No-Image++ Ablation Analysis

• No-Image++ Ablation is a term describing experiments that remove or suppress image data while enhancing non-image channels like text and procedural parameters.
• The approach investigates modality dependence using methods such as modality-removal counterfactuals, no-box attacks, and internal image encoder suppression.
• Studies reveal that while non-image information can partially compensate for removed imaging data, image inputs remain critical for tasks like localization and structural visualization.

No-Image++ Ablation is best understood here as an Editor’s term for ablation settings that remove, suppress, or strictly control image information while preserving, substituting, or strengthening non-image channels such as patient profiles, procedural parameters, retrieved knowledge, text encoders, or surrogate decoders. In the most relevant papers, the phrase is not used as an explicit method name; instead, closely related analyses appear as modality-removal counterfactuals, no-box attacks, image-contamination controls, and internal image-encoder suppressions. The common aim is to determine which functions are genuinely image-dependent, which persist through non-image structure, and what residual behavior remains after image-conditioned pathways are reduced or replaced (Zhao et al., 27 May 2025, Chung et al., 11 Aug 2025, Wu et al., 4 Jul 2025).

1. Terminology and scope

Across the recent literature most closely aligned with the topic, “No-Image++” is not a standardized benchmark label. FUAS-Agents explicitly reports that there is no “No-Image,” “No-Image++,” or equivalent image-removal experiment. SOFA is described as a strong design template for procedural optimization conditioned on imaging, but not as direct evidence for image-free optimization. The Stable Diffusion watermark-removal paper likewise states that it does not use the term “No-Image++,” and instead studies stronger no-box attacks. By contrast, “No Safe Dose” is described as “unusually close to an ideal ‘No-Image++’ ablation” because it isolates image-data contamination while separately ablating the text encoder. AAT is relevant as a finer-grained image-side ablation, but it does not remove the image branch (Zhao et al., 27 May 2025, Chung et al., 11 Aug 2025, Wu et al., 4 Jul 2025, Friedrich et al., 27 May 2026, Lin et al., 1 Jul 2025).

Work	Explicit “No-Image++”	Closest reported evidence
FUAS-Agents	No	No “w/o MRI,” “w/o clinical data,” “w/o RAG,” or planning-controller ablation
SOFA	No	“Pre-ablation only,” “Ablation only,” and fused SOFA comparison in Phase 1
Stable Diffusion watermark removal	No	no-box ablations on blur kernel size, message length, and surrogate decoder depth
No Safe Dose	No explicit term	datasets differ only in unsafe-image fraction; text encoder ablation probes the residual floor
AAT	No	attention-head suppression inside the CLIP image encoder

This suggests that No-Image++ Ablation is best treated as a family resemblance across modality-dependence studies rather than as a single canonical protocol. In practice, the phrase is most useful when the experiment asks not merely whether image inputs matter, but whether stronger non-image structure can compensate for their removal, and what parts of the pipeline fail first when image-conditioned evidence disappears.

2. Modality dependence in multimodal treatment-planning systems

In FUAS-Agents, image dependence is stated directly rather than tested through an explicit ablation. The system takes “MRI data and patient information,” and the Planner Agent decomposes the request into “data ingestion and normalization, image analysis and segmentation, dose prediction, text generation, and visualization.” The Tooler Agent includes MRI segmentation with MedSAM-2, and the paper states that segmentation “delineates lesion regions from MRI images, providing essential input for subsequent dose prediction and treatment report generation.” Dose prediction “integrates MRI features and clinical data,” while the final plan includes segmented lesion visualization, predicted treatment dosage, and a textual treatment strategy or report. The paper further states that no image-removal, non-image-removal, RAG-removal, Strategy-Agent-removal, Planner-removal, Memory/Reflexion-removal, or Optimizer-removal ablation is reported. The likely consequences of removing MRI—loss of lesion delineation, loss of image-based radiomics, impaired dose prediction, and degraded visualization—are presented only as inference, not as experimentally validated results (Zhao et al., 27 May 2025).

