🤖 machine learning

Steal the Patch Size: Adversarially Manipulate Vision-Language Models

This paper introduces "Steal the Patch Size," a black-box attack that exploits task-level side-channel accuracy drops in vision-language models to recover private tokenizer configurations, such as patch size and preprocessing pipelines, thereby enabling targeted adversarial manipulation.

Original authors: Kai Hu, Akash Bharadwaj, Weichen Yu, Matt Fredrikson

Published 2026-07-02

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Kai Hu, Akash Bharadwaj, Weichen Yu, Matt Fredrikson

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are trying to guess the secret recipe of a famous chef's soup, but you aren't allowed to see the kitchen, the ingredients, or the chef's notes. You can only order the soup, taste it, and ask, "How does this taste?"

This paper describes a clever trick where researchers "tasted" the soup of modern AI image-solvers (called Vision-Language Models) to figure out their secret recipe. Specifically, they managed to steal two hidden details:

The "Patch Size": How the AI chops up an image into tiny square tiles before looking at it.
The "Preprocessing": Whether the AI squishes every image to a specific size or handles them differently based on their original shape.

Here is how they did it, using simple analogies.

The "Strawberry" Problem

You know how some people struggle to count the letter "r" in the word "strawberry"? It's because the brain sees the whole word, not the individual letters.

This paper found that AI models have a similar problem with images. Most AI models don't look at a picture as a continuous image; they chop it into a grid of small squares (patches), like a mosaic. If the AI chops the image into 16x16 pixel squares, it treats each square as one single "word" (or token).

The Trap: The Grid Game

The researchers created a simple game to trick the AI. They showed the AI an image of a colored grid (like a checkerboard) and asked, "How many squares are in this grid?"

Humans can answer this instantly. But the AI started failing in a very strange, predictable pattern:

When the grid squares were a certain size, the AI got it right.
When the grid squares were slightly larger or smaller, the AI got it wrong.
When the grid squares were exactly the same size as the AI's hidden "chopping tiles," the AI went completely blind and failed miserably.

Why? Imagine the AI's chopping tiles are perfectly aligned with the grid lines. The AI looks at one tile and sees only one solid color. It never sees the line where the colors change because the line falls exactly between the tiles. It's like trying to see the edge of a brick wall by looking only at the bricks, never the mortar. The AI loses the ability to count.

The Heist: Stealing the Secrets

By testing thousands of different grid sizes, the researchers watched for these "blind spots."

Finding the Tile Size: They noticed the AI failed every time the grid size was a multiple of a specific number (e.g., 14, 28, 42). This told them the AI's hidden "chopping tile" was exactly 14 pixels wide.
Finding the Resize Rule: Some AI models squish every image to a fixed size (like 512x512) before chopping it. Others handle different sizes differently.
- If the AI squishes images, the "blind spots" disappear when you just change the grid size.
- But the researchers added a trick: they put the grid inside a larger, blank canvas (padding). By changing the size of this blank canvas, they could force the AI to squish the image in predictable ways. This revealed the exact size the AI was squishing images to (e.g., 512 pixels).

The Result: They Know the Secrets

Using this method, the researchers successfully guessed the hidden settings of major AI models like GPT-4o, Claude, and Qwen. They didn't need to hack the code; they just asked the right questions and watched where the AI stumbled.

Why Does This Matter? (The "Targeted" Attack)

The paper shows that knowing these secrets allows for a "surgical" attack.

Imagine you want to trick a specific AI into seeing a stop sign as a speed limit sign, but you don't want to trick a different AI.

Without the secret: You make a generic trick that might work on both, or neither.
With the secret: You know exactly how the first AI chops its images. You can create a trick that works perfectly for that specific chopping style but looks completely normal to the second AI (which chops differently).

It's like knowing a specific lock's tumblers are 14mm wide. You can craft a key that opens only that lock, while leaving all other locks untouched.

Summary

The paper proves that the "invisible" way AI models process images leaves a fingerprint. By asking simple questions about grids, researchers can reverse-engineer the model's internal settings. This reveals that the "implementation details" of how AI sees the world are actually secret keys that, if stolen, allow attackers to create highly specific and dangerous tricks against those models.

Technical Summary: Steal the Patch Size: Adversarially Manipulate Vision-Language Models

Problem Statement

Deployed Vision-Language Models (VLMs) rely on complex, often undocumented visual preprocessing pipelines. These pipelines include critical architectural and system-level design choices such as visual patch size ( $P$ ), input resizing strategies, padding/cropping rules, and target resolutions ( $S$ ). While these parameters significantly impact model efficiency, accuracy, and robustness, they are typically treated as private deployment-time information and are not disclosed via APIs or documentation.

This paper addresses a "blind spot" in black-box VLMs: the inability of these models to perform trivial tasks (like counting grid cells) when specific structural alignments occur between the input image and the model's internal tokenization grid. The authors posit that these failures are not random but constitute a deterministic, task-level side channel induced by ViT-style patchification. The core research question is whether private architectural and preprocessing parameters of black-box VLMs can be systematically recovered through API access alone, without access to gradients, internal activations, or training data.

