PaperlayerView exact revision on arXiv

Source-linked AI summary

Aggregate accuracy conceals concentrated temporal vulnerability in a spiking speech classifier

İsmail Can Dikmen

arXiv:2610.03155v1cs.NE

TL;DR

Aggregate accuracy does not show which utterances are locally vulnerable or how internal activity changes when labels remain stable. The study retains every prediction in a defined adjacent-bin neighborhood and links source-level outcomes to internal responses. Expected accuracy rises even as adverse neighbors remain concentrated in a small set of sources.

  • Problem

    Aggregate accuracy can combine adverse and corrective transitions, leaving the distribution of local vulnerability and internal responses unclear.

    Source: §1 · pp. 1–2

  • Method

    The study retains every prediction for a defined one-count, adjacent-bin neighborhood around 100 validation utterances and analyzes source-conditioned outcomes and internal responses.

    Source: §1 · p. 2

  • Results

    84.00% to 84.54% equal-source expected accuracy coexists with adverse neighbors for 13 of 84 initially correct utterances, and five sources carry 93.21% of harmful moves.

    Source: §1 · p. 2, §6 · p. 23

  • Takeaways & Limitations

    Complete source-conditioned maps distinguish vulnerability incidence, candidate concentration, internal change, and execution dependence that aggregate accuracy leaves unresolved.

    Source: §6 · p. 23

    The local analyses use 100 label-stratified validation identities, including only 13 adverse-sensitive SpikeSCR sources, limiting population precision.

    Source: §5.6 · p. 22

Abstract

from arXiv · show

Aggregate accuracy cannot reveal which utterances are locally vulnerable or how internal activity changes when labels remain stable. We retain every prediction for 725,070 adjacent-bin, one-count changes around 100 validation utterances of a frozen SpikeSCR-based classifier. The canonical native-horizon GPU singleton path reaches 86.0836% validation accuracy. Equal-source expected accuracy under a uniformly chosen neighbor rises from 84.00% to 84.54%, although 13 of 84 initially correct sources admit adverse neighbors. Five sources carry 93.21% of adverse moves. Margin-guided and surrogate-gradient searches miss sparse cases at fixed query budgets; a post hoc gradient prefix finds all 13 at 73.45% of the census of initially correct sources. Source-matched traces and clean-state interventions distinguish internal change from harmful direction and recoverability. Two count-readout replicas have similar validation accuracies but a 5.21-fold class-change gap concentrated in four sources. Controlled query/key source isolation eliminates 531 batch-order label changes and restores bitwise order invariance across all 9,981 validation score vectors. Isolated batch predictions reproduce padding-matched singleton labels on 9,980 of 9,981 inputs. Paired CPU/GPU replay of all 25,820 class-changing neighbors gives 99.8993% label agreement and preserves all 13 vulnerable sources and their fixed witnesses. Complete source-conditioned maps distinguish vulnerability incidence, concentration, internal change, and execution dependence that aggregate accuracy leaves unresolved.

1 Introduction

Aggregate accuracy can obscure how temporal changes affect individual utterances and internal activity. This study enumerates a defined local neighborhood and connects its source-level outcomes to internal responses and execution behavior.

1 Introduction

  • Average accuracy can combine adverse and corrective transitions, while a flip rate also combines harmful, beneficial, and wrong-to-different-wrong outcomes.The paper frames the missing evidence as a retained local outcome map linked to internal responses.Source: §1 · pp. 1–2
  • The motivating question is how to measure local consequences of temporal dependence without averages or incomplete coverage hiding their distribution.The setting is spiking speech, where time-dependent states and spike communication allow input timing changes to alter later activity.Source: §1 · pp. 1–2
  • The audit retains every prediction for a one-count move to an adjacent 5 ms bin, measuring net correctness, adverse incidence, candidate density, and concentration.Completeness is bounded to the stated neighborhood, inputs, checkpoint, and execution path.Source: §1 · p. 2
  • 84.00% to 84.54% equal-source expected accuracy coexists with adverse neighbors for 13 of 84 initially correct sources, while five sources carry 93.21% of harmful moves.At fixed candidate-query budgets, margin-guided and gradient searches miss different rare cases.Source: §1 · p. 2
  • Source-matched activations, matched branch-state interventions, and exact spike-count readouts in two additional replicas separate decision, representation, and trajectory changes.The replica comparison motivates reporting class-change load separately from source-level robustness.Source: §1 · p. 2
  • Controlled source isolation identifies cross-source q/k LIF coupling as the mechanism of batch-order dependence and recovers 9,980 of 9,981 padding-matched singleton labels.Paired CPU/GPU replay preserves the original vulnerable sources and fixed witnesses.Source: §1 · p. 2

2 Related work

Related work addresses temporal attacks, bounded verification, timing sensitivity, and internal explanations through distinct methods. This study combines complete local outcome maps with source-conditioned analysis and matched internal-state replacement.

