Determine whether adversarial target alignment achieves practical independent recovery

Determine whether adversarial attacks on contrastive encoders can produce practical independent target recovery at or above the blend-derived reference level, rather than merely increasing victim-space target alignment.

Background

The paper evaluates whether victim-space target similarity (VTS), optimized by an adversarial attack against a contrastive encoder, predicts independently measured target evidence (ITE). Independent evidence is calibrated against the evidence produced by blending a source image with a real target-class image at a 50% dose. Although robustly fine-tuned encoders produce more independent evidence than vanilla CLIP and SigLIP, no cell reaches the frozen reference level. Three cells lie within the replication band created by two anchor estimates, so the authors classify their practical recovery status as inconclusive rather than resolved.

References

The three nearest cells fall within the replication band of that level, so the question of practical recovery remains open rather than settled.

— Does Target Alignment Mean Target Recovery? An Evidence-Ladder Study of Adversarial Claims on Contrastive Encoders  (2610.11938 - Yang et al., 8 Oct 2026) in Section 1, Introduction; Section 5.2, Results—Robustness–evidence contrasts; Section 6, Discussion—Near-threshold cells

Downstream propagation (L3) remains untested: if the classifier-level evidence we measure propagates to generative or retrieval endpoints, the sub-threshold finding may understate the practical risk.

— Does Target Alignment Mean Target Recovery? An Evidence-Ladder Study of Adversarial Claims on Contrastive Encoders  (2610.11938 - Yang et al., 8 Oct 2026) in Section 6, Discussion—Future work