PaperlayerView exact revision on arXiv

Source-linked AI summary

Curvature Under Attack in hZACH-ViT: Gauge Symmetry, Boundary Saturation, and Adversarial Failure

Athanasios Angelakis, Marta Gomez-Barrero

arXiv:2610.00680v1cs.LGcs.CV

TL;DR

The paper asks whether apparent hyperbolic robustness reflects curvature itself or its interaction with scale and boundary numerics. It studies matched hZACH-ViT prototype heads and curvature interventions, finding that lower Poincare curvature improves clean results while increasing strong OrganAMNIST attack success; the supported conclusion is an implementation-sensitive boundary regime.

  • Problem

    Curvature alone may not determine the empirical behavior of curved representations because coordinate scale, learned logit temperature, and numerical safeguards also matter.

    Source: §1 · pp. 1–2

  • Method

    The study compares matched hZACH-ViT prototype heads at c=1 and retrains Poincare and spherical heads at c=0.1, using gauge analysis and boundary-sensitive attack diagnostics.

    Source: §1 · p. 2, §3.2 · p. 3

  • Results

    At c=0.1, Poincare clean results improve and saturation and the large Organ attack slowdown disappear; strong OrganAMNIST ASR rises from 89.70% to 99.27%.

    Source: §5.2 · p. 6, §6 · p. 7

  • Takeaways & Limitations

    The evidence supports a Poincare boundary-saturated numerical regime that jointly reorganizes clean recognition and adversarial motion, not intrinsic hyperbolic robustness.

    Source: §8 · p. 8

    The study covers one compact architecture, three medical benchmarks, five seeds, and 50 examples per class; its first-order attacks are neither exhaustive nor certified, and no configuration is clinically secure.

    Source: §7 · p. 8

Abstract

from arXiv · show

Curvature is often treated as an intrinsic property of a representation, although its empirical effect also depends on coordinate scale, learned logit temperature, and numerical safeguards. We study this interaction in hZACH-ViT, a compact Vision Transformer with Euclidean, Poincare, and spherical prototype heads. The backbone architecture, seed-specific initialization, 50-per-class training subset, and optimization protocol are matched across three MedMNIST datasets and five seeds. At the fixed comparison curvature $c=1$, Poincare has the lowest class-macro PGD attack-success rate in all 12 dataset-budget cells and under a stronger CE+DLR multi-restart attack on all three datasets, but it also has the lowest clean MacroF1. An end-to-end curvature intervention changes the interpretation. Reducing Poincare curvature to $c=0.1$ improves clean MacroF1 in every one of the 15 paired seed-dataset comparisons and removes hard boundary clipping, yet on OrganAMNIST it increases strong attack success from $89.7\%$ to $99.3\%$ (paired difference $+9.57$ points; 95\% hierarchical bootstrap CI $[+5.52,+14.03]$). At $c=1$, $40$-$47\%$ of clean Poincare features are hard-clipped, the radial Jacobian of the inherited map is nearly zero, and dimensionless attack trajectories are unusually long and inefficient. The spherical head provides a control: its curvature change is an exact scale gauge to floating-point precision and produces much smaller attack differences. These results do not establish intrinsic hyperbolic robustness. They identify an implementation-sensitive regime in which curvature, scale, and proximity to the Poincare boundary jointly organize clean recognition and adversarial representation motion.

1 Introduction

The paper asks whether apparent robustness under negative curvature reflects intrinsic geometry or interactions among curvature scale, learned logit temperature, and numerical safeguards. It studies hZACH-ViT with matched curvature comparisons and within-family retraining, and frames the evidence as an implementation-sensitive boundary regime rather than a universal robustness property.

1 Introduction

  • Curvature magnitude, learned logit temperature, and boundary safeguards can jointly shape what a nominally geometric observation reflects.The paper distinguishes intrinsic geometry, representation adaptation, and finite-precision computation as interacting factors.Source: §1 · pp. 1–2
  • Adversarial optimization is used to probe available representation directions and boundary-reaching trajectories, not to claim clinical security.Prior work notes both feature-organization effects on robustness and precision difficulties near the Poincare boundary.Source: §1 · p. 2
  • The study fixes training and attack protocols, compares curvature signs at c=1, then retrains Poincare and spherical heads at c=0.1.The approach uses the compact ZACH-ViT backbone with geometry-aware prototype heads.Source: §1 · p. 2
  • The contribution combines corrected class-macro attacks, curvature-scale gauge analysis, boundary diagnostics, and stronger multi-restart attack validation.The evidence supports an implementation-sensitive boundary regime, not a universal robustness property of negative curvature.Source: §1 · p. 2

2 Related Work and Positioning

Prior work establishes prototype-based hyperbolic and spherical representations, while also identifying precision and boundary issues in Poincare learning. The paper positions its contribution as separating curvature sign from scale and examining adversarial motion in normalized curved coordinates.

