorte. Controversial stimuli: Pitting neural networks against each other models of human cognition. Proceedings of the National Academy of Sciences, 117(47)29330-29337. 2020.
Ian Goodfellow, Honglak Lee, Quoe Le, Andrew Saxe, and Andrew Ng. Mcasuring invariances in deep networks. Advances in neural information processing systems, 22, 2009.
Chong Guo, Michael Lee, Guillaume Leclere, Joel Dapello, Yug Rao, Aleksander Madry, and James Dicarlo. Adversarially trained neural representations are already as robust as biological neural representations. In International Conference on Machine Learning, pp. 8072-8081. PMLR, 2022.
13

---

Published as a conference paper at ICLR 2026
Nikolaus Hansen, Sibylle D Müller, and Petros Koumoutsakos. Reducing the time complexity of the derandomized evolution strategy with covariance matrix adaptation (cma-es). Evolutionary computation, 11(1):1-18, 2003.
Nikolaus Hansen, Youhei Akimoto, and Petr Baudis. CMA-ES/pycma Github. Zen- odo, 100::1005221//eooo225555555 zenodo 2559634
February 2019. URL htt.httt////i..r//1..000
Olivier Hénaff and Eero Simoncelli. Geodesies of learned representations. arXiv preprint 1rXiv:1511.069// 2015.
Jörn-eeriik Jacobsen, Jens Behrmann, Richard Zemel, and Matthias Bethge. Excessive invariance causes adversarial vulnerability, 2020. URL httphhttt:///att oww.//v..rrroooooooo
00401
James Jun, Nicholas A Steinmetz, Joshua H Siegle. Daniel J Denman, Marius Bauza, Brian Barbarits, Albert K Lee, Costas A Anastassiou, Alexandru Andrei, Çağatay Aydın, et al. Fully integrated silicon probes for high-density recording of neural activity. Nature, (5679)):2322223 2017.
Alexander JE Kell, Daniel LK Yamins, Erica N Shook, Sam V Norman-Haiigere,, and Josh H McDermott, A task-optimized neural network replicates human auditory behavior, predicts brain responses, and reveals cortical processing hierarchy. Neuron, 98(3):630-644) 2018.
Saeed Reza Kheradpisheh, Masoud Ghodrati, Mohammad Ganjtabesh, and Timothée Masquelier. Deep networks can resemble human feed-forward vision in invariant object recognition. Scientific reports, 6(1):3267,, 2016.
Daiichiro Kuroki.
new jspsych plugin for psychophysics, providing accurate display duration and stimulus onset asynchrony. Behavior Research Methods, 53:301-310, 2021.
Aravindh Mahendran and Andrea Vedaldi. Understanding deep image representations by inverting them. In 2015 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pp. 1198-5196... IEEE, June 2015. doi: 10. 00.10999cp:22015.2299555 URL http:http./....o doi. org/
10. 2110//VRR.... 2015. 7299155.
Girik Malik, Dakarai Crowder, and Ennio Mingolla. Extreme image transformations affect humans and machines differently. Biological Cybernetics, 117(4):331-343, 2023.
Giulio Matteucci, Eugenio Piasini, and Davide Zoccolan. Unsupervised learning of mid-level visual representations. Current Opinion in Neurobiology, 84:00433, 2024.
Paolo Muratore, Sina Tafazoli, Eugenio Piasini, Alessandro Laio, and Davide Zoccolan. Prune and distill: similar reformatting of image information along rat visual cortex and deep neural networks. Advances in Neural Information Processing Systems, 35:30206-30218 2022a.
Paolo Muratore, Sina Tafazoli, Eugenio Piasini, Alessandro Laio, and Davide Zoccolan. Prune and distill: similar reformatting of image information along rat visual cortex and deep neural networks, 2022b. URL /RRphtsss///axii wwwpxiivorrg/asss. 2205..11212111111616
Paolo Muratore, Alireza Alemi, and Davide Zoccolan. Unraveling the complexity of rat object vision requires full convolutional network and beyond. Patterns, 602):101149 February 2025. ISSN 2666-3899. doi: 10. ptt.1///..aaeer.222....... 1atter.2022.001149 patter. 2024 101149
htllhttt::/ddd doi.
Aran Nayebi, Nathan CL Kong, Chengxu Zhuang, Justin Gardner, Anthony M Norcia, and Daniel LK Yamins. Mouse visual cortex limited resource system that self-learns an ecologically-general representation. PLOS Computational Biology, 19110)e1011506, 2023.
Anh Nguyen, Jason Yosinski, and Jeff Clune. Multifaceted feature visualization: Uncovering the different types of features learned by each neuron in deep neural networks. arXiv preprint 2016.
Anh Nguyen, Jason Yosinski, and Jeff Clune. Understanding neural networks via feature visualization: A survey. Explainable Al: interpreting, explaining and visualizing deep learning, pp. 55-76, 2019.
14

---

Published as a conference paper at ICLR 2026
Chris Olah, Alexander Mordvintsev, and Ludwig Schubert. Feature visualization. Distill, 2017. doi: 0/139911dissiill0000077.
Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, Alban Desmaison, Andreas Kopf, Edward Yang. Zachary Vetoto, Martin Raison, Alykhan Tejani, Sasank Chilamkurthy, Benoit Steiner, Lu Fang, Junjie Bai, and Soumith Chintala. Pytorch: An imperative style, nigh-performance deep learning library. H. Wallach, H. Larochelle, A. Beygelzimer, F. d'Alché- Buc, E. Fox, and R. Garnett (eds.), Advances in Neural Information Processing Systems, volume 32. Curran Asso-
ciates, Inc., 2019, URL /t//httpss//prrreedddnss neurips cc ccppaper_ fi files// illesppaper 201 9/ fi
Carlos R Ponce, Will Xiao, Peter F Schade, Till S Hartmann, Gabriel Kreiman, and Margaret Livingstone. Evolving images for visual neurons using a deep generative network reveals coding principles and neuronal preferences. Cell, 177(4))99--0099, 2019.
Alexandre Pouget, Peter Dayan, and Richard Zemel. Information processing with population codes. Nature Reviews Neuroscience, 122):125-332, 2000.
Alec Radford, Jong Wook Kim, Chris Hallacy, A. Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, Gretchen Krueger, and llya Sutskever. Learning transferable visual models from natural language supervision. In ICML, 2021.
Hadi Salman, Andrew Ilyas, Logan Engstrom, Ashish Kapoor, and Aleksander Madry. Do adversari- ally robust imagenet models transfer better?, 2020.
08489
V. Schluessel, G. Fricke, and H. Bleckmann. Visual discrimination and object categorization in the cichlid pseudotropheus sp. Animal Cognition, 15(4):525-537, March 2012. ISSN 1435-9456. doi: 10. 10.10077110071-012--4888 F10071-012-0480
URL
012
Martin Schrimpf, Jonas Kubilius, Ha Hong, Najib J Majaj, Rishi Rajalingham, Elias B Issa, Kohitij Kar, Pouya Bashivan, Jonathan Prescott-Roy, Franziska Geiger, et al. Brain-score: Which artificial neural network for object recognition is most brain-like? BioRxiv, pp. 407007,
Odelia Schwartz, Jonathan W Pillow, Nicole C Rust, and Eero P Simoncelli. Spike-triggered neural characterization. Journal of vision, 6(4):13-13, 2006.
Tatyana Sharpee. Computational identification of receptive fields. Annual review of neuroscience, 36(1):103-120, 2013.
Joshua H Siegle, Xiaoxuan Jia, Séverine Durand, Sam Gale, Corbett Bennett, Nile Graddis, Greggory Heller, Tamina Ramirez, Hannah Choi, Jennifer A Luviano, et al. Survey of spiking in the mouse visual system reveals functional hierarchy. Nature, 592(7852):86 92, 2021.
Nicholas James Sofroniew, Daniel Flickinger, Jonathan King, and Karel Svoboda. A large field of view two-photon mesoscope with subcellular resolution for in vivo imaging. elife, 5:c 2016.
Fabian A. Soto and Edward A. Wasserman. Promoting rotational-invariance in object recognition despite experience with only single view. Behavioural Processes, 123:107-113, February 2016. ISSN 0376-6357 doi: 10. bewp::/.bpro...115.1.1.... URL URL http:://d http://xxxxd...ogg1/// doi.
Carsen Stringer, Marius Pachitariu, Nicholas Steinmetz, Charu Bai Reddy, Matteo Carandini, and Kenneth D Harris. Spontaneous behaviors drive multidimensional, brainwide activity. Science, 364(6437)xeaav783, 2019.
Christian Szegedy, Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv: 121.66/99 2013.
15

