Mechanically evoked defensive attack is controlled by GABAergic neurons in the anterior hypothalamic nucleus

Innate defensive behaviors triggered by environmental threats are important for animal survival. Among these behaviors, defensive attack toward threatening stimuli (for example, predators) is often the last line of defense. How the brain regulates defensive attack remains poorly understood. Here we show that noxious mechanical force in an inescapable context is a key stimulus for triggering defensive attack in laboratory mice. Mechanically evoked defensive attacks were abrogated by photoinhibition of vGAT+ neurons in the anterior hypothalamic nucleus (AHN). The vGAT+ AHN neurons encoded the intensity of mechanical force and were innervated by brain areas relevant to pain and attack. Activation of these neurons triggered biting attacks toward a predator while suppressing ongoing behaviors. The projection from vGAT+ AHN neurons to the periaqueductal gray might be one AHN pathway participating in mechanically evoked defensive attack. Together, these data reveal that vGAT+ AHN neurons encode noxious mechanical stimuli and regulate defensive attack in mice. Xie et al. report that GABAergic neurons in the anterior hypothalamic nucleus control mechanically evoked defensive attack, an important survival behavior that is often the last line of defense against threatening stimuli (for example, predators).

I n response to environmental threats, humans and animals exhibit a cascade of innate defensive behaviors (for example, freezing, escape and defensive attack). These behaviors might occur as a function of physical distance of threats, as described by a classical model termed 'predatory imminence continuum' 1 . This model has been well supported by behavioral studies. For example, when a prey detects a distant cruising predator, freezing is usually the dominant form of post-encounter defensive behavior of prey 2 . In response to looming visual stimuli mimicking an approaching predator, prey rapidly escapes to avoid capture 3 . If a cornered prey is physically attacked by the predator, then a defensive attack is often provoked as the last defense in a struggle for survival 4 . Relative to the well-characterized neural circuits for freezing and escape in different brain regions (hypothalamus [5][6][7][8][9] , midbrain [10][11][12][13][14] , thalamus 15 and pons 16 ; for review, see refs. 17,18 ), the brain mechanisms for sensory-triggered defensive attack are poorly understood.
The medial hypothalamic zone (MHZ) was proposed to play a critical role in the expression of defensive behaviors, especially with respect to predators 19,20 . The MHZ includes the AHN, the dorsomedial part of ventromedial hypothalamic nucleus (VMHdm) and the dorsal pre-mammillary nucleus (PMD). Neurons in the VMHdm and PMD participate in defensive behaviors, such as freezing and escape [5][6][7][8][9]21 . A previous study showed that hamsters threatened by live snakes as predator showed a robust increase in c-Fos expression in the AHN 22 , suggesting that AHN neurons might be involved in anti-predator defensive attack. In this study, we explored the role of AHN neurons in encoding threat-relevant sensory information and regulating defensive attack in mice.

Results
Noxious mechanical stimulus to evoke defensive attack. To identify the key stimulus to provoke defensive attack, we performed five behavioral experiments in C57BL/6 mice. First, we examined the defensive responses of mice to a plastic dummy snake which was either coated with snake feces to provide predator-derived olfactory cues or equipped with an alligator clip to apply noxious mechanical stimuli ( Fig. 1a-d). Predator-derived olfactory cues on the dummy snake did not provoke defensive attack (Supplementary Video 1 and Fig. 1e) but promoted freezing, risk assessment and avoidance in mice ( Fig. 1f-h). When the alligator clip on the dummy snake applied a sustained mechanical force (366 g) by clamping the tail of mice, mice exhibited biting-like attacks toward the dummy snake (Supplementary Video 2 and Fig. 1i) without showing freezing, risk assessment or avoidance (Fig. 1j-l). The biting-like defensive attack provoked by the alligator clip clamping on the tail was similarly observed in the light (~50 lux) and dark (~0.002 lux) conditions, suggesting that visual detection of the alligator clip clamping the tail might play a minor role in provoking such defensive attack (Extended Data Fig. 1a,b). The noxious mechanical stimuli applied on the limbs of mice also induced robust biting-like attack toward the dummy snake (Extended Data Fig. 1c). Second, we found that the mice also exhibited biting-like attacks to neutral objects Mechanically evoked defensive attack is controlled by GABAergic neurons in the anterior hypothalamic nucleus (for example, plastic lid or wood block) when these objects were physically connected to a noxious mechanical stimulus (Supplementary Video 3 and Extended Data Fig. 1d,e). These data again underscored the role of noxious mechanical force as a general stimulus to trigger defensive attack. Third, we performed genetic ablation of Mrgprd + sensory neurons, a subset of non-peptidergic sensory neurons for noxious mechanical stimuli 23,24 , by expressing diphtheria toxin receptor (DTR) in Mrgprd + neurons. In the Mrgprd-CreERT2/iDTR/Ai3 mice 25-27 , tamoxifen injections and subsequent diphtheria toxin injections decreased (86% ± 7%, n = 7 pairs) the number of EYFP + neurons (putatively Mrgprd + ) in the dorsal root ganglion (DRG) (Fig. 1m). This genetic manipulation partially but significantly reduced biting-like attack in mice with the tail or limb clamped by the alligator clip (Fig. 1n,o). Fourth, we compared the behavior of mechanically evoked defensive attack in both male and female mice and did not find any significant difference between male and female mice (Extended Data Fig. 1f). Thus, we used male mice in the following experiments. Finally, we tested how the inescapable context affects mechanically evoked defensive attack. As the dummy snake (~163 g) is much heavier than mice, an alligator clip connected to it would hamper the escape of mice and thus creating a context with low escapability (Extended Data Fig.  1g, right). As a control, we used an alligator clip without a dummy snake to generate a context with high escapability (Extended Data Fig. 1g, left). We found that the time spent in mechanically evoked biting-like attack in the context of low escapability was significantly more than that in the context of high escapability (Extended Data Fig. 1h). We also examined how mice respond to an alligator clip in a large or a small arena which might represent a context with high or low escapability, respectively (Extended Data Fig. 1i). We found that the test mice spent much more time on biting-like attack toward the alligator clip in the small arena (10 cm × 10 cm) than in the large arena (25 cm × 25 cm) (Extended Data Fig. 1j). These data indicate that 'escapability' might be a critical determinant for mechanically evoked defensive attack in mice. Together, these multiple lines of evidence suggest that noxious mechanical force in an inescapable context might be a key stimulus to evoke defensive attack by mice.
vGAT + AHN neurons are required for defensive attack. Next, we tested the role of AHN neurons in mechanically evoked defensive attack. Fluorescence in situ hybridization (FISH) analyses (Extended Data Fig. 2a-c) indicated that the AHN neurons are predominantly vGAT + (92% ± 3.6%, n = 3 mice), and only a small proportion are vGlut2 + (8% ± 0.7%, n = 3 mice). To measure the contributions of vGAT + and vGlut2 + AHN neurons to mechanically evoked defensive attack, we employed vGAT-IRES-Cre and vGlut2-IRES-Cre mice to genetically manipulate these AHN neurons 28 . The specificity and efficiency of these Cre lines to label vGAT + and vGlut2 + AHN neurons were confirmed in control experiments (Extended Data Fig. 2d-o). We injected AAV-DIO-GtACR1-2A-EGFP 29 into the AHN of vGAT-IRES-Cre and vGlut2-IRES-Cre mice, followed by optical fiber implantation above the AHN bilaterally ( Fig. 2a and Supplementary Fig. 1a,b). The cell type specificity of GtACR1-2A-EGFP expression was confirmed in control experiments ( Supplementary Fig. 1c-f). The effect of photoinhibition on AHN neurons expressing GtACR1 was validated in acute brain slices (Fig. 2b). By recording electromyogram (EMG) from masseter muscles in freely moving mice 30 (Fig. 2c), we were able to measure the initiation and termination of biting bouts during defensive attack ( Supplementary Fig. 1g). We found that photoinhibition of AHN vGAT + neurons (473 nm, 2 s OFF/2 s ON, 10 mW) rapidly (latency = 0.82 s ± 0.12 s, n = 7 mice) terminated the ongoing biting attack provoked by noxious mechanical stimuli (366 g) (Supplementary Video 4 and Fig. 2d-f). By contrast, photoinhibition of AHN vGlut2 + neurons did not prevent mechanically evoked defensive attack (Fig. 2g-i). To test whether the requirement of AHN vGAT + neurons in mechanically evoked defensive attack is behaviorally specific, we performed a series of control experiments. We found that photoinhibition of vGAT + AHN neurons under the same conditions did not alter the time spent in biting food pellet in hungry mice ( Supplementary Fig. 1h). Moreover, photoinhibition of vGAT + AHN neurons did not affect the mechanical threshold of von Frey filament to induce withdrawal of hind paws ( Supplementary  Fig. 1i). Finally, inactivation of vGAT + AHN neurons failed to alter the latency to lick or jump of mice in a hot plate test ( Supplementary  Fig. 1j). These data suggest that the AHN vGAT + neurons are selectively required for mechanically evoked defensive attack in mice.
To further test the role of vGAT + AHN neurons in mechanically evoked defensive attack, we examined whether inactivation of these neurons abrogates defensive attack that is evoked by different mechanical forces. In C57BL/6 mice, the time spent in biting-like attack increased along with the increase in mechanical force level, a relationship that can be fitted by a Boltzmann curve (R 2 = 0.998 and χ 2 = 5.8) (Supplementary Fig. 1k). In this fitted curve, time spent in biting-like attack gradually increased and eventually reached a plateau, with a saturation value of ~68%. Then, we measured mechanically evoked defensive attack at different mechanical forces in vGAT-IRES-Cre mice without (Ctrl) and with (GtACR1) photoinhibition of vGAT + AHN neurons. Photoinhibition of vGAT + AHN neurons significantly decreased the time spent in mechanically evoked defensive attack ( Supplementary Fig. 1l). These data further support that vGAT + AHN neurons play a critical role in mechanically evoked defensive attack.
The AHN contains three subnuclei that are the anterior, central and posterior parts of the AHN (AHA, AHC and AHP). To examine how vGAT + neurons in these subnuclei contribute to mechanically evoked defensive attack, we implanted optical fibers above the vGAT + neurons that expressed GtACR1-2A-EGFP in the AHA, AHC and AHP, respectively ( Supplementary Fig. 2a). We found that photoinhibition of each subnucleus decreased biting bout number ( Supplementary Fig. 2b-d) and total biting time ( Supplementary  Fig. 2e-g). To compare their contributions to mechanically evoked defensive attack, we calculated the suppression index (SI) of biting bout number by dividing the biting bout number during laser ON Fig. 1 | Noxious mechanical stimulus to evoke defensive attack in mice. a, An example picture showing a plastic dummy snake equipped with an alligator clip to apply a noxious mechanical stimulus (arrow) to mouse tail. b-d, Behavioral ethograms of wild-type C57BL/6 mice exposed to a dummy snake only (b), a dummy snake coated with snake feces (c) and a dummy snake equipped with an alligator clip to apply a noxious mechanical stimulus to mouse tail (d). The colored bars in the ethograms indicated the onset and offset of specific behaviors. e-h, Quantitative analyses of time spent for biting-like attack (e), freezing (f), risk assessment (g) and avoidance (h) in response to the dummy snake without and with snake feces. i-l, Quantitative analyses of time spent for biting-like attack (i), freezing (j), risk assessment (k) and avoidance (l) in response to the dummy snake without and with the alligator clip to apply a noxious mechanical stimulus. m, Example micrographs of the DRG of Mrgprd-CreERT2/iDTR/Ai3 mice treated with saline or diphtheria toxin. n,o, Time spent for biting-like attack in mice without and with ablation of putative Mrgprd + DRG neurons evoked by a noxious mechanical stimulus on tail (n) or on left forelimb (o). Number of mice is indicated in the graphs (e-l,n,o). Data in e-l, n, o are means ± s.e.m. (error bars). Statistical analyses in e-l, n, o were performed by two-sided Student's t-tests (*P < 0.05; **P < 0.01; ***P < 0.001). For P values, see Supplementary Table 4. The experiment (m) was repeated seven times independently with similar results. Abl, ablation; Ctrl, control. by that during laser OFF. Similarly, the SI of total biting time was defined as the total biting time during laser ON divided by that during laser OFF. Interestingly, we found that photoinhibition of vGAT + AHC neurons resulted in smaller SI of biting bout number ( Supplementary Fig. 2h) and total biting time ( Supplementary Fig. 2i

