Large-scale SDXL study

Attack-invariant projection experiment

Separate learned metrics for frozen DINO image embeddings and frozen caption embeddings. Conclusions are opened only on untouched prompts and held-out attack families.

large_scale_attack_invariant_v1

Track conclusions

caption_blip_base

Caption projection: unsupported

The frozen final-test decision did not support this projection.

Distance ratio: 2.437
95% prompt CI: [2.101, 2.819]
PCA ratio: 2.785
Paired log gain: -0.029
Paired 95% CI: [-0.081, 0.022]
Recall@1: 0.394
Triplet accuracy: 0.667

dinov2_base

DINOv2: strong separation, but no reliable improvement over PCA

Its separation remains strong, but the paired learned-over-PCA interval does not stay above zero.

Distance ratio: 23.436
95% prompt CI: [19.146, 28.701]
PCA ratio: 22.672
Paired log gain: 0.009
Paired 95% CI: [-0.100, 0.117]
Recall@1: 0.746
Triplet accuracy: 0.951

dinov3_l16

DINOv3: supported

The frozen final-test decision and paired learned-over-PCA interval support this projection.

Distance ratio: 18.312
95% prompt CI: [15.794, 21.014]
PCA ratio: 7.252
Paired log gain: 1.545
Paired 95% CI: [1.364, 1.728]
Recall@1: 0.754
Triplet accuracy: 0.932

Final-test scope

This post-hoc presentation uses 150 untouched final-test prompts and the two unseen final-test attack families. The 700/150/150 prompt split remains frozen.

Training attack families: affine, downsample_upsample, gaussian_blur, gaussian_noise, jpeg_compression, photometric

Attack protocol and exposure

All configurations below come from the frozen attack registry. Social-media compound was not trained or used for selection. Its compound pipeline contains operations related to separate training families (JPEG, downsample/upsample, photometric), but the exact combined pipeline/config was unseen.

Attack	Partition	Prompts	Exposure	Mild / medium / severe frozen configs	DINOv2 learned separation	DINOv3 learned separation
Gaussian noise	train	700	Optimized W.	mild: sigma: 2.0; medium: sigma: 6.0; severe: sigma: 12.0	Development only: 129.611×	Development only: 77.826×
Gaussian blur	train	700	Optimized W.	mild: radius: 0.5; medium: radius: 1.5; severe: radius: 3.0	Development only: 340.939×	Development only: 311.791×
JPEG compression	train	700	Optimized W.	mild: quality: 85; medium: quality: 60; severe: quality: 35	Development only: 94.829×	Development only: 36.001×
Downsample / upsample	train	700	Optimized W.	mild: scale: 0.85, resample: lanczos; medium: scale: 0.6, resample: lanczos; severe: scale: 0.35, resample: lanczos	Development only: 2432.113×	Development only: 2060.969×
Photometric adjustment	train	700	Optimized W.	mild: brightness: 1.04, contrast: 0.96, color: 1.03; medium: brightness: 0.9, contrast: 1.12, color: 0.82; severe: brightness: 1.2, contrast: 0.78, color: 1.28	Development only: 688.814×	Development only: 416.478×
Affine transform	train	700	Optimized W.	mild: degrees: 1.5, translate fraction: 0.01, scale: 0.98; medium: degrees: 4.0, translate fraction: 0.03, scale: 0.94; severe: degrees: 8.0, translate fraction: 0.06, scale: 0.88	Development only: 17.195×	Development only: 9.271×
Noise plus restoration	validation	150	Did not train W; influenced early stopping, checkpoint, restart, dimension, and model selection.	mild: sigma: 3.0, median size: 3; medium: sigma: 8.0, median size: 3; severe: sigma: 14.0, median size: 5	Development only: 51.396×	Development only: 32.891×
Perspective warp	validation	150	Did not train W; influenced early stopping, checkpoint, restart, dimension, and model selection.	mild: displacement fraction: 0.015; medium: displacement fraction: 0.04; severe: displacement fraction: 0.08	Development only: 33.708×	Development only: 16.583×
Occlusion / overlay	final_test	150	Influenced neither training nor selection; evaluated once.	mild: area fraction: 0.03, opacity: 0.45; medium: area fraction: 0.08, opacity: 0.65; severe: area fraction: 0.16, opacity: 0.85	Final test: 23.726×	Final test: 36.725×
Compound social-media degradation	final_test	150	Influenced neither training nor selection; evaluated once.	mild: long edge: 896, JPEG quality: 82, color: 0.96, sharpen: 1.05; medium: long edge: 640, JPEG quality: 58, color: 0.86, sharpen: 1.15; severe: long edge: 448, JPEG quality: 38, color: 0.72, sharpen: 1.3	Final test: 52.402×	Final test: 20.299×

Attack-family separation

Larger ratio means the attack stayed closer than a new seed. Learned W is compared with a matched-dimensional PCA baseline within each DINO representation; absolute distances are only comparable within a representation.