---

invariant object recognition. Frontiers in Neural Circuits, 9, February 2015. ISSN 1662-5110. doi: 2.3388/fnnirr.2155.000 Published as a conference paper at ICLR 2026
Sina Tafazoli, Houman Safaai, Gioia De Franceschi, Federica Bianca Rosselli, Walter Vanzella, Margherita Riggi. Federica Buffolo, Stefano Panzeri, and Davide Zoccolan. Emergence of transformation-toleraat representations of visual objects in rat lateral extrastriate cortex. eLife. 6, April 2017. ISSN 2050-084X. doi: 10.7554/elife.227944 URL.ttpp:
org/10
f5
Morgan B. Talbot, Gabriel Kreiman, James J. DiCarlo, and Guy Gaziv. L-wise: Boosting human visual category learning through model-based image selection and enhancement. International Conference on Learning Representations (ICLR), 2025.
Lorenzo Tausani, Paolo Muratore, Morgan B. Talbot, Giacomo Amerio, Gabriel Kreiman, and Davide Zoccolan. Stretching beyond the obvious: A gradient-free framework to unveil the 5281/
hidden landscape of visual invariance, September 2025.
.er.do.11199 17191755
Rudi Tong, Ronan da Silva, Dongyan Lin, Arna Ghosh, James Wilsenach, Erica Cianfarano, Pouya Bashivan, Blake Richards, and Stuart Trenholm. The feature landscape of visual cortex. November 2023. doi: 10.1101111111111111111111 10.1100// 1..03.5650000 URL 03. 565000
Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry, Robustness may be at odds with accuracy. arXiv preprint arXiv: urXiv:/805.12/52, 2018.
Shimon Ullman, Liav Assif, Ethan Fetaya, and Daniel Harari. Atoms of recognition in human and computer vision. Proceedings of the National Academy of Sciences, 113(10):2744-7499 2016.
Edgar Y Walker, Fabian Sinz, Erick Cobos, Taliah Muhammad, Emmanouil Froudarakis, Paul G
Fahey, Alexander S Ecker, Jacob Reimer, Xaq Pitkow, and Andreas S Tolias. Inception loops discover what excites neurons most using deep predictive models. Nature neuroscience, 22(12): 2060-2065, 2019.
Binxu Wang and Carlos R Ponce. High-performann evolutionary algorithms for online neuron control. In Proceedings of the genetic and evolutionary computation conference, pp. 1308-1316 2022a.
Binxu Wang and Carlos R Ponce. Tuning landscapes of the ventral stream. Cell Reports, 41(6), 2022b.
Binxu Wang and Carlos Ponce. Neural dynamics of object manifold alignment in the ventral stream. bioRxiv, pp. 2024-06, 2024.
Zhou Wang and Bero P Simoncelli. Maximum differentiation (mad) competition: A methodology for comparing computational models of perceptual quantities. Journal of vision, 8 8(12):8-8, 88, 2008.
Samantha M. W. Wood and Justin N. Wood. A chicken model for studying the emergence of
htLh:tt::/// doi. org 3389/ Encir 2015. 00007
Will Xiao and Gabriel Kreiman. Gradient-free activation maximization for identifying effective stimuli. arXiv preprint arXiv:1905.00378, 2019.
Will Xiao and Gabriel Kreiman. Xdream: Finding preferred stimuli for visual neurons using generative networks and gradient-free optimization. PLoS computational biology, 16(6):e100797) 2020.
Daniel LK Yamins and James DiCarlo. Using goal-driven deep learning models to understand sensory cortex. Nature neuroscience, 19(3):356-365, 2016.
Daniel LK Yamins, Ha Hong, Charles F Cadieu, Ethan A Solomon, Darren Seibert, and James J DiCarlo. Performance-optimizz hierarchical models predict neural responses in higher visual cortex. Proceedings of the national academy of sciences, 11 111(23):8619-8222 2014.
Ehud Zohary, Michael N Shadlen, and William T Newsome. Correlated neuronal discharge rate and its implications for psychophysical performance. Nature, 370(6485); 1994.
16

---

Published as a conference paper at ICLR 2026
Supplementary Material
A ADDITIONAL DETAILS REGARDING COMPUTATIONAL EXPERIMENTS
A.1 PSEUDOCODE FOR THE SNS ALGORITHM
Here present the pseudo-code (Algorithm T) for the SnS algorithm. We used library imple- mentations for the CMA-ES gradient-free optimizer (Hansen et al.) 2019) and the Pareto front computation (Fortin al. 2012). Importantly, introduce the following should lodlsl_soppp criteria for our experiments.
Optimizations were terminated by either reaching maximum iteration limit (500) satisfying early stopping rule derived from the target unit's response statistics to a large dataset of natural images (i.e., the full ImageNet train set, 1.2 million). In particular, given the vastness of the dataset, we assumed that the activation elicited by the most effective image in the natural dataset (a nat) represented conservative threshold for an image to considered invariant. On the other hand, the activation from the least effective image msin represents non-response level, functioning as a threshold for an image to considered adversarial. Therefore, when searching for adversarial images, termination was reached when large fraction (i.e., 2 90%) of the current population of images elicited activations at or below Linnn nut+ thus lcading to a non non-rossonneee responsive status. Conversely, when looking for invariant images after initialization from random noise, it was terminated when large fraction (i.e., 2 90%) of the population of images yielded activations equal or above a mmax_nat> _att thus reaching the desired high-activation regime.
In terms of computational complexity, both generator based image synthesis from latent codes and the extraction of activations from the target network require only a single feedforward pass per iteration, whose computational cost, while depending on network size, is negligible in practice for all the architectures examined in our study, which span roughly an order magnitude of parameter counts (from 11.7M for ResNet-18 18 to 86.6M for ViT). Consequently, the dominant computational bottleneck the CMA-ES optimizer, whose running time scales quadratically with the dimensionality d of the search space. In practice, however, this does not pose limitation: CMA-ES has been shown to highly effective method for gradient- free optimization of neural activity in vivo (Wang & Ponce (2022a), and it remains computationally efficient under our hardware configuration well (see Section A.6)
Algorithm SnS gradient- free optimization algorithm
Require: Φ
b Target network Image generator
Require: y
Require: T 2 0
Maximum number of iterations
Require: K. l 1, l........de de)th(o))
Require: Fret HxCC
Common choice is Fref
t+
ayef - (Irot, )m).))
N.f.
Eo -- (m))
while < T and learly_stop do
2₁ = $/ (E,)
D Compute new candidate stimuli > Measure activations in target layers ss
a= =1' (2t,
12' (2,, )x.e)
LK
stretch t-
a"
a
C
squeeze f- a" a Te
P +- compute compute_pareto front (Ee, Stretcch L
E + Svolve(P.E,
> Evolution strategy CMA-ES optimization
1++
early_stop <- should_stoy (a* aa) end while
17

---

Published as a conference paper at ICLR 2026
A.2 EXPERIMENTAL HYPERPARAMETERS
The generative model vo is instantiated as pretrained deep neural network variant, specifically the fc7 configuration from Dosovitskiy & Brox (201)). The choice of this model instead of alternative models, such as as large-scale GANs and diffusion models, was motivated by the fact that the latter impose very strong priors on the structure of the synthesized images, which risks evolving exceedingly complex photorealistic details that are unlikely to be encoded by units in low- and mid-level processing stages (Wang & Ponce 2024).
The CMA-ES optimizer is configured with the following hyperparameters:
Initial Step Size (oo): 1.0
Population Size: 50
The initial step size do determines the covariance of the sampling distribution the onset of optimization, effectively controlling the exploration radius in the latent space.
The population size specifies the number of candidate solutions (i.e. codes) evaluated per iteration.
Initial codes were randomly sampled from a Gaussian distribution (00 Tmit). The initial standard deviation, Tiit, was set to /0.01 x Eil where E|]larl is the mean absolute value of the reference code. For invariance experiments benchmarked against natural images, where direct reference codes were unavailable, initial codes were drawn from a standard normal distribution (N(001) 1)).
A.3 PARETO FRONT COMPUTATION
Multi-objective optimization often involves conflicting goals (e.g., stretching squeezing, see Fig. [. One way of dealing with such problems is by structuring the fitness function as a linear combination of the different optimization objectives (weighted-sum methods). However, these methods often require fine parameter tuning to prevent one objective from dominating. Unlike weighted-sum methods, Pareto fronts (PFs) handle trade-offs without parameter tuning. At each optimization iteration, candidate solutions (n=50) are ranked iteratively into PFs in the two-objective space. Each PF contains mutually non-dominant solutions (i.e. one is not better than another in both objectives). To get a full ordering, solutions are sorted within each front:
Invariance Experiments: In this scenario, solutions on the same Pareto front were prioritized based on their proximity to the target unit's ss reference activation level (min, || [(x, (²) - o l12).
This exploitative strategy was motivated by the empirical difficulty converging towards the target activation level while at the same time maximizing input distance.
Adversarial Attacks: Solutions on the same Pareto front were selected for the next generation with uniform probability (random ordering). This promotes exploration along the front, preventing premature convergence to a single type of adversarial strategy.
CMA-ES then updates its distribution using the best 30% of this ranking. At the end of the opti- mization, all solutions are used to compute global PF, which is thus fully data-driven (see Fig. ST for several examples). In our study, we analyzed only the last solution from this final PF for each experiment.
A.4 SEPARABILITY OF THE INVARIANT IMAGES IN THE PIXEL REPRESENTATION
To assess whether the representation spaces where the stretching was applied yielded sets of invariant images that were distinguishable at the pixel level, we performed an image classification analysis. We generated invariant images for n 77 readout layer units (i.e., ImageNet classes) by stretching the representations in three different processing stages: (f) low Low_level (pixel space), (ii) and (iii) high_level. For each unit and each representation space condition, we performed 10 independent optimization runs with different random seeds, yielding total dataset of 77 x 3 x 10 2310 images. Principal Component Analysis (PCA) was applied to the raw pixel representations of all images. The first l principal components were then used as input features to train a Support Vector Classifier with a radial basis function kernel to discriminate the class to which the invariant images belonged (i.e., low_ level, 1, mi d l,vel, or h high_ level) 5-fold cross- noss-validatiin was used.
18