AHN vGAT + neurons are activated by mechanical stimuli.
To examine whether vGAT + AHN neurons respond to noxious mechanical stimuli, we expressed jGCaMP7s in these neurons (Fig. 3a-c) and recorded GCaMP fluorescence using fiber photometry 31,32 in various behavioral contexts that were not related to social interaction. In freely moving mice, the GCaMP fluorescence of vGAT + AHN neurons slightly but significantly increased at the initiation of locomotion in the arena (1.36% ± 0.21%, n = 7 mice; Fig.  3d-f,m). By contrast, a clip that clamped the tail of freely moving mice robustly increased the GCaMP fluorescence (10.5% ± 1.04%, n = 7 mice; Fig. 3g-i,n). In a control experiment, fluorescence from EGFP-expressing vGAT + AHN neurons was not changed by a clip that clamped the tail of freely moving mice (Extended Data Fig. 3a-c,m), suggesting that the GCaMP7 fluorescence changes were not artifacts caused by movements of mice. The GCaMP fluorescence of vGAT + AHN neurons was modestly but significantly increased at the initiation of biting attack (1.63% ± 0.23%, n = 7 mice; Fig. 3jl,o). We also observed a mild but significant increase in GCaMP fluorescence during risk assessment to snake (Extended Data Fig.  3d-f,n), during object exploration (Extended Data Fig. 3g-i,o) and during noxious thermal stimuli in the hot plate test (Extended Data Fig. 3j-l,p).
We also recorded vGAT + AHN neurons in a series of social contexts. The GCaMP fluorescence of vGAT + AHN neurons was robustly increased when the mice were physically attacked by the CD1 aggressor (Extended Data Fig. 4a-c,j). By contrast, these neurons were only modestly activated during social investigation toward male mice (Extended Data Fig. 4d-f,k) or female mice (Extended Data Fig. 4g-i,l). When we combined the above data, we  found that vGAT + AHN neurons were preferentially activated when the mouse tail was clamped by a clip in non-social context (Fig. 3p) and when the mouse was physically attacked by the CD1 aggressor in social context (Fig. 3q). These data suggest that AHN vGAT + neurons are preferentially activated by noxious mechanical stimuli.
Single AHN vGAT + neurons encode mechanical stimuli. To test whether single vGAT + AHN neurons encode mechanical stimuli, we expressed ChR2-mCherry in these neurons and performed single-unit recording with an optrode in the AHN of head-fixed awake mice ( Fig. 4a and Extended Data Fig. 5a). The putative vGAT + AHN neurons were identified according to the action potentials (APs) evoked by light pulses (473 nm, 1 ms, 10 mW) illuminating on ChR2-mCherry + AHN neurons. The light-evoked APs had to conform to two criteria: first, their latencies to the light pulses should be less than 5 ms; second, their waveforms should be similar to those of spontaneous APs 33 . With these empirical criteria, we identified 15 units from five mice as putative vGAT + AHN neurons. Their light-evoked APs had short response latencies (2.7 ms ± 0.4 ms, n = 15 units; Fig. 4b) and possessed waveforms quantitatively correlated with those of spontaneous APs (Extended Data Figs. 4c and 5b). Next, we examined the responses of these 15 putative AHN vGAT + neurons to mechanical and olfactory stimuli. Mechanical stimuli (366 g) were applied by clamping an alligator clip onto the mouse tail (Fig. 4d). Snake feces coated on a cotton swab was used to provide predator-derived olfactory stimuli (Fig. 4e). The putative vGAT + AHN neurons responded to both mechanical stimuli and olfactory stimuli (Extended Data Figs. 4f and 5c). However, the responses to mechanical stimuli were significantly stronger than those to predator-derived olfactory stimuli ( Fig. 4g; one-way ANOVA, P < 0.001). These data confirmed the GCaMP results that vGAT + AHN neurons preferentially respond to mechanical stimuli.
To quantitatively test how AHN vGAT + neurons encode mechanical force, we used von Frey filaments (1 g, 10 g or 100 g) to poke different body parts of mice (Fig. 4h). The 15 putative AHN vGAT + neurons responded to von Frey filaments poking on the tail in a graded manner (Fig. 4i) and preferred stronger mechanical force (1 g versus 10 g, P < 0.001; 10 g versus 100 g, P < 0.001; n = 15 units, one-way ANOVA; Fig. 4j). Moreover, these neurons also responded to mechanical stimuli delivered to four limbs, with a bias toward the contralateral side (Fig. 4k). They exhibited clear adaptation in response to repetitive mechanical stimuli at 0.5 Hz (Fig.  4l). Recording sites marked by electrolytic lesion were all located within the three subnuclei of AHN (Extended Data Fig. 5d). The peak z-score of units in the AHA, AHC and AHP showed mild differences (Extended Data Fig. 5e). Together, these data suggest that vGAT + AHN neurons encode mechanical stimuli on the body surface.
Mapping monosynaptic inputs of AHN vGAT + neurons. With recombinant rabies virus (RV), we next performed monosynaptic retrograde tracing 34 to examine how vGAT + AHN neurons are connected to brain areas associated with mechanical stimuli or attack behavior (Fig. 5a-c). A brain-wide survey revealed a series of monosynaptic projections to the vGAT + AHN neurons (Fig.  5d,e). First, robust monosynaptic inputs arose from the lateral parabrachial nucleus (LPB) and paraventricular thalamic nucleus (PVT) (Figs. 5d1,d2), two brain areas that are directly innervated by TAC1 + spinal neurons for pain-related defensive behaviors 35 . Moreover, the LPB is also innervated by Tacr1 + and Gpr83 + neurons that might be involved in pain-related defensive behaviors 36,37 . Consistent with these anatomical results, we found that simultaneous chemogenetic inactivation of LPB and PVT neurons impaired the mechanically evoked defensive attack (Extended Data Fig. 6ae). Second, vGAT + AHN neurons were monosynaptically innervated by neurons in the VMH and lateral septal nucleus (LS) (Fig.  5d3,d4), both of which have been related to attack behaviors in mice (VMH 38 and LS 39 ). Third, consistent with the observation that AHN vGAT + neurons modestly responded to predator-derived olfactory cues, we found that these neurons receive sparse innervations from the medial amygdala (MA) (Fig. 5d3), which convey olfactory signals from the accessory olfactory bulb to hypothalamic nuclei 40 . Fourth, AHN vGAT + neurons are monosynaptically innervated by neurons in the posterior hypothalamic nucleus (PH), PMD, ventral premammillary nucleus (PMV) (Fig. 5d5) and subiculum (S) (Fig. 5d6). These data supported the hypothesis that vGAT + AHN neurons are within a brain network for mechanically evoked defensive attack.
AHN vGAT + neurons trigger defensive attack. Next, we tested whether activation of vGAT + AHN neurons is sufficient to trigger defensive attack behavior. We injected AAV-DIO-ChR2-mCherry into the AHN of vGAT-IRES-Cre mice, followed by implantation of optical fibers above the AHN (Fig. 6a). The cell-type specificity of ChR2-mCherry expression in vGAT + AHN neurons was confirmed in control experiments ( Fig. 6b and Supplementary Fig.  3a). The effectiveness of photostimulation to trigger AP firing in ChR2-mCherry + AHN neurons was validated in acute brain slices (Fig. 6c). In a group of mice (n = 6), we found that light stimulation of vGAT + AHN neurons significantly enhanced mechanically evoked defensive attack toward the dummy snake (Supplementary Video 5 and Fig. 6d-g), which was monitored by EMG recording (Supplementary Fig. 3b). Then, we measured mechanically evoked defensive attack at different mechanical forces in mice without (Ctrl) and with (ChR2) optogenetic activation of vGAT + AHN neurons and found that activation of vGAT + AHN neurons significantly increased mechanically evoked defensive attack ( Supplementary  Fig. 3c). In another group of mice (n = 7), light stimulation of vGAT + changes (ΔF/F) of an example mouse before and after the initiation of locomotion. g,h, Schematic diagram (g) and an example trace of normalized GCaMP fluorescence changes (ΔF/F) in a mouse that received noxious mechanical stimuli applied with a clip (h). Red vertical lines in the ethogram indicated the application of noxious mechanical stimuli. i, Averaged GCaMP fluorescence changes (ΔF/F) of an example mouse before and after the initiation of noxious mechanical stimuli. j,k, Schematic diagram (j) and an example trace of normalized GCaMP fluorescence changes (ΔF/F) in a mouse that exhibited biting attack toward a dummy snake in the presence of mechanical pain (k). The red trace indicates the EMG recorded from masseter. l, Averaged GCaMP fluorescence changes (ΔF/F) of an example mouse before and after the initiation of biting attack. m-o, Quantitative analyses of GCaMP fluorescence changes (ΔF/F) of vGAT + AHN neurons in seven test mice before and after the initiation of locomotion (m), mechanical stimuli (n) and biting attack (o). p,q, Comparisons of GCaMP responses of vGAT + AHN neurons to distinct behaviors or stimuli in non-social context (p) and social context (q). Data in f, i, l, m-q are means ± s.e.m. (error bars). Number of mice (m-q) is indicated in the graphs. Statistical analyses (m-o) were performed by two-sided Student's t-tests (***P < 0.001). Statistical analyses (p,q) were performed by one-way ANOVA (**P < 0.01) and Tukey's honest significant difference test (***P < 0.001). For P values, see Supplementary Table 4. The experiment (a) was repeated seven times independently with similar results. AHN neurons also rapidly (latency = 2.7 s ± 0.4 s, n = 7 mice) provoked biting-like attack toward the live snake (Supplementary Video 6 and Fig. 6h-j). The light-evoked biting-like attack was a function of laser power and frequency of light stimulation ( Supplementary  Fig. 3d,e). Moreover, we found that light stimulation of vGAT + AHN neurons suppressed other defensive behaviors, such as risk assessment (Fig. 6k), avoidance ( Supplementary Fig. 3f) and freezing ( Supplementary Fig. 3g). The same photostimulation also evoked biting-like attack to the wood block (Supplementary Video 7 and Supplementary Fig. 3h-k), which was reminiscent of the earlier observation that neutral targets linked to noxious mechanical stimuli also evoked defensive attack (Extended Data Fig. 1e). One important concern about the specificity of biting-like attack evoked by vGAT + AHN neurons may be raised. Activation of vGAT + AHN neurons might broadly provoke an aggressive state that drives the mice to attack any target without target specificity. To address this concern, we examined how light stimulation of vGAT + AHN neurons might affect social aggression. Unexpectedly, Although light stimulation of vGAT + AHN neurons did not evoke social attack or mounting, it increased the time spent in social investigation of conspecifics ( Supplementary Fig. 4d,i,n). To measure the priority level of light-evoked biting attack to predator and social investigation to conspecifics, we performed two additional experiments. First, in an arena with both snake and male conspecifics ( The vGAT + AHN-PAG pathway triggers defensive attack. Next, we explored the efferent pathways of vGAT + AHN neurons involved in defensive attack by injecting AAV-DIO-EGFP-Synaptobrevin2 (Syb2) into the AHN of vGAT-IRES-Cre mice (Extended Data Fig. 7a,b). Consistent with a previous study 41 , we found that the AHN vGAT + neurons divergently projected to different brain regions ipsilaterally, including the medial preoptic area, LS, VMH, PMD, ventrolateral periaqueductal gray (vlPAG) and other areas (Extended Data Fig. 7c-g). To functionally validate these divergent projections, we injected AAV-DIO-ChR2-mCherry into the AHN of vGAT-IRES-Cre mice and performed slice physiology (Extended Data Fig. 8a). In acute brain slices, light reliably evoked GABAergic post-synaptic currents from neurons in the above brain areas, and these currents were almost completely abrogated by GABAa receptor antagonist picrotoxin (PTX; Extended Data Fig. 8b-f). Both the vlPAG and LS have been implicated in attack-related behaviors in mice (vlPAG 30,42 and LS 39 ). Thus, we tested whether activation of vGAT + AHN-vlPAG or AHN-LS pathway would evoke defensive attack behavior. AAV-DIO-ChR2-mCherry was injected into the AHN of vGAT-IRES-Cre mice, followed by optical fibers implanted above ChR2-mCherry + axon terminals in either the vlPAG ( Fig. 7a and Extended Data Fig. 9a) or the LS ( Fig. 7d and Extended Data Fig. 9e). Light stimulation of vGAT + AHN-vlPAG pathway reliably provoked biting-like attack toward the live snake (Fig. 7b,c) and suppressed other defensive behaviors (Extended Data Fig. 9b-d). By contrast, activation of vGAT + AHN-LS pathway failed to induce biting-like attack toward the snake (Fig. 7e,f and Extended Data Fig.  9f-h). These data suggest that vGAT + AHN-vlPAG pathway might participate in defensive attack in mice.
To rule out the possibility of collateral activation, we performed two experiments. First, we examined whether the biting-like attack evoked by vGAT + AHN neurons could be blocked by infusion of PTX in the vlPAG. AAV-DIO-ChR2-mCherry was injected into the AHN of vGAT-IRES-Cre mice, followed by implanting an optical fiber above the AHN and cannulae above the vlPAG ( Fig. 7g and Extended Data Fig. 10a). In behaving mice, delivery of PTX (100 μM) through cannulae (Extended Data Fig. 10b) blocked the light-evoked biting-like attack in a dose-dependent manner (Fig.  7h,i). As a control, delivery of saline did not alter light-evoked biting-like attack (Extended Data Fig. 10c). Second, we examined whether the biting-like attack evoked by vGAT + AHN-PAG pathway could be blocked by infusion of tetrodotoxin (TTX) in the AHN. AAV-DIO-ChR2-mCherry was injected into the AHN of vGAT-IRES-Cre mice, followed by implanting an optical fiber above the vlPAG and cannulae above the AHN ( Fig. 7j and Extended Data Fig. 10d). In behaving mice, delivery of TTX (10 μM) through cannulae did not block the light-evoked biting-like attack (Fig. 7k, l). Together, these two lines of evidence to some extent ruled out the possibility of collateral activation and suggest that vGAT + AHN-vlPAG pathway might be one of AHN circuits that participate in mechanically evoked defensive attack.
To determine whether vGAT + AHN-vlPAG pathway is required for mechanically evoked defensive attack, we performed two experiments. First, we injected AAV-DIO-GtACR1-2A-EGFP in the AHN of vGAT-IRES-Cre mice, followed by optical fiber implantation above the vlPAG (Fig. 8a,b). Photoinhibition of vGAT + AHN-vlPAG pathway significantly impaired mechanically evoked defensive attack behavior ( Fig. 8c-e). In control experiments, light illumination on EGFP-expressing axon terminals of AHN vGAT + neurons in the vlPAG did not change mechanically evoked defensive attack ( Supplementary Fig. 6a,b). Second, we injected AAV-DIO-hM4Di-mCherry into the AHN of vGAT-IRES-Cre mice, followed by implanting cannulae above the PAG (Fig. 8f,g). Infusion of clozapine N-oxide (CNO, 10 µg ml −1 ) through the cannulae to the hM4Di-mCherry + axon terminals in the vlPAG significantly impaired mechanically evoked defensive attack ( Fig. 8h-j). In the control experiment, CNO infusion to mCherry + axon terminals in the vlPAG did not change mechanically evoked defensive attack ( Supplementary Fig. 6c,d). These two lines of evidence, again, suggest that vGAT + AHN-vlPAG pathway might be one of AHN circuits that participate in mechanically evoked defensive attack.

