PaperlayerView exact revision on arXiv

Source-linked AI summary

Mind the Spike: Mechanisms and Brittleness of Visual Massive Activations in Large Vision-Language Models

Jonas Ngnawé, Yann Pequignot, Sabyasachi Sahoo, Christian Gagné, Frédéric Precioso, Sanmi Koyejo

arXiv:2609.32808v1cs.LGcs.AIcs.CLcs.CV

TL;DR

The paper asks how visual spikes form across LVLMs, where they arise, and how image perturbations affect them. It analyzes their triggers and locations and tests interventions, finding that spikes are brittle and can be created or removed with small perturbations.

  • Problem

    It is unclear whether visual spikes form consistently across LVLMs, what triggers and distinguishes spike tokens, and how spikes respond to image perturbations.

    Source: §1 · p. 2

  • Method

    The paper examines visual-spike triggers and pre-decoder token representations, then uses trigger-guided perturbations and a preventive intervention to manipulate spikes.

    Source: §1 · pp. 2–3

  • Results

    Common corruptions create and relocate spikes more often than they remove them, and an ℓ∞ budget of 1/255 suffices for the spike attack in nine of ten spiking models.

    Source: §1 · p. 3

  • Takeaways & Limitations

    The study establishes control over visual-spike creation, relocation, and suppression, while the spikes’ functional role remains open.

    Source: §1 · p. 3, §7 · p. 9

    Whether and when visual massive activations contribute to model behavior, including in multi-image reasoning and video, remains unresolved.

    Source: §7 · pp. 9–10

Abstract

from arXiv · show

Large vision-language models (LVLMs) inherit massive activations from their text-only bases: spikes where a few fixed hidden channels receive values thousands of times above the typical magnitude. The text spike systematically appears in early layers at a fixed initial position, independently of input content. Visual spikes vary across images, but whether their formation follows a consistent pattern across LVLMs and how they respond to image perturbations remain open questions. We find that some LVLMs do not form visual spikes, while others spike at different rates, typically in deeper layers. We identify the trigger direction from model weights and an interpretable location rule: before the language model decoder runs, eventual spike tokens are largely restricted to those sharing least with the rest of the image. Crucially, visual spikes are strikingly brittle. Common corruptions frequently create and relocate spikes, and less often remove them, raising overall incidence. Our trigger-guided spike attack deliberately creates or removes spikes under a small $\ell_\infty$ budget, with 1/255 enough in nine of the ten models that spike. Finally, our preventive intervention removes only the trigger component before spikes erupt, eliminating or substantially reducing spikes on clean and perturbed images while leaving the other image tokens nearly unchanged. Our study spans 25 adapter-based LVLMs built on 18 released text-only bases from 10 families, ranging from 2B to 72B parameters.

1 INTRODUCTION

Visual spikes reuse inherited text-spike channels, but their formation varies across LVLMs and images, leaving their trigger, location, and perturbation sensitivity open questions. Across a broad model set, the paper characterizes these mechanisms and shows that visual spikes are brittle and can be controlled.

1 INTRODUCTION

  • Visual-spike formation raises open questions about its consistency across models, token location, triggering mechanism, and sensitivity to image perturbations.Visual spikes use inherited channels but vary in location across images, unlike the text spike’s fixed early position.Source: §1 · pp. 1–2
  • Ten LVLMs form visual spikes at different rates, while fifteen do not; image tokens reach a typically deeper visual switch only under some visual adaptations.The study examines 25 adapter-based LVLMs built on 18 text-only bases from 10 families, spanning 2B to 72B parameters.Source: §1 · p. 2
  • Before decoder execution, eventual spike tokens are largely restricted to image tokens sharing least with the rest of the image, a finer location rule than background preference.Scaling down a chosen region as small as one tenth of the image draws the spike into that region.Source: §1 · pp. 2–3
  • Common corruptions create and relocate visual spikes more often than they remove them, and trigger-guided attacks create or remove spikes with an ℓ∞ budget of 1/255 in nine of ten spiking models.Model yes/no answers remain unchanged on 93 to 100% of attack attempts despite no explicit answer-preservation objective.Source: §1 · p. 3
  • The preventive intervention removes the trigger component before the spike is written, reducing spikes on clean and perturbed images while preserving ordinary-token writes.It eliminates clean-image spikes in six of ten models and preserves model outputs in eight of ten.Source: §1 · p. 3
  • The study connects spike formation to an inherited switch and trigger, and demonstrates control over spike creation, relocation, and suppression.The visual switch’s trigger direction is formulated from the block’s weights; the paper also reports that blocking the eventual spike token’s attention to the text spike suppresses visual spikes on 75 to 100% of images.Source: §1 · pp. 2–3

2 BACKGROUND AND SETUP

This section establishes the inherited text-spike mechanism, defines the measures used to distinguish massive activations from channel concentration, and describes the model and evaluation setup.

