PaperlayerView exact revision on arXiv

Source-linked AI summary

Still There, No Longer Seen: Exposing Compression-Induced Risk in Large Vision-Language Models

Qiankun Li, Yuechen Zhang, Bowen Chen, Shilinlu Yan, Zhenhong Zhou, Kun Wang, Li Sun

arXiv:2609.35002v1cs.CVcs.AIcs.CR

TL;DR

Visual-token compression can change LVLM robustness, while aggregate measures do not identify whether a particular failure is induced by compression. The paper uses paired full-token and compressed inference and introduces CIRA, an encoder-only attack that reallocates token priorities while preserving displaced evidence. Across 12 dataset–compressor settings, CIRA achieves a mean CSFR of 20.35% with Full ASR of 6.92%.

  • Problem

    The paper asks which adversarial failures can be attributed specifically to visual-token compression rather than vulnerabilities already present in the underlying LVLM.

    Source: §1 · pp. 1–2

  • Method

    CIRA uses vision-encoder-side objectives to reallocate token priorities while preserving displaced evidence, without requiring downstream questions or labels, the language model, deployed compressor, or exact budget.

    Source: §1 · p. 2

  • Results

    Across 12 dataset–compressor settings, CIRA achieves a mean CSFR of 20.35%, while its Full ASR is 6.92%.

    Source: §5.2 · p. 7

  • Takeaways & Limitations

    The results support treating the compression boundary as security-relevant and using paired full-token and compressed inference to attribute risk to compression.

    Source: §7 · p. 10

    The attack is evaluated under a restricted threat model with bounded image-space perturbations and vision-encoder-only access.

    Source: ETHICS STATEMENT · p. 10

Abstract

from arXiv · show

Visual token compression reduces the inference cost of Large Vision-Language Models (LVLMs). However, aggregate robustness measures do not reveal whether a particular adversarial failure is induced by compression or inherited from the underlying model. We define a compression-specific failure (CSF) as an adversarial input that remains correct under full-token inference but fails after compression, casting compression-induced risk as a paired failure attribution problem. Within a controlled diagnostic cohort, counterfactuals show that retained-set allocation causally changes compressed correctness and reveal a negative association between recovery and representation drift in displaced evidence. Motivated by these findings, we propose CIRA, a Compression-Induced Risk Attack for Large Vision-Language Models. Under a vision-encoder white-box setting, CIRA optimizes image perturbations through encoder-side objectives that manipulate token priorities across candidate compression budgets while preserving displaced evidence. CIRA uses no downstream questions or labels and requires no access to the language model, deployed compressor, or exact compression budget. Across 12 dataset-compressor settings evaluated at four budgets, CIRA achieves a mean CSFR of 20.35% while limiting full-token attack success to 6.92%, with similar behavior on additional LVLM families. A cross-view selection-stabilization defense substantially suppresses CIRA, although Adaptive CIRA partially restores its effectiveness. These results show that compression-specific failures persist under restricted access and support paired evaluation of full-token and compressed inference for attributing risk to visual-token compression.

1 INTRODUCTION

Visual-token compression can alter LVLM robustness, but the central question is whether a failure is caused by compression rather than inherited from the underlying model. The paper defines a paired criterion for identifying such failures and introduces an encoder-only attack guided by controlled diagnostics.

1 INTRODUCTION

  • Compression-specific failures matter because full-token robustness assessment misses adversarial failures confined to the compressed path.The paper asks which failures can be attributed specifically to compression and whether they can be induced when the deployed compressor and budget are unknown.Source: §1 · pp. 1–2
  • A compression-specific failure (CSF) occurs when an input remains correct under full-token inference but fails after compression.This paired criterion distinguishes compression-introduced failures from those already present in the underlying LVLM.Source: §1 · p. 2
  • Controlled counterfactuals show that retained-set allocation causally changes compressed correctness, while recovery is negatively associated with representation drift in displaced evidence.These findings motivate reallocating token priority while preserving displaced evidence.Source: §1 · p. 2
  • CIRA combines global encoder-side priority reallocation with preservation of displaced evidence to induce paired CSFs across compressor–budget settings.It uses vision-encoder white-box access without downstream questions or labels, the language model, deployed compressor, or exact compression budget.Source: §1 · pp. 2–3
  • The evaluation spans four compressors, three datasets, four budgets, and multiple LVLM families, and tests a cross-view selection-stabilization defense against standard and adaptive CIRA.The analysis includes evidence of global priority reallocation and limited representation drift in displaced evidence.Source: §1 · p. 3

2 RELATED WORK

Related work covers visual-token compression, adversarial robustness in vision-language models, and robustness specifically under compression. The paper positions its focus as inducing compression-specific failures with encoder-only access and without knowledge of the deployed compressor or budget.

