BLADE
Bit-level Fault Analysis via Differentiable Estimation
Semantic steering of a captioner
by flipping weight bits — no input perturbation
PAPER How a Bit Becomes a Story
arXiv:2512.14715 · siege-research/BLADE
Targetblip2-opt-2.7b
Precisionint8 · s=max|w|/127
Surfacedec.xattn[10:12]
Budget0 / 20 bits
Kmax2 per element
Statestandby
01 Input frame idle
CAPTION SUBJECT · drone
sourceoriginal vector render · 320×200
pixelsuntouched · no perturbation
sha-256a91f7c··4d20e8
integrity—
02 Captioning pipeline frozen
ViT-g vision encoderfp16
Q-Former · 32 queriesfp16
decoder cross-attentionint8 ◂ attack surface
OPT-2.7b language headint8
beam decode · B=3greedy argmax J
ILLUSTRATIVE

This drone vignette is a constructed security scenario for intuition about downstream impact. It is not a result reported in the paper. Measured results follow in the evidence panel.

03 Quantized weight memory · gradient saliency idle
xattn[10] · q k v o
xattn[11] · q k v o
|w| magnitude top-K ∂L/∂w FD candidate accepted flip reverted —
04 Bit inspector —
two's-complement int8
▸
q → q′ · Δq
—
Δw = s·Δq · ΔJ
—
05 Generated caption awaiting input
b1
b2
b3
06 Objective maximize J
J(c) = dSBERT(y*, c) − λ·log PPLdistil(c)   λ=0.005
semantic drift d_SBERT0.000
fluency PPL ≤ 300—
objective J—
07 Flip ledger accepted 0
#sitebitq → q′ΔJ
08 Stop condition running
d_SBERT ≥ 0.40
0.062
below threshold
PPL ≤ 300
92
within bound
bits spent0 of 20
outcomesearch in progress
the finding, stated plainly
Change the meaning. Keep the sentence.
the image
unchanged
identical bytes · sha-256 a91f7c··4d20e8
the sentence
still fluent
grammatical, same surface form, 1 token edited
the meaning
drifted
d_SBERT 0.062 → 0.412 · object class swapped
fluent semantic drift — not degenerate corruption
EVIDENCE measured results · Flickr8k · BLIP2-OPT-2.7B · last two decoder cross-attention layers · 20-bit budget GPT-4o-mini semantic drift calculator
Qualitative — what the captions actually look like paper fig. 3
baselinetwo people sitting on a bench
BLADEa man sitting on a bench
count collapses · structure and grammar intact
baseline… leaning against a wall
BLADE… leaning against a ledge
plausible noun, wrong about the scene
baselinea man holding a dog
BLADEa man holding a dog in his lap
inserted relation unsupported by the image
PBSa a of the of the of the of the a of…
schematic  the paper reports long, noisy, repetitive collapse — mean structure preservation 38.3
Each BLADE edit is one small grammatical change that walks the sentence away from what the image shows — a count, a noun, an added relation. PBS changes the caption nearly every time, and destroys it in the process.
Quantitative — at a 20-bit budget higher ASR = better attack
BLADE17.89 ASR
misdirection M18.5
structure SP92.4
RANDOM11.07 ASR
misdirection M14.3
structure SP95.0
PBS9.43 ASR
misdirection M62.2
structure SP · gate 5038.3
misdirects hardest, but lands under the structure gate (SP ≥ 50) — degenerate captions score zero
ATTENTIONBREAKER6.73 ASR
misdirection M9.8
structure SP98.0
preserves the sentence almost perfectly — because it mostly leaves it alone
attack success rate, averaged across the full evaluation
2.4× over PBS 2.37× over AttentionBreaker 1.6× over random flips
caption left unchanged RANDOM53% PBS9% ATTNB76% BLADE27%
SCOPE BLADE is evaluated on image captioners. The general claim is semantic steering through differentiable fault injection — gradients predict which bits move meaning while syntax holds. The drone scene was illustration; these numbers are the result.
how a bit becomes a story
Fluent semantic drift,
not degenerate corruption.
16 bit flips out of a 20-bit budget. No input perturbation, no retraining, no data poisoning.
2.4× the attack success rate of Progressive Bit Search — while the sentence still holds together.
HAIDER · RAHMAN · MOEYKENS · DEVABHAKTUNI · CHAKRABORTY UNIVERSITY OF MAINE · ILLINOIS STATE arXiv:2512.14715 ↗
Paper ↗
0:00 / 1:24
ACT I — ILLUSTRATION