{"id":"ed9859f1-a4b8-4bbd-b4ca-545313a311f4","arxiv_id":"2607.07375","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"unknown","formal_verification":"none","parameter_count":5,"one_line_summary":"Aligning adversarial perturbations with the near-null singular directions of intermediate linear layers in transformer VLMs yields stronger attacks than existing feature- and output-space methods.","lead":"The paper introduces a white-box adversarial attack on vision-language models that targets the bottom singular-vector subspaces of intermediate weight matrices, showing improved degradation of model outputs over six baselines on three VLMs. A generalist might read it because it identifies a specific, measurable structural weakness in widely deployed multimodal AI systems.","discovery_kind":"unclear","skeptic_critique":{"model":"glm-5.2","headline":"SSGRA's reported gains rely on post-hoc per-model tuning of layer set S and trade-off λ (λ=0 on Qwen2.5-VL, the strongest-gain model), giving it optimization degrees of freedom that baselines lack; the fairness of the comparison is the load-bearing question.","rationale":"The reader's CONDITIONAL verdict already captures the core concern. I am not changing the verdict but am extending the rationale: the layer-selection issue is compounded by per-model λ selection (with λ=0 on the strongest-gain model) and by the extreme variance of SSGRA's results, which together make the baseline comparison not fully fair. The conceptual contribution — identifying bottom singular-vector subspaces as a spectral attack surface — is interesting and partially supported by Figure 5 (natural alignment increase under BSA) and the ablation in Figure 7b (bottom vs. top subspace). But the empirical claim that SSGRA improves attack effectiveness needs cleaner evaluation with fixed hyperparameters and a larger evaluation set to be convincing. The paper itself acknowledges the layer-selection limitation and defers adaptive methods to future work, which is appropriate. No code release further limits reproducibility. The verdict should remain CONDITIONAL with moderate confidence.","tokens_in":28489,"tokens_out":3509,"duration_ms":170579,"concrete_test":"Re-run SSGRA on Qwen2.5-VL and LLaVA-1.5 with (a) a fixed layer set S selected on a held-out set of images disjoint from the 100-image evaluation set, and (b) a single fixed λ (e.g., 0.5) across all three models. If the gains over the strongest baseline persist at >3% relative degradation under this fixed configuration, the spectral hypothesis is supported. If the gains shrink below that threshold or the variance remains as extreme, the post-hoc tuning is the primary driver.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central empirical claim is that spectral subspace guidance improves attack effectiveness over baselines. The evidence (Table 3, Figure 2) shows SSGRA outperforming six baselines on three VLMs. However, SSGRA benefits from post-hoc tuning that baselines do not receive: (1) the layer set S is selected by evaluating each layer on a validation set and retaining the strongest performers (Section 4.1); (2) the trade-off parameter λ is selected per model, with λ=0 chosen for Qwen2.5-VL (Section 5.5), meaning the combined objective in Eq. (2) reduces to pure spectral alignment on the model showing the largest gains — the combined-objective design is not validated there; (3) the subspace dimension s is stated as fixed but its selection procedure is not described. Baselines appear to receive only learning-rate grid search (Section 5.1), applied uniformly to all methods. This asymmetry means SSGRA's reported gains could partly reflect selection bias rather than the intrinsic value of spectral guidance. The concern is amplified by the extremely high variance of SSGRA results: e.g., Qwen2.5-VL ROUGE-L F1 at c=0.005 is 0.010±0.020 (std exceeds mean), and at c=0.0035 BERTScore F1 is 0.704±0.217, compared to BSA at 0.864±0.037 and CE at 0.875±0.034. This suggests a bimodal outcome distribution where the mean improvement may be driven by a subset of images where the tuned configuration happens to work well, rather than a uniform spectral vulnerability. The reader identified the layer-selection issue but not the λ=0 collapse or the variance problem.","agreement_with_reader":"partial"},"referee_report":{"model":"glm-5.2","summary":"The paper introduces a spectral perspective on adversarial vulnerability in transformer-based vision-language models (VLMs). The central idea is that bottom singular-vector subspaces of intermediate linear transformations constitute an overlooked attack surface: representations aligned with these subspaces are strongly attenuated, and explicitly guiding adversarial representations toward them (via the proposed SSGRA attack) improves attack effectiveness. The paper provides evidence across three VLMs (Qwen2.5-VL, LLaVA-1.5, Gemma 3) and six baselines, using BERTScore and ROUGE-L. It also shows that untargeted adversarial optimization (BSA) naturally increases bottom-subspace alignment, providing independent support for the mechanism. The theoretical grounding draws on the instability of ill-posed inverse problems. The core mechanism