Attack family	Evidence	DINO	Method	Attack-distance mean	Different-seed-distance mean	Prompt-macro separation ratio	Ordering accuracy	Prompts	Pairs
Gaussian noise	Development only	DINOv2	Learned W	0.001	0.015	129.611	0.958	700	2800
Gaussian noise	Development only	DINOv2	Matched-dimensional PCA	0.001	0.011	76.950	0.942	700	2800
Gaussian noise	Development only	DINOv3	Learned W	0.000	0.002	77.826	0.970	700	2800
Gaussian noise	Development only	DINOv3	Matched-dimensional PCA	0.006	0.019	34.767	0.814	700	2800
Gaussian blur	Development only	DINOv2	Learned W	0.000	0.015	340.939	0.991	700	2800
Gaussian blur	Development only	DINOv2	Matched-dimensional PCA	0.000	0.011	233.104	0.992	700	2800
Gaussian blur	Development only	DINOv3	Learned W	0.000	0.002	311.791	0.997	700	2800
Gaussian blur	Development only	DINOv3	Matched-dimensional PCA	0.000	0.019	461.033	0.991	700	2800
JPEG compression	Development only	DINOv2	Learned W	0.001	0.015	94.829	0.969	700	2800
JPEG compression	Development only	DINOv2	Matched-dimensional PCA	0.001	0.010	63.006	0.961	700	2800
JPEG compression	Development only	DINOv3	Learned W	0.000	0.002	36.001	0.949	700	2800
JPEG compression	Development only	DINOv3	Matched-dimensional PCA	0.012	0.020	10.608	0.723	700	2800
Downsample / upsample	Development only	DINOv2	Learned W	0.000	0.015	2432.113	1.000	700	2800
Downsample / upsample	Development only	DINOv2	Matched-dimensional PCA	0.000	0.010	1844.916	1.000	700	2800
Downsample / upsample	Development only	DINOv3	Learned W	0.000	0.002	2060.969	1.000	700	2800
Downsample / upsample	Development only	DINOv3	Matched-dimensional PCA	0.000	0.019	3080.715	1.000	700	2800
Photometric adjustment	Development only	DINOv2	Learned W	0.000	0.016	688.814	1.000	700	2800
Photometric adjustment	Development only	DINOv2	Matched-dimensional PCA	0.000	0.011	561.074	1.000	700	2800
Photometric adjustment	Development only	DINOv3	Learned W	0.000	0.002	416.478	1.000	700	2800
Photometric adjustment	Development only	DINOv3	Matched-dimensional PCA	0.000	0.019	422.230	0.994	700	2800
Affine transform	Development only	DINOv2	Learned W	0.001	0.016	17.195	0.924	700	2800
Affine transform	Development only	DINOv2	Matched-dimensional PCA	0.001	0.011	15.072	0.916	700	2800
Affine transform	Development only	DINOv3	Learned W	0.000	0.002	9.271	0.915	700	2800
Affine transform	Development only	DINOv3	Matched-dimensional PCA	0.009	0.019	5.636	0.719	700	2800
Noise plus restoration	Development only	DINOv2	Learned W	0.001	0.013	51.396	0.955	150	600
Noise plus restoration	Development only	DINOv2	Matched-dimensional PCA	0.001	0.011	43.367	0.930	150	600
Noise plus restoration	Development only	DINOv3	Learned W	0.000	0.002	32.891	0.948	150	600
Noise plus restoration	Development only	DINOv3	Matched-dimensional PCA	0.009	0.020	7.938	0.733	150	600
Perspective warp	Development only	DINOv2	Learned W	0.001	0.014	33.708	0.975	150	600
Perspective warp	Development only	DINOv2	Matched-dimensional PCA	0.001	0.012	29.590	0.955	150	600
Perspective warp	Development only	DINOv3	Learned W	0.000	0.002	16.583	0.938	150	600
Perspective warp	Development only	DINOv3	Matched-dimensional PCA	0.003	0.018	17.644	0.893	150	600
Occlusion / overlay	Final test	DINOv2	Learned W	0.001	0.012	23.726	0.932	150	600
Occlusion / overlay	Final test	DINOv2	Matched-dimensional PCA	0.001	0.010	25.580	0.947	150	600
Occlusion / overlay	Final test	DINOv3	Learned W	0.000	0.002	36.725	0.970	150	600
Occlusion / overlay	Final test	DINOv3	Matched-dimensional PCA	0.002	0.018	31.274	0.922	150	600
Compound social-media degradation	Final test	DINOv2	Learned W	0.001	0.012	52.402	0.970	150	600
Compound social-media degradation	Final test	DINOv2	Matched-dimensional PCA	0.001	0.011	39.916	0.947	150	600
Compound social-media degradation	Final test	DINOv3	Learned W	0.000	0.002	20.299	0.895	150	600
Compound social-media degradation	Final test	DINOv3	Matched-dimensional PCA	0.018	0.016	6.610	0.618	150	600