Visual token compression

  • Visual-token compression work spans selection, learned pruning, hybrid pruning and merging, query-conditioned methods, adaptive reduction, and video or multi-turn approaches.Source: §2 · p. 3

Adversarial robustness of vision-language models

  • LVLM adversarial-robustness research includes transfer-based, encoder-based, and prototype-guided attacks, alongside training-time and test-time defenses.Source: §2 · p. 3

Robustness under visual token compression

  • Compression-specific robustness work includes pruning defenses, CAGE’s unknown-setting token targeting, and CAA’s ranking manipulation, whereas this paper targets selective failures without compressor or budget knowledge.CAA includes white-box attacks tailored to known configurations and transfer attacks using surrogate models.Source: §2 · p. 3

3 DIAGNOSING COMPRESSION-SPECIFIC FAILURES

The section defines compression-specific failures through paired full-token and compressed inference, then uses controlled retained-set interventions to diagnose when token allocation changes compressed correctness. Recovery is greater with guided reallocation, while its benefit is smaller for evidence with greater representation drift.

3.1 PROBLEM SETUP AND COMPRESSION-SPECIFIC FAILURE

  • A compression-specific failure focuses on adversarial inputs that remain correct under full-token inference but fail after compression.Evaluation is restricted to samples correct under both inference paths before attack.Source: §3.1 · pp. 3–4

3.2 RETAINED-SET ALLOCATION AND COMPRESSED CORRECTNESS

  • The diagnostic cohort uses first-observed CSFs from downstream-agnostic VEAttack trajectories, then exchanges equal numbers of retained and omitted direct tokens at the same encoder state and capacity.A post-hoc answer-aware oracle selects exchanged token identities.Source: §3.2 · p. 4
  • Guided recovery exceeds matched-random recovery by 22.5–24.1 pp on average across 12 dataset–budget cells, showing that token identity matters beyond retention count.The comparison holds encoder state, capacity, and exchange size fixed.Source: Figure 2 · p. 4, §3.2 · p. 4

3.3 RETAINED-SET ALLOCATION COMPONENTS AND REPRESENTATION DRIFT

  • At ρ∗= 7.5%, exact recovery rises from 17.4% under matched random exchange to 42.0% under guided reallocation; restoration and removal both contribute.Coordinating restoration of omitted high-support tokens with removal of retained low-support tokens provides the largest gain.Source: §3.3 · p. 4, Table 1 · p. 5
  • Restoration’s average effect falls from +20.5 pp in the lower-drift tertile to +10.3 pp in the upper, with a negative association also found in continuous analysis.Table 1 reports evidence-restoration effects across representation-drift tertiles.Source: §3.3 · p. 4, Table 1 · p. 5
  • The diagnostics motivate CIRA’s objective: make evidence inaccessible after compression while preserving its utility under full-token inference.Source: §3.3 · p. 5

4 METHODOLOGY

CIRA formulates compression-specific attack behavior as preserving full-token correctness while increasing compressed prediction error, then uses encoder-side objectives to manipulate token priorities and preserve displaced evidence. Its objectives are jointly optimized under a valid-image constraint.

4.1 ATTACK FORMULATION

  • CIRA targets full-token correctness alongside compressed prediction error, but replaces this ideal criterion with compressor-independent encoder-side objectives evaluated across configurations.The attacker lacks the downstream question, reference answer, language model, compressor, and exact deployed budget, knowing only an admissible budget range.Source: §4.1 · p. 5

4.2 GLOBAL SELECTION HIJACKING

  • Global Selection Hijacking maximizes alignment between adversarial priorities and inverse clean priorities, encouraging clean high-priority tokens downward and clean low-priority tokens upward.Encoder-side proxy scores determine retention priority; the clean rank and inverse-priority encoding support the scale-invariant objective.Source: §4.2 · p. 5

4.3 HIDDEN-EVIDENCE PRESERVATION

  • Hidden-Evidence Preservation protects clean high-priority tokens displaced beyond candidate retention boundaries by limiting their representation drift.Budget-marginal weights reflect the fraction of admissible budgets under which a token becomes hidden, giving more protection to evidence displaced across more budgets.Source: §4.3 · pp. 5–6

4.4 JOINT OPTIMIZATION

  • CIRA combines the priority-manipulation and evidence-preservation objectives, with λ controlling preservation strength, and maximizes the result by projected sign-gradient ascent.The perturbation is constrained to the valid-image domain.Source: §4.4 · p. 6

5 EXPERIMENTS

The experiments evaluate CIRA across compression settings and compare it with downstream-agnostic and stronger-access attacks. Results show compression-specific selectivity, cross-configuration transfer, and distinct contributions from its priority-reallocation and evidence-preservation objectives.