---

Published as a conference paper at ICLR 2026
Activaaion decrement relative
the most exciting image?8)
42
29
43
44
24-
-0
Robust, unit 956
Robust, unil 118
Standard, unit
Standard, unit. 477
Aclivaaiio decr decremeett relalivee Lo
the most exciting (e6
100
120
100
100
60-
50
421
2
Φ + MEI (pixets)
8
8 Euclidean from (pixels)
Euclidean
Euclidean MEI (pixets)
Euclidean from MEI (pixels)
converged
non converged
Figure S1: Examples of solutions the final Pareto Front. Visualization of the final Pareto fronts for n example units in Invariance experiments (top) and 4 example units in Adversarial Attack experiments (bottom). In all reported experiments, targets were located in the readout layer, while pixel space used as lower representation space. The ordinate axis represents the activation reduction of readout unit of robust or standard ResNet50 with respect to the activation produced by a reference image (MEI), when SnS is applied to synthesize either adversarial or invariant images, while the abscissa represents the L2 pixel distance between these synthesized images and the reference. In the Invariance Experiments, SnS maintains a substantial fraction of the reference image activation (regardless of whether the optimization fully converges) while allowing the synthesized images to diverge markedly from the reference pixel space. Conversely, the Adversarial Attack setting, SnS reliably produces images that almost completely suppress the response of the target unit, yet remaining comparatively close to the MEI the pixel space representation. Note the different scale range of the abscissa and ordinate axes between the top and bottom plots.
A.5 OPTIMIZATION CONVERGENCE
A.5.1 SNS IMAGES FALL INTO FUNCTIONALLY RELEVANT ACTIVATION REGIMES
Although some optimizations terminated at maximum iterations (adversarial: 97.92% (ro- bust), 93.12% (standard); invariant: 63.38%, 35.71%, 21.30% (robust: 1ow_level, mid rid_level, high_level)), final populations consistently reached functionally relevant activation regimes. Most invariant images achieved activations within the top 0.1 % of natural image responses, being comparable or more extreme than the readout activation of images of the same category encoded by the readout target unit (Fig. b)) Adversarial examples drove activations the lowest 1st percentile of the natural images, thus significantly suppressing target unit activation with respect to average activation with natural image. As shown in Table this was true also when considering only those units for which the carly-stopping criterion was not reached, i.e., the optimizations that terminated at the maximum number of iterations (500). Moreover, as illustrated by the convergence curves in Fig. S2 b, the average trajectories of both optimization objectives (activation of the target readout units and Euclidean distance from the MEI in pixelspace) rapidly approached stable asymptotic values consistent with the respective optimization goals (i.e., invariant and adversarial). In particular, the Euclidean distance plateaued, indicating that the optimized images no longer underwent substantial changes after a certain number of iterations.
86.75%, 32.60% 5.84% (standard: low_ now_level, mid mid_level,
19

---

Published as a conference paper at ICLR 2026
Nor Normelized activatin
Layerd Layent,
120
300-
10:36e m16teectt 11.095
1.00
250
D0
200
60-
1.50
60-
100
20-
Invariance Adversaric
20-
200
500
Figure S2: SnS images fall into functionally relevant activation regimes. (a) Distributions of readout target unit activations (normalized by peak natural stimulus response) for SnS SnS-generated images: invariant (stretched at pixel, mid- high-levels) and adversarial (pixel-space). Each distri- bution pulls together all optimizations performed in that specific condition (n = 77 target neurons x random seeds = 770 experiments per condition). Comparison with natural image activations (same/different category) confirms that SnS invariant images elicit strong target responses, while adversarial examples achieve significant suppression. (b) The average convergence curves (# SD) for the experiments illustrated in Fig. (invariance and adversarial attacks, 770 per condition). Both optimization objectives (i.e., activation of the target units and Euclidean distance from the MEI function of iteration number. Both objectives converged stable asymptotic values consistent with the intended optimization target (i.e., the search for invariant or adversarial images). In particular, the Euclidean distance reached a plateau, indicating that the images no longer continued to evolve significantly following an initial period of convergence.
in pixel space) are shown
A.5.2 INVARIANT SOLUTIONS ARE MAXIMALLY DISTINCT FROM THEIR REFERENCES AND HETEROGENEOUS ACROSS MULTIPLE RUNS
To quantify how much the invariant images generated by SnS (when targeting a given processing stage) diverged from the reference MEI (x*) across the depth of ResNet50, we computed the Euclidean distance between their activation vectors at each layer of the network (Representational Distance Analysis in short). Again, 10 different invariant images were produced for 77 distinct readout units by stretching representations at layers low_level, mid_eeeel, and hi high_level We calculated the mean (#: SEM) Euclidean distance between each of these 77 x 10 invariant images and the corresponding reference images at every convolutional, pooling and linear layer of the network, separately for each stretching stage. Analogously, to quantify heterogeneity between different invariant solutions, for each aforementioned stage we measured the average pairwise distance between invariant images, then averaged across each target neuron (n 77). These distances were compared against three control metrics:
Reference Variability distance: Mean distance between all pairs drawn from 10 independent
XDREAM runs for each unit (n (19) 45 pairs per unit, 77) Within- Within-Category distance: Mean distance between pairs of images randomly sampled from the same ImageNet category (mean over 1000 categories, 10 images/category).
20

---

Published as a conference paper at ICLR 2026
Table S1: Mean activations of target units to SnS-synthesized images from optimizations that failed to converge. Reported activations are normalized by the response to the maximally activating natural image for the corresponding unit. N denotes the number of runs in which the early-stopping criterion was not reached for each experimental condition, out of total of 770 optimization runs per condition. Successful maintenance of activation levels Invariance runs would be indicated by positive activation values in the Mean column near to or exceeding I, while successful suppression of activity in Adversarial runs would result in low or negative values.
Experiment
Layer
Model Type
Mean
SEM
Invariance
low_leve
Standard
0.7682
0.0103
668
Invariance
mid_level
Standard
0.9581
0.0110
251
Invariance
high_level
Standard
0.9623
0.0233
45
Adversarial
low level
Standard
-0.1920
0.0027
718
Invariance
low low_level
Robust L2
0.8467
0.0056
489
Invariance
Robust L2
0.9104
0.0059
276
Invariance
high_level
Robust Lz
0.9271
0.0075
166
Adversarial
low_level
Robust L2
-0.1547
0.0036
755
Robust ReeNee55
Standand Reshwr50
EuctWoo relpme
Laver zenvi
Kunker maves
1.50
Japet mew?
Lapert uoee
00 00-2ine 020999 10 15000
Fbol space
Razue ND
Ruslspacs Lagari, Joorm?
Standart
2.00
2.30
Layeni,zovv
0.75
Figure S3: Representation of the invariant images across the feedforward hierarchy. (a) Average distance between the invariant images generated by SnS and their reference MEIs across the different stages of a robust ResNet50. Euclidean distances were normalized by the mean, vithin-category distance of Imagenet images. Different lines indicate the different stretching layers used in the optimization (also reported the axis). The average distance between randomly selected natural images from Imagenet (solid gray line) and the average distance between multiple MEIs generated via XDREAM are reported for comparison. (b) Same as (a) for standardly trained network. Normalized average distance between the invariant images generated by SnS across the different stages of a robust ResNet50. Different lines indicate the different stretching layers used in the optimization. The average distance between randomly selected natural images from Imagenet (solid gray line) and the average distance between multiple MEIs generated via XDREAM are reported for comparison. (d) Same (c) for standardly trained network.
Between-Categowe distance: Mean distance between pairs of images randomly sampled across all ImageNet categories (using the same total number of pairs as the within-category control).
In our analysis (see Fig. S3 we normalized all Euclidean distances by the mean, within-category distance of Imagenet images. Fig. S3 show that invariant images that were generated to be maximally different from the MEI in specific layer had the largest normalized distance in that layer, as compared to invariant images obtained by applying the stretching in other layers. Moreover, this distance consistently surpassed the one among natural images (both within the same category and randomly sampled) and multiple MEIs of the same unit, demonstrating SnS's ' efficacy in exploring larger spans of unit's invariance manifold, as compared searching multiple times for different
21

---

Published as a conference paper at ICLR 2026
MEIs. Moreover, Fig. S33-d show that distances between invariant images were significantly above O for all stretching layers (pixel space, mid, and late layers) in both standard and robust ResNet50, indicating substantial diversity between invariant images. Heterogeneity is lowest in the pixel space (standard: 0.69, robust: 1.03) and higher in the mid (standard: 1.24, robust: 1.66) and late layers (standard: 0.85, robust: 1.27). Interestingly, invariances in the mid-layers of both networks and those in the late layer of the robust network- are more heterogeneous than both random ImageNet pairs and multiple MEIs for the same unit. Instead, the invariant images in the late layer of the standard network exceed MEI heterogeneity, but not that of random ImageNet pairs. This heterogeneity is supported by SnS random initialization, which promotes broad exploration of the invariance landscape across multiple runs for the same unit and reduces the likelihood of converging to the same local minimum.
A.6 COMPUTATIONAL RESOURCES
All experiments reported in this work were executed on a Dell Precision 7960 Tower (Ubuntu 22.04.5
LTS) with the following configuration:
CPU: Intel (R) Xeon(R) w5-3425 (24 cores, 48 threads);
GPU: NVIDIA RTX A6000 (48 GB GDDR6);
System Memory: 128 GiB;
Storage: 8.2 TB.
On this setup, a full optimization of a single SnS run (500 iterations) lasted approximately 120 seconds. The complete source code used to conduct the experiments is available at https://ittub.comm/ocoo/ lab/SnS Moreover the experimental data is accessible via Tausani al. (2025).
B PROCEDURE TO PROBE THE INTERPRETABILITY OF THE INVARIANT IMAGES BY HUMANS AND OBSERVER NETWORKS
Thank you for your joining study! This task invotees making judgements about pictures.
To
white button of
you.
image.
Making accurate choices will incresse your boess payost, random guassing ig will lead borus and anding early.
The experier ent about 40 minuces long, Please feel free take breaks in between trials as reeded.
So me trits may be eatr emeey chi lenging or ambrguous, We connot guarantee that possibble choose sccuratety all cases.
We reserve the right end the expertment time.
bug teg,
contact
compensated your
your participation g. images you sea, resporse may publiidy sclence
support open
Your personal information on will remein confidentiel though anonymized cemographic information may be incuded in summary stat stics.
you wish, you may view our full consent for document hara.
By di cltig "Continue"" you voluntanty agree participant in our expertment and agree the rules above.
Continue
Figure S4: Instructions shown human participants. These instructions were shown to the participants at the beginning of the task.
For our interpretability experiments, we chose 12 ImageNet categories (goldfish. chickadee, frilled lizard, Dungeness crab, Staffordshi candle, grand piano, minibus, reflex camera, soccer ball, cup). For each cate- gory, we selected reference images ore and, for each of them, we generated one invariant image by stretching its representation in Now_levell mid _lveel, and high_level in both standard and robust ResNet50. This yielded kinds of invariant images per reference image, where invariance was always defined relative to the readout unit corresponding to the reference image's category. For each category, we also included in the classification pool the 10 reference images and 20 MEIs (generated with XDREAM) of the readout unit corresponding the chosen category (10 for the standard and 10
bull terrier, ei cicada,
22