Formalism of text spike formation

  • A text spike is written when a high-gain feed-forward writer aligns with a trigger direction; the responsible block is called the switch, or text switch for text spikes.The cited formalism calls this block the step-up block; at position 0, self-attention drives the first token’s residual toward the trigger direction.Source: §2 · p. 3

Spike measurements

  • Across the 25 LVLMs, the common channel-concentration definition flags tokens broadly, while the original massive-activation criterion identifies spikes in only ten models.The figure reports that 23 models have at least one token passing ϕ ≥ 20 in every image, while ten models spike under the original criterion.Source: Figure 3 · p. 4
  • The original massive-activation ratio compares activation magnitude with the layer-wide median, whereas the channel-concentration ratio measures concentration within a token.The original criterion requires an eligible image token to meet Ψ ≥ 1,000 and absolute magnitude at least 100 in a measured deep layer; the concentration criterion uses ϕ ≥ 20.Source: §2 · p. 4

Attention sink

  • An image token is an attention sink when its attention, averaged across heads and subsequent text queries, reaches the stated threshold in a measured deep layer.The measure is defined independently of massive activations.Source: §2 · p. 4

Setup

  • The study evaluates 25 open adapter-based LVLMs and their text-only bases on 300 clean COCO validation images per model, with task performance assessed on POPE, VQAv2, and COCO captioning.It records image-token residual states after each decoder block and uses accuracy, VQA accuracy, and CIDEr for the three tasks, respectively.Source: §2 · p. 4

3 WHEN AND HOW VISUAL SPIKES FORM

Visual spikes occur in only some LVLMs, where an inherited switch writes them when image-token states align with its trigger. The section identifies that switch and its trigger, and tests how adaptation and attention shape whether spikes form.

3.1 VISUAL SPIKES ARE NOT UNIVERSAL ACROSS LVLMS

  • Ten of 25 LVLMs spike, with clean-image incidence from 1.7 to 100%; the other fifteen reach at most 877, below the 1,000 criterion.Incidence varies by up to 87 percentage points across adaptations sharing a base, without changing the observed spiking regime.Source: §3.1 · p. 5
  • The concentration criterion ϕ ≥20 selects 83 to 100% of tokens in 21 models, whereas Ψ ≥1,000 selects at most 1% on the same forwards.Calibrating the concentration threshold does not recover the two regimes; attention-sink measurements support their separation while distinguishing sinks from massive activations.Source: §3.1 · p. 5

3.2 THE VISUAL SWITCH

  • In ten spiking models, one block raises a spike-channel value from tens to thousands; the fifteen non-spiking models have no such write.The visual switch lies later than the text switch in nine of ten models; Pixtral-12B uses the same block for both.Source: §3.2 · p. 5
  • Image tokens activate the visual switch by aligning with its trigger direction, and the switch block, writer, and trigger are inherited from the text-only base.The text switch can instead be activated by a sufficiently small input norm, while ordinary image tokens at their own norm do not follow that route.Source: §3.2 · pp. 5–6
  • The visual spike depends on attention to the text spike token: blocking that attention suppresses spikes on 75 to 100% of images.The adaptation makes an inherited switch reachable: image tokens can pass one to fifteen candidate blocks without spiking, and the base spikes on most images when given the LVLM state entering the visual switch.Source: §3.2 · p. 6

3.3 TRIGGER DIRECTION ESTIMATION

  • The estimated trigger maximizes the signed writer output over unit inputs, retaining the full block nonlinearity; its direction matches the measured-sign eigenvector at cosine 0.999 to 1.000.The sign is measured on a forward pass at the switch, and the full nonlinear objective selects the orientation that produces that write.Source: §3.3 · p. 6
  • At the switch input, the eventual spike token’s median trigger cosine is 0.08 to 0.62, while 99% of other tokens lie below 0.05.The trigger estimate underlies the spike attack and preventive intervention; Table 1 compares trigger removal on clean, corrupted, and attack images, with a random direction leaving reported clean spike rates unchanged.Source: §3.3 · pp. 6–7, Table 1 · p. 7

4 WHERE THE VISUAL SPIKE FORMS

Before the decoder runs, eventual spike tokens are largely among those sharing least with the rest of the image. Their selection among these candidates is completed near the visual switch, and reducing a region’s token vectors can draw the spike into it.

