Certified Interface Aliases: Exact Collisions in Vision-Language Preprocessing, and When They Exist

Mert Onur Cakiroglu; Elham Buxton; Mehmet Dalkilic; Hasan Kurban

cs.CVSep 26, 2026

Certified Interface Aliases: Exact Collisions in Vision-Language Preprocessing, and When They Exist

Authors: Mert Onur Cakiroglu, Elham Buxton, Mehmet Dalkilic, Hasan Kurban

Organizations: Luddy School of Informatics, Computing, and Engineering, Indiana University Bloomington, Bloomington, IN, USA · Department of Computer Science, University of Illinois Springfield, Springfield, IL, USA · College of Science and Engineering, Hamad Bin Khalifa University, Doha, Qatar

Abstract

Vision-language verifiers and routers must distinguish errors repairable by more reasoning from those caused by visual evidence never reaching the language model. This distinction lacks ground truth because annotators see full-resolution images while models receive preprocessed tensors. We introduce AliasForge to create cases where the relevant fact is provably absent from the interface. Fixed-point resampling makes the pre-rounding resize an exact integer linear map that can send nonzero integer perturbations to zero. Hiding a label-flipping perturbation there produces images with opposite step-correctness labels but bit-identical interface states. Every verifier therefore has the same output law on both members, giving pair-balanced accuracy exactly one half and zero gain from language-side repair. We prove that every fixed-point downscaler has such null vectors and bound their smallest size at the most common ratios, which rules out an 8-bit fit whenever the bound exceeds 255. From the resize configuration alone, a lattice criterion supplies realizable collisions and certifies their absence within the specified construction family. It resolves all 20 screened configurations, 17 as constructible and 3 as non-constructible. We construct certified pairs across three architectures and certify four additional processors, with zero decision-logit gap on all 18 scored pairs and none of the 18 controls. The pairs also screen routers that waste computation on re-attention or further reasoning. On natural items, per-item routing headroom exists, but no tested interface-only router improves over stopping. Our fiber ceiling bounds the headroom recoverable from the interface. Code: https://github.com/KurbanIntelligenceLab/aliasforge.

Figures & tables

Figure 1: Certified interface aliases and routing. (1) Images with different correct answers reach the model as bit-identical tensors because the deployed resize $K$ maps their difference $\mathbf{D}$ to zero (Theorem 3 ). (2) The criterion predicts which deployed pipelines admit certified pairs, while controls outside the resize null space and identity-resize controls do not certify (Proposition 10 ). (3) No tested action improves on stopping on natural items despite per-item oracle headroom; error bars are $95\%$ intervals clustered by record, the source problem.

Target or control	Resize configuration	Certified pairs		Member logit gap
Qwen2.5-VL-7B	$2\times$ downscale	$15$	of $15$	zero on all $8$ scored
LLaVA-1.5-7B	fixed $2\times$ resize	$10$	of $10$	zero on all $10$
VisualPRM-8B	$3{\times}3$ tiles and thumbnail	$20$	of $20$	not available
All negative controls	four control designs	$0$	of $147$	nonzero when available

Table 1: Instrument validation. Targets are Qwen2.5-VL-7B ( Bai et al., 2025 ) , LLaVA-1.5-7B ( Liu et al., 2024 ) and VisualPRM-8B ( Wang et al., 2025 ) . Predictions matched the observed outcomes in all

192

attempts, and all

18

measured decision-logit gaps between members were exactly zero.

Figure 2: A certified pair on a MathVision image. (1) Member A contains three marks and member B contains two, giving different correct counts. (2) The third mark is magnified at twice its original contrast. (3) After $2\times$ resizing, the tensors are bit-identical.

Fixed policies
	Certified pairs	Natural stream
	Dominated	Gain over stop $\uparrow$			Order
Routing method	action rate $\downarrow$	with 95% interval		Regret $\downarrow$	accuracy $\uparrow$
Always stop	0.000	$0.000$	reference	$0.105$	$0.271$
Always re-attend	1.000	$+0.002$	$[-0.008,\,+0.010]$	$0.103$	$0.281$
Always reason	1.000	$0.000$	$[-0.007,\,+0.008]$	$0.104$	$0.188$

Table 2: Certified-pair screen and natural-stream routing. The screen reports dominated-action rates on

80

certified Qwen2.5-VL-7B pairs (Corollary 5(a) ). Natural results use

1280

VisualProcessBench items from

1018

records with a frozen Qwen2.5-VL-7B verifier. Gain is relative to stopping at

\lambda=0

, with

95\%

intervals clustered by record. † Best of six, Holm-adjusted

p=0.11

Appendix figures & tables11 assets

Supplementary material from the paper’s appendix.