2 Related Work and Positioning

  • Prototype networks compare inputs with class representatives, with hyperbolic embeddings used for hierarchical structure and spherical classifiers organizing decisions through angles.The cited examples include image embeddings and Vision Transformers.Source: §2 · p. 2
  • Prior work links representation geometry and feature organization to accessible computation and non-robust directions under perturbation.Direct attacks on hyperbolic networks also show that evaluation can depend on geometry.Source: §2 · pp. 2–3
  • Earlier studies examined flat ZACH-ViT attacks and clean hZACH-ViT model selection, but not curvature-scale gauge or dimensionless adversarial motion.This study therefore analyzes curvature through normalized coordinates, hard projection, and radial sensitivity.Source: §2 · pp. 2–3

3 Geometry, Gauge, and Boundary Coordinates

The geometry section specifies matched prototype heads and separates global scale symmetries from finite-precision boundary effects. It uses normalized and boundary-sensitive coordinates to characterize the implementation and attack trajectories.

3.1 Matched prototype heads

  • Each prototype head starts from a pooled 64-dimensional feature and learns one preimage per class, using a learned positive scale with metric distance.The Euclidean head uses ordinary distance; curved heads use their respective manifold maps and distances.Source: §3.1 · p. 3
  • The Poincare feature map applies an origin exponential map followed by canonical numerical projection into the open ball; the sphere has radius 1/√c.All prototype variants have 248,705 active-forward parameters, versus 248,712 for the original linear head.Source: §3.1 · p. 3

3.2 Two scale symmetries

  • Spherical normalization removes positive feature dilation, yielding an infinitesimal radial constraint on the loss gradient.The paper names this property radial orthogonality.Source: §3.2 · p. 3
  • Changing curvature admits a model-level scale reparameterization, but the implemented Poincare map can break real-arithmetic covariance near the boundary.The implementation uses float32 arithmetic, hard projection at ρc=1−10^-7, and stabilized denominators; the reparameterization does not imply equivalence of independently trained checkpoints.Source: §3.2 · p. 3
  • The analysis records normalized radius, boundary slack, radial Jacobian, and the fraction of samples reaching hard projection.It also measures a dimensionless trajectory ratio, for which lower values indicate a less direct path under the same normalized metric.Source: §3.2 · p. 4

4 Experimental Protocol

The experiments use matched low-data training across three MedMNIST datasets and five seeds, with validation-selected checkpoints and shared-clean-correct attack evaluation. They compare paired curvature results and use first-order attacks with convergence and gradient diagnostics.

4 Experimental Protocol

  • Training uses 50 images per class on BloodMNIST, DermaMNIST, and OrganAMNIST, with five seeds and validation MacroF1 checkpoint selection.Inputs are 224×224 RGB with patch size 16; training runs for 47 epochs using Adam at 10^-4 without weight decay.Source: §4 · p. 4
  • Attack-success rates are conditioned on clean correctness, using shared pools across heads or within-family curvature comparisons.Core and strong subsets retain up to 64 and 16 images per eligible class, respectively, and class-macro ASR is averaged over five seeds.Source: §4 · p. 4
  • Curvature effects are paired on the same images, with hierarchical bootstrap intervals resampling seeds and then images within class.Clean MacroF1 uses the full test set.Source: §4 · p. 4
  • Core attacks use untargeted clean-start PGD-10, while strong validation uses PGD-20 with three starts each for CE and DLR.The strongest margin among six candidates is retained; convergence, input gradients, and selected losses are audited, but these probes are not certificates.Source: §4 · p. 4

5 Results

At c=1, Poincaré is hardest for the tested attacks but has the lowest clean MacroF1; lowering curvature improves clean performance while increasing OrganAMNIST attack success. Boundary and frozen-backbone analyses connect these patterns to boundary-sensitive radial motion and representation adaptation, rather than terminal distance alone.