4 WHERE THE VISUAL SPIKE FORMS

  • The shared part—the token’s projection onto the mean direction of the other image tokens—best ranks eventual spike tokens, with median AUC 0.893 and FPR@95 28%.The norm yields 0.850 and 48%, and direction yields 0.824 and 78%; neither component alone locates spike tokens consistently across models.Source: §4 · p. 7
  • The eventual spike token falls in the least-shared tenth on 43 to 97% of spiking images, versus 10% by chance, and in the least-shared quarter on 71 to 100%.Across all ten models, lower shared part correlates with later trigger alignment; the least-shared tenth has higher mean alignment than the most-shared tenth in every model.Source: §4 · p. 7
  • The least-shared rule is finer than background preference: background covers 60 to 75% of tokens and adds little localization once the least-shared tenth is known.The spike token rarely decodes to the scene, even when it and another marked token both lie in the sky.Source: §4 · p. 7
  • The shared part fixes candidate tokens before decoding, while their states decide among candidates near the switch; swapping states moves the spike more often closer to that switch.In eight models, trigger alignment remains near zero until one or two blocks before the switch, where attention and feed-forward writes produce it.Source: §4 · pp. 7–8
  • Scaling a region’s vectors to a tenth draws the spike into it in six models, including regions as small as a tenth of the image or a single token.The scaled tokens become least-shared candidates and, in affected models, the smallest candidate takes the spike; the effect does not occur in Qwen2.5-VL-32B or Pixtral-12B.Source: §4 · p. 8

5 VISUAL SPIKES ARE BRITTLE TO IMAGE PERTURBATIONS

Visual spikes depend on image-token trajectories and are brittle to image changes: corruptions often create or relocate spikes, and a trigger-guided attack can deliberately create or remove them. These internal changes can occur while answers remain unchanged.

5 VISUAL SPIKES ARE BRITTLE TO IMAGE PERTURBATIONS

  • Across ten spiking models and six corruptions, 3,152 spikes are created against 476 removals, raising overall incidence despite model–operator exceptions.Yes/no decisions remain unchanged on 73.5 to 96.5% of forwards.Source: §5 · p. 8
  • Incidence alone misses relocation: brightness changes Qwen3-VL-32B incidence from 0.41 to 0.39 while 39 questions gain a spike and 43 lose one.Among forwards spiking both before and after corruption, token location changes on 85 to 100% in three Qwen3-VL models and 96 to 100% in Molmo2-8B.Source: §5 · p. 8
  • At an ℓ∞ budget of 1/255, the trigger-guided attack creates spikes on 53 to 100% of eligible images and removes them on 95 to 100% in the reported models.The attack’s signed objective creates or abolishes the state, and its answer-independent optimization targets spike-criterion flips.Source: §5 · p. 8
  • Table 2 compares edits across ten spiking models; each cell reports the median and range, while zero-counts record models with no spiking forwards.Its token-level cosine and norm-ratio measures compare feed-forward outputs under edits; bold identifies the best spike-removing edit.Source: Table 2 · p. 9
  • The attack can alter a large internal state while decisions remain stable: yes/no answers are unchanged on 93 to 100% of attempts.On free-form tasks, VQAv2 accuracy changes by 0.6 to 4.9 percentage points in absolute value, while CIDEr moves between −0.10 and +0.11.Source: §5 · p. 9

6 PREVENTIVE INTERVENTION

The preventive intervention removes the estimated trigger component before the visual switch writes a spike, without deleting tokens or changing weights. It suppresses spikes on clean and perturbed inputs while largely preserving ordinary-token outputs and task results.