How to read the distances

A squared projected distance is the squared Euclidean distance after applying the frozen projection. The prompt-macro ratio averages each prompt's different-seed / same-source-attack ratio, rather than pooling prompts. Pooled absolute means average all pair distances. Ordering accuracy is the fraction of triplets where the different SDXL seed is farther than the same-source attack.

Full prompt distribution

Representation	Prompts	Mean	Median	Prompts below 2×	Prompts below 5×	Prompts below 10×
caption_blip_base	150	2.437	1.846	85	138	146
dinov2_base	150	23.436	13.757	1	18	50
dinov3_l16	150	18.312	12.370	3	24	60

Learned and PCA 3D views

Illustrative auxiliary 3D projection: each panel shows the same selected final-test triplets. Learned and PCA panels for a representation share bounds.

Color = prompt. Circle = clean source. Triangle = attacked copy. Cross = different seed. Solid connector = source to attack; dashed connector = source to different seed.

DINOv2 learned

DINOv2 pca

DINOv3 learned

DINOv3 pca

Held-out breakdowns

Absolute distances cannot be compared across representations; compare values within a representation. Ratios and ordering accuracy summarize the within-representation comparison.

By fully held-out attack family

Track	Value	Ratio	Attack-distance mean	Different-seed mean	Ordering accuracy
dinov2_base	occlusion_overlay	23.726	0.001	0.012	0.932
dinov2_base	social_media_compound	52.402	0.001	0.012	0.970
dinov3_l16	occlusion_overlay	36.725	0.000	0.002	0.970
dinov3_l16	social_media_compound	20.299	0.000	0.002	0.895
caption_blip_base	occlusion_overlay	undefined because exact or near caption collisions make the prompt-macro ratio unstable	0.078	0.140	0.677
caption_blip_base	social_media_compound	undefined because exact or near caption collisions make the prompt-macro ratio unstable	0.083	0.146	0.657

By attack severity

Track	Value	Ratio	Attack-distance mean	Different-seed mean	Ordering accuracy
dinov2_base	medium	38.608	0.001	0.012	0.943
dinov2_base	mild	202.008	0.000	0.013	0.983
dinov2_base	severe	12.977	0.001	0.011	0.926
dinov3_l16	medium	38.211	0.000	0.002	0.919
dinov3_l16	mild	134.723	0.000	0.002	0.998
dinov3_l16	severe	16.239	0.000	0.002	0.880
caption_blip_base	medium	undefined because exact or near caption collisions make the prompt-macro ratio unstable	0.079	0.132	0.652
caption_blip_base	mild	undefined because exact or near caption collisions make the prompt-macro ratio unstable	0.058	0.148	0.730
caption_blip_base	severe	undefined because exact or near caption collisions make the prompt-macro ratio unstable	0.105	0.149	0.617

By prompt source

Track	Value	Ratio	Attack-distance mean	Different-seed mean	Ordering accuracy
dinov2_base	coco2017	23.546	0.000	0.005	0.955
dinov2_base	diffusiondb	23.326	0.001	0.019	0.947
dinov3_l16	coco2017	14.926	0.000	0.002	0.920
dinov3_l16	diffusiondb	21.697	0.000	0.002	0.945
caption_blip_base	coco2017	2.493	0.063	0.108	0.643
caption_blip_base	diffusiondb	2.382	0.099	0.179	0.690

By caption-divergence stratum

Track	Value	Ratio	Attack-distance mean	Different-seed mean	Ordering accuracy
dinov2_base	high	26.522	0.001	0.020	0.953
dinov2_base	low	16.841	0.000	0.004	0.945
dinov2_base	medium	26.944	0.001	0.012	0.955
dinov3_l16	high	24.385	0.000	0.002	0.958
dinov3_l16	low	12.882	0.000	0.002	0.907
dinov3_l16	medium	17.668	0.000	0.002	0.932
caption_blip_base	high	2.766	0.104	0.213	0.762
caption_blip_base	low	2.210	0.047	0.075	0.568
caption_blip_base	medium	2.336	0.090	0.142	0.670

Final held-out DINO results

These result numbers use only 150 untouched final prompts and 600 pairs per final family per representation. Training and validation families have protocol parameters above but no numbers in this final-test table.