The same asymmetry appears in SOFA. The framework is fundamentally organized around pre-ablation LGE-MRI rendered into six views and spatial procedural maps encoding duration, force, temperature, and power. Its clearest ablation is not a No-Image++ study in the strict sense, but a Phase 1 comparison among “Pre-ablation” only, “Ablation” only, and fused SOFA. The reported results are: pre-ablation only, MSE $0.027 \pm 0.001$, PSNR $17.57 \pm 0.151$, SSIM $0.822 \pm 0.002$, Dice $0.103 \pm 0.014$; ablation only, MSE $0.020 \pm 0.001$, PSNR $17.61 \pm 0.169$, SSIM $0.814 \pm 0.004$, Dice $0.092 \pm 0.031$; SOFA, MSE $0.018 \pm 0.001$, PSNR $18.00 \pm 0.156$, SSIM $17.57 \pm 0.151$0, Dice $17.57 \pm 0.151$1. For recurrence prediction, the paper reports a demographic baseline with AUC $17.57 \pm 0.151$2 and accuracy $17.57 \pm 0.151$3, a real post-ablation baseline with AUC $17.57 \pm 0.151$4 and accuracy $17.57 \pm 0.151$5, and SOFA with AUC $17.57 \pm 0.151$6 and accuracy $17.57 \pm 0.151$7. The optimization stage reduces model-predicted recurrence from $17.57 \pm 0.151$8 to $17.57 \pm 0.151$9, a $0.822 \pm 0.002$0 reduction. However, the paper explicitly does not report a procedural-parameter-only recurrence model or an image-free optimizer. Accordingly, SOFA provides indirect evidence that procedural maps carry signal, but direct evidence that imaging can be removed is absent (Chung et al., 11 Aug 2025).

Taken together, these treatment-planning papers define a strong version of the No-Image++ question: when a pipeline is already multimodal, does non-image information remain complementary, or can it become substitutive? Their reported evidence supports complementarity. In FUAS-Agents, MRI is treated as a required modality for lesion localization and dose estimation. In SOFA, fusion outperforms either pre-only or ablation-only conditioning in simulation, while no recurrence or optimization result is reported for a truly image-free configuration.

3. No-box watermark removal as a no-image-adjacent paradigm

The Stable Diffusion watermark-removal study is the closest match to No-Image++ in generative-model security, but its operative threat model is no-box rather than no-image. “No-box” is defined as a setting in which the attacker has no access at all to the true watermark decoder: no weights, no architecture, no gradients, no queries, and not even the exact watermark message length or message content. Within that constraint, the paper introduces three attacks: edge prediction-based, box blurring, and fine-tuning-based. The explicit ablations are on blur kernel size, message length, and surrogate decoder depth, all of which strengthen or weaken the attack without granting access to the true decoder (Wu et al., 4 Jul 2025).

For image-space attacks, the most relevant result is box blur plus deblurring. The paper defines the normalized box filter by

$0.822 \pm 0.002$1

and evaluates blurred and deblurred images with bit accuracy, FID, IS, and CLIP embedding similarity. For box blur with kernel size $0.822 \pm 0.002$2, the blurred image yields Acc $0.822 \pm 0.002$3, FID $0.822 \pm 0.002$4, IS $0.822 \pm 0.002$5, and CLIP $0.822 \pm 0.002$6; after deblurring, the same attack yields Acc $0.822 \pm 0.002$7, FID $0.822 \pm 0.002$8, IS $0.822 \pm 0.002$9, and CLIP $0.103 \pm 0.014$0. The abstract summarizes the best attack as reducing watermark detection or extraction accuracy to approximately $0.103 \pm 0.014$1. The paper interprets box blur as the best middle ground among image-only no-box corruptions: resize attacks often destroy quality, while motion and Gaussian blur preserve quality better but leave the watermark more detectable. In that sense, box blur plus deblur is the closest analog to a “stronger no-image-style” attack because it degrades decoder-relevant image structure without requiring the decoder itself (Wu et al., 4 Jul 2025).

