arXiv:2506. 20893v5 Announce Type: replace-cross Abstract: In this paper, we reveal a significant shortcoming in class unlearning evaluations: overlooking the underlying class geometry can cause information leakage about the forgotten class.
By Ali Ebrahimpour-Boroojeny, Yian Wang, Hari Sundaram
The paper demonstrates that a targeted adversarial perturbation can reduce a vision‑language model’s training loss to near zero for a fixed target caption, yet the same model, when generating freely, still produces the correct description. This phenomenon, termed the train/inference gap, is traced to a single autoregressive step where the target token’s rank is fixed across all images, and further analysis shows that the language decoder, rather than the visual encoder, determines whether the corrupted signal is amplified or suppressed. The study uses a controlled two‑stage PGD attack on Qwen2.5‑VL‑7B‑Instruct and evaluates the effect on 200 held‑out COCO images, revealing that adversarial robustness in autoregressive VLMs largely depends on the language decoder’s prior.
whyItMatters":"The findings suggest that defenses and faithfulness evaluations for deployed vision‑language models should focus on the language decoder rather than the visual encoder, as the former is the key determinant of robustness to adversarial perturbations."
By Arun Josephraj Arokiaraj, Zekun Wu, Adriano Koshiyama
LETHE is a new protection method that defends against unauthorized image‑to‑video generation by disrupting how diffusion models read a reference image. It achieves this by collapsing the spread of reference value vectors and attracting subsequent frames to these collapsed tokens, thereby severely degrading generated videos. Extensive experiments on modern I2V models and two human‑centric benchmarks show that LETHE outperforms existing protection techniques.
By Boheng Li, Yueming Xing, Yiming Li, Jie Zhang, Tianwei Zhang
The paper introduces a unified evaluation framework for assessing the physical adversarial robustness of Vision‑Language Models (VLMs) deployed at the edge. It defines a conditional attack success rate (cASR) metric that counts only images where the model still localizes objects under a gray occluder, and categorizes failures into omission, substitution, and displacement. Benchmarking shows that compact grounding VLMs can be as vulnerable as traditional object detectors, with omission being the only failure visible to downstream systems, while displacement and substitution pose potentially more dangerous risks, especially under distribution shift.
By Eric Liang, Alan Luo, Kaiwen Yuan
The paper reports a privacy breach in a two-node split‑LLM training system where the returned gradient reveals which data rows were real, despite the system passing standard privacy checks. By exploiting the fact that decoy rows produce zero gradients, an attacker can identify real rows with 100% accuracy across multiple runs. The authors demonstrate that adding gradient clipping and noise can mitigate the leak, but the system remains vulnerable to several untested attack vectors.
By Georgios Politis, Evangelos Pappas
The paper investigates what information must be preserved in replay buffers for class‑incremental learning. By treating cached predictions as temporally heterogeneous supervision, the authors separate classes known at storage time from those learned later, and evaluate the impact of deleting logit matching. Experiments on CIFAR‑100 with DER++ show that a simple task‑level offset can largely correct the cost of removing later‑class matching, while the cost of disrupting class correspondence remains.
By BoRen Deng, Xiangyue Ma, Chenglong Li, Xiaoting Du