---

Published as a conference paper at ICLR 2026
for the robust network). This yielded total of 12 categories x 10 randomly sampled images stimulus types (i.e., reference image, 2 MEIs and 6 invariant images). Observer networks had to classify all 1080 of these images; humans had to classify subset of 540 images (i.c., 5 rather than 10 randomly sampled images per category). Classification accuracy (12-AFC percent correct) was calculated for each of the 9 stimulus types. To assess the generalizability of our findings, we repeated the same experiment with invariant images generated by two additional architectures (ResNet18 18 and VGGI6 bn, in both standard and robust versions; see details above). The pool of observer networks was identical to the previous experiment. As for ResNet50, 3 levels of stretching were applied: Pixel space, mid level (VGGI6 bn: 2nd convolutional layer the 3rd block; ResNet- 18: 4th convolutional stage in layer 2) and high level (VGG16 3rd convolutional layer in the 5th block; ResNet-18: 4th convolutional stage in layer 4).
The psychophysies experiment administered to human participants was conducted as follows. After clicking on a fixation cross at the start of each trial, participants were presented with an image for 50 ms at ~00 of visual angle. After a 20ms blank screen, a backward mask image (random RGB pixel noise) was then presented for 200ms. Images were presented in random order. Participants then clicked one of 12 category buttons that subsequently appeared in cireular arrangement, with 10-second timeout (Fig. [a). To avoid directional bias, the sequence of category buttons was randomly rotated for each trial.
Participants for the human experiment were recruited using the online Prolific platform under a preexisting IRB protocol. Participants were compensated an overall rate calibrated to $15 USD per hour. To facilitate engagement with the task, compensation included I-cent bonus for each correct trial, and participants were shown green check after correct responses The typical bonus amount that participants would receive was overestimated based on pilot data. To adjust for this discrepancy, after recruitment for the study was complete, participants were uniformly provided with an additional bonus to bring compensation to the $15/hour level.
black "X" otherwise.
The main task was preceded by a screening phase, in which participants classified 24 natural images (2 per category), and were allowed to proceed if they correctly classified 2 1 image per category and 2 in total (maximum 3 attempts allowed per participant). Data from the screening phase were not included in any analyses. Participants who did not pass the screening phase were compensated for the time spent during the screening process.
The experiment posed minimal risks to participants. It is unlikely but conceivable that the brief presentation of images and masks could be hazardous to subset of individuals with photosensitive epilepsy: out of an abundance of caution, warning Prolific website to be viewed by participants before joining the study. To ensure consistent stimulus presentation, participants were required to complete the task desktop or laptop computer; access via tablets and smartphones was programmatically blocked. The title and description of the task on the Prolific website are reproduced follows:
shown in the description of the task on the
Title: Identify objects in photos, earn roughly $4.00 bonus for accurate responses
Description:
View 540 photos and identify the animal or other object in each photo. Earn a bonus for each accurate response, rypically around $4.00 USD in total (maximum $5.40).
PLEASE NOTE:
1. The task begins with a screening phase you must pass with a certain accuracy level before starting the experiment proper. You may re-an re-attempt the screening phase up to 2 times if you wish, but you will only be compensated for a maximum of 5 minutes spent in the screening phase.
2. Please avoid resizing the task window during the experiment, as this can break the task. It's best to maximize your browser window and get comfortable before starting.
WARNING: this task contains bright, rapidly flashing images: it is not suitable for individuals with photosensitive epilepsy.
Please see Fig. [S4 for the additional in-task instructions provided participants. The task was implemented using the JsPsych library (De Leeuw 2015) and the JsPsychPsychophyyies plugin (Kuroki 2021)
23

---

Published as a conference paper at ICLR 2026
Table S2: Statistical results from omnibus test (type II Wald chi-square) and post-hoe pairwise comparisons to test differences among stimulus types in the human image classification experi- ments. All p values are adjusted using the Henjamini-Hochheee correction, with significant values in bold.
Human subjects
Comparison
z-value
p-value
Omnibus test (effect of stimulus type)
<0.0001
Average Robust Stretch vs Average Standard Stretch
36.63
<0.0001
Robust layer4_comy vs Robust layer3_cone
4.94
<0.0001
Standard layer__comme _cnvvr vs Standard 1ayer3_conv
-8.41
<0.0001
Robust layer4_conv) vs Robust pixel space
-9.52
<0.0001
Standard layer4_comm __rer______o___ vs Standard pixel space
7.49
<0.0001
Robust layer3 _er___covll vs Robust pixel space
-4.66
<0.0001
Standard layer3 convl vs Standard pixel space
-0.99
0.32
Robust MEI vs Standard MEI
32.96
<0.0001
B. STATISTICAL ANALYSIS FOR CLASSIFICATION EXPERIMENTS
Analysis of data from classification experiments focused on identifying accuracy differences between 9 image types: natural images, MEI's from robust and standard networks, and invariant images from 3 different layers for both network types. We fitted a generalized linear mixed model (GLMM) with logistic link function for binary correct vs. incorrect trial responses, including random intercepts for participants and semantic image categories. We used an omnibus test (type Wald chi-square) to assess overall differences among the 9 image types. followed by 8 planned contrasts via estimated marginal means: (i) robust vs. standard MEIs, (ii) robust vs. standard invariant images averaged across the 3 representation layers, and (iii-vii) within each network type, all 3 possible pairwise comparisons between invariant types at different layers. Our analysis employed the Benjamini- Hochberg procedure control the false discovery rate under multiple comparisons (Benjamini & Hochberg 1995). The results of the planned comparisons are provided in Table S2
C SNS GENERATES EFFECTIVE ADVERSARIAL AND INVARIANT EXAMPLES FOR NATURAL IMAGES
We replicated the experiment reported in Section 4.1 (see Fig. 2 also in the case where, for target readout neuron, a highly effective natural image representative of the class encoded by the unit was used as reference for SnS optimization instead of a MEI. As for Section 4.1, both invariant and adversarial images were synthesized by stretching the pixel-level representation. considered the 12 readout units of robust ResNet50 encoding the 12 image categories used for the interpretability experiment with human observers (see Sections 3.2 4.3 and Supplcmentary Scction B). For each unit, both the adversarial and invariant experiment repeated for 10 different reference natural images, the same ones used for the interpretability experiment (for a total of 12 x 10 invariant images and 12 x 10 adversarial images). Example images shown Fig. S5p. bottom. Fig. [55 shows that, similarly to the experiment performed with MEI references (see Fig. 2}. both adversarial
these experiment,
and invariant images reached the desired functional activation regimes (i.e., for adversarial images: silencing the target unit without distancing too much from the reference image; for invariant images: departing substantially from the reference natural image, while the same time preserving the same level of activation).
D SINGLE-LOSS ABLATION EXPERIMENTS
To assess the functional contribution of each component of the SnS dual-loss objective (see Section 3.1 for detailed description), we performed set of ablation experiments in which optimized images using only one loss term at a time. We repeated the experiment shown in Fig. 2] in which readout unit is selected as the optimization target and pixel space is used the representation
24

---

Published as a conference paper at ICLR 2026
b
MEI
Activation decrement reference netural image
Adversaii
Rotstion
Transiation (0%, 0% 10%, 29% 60%s)
Scading (0%, 20% 40% 60%, 50%)
Invariant
80-
Adversarial
60-
Netural
20
Invariant
0-
-20
Adversarial
-50
50
100
150
200
250
300
350
Euclidean distance from the reference natural image (pixels)
Figure S5: SnS generates effective adversarial and invariant examples for natural images (a) As in Fig. 2 the ordinate axis represents the activation reduction of a readout unit of L2-robust ResNe150 with respect the activation produced by a reference natural image, when SnS is applied to synthesize either adversarial or invariant images, while the abscissa represents the L2 pixel distance between these synthetized images and the reference. In this experiment, differently from Fig. 2 the reference images were not the MEIs of the readout units but natural images belonging to the specific categories encoded by the units. Each data point reports the average (+ SD) of these metries across 12 x 10 image synthesis experiments, where 12 are the targeted readout units and 10 are the different reference images selected for each unit. (b) Examples invariant and adversarial images obtained for 5 readout units of L2-robust ResNet50, when the reference images were either their MEIs (top), as for the experiment shown in Fig. 2 or natural images (bottom), as for the experiment shown in (a).
space. For each target unit, synthesized images under four single-loss variants: 1) Squeeze-up: minimize the target unit activation distance between the synthesized image and the reference MEI; 2) Stretch-up: maximize the activation distance from the reference MEI; 3) Squeeze-down: minimize the distance of the synthesized image from the reference MEI in the pixel representation; and 4)
Stretch down: maximize such distance.
We used the same 77 readout units and 10 initialization seeds per unit as in the main experiments, resulting in 770 runs per single-loss condition. Squeeze-up and stretch-down followed the initializa- tion and Pareto-from sorting used for SnS invariances; squeeze-down and stretch-up followed the procedures used for SnS adversarial optimizations (see Sections A.3 and B.I.
Across all four variants, optimizing only one objective consistently failed to drive the other metric (activation distance or pixelspace distance) to its required regime (Fig. [S6). None of the single-loss optimizations produced solutions that simultaneously exhibit the trade-off characteristic of SnS invariant or adversarial synthesis. This demonstrates that the dual-loss formulation necessary for producing meaningful invariances and adversarial examples. Although the single-loss variants did not reproduce SnS behavior, each produced a characteristic synthesis regime that sheds light on the role of its loss component:
Optimizing only the squeeze term yielded images whose activation approached the invariant regime (i.e., close to the MEI's activation). but whose pixel-space distance remained near the distance of the initial random seeds (see the black curve in Fig S2p. right when iterations is equal to 0). This behavior mirrors repeated XDREAM optimization with multiple initializations, producing multiple high-activation images that differ from each other but do not explore the far boundary of the invariance manifold. The explicit maximization of representation distance (e.g., in pixel space) is the factor that drives invariant images far
Squeeze-up:
25

