Twenty-Prompt Attack vs Generation Study

Attack versus independent generation variation across twenty controlled prompts.

All distances reference each image’s own prompt baseline. Compare values only within the same encoder, space, dimension count, and metric.

The exact preexisting 600 images were reused; no images were regenerated.

Prompt-balanced full-space separation

Generation / attack is the mean distance between independently generated images divided by the mean distance between an attacked version of the same source image and its baseline. The attack distance defines the 1× reference; values above 1× mean that different semantic generations are farther apart than attacked copies.

Encoder	Attack mean	Generation mean	Generation / attack	95% CI
BLIP CLS	0.3566	0.5452	1.53×	1.3966–1.6668
CLIP	0.2385	0.4653	1.95×	1.7511–2.1467
DINOv2	0.2167	0.7732	3.57×	3.2325–3.9167
Qwen3-VL Embedding 2B	0.2435	0.5311	2.18×	1.9747–2.4272
DINOv3-L/16	0.2237	0.6334	2.83×	2.5057–3.2158
Qwen3-VL Embedding 8B	0.2993	0.6226	2.08×	1.8795–2.3107

DINOv2 vs DINOv3

DINOv2 produced the stronger separation signal in this experiment. This is specific to the completed twenty-prompt robustness protocol and is not a universal ranking of DINOv2 and DINOv3 as representation models.

Measured DINO separation
Encoder	Attack mean	Generation mean	Generation / attack	95% CI	AUC
DINOv2	0.2167	0.7732	3.568×	3.232–3.917	0.984
DINOv3-L/16	0.2237	0.6334	2.832×	2.506–3.216	0.940

Per-family caption robustness

Per-family caption robustness
Captioner	Attack family	Attack change	Generation change	Generation / attack	95% CI
BLIP caption	noise	0.1737	0.2954	1.70×	1.1716–2.8609
BLIP caption	noise_denoise	0.1645	0.2954	1.80×	1.2893–2.8910
BLIP caption	blur	0.1964	0.2954	1.50×	1.1156–2.2660
BLIP caption	geometric	0.1449	0.2954	2.04×	1.2568–3.6122
BLIP caption	compression	0.1093	0.2954	2.70×	1.8047–4.5860
BLIP caption	resampling	0.1002	0.2954	2.95×	1.9254–6.0923
Detailed Florence caption	noise	0.3210	0.5279	1.64×	1.3452–2.1093
Detailed Florence caption	noise_denoise	0.3441	0.5279	1.53×	1.2531–1.9604
Detailed Florence caption	blur	0.3774	0.5279	1.40×	1.1716–1.7559
Detailed Florence caption	geometric	0.2778	0.5279	1.90×	1.6137–2.3282
Detailed Florence caption	compression	0.2551	0.5279	2.07×	1.7317–2.6112
Detailed Florence caption	resampling	0.2841	0.5279	1.86×	1.4158–2.6666
Qwen3-VL 8B neutral	noise	0.4552	0.6936	1.52×	1.3836–1.6814
Qwen3-VL 8B neutral	noise_denoise	0.4828	0.6936	1.44×	1.3383–1.5517
Qwen3-VL 8B neutral	blur	0.5847	0.6936	1.19×	1.1210–1.2619
Qwen3-VL 8B neutral	geometric	0.4491	0.6936	1.54×	1.3987–1.7459
Qwen3-VL 8B neutral	compression	0.4294	0.6936	1.62×	1.4788–1.7866
Qwen3-VL 8B neutral	resampling	0.4549	0.6936	1.52×	1.3757–1.7111
Qwen3-VL 8B artifact-invariant	noise	0.4346	0.6728	1.55×	1.3793–1.7741
Qwen3-VL 8B artifact-invariant	noise_denoise	0.4467	0.6728	1.51×	1.3282–1.7439
Qwen3-VL 8B artifact-invariant	blur	0.5477	0.6728	1.23×	1.1486–1.3280
Qwen3-VL 8B artifact-invariant	geometric	0.4078	0.6728	1.65×	1.4409–1.9295
Qwen3-VL 8B artifact-invariant	compression	0.3836	0.6728	1.75×	1.5262–2.0534
Qwen3-VL 8B artifact-invariant	resampling	0.4409	0.6728	1.53×	1.3638–1.7492

Paired prompt ablation

Neutral uses the standard scene-description instruction: describe the visible objects, actions, scene, and relationships. Artifact-invariant uses the same Qwen3-VL 8B model with a different instruction: focus on stable semantic content and ignore minor blur, noise, JPEG, resampling, and color artifacts. This comparison tests an instruction change—not a different model—and is not a proven paper method.