5.1 At c=1, Poincar´e fails more slowly but recognizes less well

  • At c=1, Poincaré has the lowest point-estimate PGD-10 ASR in all 12 dataset-budget cells and the lowest clean MacroF1 on all three datasets.Under the stronger attack, it again has the lowest point estimate on each dataset; on OrganAMNIST its ASR is 9.38, 8.78, and 9.97 points below sphere, Euclidean prototype, and linear heads, respectively.Source: §5.1 · pp. 4–5, Figure 1 · p. 5, Table 1 · p. 5

5.2 The curvature intervention removes the clean penalty and the Organ attack slowdown

  • At c=0.1, Poincaré clean MacroF1 rises by +7.69, +3.34, and +9.95 points on Blood, Derma, and OrganAMNIST, while OrganAMNIST strong ASR rises by +9.57 points.All 15 within-seed clean differences are positive; the OrganAMNIST strong-ASR difference has a 95% CI of [+5.52, +14.03].Source: §5.2 · pp. 5–6, Figure 2 · p. 6

5.3 Boundary occupancy, radial sensitivity, and the curvature gauge

  • At c=1, 40.1–47.2% of clean Poincaré features reach the hard projection threshold; at c=0.1, clipping disappears in all 15 runs and radial Jacobians increase across all three datasets.Spherical rescaling changes logits by at most 1.43 × 10^-6 across 133,242 logits, while the Poincaré c=1 to 0.1 transform reaches a maximum difference of 0.713 and changes one prediction among 62,572 logits.Source: Table 2 · p. 6, §5.3 · p. 7

5.4 Dimensionless trajectories and attack validity

  • At 4/255, Poincaré path efficiencies rise from 0.120, 0.123, and 0.118 at c=1 to 0.155, 0.207, and 0.211 at c=0.1 on Blood, Derma, and Organ, respectively.Dimensionless c=1 paths are three to five times longer, with 40.4–57.9% of states clipped; attack checks narrow the interpretation to the measured boundary regime, not a certificate.Source: §5.4 · p. 7

5.5 Frozen-backbone attribution control

  • On the strict direct four-head pool of frozen BloodMNIST backbones, five-seed PGD-10 ASR at 4/255 was 98.0% for linear, 95.0% for Euclidean prototype, and 97.5% for Poincaré, which was not the slowest head.Several seed pools contain only 3-40 attacked images, so this is an attribution control rather than a robustness ranking.Source: §5.5 · p. 7

6 Discussion

Lowering Poincaré curvature improves clean results and removes saturation, but also removes the large Organ attack gap. The contrast between spherical scale invariance and Poincaré boundary effects does not establish that clipping alone causes the attack difference.

6 Discussion

  • Lower curvature improves every paired Poincaré clean result, removes saturation, restores radial sensitivity, and removes the large Organ attack gap.The c=1 narrative that Poincaré representations fail more slowly is therefore incomplete.Source: §6 · p. 7
  • Boundary occupancy coincides with extinguished radial sensitivity and inefficient normalized attack paths.The discussion connects these observations to near-boundary concentration, precision-dependent hyperbolic optimization, and radial clipping.Source: §6 · p. 8
  • Spherical normalization is an exact architectural invariance, whereas Poincaré radial suppression is curvature-dependent and finite-precision; independent training does not prove clipping causes the ASR gap.Source: §6 · p. 8

7 Limitations and Broader Impact

The study is limited to one compact architecture, three medical benchmarks, five seeds, and 50 examples per class. Its attacks are not exhaustive or certified, and its evaluation does not establish clinical security.

7 Limitations and Broader Impact

  • The experiments cover one compact architecture, three medical benchmarks, five seeds, and 50 examples per class.Source: §7 · p. 8
  • Results may change with full-data training, larger backbones, other Poincaré maps, or adversarial training.Source: §7 · p. 8
  • Shared-clean-correct evaluation excludes classes without jointly correct images, and stabilized trajectories may not duplicate the classifier’s clamp sequence bit-for-bit.Source: §7 · p. 8
  • The first-order attacks are neither exhaustive nor certified, ASR is high for every head at 4/255, and no configuration is clinically secure.Source: §7 · p. 8

8 Conclusion

The conclusion is narrower than a claim of intrinsic hyperbolic robustness: curvature can place learned Poincaré representations in a boundary-saturated numerical regime that jointly reorganizes clean recognition and adversarial motion.

8 Conclusion

  • Curvature can place learned Poincaré representations in a boundary-saturated numerical regime that jointly reorganizes clean recognition and adversarial motion.Source: §8 · p. 8

Reproducibility

The paper reports its software and hardware environment and says code and supporting materials will be released publicly after NeurIPS 2026.