5.1 EXPERIMENTAL SETUP

  • The evaluation uses LLaVA-v1.5-7B on POPE, TextVQA, and MME, four compressors at K = 32, 64, 128, and 192, and compares CIRA with downstream-agnostic baselines.Qwen3-VL-8B-Instruct and InternVL3.5-8B are also evaluated.Source: §5.1 · p. 6

5.2 MAIN RESULTS

  • CIRA achieves 20.35% mean CSFR versus 5.49% for VEAttack and 5.92% for CAGE, with 6.92% Full ASR versus 45.95% and 50.20%.Table 2 reports CSFR and Full ASR on LLaVA-v1.5-7B.Source: Table 2 · p. 7, §5.2 · p. 7
  • Reused without re-optimization, CIRA reaches 31.96% mean CSFR on PruMerge versus 6.28% for CAGE; across settings, CSFR rises from 12.04% at K = 192 to 28.78% at K = 32.Compression-selective behavior also extends to Qwen3-VL and InternVL.Source: §5.2 · pp. 7–8

5.3 MECHANISTIC ANALYSIS

  • At K = 128, the highest-priority octile is demoted by 0.47–0.53 rank units while the lowest is promoted by 0.73–0.76; high-priority groups also show less representation drift.For the top 10% and 10–30% groups, rank demotion peaks at 53.0% and 53.7%, while drift is 12.4% and 12.7%.Source: Figure 3 · p. 8, Figure 4 · p. 8, §5.3 · p. 8

5.2 MAIN RESULTS

  • CAA† achieves only 3.24% mean CSFR versus CIRA’s 20.35%, despite lower Full ASR of 3.32% versus 6.92% and access to the downstream question and language model.CIRA uses only the vision encoder, indicating that preserving full-token predictions alone does not induce compression-specific failures.Source: §5.2 · p. 8

5.3 MECHANISTIC ANALYSIS

  • On VisionZip, removing GSH reduces mean CSFR from 18.22% to 3.68%, while removing HEP raises mean Full ASR from 6.92% to 23.10%.Replacing HEP with global representation preservation yields 15.71% mean CSFR and 8.66% Full ASR.Source: §5.3 · p. 8, Table 3 · p. 9

6 SELECTION STABILIZATION DEFENSE

TCS stabilizes token selection by comparing priorities across translated views, substantially suppressing standard CIRA while retaining a smaller effect against adaptive CIRA.

Selection stabilization

  • TCS selects tokens by aligned rank-quantile consensus across four translated views, exploiting stability of clean high-priority evidence and view-sensitivity of attack-induced replacements.The selected indices are applied to unshifted-view features, leaving aggregation and full-token inference unchanged.Source: §6 · p. 9

Defense effectiveness

  • 18.22% to 3.39%: TCS reduces standard CIRA mean CSFR by 81.4% across three datasets and four budgets, versus a 32.5% reduction for CAGE.Suppression strengthens under tighter compression.Source: §6 · p. 9

Adaptive stress test

  • 3.39% to 12.70%: under TCS, Adaptive CIRA raises mean CSFR to 74.5% of its matched undefended value of 17.04%.TCS retains a smaller but nonzero effect against the adaptive attack.Source: §6 · p. 9

7 CONCLUSION

The conclusion frames compression-specific failures as risks attributable to the compression path and reports that CIRA induces them across unknown compressor and budget settings. It recommends paired robustness evaluation of full-token and compressed inference.

Conclusion

  • Pairing full-token and compressed inference on the same adversarial input attributes failures specifically to the compression path.The conclusion treats the compression boundary as a security-relevant component of LVLM deployment.Source: §7 · pp. 9–10
  • CIRA induces compression-specific failures across unknown compressor and budget settings by reallocating token priorities while limiting full-token degradation.Controlled diagnostics show retained-set allocation affects compressed correctness, while recovery is negatively associated with representation drift in displaced evidence.Source: §7 · p. 10
  • Selection stabilization substantially suppresses CIRA, although adaptive optimization partially restores its effectiveness.Source: §7 · p. 10

AI USE STATEMENT

The authors describe a limited supporting role for generative AI tools and state that they independently checked and validated AI-assisted content.