Paired prompt ablation
Attack family	Helpful prompts	Generation preserved	Mean invariant − neutral attack change
blur	13/20	20/20	-0.0370
compression	13/20	20/20	-0.0458
geometric	13/20	20/20	-0.0413
noise	12/20	20/20	-0.0206
noise_denoise	13/20	20/20	-0.0361
resampling	10/20	20/20	-0.0140

Runtime and provenance

Runtime and peak GPU memory
Mode	Runtime seconds	Peak GPU memory GiB
Runtime/memory remains recorded in immutable shard provenance.

Exact model revisions
Component	Model	Revision	Role
DINOv3-L/16	facebook/dinov3-vitl16-pretrain-lvd1689m	`ea8dc2863c51be0a264bab82070e3e8836b02d51`	embedding
Qwen3-VL Embedding 8B	Qwen/Qwen3-VL-Embedding-8B	`2c4565515e0f265c6511776e7193b22c0968ddc7`	embedding
Qwen3-VL 8B artifact-invariant	Qwen/Qwen3-VL-8B-Instruct	`0c351dd01ed87e9c1b53cbc748cba10e6187ff3b`	prompt_ablation
Qwen3-VL 8B neutral	Qwen/Qwen3-VL-8B-Instruct	`0c351dd01ed87e9c1b53cbc748cba10e6187ff3b`	primary

BLIP CLS

Normalized full embedding spaces are encoder-specific. Raw-global PCA is fitted to the original embeddings from all prompts, so prompt identity and image variation both affect its axes. Centered-global PCA first subtracts each prompt’s baseline embedding, then fits one shared set of axes to the resulting within-prompt displacements; all prompt baselines therefore share the origin. Axes are shared only within the same encoder. Local PCA axes are not shared.

Full-space distributions and PCA views

Full-space L2 histogram plot — Full-space L2 histogram

Full-space L2 violin / boxplot plot — Full-space L2 violin / boxplot

Raw-global 2D PCA plot — Raw-global 2D PCA

Raw-global 3D PCA plot — Raw-global 3D PCA

Centered-global 2D PCA plot — Centered-global 2D PCA

Centered-global 3D PCA plot — Centered-global 3D PCA

Explained variance plot — Explained variance

Mean / attack separation factor plot — Mean / attack separation factor

Prompt-balanced minimum, median, and maximum

Embedding generalization
Attack mean	Generation mean	Generation / attack	95% CI	Distance-only AUC	Held-out protocol
0.3566	0.5452	1.53×	1.3966–1.6668	0.8499	use separator evaluation prompt and prompt-plus-family folds

CLIP

Full-space distributions and PCA views

Prompt-balanced minimum, median, and maximum

Embedding generalization
Attack mean	Generation mean	Generation / attack	95% CI	Distance-only AUC	Held-out protocol
0.2385	0.4653	1.95×	1.7511–2.1467	0.8920	use separator evaluation prompt and prompt-plus-family folds

DINOv2

Full-space distributions and PCA views

Prompt-balanced minimum, median, and maximum

Embedding generalization
Attack mean	Generation mean	Generation / attack	95% CI	Distance-only AUC	Held-out protocol
0.2167	0.7732	3.57×	3.2325–3.9167	0.9841	use separator evaluation prompt and prompt-plus-family folds

DINOv3-L/16

Full-space distributions and PCA views

Prompt-balanced minimum, median, and maximum

Embedding generalization
Attack mean	Generation mean	Generation / attack	95% CI	Distance-only AUC	Held-out protocol
0.2237	0.6334	2.83×	2.5057–3.2158	0.9395	use separator evaluation prompt and prompt-plus-family folds

Qwen3-VL Embedding 2B

Full-space distributions and PCA views

Prompt-balanced minimum, median, and maximum

Embedding generalization
Attack mean	Generation mean	Generation / attack	95% CI	Distance-only AUC	Held-out protocol
0.2435	0.5311	2.18×	1.9747–2.4272	0.9288	use separator evaluation prompt and prompt-plus-family folds

Qwen3-VL Embedding 8B

Full-space distributions and PCA views

Prompt-balanced minimum, median, and maximum

Embedding generalization
Attack mean	Generation mean	Generation / attack	95% CI	Distance-only AUC	Held-out protocol
0.2993	0.6226	2.08×	1.8795–2.3107	0.9198	use separator evaluation prompt and prompt-plus-family folds