Reproducibility

  • Experiments used Python 3.10.16, PyTorch 2.3.1+cu121, CUDA 12.1, and one NVIDIA GeForce RTX 3060 GPU.Source: Reproducibility · p. 8
  • The authors state that code and supporting materials required to reproduce the analyses will be released publicly after NeurIPS 2026.Source: Reproducibility · p. 8
  • The reported analyses were run on a single NVIDIA GeForce RTX 3060 GPU.Source: Reproducibility · p. 8

A Evaluation-pool coverage

Evaluation pools define the samples and class coverage for the comparisons; the curvature-scale audit and strong-attack analysis then examine prediction asymmetry, gradients, and convergence.

A Evaluation-pool coverage

  • Core four-head pools contain 454-512 BloodMNIST, 176-205 DermaMNIST, and 423-704 OrganAMNIST images per seed after an independent class cap.BloodMNIST pools include all eight classes; DermaMNIST pools lack class 3, and OrganAMNIST pools cover 8-11 classes. Strong pools use an independent cap of 16 images per eligible class.Source: A Evaluation-pool coverage · p. 11
  • Within-family curvature pools contain 502-512 BloodMNIST, 207-275 DermaMNIST, and 554-703 OrganAMNIST Poincaré images; spherical pools cover all 11 OrganAMNIST classes in every seed.Poincaré strong pools contain 128 BloodMNIST, 89-103 DermaMNIST, and 144-176 OrganAMNIST images.Source: A Evaluation-pool coverage · p. 11

B Functional curvature-scale gauge audit

  • Features, prototypes, and temperature are transformed together under Eq. (4), then implemented maps recompute logits and predictions; directional asymmetry concentrates in boundary-saturated c=1 Poincaré runs, unlike the spherical control.Table 3 reports a curvature-scale gauge audit with mean errors weighted by the number of logits.Source: B Functional curvature-scale gauge audit · p. 11, Table 3 · p. 11

C Strong-attack convergence and gradients

  • Maximum zero-gradient and non-finite-gradient fractions are both zero; mean Poincaré clean input-gradient L2 norms are 0.272 versus 0.234 on Blood, 0.551 versus 0.254 on Derma, and 3.72 versus 2.55 on OrganAMNIST at c=0.1 versus c=1.The reported maximum fractions are across the curvature comparison.Source: C Strong-attack convergence and… · p. 11
  • DLR supplies the worst-margin candidate for a non-zero fraction of images in every dataset family, so the combined strong-attack result is not simply CE-only PGD.Strong-attack convergence curves and seed-level records are provided; selected loss family varies across images.Source: C Strong-attack convergence and… · p. 11

D Frozen-backbone attribution control

The frozen-backbone control tests whether prototype-head geometry alone reproduces the end-to-end ordering, while the accompanying trajectory summary specifies dimensionless path and clipping measures.

D Frozen-backbone attribution control

  • On OrganAMNIST, five-seed Figure 3 shows CE and DLR strengthening through 20 steps while c=1 and c=0.1 remain separated; final ASR selects the worst true-class margin across six CE/DLR restart candidates.Source: Figure 3 · p. 12
  • At 4/255, five-seed mean PGD-10 ASRs were 98.0% (linear), 95.0% (Euclidean prototype), 97.5% (Poincaré), and 96.9% (sphere) on the shared-clean-correct pool.The pool had only 3-40 attacked images in several seeds, so this is an attribution control rather than a robustness ranking.Source: D Frozen-backbone attribution control · p. 12
  • A Poincaré terminal metric on features learned under the linear objective is insufficient to reproduce the end-to-end c=1 ordering.For the control, the validation-selected linear ZACH-ViT feature extractor was frozen and only the prototype heads were trained.Source: D Frozen-backbone attribution control · pp. 11–12
  • On the same frozen representation, changing Poincaré curvature from c=1 to c=0.1 changes PGD-10 ASR by -1.9, +0.9, 0.0, and +0.9 points across four budgets; spherical changes are +1.0, -1.8, -0.01, and -0.09 points.Clean MacroF1 increases from .433 to .557 for Poincaré and from .542 to .591 for sphere; clean curvature selection and perturbation dynamics do not share a fixed ordering on this representation.Source: D Frozen-backbone attribution control · p. 12

E Dimensionless trajectory summary

  • Table 4 reports five-seed mean PGD-10 trajectory quantities at 4/255; path and endpoint use √c d_c, while “Clip steps” is the fraction of states at the Poincaré hard projection threshold.Source: Table 4 · p. 12
Loading 2610.00680v1…