---

Published as a conference paper at ICLR 2026
away from its reference MEI, exploring the maximal invariant transformations within that representation space.
Maximizing the activation distance naturally pushed images to diverge in pixel space as well. The optimization suppressed the target unit by making the image increasingly dissimilar from the reference. This behavior essentially the opposite of SnS adversarial synthesis, where the unit is silenced with minimal pixel-space change.
Stretch-up:
Squeeze-down: Matching the reference MEI in pixel space also preserved the high activation of the reference. This optimization notably similar to that used for model metamers (Feather et al.) 2023), which enforce representation matching at internal layers. Thus, metamer synthesis emerges as special case of the SnS loss structure when the squeeze term is applied alone to the representation space.
Stretch-down:
Maximizing pixelspace distance alone caused images to diverge visually but produces no systematic change in target-unit activation. Indeed the activation of the target unit remained close to its initial value at the beginning of the optimization (see the black curve in Fig. S2p, left; iteration = 0), which very far from the one produced by the MEL. This confirms that stretch-down alone does not find images relevant to the unit of interest.
In summary, the single-loss ablations showed that none of the individual terms is sufficient to generate the invariant adversarial images produced by SnS. The dual-loss structure is es- sential, with each component stabilizing and constraining the other. These results further vali- dated SnS as principled framework for probing model invariances and adversarial directions.
Activatton decoenennt r rotrtio to mocet worthig mesgee (14
120
E SNS IS EFFECTIVE IN TARGETING UNITS IN HIDDEN LAYERS
Building upon our findings in Section 4.1 we extended the application of SnS to units within hidden convolutional layers. Unlike output layer units tuned to predefined classes, hidden units are hypothesized to function more analo- gously to biological visual neurons, responding features rather than com- plete objects. This makes them compelling tar- gets for deciphering learned internal representa- tions.
MEI
Sturch up
Stanet cove
Eudidean dislanco from the most aediing imago (pbools)
to intermediate-levs
Figure S6: Single-loss ablation experiments demonstrate the need of SnS dual loss. Com- parison between SnS adversarial and invariance experiment distances (same in Fig. 2 with the results of single loss optimizations (squeeze up, squeeze down, stretch up, stretch down). Each point corresponds to the mean + SD of 770 ex- periments (i.e. 77 readout units 10 random ini- tializations per each unit). The black dotted line represents the median image L2 distance among Imagenet images.
To investigate this, we conducted SnS invari- ance experiments targeting 50 distinct units in both layer3_cone and layer4_com of the ResNet50 network, using pixel space as the input representation. For each unit, we per- formed 10 optimization runs initiated with dif- ferent random seeds. In the standard network, SnS terminated by early stopping in 67. 67.20% of runs at 1ayer__come convi and 27.40% at 1ayer4_conv
the L2-robust network, convergence 87.80% and 89.40% respec- tively. Importantly, even non-converging in- stances, the optimization process often guided the input towards stimuli that elicited high unit activations, consistent with functionally relevant regimes identified through natural image statistics on ImageNet (Fig. (S7)).
Qualitatively, the SnS SnS-generated invariant images served as effective "feature visualizers." " This was particularly insightful as the precise selectivity of these hidden units is unknown priori. The
26

---

Published as a conference paper at ICLR 2026
Robust ResNet50 in Layer3_comm convi (mid level)
Standard ResNet50 target in Layer3_ conv1 (mid level)
MEIs
MEIs
Invariant images
Invariant images
Robust ResNet50 - target in Layer4_ conv7 (high level) d
Standard ResNet50 target in Layer4_conv? conv? (high level)
MEIs
MEIs
Invariant images
Invariant images
Normalized activation
Level Targets
Targets
High Level Targets (Natural
High Level Targets
Figure S7: SnS effective with targets in hidden layers (a) Comparison MEIs (top row) with SnS-generated invariant images (bottom row) for representative target unit in paaee3_ccov of robust ResNet50. SnS images, synthesized be invariant in pixel space, were generated using the green-hige highlighted MEI as reference. Red rectangles identify the unit's 's key responsive regions. This comparison highlights SnS's ability to distill the core visual features a unit detects, offering clearer insight than MEIs alone. (b-d) The same SnS-hased feature visualization approach (as in (a)) applied to different representative target units: (b)
of a standard ResNet50; (c)
Layer conv? of robust ResNet50; and (d) Layvr4_conv7 of standard ResNet50. (e) Final activation distributions for the target units from the SnS optimization in hidden layers. As in Fig. $2
convergence performance compared to natural image statisties
resulting visualizations clearly delineated the specific image features to which a target neuron was most sensitive (region of interest (ROI)), effectively isolating these core features from irrelevant contextual details (Fig. S7 a-d (bottom rows)). This level of feature disentanglement and clarity surpassed that observed images optimized by methods like XDREAM (Xiao & Kreiman 2020), which often retain more complex, less isolated visual elements (Fig. S7h-d (top rows)). Moreover, by comparing the reference image multiple invariant instances (i.e. initialized with multiple random
27

---

Published as a conference paper at ICLR 2026
seeds), the images revealed specific transformations the identified ROI could tolerate while preserving the unit's activation level, offering insights into the unit's s invariances (Fig. S7 (bottom rows)).
F SNS CAN BE USED TO STUDY INVARIANCE MANIFOLD GEOMETRY
SnS can be used to extensively sample the invariant manifold of target unit, paving the way to the analyses of its intrinsic dimension (ID) and geometric structure. To show the feasibility of this approach we selected single target readout neuron (the chickadee unit in the L2 robust ResNet50 readout layer) and extensively sampled its maximally invariant images across three different stretching layers (the same ones used in Section 4.2): pixel space (inpu//ow-level), Layer 1eyeer__covil __covvl (mid-level). and Layer4_coe __cvvvvcvv (high-level). For each stretching layer, we ran SnS 100 times for each of different reference MEIs (obtained from independent XDREAM runs), yielding 500 invariant images per layer. To estimate the ID of each invariance manifold, we applied two distinet techniques to the vector representations of the invariant images: 1) PCA, measuring the number of components explaining 95% % of the variance; and 2) neeinearsst-neighhoos intrinsic dimension Facco estimation (2NN-ID: Facco et al. )2017)) a state-of-the thrtt nonlinear estimator of intrinsic dimension that has been successfully applied to analyze image manifolds in both CNNs and visual cortical areas (Ansuini et al. 2019; Muratore et al. 2022a). 2NN-ID was computed for different subsamples of points (from = 50 to 500 invariant images), repeating the process 50 times for each cardinality.
These two approaches returned dimensionalities in very different numerical ranges: PCA required hundreds of components explain 95% of variance (from 230 to 340 PCs, Fig. (88), whereas the II) estimated by 2NN-ID ranged between 10 and 30 across the three manifolds (Fig. (8p). This radical difference in II) estimation between classic linear method (PCA) and 2NN-ID points the fact that the structures of all 3 manifolds are highly nonlinear (Facco et al. 2017 Ansuini et al. 2019). This aligns with expectations for neurons high in the visual hierarchy whose responses abstract over complex real-world transformations.
Despite differences in scale, both methods agreed on a consistent ordering of dimensionality across stretching layers: lowest ID for pixel-level stretching, highest for mid-level stretching, and reduced ID again for high-level stretching. This pattern mirrors previously reported trends in the ID) of image representations across deep CNNs (Ansuini et al. (219)) where ID initially increases, peaks in mid layers and then gradually diminishes in deeper layers. This result further reinforces the distinction between invariances uncovered at different stretching layers (Fig. 3 indicating the ability of SnS to discover axes variation that are distinct not only in qualitative terms (Fig. 3R), but also in their dimensionality.
SNS IS ROBUST TO SUBSAMPLING OF THE REPRESENTATION SPACE G
SnS, as a gradientless and -ogeo-agnostic method, offers significant advantages for neuroscience research, particularly in scenarios where constructing detailed "digital twin" models (as described in Section [ is impractical. However, a critical challenge for applying SnS to study hierarchical invariances the brain the inherent undersampling of representational spaces. Despite recent advances in electrophysiology and calcium imaging enabling simultaneous recording from hundreds or thousands of neurons (Jun et 2017 Sofroniew al. 2016), these recordings invariably capture only fraction of the total neural population within a given brain area.
To evaluate SnS's performance under conditions analogous experimental neuroscience, we inves- tigated how subsampling the representational space impacts the qualitative nature and quantitative characteristics (assessed via representational distance analysis, see Section A.3.2 for methodological details) of the invariances identified by SnS. Specifically, we focused on the same 77 readout target units previously analyzed in Section 4.2 For these units, we identified invariances after subsampling or 4_oov7 of the
their corresponding representational spaces (either 1 CNN) to either 1000 or 100 randomly selected units. To ensure robustness, this process was repeated 10 times for each target unit and subsampling condition, using different random selections of repre- sentational space units. As a reference, 1000 units represent 0.5% of the units in Saayeerr_coie (n 200704), while they constitute 4% of 1ayer4_conv? __covv (n 25088).
28