Discussion
In response to environmental threats, humans and animals exhibit a cascade of innate defensive behaviors (for example, freezing, escape and defensive attack). Relative to the well-characterized neural circuits for freezing and escape, the brain mechanisms underlying defensive attack are poorly understood. In this study, we explored how the brain regulates sensory-triggered defensive attack in mice.
Noxious mechanical stimuli to evoke defensive attack. By using a dummy snake combined with different sensory stimuli, we showed that noxious mechanical force is a key stimulus to evoke defensive attack (Fig. 1). The pivotal role of noxious mechanical force in defensive attack was further supported by a significant reduction of biting-like attacks in mice with genetic ablation of Mrgprd + sensory neurons, which might participate in behavioral responses to noxious mechanical stimuli 24 . The ablation of Mrgprd + neurons did not completely abrogate mechanically evoked defensive attack, probably because they are only a subset of non-peptidergic sensory neurons for mechanical stimuli 23 . It is likely that other types of nociceptors might also be involved in mechanically evoked defensive attack-a hypothesis that remains to be determined in future studies. Unlike mechanical force, snake feces coated on the dummy snake to provide predator-derived olfactory cues 40 failed to evoke defensive attack. Instead, the olfactory cues promoted other defensive responses (for example, freezing, risk assessment and avoidance), an observation consistent with previous studies 43, 44 .
vGAT + AHN neurons are critical for defensive attack. The MHZ has been proposed to play a critical role in anti-predator defensive behaviors 19,20 , thus prompting us to look for neural mechanisms underlying mechanically evoked defensive attack in this brain area. We found that the activities of AHN vGAT + neurons in the MHZ are selectively required for mechanically evoked defensive attack (Fig.  2). These neurons preferentially responded to noxious mechanical stimuli applied by alligator clip (Fig. 3) and physical attack from a CD1 aggressor (Extended Data Fig. 4). Their activities encode the intensity of mechanical force delivered onto the contralateral side of the body (Fig. 4). However, given the state/context-dependent properties of survival circuits, the data combined from divergent experiments should be interpreted cautiously (Fig. 3p,q). Why, then, do these neurons respond to noxious mechanical stimuli? We found that vGAT + AHN neurons were monosynaptically innervated by the LPB and PVT (Fig. 5), two brain areas directly innervated by several populations of spinal projection neurons for pain-related defensive behaviors 35-37 . Together, these results suggest that AHN vGAT + neurons might be a critical circuit module for mechanically evoked defensive attack.
The role of vGAT + AHN neurons in defensive and offensive attack. To better understand the behavioral relevance of vGAT + AHN neurons, it is essential to revisit the concepts of defensive and offensive attack. Rodents exhibit defensive attack toward the attacking predator or aggressive conspecifics 4 . To a territorial intruder, rodents show social investigation and then a series of offensive social attacks, namely social aggression 4,45 . In our study, we showed that photostimulation of vGAT + AHN neurons evoked biting-like attack toward threatening targets ( Fig. 6) but suppressed social aggression ( Supplementary Fig. 4a-d). These data suggest that vGAT + AHN neurons might participate in mechanically evoked defensive attack rather than offensive attack. Previous studies using lesion and electrical stimulation techniques suggested that the AHN in other species might participate in intraspecific aggression (rat 46 , cat 47 , hamster 48 , prairie voles 49 and finch 50 ). But these studies did not reveal whether the AHN is involved in defensive or offensive attack. Our data suggest that the AHN in these species might be more involved in defensive attack against social aggressor.
A 'brake' mechanism to prioritize defensive attack. An interesting finding of this study is that vGAT + AHN neurons suppressed social aggression ( Supplementary Fig. 4a-c) and a series of defensive behaviors, such as risk assessment (Fig. 4k), avoidance ( Supplementary Fig. 3f) and freezing ( Supplementary Fig. 3g). The suppression of offensive social attack during social aggression might be explained by our anatomical and functional data (Extended Data Figs. 7 and 8) showing that efferent projections of vGAT + AHN neurons exerted GABAergic inhibition to VMHvl neurons, which are causally linked to social aggression 38,51-53 . Likewise, suppression of defensive behaviors might be explained by the finding that vGAT + AHN neurons had strong GABAergic inhibition to PMD and VMHdm neurons which are involved in defensive behaviors such as freezing and avoidance [5][6][7][8][9]21 . With the GABAergic efferents from vGAT + AHN neurons to the PMD and VMHdm, noxious mechanical stimuli might prioritize defensive attack above other forms of defensive behavior by the above 'brake' mechanism.
New questions. Our results also raise several new questions. First, although noxious mechanical stimuli optimally activated vGAT + AHN neurons, predator-derived olfactory cues also modulated their activities (Fig. 4f,g). Moreover, these neurons receive sparse monosynaptic innervations from the MA (Fig. 5d) which convey olfactory signals from the accessory olfactory bulb to the hypothalamus 40 . How AHN vGAT + neurons participate in olfaction-mediated defensive behaviors would be an interesting topic to pursue in a future study. Second, an interesting observation is that photostimulation of vGAT + AHN neurons switched mouse behavior from social aggression to investigation. It is likely that activation of vGAT + AHN neurons might inhibit aggression-related neurons and somehow disinhibit neurons that are relevant to social investigation. The pathway for disinhibition of social investigation remains to be identified. Finally, our data of fiber photometry and single-unit recording have some limitations. The bulk fiber photometry signal might not report the activity of small subpopulations in the heterogeneous vGAT + AHN neurons. Single-unit recording was performed in head-fixed mice that did not exhibit defensive attack.
Although these data at this point might be sufficient to support the conclusion that vGAT + AHN neurons preferentially respond to noxious mechanical stimuli, in future studies it is essential to employ a gradient-index lens combined with a miniscope to visualize the calcium signals of individual vGAT + AHN neurons in freely moving mice. This approach will enable monitoring of the activities of individual vGAT + AHN neurons in parallel with mechanically evoked defensive attack.