6 PREVENTIVE INTERVENTION

  • The intervention projects the switch’s feed-forward input away from the trigger while preserving the residual connection; it deletes no tokens and changes no weights.Unlike post-formation spike-token removal, the edit acts before the massive write.Source: §6 · p. 9
  • On clean POPE inputs, trigger removal eliminates spikes in six of ten models and reduces incidence by 45 to 81% in the others.Suppression persists across six corruptions and attack-produced images; five models remain at zero incidence on corrupted inputs.Source: §6 · p. 9
  • Across eight models, 1,599 of 1,600 clean POPE answers are identical; VQA accuracy shifts by at most 0.006 and CIDEr by at most 0.010.Molmo2-8B and Pixtral-12B retain 53% and 13% of captions, respectively.Source: §6 · p. 9
  • Trigger removal preserves ordinary-token feed-forward outputs, with median cosine 0.999 and norm ratio 1.000, while changing writes most on would-be spike tokens.Zeroing the feed-forward input also zeroes its output, whereas a random-direction edit leaves spikes untouched.Source: §6 · p. 9

7 CONCLUSION

The study controls visual massive activations but does not establish whether they support useful computation. Suppression leaves behavior nearly unchanged in eight spiking models, while free-form outputs change substantially in two; possible roles under other conditions, including multi-image reasoning and video, remain open.

7 CONCLUSION

  • Suppressing spikes leaves behavior nearly unchanged in eight of ten spiking models but substantially changes free-form outputs in the other two.These changes alone do not establish whether spikes support useful computation.Source: §7 · pp. 9–10
  • The study establishes control over creating, relocating, and suppressing visual massive activations.Source: §7 · p. 9
  • Whether and when visual massive activations contribute to model behavior remains an open question.Stable answers after suppression do not rule out a role under other conditions.Source: §7 · p. 10

REPRODUCIBILITY STATEMENT

The paper describes its model, image, measurement, and attack setup, along with the compute used for reported experiments. It states that code producing every table and figure will be released.

REPRODUCIBILITY STATEMENT

  • The project used about 53 B200-hours for the reported work, with roughly 23 hours spent on attacks.The attack consumed most of its time on Molmo2-8B and InternVL3.5-38B; exploratory and superseded runs are excluded.Source: REPRODUCIBILITY STATEMENT · p. 10
  • Measurements use 300-image COCO val2014 censuses and a separate POPE-derived manifest for perturbation and location runs.The passage also specifies fixed-seed sampling, image sets, and model input-size conventions.Source: REPRODUCIBILITY STATEMENT · p. 10
  • The paper specifies procedures for measuring spikes, estimating triggers, running attacks, and applying Gaussian noise.It states that code producing every table and figure will be released.Source: REPRODUCIBILITY STATEMENT · p. 10

THE USE OF LARGE LANGUAGE MODELS

Large language models assisted with writing, related-work retrieval, analysis code, experiments, and project records. The authors retain responsibility for the claims and describe the research questions, terminology decisions, and final text as theirs.

THE USE OF LARGE LANGUAGE MODELS

ETHICS STATEMENT

The paper describes a white-box attack and preventive intervention, reviews prior work on visual spikes, and documents its model, compute, and data setups. Its related-work discussion distinguishes activation spikes from attention sinks and from tokens already massive before decoder processing.

ETHICS STATEMENT

  • The white-box attack targets the internal activation state in open vision-language models, requires model weights, and does not optimize the model's answer.The attack and preventive intervention were evaluated only on public checkpoints and public benchmark images.Source: ETHICS STATEMENT · p. 10

A RELATED WORK

  • The paper separates language-model-written visual spikes from tokens already massive at decoder input and finds the visual switch differs from the text-spike writing block in nine of ten spiking models.It also identifies a pre-decoder location rule based on tokens sharing least with the rest of the image.Source: A RELATED WORK · pp. 16–17
  • The original magnitude criterion distinguishes spiking and non-spiking regimes that channel-concentration criteria can obscure.Independent attention measurements largely support that separation.Source: A RELATED WORK · p. 16
  • Unlike prior attacks targeting answer-token attention and hallucinated content, this spike attack targets image tokens and the massive-activation state.It uses the inherited trigger to create or remove the state under a small pixel budget without using the answer as its objective or stopping rule.Source: A RELATED WORK · p. 17

B.1 MODELS

  • The 25 adapter-based vision-language models are grouped by base language model, and the table reports clean VSIκ and largest clean peak.Within a shared base, adaptation moves the rate but does not change spiking status; the reported spike channels coincide with the base's top text-spike dimension where probed.Source: §B.1 · pp. 17–18, Table 3 · p. 18

