Twenty-Prompt Attack vs Generation Study

Attack versus independent generation variation across twenty controlled prompts.

All distances reference each image’s own prompt baseline. Compare values only within the same encoder, space, dimension count, and metric.

The exact preexisting 600 images were reused; no images were regenerated.

Prompt-balanced full-space separation

The ratio column compares each group’s mean distance with the baseline-derived attack mean; attacks therefore define the 1× reference.

Encoder	Attack mean	Generation mean	Generation / attack	95% CI
BLIP CLS	0.3566	0.5452	1.53×	1.3966–1.6668
CLIP	0.2385	0.4653	1.95×	1.7511–2.1467
DINOv2	0.2167	0.7732	3.57×	3.2325–3.9167
Qwen3-VL Embedding 2B	0.2435	0.5311	2.18×	1.9747–2.4272
DINOv3-L/16	0.2237	0.6334	2.83×	2.5057–3.2158
Qwen3-VL Embedding 8B	0.2993	0.6226	2.08×	1.8795–2.3107

DINOv2 vs DINOv3

DINOv2 produced the stronger separation signal in this experiment. This is specific to the completed twenty-prompt robustness protocol and is not a universal ranking of DINOv2 and DINOv3 as representation models.

Measured DINO separation
Encoder	Attack mean	Generation mean	Generation / attack	95% CI	AUC
DINOv2	0.2167	0.7732	3.568×	3.232–3.917	0.984
DINOv3-L/16	0.2237	0.6334	2.832×	2.506–3.216	0.940

Per-family caption robustness

Per-family caption robustness
Captioner	Attack family	Attack change	Generation change	Generation / attack	95% CI	Collapse checks
BLIP caption	noise	0.1737	0.2954	1.70×	1.1716–2.8609	Collapse warning
BLIP caption	noise_denoise	0.1645	0.2954	1.80×	1.2893–2.8910	Collapse warning
BLIP caption	blur	0.1964	0.2954	1.50×	1.1156–2.2660	Collapse warning
BLIP caption	geometric	0.1449	0.2954	2.04×	1.2568–3.6122	Collapse warning
BLIP caption	compression	0.1093	0.2954	2.70×	1.8047–4.5860	Collapse warning
BLIP caption	resampling	0.1002	0.2954	2.95×	1.9254–6.0923	Collapse warning
Detailed Florence caption	noise	0.3210	0.5279	1.64×	1.3452–2.1093	Passed
Detailed Florence caption	noise_denoise	0.3441	0.5279	1.53×	1.2531–1.9604	Passed
Detailed Florence caption	blur	0.3774	0.5279	1.40×	1.1716–1.7559	Passed
Detailed Florence caption	geometric	0.2778	0.5279	1.90×	1.6137–2.3282	Passed
Detailed Florence caption	compression	0.2551	0.5279	2.07×	1.7317–2.6112	Passed
Detailed Florence caption	resampling	0.2841	0.5279	1.86×	1.4158–2.6666	Passed
Qwen3-VL 8B neutral	noise	0.4552	0.6936	1.52×	1.3836–1.6814	Passed
Qwen3-VL 8B neutral	noise_denoise	0.4828	0.6936	1.44×	1.3383–1.5517	Passed
Qwen3-VL 8B neutral	blur	0.5847	0.6936	1.19×	1.1210–1.2619	Passed
Qwen3-VL 8B neutral	geometric	0.4491	0.6936	1.54×	1.3987–1.7459	Passed
Qwen3-VL 8B neutral	compression	0.4294	0.6936	1.62×	1.4788–1.7866	Passed
Qwen3-VL 8B neutral	resampling	0.4549	0.6936	1.52×	1.3757–1.7111	Passed
Qwen3-VL 8B artifact-invariant	noise	0.4346	0.6728	1.55×	1.3793–1.7741	Passed
Qwen3-VL 8B artifact-invariant	noise_denoise	0.4467	0.6728	1.51×	1.3282–1.7439	Passed
Qwen3-VL 8B artifact-invariant	blur	0.5477	0.6728	1.23×	1.1486–1.3280	Passed
Qwen3-VL 8B artifact-invariant	geometric	0.4078	0.6728	1.65×	1.4409–1.9295	Passed
Qwen3-VL 8B artifact-invariant	compression	0.3836	0.6728	1.75×	1.5262–2.0534	Passed
Qwen3-VL 8B artifact-invariant	resampling	0.4409	0.6728	1.53×	1.3638–1.7492	Passed

Paired prompt ablation

The artifact-invariant prompt is a prompt-intervention ablation, not a proven paper method.