Appendix

	$2\times$			$1.5\times$			$4/3\times$
Filter	$\beta(K)$	$\lVert w\rVert_{\infty}$	$\beta(K)/M$	$\beta(K)$	$\lVert w\rVert_{\infty}$	$\beta(K)/M$	$\beta(K)$	$\lVert w\rVert_{\infty}$	$\beta(K)/M$
Bicubic	$\mathbf{3}$	$\mathbf{3}$	$<1$	$2.8{\times}10^{10}$	$6.7{\times}10^{12}$	$5.7{\times}10^{3}$	$1.2{\times}10^{16}$	$7.1{\times}10^{18}$	$2.4{\times}10^{9}$
Bilinear	$\mathbf{3}$	$\mathbf{3}$	$<1$	$5.2{\times}10^{12}$	$5.2{\times}10^{12}$	$1.2{\times}10^{6}$	$2.3{\times}10^{12}$	$2.3{\times}10^{12}$	$5.5{\times}10^{5}$
Box	$\mathbf{1}$	$\mathbf{1}$	$<1$	gate failed			$\mathbf{1}$	$\mathbf{1}$	$<1$
Lanczos	$6.3{\times}10^{4}$	$1.9{\times}10^{6}$	$<1$	$5.6{\times}10^{9}$	$6.8{\times}10^{12}$	$964$	$1.2{\times}10^{15}$	$2.3{\times}10^{19}$	$2.1{\times}10^{8}$

Appendix

Table A1 : Window-free bounds in the principal case.

\beta(K)

bounds every interior integer kernel vector from below at any support width,

\lVert w\rVert_{\infty}

is the sup-norm of the generator, and

\beta(K)/M

bounds interior image differences of any rank, where

M

is the largest absolute row sum of

K

. Orange entries exceed

255

and exclude a realizable perturbation. Blue entries are attained by the generator. The box operator at

1.5\times

fails the bit-exact reconstruction check of Table A3 .

Processor field	Data type	Qwen2.5-VL-7B	LLaVA-1.5-7B	Image dependence
		Shape
pixel_values	float32	$(1024,\,1176)$	$(1,\,3,\,336,\,336)$	content
image_grid_thw	int64	$(1,\,3)$	not emitted	geometry
input_ids	int64	$(1,\,321)$	$(1,\,617)$	none
attention_mask	int64	$(1,\,321)$	$(1,\,617)$	none
mm_token_type_ids	int64	$(1,\,321)$	not emitted	none

Appendix

Table A2 : Fields included in the certificate digest. Shapes are shown for the audited scored prompt. Image dependence indicates whether a field varies with pixel content, only with image geometry, or not with the image.

	Resize ratio
Filter	$1.5\times$	$2\times$	$3\times$	$3.01\times$	$4\times$	$6\times$	$8\times$
Bicubic	$\geq 1.6{\times}10^{12}$	$\mathbf{3}$	$\mathbf{13}$	$\geq 735$	$\mathbf{5}$	$\mathbf{2}$	$\mathbf{2}$
Bilinear	$\geq 1.2{\times}10^{12}$	$\mathbf{3}$	$\mathbf{2}$	$\mathbf{1}$	$\mathbf{1}$	$\mathbf{1}$	$\mathbf{1}$
Box	gate failed	$\mathbf{1}$	$\mathbf{1}$	$\mathbf{1}$	$\mathbf{1}$	$\mathbf{1}$	$\mathbf{1}$
Lanczos	$\geq 1.8{\times}10^{12}$	$\geq 4.8{\times}10^{5}$	$\geq 1.6{\times}10^{3}$	$\geq 2.0{\times}10^{3}$	unresolved	$\mathbf{35}$	$\mathbf{16}$

Appendix

Table A3 : Constructibility by resampling filter and resize ratio. Bold numbers give the sup-norm of a constructed integer kernel vector. Entries of the form

\geq B

give certified lower bounds. Because each such bound exceeds

255

, the rank-one construction is excluded. At

1.5\times

and for Lanczos at

2\times

, Theorem 7 makes the exclusion independent of the window (Table A1 ). Unresolved means that the bound falls below

255

but no realizable vector was found. Gate failed means that the reconstructed operator did not reproduce the deployed library bit for bit.