AI use statement

  • Generative AI tools supported editing, literature discovery, ideation, technical execution, and manuscript drafting and revision; the authors independently checked and validated the assisted content.Source: AI USE STATEMENT · p. 10

REPRODUCIBILITY STATEMENT

The reproducibility statement locates the threat model, objectives, optimization, experiments, and analyses across the paper and appendices, and points to a GitHub repository for code and scripts.

Reproducibility statement

  • The threat model, compression-specific failure formulation, and GSH and HEP attack objectives are described in Sections 3 and 4.Source: REPRODUCIBILITY STATEMENT · p. 10
  • Optimization and experimental details are provided in Appendices A and B, while main results, mechanistic analyses, and defense evaluations appear in Sections 5.2, 5.3, and 6.Source: REPRODUCIBILITY STATEMENT · p. 10
  • Additional analyses are located in Appendices C, D, E, G, H, and I, and reproduction code and scripts are provided in the GitHub repository.Source: REPRODUCIBILITY STATEMENT · p. 10

ETHICS STATEMENT

This section examines how retained-token allocation relates to correctness and recovery, including sensitivity across settings, and reports CIRA’s behavior across additional LVLM families. It also describes translation-consensus selection as a way to downweight view-specific adversarial replacements and favor stable evidence.

C.1 DIAGNOSTIC COHORT AND FIXED FAILURE STATE

  • The diagnostics fixed first-observed failures in a cohort correct under full-token and every evaluated compressed setting, then compared support-guided token exchanges with matched-random reallocations.The work uses public benchmarks and pretrained models, involves no human subjects or personally identifiable information, and acknowledges dual-use risks while evaluating CIRA under bounded image perturbations and vision-encoder-only access.Source: ETHICS STATEMENT · p. 10, §C.1 · p. 17, C CONTROLLED RETAINED-SET ALLOCATION… · p. 17

C.3 RETAINED-SET ALLOCATION SENSITIVITY AND CUMULATIVE RECOVERY

  • 22.5–24.1 pp was the average guided–random recovery advantage across all nonzero exchange ratios.Recovery was cumulative: it counted whether a compression-specific failure was corrected at any schedule point up to the displayed exchange ratio.Source: §C.3 · p. 18, Table 5 · p. 19

C.4 FACTORIAL DECOMPOSITION OF RECOVERY

  • Evidence restoration was positive at every budget, removal effects increased with K, and interactions were negative and smaller than either main effect.The factorial decomposition was evaluated at an exchange ratio of 7.5%.Source: §C.4 · p. 19, Table 6 · p. 19

C.5 REPRESENTATION-DRIFT MODERATION

  • −8.1 pp per 0.1 increase in representation drift was the estimated within-cell association with evidence-restoration effect.Budget-specific drift tertiles were not uniformly monotone; retained-set intervention causally altered correctness in the fixed cohort, but the drift–recovery analysis supports association, not causal mediation.Source: §C.5 · p. 20, Table 7 · p. 20

D.1 PRESERVATION WEIGHT

  • Increasing λ reduced Full ASR while retaining substantial CSFR; λ = 0.8 had the highest observed Selective Gap and was used throughout.The Selective Gap remained stable for λ ∈ [0.6, 1.0].Source: §D.1 · p. 20, Table 8 · p. 20

D.2 CANDIDATE COMPRESSION-BUDGET INTERVAL

  • The default candidate budget interval [32, 192] matched the evaluation range, with Selective Gap within 0.28 pp of the best observed value.Selectivity varied modestly across the six candidate intervals.Source: §D.2 · p. 21, Table 9 · p. 21

D.3 PERTURBATION BUDGET AND OPTIMIZATION STEPS

  • Across 16 perturbation-budget and step configurations, Full ASR was 4.14%–6.38% and Avg. CSFR was 14.93%–20.82%.The default ϵ = 4/255, 100-step setting was within a stable selective region rather than an isolated optimum.Source: §D.3 · p. 21, Figure 5 · p. 21

D.4 SCORING-LAYER CONFIGURATION STUDY

  • The {−1, −3, −5} scoring-layer configuration achieved 23.45% Avg. CSFR, 5.59% Full ASR, and a 17.86 pp Selective Gap.Its clean high-priority-token exclusion-rate range was 0.055 versus 0.242 for {−2}; cross-layer variation and selectivity were negatively associated (ρs = −0.70), descriptively rather than causally.Source: §D.4 · p. 21, Figure 6 · p. 22

