SPOOK Reveals Blind Spots in Vision Encoders: How Sparse Pixel Optimization Breaches Semantic Boundaries

Title

SPOOK Reveals Blind Spots in Vision Encoders: How Sparse Pixel Optimization Breaches Semantic Boundaries

Meta Description

SPOOK uses sparse pixel optimization on blank canvases to probe vision encoders, finding that both OpenCLIP and DINOv3 share an off-manifold semantic mis-mapping failure mode, offering a simple black-box probe for representation geometry diagnosis.

Article Content

The semantic representation capability of vision encoders is often taken for granted, but a study called SPOOK reveals a common weakness in modern vision encoders using an extremely simple method—sparse pixel edits on blank canvases: when inputs are far from the natural image manifold, the correlation between embedding similarity and human-visible semantics becomes blurred or even fails.

Black-Box Probe: "Sculpting" Semantics on a Blank Canvas with Hill Climbing

The core experimental design of SPOOK is very straightforward: starting from a pure white canvas, it uses a pixel-level hill-climbing algorithm to perform sparse pixel edits, modifying only a small number of pixel values, to observe whether these optimized blank canvases can retrieve specified targets in multimodal contrastive encoders and self-supervised vision encoders. The entire process does not rely on model internal gradients or structural information, belonging to a typical black-box setting.

The cleverness of this method lies in stripping away the complexity of natural images. Traditional adversarial attacks or feature visualization often require real images as a starting point, whereas SPOOK directly challenges a more fundamental question: will vision encoders incorrectly map completely non-semantic inputs (blank canvases) to meaningful semantic regions? Experiments are evaluated on two datasets, ImageNet and Flickr30k, covering two types of models: OpenCLIP (language-aligned multimodal encoder) and DINOv3 (self-supervised vision encoder).

Pixel-level hill climbing is a gradient-free black-box optimization method. It starts from an initial input (such as a pure white canvas), iteratively attempts small perturbations to pixel values (increasing, decreasing, or replacing with random values), and retains those modifications that improve the objective function (such as embedding similarity to the target category). Unlike gradient-based adversarial attacks, hill climbing does not require backpropagation or model internal information; it can gradually "sculpt" inputs that trigger target semantics solely through querying the model's input-output feedback. Its sparsity constraint (only a small number of pixels allowed to be modified) greatly reduces the search space and also makes the generated inputs closer to a "non-semantic" blank canvas, thereby more purely probing the encoder's behavior far from the natural image manifold.

Natural image manifold hypothesis posits that real-world images (such as photographs) are not uniformly distributed in the extremely high-dimensional pixel space, but rather concentrated on a low-dimensional subset with specific statistical regularities, called the natural image manifold. Vision encoders are mainly trained on samples from this manifold, so their embedding space can well preserve semantic similarity near the manifold. However, when inputs deviate from the manifold (e.g., sparsely edited blank canvases), the encoder may map them to unreasonable regions in the embedding space, causing embedding similarity to disconnect from human-visible semantics. Understanding this concept is fundamental to analyzing the "off-manifold failure mode" revealed by SPOOK.

Both Types of Encoders Breached: Sparse Edits Suffice to Enter Target Semantic Basins

On OpenCLIP, researchers optimized blank canvases toward class prompts, and the results were surprising: these inputs, modified only through sparse pixel edits, achieved strong top-1 and top-5 performance in target retrieval tasks. That is, the model recognizes these almost blank images as specific categories and can accurately hit targets in retrieval tasks.

On DINOv3, experiments optimized inputs toward class prototypes, and similarly observed high target alignment and near-top prototype rankings. DINOv3, as a self-supervised vision encoder, was not trained with language alignment, yet exhibited similar vulnerability. This indicates that the problem is not specific to multimodal contrastive learning, but a shared characteristic of modern vision encoders in representation geometry.

According to the original data, these sparsely optimized blank canvases can stably enter target semantic basins—regions in the embedding space corresponding to specific semantic concepts—on both types of encoders. This means that encoders have systematic semantic mis-mapping in regions far from the natural image manifold.