---

Published as a conference paper at ICLR 2026
b
Cumulative explained variance ratio
27.5
25.0
0.8
Estimated
20.0
17.5
0.4
Rie space
15.0
Layer3 conv1
Layork conv7 Explolined
12.5
0.2
Layert ponvt
veriance
10.0
Layard conv?
100
200
300
400
500
50
100
200
Number of principal com components
Number of points (log sca
Figure S8: Hierarchical invariance manifolds differ consistently in their dimensionality. (a) PCA estimation of the dimensionality of the invariance manifolds obtained for an example L2 robust ResNet50 readout unit by stretching the representations of the MEIs at different depths the network: low-level (pixel space), mid-level (Tayer3_comm The curves show the cumulative fraction of variance of each manifold (consisting of 500 sampled images) that was explained by considering (ranked according to their cigenvalue). For each stretching depth, the number of principal components necessary explain 95% of data variance (horizontal black dashed line) is indicated by color- specific vertical dashed line. (b) Dimensionality of the same invariance manifolds analyzed in a, but estimated using the nonlinear intrinsic dimension method 2NN-ID. The curves show the average intrinsic dimension + SEM, as obtained for increasingly larger sets of invariant images sampled from the manifolds.
and high-level (Iayer4_conv)
increasingly larger number of principal components
Our findings indicate that SnS is robust to such undersampling. Qualitatively, the invariances identified using subsampled spaces were comparable in their level of abstraction to those found using the full representational layer (Fig. (S9) and c). This suggests that the SnS optimization process effectively identified relevant axes of image variation even with reduced unit information. This qualitative observation was corroborated by quantitative representation distance analysis (Fig. SSp and d), which demonstrated a strong alignment in the progression of invariance discovery between analyses using full and subsampled layers. These results highlight SnS's potential for reliably characterizing neural invariances even when constrained by the partial observations typical of in vivo recordings.
plausible explanation for this robustness subsampling lies in the inherent representational redun- dancy present in both biological neural circuits and artificial neural networks. In biological systems, information is often encoded in a distributed manner across populations (Zohary et al. 1994 (Stringer
et al. 2019, where multiple neurons may carry similar or overlapping information, contributing to robustness against noise and cell loss (Pouget et al. 2000). Similarly, deep neural networks, including CNNs, have been shown to learn redundant features or possess anee-parameterization. where multiple units or weights contribute to similar computations (Denil et al., 2013). Consequently, sufficiently large and representative subsample of units can still capture the dominant computational characteristics and drive the overall representation into similar regimes as the full layer, explaining the observed consistency in identified invariances.
H SNS DISCOVERS LAYER SPECIFIC HIERARCHICAL INVARIANCES FOR L ROBUST MODELS
To assess whether hierarchical divergence in SnS invariances also arises under Loo robustification, we generated SnS invariances for an -robusttt ResNet50 (e = 4/255) from RobustBench (Croce et al. 2020) using the same n = 120 natural images and the same three stretching depths (pixel-space, level high-level) as in Fig. 4 Qualitatively (Fig, (S10a) and quantitatively (Fig. (S10)). layer- specific invariances in the L.- -robust model remained highly distinct and discriminable in pixel space, mirroring those already shown in Fig. 3 We then tested interpretability across observers by presenting
29

---

Published as a conference paper at ICLR 2026
Robust ResNet50 stretch in Layer3 conv1
MEI
Invariant images
Full
Eucildean distance reletvve
to samto catsoory variationn
Laywr canv2
Loyers convt NEI
2.00
Luyo 2ondd n- 1000
Bubsampiing
1.59
= 1000
0.75
Subsampling
Layer3 comv)
n 100
Representation space
Robust ResNet50 stretch in Layer4_comm conv?
d
MEI
Invariant images
layer
Euclidean distance relative
2.25
Liyer_.omn conn"
Layere_cen' 100
Layert_onnd
to category
1.75
1:50
Subsampling
1000
1.00
Subsampling
ZONU?
n 100
Represantation space
Figure S9: SnS invariance robust to subsampling of the representation space (a) Example MEI and associated invariant images obtained for a readout neuron (candle, e) in L2 robust ResNet50 stretching the mid level layer (i.c. Layer _ayer3_coovi), Each row represents examples for different levels of subsampling: using the full layer (1*t row), subsampled spaces of size n 1000 and 100 (2nd and 3rd rows respectively). Multiple results are shown for different random initialization seeds (columns). (b) Normalized average distance between the invariant images generated by SnS (stretching in Layer 3_ccvvl]_c and their reference MEIs across the different stages a robust ResNet50. Different lines indicate different cardinalities of units in the representation space used for optimization (i.e. all, n 1000 and n = 100). The average distance between multiple MEIs generated via XDREAM reported for comparison. (c-d) Same as (a) and (b) respectively, but stretching was performed on robust ResNet50 in the high_ level layer (i.c. [ayer4_conyy
-oobutt invariances to three architectures (ResNet-18, Wide-ResNNet5--2, ConvNeXt-Base each in standard (Paszke et al. 2019) and L versions (e = 4/255, also from RobustBench (Croce et al. 2020j). As in the Le setting, invariances from the Loe -rousst generator were more interpretable average than those from standard ResNet50, and interpretability again decreased when robust invariances were evaluated by standard networks (Fig. (S0g). Notably, however, when Lox invariances were judged by other -robusttst observers, classification accuracy either remained at ceiling or increased across stretching depths, suggesting that -rbuust networks share highly aligned invariance structure even deeper layers. This observation highlights promising directions for future work comparing invariances across robustness regimes, as well as in models whose robustness arises from perceptually aligned training strategies (e.g., harmonized neural networks (Fel al. 2022)) or biologically inspired architectures such as VOneResNet (Dapello et al. 2020).
I HIERARCHICAL INVARIANCES IN VISION TRANSFORMERS
One of the strengths of SnS is that, being gradient-free, it can easily be applied (literally out-of- the-box) to virtually any visual processing architecture (biological or artificial), as long as one can measure the responses of its units to the images produced by SnS optimization algorithm. In cases where the goal is to uncover the invariance of the whole model to transformations of specific object classes, the additional constraint to have access the responses of the readout units for those
30

---

Published as a conference paper at ICLR 2026
Pixol space
Mid loyer
layer
Robust observers
Standard observers
1.0
0.5-
Dtssiiinatinn Acpussoy
0-66
0.4-
Observer
0.2
Robust- Flos Space
Woskerlo00 2
Wodfarlerd0.
Standand
0.-
Tobual- Lapart came/
Natiral
Rool stice
Lese laper
Real soice
laver
Lete laper
Natural
scuce
Plwel syuce Lane
0.0-
26
10c
Law
Late
Number of Printppll Components
Figure S10: Invariances in Loo rrousst ResNe (a) Example invariant images obtained for a read- out neuron ("cup") in -robusst ResNet50 and computed for Pixel space, Layer __convl. Layer4_comm __coovvvv (rows). (b) Accuracy of SVC in discriminating the three classes of invariant images produced by stretching the aforementioned layers as a function of the number of principal components fed to the classifier. (c) Classification accuracies for Los -robust and standard ResNet50 invariances across multiple -robuutust and standard observer networks.
classes, As such, SnS can directly be applied to investigate the invariance of readout units in vision transformers (ViTs).
To test this application, we ran the experiments of Section 3.2 (observer networks only) on a ViT-B-16 16 model pretrained on ImageNet and crip-trained ViT-B-16 visual encoder (Radford et al. (021). Since the CLIPP model lacks explicit readout units, we trained linear classifier atop the frozen visual encoder for ImageNet classification to construct class-specific detectors (top validation accuracy: 78.94%). For both models, we considered the output linear layer of the MLP in the sixth encoder layer as mid-level layer and the one in the twelfth encoder layer as high level representation.
Our findings reveal that, similar to CNNs, the nature of the discovered invariances in ViTs depends on the hierarchical level the stretched representation. Stretching the pixel space primarily altered low-level properties such luminance, yielding invariances that were poorly interpretable (Fig. SIT a,b). Contrary to the experiments with ResNet50 (see Fig. a).,) where a clear, qualitative distinction was observable between invariant images stretched in mid and late layers, in both ViTs we did not observe such difference (see Fig. S11 b.. These images were also comparable in terms of invariance interpretability (Fig. () This observation is consistent with the view that ViTs learn less strictly hicrarchical representations than CNNs, and that these models integrate information more globally (Dosovitskiy al. 2020). Overall, there seems be little, but consistent across conditions advantage of the CLIP- CLinetrained version of ViT-B-16 16 in terms of interpretability. This trend seems to be similar between standard and robust network observers.
J SNS INVARIANCES AND METAMERS ARE STRUCTURALLY AND FUNCTIONALLY DISTINCT
To better contextualize SnS invariances within ofate-of-the-eee art techniques to probe invariances in neural networks, carried out systematic comparison between gradient-basee metamers. Metamers were generated using the original implementation Feather et al. 2023), including the same hyperparameter settings mentioned in the original paper. Metamers
invariant images and
31