online content
Any methods, additional references, Nature Research reporting summaries, source data, extended data, supplementary information, acknowledgements, peer review information; details of author contributions and competing interests; and statements of data and code availability are available at https://doi.org/10.1038/ s41593-021-00985-4. Publisher's note Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.

Methods
Animals. Each individual experimental procedure using mice and snakes as animal models in this study was approved by the Administrative Panel on Laboratory Animal Care at the National Institute of Biological Sciences (NIBS). These procedures include the use of an alligator clip on the mouse's tail, the pairing of a mouse with a snake in the arena and other procedures. For detailed information of approval, see the approved animal protocol (NIBS2018M0027) in the Supplementary Information. The vGlut2-IRES-Cre, vGAT-IRES-Cre, Mrgprd CreERT2 , Rosa26 iDTR and Ai3 mouse lines 23-26 were imported from the Jackson Laboratory. Both male and female mice on C57BL/6 and CD1 background were maintained on a circadian 12-h light/dark cycle with food and water available ad libitum. Mice were housed in groups (3-5 animals per cage) before they were separated 3 d before virus injection. After virus injection, each mouse was housed in one cage for 3 weeks before subsequent experiments. To avoid potential sex-specific differences, we used male mice only.
AAV vectors. The AAV serotype used in this study was AAV2/9. The AAVs used are listed in Supplementary Table 1 angle from the lateral to medial). The ferrule was then secured on the skull with dental cement. After implantation, antibiotics were applied to the surgical wound. The optogenetic and fiber photometry experiments were conducted at least 3 weeks after optical fiber implantation. All experimental designs related to optical fiber implantation are summarized in Supplementary Table 2. The positions of optical fiber tips are summarized in Supplementary Fig. 7. For optogenetic manipulations, the output of the laser was measured and adjusted to 2 mW, 5 mW and 10 mW before each experiment. The pulse onset, duration and frequency of light stimulation were controlled by a programmable pulse generator attached to the laser system. After AAV injection and fiber implantation, the mice were housed individually for 3 weeks before the behavioral tests.

Preparation of the behavioral tests.
Before the behavioral tests, the animals were handled daily by the experimenters for at least 3 d. On the day of the behavioral test, the animals were transferred to the testing room and habituated to the room conditions for 3 h before the experiments started. The apparatus was cleaned with 20% ethanol to eliminate odor cues from other animals. All behavioral tests were conducted during the same circadian period (13:00-19:00). All behaviors were scored by the experimenters who were blinded to the animal treatments.
Measurement of defensive behaviors to the dummy snake. The plastic dummy snake was purchased from a merchant in the Tao-Bao online store (www.taobao. com). The dummy snake (163 g) was either coated with fresh snake feces to provide olfactory cues of snake or equipped with a head-like alligator clip (3 g) to provide noxious mechanical stimuli. The mechanical force from the alligator clip, measured with a spring dynamometer, was ~366 g. The mechanical stimuli were applied either on the tail or on the four limbs of mice. In some experiments (Extended Data Fig. 1a,b), the ambient light in the behavioral box was switched on (Light + , ~50 lux) and off (Light − , ~0.002 lux) to measure the contribution of visual cues to mechanically evoked defensive attack. In some experiments (Extended Data Fig.  1d,e), neutral objects (wood block and plastic lid) were connected to the alligator clip to examine whether mice exhibit defensive attack to a neutral object in the presence of noxious mechanical stimuli.
The defensive responses of the mice to the dummy snake in the enclosed arena (25 cm × 25 cm × 35 cm) were recorded with a high-speed camera (160 frames per second). The arena was cleaned with 20% ethanol to eliminate odor cues from other mice. The time spent in freezing, risk assessment, avoidance and biting attack were measured by EthoVision XT 14 software (Noldus) off-line and plotted with a behavioral ethogram.
Genetic ablation of Mrgprd + neurons. To ablate Mrgprd + neurons, a two-step strategy of drug injections was used. First, tamoxifen was injected intraperitoneally for eight consecutive days at a dosage of 75 mg kg −1 in 14-day-old Mrgprd-CreERT2/iDTR/Ai3 male mice. Tamoxifen injection at this dosage at this developmental stage was shown to induce Cre expression in Mrgprd-expressing DRG neurons with high specificity (88.1% ± 1%) and high efficiency (92.9% ± 4.6%) 23 . Second, 3 weeks after the last dose of tamoxifen injection, diphtheria toxin was injected intraperitoneally for three consecutive days at a dosage of 4 mg kg −1 in the same group of mice. The defensive attack behavior to the dummy snake was measured 3 weeks after the last dose of diphtheria toxin injection. The efficiency of genetic ablation of Mrgprd + neurons was tested by immunostaining of EYFP in the dorsal root ganglia (DRG) at the lumbar and sacral segments.

EMG electrode implantation and EMG recording.
To monitor jaw muscle activity, we implanted chronic EMG electrodes in the right masseter muscles of the jaw. The EMG electrode was made with flexible multi-strand stainless steel wires (A-M Systems, 793200). The insulation of a small segment of the wire (~0.5 mm) was removed to expose the electrode to the muscle. During the surgical procedure, the wires were threaded through and anchored with a knot on the muscle. The wires were then threaded beneath the skin of mouse face and attached to the ground electrodes at the base of the skull with dental cement. After 3 d of recovery from surgery, mice were connected to flexible EMG connection cables and allowed to adapt for at least 1 d. The EMG signals were recorded using a Microelectrode AC Amplifier Model 1800 (A-M Systems), filtered (10-500 Hz EMG recordings) and digitized at 250 Hz using Spike2 software (Cambridge Electronic Design). A flashing LED triggered by a 1-s square-wave pulse was simultaneously recorded to synchronize the video and EMG signals. The effects of photoinhibition (Figs. 2d-i and 8c-e) and photostimulation ( Fig. 6d-g) of vGAT + AHN neurons on defensive attack were examined in this study.