is novel and the empirical evidence is broadly supportive, but the comparison fairness between SSGRA and baselines is compromised by asymmetric hyperparameter tuning and extremely high variance in SSGRA's results.","tokens_in":29501,"tokens_out":1571,"duration_ms":247464,"significance":"The paper identifies a genuinely underexplored spectral attack surface (bottom singular-vector subspaces of intermediate linear transformations) and provides a falsifiable mechanism (information attenuation along near-null directions) grounded in the theory of ill-posed inverse problems. The observation that BSA naturally increases bottom-subspace alignment (Figure 5) is a non-circular supporting result. The ablation comparing bottom- vs. top-subspace alignment (Figure 7b) is a clean test of the hypothesis. The framework is tested on three current VLMs with six representative baselines. However, the significance of the empirical gains is tempered by the fairness and variance issues detailed below.","major_comments":[{"comment":"Section 4.1, layer selection procedure: SSGRA's layer set S is selected by evaluating each layer on a validation set and retaining the strongest performers, while baselines receive only learning-rate grid search (Section 5.1). This asymmetry means SSGRA has optimization degrees of freedom that baselines lack. The paper acknowledges this ('Developing adaptive layer-selection methods that avoid validation-based tuning is left for future work') but the reported gains over baselines are not directly comparable under this protocol. At minimum, baselines should also receive equivalent per-layer validation tuning, or the paper should report SSGRA results with a non-tuned layer set (e.g., all layers or a fixed heuristic selection) to isolate the contribution of spectral guidance from the contribution of layer tuning.","section":null},{"comment":"Section 5.5 and Table 3, Qwen2.5-VL: λ=0 is selected for the model showing the largest gains, reducing Eq. (2) to pure spectral alignment (the BSA discrepancy term drops out). This means the combined-objective design is not validated on the strongest-gain model. The ablation in Figure 7a removes the spectral term from the combined objective, but since λ=0 on Qwen2.5-VL, the ablation effectively compares pure spectral alignment vs. pure BSA — not the contribution of spectral guidance as an additive term. The paper should clarify whether the ablation was conducted at λ=0 or at the selected λ, and should report results for intermediate λ values on Qwen2.5-VL to validate the trade-off design.","section":null},{"comment":"Table 3, Qwen2.5-VL ROUGE-L F1: SSGRA exhibits extremely high variance — e.g., at c=0.005, ROUGE-L F1 is 0.010±0.020 (std exceeds mean), and at c=0.0035, BERTScore F1 is 0.704±0.217 vs. BSA at 0.864±0.037. This suggests a bimodal outcome distribution where the mean improvement may be driven by a subset of images where the tuned configuration works well, rather than a uniform spectral vulnerability. The paper should report the distribution of per-image results (e.g., histograms or success rates) to clarify whether the gains are systematic or driven by a subset of images. This is load-bearing because the central claim is that bottom subspaces constitute a general spectral attack surface, not a property-specific or image-specific one.","section":null},{"comment":"Section 4.1, subspace dimension s: The paper states that s is 'fixed' but does not describe how its value was selected or what value was used. Since s controls the dimensionality of the bottom singular-vector subspace and directly affects the spectral alignment term in Eq. (2), its selection procedure should be disclosed. If s was also tuned on the validation set, this adds to the fairness concern above.","section":null}],"minor_comments":[{"comment":"Table 3, Gemma 3: SSGRA does not consistently outperform the strongest baseline (CE) across all budgets. At c=0.002 and c=0.0025, SSGRA is worse than CE on ROUGE-L F1. The paper should acknowledge this more explicitly rather than stating 'SSGRA consistently achieves the strongest attacks.'","section":null},{"comment":"Section 5.1: The perturbation budget range (0.002–0.005 in L∞) is described as selected via grid search, but the selection criterion ('lower bound captures the regime where outputs remain semantically similar') is vague. The specific criterion should be disclosed.","section":null},{"comment":"Figure 2: The y-axis ranges differ across subplots (e.g., Qwen2.5-VL ROUGE-L ranges 0–0.6 while Gemma 3 ranges 0–0.5), making visual comparison across models difficult. Consider using consistent ranges or clearly labeling the different scales.","section":null},{"comment":"Section 3, Eq. (1): The alignment measure Ψ_k normalizes by ||h_i||_2, but the paper does not discuss potential numerical instability when token representations have very small norms.","section":null},{"comment":"Table 2: The FLOPs comparison notes that values should be compared only within the same VLM, but the table presents all three models together. A visual separator or clearer labeling would help.","section":null},{"comment":"Reference [1] cites 'LLaVA-onevision-1.5' but the model is referred