2.1 Temporal perturbations and attacks in SNNs

  • Existing SNN attack studies span image and event-based settings, while exact count-preserving retiming differs from the one-count, same-feature, adjacent-bin neighborhood audited here.Surrogate-gradient outcomes depend on optimization and numerical choices; failure to find a harmful perturbation does not establish that none exists (Athalye et al., 2018). The closest retiming precedent searches event-vision datasets under different constraints (Y. Yu et al., 2026).Source: §2.1 · p. 3

2.2 Verification and complete local maps

  • Unlike verification that can stop after finding a counterexample, the retained local map stores every candidate prediction and calculates typed transitions and source-level rates.Local decision geometry here means classifier outcomes over explicitly enumerated input changes around each source utterance.Source: §2.2 · p. 3

2.3 Timing in spiking speech and internal explanation

  • Prior work establishes timing sensitivity in spiking speech; this study asks which local moves cross a frozen classifier’s decision boundary and how outcomes vary by source.Observational explanations characterize activity, whereas clean-activation replacement tests downstream effects; recovery under that intervention does not establish unique necessity or identify a single origin of change.Source: §2.3 · pp. 3–4

3 Materials and methods

This section defines a locked, validation-only audit of a frozen SpikeSCR classifier, specifying exhaustive local perturbation and internal-state analyses, a complementary count-readout audit, and source-level statistical procedures. It also describes deterministic inference with state resets and integrity checks, alongside controls for source isolation, padding effects, and CPU/GPU replay.

3.1 Study design and separation of data roles

  • The study separated one official-test benchmark evaluation from validation-only neighborhood and activation analyses, with test data unavailable to audit code.Checkpoint, preprocessing, metrics, validation panel, and perturbation rule were fixed before the test file was opened; later execution diagnostics also did not reopen the test split.Source: §3.1 · p. 4

3.2 Dataset, input representation, and classifier

  • The classifier used 5 ms bins and 140 transformed features; the epoch-282 checkpoint had the run’s highest official-validation accuracy, 86.3340%.The public SpikeSCR architecture was trained for 300 epochs, and the canonical local analyses used the same weights with singleton inference at each source’s native horizon.Source: §3.2 · p. 6, §3.3 · p. 7

3.4 Frozen validation panel

  • The frozen panel comprised 100 validation utterances sampled by label and source ID, with two or three per class; 84 were initially correct under singleton inference.Because the panel used label quotas, its mean source-level rates describe this panel rather than prevalence-weighted accuracy over all 9,981 validation utterances.Source: §3.4 · p. 7

3.5 Finite adjacent-bin neighborhood

  • The neighborhood exhaustively moves one integrated count to an adjacent 5 ms bin within the same feature and horizon, preserving total count and retaining distinct tensor candidates.This is a controlled stress test on the transformed count tensor, not a physical-jitter or perceptual-equivalence model; unique candidates are primary, with event-weighted counts reported separately.Source: §3.5 · pp. 7–8

3.6 Decision outcomes and source-level quantities

  • Source-level outcomes distinguish class changes from adverse errors, while matched-weight accuracy decompositions and exact sampling calculations define coverage and retrospective search comparisons.The analyses compared uniform sampling and fixed margin-based allocations with clean-input surrogate-gradient rankings; candidate outcomes were used only after policies and rankings were set.Source: §3.6 · p. 8, §3.7 · pp. 8–9

3.8 Internal activation traces

  • Traces measured relative L2 change at seven declared boundaries, and matched clean-activation replacements tested whether a clean state could restore downstream predictions.Block outputs include residual sums, so relative L2 change is not a spike-flip fraction; replacement sufficiency does not establish unique necessity or the first causal point.Source: §3.8 · pp. 9–10, §3.9 · p. 10