For model-side attacks, the paper’s strongest method is fine-tuning the watermarked generator against a surrogate decoder. The attacker optimizes generator parameters so that outputs decode to an adversarial message under the fake decoder rather than to the owner’s watermark. The message-length ablation reports the following attack-side accuracies: $0.103 \pm 0.014$2 at 32 bits, $0.103 \pm 0.014$3 at 36 bits, $0.103 \pm 0.014$4 at 40 bits, $0.103 \pm 0.014$5 at 44 bits, $0.103 \pm 0.014$6 at 48 bits, $0.103 \pm 0.014$7 at 52 bits, $0.103 \pm 0.014$8 at 56 bits, $0.103 \pm 0.014$9 at 60 bits, and $0.020 \pm 0.001$0 at 64 bits. The decoder-depth ablation reports Acc $0.020 \pm 0.001$1 at depth 4, $0.020 \pm 0.001$2 at depth 6, $0.020 \pm 0.001$3 at depth 8, $0.020 \pm 0.001$4 at depth 10, and $0.020 \pm 0.001$5 at depth 12. The paper therefore identifies two main strengthening knobs: shorter adversarial messages, especially 32 bits, and surrogate decoder capacity close to the target, with depth 10 slightly outperforming depth 8 in the reported table. These are not image-removal experiments, but they are directly relevant to No-Image++ as examples of how image-conditioned evidence can be attacked indirectly through decoder-free perturbation and surrogate non-image structure.

4. Causal decomposition of image and non-image safety channels

“No Safe Dose” provides the clearest causal decomposition of image and non-image contributions. The paper constructs text-to-image training corpora that differ only in their fraction of unsafe images and formalizes contamination rate, unsafe-image count, and unsafe output rate as

$0.020 \pm 0.001$6

At full scale, output unsafety increases from $0.020 \pm 0.001$7 at $0.020 \pm 0.001$8 contamination to $0.020 \pm 0.001$9 at $17.61 \pm 0.169$0, $17.61 \pm 0.169$1 at $17.61 \pm 0.169$2, and $17.61 \pm 0.169$3 at $17.61 \pm 0.169$4. The paper characterizes this dose-response as monotonic, sublinear, and saturating, and fits a Hill-type model with $17.61 \pm 0.169$5, $17.61 \pm 0.169$6, $17.61 \pm 0.169$7, $17.61 \pm 0.169$8, and $17.61 \pm 0.169$9 (Friedrich et al., 27 May 2026).

The factorial design then separates proportion from count. At fixed contamination proportion $0.814 \pm 0.004$0, the 7.94M, 1.00M, and 0.10M conditions yield unsafe-output rates of $0.814 \pm 0.004$1, $0.814 \pm 0.004$2, and $0.814 \pm 0.004$3. The paper reports no statistically significant difference between the 7.94M and 1.00M settings ($0.814 \pm 0.004$4), while the 0.10M setting is significantly elevated ($0.814 \pm 0.004$5). At fixed unsafe count 96K, the contrast between 7.94M total images at $0.814 \pm 0.004$6 contamination and 1.00M total images at $0.814 \pm 0.004$7 contamination yields $0.814 \pm 0.004$8 versus $0.814 \pm 0.004$9 unsafe outputs. The conclusion is explicit: above roughly 1M images, proportion rather than absolute unsafe count is the operative variable (Friedrich et al., 27 May 2026).

For No-Image++ interpretation, the decisive result is the zero-contamination floor. Even when unsafe-image contamination is reduced to $0.092 \pm 0.031$0, the model still produces $0.092 \pm 0.031$1 unsafe outputs overall, including $0.092 \pm 0.031$2 under adversarial prompts and $0.092 \pm 0.031$3 under safe prompts. The paper attributes this residual risk partly to the frozen text encoder and tests that hypothesis by replacing T5-Gemma-2B with CLIP ViT-L/14 and SafeCLIP ViT-L/14. At full scale on filtered data, the unsafe-output floor becomes $0.092 \pm 0.031$4 with T5-Gemma-2B, $0.092 \pm 0.031$5 with CLIP ViT-L/14, and $0.092 \pm 0.031$6 with SafeCLIP ViT-L/14. On original data, the corresponding rates are $0.092 \pm 0.031$7, $0.092 \pm 0.031$8, and $0.092 \pm 0.031$9. The contamination effect therefore persists across all three encoders, but encoder choice moves the floor. The combined mitigation—SafeCLIP plus filtered data—reduces unsafe output from $0.018 \pm 0.001$0 to $0.018 \pm 0.001$1, while the paper reports no quality degradation in terms of FID, CLIPScore, and ImageReward (Friedrich et al., 27 May 2026).