Ratio	Bound	Witness	Configurations model and output side in pixels
Constructible integer ratios, $17$ configurations
$2\times$	$0.71$	$\phantom{1}3$	CLIP 224 $\cdot$ PaliGemma 224 $\cdot$ Qwen2.5-VL 224 $\cdot$ LLaVA-1.5 336 $\cdot$ Phi-3.5-V 336 † $\cdot$ SigLIP 384 $\cdot$ SmolVLM 384 † $\cdot$ InternVL thumbnail 448 $\cdot$ Qwen2.5-VL 448 $\cdot$ Pixtral 512 $\cdot$ Cambrian 576
$3\times$	$4.17$	$13$	BLIP-2 224 $\cdot$ SigLIP 384 $\cdot$ InternVL tile 448
$4\times$	$1.25$	$\phantom{1}5$	CLIP 224 $\cdot$ LLaVA-1.5 336
$6\times$	$0.59$	$\phantom{1}2$	Molmo 336
Excluded non-integer ratios, $3$ configurations

Appendix

Table A4 : Screen of

20

declared bicubic-resize configurations. The bound column gives the lower bound of Proposition 10 on

\lVert v\rVert_{\infty}

, and a value above

255

excludes the construction, and at

1.5\times

the exclusion holds for every interior support (Theorem 7 ). For constructible ratios, the witness column gives the smallest

\lVert v\rVert_{\infty}

of a kernel vector found. A dagger marks a configuration evaluated at a declared geometry that differs from the processor’s default, so its verdict does not apply to the default pipeline.

	Observed resize
Pipeline	Input side	Output side	Ratio	Result
Eligible fixed-point resizes
SigLIP-B/16-384	$768$	$384$	$2\times$	$6/6$ certified
SigLIP-SO400M/14-384	$768$	$384$	$2\times$	$6/6$ certified
BLIP-2 OPT-2.7B	$448$	$224$	$2\times$	$6/6$ certified
Pixtral-12B	$2048$	$1024$	$2\times$	$6/6$ certified

Appendix

Table A5 : Breadth across deployed processors. All six attempts certified on each pipeline with an eligible fixed-point resize. The remaining pipelines fall outside the current procedure’s scope.

Action	Mechanism	Changes $\mathbf{z}$	Cost accounting
Policy actions
stop	accept the current verdict	no	$0$
att re-attend	instruct the model to re-examine the region named by $Q$	no	prompt + one critique
rea reason	run and aggregate $t$ additional critique passes	no	$t\times$ critique
enc re-encode	recompute $\mathbf{z}$ from a higher-resolution center crop	yes	re-prefill + one critique
Diagnostic controls

Appendix

Table A6 : Action set and diagnostic controls. The policy actions use the path-matched costs shown below. The placebo critique is the path-matched baseline, the ten-crop oracle bounds crop-based re-encoding, and the same-interface re-encode isolates re-encoding overhead.

Simulation setting		Number of eight-item templates
$V$	$\rho$	$10$	$20$	$40$	$80$	$160$	$320$
$0.01$	$0.5$	$0.03$	$0.07$	$0.12$	$0.27$	$0.45$	$0.71$
$0.02$	$0.5$	$0.08$	$0.16$	$0.35$	$0.68$	$0.94$	$0.99$
$0.03$	$0.5$	$0.13$	$0.33$	$0.68$	$\mathbf{0.93}$	$1.00$	$1.00$
$0.03$	$0.9$	$0.03$	$0.15$	$0.52$	$0.86$	$\mathbf{0.99}$	$1.00$
$0.05$	$0.5$	$0.34$	$0.77$	$0.96$	$1.00$	$1.00$	$1.00$

Appendix

Table A7 : Power of the routing-value gate. Each cell gives the simulated probability that the

95\%

lower bound on the split-sample routing value

V

exceeds zero. The columns give the number of eight-item templates, and

\rho

controls dependence among items from the same template. Bold values mark the smallest template count achieving at least

0.90

power for the pre-registered target

V=0.03

Symbol	Quantity	Value	Interpretation
$\hat{V}_{\text{plug}}$	plug-in per-item maximum	$0.101$	inflated by maximizing noisy gains
$\hat{V}$	split-sample routing value	$0.056$	estimated headroom after bias control
$\hat{V}_{\text{fit}}$	best of eight fitted interface routers	$\approx 0$	no fitted router recovers the headroom
$\hat{V}_{\textsc{ias}}$	ias-Route as realized	$0$	matches the best fixed action

Appendix

Table A8 : From estimated routing headroom to realized gain on the natural stream. Every entry is an estimate.