B.2 COMPUTE

  • Runs use a single NVIDIA B200 GPU, and the reported reproduction cost is about 53 B200-hours.The attack accounts for roughly 23 hours; exploratory and superseded runs are not counted in the total.Source: §B.2 · pp. 18–19

B.3 DATA AND PREPROCESSING

  • Images come from fixed-seed COCO val2014 sampling, with a separate POPE-derived manifest used for perturbation and location runs.Each run recomputes Ψpeak on its own forward, and reported measurements identify the input size used.Source: §B.3 · p. 19

B.4 MEASUREMENT PROTOCOL

The measurement protocol defines which image tokens and decoder states count toward spike incidence, then evaluates spike-token distinctiveness and attention sinks. It also specifies the corruption conditions used in the analysis.

B.4 MEASUREMENT PROTOCOL

  • The scan excludes image tokens already at 100 on inherited spike channels and measures eligible tokens across the deep 60% of decoder states.That scan finds every image detected by a full-state scan except one of 7,500; Pixtral-12B’s incidence is 99.7% because its spike begins at block 2.Source: §B.4 · p. 19
  • At Ψ≥1,000, the peak token stands 18 to 378 times above the runner-up in nine spiking models, while non-spiking models’ peak-to-runner-up ratio is at most 2.1.Molmo2-8B is an exception, spiking on a median of seven tokens per image.Source: §B.4 · p. 20, Table 4 · p. 20
  • Attention sinks are measured from head-mean attention over image tokens, with a sink declared when the share reaches 0.3 in a deep block.The protocol reads attention on POPE, VQAv2, and captioning tasks.Source: §B.4 · pp. 20–21
  • Between 2 and 35 of 200 evaluation forwards change spiking status across attention implementations in eight models, and trigger alignment differs across the implementations.Census incidence uses the default implementation, whereas attention readings use eager attention.Source: §B.4 · p. 21, Table 5 · p. 21

B.5 CORRUPTIONS AND THEIR GRADES

  • The corruption panel uses six operators, including Gaussian noise at σ=0.45, blur at σ=3.2 pixels, JPEG quality 10, brightness increase 0.4, and contrast reduced to 0.1.Gaussian noise is added in [0, 1] pixel units before preprocessing; its five grades use σ values 0.05, 0.10, 0.19, 0.30, and 0.45.Source: §B.5 · p. 21

C WHEN AND HOW VISUAL SPIKES FORM

The appendix tests how spike criteria distinguish spiking from non-spiking models, how visual switches write spikes, and how those switches relate to their text-only bases. It finds that channel concentration thresholds do not reliably separate the regimes, while spike formation is associated with a trigger direction and a specific image-token location rule.

C.1 SPIKE CRITERIA AND ATTENTION

  • No single threshold on ϕ separates the regimes: a separating threshold would need to be at most 47.0 and above 86.1 simultaneously.Thresholds rescaled by hidden size or calibrated per model also fail to separate the groups.Source: §C.1 · pp. 22–23
  • Only the criterion at 1,000 separates the two groups, while the two lower criteria pass in 23 of 25 models, among four criteria evaluated on 300 census images per model.Source: Table 6 · p. 23
  • Of 4,184 spiking forwards, 3,529 have an attention sink, and the sink sits on a spike token on all but three; image-token attention remains far less persistent than the text spike token’s.Across all 25 models, the largest share held by any image token at a layer-head pair is 1.4%, versus 49 to 98% for the text spike token.Source: §C.1 · p. 23, Table 7 · p. 24

C.2 VISUAL SWITCHES AND TRIGGER DIRECTIONS

  • The trigger is derived from the visual-switch weights by maximizing the spike-channel write in the eruption’s sign, without using image inputs.For the five Qwen bases, the trigger agrees with the relevant eigenvector at the visual switch; the trigger survives adaptation.Source: §C.2 · pp. 24–25, Table 8 · p. 26
  • In nine spiking models with a later visual switch, that block writes 3,919 to 15,631 on the spike channel, while image-token peaks after the text switch are 3 to 165.The writing block’s down-projection row is nearly unchanged from the text-only base, at cosine 0.997.Source: §C.2 · pp. 25–26, Table 10 · p. 27
  • The spike token is aligned with the trigger at the visual switch, while the least-shared image tokens are those that later align with it.Scaling down a chosen region as small as one tenth of the image can draw the spike into that region.Source: Table 9 · p. 27
  • At position 0, small vectors can be carried onto the trigger, but image tokens at their own norm reach the spike level on at most 8.3% of forwards in all ten spiking models.Gaussian vectors at text norm reach the level on 99.9 to 100% of forwards in eight models.Source: §C.2 · pp. 27–28, Table 11 · p. 28, Table 12 · p. 28
  • The text-only base supplies a block capable of writing the spike, but whether an adaptation spikes depends on whether its image tokens align with that block’s trigger.Rules based on the base’s text switch or largest middle-third write correctly predict some held-out cases but fail on others.Source: §C.2 · pp. 29–31