Measuring the effects of GtACR1-mediated photoinhibition on defensive attack.
To test the effects of photoinhibition of vGAT + and vGlut2 + AHN neurons on mechanically evoked defensive attack, we injected AAV-EF1α-DIO-GtACR1-2A-EGFP into the AHN of vGAT-IRES-Cre or vGlut2-IRES-Cre mice bilaterally, followed by optical fibers implanted above the injection sites bilaterally. Three weeks after AAV injection, the mice were subjected to the regular procedure to test mechanically evoked defensive attack behavior. GtACR1-mediated photoinhibition was achieved by laser illumination (473 nm, 2 s OFF/2 s ON, 10 mW) on GtACR1-expressing vGAT + or vGlut2 + AHN neurons during mechanically evoked defensive attack. The biting bout frequency and time spent in biting toward the dummy snake, as read out by analyzing EMG traces, were analyzed off-line. In a control experiment, the locomotion speed of freely moving mice before and during photoinhibition of vGAT + AHN neurons was measured with the video recorded from a camera above the mice.
To test the effects of photoinhibition of vGAT + AHN-vlPAG pathway on mechanically evoked defensive attack, we injected AAV-EF1α-DIO-GtACR1-2A-EGFP into the AHN of vGAT-IRES-Cre mice bilaterally, followed by optical fibers implanted above the vlPAG bilaterally. Six weeks after AAV injection, the mice were subjected to the regular procedure to test mechanically evoked defensive attack behavior. GtACR1-mediated photoinhibition was achieved by laser illumination (473 nm, 2 s OFF/2 s ON, 10 mW) on GtACR1-expressing axon terminals of vGAT + AHN neurons during mechanically evoked defensive attack. The biting bout frequency and time spent in biting toward the dummy snake, as read out by analyzing EMG traces, were analyzed off-line.
Fiber photometry recording. A fiber photometry system (ThinkerTech, version 2016) was used for recording GCaMP signals from genetically identified neurons 29 . To induce fluorescence signals, a laser beam from a laser tube (488 nm) was reflected by a dichroic mirror, focused by a ×10 lens (NA 0.3) and coupled to an optical commutator. A 2-m optical fiber (230 μm in diameter, NA 0.37) guided the light between the commutator and the implanted optical fiber. To minimize photo-bleaching, the power intensity at the fiber tip was adjusted to 0.02 mW. The jGCaMP7s 30 fluorescence was band-pass filtered (MF525-39, Thorlabs) and collected by a photomultiplier tube (R3896, Hamamatsu). An amplifier (C7319, Hamamatsu) was used to convert the photomultiplier tube current output to voltage signals which were further filtered through a low-pass filter (40 Hz cutoff, Brownlee 440). The analog voltage signals were digitalized at 100 Hz and recorded by a Power 1401 digitizer and Spike2 software.
AAV-hSyn-DIO-jGCaMP7s was stereotaxically injected into the AHN of vGAT-IRES-Cre mice, followed by optical fiber implantation above the AHN (see 'Stereotaxic injection' and 'Optical fiber implantation'). Three weeks after AAV injection, fiber photometry was used to record GCaMP signals from the cell bodies of vGAT + AHN neurons in seven different behavioral tests (see below). A flashing LED triggered by a 1-s square-wave pulse was simultaneously recorded to synchronize the video and GCaMP signals. After the experiments, the optical fiber tip sites above the vGAT + AHN neurons were histologically examined in each mouse.
Measuring GCaMP signals before and during mechanical stimuli. Head-fixed awake mice with the optical fiber connected to the fiber photometry system were allowed to stand on a circular treadmill. Then, noxious mechanical stimuli were applied by the alligator clip to mouse tail while the GCaMP fluorescence was recorded. The GCaMP signals were measured by normalizing GCaMP fluorescence (ΔF/F) and aligned with the initiation of mechanical stimuli.

Measuring GCaMP signals before and during mechanically evoked biting.
Mice with the optical fiber connected to the fiber photometry system freely explored the arena for 10 min. Then, the mouse tail was clamped by the alligator clip connected to the dummy snake. The GCaMP fluorescence and mechanically evoked biting-like attack were simultaneously recorded. The GCaMP signals were measured by normalizing GCaMP fluorescence (ΔF/F) and aligned with the initiation of biting-like attack.
Measuring GCaMP signals before and during locomotion. Head-fixed awake mice with the optical fiber connected to the fiber photometry system were allowed to stand on a circular treadmill. The spontaneous locomotion and the GCaMP fluorescence were simultaneously recorded. The GCaMP signals were measured by normalizing GCaMP fluorescence (ΔF/F) and aligned with the initiation of locomotion.
Measuring GCaMP signals before and during risk assessment. Mice with optical fibers connected to the fiber photometry system freely explored the arena for 10 min. Then, a live snake was introduced to the arena while the GCaMP signals and risk assessment were simultaneously recorded. The GCaMP signals were measured by normalizing GCaMP fluorescence (ΔF/F) and aligned with the initiation of risk assessment.
Measuring GCaMP signals before and during object exploration. Mice with optical fibers connected to the fiber photometry system freely explored the arena for 10 min. Then, a wood block (3 cm × 3 cm × 3 cm) was introduced to the arena while the GCaMP signals and object exploration were simultaneously recorded. The GCaMP signals were measured by normalizing GCaMP fluorescence (ΔF/F) and aligned with the initiation of object exploration.
Measuring GCaMP signals before and during social investigation. Mice with optical fibers connected to the fiber photometry system freely explored the arena for 10 min. Then, a male or female C57BL/6 mouse was introduced to the arena while the GCaMP signals and social investigation were simultaneously recorded. The GCaMP signals were measured by normalizing GCaMP fluorescence (ΔF/F) and aligned with the initiation of social investigation.
Single-unit recording with optrode. An optrode was used to identify the single-unit activity of vGAT + AHN neurons. AAV2/9-hSyn-DIO-ChR2-mCherry was injected into the AHN of vGAT-ires-Cre mice. Three weeks after viral injection, single-unit recording was performed with an optrode in the AHN of head-fixed awake mouse standing on the treadmill. The single-channel optrode was made by assembling an optic fiber (230 μm) parallel with a glass-coated tungsten electrode (1-3 MΩ). The distance between the two tips was ~200 μm. The optrode was vertically advanced into the AHN with a Narishige micro-manipulator so that the tungsten electrode tip was in the AHN while the optic fiber was above the AHN, which minimized damage to the AHN by the optic fiber. The spikes were amplified by a differential amplifier (Model 1800, A-M Systems), digitized (10 kHz) and stored by Spike2 software (version 7.03). When the spikes from mechanically responsive units were isolated, a train (10 Hz, 1 s) of light stimulations (1 ms) was delivered to test if the units were from ChR2-expressing neurons, which are presumably vGAT + . The spikes from putative vGAT + neurons had to conform to two criteria: first, their latency to the light pulse should be less than 5 ms; second, their waveform should be similar to that of spikes evoked by sensory stimulation. Only units with spikes faithfully following the light stimulations with latency less than 5 ms were further tested for sensory-evoked responses. The spike sorting was performed with Spike2 software (version 7.03) in accordance with our previous work 9 . For a certain train of APs, after setting the threshold of the spikes, Spike2 automatically generated the templates and performed the spike sorting. The quality of spike clustering was further confirmed by principal component analysis (Extended Data Fig. 5b). During single-unit recording, the application of mechanical and olfactory stimuli by the experimenter was recorded by a video camera. A flashing LED triggered by a 1-s square-wave pulse was simultaneously recorded to synchronize the video and single-unit recording.
Mechanical and olfactory stimuli. When the single-unit activity of putative vGAT + AHN units was isolated, we applied mechanical or olfactory stimuli to the test mice. Mechanical stimuli were applied either by alligator clip or by von Frey filaments. The alligator clip that clamped mouse tail generated mechanical force (~366 g) which was measured by two spring dynamometers connected to the two jaws of the alligator clip directing toward the opposite directions. Three von Frey filaments with graded mechanical forces (1 g, 10 g and 100 g) were used to poke different body parts of mice. To examine whether AHN vGAT + neurons also respond to mechanical stimuli applied on other parts of the body, we used von Frey filament (100 g) to poke four limbs of the mouse. To examine adaptation of AHN vGAT + neurons to repetitive mechanical stimuli, von Frey filaments (100 g) were used to poke the tail of the test mice four times at a certain frequency (0.1 Hz or 0.5 Hz). To mimic olfactory cues of predator, fresh snake feces was coated on a cotton swab and presented to the test mice with a distance of 2 cm between the cotton swab and the nose tip.
Verification of recording sites. The recording sites of the putative vGAT + AHN neurons were marked with electrolytic lesions applied by passing positive currents (40 µA, 10 s) through the tungsten electrode. Under deep anesthesia with urethane, the brain was perfused with saline and PBS containing 4% paraformaldehyde (PFA). After regular histological procedure, frozen sections were cut at 40 µm in thickness and counterstained with DAPI for histological verification of recording sites (Extended Data Fig. 5a).
One week after injection of RV, mice were perfused with saline followed by 4% PFA in PBS. After 8 h of post-fixation in 4% PFA, coronal brain sections at 40 μm in thickness were prepared using a cryostat (Leica CM1900). All coronal sections were collected and stained with DAPI. The coronal brain sections were imaged with an Olympus VS120 epifluorescence microscope (×10 objective) and analyzed with ImageJ. For quantifications of subregions, boundaries were based on the Mouse Brain Atlas 54 . Only brain areas with at least ten labeled neurons in vGAT-IRES-Cre mice were analyzed. To correct potential bias, the cell number in each brain area was normalized by dividing it by the total cell number.
Cell counting strategies. Cell counting strategies are summarized in Supplementary Table 3. For counting cells in the AHN, we collected coronal sections (40 μm) from bregma −0.34 mm to bregma −1.34 mm for each mouse. The outline of the AHN was according to the Mouse Brain Atlas 54 . We acquired confocal images (×20 objective, Zeiss LSM780), followed by cell counting with ImageJ software. By combining FISH and immunohistochemistry, we counted the number of vGAT + and vGlut2 + cells in the AHN and calculated the percentages of vGAT + and vGlut2 + neurons in the neuronal population labeled by EGFP. With immunohistochemical staining of glutamate and GABA, we calculated the percentages of glutamate + and GABA + neurons in the neuronal population labeled by EGFP, GCaMP7 or mCherry.
To analyze monosynaptic inputs of vGAT + AHN neurons, we counted DsRed + cells in a series of brain areas. For counting cells in the LPB, we collected coronal sections (40 μm) from bregma −4.96 mm to bregma −5.68 mm. The outlines of these brain areas were according to the Mouse Brain Atlas 54 . We acquired fluorescent images (×10 objective, Olympus), followed by cell counting with ImageJ software.