to as 'LLaVA-1.5' throughout the text. Clarify whether this is the same model or a different variant.","section":null},{"comment":"Algorithm 1 (Appendix): Line 17 defines L_SSGRA = -λL_BSA + (1-λ)L_SS, but the sign convention should be clarified — the text describes maximizing both objectives, but the negative sign on L_BSA suggests minimization of similarity (which is equivalent to maximizing discrepancy). A brief note would help readers.","section":null}],"recommendation":"major_revision","confidential_remarks":"The paper's core idea (bottom singular-vector subspaces as an attack surface) is novel and the non-circular evidence (Figure 5: BSA naturally increases bottom-subspace alignment) is genuinely supportive. However, the fairness concern is real and load-bearing: SSGRA receives per-layer validation tuning that baselines do not, and λ=0 on the strongest-gain model means the combined-objective design is unvalidated there. The extremely high variance on Qwen2.5-VL (std exceeding mean in several cells) is also concerning and not discussed. I believe these issues are addressable within the manuscript's scope (additional experiments with fair baselines, distributional analysis of per-image results, disclosure of s selection), but they are necessary before the central claim can be accepted. The paper fits the journal's scope if these are resolved."},"author_rebuttal":{"model":"glm-5.2","summary":"We thank the referee for a careful and constructive review. The referee raises four major concerns: (1) asymmetric hyperparameter tuning between SSGRA and baselines, (2) the λ=0 selection for Qwen2.5-VL undermining the combined-objective ablation, (3) extremely high variance in SSGRA's results suggesting bimodal outcomes, and (4) undisclosed selection procedure for the subspace dimension s. We agree that all four points identify legitimate gaps in the manuscript's experimental transparency. We will address each through new experiments and revised text in the next version.","responses":[{"response":"The referee is correct that the current protocol introduces an asymmetry: SSGRA benefits from validation-based layer selection while baselines do not receive equivalent per-layer tuning. We agree this confounds the comparison and will address it in the revision through two additions. First, we will report SSGRA results using a non-tuned, fixed layer set (specifically, applying spectral guidance to all eligible intermediate linear transformations rather than a validation-selected subset). This isolates the contribution of spectral guidance from the contribution of layer tuning. If the gains persist with the fixed layer set, they are attributable to the spectral mechanism rather than the selection procedure. Second, we will apply equivalent per-layer validation tuning to the strongest baselines (at least BSA, which is the most directly comparable method since SSGRA extends it). This ensures both methods receive comparable optimization budgets. We will present both sets of results alongside the existing ones and discuss the implications transparently. We acknowledge that if the gains diminish substantially under the fixed layer set, the current claims about the magnitude of improvement would need to be qualified. We also note that the non-circular supporting evidence — the BSA natural-alignment finding (Figure 5) and the bottom-vs-top ablation (Figure 7b) — does not depend on layer selection and thus provides independent evidence for the spectral mechanism regardless of this concern.","revision_made":"yes","referee_comment":"Section 4.1, layer selection procedure: SSGRA's layer set S is selected by evaluating each layer on a validation set and retaining the strongest performers, while baselines receive only learning-rate grid search (Section 5.1). This asymmetry means SSGRA has optimization degrees of freedom that baselines lack. The paper acknowledges this ('Developing adaptive layer-selection methods that avoid validation-based tuning is left for future work') but the reported gains over baselines are not directly comparable under this protocol. At minimum, baselines should also receive equivalent per-layer validation tuning, or the paper should report SSGRA results with a non-tuned layer set (e.g., all layers or a fixed heuristic selection) to isolate the contribution of spectral guidance from the contribution of layer tuning."},{"response":"The referee's observation is accurate and we appreciate its precision. On Qwen2.5-VL, λ=0 was selected, which reduces Eq. (2) to pure spectral alignment without the BSA discrepancy term. The ablation in Figure 7a was conducted at the selected λ=0, meaning it compares pure spectral alignment (SSGRA with λ=0) against pure BSA (the spectral term removed, which leaves only the BSA objective). The referee is correct that this does not test the contribution of spectral guidance as an additive term within the combined objective — it tests the two objectives in isolation. We will make this explicit in the revised text. To properly validate the trade-off design, we will run and report results for intermediate λ values (e.g., λ ∈ {0.1, 0.25, 0.5, 0.75, 0.9}) on Qwen2.5-VL. This will show whether combining