Paired prompt ablation
Attack family	Helpful prompts	Generation preserved	Mean invariant − neutral attack change
blur	13/20	20/20	-0.0370
compression	13/20	20/20	-0.0458
geometric	13/20	20/20	-0.0413
noise	12/20	20/20	-0.0206
noise_denoise	13/20	20/20	-0.0361
resampling	10/20	20/20	-0.0140

Runtime and provenance

Runtime and peak GPU memory
Mode	Runtime seconds	Peak GPU memory GiB
Runtime/memory remains recorded in immutable shard provenance.

Exact model revisions
Component	Model	Revision	Role
DINOv3-L/16	facebook/dinov3-vitl16-pretrain-lvd1689m	`ea8dc2863c51be0a264bab82070e3e8836b02d51`	embedding
Qwen3-VL Embedding 8B	Qwen/Qwen3-VL-Embedding-8B	`2c4565515e0f265c6511776e7193b22c0968ddc7`	embedding
Qwen3-VL 8B artifact-invariant	Qwen/Qwen3-VL-8B-Instruct	`0c351dd01ed87e9c1b53cbc748cba10e6187ff3b`	prompt_ablation
Qwen3-VL 8B neutral	Qwen/Qwen3-VL-8B-Instruct	`0c351dd01ed87e9c1b53cbc748cba10e6187ff3b`	primary

BLIP CLS

Normalized full embedding spaces are encoder-specific. Raw-global axes are shared only within an encoder. Centered-global PCA fits 580 nonbaseline displacements; all prompt baselines share the origin. Local PCA axes are not shared.

Full-space distributions and PCA views

Full-space L2 histogram plot — Full-space L2 histogram

Full-space L2 violin / boxplot plot — Full-space L2 violin / boxplot

Raw-global 2D PCA plot — Raw-global 2D PCA

Raw-global 3D PCA plot — Raw-global 3D PCA

Centered-global 2D PCA plot — Centered-global 2D PCA

Centered-global 3D PCA plot — Centered-global 3D PCA

Explained variance plot — Explained variance

Mean / attack separation factor plot — Mean / attack separation factor

Prompt-balanced minimum, median, and maximum

Embedding generalization
Attack mean	Generation mean	Generation / attack	95% CI	Distance-only AUC	Held-out protocol
0.3566	0.5452	1.53×	1.3966–1.6668	0.8499	use separator evaluation prompt and prompt-plus-family folds

CLIP

Full-space distributions and PCA views

Prompt-balanced minimum, median, and maximum

Embedding generalization
Attack mean	Generation mean	Generation / attack	95% CI	Distance-only AUC	Held-out protocol
0.2385	0.4653	1.95×	1.7511–2.1467	0.8920	use separator evaluation prompt and prompt-plus-family folds

DINOv2

Full-space distributions and PCA views

Prompt-balanced minimum, median, and maximum

Embedding generalization
Attack mean	Generation mean	Generation / attack	95% CI	Distance-only AUC	Held-out protocol
0.2167	0.7732	3.57×	3.2325–3.9167	0.9841	use separator evaluation prompt and prompt-plus-family folds

DINOv3-L/16

Full-space distributions and PCA views

Prompt-balanced minimum, median, and maximum

Embedding generalization
Attack mean	Generation mean	Generation / attack	95% CI	Distance-only AUC	Held-out protocol
0.2237	0.6334	2.83×	2.5057–3.2158	0.9395	use separator evaluation prompt and prompt-plus-family folds

Qwen3-VL Embedding 2B

Full-space distributions and PCA views

Prompt-balanced minimum, median, and maximum

Embedding generalization
Attack mean	Generation mean	Generation / attack	95% CI	Distance-only AUC	Held-out protocol
0.2435	0.5311	2.18×	1.9747–2.4272	0.9288	use separator evaluation prompt and prompt-plus-family folds

Qwen3-VL Embedding 8B

Full-space distributions and PCA views

Prompt-balanced minimum, median, and maximum

Embedding generalization
Attack mean	Generation mean	Generation / attack	95% CI	Distance-only AUC	Held-out protocol
0.2993	0.6226	2.08×	1.8795–2.3107	0.9198	use separator evaluation prompt and prompt-plus-family folds