3.10 Complementary two-seed count-readout audit

  • A complementary audit evaluated two frozen count-readout replicas on the same 100 utterances and all 1,297,705 unique adjacent-bin moves per replica.Its 1,600-component count readout aggregates global and four window counts; trace changes that preserve these counts leave readout features and recorded-execution logits unchanged.Source: §3.10 · pp. 10–11

3.11 Statistical analysis and integrity controls

  • Statistical analyses treated the utterance as the resampling unit, used source-level bootstrap and permutation procedures, and applied Benjamini-Hochberg correction to specified test families.Replica comparisons paired the same source identities and neighbor sets; intervals are conditional on the panel and frozen models, not estimates of training-seed variation.Source: §3.11 · p. 11
  • All canonical local maps use unmodified deterministic float32 singleton outcomes, with state resets and checks of inputs, candidates, predictions, transitions, and archives.A final singleton reconstruction corrected ten candidate predictions across six sources; CPU inference matched all 100 clean panel predictions, and native GPU replay reproduced their score vectors bit-for-bit.Source: §3.11 · p. 12
  • Reproduction materials include script hashes, dependency versions, checkpoint digests, per-source gradients, fixed rankings, and executable coverage checks.The all-target extension was checked against earlier runner-up gradients and same-runtime hard-spike replays, and its first adverse witnesses were verified with new singleton forwards.Source: §3.11 · p. 12

3.12 Execution mechanism and paired device controls

  • Source isolation at q_lif2 and k_lif2 was tested against 9,981 padding-matched singleton references and paired order and duplicate-input controls.Batch-size-one calls bypassed the intervention; three selected order-sensitive pairs also received q-only, k-only, and joint isolation tests.Source: §3.12 · p. 12
  • Padding diagnostics compared native, valid-prefix, and added-bin score components for 408 selected sources, including 344 historical padding-sensitive sources and 64 positive-padding controls.The added component’s total softmax mass was checked against the number of added bins; these selected sources were not a random panel.Source: §3.12 · p. 12
  • All 25,820 class-changing candidates were reconstructed as native-horizon CPU and GPU singleton runs, with device-specific transitions recomputed and 13 adverse witnesses fixed in advance.No source-isolation intervention was active during the paired device replay.Source: §3.12 · p. 12

4 Results

The local audit finds favorable mean accuracy alongside sparse, concentrated adverse vulnerability, while execution controls, internal traces, and interventions distinguish decision changes from hidden activity changes. Across two count-readout replicas, similar validation accuracy also coexists with sharply different class-change loads concentrated in a few sources.

4.1 Classifier performance and singleton-batch agreement

  • 86.0836% validation accuracy on the canonical singleton path contrasts with 617/9,981 changed labels between archived batch-256 and CPU singleton paths despite a 0.2605-point net-accuracy gap.Padding changed 344 labels; reversing batch order changed 531, while joint q/k source isolation restored bitwise score-vector order invariance and padding-matched singleton labels on 9,980/9,981 inputs.Source: §4.1 · pp. 12–13, Table 2 · p. 13
  • Padding native singleton inputs changed 344 labels, and excluding added output bins restored only 26, indicating that padding also changes valid-prefix processing.No labels changed among 4,057 unpadded sources, compared with 24/104 sources receiving at least 81 added bins.Source: §4.1 · p. 13

4.2 Complete local decision geometry

  • 84.00% to 84.5418% equal-source expected accuracy coexists with adverse neighbors for 13 of 84 initially correct sources, with five sources carrying 93.21% of adverse candidates.Among class-changing candidates, 19.97% were adverse, 34.98% corrective, and 45.05% lateral; the partition is shown in Table 3.Source: §4.2 · p. 14, Table 3 · p. 14, §4.3 · p. 15

4.3 Favorable average accuracy hides incomplete vulnerability coverage

  • At 8,400 queries, lowest-margin-quartile focus expected 9.42 discoveries, but a vulnerable source outside the quartile was missed; a post hoc gradient prefix found all 13 using 73.45% of the initially correct-source census.The 5,612-candidate prefix found all 13; fixed first-order rankings did not establish failure of iterative attacks or other surrogate formulations.Source: §4.3 · pp. 15–16

4.4 Stable decisions often concealed internal change; 4.5 Internal divergence and decision-score displacement

  • 88.3720% of class-preserved candidates had nonzero block-2 activation change, and class-changing candidates showed larger source-matched divergence than preserved candidates at nearly all measured boundaries.Despite these internal changes, activation-change magnitude only weakly ranked margin displacement among nonzero responses, so score recording adds decision-relevant information.Source: §4.4 · p. 16, §4.5 · p. 17