ChR2-mediated photostimulation of vGAT + AHN neurons.
AAV-hSyn-DIO-ChR2-mCherry was bilaterally injected into the AHN of vGAT-IRES-Cre mice, followed by optical fibers implanted bilaterally above the injection sites. Three weeks after AAV injection, the vGAT + AHN neurons were photostimulated (473 nm, 10 mW, 20 Hz, 10~20 s), and mouse behaviors to different experimental targets were examined. The laser was switched on by the experimenter when the test mice were not performing other behaviors such as self-grooming or rearing. The duration of photostimulation was between 10 s and 20 s. Considering the potential injury of the live snake caused by light-evoked biting attack of mice, we shut off the light pulses when the test mice clearly exhibited defensive attack. Therefore, the duration of light stimulation was, in some cases, variable. For data analyses, we normalized time spent in attack by dividing time for attack during laser ON phase by the total time of laser ON phase. In each experiment, three trials per mouse were used to reduce the variability of experimental results.
Measurement of behaviors to live predator. The mice were habituated to the enclosed arena (25 cm × 25 cm) for 15 min per day in three consecutive days before the behavioral test. On the fourth day, after the mice entered the arena, they were first habituated to the arena for 15 min to minimize anxiety and stress. Then, a live snake (20−30 g) was gently placed inside the chamber. To minimize the possibility of predatory attack from the snake, the snake was anaesthetized with isoflurane if necessary. A light-pulse train lasting 10~20 s (473 nm, 5 ms, 20 Hz, 10 mW) was delivered to stimulate vGAT + AHN neurons that expressed ChR2-mCherry. The defensive behaviors (risk assessment, freezing, avoidance and biting-like attack) were recorded by the horizontal camera. A researcher blinded to the conditions of the mice analyzed the video by plotting a behavioral ethogram off-line. The total time spent for defensive behaviors (risk assessment, freezing, avoidance or biting-like attack) was used for the quantitative analyses. Risk assessment is a stereotypical slow investigative approach with low-lying extended body posture that can be visually identified 41 . Avoidance was defined as rapid locomotion with a peak speed higher than 30 cm s −1 after risk assessment. Freezing was defined as a period of time (>1 s) with locomotion speed lower than 0.5 cm s −1 , according to published work 3 . Avoidance and freezing were automatically identified with EthoVision XT 14 software. In some cases, we also measured the dependence of defensive attack on the frequency (5 Hz, 10 Hz, 20 Hz) and power (2 mW, 5 mW, 10 mW) of laser pulses.

Measurement of behaviors to neutral object.
The mice were habituated to the enclosed arena (25 cm × 25 cm) for 15 min per day in three consecutive days before the behavioral test. On the fourth day, after the mice entered the arena, they were first habituated to the arena for 15 min to minimize anxiety and stress. Then, a wood block (3 cm × 3 cm × 3 cm) was gently placed inside the chamber. For photostimulation of vGAT + AHN neurons, a light-pulse train lasting 10~20 s (473 nm, 5 ms, 20 Hz, 10 mW) was delivered. Mouse behaviors (sniffing, avoidance, freezing and biting-like attack) were recorded by the horizontal camera. A researcher blinded to the conditions of the mice analyzed the video by plotting a behavioral ethogram off-line. The total time spent for these behaviors (sniffing, avoidance, freezing and biting-like attack) was used for the quantitative analyses.

Measurement of behaviors to conspecifics.
The mice were habituated to the enclosed arena (25 cm × 25 cm) for 15 min per day in three consecutive days before the behavioral test. On the fourth day, after the mice entered the arena, they were first habituated to the arena for 15 min to minimize anxiety and stress. Then, a male or female C57BL/6 mouse of similar age to the test mouse was gently placed inside the chamber. For photostimulation of vGAT + AHN neurons, a light-pulse train lasting 10~20 s (473 nm, 5 ms, 20 Hz, 10 mW) was delivered. The social behaviors (social investigation, mounting and social attack) were recorded by the horizontal camera. A researcher blinded to the conditions of the mice analyzed the video by plotting a behavioral ethogram off-line. The total time spent on social behaviors (social investigation, avoidance, mounting and social attack) was used for the quantitative analyses.
We also tested how light stimulation of AHN vGAT + neurons influence social attack in a paradigm of social aggression. A 1-month-old male C57BL/6 mouse was gently placed inside the home cage of the test mouse. We did not use fully adult male intruders in our study, because, in our hands, the fully adult male intruders occasionally were very aggressive and suppressed social aggression from the test mice. By contrast, 1-month-old young intruders did not fight with the test mice and more reliably evoked social aggression from the test mice. For photostimulation of vGAT + AHN neurons, a light-pulse train lasting 10~20 s (473 nm, 5 ms, 20 Hz, 10 mW) was delivered. The social behaviors (social investigation, mounting and social attack) were recorded by the vertical camera. A researcher blinded to the conditions of the mice analyzed the video by plotting a behavioral ethogram off-line. The total time spent for social behaviors (social investigation, avoidance, mounting and social attack) was used for the quantitative analyses.
Measurement of behaviors to conspecifics and live snake. The mice were habituated to the enclosed arena (25 cm × 25 cm) for 15 min per day in three consecutive days before the behavioral test. On the fourth day, after the mice entered the arena, they were first habituated to the arena for 15 min to minimize anxiety and stress. Then, a live snake and a male (or female) C57BL/6 mouse of similar age to the test mouse were gently placed inside the chamber together. For photostimulation of vGAT + AHN neurons, a light-pulse train lasting 10~20 s (473 nm, 5 ms, 20 Hz, 10 mW) was delivered. The social behaviors (social investigation, mounting and social attack) and anti-predator defensive behaviors (freezing, risk assessment, avoidance and defensive attack) were recorded by the horizontal camera. A researcher blinded to the conditions of the mice analyzed the video by plotting a behavioral ethogram off-line. The total time spent on each behavior was used for the quantitative analyses.

Cell-type-specific anterograde tracing of AHN vGAT + neurons.
For cell-type-specific anterograde tracing of vGAT + AHN neurons, AAV-DIO-EGFP-Syb2 was stereotaxically injected into the AHN of vGAT-ires-Cre mice (200 nl). The mice were then maintained in a cage individually. Three weeks after viral injection, mice were perfused with saline, followed by 4% PFA in PBS. After 8 h of post-fixation in 4% PFA, coronal brain sections at 40 μm in thickness were prepared using a cryostat (Leica CM1900). All coronal sections were collected and stained with primary antibody against EGFP (Abcam, cat. no. ab290, 1:2,000) and DAPI. The coronal brain sections were imaged with an Olympus VS120 epifluorescence microscope (×10 objective lens).