E CROSS-MODEL SCOPE

  • Across two additional model families, CIRA induces compression-specific failures with Full ASR substantially below VEAttack and CAGE, and leads downstream-agnostic attacks in Avg. CSFR on TextVQA for every compressor.POPE and MME results are more heterogeneous across compressors, but failure induction remains observable under target-encoder-only access.Source: E CROSS-MODEL SCOPE · p. 22

F SELECTION STABILIZATION DEFENSE

F.1 TRANSLATION-CONSENSUS SELECTION

  • TCS replaces the compressor’s priority ranking with a consensus ranking across translated views while retaining the unshifted view’s token features and key-similarity metric.Token counts, aggregation, and language-model input length remain unchanged; the four encoder views are batched, with no additional language-model inference.Source: §F.1 · p. 23

F.2 CROSS-VIEW SUPPORT MECHANISM

  • As K rises from 32 to 192, CIRA replacement tokens’ one-view share falls from 88.0% to 63.9%, while fewer than 2.5% have four-view support.Clean Top-K tokens’ four-view share rises from 20.0% to 44.2%; averaging aligned rank quantiles downweights isolated replacements and favors evidence supported across translations.Source: Figure 7 · p. 23, §F.2 · p. 24

F.3 ADAPTIVE EVALUATION

Adaptive evaluation tests whether cross-view selection stabilization (TCS) suppresses CIRA and whether adaptive optimization restores its priority reallocation. Complementary task-utility analyses characterize clean accuracy under compression, post-attack accuracy, and TCS recovery.

F.3 ADAPTIVE EVALUATION

  • Under TCS, clean Top-K retention rises from 0.3–12.3% to 62.9–70.8% for CIRA, while Adaptive CIRA reduces it to 6.5–34.7%.TCS attenuates priority demotion and promotion; Adaptive CIRA restores much of that signed reallocation.Source: §F.3 · p. 24, Figure 8 · p. 24

G.1 CLEAN UTILITY UNDER COMPRESSION

  • High-budget settings preserve most POPE and MME accuracy across model families, while TextVQA generally incurs larger compression losses.Table 11 supplies clean reference accuracy for the post-attack comparisons.Source: §G.1 · p. 25, Table 11 · p. 25

G.2 POST-ATTACK TASK UTILITY

  • Adversarial accuracy complements CSFR by measuring overall task degradation, including both pre-existing compression errors and attack-induced failures.The analysis uses complete evaluation sets for adversarial accuracy.Source: G COMPLEMENTARY TASK-UTILITY RESULTS · p. 24, §G.2 · p. 25
  • 9.6 pp mean compressed accuracy drop under CIRA, versus 5.4 pp under full-token inference, across nine equally weighted model–dataset pairs.Budget-averaged compressed accuracy drops by 3.3–20.8 pp across evaluated model–dataset–compressor settings; adversarial accuracy also reflects pre-existing compression errors.Source: §G.2 · p. 25

G.3 TASK-UTILITY RECOVERY UNDER TCS

TCS recovers compressed task utility under CIRA with little change to clean accuracy, but recovers less under Adaptive CIRA. The discussion bounds the evaluation to single-image, task-correctness outcomes and notes that other compression mechanisms require further diagnostics.

G.3 TASK-UTILITY RECOVERY UNDER TCS

  • On LLaVA-v1.5-7B with VisionZip, TCS changes clean Avg. ACC by at most 0.52 pp in magnitude and recovers 6.77–13.20 pp under CIRA; recovery is smaller under Adaptive CIRA.Source: §G.3 · pp. 25–26, Table 13 · p. 26

H LIMITATIONS AND FUTURE WORK

  • Single-image evaluation leaves open whether encoder-only priority manipulation remains compression-selective across video frames or dialogue turns.Those settings add temporal redundancy and evolving context to evidence retention.Source: H LIMITATIONS AND FUTURE WORK · p. 26
  • Retained-set diagnostics do not identify spatial, positional, or attentional distortions, and other compression mechanisms require additional attribution diagnostics.Adaptive pruning, learned summarization, and recoverable routing complicate a single-token-ranking account; paired CSF evaluation remains applicable.Source: H LIMITATIONS AND FUTURE WORK · p. 26
  • Task-level CSF does not establish safety preservation; targeted manipulation and jailbreak evaluation requires outcome criteria tailored to those objectives.Source: H LIMITATIONS AND FUTURE WORK · p. 26

I QUALITATIVE CASE STUDIES

Related papers

Loading 2609.35002v1…