{"record_type":"pith_number_record","schema_url":"https://pith.science/schemas/pith-number/v1.json","pith_number":"pith:2026:ZG3HMSQHPKQYNYMVJQITBTOU3C","short_pith_number":"pith:ZG3HMSQH","schema_version":"1.0","canonical_sha256":"c9b6764a077aa186e1954c1130cdd4d8946d8922b06a3be93cf09191a9d31cc6","source":{"kind":"arxiv","id":"2607.00174","version":1},"attestation_state":"computed","paper":{"title":"Steal the Patch Size: Adversarially Manipulate Vision-Language Models","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.LG"],"primary_cat":"cs.CV","authors_text":"Akash Bharadwaj, Kai Hu, Matt Fredrikson, Weichen Yu","submitted_at":"2026-06-30T20:47:35Z","abstract_excerpt":"We present a black-box model-stealing attack that recovers private vision-tokenizer configurations of deployed vision-language models (VLMs), including the visual patch size and input preprocessing pipeline. The key idea is a task-level side channel induced by ViT-style patchification: when a synthetic grid image is aligned with the hidden patch grid, boundary cues are erased at tokenization, causing periodic accuracy drop. By sweeping the grid cell size and measuring these collapses, we infer the patch size; by introducing padding and a consistency-check test, we further identify whether prep"},"verification_status":{"content_addressed":true,"pith_receipt":true,"author_attested":false,"weak_author_claims":0,"strong_author_claims":0,"externally_anchored":false,"storage_verified":false,"citation_signatures":0,"replication_records":0,"graph_snapshot":true,"references_resolved":false,"formal_links_present":false},"canonical_record":{"source":{"id":"2607.00174","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CV","submitted_at":"2026-06-30T20:47:35Z","cross_cats_sorted":["cs.LG"],"title_canon_sha256":"582c51480f2ae8cf4e83daf83ed2f9d16fe8095d0f00d1a8435b61a30bf0acf7","abstract_canon_sha256":"5e81e19c07ed41fc3aaeaa6494b35b50a4932e6421f701574d03ada578516897"},"schema_version":"1.0"},"receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-02T00:18:37.903545Z","signature_b64":"BVKwEGv118IhhS22l8KRra8FQm7x07jF+QRVdS/wXvDP2DO3ziUAm8gvZz91J9oYQusgdPOZI1hS4sm6EII3CQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"c9b6764a077aa186e1954c1130cdd4d8946d8922b06a3be93cf09191a9d31cc6","last_reissued_at":"2026-07-02T00:18:37.902919Z","signature_status":"signed_v1","first_computed_at":"2026-07-02T00:18:37.902919Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"graph_snapshot":{"paper":{"title":"Steal the Patch Size: Adversarially Manipulate Vision-Language Models","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.LG"],"primary_cat":"cs.CV","authors_text":"Akash Bharadwaj, Kai Hu, Matt Fredrikson, Weichen Yu","submitted_at":"2026-06-30T20:47:35Z","abstract_excerpt":"We present a black-box model-stealing attack that recovers private vision-tokenizer configurations of deployed vision-language models (VLMs), including the visual patch size and input preprocessing pipeline. The key idea is a task-level side channel induced by ViT-style patchification: when a synthetic grid image is aligned with the hidden patch grid, boundary cues are erased at tokenization, causing periodic accuracy drop. By sweeping the grid cell size and measuring these collapses, we infer the patch size; by introducing padding and a consistency-check test, we further identify whether prep"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2607.00174","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2607.00174/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"aliases":[{"alias_kind":"arxiv","alias_value":"2607.00174","created_at":"2026-07-02T00:18:37.903008+00:00"},{"alias_kind":"arxiv_version","alias_value":"2607.00174v1","created_at":"2026-07-02T00:18:37.903008+00:00"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2607.00174","created_at":"2026-07-02T00:18:37.903008+00:00"},{"alias_kind":"pith_short_12","alias_value":"ZG3HMSQHPKQY","created_at":"2026-07-02T00:18:37.903008+00:00"},{"alias_kind":"pith_short_16","alias_value":"ZG3HMSQHPKQYNYMV","created_at":"2026-07-02T00:18:37.903008+00:00"},{"alias_kind":"pith_short_8","alias_value":"ZG3HMSQH","created_at":"2026-07-02T00:18:37.903008+00:00"}],"events":[],"event_summary":{},"paper_claims":[],"inbound_citations":{"count":0,"internal_anchor_count":0,"sample":[]},"formal_canon":{"evidence_count":0,"sample":[],"anchors":[]},"links":{"html":"https://pith.science/pith/ZG3HMSQHPKQYNYMVJQITBTOU3C","json":"https://pith.science/pith/ZG3HMSQHPKQYNYMVJQITBTOU3C.json","graph_json":"https://pith.science/api/pith-number/ZG3HMSQHPKQYNYMVJQITBTOU3C/graph.json","events_json":"https://pith.science/api/pith-number/ZG3HMSQHPKQYNYMVJQITBTOU3C/events.json","paper":"https://pith.science/paper/ZG3HMSQH"},"agent_actions":{"view_html":"https://pith.science/pith/ZG3HMSQHPKQYNYMVJQITBTOU3C","download_json":"https://pith.science/pith/ZG3HMSQHPKQYNYMVJQITBTOU3C.json","view_paper":"https://pith.science/paper/ZG3HMSQH","resolve_alias":"https://pith.science/api/pith-number/resolve?arxiv=2607.00174&json=true","fetch_graph":"https://pith.science/api/pith-number/ZG3HMSQHPKQYNYMVJQITBTOU3C/graph.json","fetch_events":"https://pith.science/api/pith-number/ZG3HMSQHPKQYNYMVJQITBTOU3C/events.json","actions":{"anchor_timestamp":"https://pith.science/pith/ZG3HMSQHPKQYNYMVJQITBTOU3C/action/timestamp_anchor","attest_storage":"https://pith.science/pith/ZG3HMSQHPKQYNYMVJQITBTOU3C/action/storage_attestation","attest_author":"https://pith.science/pith/ZG3HMSQHPKQYNYMVJQITBTOU3C/action/author_attestation","sign_citation":"https://pith.science/pith/ZG3HMSQHPKQYNYMVJQITBTOU3C/action/citation_signature","submit_replication":"https://pith.science/pith/ZG3HMSQHPKQYNYMVJQITBTOU3C/action/replication_record"}},"created_at":"2026-07-02T00:18:37.903008+00:00","updated_at":"2026-07-02T00:18:37.903008+00:00"}