Generalize FATA to black-box transfer settings

Develop black-box transfer methods for Feature-Aware Token Attack (FATA) against visual-token compression when gradients of the target visual encoder are unavailable.

Background

Feature-Aware Token Attack (FATA) assumes access to gradients through the visual encoder. The paper evaluates vision-encoder-only attacks and model-specific adaptations, but does not resolve whether compression-triggered failures can be transferred effectively to systems for which the attacker lacks gradient access. The conclusion explicitly identifies black-box transfer as an unresolved direction.