Cannula implantation and drug infusion.
A cannula was stereotaxically implanted above the vlPAG. The inner and outer diameters of the cannula were 150 μm and 300 μm, respectively. The cannula was fixed to the skull using acrylic cement. During drug infusion, the cannula was connected with a catheter filled with PTX (100 μM) or saline for injection. The other end of the catheter was connected to a Hamilton syringe controlled by an infusion pump to drive the delivery of PTX or saline (50 nl min −1 ). The delivery of PTX or saline was operated in a step-wise fashion, with 100 nl infused to the vlPAG in each step (0 nl, 100 nl and 200 nl). Photostimulation-induced anti-predator defensive behaviors were measured after each step of infusion was completed (0 nl, 100 nl and 200 nl). At the end of the experimental session, the test mice were perfused, and the coronal brain sections containing vlPAG were inspected for the presence of cannula track. The mice with no cannula track above the vlPAG were rejected from further analysis.
Slice physiological recording. Slice physiological recording was performed according to published work 53 . Brain slices containing the AHN, LS, VMHdm, PMD, VMHvl or PAG were prepared from adult mice anesthetized with isoflurane before decapitation. Brains were rapidly removed and placed in ice-cold oxygenated (95% O 2 and 5% CO 2 ) cutting solution (228 mM sucrose, 11 mM glucose, 26 mM NaHCO 3 , 1 mM NaH 2 PO 4 , 2.5 mM KCl, 7 mM MgSO 4 and 0.5 mM CaCl 2 ). Coronal brain slices (400 μm) were cut using a vibratome (VT1200S, Leica). The slices were incubated at 28 °C in oxygenated artificial cerebrospinal fluid (ACSF: 119 mM NaCl, 2.5 mM KCl, 1 mM NaH 2 PO 4 , 1.3 mM MgSO 4 , 26 mM NaHCO 3 , 10 mM glucose and 2.5 mM CaCl 2 ) for 30 min and were then kept at room temperature under the same conditions for 1 h before transfer to the recording chamber at room temperature. The ACSF was perfused at 1 ml min −1 . The acute brain slices were visualized with a ×40 Olympus water immersion lens, differential interference contrast optics (Olympus) and a charged-coupled device camera.
Patch pipettes were pulled from borosilicate glass capillary tubes (cat. no. 64-0793, Warner Instruments) using a PC-10 pipette puller (Narishige). For recording of APs (current clamp), pipettes were filled with solution (in mM: 135 K-methanesulfonate, 10 HEPES, 1 EGTA, 1 Na-GTP, 4 Mg-ATP and 2% neurobiotin, pH 7.4). For recording of post-synaptic currents (voltage clamp), pipettes were filled with solution (in mM: 135 CsCl, 10 HEPES, 1 EGTA, 1 Na-GTP and 4 Mg-ATP, pH 7.4). The resistance of pipettes varied between 3.0 MΩ and 3.5 MΩ. The current and voltage signals were recorded with MultiClamp 700B and Clampex 10 data acquisition software (Molecular Devices). After establishment of the whole-cell configuration and equilibration of the intracellular pipette solution with the cytoplasm, series resistance was compensated to 10-15 MΩ. Recordings with series resistances greater than 15 MΩ were rejected.
An optical fiber (230 µm in diameter, NA 0.37) was used to deliver light pulses, with the fiber tip positioned 500 μm above the brain slices. Laser power was adjusted to 10 mW. Light-mediated photoinhibition of GtACR1 + neurons was tested by a constant laser illumination (473 nm, 300 ms, 10 mW) while the neurons were depolarized (usually 0.1 NA) to trigger AP firing. Light-evoked APs from ChR2-mCherry + neurons in the AHN were triggered by a light-pulse train (473 nm, 2 ms, 10 Hz or 20 Hz, 10 mW) synchronized with Clampex 10 data acquisition software. Light-evoked post-synaptic currents from PAG neurons were triggered by single light pulses (2 ms) in the presence of 4-aminopyridine (20 μM) and TTX (1 μM). D-AP5 (50 μM)/CNQX (20 μM) or PTX (50 μM) was perfused with ACSF to examine the neurotransmitter type used by ChR2-mCherry-expressing AHN neurons.
RNA in situ hybridization. Mice were perfused with PBS treated with 0.1% DEPC (Sigma, D5758), followed by DEPC-treated PBS containing 4% PFA (PBS-PFA). Brains were post-fixed in DEPC-treated PBS-PFA solution overnight and then placed in DEPC-treated 30% sucrose solution at 4 °C for 30 h. Brain sections to a thickness of 30 μm were prepared using a cryostat (Leica, CM3050S) and collected in DPEC-treated PBS. FISH was performed as previously described 55 with minor modifications. In brief, brain sections were rinsed with DPEC-treated PBS and permeabilized with DPEC-treated 0.1% Tween 20 solution (in PBS) and then DPEC-treated in 2× SSC containing 0.5% Triton X-100. Brain sections were then treated with H 2 O 2 solution and acetic anhydride solution to reduce non-specific FISH signals. After 2-h incubation in prehybridization buffer (50% formamide, 5× SSC, 0.1% Tween 20, 0.1% CHAPS and 5 mM EDTA in DEPC-treated water) at 65 °C, brain sections were then hybridized with the hybridization solution containing mouse antisense cRNA probes (digoxigenin labeling) for vGlut2 (amplified by primers CCAAATCTTACGGTGCTACCTC and TAGCCATCTTTCCTGTTCCACT) or vGAT (amplified by primers GCCATTCAGGGCATGTTC and AGCAGCGTGAAGACCACC) at 65 °C for 20 h. The sequences of cDNA primers for cRNA probes were the same as those in the ISH DATA of the Allen Brain Atlas (https://mouse.brain-map.org/). After washing, brain sections were incubated with anti-digoxigenin-POD and Fab fragments (1:400, Roche, 11207733910) at 4 °C for 30 h, and FISH signals were detected using a TSA Plus Cyanine 3 kit (NEL744001KT, PerkinElmer). To detect the GFP signals, brain sections were incubated with a primary antibody against GFP (1:2,000, Abcam, ab290) at 4 °C for 24 h and then with an Alexa Fluor 488-conjugated goat anti-rabbit secondary antibody (1:500, Invitrogen, A11034) at room temperature for 2 h. Brain sections were mounted and imaged using a Zeiss LSM780 confocal microscope or the Olympus VS120 Slide Scanning System.
Immunohistochemistry. Mice were anesthetized with isoflurane and sequentially perfused with saline and PBS containing 4% PFA. Brains were removed and incubated in PBS containing 30% sucrose until they sank to the bottom. Post-fixation of the brain was avoided to optimize immunohistochemistry of GABA and glutamate. Cryostat sections (40-μm) were collected, incubated overnight with blocking solution (PBS containing 10% goat serum and 0.7% Triton X-100) and then treated with primary antibodies diluted with blocking solution for 3-4 h at room temperature. Primary antibodies used for immunohistochemistry are displayed in Supplementary Table 1. Primary antibodies were washed three times with washing buffer (PBS containing 0.7% Triton X-100) before incubation with secondary antibodies (tagged with Cy2, Cy3 or Cy5, dilution 1:500, Life Technologies) for 1 h at room temperature. Sections were then washed three times with washing buffer, stained with DAPI, washed with PBS, transferred onto Superfrost slides and mounted under glass coverslips with mounting media.
Sections were imaged with an Olympus VS120 epifluorescence microscope (×10 objective lens) or a Zeiss LSM780 confocal microscope (×20 and ×60 oil-immersion objective lens, ZEN 2012 software). Samples were excited by 488-, 543-or 633-nm lasers in sequential acquisition mode to avoid signal leakage. Saturation was avoided by monitoring pixel intensity with Hi-Lo mode. Confocal images were analyzed with ImageJ software.
Analyses of cell-type specificity. Two types of experiments were performed to quantify cell-type specificity in the study. First, we tested the specificity of vGAT-IRES-Cre and vGlut2-IRES-Cre lines to label vGAT + and vGlut2 + AHN neurons, by injecting AAV-DIO-EGFP into the AHN of these mice. Then, we collected the tissue sections of AHN, and the expressions of vGAT/vGlut2 mRNA and EGFP were examined by RNA in situ hybridization and immunohistochemistry, respectively. The specificity and efficiency of vGAT-IRES-Cre and vGlut2-IRES-Cre mice to label vGAT + and vGlut2 + neurons were calculated.
Second, we tested whether the molecular tools (GtACR1-2A-EGFP, jGCaMP7s and ChR2-mCherry) were specifically expressed in GABAergic neurons in the AHN by immunostaining of GABA with an anti-GABA antibody (Sigma, cat. no. A2052, lot 238K2568, dilution 1:500) that was validated in our previous studies 12 . The cell-type specificity and efficiency for each molecular tool to express in vGAT + AHN neurons were quantitatively analyzed.

Data quantification and statistical analyses.
Data collection and analysis were performed blinded to the conditions of the experiments. All mice were randomly assigned to different groups. For the statistical analyses of experimental data, two-sided Student's t-test and one-way ANOVA were used. The normality of data distribution was tested before two-sided Student's t-test (Supplementary Fig. 8). The 'n' used for these analyses represents the number of mice or cells. See the detailed information of statistical analyses in the figure legends and Supplementary  Table 4. All statistical comparisons were conducted on data originating from three or more biologically independent experimental replicates. All data are shown as means ± s.e.m. The software for data analyses includes OriginPro 2021, MATLAB R2014A, Clampfit 10.5, Spike2 7.03, ImageJ 2.0 and EthoVision XT 14. No sample size calculation was performed. Mouse behavior data for each condition were sampled from 7 to 8 mice. Slice physiology data for each condition were sampled from 7 to 8 recorded cells of three mice. Immunohistochemical data for each condition were sampled from tissue sections of 3-5 mice. The sample sizes are similar to those reported in previous studies 11,14,56 .
For behavioral analyses, the mice with incorrect AAV injections/optical fiber and cannula implantations were excluded for further analyses. For whole-cell recordings, the neurons with Ra larger than 15 MΩ were excluded from further analyses, because Ra larger than 15 MΩ indicates poor patch clamp. For EMG recordings, the mice with EMG signal-to-noise ratio lower than 5/1 were excluded from further analyses, because low signal-to-noise ratio would interfere with accurate reading of biting bouts. For single-unit recordings, the units with spike-to-noise ratio lower than 3/1 were excluded from further analyses, because low spike-to-noise ratio would interfere with accurate reading of spikes.
Reporting Summary. Further information on research design is available in the Nature Research Reporting Summary linked to this article.

Data availability
All data supporting the findings of this study are provided within the paper and its Supplementary Information. All additional information will be made available upon reasonable request to the authors. Source data are provided with this paper.

Code availability
The MATLAB code for data analyses is available from the corresponding author upon reasonable request. (g) Schematic diagrams showing the test mice were subject to an alligator clip (a context with high escapability) (left) or an alligator clip connected to a heavy dummy snake (a context with low escapability) (right). (h) Quantitative analyses of biting-like attack in mice, showing the time spent for defensive attack against an alligator clip with a dummy snake (low escapability) was significantly higher than that against an alligator clip without a dummy snake (high escapability). (i) Schematic diagrams showing the test mice were subject to an alligator clip in a large arena (a context with high escapability) (left) or a small arena (a context with low escapability) (right). (j) Quantitative analyses of biting-like attack in mice, showing the time spent for defensive attack against an alligator clip in small arena (low escapability) was significantly higher than that against an alligator clip in large arena (high escapability). Numbers of mice were indicated in the graphs (b-f, h, j). Data in (b-f, h, j) are means ± SEM. Statistical analyses in (b-f, h, j) were performed by two-sided Student t-tests (n.s. P > 0.1; *** P < 0.001). For the P values, see Supplementary Table 4. Fig. 2 | Analyses of cell-type specificity of vGlut2-IRES-Cre and vGAT-IRES-Cre lines in the AHN. (a, b) Table 4. Fig. 9 | Activation of vGAT + AHN-PAG pathway and AHN-LS pathway. (a) Example coronal sections showing ChR2-mCherry expression is largely restricted within the AHN of vGAT-IRES-Cre mice (left) and the optical-fiber tracks above the ChR2-mCherry+ axon terminals in the vlPAG (right). (b-d) Quantitative analyses of time spent for freezing (b), risk assessment toward snake (c), and avoidance from snake (d) of mice evoked by activation of vGAT+ AHN-vlPAG pathway. (e) Example coronal sections showing ChR2-mCherry expression is largely restricted within the AHN of vGAT-IRES-Cre mice (left) and the optical-fiber tracks above the ChR2-mCherry+ axon terminals in the LS (right). (f-h) Quantitative analyses of time spent for freezing (f), risk assessment to snake (g), and avoidance from snake (h) of mice evoked by activation of vGAT+ AHN-LS pathway. Scale bars are labeled in the graphs. Data in (b-d, f-h) are means ± SEM (error bars). Numbers of mice are indicated in the graphs (b-d, f-h). Statistical analyses were performed by two-sided Student t-tests (***, P < 0.001). For the P values, see Supplementary Table 4. The experiment (a, e) was repeated seven times independently with similar results. Last updated by author(s): Nov 12, 2021 Reporting Summary Nature Research wishes to improve the reproducibility of the work that we publish. This form provides structure for consistency and transparency in reporting. For further information on Nature Research policies, see our Editorial Policies and the Editorial Policy Checklist.

Statistics
For all statistical analyses, confirm that the following items are present in the figure legend, table legend, main text, or Methods section.

n/a Confirmed
The exact sample size (n) for each experimental group/condition, given as a discrete number and unit of measurement A statement on whether measurements were taken from distinct samples or whether the same sample was measured repeatedly The statistical test(s) used AND whether they are one-or two-sided Only common tests should be described solely by name; describe more complex techniques in the Methods section.
A description of all covariates tested A description of any assumptions or corrections, such as tests of normality and adjustment for multiple comparisons A full description of the statistical parameters including central tendency (e.g. means) or other basic estimates (e.g. regression coefficient) AND variation (e.g. standard deviation) or associated estimates of uncertainty (e.g. confidence intervals) For null hypothesis testing, the test statistic (e.g. F, t, r) with confidence intervals, effect sizes, degrees of freedom and P value noted  Policy information about availability of data All manuscripts must include a data availability statement. This statement should provide the following information, where applicable: -Accession codes, unique identifiers, or web links for publicly available datasets -A list of figures that have associated raw data -A description of any restrictions on data availability All data supporting the findings of this study are provided within the paper and its supplementary information. All additional information will be made available upon reasonable request to the authors. Source data are provided with this paper.