This is the most rigorous currently available template for No-Image++ reasoning. Image-data removal lowers the contamination-driven component, but does not eliminate unsafe behavior. Non-image channels, especially the text encoder, remain causally active. In ablation language, image removal changes the slope, whereas encoder replacement changes the baseline floor.

5. Fine-grained image-side ablations and representation effects

AAT shows that image-side ablation need not mean removing the entire image branch. The method intervenes inside the multi-head self-attention modules of the CLIP image encoder by suppressing the contribution of selected heads through post-softmax attention-weight manipulation. It does not modify the text encoder, projection heads, or model parameters. The paper proposes two strategies: AAT-GA, which searches over binary ablation masks with a genetic algorithm, and AAT-BP, which learns head-wise suppression factors by back-propagation. The strongest headline result is an improvement of up to $0.018 \pm 0.001$2 mean-recall points on Chinese-CLIP image-to-text retrieval, and the reported suppression-strength study finds best performance around $0.018 \pm 0.001$3. Appendix statistics show that AAT-GA typically ablates roughly $0.018 \pm 0.001$4 to $0.018 \pm 0.001$5 of image-encoder heads, depending on model family and scale (Lin et al., 1 Jul 2025).

For No-Image++ interpretation, AAT is important because it replaces coarse modality removal with internal structural suppression. The image stream remains active, yet some of its internal routing paths are treated as detrimental. This suggests a broader taxonomy of image ablation: whole-modality removal, token masking, feature removal, and structured micro-ablation are empirically distinct interventions. AAT belongs to the last category.

A different boundary case appears in the self-supervised Siamese study on image classification. Although the paper does not discuss No-Image++ directly, it reports an unusual CIFAR-10 result for ResNet-18: no pretraining yields test accuracy $0.018 \pm 0.001$6, self-supervised pretraining on Gaussian random images yields $0.018 \pm 0.001$7, and self-supervised pretraining on CIFAR-10 images yields $0.018 \pm 0.001$8. This suggests that some downstream benefit may come from the training objective and induced invariances rather than from semantic natural-image content alone, although the paper does not specify the Gaussian-random-image setup in detail and does not provide linear-evaluation or multiple-seed controls (Papastratis, 2021).

6. Limits, misconceptions, and terminological boundaries

A persistent misconception is to treat any nearby experiment as a direct No-Image++ validation. The papers considered here do not support that simplification. FUAS-Agents does not report “w/o MRI,” “w/o clinical data,” “w/o RAG,” “w/o segmentation,” or planning-controller ablations. SOFA reports no procedural-only recurrence model and no image-free optimizer. The Stable Diffusion watermark paper studies no-box attacks rather than the removal of image inputs as such. Even the strongest causal case, “No Safe Dose,” still requires text-encoder ablation to explain the residual unsafe-output floor (Zhao et al., 27 May 2025, Chung et al., 11 Aug 2025, Wu et al., 4 Jul 2025, Friedrich et al., 27 May 2026).

A second misconception concerns the meaning of “ablation” itself. In machine learning, the term usually denotes removal or suppression of components, modalities, or pathways. In other technical literatures, it can denote literal material removal. “Ablation Removal of Transport-Blocking Defects in Surface-Electrode Ion Traps” uses a Q-switched Nd:YAG 532 nm pulsed ablation laser to remove a particulate defect in situ; after ablation, ions were successfully transported in 22,500 round-trip shuttling trials, with reported round-trip shuttling error rate $0.018 \pm 0.001$9. That paper is unrelated to modality removal, but it sharply illustrates the term’s domain dependence (Maddock et al., 7 May 2026).

The most defensible synthesis is therefore narrow. No-Image++ Ablation is not yet a settled benchmark or method name. It is a useful umbrella for experiments that ask whether image-conditioned performance can be decomposed into an image-essential component and a compensable non-image component. The strongest evidence across current papers is asymmetric: images are often indispensable for anatomy-specific localization, structural visualization, and spatially grounded prediction; non-image channels are often indispensable for personalization, strategy generation, safety baselines, and transfer; and explicit substitution of the latter for the former remains only partially demonstrated. This suggests that the term is best used for modality-dependence analysis, not for claiming that image-free operation has already been established across these systems.