4.6 Clean internal states frequently restored adverse decisions

  • Matched clean-state replacement restored the clean, correct prediction for adverse candidates, while no attention-versus-local patch contrast survived correction.For corrective and lateral candidates, clean-state replacement often recovered the original clean prediction rather than ground truth; these intervention outcomes are not repair rates.Source: §4.6 · p. 18, Table 8 · p. 18

4.7 Exact temporal aggregation in two count-readout replicas

  • The two count-readout replicas had validation accuracies of 72.2773% and 72.5278%, yet replica B had 5.21 times as many class-changing neighbors, concentrated in four sources.The replicas also separated changes removed before readout, removed by temporal aggregation, and retained in the count representation without crossing the decision boundary.Source: §4.7 · pp. 18–20, Table 9 · p. 19

4.8 Temporal transitions persist across CPU and GPU execution

  • CPU and GPU agreed on 25,794/25,820 class-changing candidates (99.8993%), and both recovered the same 13 adverse-sensitive sources and all 13 fixed witnesses.The replay tests persistence within the originally class-changing cohort, not vulnerability incidence among originally preserved candidates.Source: §4.8 · p. 20

5 Discussion

The discussion shows how favorable averages can coexist with concentrated local vulnerability, internal changes, and execution-dependent predictions. It argues for complete source-conditioned measurement while bounding the claims to the evaluated models, perturbations, and execution paths.

5.1 What average performance leaves unresolved

  • On the fixed SpikeSCR panel, equal-source expected accuracy under uniform draws from each stated neighborhood improves, yet 13 initially correct utterances have an adverse neighbor; corrective transitions offset adverse transitions on average.Near-identical validation accuracies coexist with a 5.21-fold difference in class-changing candidates driven by four sources.Source: §5.1 · p. 20
  • Preserved labels can conceal substantial internal change, and activation divergence alone does not indicate whether a transition is harmful or corrective.The median final-block relative L2 change for class-preserved candidates is 0.6464; within-source correlation between activation change and absolute ground-truth margin movement is only 0.0544.Source: §5.1 · p. 20

5.2 Why complete local coverage changes the assessment

  • Complete local coverage reveals search misses: low-margin allocation finds more vulnerable sources in expectation, but excludes source 1627, while the gradient top-1,000 misses sources 9282 and 1534.A post hoc longer gradient prefix finds all 13 vulnerable sources, so exhaustive enumeration supports full distributional measurement rather than being required for every witness.Source: §5.2 · pp. 20–21

5.3 Matched interventions establish clean-state sufficiency

  • Matched clean-state replacement often restores correct decisions for adverse candidates, but the evidence does not establish a universally dominant branch.Candidate-pooled recovery rates are 41.17–77.64%, versus equal-source means of 78.51–92.93% across four boundaries; full-stem and full-block replacements restore 100% by design as positive controls.Source: §5.3 · p. 21

5.4 Implications for temporal robustness

  • A temporal-robustness report should specify the perturbation, transition direction, source incidence, and concentration, alongside both candidate-pooled and source-equal rates.Suggested training strategies are hypotheses only; the frozen-classifier study does not test whether they improve robustness.Source: §5.4 · p. 21

5.5 Execution dependence has an identifiable mechanism

  • Query/key source isolation removes the measured batch-order effect and restores bitwise order invariance, while padding-matched singleton labels still differ for one input.The public q/k reshape sends different sources through shared temporal LIF lanes; remaining padding or batch-shape differences are not fully isolated, and the archived test result pertains to batch-256 execution.Source: §5.5 · p. 22, §5.6 · p. 22

5.6 Limitations

  • The evidence is limited to one detailed SpikeSCR checkpoint, a fixed 100-utterance panel, and adjacent-bin, same-feature one-count moves at a fixed horizon.The 13 adverse-sensitive sources constrain population precision; the perturbations are not established as physically or perceptually equivalent to sensor jitter, and clean-state replacement establishes sufficiency rather than a deployed defense or unique causal necessity.Source: §5.6 · pp. 22–23

6 Conclusion

The complete temporal audit shows that improved equal-source expected accuracy coexists with adverse neighbors concentrated in a few initially correct sources. Internal traces, interventions, replica comparisons, and execution controls reveal distinctions that aggregate accuracy alone misses.