D WHERE THE VISUAL SPIKE FORMS

Spike tokens tend to have the smallest shared part with the rest of the image, which predicts later trigger alignment. Region edits can redirect their location, while blocking attention to the earlier text spike often prevents the visual spike.

D.1 THE SHARED PART AND SPIKE LOCATION

  • The shared part correlates negatively with trigger alignment, including on non-spiking images, where the median correlation is −0.28 across nine models.This supports shared-part size as a pre-decoder locator of later trigger alignment, whether or not the image produces a spike.Source: §D.1 · p. 34, Table 23 · p. 35
  • Among background tokens, the spike token falls in the lowest shared-part decile on 50–100% of images, versus 10–12% for a random background token.Given the lowest decile, background adds little: 75–93% of spike tokens are background, versus 69–89% of tokens in that decile.Source: §D.1 · p. 34, Table 25 · p. 37
  • Neither token size nor direction locates spikes consistently across models; the shared part outperforms both in five of ten models.The norm is a better locator than direction in six models, while direction works for Qwen2.5-VL-32B but collapses in two Qwen3-VL models.Source: §D.1 · p. 35, Table 26 · p. 37
  • Under Gaussian noise at σ = 0.45, spike tokens remain at the 0th–18th shared-part percentile in nine spiking models, despite more images spiking.Counts rise from 13 to 113 in Qwen3-VL-8B and from 24 to 134 in InternVL3.5-4B; Molmo2-8B instead sits near the middle.Source: §D.1 · p. 35
  • At equal token coverage, the shared part locates more spike tokens than background; the spike token is generally ordinary-sized but unusually low in shared part.The figure compares spike-token share with background share as the fraction of tokens selected from the smallest shared part increases.Source: Figure 9 · p. 35, Figure 10 · p. 36
  • The spike token rarely carries scene content: its descriptions name the scene on 0–12% of images, versus 94–100% with real image tokens.In Qwen3-VL-4B, the spike token produces a repetitive pattern rather than the content at its image position.Source: §D.1 · p. 38, Table 27 · p. 39, Table 28 · p. 40

D.2 SELECTION AND ALIGNMENT OF THE SPIKE TOKEN

  • Blocking attention from the eventual visual spike token to the text spike leaves spikes on only 0–5% of images in six of nine models.The text spike’s value is small and nearly input-independent, so its attention contributes little content while changing what the remaining attention can read.Source: §D.2 · p. 40, Table 31 · p. 42

D.3 CONTROLLING THE SPIKE LOCATION

  • Scaling a quadrant’s tokens to a tenth draws the spike into it on 33–82% of spiking images in seven tested models; raising shared part at fixed norm keeps it out in seven.A 25-token block draws the spike on 47% and 38% in the two strongest models, versus 9.8% at random; success depends on the model and edit.Source: §D.3 · p. 43, Table 33 · p. 43

E.1 COMMON CORRUPTIONS ←-

Common corruptions often create or relocate visual spikes, and the trigger-guided attack deliberately creates or abolishes them under bounded pixel changes. The preventive intervention is evaluated on clean, corrupted, and attacked inputs.

E.1 COMMON CORRUPTIONS ←-

  • Across ten models and six corruptions, 3,152 questions gain a spike and 476 lose one; 50 of 60 model–operator cells change at least one question.Spike-token location also changes on 85–100% of persistent-spike forwards in three Qwen3-VL models, while accuracy loss ranges from 8.5–22.0 points under Gaussian noise to at most 5.5 under JPEG or brightness rise.Source: §E.1 · p. 47, Table 37 · p. 49

