- Attack uses the full 13-tower ensemble again; add never-attacked cross-architecture
judges (C-RADIOv3-H, Qwen3-VL-8B vision) so held-out transfer measures real
cross-architecture generalization rather than CLIP self-similarity.
- Add differentiable loaders for the Qwen3-VL and C-RADIO towers; feature-tower decoy
centroids (targets.py) let feature-only towers be steered and scored.
- Ablation-gate two Tier-1 contrastive giants (SigLIP2-giant, MetaCLIP2-H): rejected
because they reduced frontier and held-out transfer.
- Frontier judges: drop the output-token cap so reasoning models (GPT-5.5) are not
truncated into empty labels; re-scored on 60 images with bootstrap CIs.
- Rewrite the model card for v0.2.1 (n=60 results, natural prose, clean LaTeX) and bump
version metadata.
Co-authored-by: Cursor <cursoragent@cursor.com>
Initial public release: VEIL-PGD v0.1
Klaus Clawd+1: Cursor
c793f45
Imperceptible, JPEG-robust adversarial perturbation trained on an
ensemble of open vision-language-model vision towers, for
training-data protection. PolyForm Noncommercial 1.0.0.
Co-authored-by: Cursor <cursoragent@cursor.com>