the two objectives at intermediate λ yields improvements over either pure objective (λ=0 or λ=1), or whether pure spectral alignment is indeed optimal for this model. If the latter, we will discuss why Qwen2.5-VL's spectral characteristics (its high proportion of near-null singular directions, Table 1) may make pure spectral alignment sufficient, while models with fewer near-null directions (e.g., Gemma 3) may benefit from the combined objective. We will also report the selected λ values for LLaVA-1.5 and Gemma 3 to show whether the combined objective is validated on those models.","revision_made":"yes","referee_comment":"Section 5.5 and Table 3, Qwen2.5-VL: λ=0 is selected for the model showing the largest gains, reducing Eq. (2) to pure spectral alignment (the BSA discrepancy term drops out). This means the combined-objective design is not validated on the strongest-gain model. The ablation in Figure 7a removes the spectral term from the combined objective, but since λ=0 on Qwen2.5-VL, the ablation effectively compares pure spectral alignment vs. pure BSA — not the contribution of spectral guidance as an additive term. The paper should clarify whether the ablation was conducted at λ=0 or at the selected λ, and should report results for intermediate λ values on Qwen2.5-VL to validate the trade-off design."},{"response":"This is a fair and important concern. The high variance — particularly cases where the standard deviation exceeds the mean — is consistent with a bimodal or heavy-tailed distribution of per-image outcomes. We will address this by reporting per-image result distributions (histograms and/or success rates at various thresholds) for SSGRA and the strongest baselines on Qwen2.5-VL. This will make transparent whether the gains are systematic across images or driven by a subset where the attack succeeds dramatically while others remain largely unaffected. We acknowledge that if the distribution is strongly bimodal — with gains concentrated on a subset of images — the claim that bottom subspaces constitute a 'general spectral attack surface' would need to be qualified. However, we note that even a bimodal distribution would be consistent with the spectral mechanism if the bimodality correlates with spectral properties of the specific images or layers involved (e.g., images whose clean representations have higher initial energy in near-null directions). We will investigate this and report whether per-image attack success correlates with spectral alignment measures, which would provide additional mechanistic evidence. We will also report median performance in addition to means to reduce the influence of outlier images on the reported comparisons.","revision_made":"yes","referee_comment":"Table 3, Qwen2.5-VL ROUGE-L F1: SSGRA exhibits extremely high variance — e.g., at c=0.005, ROUGE-L F1 is 0.010±0.020 (std exceeds mean), and at c=0.0035, BERTScore F1 is 0.704±0.217 vs. BSA at 0.864±0.037. This suggests a bimodal outcome distribution where the mean improvement may be driven by a subset of images where the tuned configuration works well, rather than a uniform spectral vulnerability. The paper should report the distribution of per-image results (e.g., histograms or success rates) to clarify whether the gains are systematic or driven by a subset of images. This is load-bearing because the central claim is that bottom subspaces constitute a general spectral attack surface, not a property-specific or image-specific one."},{"response":"The referee is correct that the selection procedure for s is not disclosed in the manuscript. We will add this information in the revision. In our experiments, s was set to 10, matching the value used in the spectral alignment analysis (Section 5.4, where k=10 is used for the top-k and bottom-k subspace analyses in Figures 5 and 6). The value was chosen based on the spectral analysis showing that the bottom-10 singular vectors capture the most attenuated directions, and was fixed across all models and perturbation budgets rather than being tuned per-model on the validation set. We will state this explicitly, including the rationale for the choice and its relationship to the analysis in Section 5.4. We will also add a sensitivity analysis over a small set of s values (e.g., s ∈ {5, 10, 20, 50}) to show that the results are not sensitive to this choice, which would further address the fairness concern. If s was in fact tuned on the validation set, we will disclose this honestly and add it to the list of tuned hyperparameters; if it was fixed as described, the sensitivity analysis will confirm robustness.","revision_made":"yes","referee_comment":"Section 4.1, subspace dimension s: The paper states that s is 'fixed' but does not describe how its value was selected or what value was used. Since s controls the dimensionality of the bottom singular-vector subspace and directly affects the spectral alignment term in Eq. (2), its selection procedure should be disclosed. If s was also tuned on the validation set, this adds to the fairness concern above."