6 Conclusion

  • Expected accuracy rises from 84.00% to 84.54%, yet 13 of 84 initially correct utterances admit adverse neighbors and five sources carry 93.21% of harmful candidates.Low-margin sampling improves expected discovery, while a fixed gradient ranking reaches different rare cases; the retained map identifies adverse density even beyond compared query budgets.Source: §6 · p. 23
  • Source-matched traces distinguish activation magnitude from harmful direction, and clean branch states often restore correct adverse predictions.Two count-readout replicas with similar validation accuracies show a 5.21-fold class-change gap concentrated in four sources, with the opposite ordering in fully robust correct source counts.Source: §6 · p. 23
  • Controlled q/k isolation removes 531 batch-order label changes, while paired CPU/GPU replay yields 99.8993% candidate-label agreement and preserves all 13 vulnerable sources and fixed witnesses.The paper supports reporting source incidence, candidate density, internal response, and the execution contract alongside aggregate accuracy.Source: §6 · p. 23

Data and code availability

The authors identify the dataset, original model code, and archived materials supporting the study. The archive includes records for regenerating the article's tables, while excluding several raw model artifacts.

Data and code availability

  • The SSC dataset and original SpikeSCR code are available through the Heidelberg Spiking Data Sets and GitHub, respectively.The archive is at Zenodo and the maintained project repository is on GitHub.Source: Data and code availability · p. 23
  • The Zenodo archive includes the frozen checkpoint, complete 725,070-neighbor outcome map, activation metrics, replacement score vectors, search-policy records, replica records, and execution-control records.The command `python -m ssc_geometry paper` regenerates every article table without model inference and compares 434 printed values with regenerated values.Source: Data and code availability · p. 23
  • Raw hidden tensors, unpatched census score vectors, full all-target gradient tensors, and replica weights are not included in the archive.Source: Data and code availability · p. 23

A Numerical execution and canonical reconstruction

The canonical reconstruction evaluates the full neighborhood using the unmodified network at singleton batch size. It distinguishes this GPU path from a separate CPU control and rejects the earlier adapted executor's outcome map.

A Numerical execution and canonical reconstruction

  • The samplewise adapter addressed deterministic sample-position dependence in the pinned q/k path, but a later 51,560-candidate audit found nine transition disagreements and required full singleton reconstruction.The precise numerical source of residual adapter-singleton score differences was not isolated.Source: A Numerical execution and canonical… · p. 27
  • The complete reconstruction evaluated all 725,070 candidates with the unmodified network at computational batch size one, correcting ten predictions across six sources relative to the rejected adapted executor.The final 25,820 class-changing outcomes comprise 5,157 adverse, 9,031 corrective, and 11,632 lateral outcomes.Source: A Numerical execution and canonical… · p. 27
  • The earlier adapted outcome map is not used in reported results; the internal bridge retains singleton traces only when their scores equal canonical outcomes.Source: A Numerical execution and canonical… · p. 27
  • The full-validation CPU singleton run is a separate control from canonical GPU inference, and its 8,591 correct predictions and 617 disagreements concern archived batch-256 execution.Within the 100-source panel, GPU and CPU singleton labels agree, while GPU singleton and archived batch-256 labels disagree on eight sources.Source: A Numerical execution and canonical… · p. 27

A.1 Controlled full-validation GPU replays

Controlled full-validation replays compare singleton, padding, ordering, and device execution conditions on the frozen validation set. The reported score differences are generally small, with only two sources changing class between CPU and native GPU singleton execution.

A.1 Controlled full-validation GPU replays

  • The controlled conditions share the same GPU runtime and model settings, and native GPU singleton scores match the 100 canonical panel score vectors bit-for-bit.The padding-matched singleton condition pads to the maximum native horizon in each contiguous batch-256 group, with the same valid-input mask.Source: §A.1 · p. 27
  • 2 sources, IDs 7368 and 7558, change class between CPU and native GPU singleton execution across 9,981 validation sources.The paired execution-controls table defines changed labels as the sum of correct-to-wrong, wrong-to-correct, and wrong-to-different-wrong cases.Source: §A.1 · p. 27, Table A.1 · p. 28
  • The median CPU–GPU maximum score difference is 1.90735 × 10−6, the 95th percentile is 3.81470 × 10−6, and the maximum is 3.0513.134 sources have a maximum score difference greater than 10−4; the passage characterizes the bulk as small despite the larger tail.Source: §A.1 · p. 27
  • Fresh replay reproduces the original and reversed batch-256 labels before the query/key source-isolation intervention.Source: §A.1 · p. 28

A.2 Padding gap and output decomposition

The padding gap separates the valid-prefix output of a padded run from its added-bin output; the prefix need not match the native-horizon output. In the selected cohort, removing the added-bin component restores some changed labels, but most remain changed in the prefix alone.