Vision-tower outputs, a signal of $\mathbf{z}$
		Natural stream			Certified pairs
Features	Learner	Gain over stop, $95\%$ CI	Order acc.	Action rate	Any action	Dominated
projected tokens	ridge	$-0.003$ $[-0.011,\,+0.006]$	$0.244$	$0.77$	$0/80$	$0/80$
projected tokens	boosting	$-0.003$ $[-0.012,\,+0.007]$	$0.254$	$0.78$	$71/80$	$37/80$
patch features	ridge	$+0.002$ $[-0.006,\,+0.010]$	$0.245$	$0.77$	$80/80$	$80/80$
patch features	boosting	$+0.003$ $[-0.006,\,+0.012]$	$0.259$	$0.78$	$70/80$	$5/80$

Appendix

Table A9 : Oracle-supervised routers by signal. The vision-tower routers read

\mathbf{z}

alone, and the hidden-state routers read

(\mathbf{z},Q,R)

. Gain intervals are clustered by record, and Action rate is the fraction of natural items sent to a non-stop action. On certified pairs, Any action counts non-stop choices, while Dominated counts choices of re-attention or further reasoning.

Source	Best fixed	$\hat{V}$	ias-Route specified	Median ias-Route / random	Learned router
MathVerse ( $454$ )	att	$+0.067$ $[+0.051,+0.078]$	$+0.002$ $[-0.012,+0.015]$	$+0.020$ / $+0.023$	$-0.004$ $[-0.018,+0.011]$
MathVision ( $331$ )	stop	$+0.031$ $[+0.013,+0.042]$	$-0.012$ $[-0.028,+0.003]$	$+0.000$ / $+0.002$	$-0.007$ $[-0.021,+0.006]$
DynaMath ( $260$ )	stop	$+0.065$ $[+0.044,+0.079]$	$-0.004$ $[-0.022,+0.017]$	$+0.019$ / $+0.018$	$+0.009$ $[-0.013,+0.031]$
WeMath ( $126$ )	rea	$+0.044$ $[+0.018,+0.055]$	$+0.001$ $[-0.001,+0.005]$	$+0.019$ / $+0.025$	$+0.006$ $[-0.012,+0.024]$
MMMU ( $109$ )	rea	$+0.034$ $[+0.011,+0.055]$	$-0.001$ $[-0.003,+0.001]$	$-0.006$ / $-0.009$	$-0.004$ $[-0.022,+0.012]$
All five ( $1280$ )	rea	$+0.056$ $[+0.047,+0.062]$	$+0.000$ $[+0.000,+0.001]$	$+0.016$ / $+0.018$	$+0.002$ $[-0.005,+0.010]$

Appendix

Table A10 : Results by source benchmark. Policies are fit once on the full stream and evaluated within each source. Gains are relative to the source-specific best fixed action. Here

\hat{V}

is the split-sample routing value, and intervals are

95\%

confidence intervals clustered by record. The learned router is boosting on patch features. Median-rule entries report ias and random-score gains, respectively.

Inert across three critiques
		Initial stop verdict
Quantity	All	Wrong	Correct
Measurements, $n$	$2560$	$954$	$1606$
Rate	$0.452$ $[0.433,\,0.472]$	$0.496$ $[0.464,\,0.527]$	$0.426$ $[0.403,\,0.451]$
Correct after action
Placebo	$0.525$ $[0.506,\,0.544]$	$0.126$ $[0.106,\,0.148]$	$0.762$ $[0.741,\,0.782]$

Appendix

Table A11 : Natural verdicts under each action. Columns split the

2560

measurements by the initial stopping verdict. Proportions use Wilson intervals, and gain intervals are bootstrapped by record.

VLM Evaluation

Vision-language model evaluation measures multimodal systems’ perception, reasoning, grounding, robustness, and reliability across controlled and real-world tasks.