}],"tokens_in":28641,"tokens_out":1871,"duration_ms":169704,"standing_objections":[]},"desk_editor":{"model":"glm-5.2","letter":"The paper introduces a new angle on adversarial vulnerability in VLMs: bottom singular-vector subspaces of intermediate linear layers as an attack surface. The most valuable finding is observational and independent of the proposed attack — Figure 5 shows that BSA, which has no spectral objective, naturally increases alignment with bottom singular subspaces during optimization. That's a non-trivial result. The spectral characterization in Table 1 (near-null singular directions are far more prevalent than large ones) is also useful empirical grounding. The analogy to ill-posed inverse problems is reasonable and gives the work a theoretical hook that prior spectral-norm approaches lack. Credit is due for framing the problem from the bottom of the spectrum rather than the top, which is genuinely underexplored. The bottom-vs-top ablation (Figure 7b) is a clean experiment and supports the hypothesis. The layer-wise alignment dynamics in Figure 6 are a nice touch. The paper is clearly written and the algorithm is specified in enough detail to reproduce. No code is released, which is a gap but not a dealbreaker. The stress-test concern about fairness of comparison is the real issue, and it lands. Three problems compound each other. First, the layer set S is selected post-hoc on a 100-image validation set by picking the strongest-performing layers, while baselines get only learning-rate grid search. Second, λ=0 was selected for Qwen2.5-VL — the model showing the largest gains — meaning the combined objective in Eq. (2) collapses to pure spectral alignment there. The ablation in Section 5.6 is also on Qwen2.5-VL, so it's essentially comparing pure spectral alignment vs. pure BSA, not validating the combined design. Third, the variance is extreme: on Qwen2.5-VL ROUGE-L F1 at c=0.005, SSGRA gets 0.010±0.020 (std exceeds mean), and at c=0.0035 BERTScore F1 is 0.704±0.217 vs. BSA at 0.864±0.037. This suggests bimodal outcomes where the mean improvement is driven by a subset of images, not a uniform spectral vulnerability. On Gemma 3, the gains are marginal — several budgets show no improvement over the best baseline. The observational findings (Figure 5, Table 1) stand on their own and are worth publishing. The attack gains need cleaner evaluation: either give baselines the same layer-selection treatment, or use a principled (non-validation-based) layer selection, and report per-image or median-based results to address the variance. This paper is for researchers in adversarial robustness and spectral methods. The spectral perspective is new enough to deserve a serious referee who can push the authors to fix the comparison fairness and variance reporting. I'd recommend accepting for peer review with a clear expectation that these issues get addressed.","headline":"New spectral perspective on VLM adversarial vulnerability is interesting, but the attack comparison has a fairness problem and very high variance that undermines the headline gains.","tokens_in":29313,"tokens_out":1313,"would_cite":false,"duration_ms":84836,"reading_group":"no","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"glm-5.2","headline":"Bottom singular vectors expose hidden attack surface in VLMs","keywords":["adversarial attacks","vision-language models","spectral analysis","singular value decomposition","robustness","transformers","white-box attacks","deep neural networks"],"falsifier":"If aligning adversarial representations with bottom singular-vector subspaces were not the operative mechanism, then replacing the bottom-s subspace with a random subspace of the same dimension should yield comparable attack effectiveness, and removing the spectral alignment term should not degrade performance. The ablation showing that top-singular-subspace alignment produces much weaker attacks than bottom-singular-subspace alignment, and that removing the spectral term weakens SSGRA, partially addresses this.","tokens_in":28579,"feed_emoji":"🔍","tokens_out":1004,"duration_ms":109049,"temperature":0.7,"pith_summary":"This paper identifies the bottom singular-vector subspaces of intermediate linear transformations in transformer-based vision-language models (VLMs) as a previously overlooked spectral attack surface. The authors argue that representations aligned with these near-null singular directions are strongly attenuated, weakening semantic information propagation through the network. They propose SSGRA (Spectral Subspace Guided Representation Attack), a white-box attack that explicitly aligns adversarial intermediate representations with these bottom singular-vector subspaces. The paper shows that SSGRA outperforms representative feature-space and output-space baselines on Qwen2.5-VL, LLaVA-1.5, and Gemma 3, and presents evidence that untargeted adversarial optimization naturally increases alignment with these information-attenuating subspaces even without explicit enforcement.","feed_headline":"Singular vectors reveal hidden attack surface in vision-language models","feed_subtitle":"Aligning adversarial perturbations with near-null spectral directions in VLM weight matrices degrades outputs beyond what existing attacks,","key_machinery":"The Spectral Subspace Guided Representation Attack (SSGRA), a white-box attack combining a blockwise representation-discrepancy objective (inherited from BSA) with a spectral alignment term that pushes adversarial representations into the span of the bottom-s right singular vectors of selected intermediate linear transformations.","core_discovery":"The central discovery is that the bottom singular-vector subspaces of intermediate weight matrices in transformer-based VLMs constitute a spectral attack surface that can be deliberately exploited. The authors demonstrate this through SSGRA, which adds a spectral alignment objective to existing feature-discrepancy attacks, and through analysis showing that standard adversarial optimization already drifts toward these near-null directions unprompted. The degree of vulnerability correlates with the prevalence of near-null singular directions: Qwen2.5-VL, which has roughly twice as many near-null singular directions as Gemma 3, exhibits the largest degradation under SSGRA.","pith_inferences":["If bottom singular-vector subspaces are the primary spectral attack surface, then training-time interventions that reduce the rank deficiency of intermediate weight matrices (e.g., low-rank projection away from near-null directions, or structured regularization enforcing minimum singular value thresholds) could yield models that are harder to attack without changing architecture.","The observation that adversarial optimization naturally aligns with bottom singular subspaces may connect to the broader theory of ill-posed inverse problems: if adversarial vulnerability is fundamentally about information attenuation along near-null directions, then robustness bounds might be expressible in terms of the spectral profile of intermediate layers rather than end-to-end Lipschitz cons","The layer-selection procedure used by SSGRA (retaining layers with strongest attack performance on a validation set) could be inverted: layers where spectral guidance helps most might also be the layers where targeted regularization would yield the largest robustness gains, suggesting a principled layer-priority ordering for spectral defenses."],"forward_implications":["Models with more near-null singular directions in their intermediate weight matrices may be systematically more vulnerable to adversarial perturbations, suggesting spectral conditioning as a diagnostic for robustness.","Regularization that controls or eliminates bottom singular-vector subspaces, complementing existing spectral-norm regularization on large singular values, could become a defense strategy.","The finding that standard attacks naturally drift toward bottom singular subspaces suggests this is an intrinsic geometric property of adversarial optimization in high-dimensional linear transformations, not an artifact of the proposed method.","Spectral profiling of weight matrices could serve as a lightweight pre-deployment audit for VLM robustness without requiring adversarial attack generation.","The correlation between near-null singular direction prevalence and attack vulnerability across models (Qwen2.5-VL vs. Gemma 3) suggests that architectural and training choices influence the spectral attack surface in measurable ways."],"fun_headline_variants":["Near-null spectral directions expose VLM attack surface","Spectral alignment attack degrades vision-language models","Bottom singular vectors map hidden VLM vulnerability","Near-null singular subspaces signal VLM fragility","Spectral subspace attack outperforms VLM baselines"],"cache_read_input_tokens":0,"weakest_assumption_plain":"The layer-selection procedure uses a small validation set to pick which intermediate layers receive spectral guidance, tuning the attack post hoc on the same data distribution used for evaluation. If the selected layers are overfit to this 100-image set, the reported gains over baselines (which do not use such tuning) may not be directly comparable.","fun_headline_variants_meta":{"raw":{"variants":["Near-null spectral directions expose VLM attack surface","Spectral alignment attack degrades vision-language models","Bottom singular vectors map hidden VLM vulnerability","Near-null singular subspaces signal VLM fragility","Spectral subspace attack outperforms VLM baselines"]},"model":"glm-5.2","effort":"low","cost_usd":0.0,"raw_usage":{"total_tokens":572,"prompt_tokens":499,"completion_tokens":73,"prompt_tokens_details":null},"tokens_in":499,"tokens_out":73,"duration_ms":31249,"temperature":1.0,"reasoning_tokens":null,"cache_read_input_tokens":0,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-07-09T12:40:38.819562+00:00","model_set":{"reader":"glm-5.2"},"falsifier":"If aligning adversarial representations with bottom singular-vector subspaces were not the operative mechanism, then replacing the bottom-s subspace with a random subspace of the same dimension should yield comparable attack effectiveness, and removing the spectral alignment term should not degrade performance. The ablation showing that top-singular-subspace alignment produces much weaker attacks than bottom-singular-subspace alignment, and that removing the spectral term weakens SSGRA, partially addresses this.","supporting_citations":[],"review_version":1}