---

Published as a conference paper at ICLR 2026
Robust observers
Standard observers
Invariant Images
1.0
T
Lersing
Accuracy
0.6
Observer nets
Garnanesica
Recneeiin
StulleenL
Vgg bn
0.2
Chance
Chance
Standard
Standard
0.0 Natural
ML MLP ee--nccderr 12
Prre space
MEl
6
ML Re--enooder ancoder 6
Natural
Mi MLP. e--encader 12
ME] Pirel space
6
Pirel Space
en--encceee G
MLL encoder
Piyel
MLL
Figure S11: Invariances in vision transformers. (a) Example MEI and associated invariant images obtained for readout neuron (cup) in standard ViT and computed for three different choices of the stretching representational stages (rows). Multiple results are shown for different random initialization seeds (columns) (b) Same as (a) but for VIT encoder trained via CLIP. (e) Classification accuracies for VIT invariances across multiple robust (left) and standard (right) networks.
were synthesized for the same 120 natural images used our behavioral experiment (Fig. yielding for each natural image one SnS invariant and one metamer at each of threc representational depths (pixel space, mid-level, high-level) both standard and L2-robust ResNet50 (for details see Section 3.J). First we compared metamers and SnS invariances in terms of interpretability. To do this, we replicated the experiment described in Fig. 4e with metamer stimuli. Using the same observer networks as in our main experiments (six architectures, each in both standard and L2-robust versions; n = 12 total (Section 4.3) ) we recovered results consistent with Feather et al.] (2023) (Table (S3). Specifically, metamers produced by the Lo-robust ResNet50 remained highly interpretable across observer models at all synthesis depths (pixel space, layer 3, layer 4). In contrast, Handard-netwoon metamers showed the expected sharp decline in interpretability for late-layer metamers (layer 4) across all observer networks. Critically, this pattern is the opposite of what we observed for SnS hierarchical invariances (Fig. 4- numerical values in Table (3)). Indeed, for standard networks, late-layer SnS invariances show a pronounced increase in interpretability. so much so that observer accuracies far exceed those obtained for late-layer metamers for the standard network.
second point of stark contrast between the two methods is that of average distances from the reference natural images from which both metamers and SnS invariant images were generated (Table [S4). Indeed, metamers are explicitly optimized to minimize representational distance to the target image at a given layer, whereas SnS invariances explicitly maximize that distance. As result, metamers lie much closer to their reference images than SnS invariances at all depths and for both standard and robust generator networks. For comparison, we also report the average pairwise distances between natural ImageNet images from the same class at the same three layers (i.e., within-category distance for the three representation stages, see Supplementary Section A.S.2). While metamers lie far below these natural-image baselines, SnS invariances systematically exceed them by wide margin (Table S4). In the context of the different image synthesis between the two methods, remind that, detailed in Supplementary Section D metamer-like stimuli arise special case of the SnS objective (i.e. the squeeze-down single loss variant in Fig. (66). this sense, SnS provides gradient-fit generalization of metamer-like synthesis, enabling analogous invariance characterizations in settings such as in vivo experiments where gradients are not accessible.
32

---

Published as a conference paper at ICLR 2026
Table S3: Interpretabilityy comparison between metamers and SnS hierarchical invariances. Classification accuracies (mean + SEM) of the standard and L2-robust observer networks used in the interpretability experiment (Fig. 4e), evaluated on images generated either as metamers or using SnS with both standard and Lg-robust ResNet50 as the generator network (Gen Net column). Metrics
reported for the three different representation layers used also in Fig, (Net Layer column). Note
that accuracy results for the metamers conditions in line with Feather et al. 2023).
Condition
Gen Net
Net Layer
Standard observers
Robust observers
Metamer
Standard
Pixel space
0.999 + 0.00122
0.989 = 0.00653
Metamer
Standard
Mid layer
0.939 + 0.01878
0.883 = 0.05348
Metamer
Standard
Late layer
0.310 + 0.02817
0.121 = 0.01388
Metamer
L2
Pixel space
0.998 + 0.00122
0.989 = 0.00653
Metamer
L2
Mid layer
0.997 + 0.00163
0.985 + 0.00816
Metamer
L2
Late layer
0.994 + 0.00245
0.990 + 0.00694
SnS
Standard Standard
Pixel space
0.397 + 0.087
0.224 + 0.014
SnS
Mid layer
0.476 0.099
0.256 0.022
SnS
Standard
Late layer
0.779 = 0.070
0,636 + 0.024
SnS
L2
Pixel space
0.843 = 0.052
0.936 0.040
SnS
L2
Mid layer
0.722 = 0.035
0.857 + 0.041
SnS
L2
Late layer
0.721 = 0.030
0.888 0.009
Table S4: Comparison of average distances with the reference natural image between metamers and SnS invariances. Mean + SEM are reported for each representation layer used the experiments (Pixel space, Mid layer, and Late layer of ResNet50 standard and Lg-robust variants). Distances between natural images belonging the same ImageNet category are reported as reference. For every network layer, SnS invariances yield substantially larger distances than both the natural- image baseline and the metamers.
Condition
Net Layer
ResNet50
ResNet50 (T2)
Metamer
Pixel space
0.7998 + 0.01523
0.7998 0.01523
Metamer
Mid layer
978.2 = 6.483
6.181 + 0.5169
Metamer
Late layer
356.8 + 10.48
8.254 : 0.9402
SnS
Pixel space
281.4 + 5.991
281.8 + 4.94
SnS
Mid layer
1935 = 8.864
371.8 = 2.603
SnS
Late layer
858.2 - 22.75
406.3 # 6.442
Natural
Pixel space
143.4 1.447
142.4 1.669
Natural
Mid layer
1478 8.138
201.3 : 2,268
Natural
Late layer
384.8 + 7.128
239.1 + 1.845
33


