{"id":"https://openalex.org/W7164877754","doi":"https://doi.org/10.48550/arxiv.2606.14783","title":"The Vision Encoder as a Privacy Boundary: Visual-Token Side Channels in Encoder-Free Vision-Language Models","display_name":"The Vision Encoder as a Privacy Boundary: Visual-Token Side Channels in Encoder-Free Vision-Language Models","publication_year":2026,"publication_date":"2026-06-10","ids":{"openalex":"https://openalex.org/W7164877754","doi":"https://doi.org/10.48550/arxiv.2606.14783"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2606.14783","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.14783","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2606.14783","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5138754123","display_name":"Chenyu Zhou","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhou, Chenyu","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138627909","display_name":"Qiliang Jiang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Jiang, Qiliang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5054847814","display_name":"Shuning Wu","orcid":"https://orcid.org/0009-0006-7478-7784"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wu, Shuning","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5113903386","display_name":"X J Zhou","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhou, Xu","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.4544000029563904,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.4544000029563904,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12357","display_name":"Digital Media Forensic Detection","score":0.14350000023841858,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10775","display_name":"Generative Adversarial Networks and Image Synthesis","score":0.09589999914169312,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/encoder","display_name":"Encoder","score":0.678600013256073},{"id":"https://openalex.org/keywords/security-token","display_name":"Security token","score":0.6678000092506409},{"id":"https://openalex.org/keywords/cache","display_name":"Cache","score":0.6220999956130981},{"id":"https://openalex.org/keywords/decoding-methods","display_name":"Decoding methods","score":0.5701000094413757},{"id":"https://openalex.org/keywords/noise","display_name":"Noise (video)","score":0.4562999904155731},{"id":"https://openalex.org/keywords/fidelity","display_name":"Fidelity","score":0.421099990606308},{"id":"https://openalex.org/keywords/image","display_name":"Image (mathematics)","score":0.4205000102519989},{"id":"https://openalex.org/keywords/channel","display_name":"Channel (broadcasting)","score":0.4198000133037567},{"id":"https://openalex.org/keywords/pixel","display_name":"Pixel","score":0.39890000224113464}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7590000033378601},{"id":"https://openalex.org/C118505674","wikidata":"https://www.wikidata.org/wiki/Q42586063","display_name":"Encoder","level":2,"score":0.678600013256073},{"id":"https://openalex.org/C48145219","wikidata":"https://www.wikidata.org/wiki/Q1335365","display_name":"Security token","level":2,"score":0.6678000092506409},{"id":"https://openalex.org/C115537543","wikidata":"https://www.wikidata.org/wiki/Q165596","display_name":"Cache","level":2,"score":0.6220999956130981},{"id":"https://openalex.org/C57273362","wikidata":"https://www.wikidata.org/wiki/Q576722","display_name":"Decoding methods","level":2,"score":0.5701000094413757},{"id":"https://openalex.org/C31972630","wikidata":"https://www.wikidata.org/wiki/Q844240","display_name":"Computer vision","level":1,"score":0.5056999921798706},{"id":"https://openalex.org/C99498987","wikidata":"https://www.wikidata.org/wiki/Q2210247","display_name":"Noise (video)","level":3,"score":0.4562999904155731},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4242999851703644},{"id":"https://openalex.org/C2776459999","wikidata":"https://www.wikidata.org/wiki/Q2119376","display_name":"Fidelity","level":2,"score":0.421099990606308},{"id":"https://openalex.org/C115961682","wikidata":"https://www.wikidata.org/wiki/Q860623","display_name":"Image (mathematics)","level":2,"score":0.4205000102519989},{"id":"https://openalex.org/C127162648","wikidata":"https://www.wikidata.org/wiki/Q16858953","display_name":"Channel (broadcasting)","level":2,"score":0.4198000133037567},{"id":"https://openalex.org/C160633673","wikidata":"https://www.wikidata.org/wiki/Q355198","display_name":"Pixel","level":2,"score":0.39890000224113464},{"id":"https://openalex.org/C123201435","wikidata":"https://www.wikidata.org/wiki/Q456632","display_name":"Information privacy","level":2,"score":0.36910000443458557},{"id":"https://openalex.org/C140779682","wikidata":"https://www.wikidata.org/wiki/Q210868","display_name":"Sampling (signal processing)","level":3,"score":0.3646000027656555},{"id":"https://openalex.org/C49289754","wikidata":"https://www.wikidata.org/wiki/Q2267081","display_name":"Side