OpenCLIP is a family of open-source multimodal contrastive learning models that map images and text to a shared embedding space through contrastive loss, bringing matching image-text pairs closer in the embedding space. Its training relies on large-scale image-text pairs, thus possessing language alignment capability, commonly used for zero-shot classification and retrieval. DINOv3 is a representative of self-supervised vision encoders, learning visual representations on unlabeled images through self-distillation methods (such as the DINO series), without text supervision. The two represent language alignment and pure visual self-supervision paradigms, respectively. SPOOK tests both types of models simultaneously to verify whether the off-manifold failure mode exists across paradigms. Experimental results show that both are breached by sparse blank canvases, indicating that this vulnerability may be a shared characteristic of modern vision encoder representation geometry, rather than a specific defect of a particular training paradigm.

Off-Manifold Failure Mode: A Shared Defect in Representation Geometry

SPOOK defines this phenomenon as the "off-manifold failure mode." Natural images occupy an extremely small subset in pixel space (i.e., the natural image manifold), and vision encoders have mainly seen this subset during training. When inputs deviate from this manifold—such as sparsely edited blank canvases—the encoder's embedding similarity no longer reliably reflects human-visible semantics.

This finding has direct implications for the practical deployment of vision encoders. In scenarios relying on embedding similarity, such as retrieval, classification, and content moderation, inputs far from the natural distribution may be incorrectly assigned high-confidence semantic labels. The sparse blank canvas optimization method proposed by SPOOK provides a simple and effective tool for probing representation geometry: no complex attack process is needed; pixel-level hill climbing alone can expose the encoder's semantic boundaries.

Semantic basin is a figurative concept in embedding space, referring to a region corresponding to a semantic concept (such as "dog" or "car"), where points (embedding vectors) within the region are semantically similar and typically correspond to human-recognizable concepts. In contrastive learning, semantic basins are shaped jointly by embeddings of a large number of natural images and their corresponding texts. SPOOK found that by sparsely editing blank canvases, the encoder can be guided to map inputs into target semantic basins, even if the inputs themselves are semantically meaningless to humans. This indicates that the boundaries of semantic basins may be very blurred in off-manifold regions, or even disconnected from the natural image manifold, thereby causing semantic mis-mapping. This concept helps understand the geometric structure of the encoder's representation space and its vulnerability.

Deep Problems Behind a Simple Probe

From a methodological perspective, the value of SPOOK lies not only in revealing defects but also in its minimalism. The pixel-level hill-climbing algorithm does not require model gradients or internal feature access; it can complete optimization purely relying on input-output feedback. This black-box nature allows the method to be applied to any queryable vision encoder, including closed-source APIs.

The original text states that these results "show that sparse edits on visual non-semantic inputs can enter target semantic basins in language-aligned and self-supervised visual representation spaces," and accordingly positions sparse blank canvas optimization as "a simple probe for representation geometry." For robustness evaluation and safe deployment of vision encoders, this probe provides a low-cost diagnostic tool.

Implications for Encoder Robustness Evaluation

SPOOK's experimental design reminds us that the evaluation of vision encoders should not be limited to accuracy metrics within the natural image distribution. Semantic consistency in off-manifold regions is equally critical, especially in practical systems where adversarial or anomalous inputs may occur. Sparse pixel edits can trigger semantic mis-mapping with extremely low modification amounts, indicating that the semantic basin boundaries of encoders are more blurred than expected.

In the future, black-box probe methods like SPOOK are expected to become standard diagnostic items before the release of vision encoders. For downstream applications relying on embedding similarity, understanding and monitoring off-manifold behavior is an important step to avoid semantic misjudgment.

One-line Summary

SPOOK uses sparse pixel edits on blank canvases to black-box reveal shared defects of off-manifold semantic mis-mapping in vision encoders.

Paragraph Summary

SPOOK proposes a minimalist black-box probe: starting from a pure white canvas, using pixel-level hill-climbing for sparse pixel edits, without model gradients or internal information, blank canvases can retrieve specified target categories in vision encoders such as OpenCLIP and DINOv3. Experiments evaluated on ImageNet and Flickr30k found that both language-aligned and self-supervised encoders are breached, with sparsely edited blank canvases entering target semantic basins with high accuracy. Researchers define this phenomenon as the "off-manifold failure mode," where embedding similarity disconnects from human-visible semantics when inputs are far from the natural image manifold. This method provides a low-cost tool for probing representation geometry and suggests that vision encoder evaluation should focus on semantic consistency in off-manifold regions, not just natural image accuracy.