A.2 Padding gap and output decomposition

  • The padded-run readout is decomposed into valid-prefix and extra-output contributions, and the valid-prefix output need not equal the native-horizon output.The identities were checked numerically before aggregation.Source: §A.2 · p. 28
  • Table A.2 reports a descriptive association between added-bin count and changed labels across all 9,981 validation sources; padding gap was not randomly assigned.Its scope is native versus padding-matched GPU singleton labels grouped by added 5 ms bins.Source: §A.2 · p. 28, Table A.2 · p. 28
  • Removing the added-bin component restores 26 changed labels, but 318 remain changed in the prefix alone among 344 historically changed sources.All 344 historically changed sources and 64 positive-padding unchanged controls reproduced their stored native and full-padded labels.Source: §A.2 · p. 28
  • Holding native output fixed, adding the observed extra-output vector changes 43 labels in this selected cohort; this is an algebraic diagnostic, not a physical perturbation.Both prefix alteration and added output mass must be retained in the explanation.Source: §A.2 · pp. 28–29
  • Zero input at padded positions does not guarantee zero downstream activity, and the reported 4.72% change rate with one to five added bins identifies no unique causal route.The public attention mask excludes invalid key columns, while horizon-dependent q/k reshapes and the symmetric local kernel remain possible routes; no branch-specific padding intervention was performed.Source: §A.2 · p. 29

A.3 Source isolation in the q/k LIF layout

The q/k LIF layout reshapes batch data so declared time sequences can mix entries from different sources. Joint source isolation makes scores invariant to batch order across validation, with near-complete agreement to padding-matched singleton labels.

A.3 Source isolation in the q/k LIF layout

  • The public reshape reinterprets contiguous [B, h, T, d] queries and keys as [T, B, N], mixing 200 original sources along each recorded LIF time sequence.In the recorded T = 200, B = 256, N = 256 group, reversing source order changes those sequences.Source: §A.3 · p. 29
  • The diagnostic wrapper forms independent sequences and restores the expected layout while retaining singleton flattening; for B = 1 it calls the original LIF forward directly.It introduces no conventional temporal-axis correction or retraining, and wrappers are inactive during canonical candidate replay.Source: §A.3 · p. 29
  • All 9,981 jointly isolated score vectors are bitwise order-invariant, and isolated-batch labels match padding-matched singleton labels on 9,980 sources.Source 7942 changes from class 27 to its correct class 25; cross-shape score differences can still be large for some sources.Source: §A.3 · p. 29
  • Original q-only and k-only conditions show order and duplicate-position score differences, while joint isolation removes both differences in each of three selected pairs.The maximum discrepancy from padded singleton scores in these pair controls is 1.91 × 10−6; this is not the full-validation maximum.Source: §A.3 · p. 29

A.4 Paired native-singleton device replay

Paired CPU/GPU replay preserves the original vulnerable-source identities and their archived adverse witnesses. The replay distinguishes transition-type retention from exact predicted-class agreement.

A.4 Paired native-singleton device replay

  • The replay reconstructed all 25,820 canonical class-changing tensors and ran each on CPU and GPU in the same PyTorch 2.11.0/CUDA 12.8 runtime.Candidate counts, non-negativity, native horizon, and candidate identities were checked; CPU inference used one thread.Source: §A.4 · p. 29
  • Among the replayed candidates, 25 transition-type disagreements return to the clean class; the remaining label disagreement changes an adverse candidate’s incorrect target while preserving its adverse type.The table distinguishes retention of transition type from retention of the exact predicted class.Source: §A.4 · p. 29, Table A.3 · p. 30
  • The first archived adverse witness for each vulnerable source is unchanged across devices, recovering all 13 original source identities without selecting new witnesses.No originally class-preserved candidate is included in this selected-cohort replay.Source: §A.4 · p. 30
Loading 2610.03155v1…