E.2 THE SPIKE ATTACK

  • The attack optimizes trigger alignment and spike-channel activation, using bounded iterative pixel updates to create or abolish the massive state.It stops when the spike criterion is met or removed; the model’s answer does not enter the objective or determine the stopping step.Source: §E.2 · p. 50
  • At one pixel level, attack success is assessed for creation and abolition across eligible images, with answer retention also reported.For free-form tasks, the attack succeeds on 90–100% of attempts in seven models and on 66 of InternVL3.5-38B’s 101 attempts.Source: Table 38 · p. 52, Table 39 · p. 53

F PREVENTIVE INTERVENTION

  • The preventive intervention removes the trigger component and is evaluated for spike incidence and accuracy on clean, corrupted, and attack-generated inputs.The supplied results tables cover ten models under corruption and images where the creating attack succeeded.Source: F PREVENTIVE INTERVENTION · p. 54, Table 40 · p. 54, Table 42 · p. 55

G SIX MODELS IN DETAIL

The six-model appendix cases show that models can differ in whether spikes form, where they arise, and how intervention affects related attention sinks.

G SIX MODELS IN DETAIL

  • Of six detailed models, Molmo2-8B spikes on every census image, Pixtral-12B on all but one, and the other four on none.Across six corruptions, Molmo2-8B relocates spikes on 96–100% of forwards and Pixtral-12B on 2–20%.Source: G SIX MODELS IN DETAIL · p. 56
  • Pixtral-12B spikes at its base’s text-switch block 2, while Molmo2-8B spikes at block 16 and carries in three already-massive image tokens.Molmo2-8B’s block-written spikes occur on several image tokens and at positions that vary by image; its carried-in massive tokens are not spike tokens.Source: G SIX MODELS IN DETAIL · p. 56
  • Pixtral-12B’s spike is an attention sink on every spiking forward, whereas Molmo2-8B forms one on 24–34% of forwards.For Molmo2-8B, every sink occurs on a block-written spike token, never on a carried-in one.Source: G SIX MODELS IN DETAIL · p. 56
  • Removing the trigger component eliminates Pixtral-12B’s spike write on all 200 questions, while on Molmo2-8B it removes 96% of the write.Pixtral-12B’s attention sink remains on every forward after intervention; Molmo2-8B’s sink disappears from every forward, with all answers unchanged for that model.Source: G SIX MODELS IN DETAIL · p. 56

H LIMITATIONS

The study is bounded by its model and input settings, and it leaves the origins and functional role of visual spikes unresolved. Future work could examine how training, broader modalities, and robustness-focused design shape these spikes.

H LIMITATIONS

  • The study covers adapter-based LVLMs with released text-only bases that carry text spikes, excluding natively multimodal models.The authors say this scope lets them separate inherited behavior from changes due to visual adaptation.Source: H LIMITATIONS · p. 57
  • Experiments use one image before text and do not test interleaved images, multiple images, video, audio, speech, or other modalities.The study focuses on vision and language, despite including an omni-model.Source: H LIMITATIONS · p. 57
  • The analysis explains spike production in trained models but does not trace how training reaches the trigger or which adaptation component makes it reachable.It also does not trace how the encoder, projector, or training objective creates the pre-decoder token structure linked to spike candidates.Source: H LIMITATIONS · p. 57
  • Empirical findings are limited to the studied datasets, prompts, corruptions, and budgets; the observed split does not prove non-spiking models can never spike.The attack is white-box and requires access to the visual switch and trigger, while the intervention was not tested against an adaptive attack optimized through it.Source: H LIMITATIONS · p. 57
  • The intervention’s behavioral effects vary by model, so its task-behavior preservation cannot be assumed across all spiking models.In Molmo2-8B and Pixtral-12B, free-form outputs change more than in the other eight models.Source: H LIMITATIONS · p. 57

I FUTURE WORK

  • Future work could identify how the encoder, projector, multimodal data, and optimization affect whether image tokens reach the inherited trigger.This may help predict which adaptations will spike.Source: I FUTURE WORK · p. 57
  • Training for robustness could target small image changes that steer tokens into or out of the trigger, complementing the current inference-time intervention.The intervention leaves trained weights unchanged, and the model remains susceptible to perturbations that create, move, or remove spikes.Source: I FUTURE WORK · p. 57
  • The functional role of visual spikes remains open, particularly whether they support useful computation in models where their removal changes free-form outputs.The authors also identify interleaved images, multi-image reasoning, video, and natively multimodal models as further tests of the mechanism.Source: I FUTURE WORK · pp. 57–58

Related papers

Loading 2609.32808v1…