Reviews:
[{"review_id": "1917XfAfX4", "reviewer": "Reviewer_N9Ge", "summary": "The authors present a framework for examining invariances and adversarial vulnerabilities of a CNN representation, in which\nbase images are modified simultaneously to maximize euclidean distance to the base in one layer while minimizing it in another.\n\nThey demonstrate through examples that the method can generate adversarial and invariant images, and that these are recognizable by humans or other networks.", "questions": "See above.", "limitations": "", "rating": 2, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "The topic is important: the ML community needs tools for characterizing fundamental aspects of network function.\n\nThe general approach taken by the authors is well motivated and novel (although see below for some related literature that should be cited).", "weaknesses": "I like the conceptuatlization, but the construction of the method is ad hoc and not well explained, and the experimental results are somewhat anectdotal and not fully convincing.\n\nFirst, the method.  I thought I understaood the basic construction after reading abstract/intro, but then found the more precise description in the  Methods section confusing.  Some specifics:\n\n- Eq. (2) is a non-standard notation for a dual objective: Presumably one wants to either trade these two terms off (in which case they should be added, with a multiplier), or one wants to hold one fixed while minimizing the other.  Alternatively, one could take the quotient.  As written, I can't tell what was done for the examples in the papepr (see below).  \n\n- The methods section starts with description of a 3-component implementation, but provides no motivation for this. Specifically, why is there a need for a separate generative model?  Or a separate gradient-free optimizer?  I would think a unified algortihm, in which adjustments to the input are made by backpropagating gradients of the objective through the test network, would be easier to implenent, test, and interpret.\n\nThe empirical results:\n\n- The method is stated in intro/abstract as seeking perturbations that trade off the L2 norm of activations at two different levels {k,l} of a network. But as far as I can tell, all experiments set one of these \"levels\" to be the input (level 0), and it's not clear to me how one would interpret a tradeoff bertween two internal levels.  I think readers would be better served by defining the method with respsect to images, and mentinoning the potential generalization in the Dicussion.\n\n- The methods is defined in terms of the MSE of two layers, but most of the experiments seem to refer to individual readout units.  Why not MSE of the readout layer (or layer before)?\n\n- Figure 2 shows a single example image (an MEI), with a  corresponding adversarial and invarient example.  Although it succeeds in demonstrating that the optimization is pushing the examples in the right direction (the ratios of pixel MSE and readout reduction are opposite), the images do not seem  perceptually convincing. Why was an MEI used for this (rather than a photograph)?  Also, I can't understand why the vertical axis is not Euclidean distance in readout layer (as used in the objective).\n\n- Figure 3 shows examples of invariant images for a single MEI, computed for three different layers.  The text describes these as providing evidence that they corespond to luminance/contrast changes, texture/color changes, and viewpoint or multiplicity of object changes.\nI don't find this very  convincing: The first row includes color changes, size chnages and multiplicity changes.  The third row inclues color chnages\nAlso, not clear why MEI's were used for the base images in this experiment.\n\n- Since the combination of the two objective components is not specified, I could not understand the interpretation of the perceptual study. To make comparisons of performance on invariant images generated for different layers, it would seem essential to match the conserved objective (output layer?), rather than allow them to \"float\" along the pareto front (as described in end of sec 3.1).  Again, I could not find an explanation of how the two objectives were combined or controlled.  \n\n- Related work: the approach bears similarity to two methods that have been proposed for comparing models by searching for stimuli that best discriminate them (in some cases, holding one model fixed while maximizaing/minimizing the other): \"controversial stimuli\" (Golan et al 2020), and \"MAD competition\" (Wang et al 2008).  These should probably be cited in the \"related works\" section.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "sajycJJJH6", "reviewer": "Reviewer_oZyT", "summary": "The paper introduces Stretch-and-Squeeze (SnS), a gradient-free, model-agnostic framework to probe visual invariances and adversarial vulnerabilities in both DNNs and biological visual systems. SnS uses an evolutionary optimization strategy to get perturbations which stretch a representation, making it as different as possible, while squeezing a downstream activation, keeping it constant. Reversing these objectives will lead to adversarial examples. The authors claim an insightful finding with robust DNNs – invariant images are more human-recognizable at low levels but less so at deeper layers – which can be useful for further improving model adversarial robustness through human-model alignment.", "questions": "- How do you determine if optimization has converged? Do invariant images stabilize or do they continue to evolve? Some convergence curves would be good to see. \n- For CNN experiments where gradients are available, how do SnS-discovered invariances compare to those found via gradient-based methods? This would help validate the gradient-free approach. \n- Does the invariance found with different model architectures transferable? Are those more dependent on model architectures or training data or some other factors?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "- **Well-motivated framework, good practical value.** SnS focuses on understanding neural network representations, a fundamental challenge in the field. In comparison to prior works, SNS doesn’t look at unit activation but explore the space of transformations with well-grounded setting – a generative model, a test network, and a gradient-free optimizer. It is model-agnostic and gradient-free, particularly important with black-box models and neuroscience applications where gradient information is unavailable. It provides insights for model generalization and robustness. \n- **Comprehensive experimental evaluation and clear presentation.** The paper includes experiments with various architectures such as ResNet-18, ResNet-50, VGG16, ViT, as well as human observers with rigorous statistical analysis. This shows the generalizability of SnS. Figures (e.g., figure 1 and 4) are well-presented to illustrate the key concepts and findings. \n- **Interesting findings on adversarial training.** The divergent trends between robust and standard networks across layers (figure 4) is interesting. This hints that adversarial training does not uniformly improves human alignment and suggests that the robustness gain only align low-level, as opposed to high-level, invariances with human perception, which is informative for future investigation.", "weaknesses": "We thank the authors for submitting the paper to ICLR 2026! There are a few weaknesses listed below which I believe can make the paper better.\n- **Lack of analysis on computational cost.** The paper uses the covariance matrix adaption evolutionary strategy for d(=4096)-dimentional codes but didn’t provide analysis of computational requirements, convergence properties, or comparisons with other gradient-based methods. How does this scale with network depth or code dimensionality? These considerations can be useful in practice. \n- **Limited direct comparison to metamers or other invariance mapping techniques.** While the paper conceptually compares SnS with prior works such as metamers, empirical side-by-side comparisons would strengthen claims about its competence or unique coverage of the invariance space. \n- **Lack of analysis on invariance manifold geometry.** While SnS generates multiple invariant images (figure 3), there’s limited analysis of the manifold structure itself. Information such as intrinsic dimensionality or whether the discovered invariances concentrated in certain directions or are uniformly distributed would be worth looking into.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "SQ46LIholY", "reviewer": "Reviewer_ac3Z", "summary": "This paper introduces Stretch-and-Squeeze (SnS), a novel, gradient-free, and model-agnostic framework for systematically characterizing the invariance landscape and adversarial sensitivity of units in both artificial and biological visual systems. SnS frames these as bi-objective optimization problems using evolutionary algorithms (specifically CMA-ES) operating on the latent space of a generative model.\n\nFor probing invariance ($\\Xi_{inv}$), SnS seeks to maximize the distance (stretch, $L_{stretch}^{\\kappa}$) between a candidate image and a reference image in a chosen intermediate representation space ($\\kappa$), while simultaneously minimizing the change (squeeze, $L_{squeeze}^{l}$) in the activation of a target unit downstream ($l$). The dual objective is used for generating adversarial examples ($\\Xi_{adv}$).\n\n\nApplying SnS to standard and adversarially trained CNNs (ResNet50), the authors make several significant discoveries:\n\n1. Hierarchical Invariance: The nature of the discovered invariant images varied dramatically depending on the representation layer being stretched: pixel-level changes mainly affected luminance/contrast, mid-layers altered texture, and late-layers altered pose.   \n\n2. Interpretability of Robust vs. Standard Models: Adversarially trained (robust) networks yielded invariant images that were initially more human-interpretable than those from standard models. However, this advantage eroded or reversed at deeper layers: robust network invariances became less interpretable when stretching deeper, while standard network invariances became more interpretable.   \n\n3. Conclusion on Robustness: This suggests that adversarial training, while improving pixel-level perceptual alignment, fails to increase the interpretability of high-level invariances.  \n\nThe framework's versatility is demonstrated by its application to different CNN architectures (ResNet18, VGG16_bn) and Vision Transformers (ViT), and its potential utility in visual neuroscience experiments by showing efficacy even when only a small fraction of units are recorded.", "questions": "1. Can the authors elaborate on the choice of the generative model $\\psi$? Specifically, how might a different generative model (e.g., a modern diffusion model vs. the cited Dosovitskiy & Brox, 2016 model) affect the sampled invariant manifold, and have the authors explored this?\n\n2. The paper focuses on an $L_2$ robust ResNet-50 ($\\epsilon=3$). Would the striking hierarchical divergence in interpretability also hold for $L_\\infty$-robust models, which tend to learn different features?\n\n3. Given the bi-objective nature, the results rely on the final solution from the Pareto front. Could the authors provide a more detailed analysis or visualization of the entire Pareto front for a few example units to demonstrate the trade-off space between stretch and squeeze?\n\n4. The method is described as model-agnostic. Have the authors considered or experimented with non-vision applications, for instance, characterizing invariances in audio or text models?\n\n5. Authors should mention the IRB number at the end of the main text and consider releasing code on a public platform. Authors should also provide details on the training and hardware setup. \n\n6. Have the authors tested this approach with larger networks that ResNet and ViTs? The authors should write a remark if they cannot make a direct comparison. \n\n7. Have the authors considered evaluating the human alignment with any fMRI or EEG datasets (like Natural Scenes Dataset (NSD)), especially in case of the digital twin analogy? \n\n8. I understand the author information was redacted for anonymity from line 492 in the reproducibility statement. Just a reminder to fill it in for the final version.", "limitations": "", "rating": 6, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "* Originality and Technical Novelty: SnS is a gradient-free, model-agnostic framework for systematically exploring the full invariance manifold of a unit, moving beyond local measures or pre-defined transformations. The bi-objective optimization scheme is elegant and powerful, unifying the search for invariant images and adversarial examples.  \n\n* High Quality and Rigor: The experimental design is robust. The authors not only apply the method to a benchmark (ResNet50) but also validate the findings across different architectures (ResNet18, VGG16_bn, ViT) and use a multi-observer and human classification setup for interpretability.  \n\n* Clarity of Insight: The results are not just empirical observations but yield a deep conceptual insight: the stark, hierarchical divergence in interpretability between standard and robust networks at deeper layers. This challenges existing conclusions about adversarial robustness and perceptual alignment.  \n\n* Broad Significance: The technique is directly applicable to visual neuroscience, offering a method to probe biological neurons without relying on perfect \"digital twin\" fidelity, which is a major constraint in current gradient-based neuro-visual studies.", "weaknesses": "* Computational Cost: The reliance on evolutionary algorithms (CMA-ES) is a known trade-off for gradient-free and model-agnostic optimization. The computational cost can be very high, especially given the search space dimension ($n=4096$). While the results are excellent, the practical utility of SnS for very large-scale or high-throughput experiments may be limited compared to gradient-based methods.  \n\n* Generative Model Dependency: The quality and expressivity of the invariant images are fundamentally constrained by the generative model ($\\psi$) used. The authors assume a \"powerful prior\" is embodied in the model. The choice of generative model, and its potential bias on the invariant manifold, warrants further discussion or empirical analysis.  \n\n* Convergence Analysis: The paper notes that a significant percentage of runs did not reach the maximum iteration count (up to 86.75% for some standard network conditions). While the authors state the final populations still reached \"functionally relevant activation regimes\", a more detailed discussion on the impact of non-convergence or early stopping on the resulting Pareto front quality would strengthen the completeness of the method's presentation. \n\n* References: The authors also missed citing some critical works in this domain. For e.g. Extreme Image Transforms (EITs) [Crowder et al., 2022; Malik et al., 2023, Biol Cybernetics, Malik et al., 2023, arXiv] which present a novel view of structural changes in the input images, and MIRC [Ullman et al., 2016, PNAS] which present similar experiments with human and network observers. Authors should also mention a comparison of their method to that of EITs given they also make changes to the image space at varying levels and test against VOneResNet [Dapello et al., 2020, NeurIPS] that claims to explain the V1 variance, showing that EITs outperform VOneResNet by a significant margin.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "zXYNbA7fd1", "reviewer": "Reviewer_JP16", "summary": "This paper proposes a new method—Stretch and Squeeze (SnS)—for testing the invariance and adversarial sensitivity of neurons within deep neural networks. The approach can be applied to any two layers of a network to examine both upstream invariance and downstream adversarial sensitivity. The authors demonstrate that the SnS-generated invariant and adversarial images outperform those generated by simple affine transformations, and that these images better align with human perception. Applying this method also reveals differences between robust and standard models. The framework has potential applications for understanding the tuning properties of biological neurons.", "questions": "1. In the abstract, the authors claim that “adversarial training fails to increase the interpretability of high-level invariances”, but it is unclear how this conclusion was derived. It is just because its alignment with human perception is relatively low. This is interesting but why is the case? I understand the empirical observations, but I do not fully see how the presented results logically imply that adversarial training is ineffective. For example, in Figure 4C and 4E, differences between robust and standard models are apparent, but it remains unclear why these differences demonstrate the failure of adversarial training rather than simply reflecting distinct representational properties.\n\n2. The authors show that SnS can produce invariant and adversarial images that outperform those generated by affine transformations. However, an affine transformation may not be the most informative baseline. Since SnS involves two complementary losses (stretch and squeeze), it would be more convincing to compare it against a single-loss variant, such as using only the stretch term to generate invariant images. This comparison could more clearly highlight the contribution and necessity of the full SnS framework.", "limitations": "", "rating": 6, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 4, "strengths": "1. The study unifies the measurement of neural invariance and adversarial sensitivity into a single computational framework, which is conceptually novel.\n2. The proposed method could serve as a useful tool for probing biological neural properties in future neuroscience research.\n3. The writing is clear and the structure is easy to follow.", "weaknesses": "1. Although the paper is categorized under “Application to Cognitive & Neuroscience,” it does not actually include experiments or validations on biological neural data.\n2. The paper identifies differences between robust and standard networks but does not attempt to explain the origin or meaning of these differences.\n3. The figure quality can be substantially improved.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)