Methodology

The proposed attack, termed Patch-Size Matching (PSM), exploits the geometric relationship between input grid boundaries and the model's internal patch grid.

1. The Mechanism: Patch-Size Matching (PSM)

Most VLMs tokenize images using a Vision Transformer (ViT) that partitions inputs into non-overlapping $P \times P$ patches.

The Phenomenon: When a synthetic grid image with cell size $D$ is processed, if the effective cell size in the tokenizer's input space ( $D_{eff}$ ) is an integer multiple of the patch size ( $D_{eff} = kP$ ), the grid boundaries fall exactly between patches.
The Consequence: Because the interior of each grid cell is constant color, patches falling entirely within a cell contain no edge information. The tokenization process suppresses boundary cues, causing the model to become "blind" to the grid structure.
The Signal: As the grid cell size $D$ is swept, the model's accuracy on a grid-counting task exhibits periodic drops (valleys) whenever $D_{eff}$ aligns with a multiple of $P$ .

2. The Three-Stage Black-Box Attack

The authors propose a systematic procedure to recover hidden parameters under unknown resizing and padding conditions:

Stage 1: Unpadded Sweep (Dynamic vs. Fixed Resolution)
The attacker queries the model with grid images of varying cell sizes $D$ without padding.
- If the model uses dynamic resolution, the periodic accuracy valleys appear directly, allowing the direct inference of the patch size $P$ from the period of the drops.
- If the model uses fixed resolution (resizing inputs to a target $S$ ), the periodicity is obscured because $D$ is rescaled non-linearly.
Stage 2: Restoring Periodicity via Zero-Padding
For models suspected of using fixed resolution, the attacker embeds the grid image into a larger canvas $L \times L$ using zero-padding (anchoring content at the top-left).
- This introduces a controllable scaling factor. If the model resizes $L \times L$ to a fixed target $S$ , the effective cell size becomes $D_{eff} = (S/L)D$ .
- By sweeping $D$ for different canvas sizes $L$ , the attacker observes that the period of accuracy drops $T(L)$ scales linearly with $L$ .
- This allows the recovery of the scale ratio $S/P$ via the relation $S/P = L/T(L)$ .
Stage 3: Consistency Check for Target Resolution
Stage 2 yields a candidate set of $(S, P)$ pairs. To identify the true target resolution $S$ :
- The attacker performs a hypothesis test comparing the model's output consistency.
- The logic is that if the model's internal target is $S$ , pre-resizing an image to $S$ before querying should yield answers more consistent with the raw query than pre-resizing to an incorrect candidate $S'$ .
- A statistical tournament selects the unique $S$ that consistently maximizes answer consistency.

3. Statistical Validation

To avoid subjective interpretation of accuracy drops, the authors employ a non-parametric permutation test (Welch-style) to determine the statistical significance of observed periodicity, ensuring the identified periods are not artifacts of noise.

Key Results

The attack was evaluated across open-source models (Qwen-VL variants, InternVL) and proprietary models (GPT-4.1-mini, GPT-4o, Claude 3.7, Claude 4.5).

Parameter Recovery: The method successfully recovered patch sizes and preprocessing behaviors.
- Qwen3-VL 30B: Identified dynamic resolution with $P=16$ .
- Claude 3.7: Identified dynamic resolution with $P=14$ .
- GPT-4.1-mini: Identified dynamic resolution with $P=16$ .
- GPT-4o: Identified fixed-resolution preprocessing. Through the three-stage process, the authors inferred a target resolution of $S=512$ and a patch size of $P=16$ .
Robustness: The attack remained effective even when models employed unknown resizing, padding, or dynamic resolution strategies.
Cost: The attack requires approximately $4.8 \times 10^4$ queries (roughly $10^7$ tokens) for high-confidence intervals, costing roughly $\$ 10\text{--}$50$ under typical API pricing.

Significance and Implications

The paper claims that recovering these "implementation details" is not merely an academic exercise but a prerequisite for advanced security attacks.

Preprocessing-Aware Transfer Attacks: Knowing the exact preprocessing pipeline allows attackers to craft adversarial perturbations that avoid distortion (aliasing) caused by resizing and padding, significantly improving transferability.
Model-Targeted Adversarial Manipulation: The authors demonstrate that leaked parameters enable the creation of adversarial examples that selectively manipulate a specific target model while remaining benign to others with different pipelines.
- Experimental Proof: In a targeted attack experiment on the NIPS 2017 dataset, an attack crafted specifically for GPT-4o (using its recovered $S=512, P=16$ ) achieved an 86.5% success rate on GPT-4o while dropping the success rate on Claude 3.7 to 4.5%. Conversely, an attack targeted at Claude 3.7 succeeded against it (18.5%) while failing against GPT-4o.

Conclusion

The authors conclude that ViT-style patchification creates a detectable signature in black-box behavior, leaking private deployment-time configurations. They argue that "implementation details" in the vision frontend are security-relevant secrets. The paper suggests that mitigations such as randomized/stochastic preprocessing, boundary-preserving tokenization, or query controls are necessary to prevent such parameter leakage and the subsequent model-targeted manipulations.