Field-specific reporting
Please select the one below that is the best fit for your research. If you are not sure, read the appropriate sections before making your selection. All studies must disclose on these points even when the disclosure is negative.

Sample size
No sample size calculation was performed. Mouse behavior data for each condition were sampled from 6-7 mice. Slice physiology data for each condition were sampled from 7-8 recorded cells of 3 mice. Immunohistochemical data for each condition were sampled from tissue sections of 3-5 mice. The sample sizes are similar to those reported in previous studies (PMID: 29581428, PMID: 28683263, PMID: 26113723) Data exclusions For behavioral analyses, the mice with incorrect AAV injections/optical fiber and cannulae implantations were excluded for further analyses.
For whole-cell recordings, the neurons with Ra larger than 15 MΩ were excluded from further analyses, because Ra larger than 15 MΩ indicates poor patch clamp. For EMG recordings, the mice with EMG signal-to-noise ratio lower than 5/1 were excluded from further analyses, because lower signal-tonoise ratio would interfere with accurate reading of biting bouts. For single-unit recordings, the units with spike-to-noise ratio lower than 3/1 were excluded from further analyses, because lower spike-tonoise ratio would interfere with accurate reading of spikes.

Replication
Data points that represent each mouse (e.g., Fig.2e and 2f) was the average value of data collected from three trials of the same experiment. Data of each experiment were acquired and analyzed by two different experimenters blind to the group allocation of the samples. For example, experimenter #1 acquired data set #1 and experimenter #2 acquired data set #2. Then experimenter #1 analyzed data set #2, whereas experimenter #2 analyzed data set #1, totally without knowing which is control or test group. And their results were compared to make sure the results were reproducible.
Randomization All mice were randomly assigned to different groups.

Blinding
All investigators were blinded to group allocation during data collection and analysis.

Behavioural & social sciences study design
All studies must disclose on these points even when the disclosure is negative.

Data collection
Provide details about the data collection procedure, including the instruments or devices used to record the data (e.g. pen and paper, computer, eye tracker, video or audio equipment) whether anyone was present besides the participant(s) and the researcher, and whether the researcher was blind to experimental condition and/or the study hypothesis during data collection.

Timing
Indicate the start and stop dates of data collection. If there is a gap between collection periods, state the dates for each sample cohort.

Non-participation
State how many participants dropped out/declined participation and the reason(s) given OR provide response rate OR state that no participants dropped out/declined participation.

Randomization
If participants were not allocated into experimental groups, state so OR describe how participants were allocated to groups, and if allocation was not random, describe how covariates were controlled.

Ecological, evolutionary & environmental sciences study design
All studies must disclose on these points even when the disclosure is negative.

Study description
Briefly

Sampling strategy
Note the sampling procedure. Describe the statistical methods that were used to predetermine sample size OR if no sample-size calculation was performed, describe how sample sizes were chosen and provide a rationale for why these sample sizes are sufficient.

Data collection
Describe the data collection procedure, including who recorded the data and how.
Timing and spatial scale Indicate the start and stop dates of data collection, noting the frequency and periodicity of sampling and providing a rationale for these choices. If there is a gap between collection periods, state the dates for each sample cohort. Specify the spatial scale from which the data are taken

Data exclusions
If no data were excluded from the analyses, state so OR if data were excluded, describe the exclusions and the rationale behind them, indicating whether exclusion criteria were pre-established.

Reproducibility
Describe the measures taken to verify the reproducibility of experimental findings. For each experiment, note whether any attempts to repeat the experiment failed OR state that all attempts to repeat the experiment were successful.

Randomization
Describe how samples/organisms/participants were allocated into groups. If allocation was not random, describe how covariates were controlled. If this is not relevant to your study, explain why.

Blinding
Describe the extent of blinding used during data acquisition and analysis. If blinding was not possible, describe why OR explain why blinding was not relevant to your study.
Did the study involve field work?

Yes No
Field work, collection and transport

Field conditions
Describe the study conditions for field work, providing relevant parameters (e.g. temperature, rainfall).

Location
State the location of the sampling or experiment, providing relevant parameters (e.g. latitude and longitude, elevation, water depth).
Access & import/export Describe the efforts you have made to access habitats and to collect and import/export your samples in a responsible manner and in compliance with local, national and international laws, noting any permits that were obtained (give the name of the issuing authority, the date of issue, and any identifying information).

Disturbance
Describe any disturbance caused by the study and how it was minimized.
Reporting for specific materials, systems and methods We require information from authors about some types of materials, experimental systems and methods used in many studies. Here, indicate whether each material, system or method listed is relevant to your study. If you are not sure if a list item applies to your research, read the appropriate section before selecting a response.

Eukaryotic cell lines
Policy information about cell lines

Cell line source(s)
State the source of each cell line used.

Authentication
Describe the authentication procedures for each cell line used OR declare that none of the cell lines used were authenticated.

Mycoplasma contamination
Confirm that all cell lines tested negative for mycoplasma contamination OR describe the results of the testing for mycoplasma contamination OR declare that the cell lines were not tested for mycoplasma contamination.

Commonly misidentified lines (See ICLAC register)
Name any commonly misidentified cell lines used in the study and provide a rationale for their use.

Palaeontology and Archaeology
Specimen provenance Provide provenance information for specimens and describe permits that were obtained for the work (including the name of the issuing authority, the date of issue, and any identifying information).

Specimen deposition
Indicate where the specimens have been deposited to permit free access by other researchers.

Dating methods
If new dates are provided, describe how they were obtained (e.g. collection, storage, sample pretreatment and measurement), where they were obtained (i.e. lab name), the calibration program and the protocol for quality assurance OR state that no new dates are provided.
Tick this box to confirm that the raw and calibrated dates are available in the paper or in Supplementary Information.

Ethics oversight
Identify the organization(s) that approved or provided guidance on the study protocol, OR state that no ethical approval or guidance was required and explain why not.
Note that full information on the approval of the study protocol must also be provided in the manuscript.

Animals and other organisms
Policy information about studies involving animals; ARRIVE guidelines recommended for reporting animal research Laboratory animals C57BL/6 and CD1 male and female mice (3-5 month old) were used in this study: vGAT-IRES-Cre mice; vGlut2-IRES-Cre mice; Ai3 mice; WT mice. Mice were maintained on a circadian 12-h light/12-h dark cycle with food and water available ad libitum. The ambient temperature was between 20-22 centrigrade. The humidity level was between 50%-60%. Mice were housed in groups (3-5 animals per cage) before they were separated 3 days prior to virus injection.

nature research | reporting summary
April 2020

Wild animals
No wild animals were used in this study.
Field-collected samples No field-collected samples were used in this study.

Ethics oversight
Each individual experimental procedure using mice and snakes as animal models in this study was approved by the Administrative Panel on Laboratory Animal Care at the National Institute of Biological Sciences, Beijing (NIBS). These procedures include the use of an alligator clip on the mouse's tail, the pairing of a mouse with a snake in the arena, and other procedures. For detailed information of approval, please read the approved animal protocol (NIBS2018M0027) in Supplementary Information.
Note that full information on the approval of the study protocol must also be provided in the manuscript.

Human research participants
Policy information about studies involving human research participants

Recruitment
Describe how participants were recruited. Outline any potential self-selection bias or other biases that may be present and how these are likely to impact results.

Ethics oversight
Identify the organization(s) that approved the study protocol.
Note that full information on the approval of the study protocol must also be provided in the manuscript.

Clinical data Policy information about clinical studies
All manuscripts should comply with the ICMJE guidelines for publication of clinical research and a completed CONSORT checklist must be included with all submissions.
Clinical trial registration Provide the trial registration number from ClinicalTrials.gov or an equivalent agency.

Study protocol
Note where the full trial protocol can be accessed OR if not available, explain why.

Data collection
Describe the settings and locales of data collection, noting the time periods of recruitment and data collection.

Outcomes
Describe how you pre-defined primary and secondary outcome measures and how you assessed these measures.

Dual use research of concern
Policy information about dual use research of concern Hazards Could the accidental, deliberate or reckless misuse of agents or technologies generated in the work, or the application of information presented in the manuscript, pose a threat to: Experiments of concern Does the work involve any of these experiments of concern: No Yes Confirm that both raw and final processed data have been deposited in a public database such as GEO.
Confirm that you have deposited or provided access to graph files (e.g. BED files) for the called peaks.

Data access links
May remain private before publication.
For "Initial submission" or "Revised version" documents, provide reviewer access links. For your "Final submission" document, provide a link to the deposited data.

Files in database submission
Provide a list of all files available in the database submission.
Genome browser session (e.g. UCSC) Provide a link to an anonymized genome browser session for "Initial submission" and "Revised version" documents only, to enable peer review. Write "no longer applicable" for "Final submission" documents.

Methodology Replicates
Describe the experimental replicates, specifying number, type and replicate agreement.

Sequencing depth
Describe the sequencing depth for each experiment, providing the total number of reads, uniquely mapped reads, length of reads and whether they were paired-or single-end.

Antibodies
Describe the antibodies used for the ChIP-seq experiments; as applicable, provide supplier name, catalog number, clone name, and lot number.
Peak calling parameters Specify the command line program and parameters used for read mapping and peak calling, including the ChIP, control and index files used.

Data quality
Describe the methods used to ensure data quality in full detail, including how many peaks are at FDR 5% and above 5-fold enrichment.

Software
Describe the software used to collect and analyze the ChIP-seq data. For custom code that has been deposited into a community repository, provide accession details.

Flow Cytometry
Plots Confirm that: The axis labels state the marker and fluorochrome used (e.g. CD4-FITC).
The axis scales are clearly visible. Include numbers along axes only for bottom left plot of group (a 'group' is an analysis of identical markers).
All plots are contour plots with outliers or pseudocolor plots.
A numerical value for number of cells or percentage (with statistics) is provided.

Sample preparation
Describe the sample preparation, detailing the biological source of the cells and any tissue processing steps used.

Instrument
Identify the instrument used for data collection, specifying make and model number.