See all 999 papers

Oct 18, 2026

Finite Interaction Lens: Structured Precision Sharing for Vision-Language Models

Identifying which visual interventions interact in a vision-language model requires comparing their joint and separate effects. The resulting four-output difference can be small enough for rounding error to obscure it. We introduce the Finite Interaction Lens (FIL), a mixed-precision method for evaluating finite intervention families. At each selected linear projection, FIL decomposes each candidate's input into a native state, two single-intervention components, and a full-dimensional mixed residual. It projects the single-intervention components at higher precision and reuses the same numerical contributions in the joint candidates, while retaining every mixed residual and nonlinear trajectory. We derive a local cancellation identity and a conditional bound on error propagation through a smooth nonlinearity. In one MLP of Qwen3-VL-4B-Instruct, FIL reduces final interaction MSE by 94.4% on 16 synthetic families and by 99.85% and 99.35% in two separate four-image COCO studies, relative to a control that has the same nominal BF16-product budget and higher-precision single interventions but projects each joint candidate independently. One image accounts for most of the absolute gain in each COCO study. Higher-accuracy multi-product BF16 arithmetic on all candidates gives lower aggregate error at similar total query times. Single-product BF16 already recovers the reference choices in both candidate-selection tasks we tested. On these development inputs, FIL improves interaction fidelity at a fixed nominal precision budget. Its practical value depends on a task that needs the extra fidelity.

Nozomu Fujisawa

Keio University

Large Vision-Language Models

Ask PDF

May 25, 2026

Capability and Robustness Cannot Both Be Free: An Information-Theoretic Bound for Vision-Language-Action Models

Vision-Language-Action (VLA) models reach high success rates on clean inputs but collapse under small adversarial perturbations: a

16/255

PGD attack drops OpenVLA-7B's LIBERO success from

95\%

to under

5\%

. Whether this trade-off has a theoretical floor was open. We prove that it does. For any VLA policy, capability

I(\Astar;\Api)

and robustness

I(\Api;\Atildepi)-I(\Api;δ)

sum to at most

H(\Astar)+I(X;\Xtilde)

, the task entropy plus adversarial channel capacity. The proof reduces to two applications of the Data Processing Inequality. The pixel-level bound is loose by

\sim 10^3

nats and serves as a ceiling guarantee; an encoder-specific corollary tightens it by over an order of magnitude, into a regime where realized capability already consumes

5

9\%

of the budget. We validate Theorem~\ref{thm:main} with zero violations across

308

cells:

252

closed-form Gaussian-VLA,

48

OpenVLA-7B

+

LIBERO

+

PGD (

4

suites

\times

4

\eps

\times

3

seeds),

4

Square-Attack, and

4

multi-step (

T{=}10

). A complementary measurability inequality

\Rob_{\text{disc}} \le \Cap_{\text{disc}}

further holds across

144

cross-architecture cells spanning OpenVLA, OpenVLA-OFT (continuous-

L_1

), and SmolVLA (flow-matching). The same construction yields three label-free diagnostics: a pre-flight encoder ceiling, a defense-forensics probe that localizes input-side vs.\ language-model intervention, and a head-agnostic robustness ratio comparable across discrete-token,

L_1

-regression, and flow-matching policies. Together these provide the cross-setting axis defense and architecture comparisons currently lack.

Jianwei Tai

School of Internet, Anhui University

Neural Network Robustness Adversarial Robustness Adversarial Attacks on VLA Models Vision-Language-Action Models Noise Robustness Robustness of VLA Models

Ask PDF

Sep 1, 2026

Encoded but Disconnected: Decomposing Vision-Language Model Failures under a Patching Null

Across three vision-language model architectures (LLaVA-1.5-7B, Qwen2.5-VL-7B, InternVL3-8B), we report a universal negative finding for mid-layer interpretability. On POPE -- the benchmark common to all three -- the mid layers encode the ground-truth answer in 68-91% of errors, yet this signal is not causally active for the final prediction: residual-stream patching yields 0% non-trivial flip at the layer level on all three architectures, and on two of three at the per-head level (Qwen: 0/12,600 patched forwards). The lone exception, InternVL3 layer-20 head-2, is a non-vocab, self-attending head whose effect is localized to that specific head (p < 1e-4). Despite the null, the errors separate operationally into three failure modes -- Perception Failure, Encoded-but-Disconnected, Prior-Override -- learnable above 60% on all three architectures, and the architecture's prior direction predicts which of two interventions elicits a category-specific response. We report these mitigation effects under oracle labels as evidence the categories are mechanistically real, not as a deployable method.

Genpei Zhang

University of Wisconsin–Madison

VLM Interpretability Mechanistic Interpretability Activation Patching Object Hallucination in VLMs

Ask PDF

Abstract

VLM Evaluation

Explore similar work

Finite Interaction Lens: Structured Precision Sharing for Vision-Language Models

Capability and Robustness Cannot Both Be Free: An Information-Theoretic Bound for Vision-Language-Action Models

Encoded but Disconnected: Decomposing Vision-Language Model Failures under a Patching Null