DINO	Final family	Prompt-macro ratio	Attack-distance mean	Different-seed mean	Ordering accuracy	Reversed count / rate	Prompts	Pairs
dinov2_base	occlusion_overlay	23.726	0.001	0.012	0.932	41 / 0.068	150	600
dinov2_base	social_media_compound	52.402	0.001	0.012	0.970	18 / 0.030	150	600
dinov3_l16	occlusion_overlay	36.725	0.000	0.002	0.970	18 / 0.030	150	600
dinov3_l16	social_media_compound	20.299	0.000	0.002	0.895	63 / 0.105	150	600

Occlusion is a stress test

The colored-box occlusion results remain in the aggregate breakdown. Because the box is visibly content-obscuring, it is a visible stress test and should not be interpreted as content-preserving robustness evidence.

Social-media degradation by severity

Mild and medium are content-preserving candidates, not human-certified content preservation. Pooled ratio is pooled different-seed mean divided by pooled attack mean.

DINO	Severity	Pairs	Reversed count / rate	Attack mean	Different-seed mean	Pooled ratio	Interpretation
dinov2_base	medium	182	9 / 0.049	0.001	0.012	19.023	Content-preserving candidate
dinov2_base	mild	216	2 / 0.009	0.000	0.014	55.369	Content-preserving candidate
dinov2_base	severe	202	7 / 0.035	0.001	0.011	13.237	Stress severity
dinov3_l16	medium	182	23 / 0.126	0.000	0.002	5.912	Content-preserving candidate
dinov3_l16	mild	216	0 / 0.000	0.000	0.002	82.064	Content-preserving candidate
dinov3_l16	severe	202	40 / 0.198	0.000	0.002	4.343	Stress severity

Paired-model interpretation — prompt_000187

The same medium social-media degradation triplet produces opposite ordering outcomes: DINOv3: attack is 72.44× farther than the different generation; DINOv2: different generation is 75.95× farther than the attack.

Metric-aware image gallery

The main gallery contains only mild or medium compound social-media degradation cases. Successes maximize the weaker DINO ratio; Near tie cases are closest to a ratio of one; Reversed ordering failures minimize the target DINO ratio.

success · prompt_000135

social_media_compound

the feeling of writer's block

DINOv2 attack distance: 0.000; different-seed distance: 0.021. DINOv3 attack distance: 0.000; different-seed distance: 0.011.

Original source image — Clean source — seed 2

Attacked derivative — Attack — Compound social-media degradation. Severity: mild. Parameters: color: 0.96; JPEG quality: 82; long edge: 896; sharpen: 1.05

Different SDXL seed — Different generation — seed 5

success · prompt_000428

social_media_compound

realistic detailed image of a girl in a portal to hell in the heavenly old soviet room by Ayami Kojima, Amano, Karol Bak, Greg Hildebrandt, and Mark Brooks, Neo-Gothic, gothic, rich deep colors. Beksinski painting. art by Takato Yamamoto. masterpiece. ultra details, high quality, high resolution .

DINOv2 attack distance: 0.000; different-seed distance: 0.104. DINOv3 attack distance: 0.000; different-seed distance: 0.005.

near tie · prompt_000650

social_media_compound

a beautiful hyperrealistic fantasy painting of a pisces cerce lernean hydra hybrid kraken glistening in reflective iridescent scales and gilded scaleswith dimensional translucent purpose, 8 k, cryengine, cgsociety

DINOv2 attack distance: 0.004; different-seed distance: 0.004. DINOv3 attack distance: 0.000; different-seed distance: 0.000.

near tie · prompt_000492

social_media_compound

a big yellow truck that is on a road

DINOv2 attack distance: 0.000; different-seed distance: 0.006. DINOv3 attack distance: 0.001; different-seed distance: 0.001.

failure · prompt_000139

social_media_compound

award winning photo of a ginger cat

DINOv2 attack distance: 0.000; different-seed distance: 0.000. DINOv3 attack distance: 0.000; different-seed distance: 0.001.

failure · prompt_000187

social_media_compound

A bathroom with tiled walls and a white bath tub.

DINOv2 attack distance: 0.000; different-seed distance: 0.009. DINOv3 attack distance: 0.000; different-seed distance: 0.000.

Illustrated attack catalog

One deterministic final-prompt triplet per frozen family, selected by weaker-DINO log ratio closest to that family median (tie-broken by triplet key). These all-family distances are post-hoc exploratory; the preregistered primary test remains the two final-test families.

train · exploratory