channel attack","level":3,"score":0.3465000092983246},{"id":"https://openalex.org/C62354387","wikidata":"https://www.wikidata.org/wiki/Q875399","display_name":"Boundary (topology)","level":2,"score":0.31459999084472656},{"id":"https://openalex.org/C2779201187","wikidata":"https://www.wikidata.org/wiki/Q2775060","display_name":"Information leakage","level":2,"score":0.305400013923645},{"id":"https://openalex.org/C2776633867","wikidata":"https://www.wikidata.org/wiki/Q186612","display_name":"Timer","level":3,"score":0.3001999855041504},{"id":"https://openalex.org/C2777042071","wikidata":"https://www.wikidata.org/wiki/Q6509304","display_name":"Leakage (economics)","level":2,"score":0.2969000041484833},{"id":"https://openalex.org/C106430172","wikidata":"https://www.wikidata.org/wiki/Q6002272","display_name":"Image restoration","level":4,"score":0.28940001130104065},{"id":"https://openalex.org/C113364801","wikidata":"https://www.wikidata.org/wiki/Q26674","display_name":"High fidelity","level":2,"score":0.2874000072479248},{"id":"https://openalex.org/C55020928","wikidata":"https://www.wikidata.org/wiki/Q3813865","display_name":"Image quality","level":3,"score":0.28630000352859497},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.2840000092983246},{"id":"https://openalex.org/C43521106","wikidata":"https://www.wikidata.org/wiki/Q2165493","display_name":"Pipeline (software)","level":2,"score":0.2775999903678894},{"id":"https://openalex.org/C74172769","wikidata":"https://www.wikidata.org/wiki/Q1446839","display_name":"Routing (electronic design automation)","level":2,"score":0.27309998869895935},{"id":"https://openalex.org/C5339829","wikidata":"https://www.wikidata.org/wiki/Q1425977","display_name":"Machine vision","level":2,"score":0.26579999923706055},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.2565999925136566}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2606.14783","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.14783","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2606.14783","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.14783","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","score":0.7169281244277954,"id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"A":[0],"vision":[1,189],"encoder":[2,190],"compresses":[3],"image":[4,37,77],"pixels":[5],"into":[6,40],"semantic":[7,17],"embeddings,":[8],"implicitly":[9],"acting":[10],"as":[11,173],"a":[12,56,61,191],"privacy":[13,49,193],"boundary":[14,34],"by":[15,35,146],"preserving":[16],"content":[18],"while":[19],"attenuating":[20],"pixel-local":[21],"detail":[22],"required":[23],"for":[24,150],"exact":[25,94],"text":[26],"recovery.":[27],"Encoder-free":[28],"vision-language":[29],"models":[30],"(VLMs)":[31],"remove":[32],"this":[33],"routing":[36],"patches":[38],"directly":[39,135],"the":[41,100,108,138,188],"language-model":[42],"token":[43,117],"stream,":[44],"thereby":[45],"exposing":[46],"an":[47],"architectural":[48],"attack":[50,154],"surface:":[51],"intermediate":[52],"visual":[53],"tokens":[54],"become":[55],"pre-output":[57],"side":[58,139],"channel.":[59],"Under":[60],"token-access":[62],"adversary,":[63],"decoders":[64],"invert":[65],"visual-token":[66,109],"streams":[67],"from":[68],"two":[69],"encoder-free":[70],"VLMs,":[71],"Gemma4":[72,129],"and":[73,79,160,167,176],"Fuyu,":[74],"recovering":[75],"recognizable":[76],"structure":[78],"readable":[80],"held-out":[81],"access":[82],"codes,":[83],"whereas":[84],"matched":[85],"encoder-based":[86],"controls":[87],"localize":[88],"target":[89],"regions":[90],"but":[91],"recover":[92],"no":[93],"strings.":[95],"Within-model":[96],"ablations":[97],"show":[98],"that":[99],"operative":[101],"factor":[102],"is":[103,123],"spatial":[104,183],"sampling":[105,113],"fidelity":[106],"of":[107,187],"grid,":[110],"especially":[111],"character-direction":[112],"density,":[114],"rather":[115],"than":[116],"or":[118],"value":[119],"count.":[120],"The":[121,153],"leakage":[122],"not":[124],"limited":[125],"to":[126,163],"exported":[127],"tokens:":[128],"layer-0":[130],"key-value":[131],"cache":[132],"tensors":[133],"are":[134],"invertible,":[136],"placing":[137],"channel":[140],"within":[141],"KV":[142],"caches":[143],"commonly":[144],"persisted":[145],"production":[147],"serving":[148],"stacks":[149],"decoding":[151],"efficiency.":[152],"survives":[155],"clutter,":[156],"realistic":[157],"document":[158,165],"degradation,":[159],"zero-shot":[161],"transfer":[162],"public":[164],"images,":[166],"it":[168],"resists":[169],"value-level":[170],"defenses":[171],"such":[172],"additive":[174],"noise":[175],"quantization.":[177],"Effective":[178],"mitigation":[179],"must":[180],"therefore":[181],"reduce":[182],"sampling,":[184],"making":[185],"removal":[186],"first-class":[192],"decision":[194],"in":[195],"VLM":[196],"deployment.":[197]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-06-17T00:00:00"}