.jpg)
In recent years, the adoption of Vision-Language Models (VLMs) in enterprise environments has skyrocketed. These systems, capable of interpreting images and generating text, are integrated into custom applications ranging from virtual assistants to document analysis tools. However, recent research has uncovered a new class of vulnerability that directly attacks the internal configuration of these models: stealing the patch size and visual preprocessing parameters through side-channel attacks.
This type of attack, black-box in nature (without internal access to the model), exploits a fundamental property of Vision Transformers (ViTs): the division of the image into patches. By feeding the model a synthetic grid, the attacker can detect periodic drops in accuracy when the grid cell size exactly matches the hidden patch size. It is then that the boundaries between cells are erased during tokenization, generating a measurable pattern. From there, by varying the padding and performing consistency tests, it is possible to determine whether the preprocessing uses dynamic or fixed resolution, and even recover the target resizing resolution.
This attack vector has profound implications for enterprise cybersecurity. If an adversary manages to extract the exact visual tokenizer configuration of a proprietary model (such as those deployed in GPT, Claude, or open variants of Qwen-VL), they can build highly effective transfer attacks, adapting adversarial examples to the specific preprocessing of the victim model. In a context where more and more companies outsource cloud services from AWS and Azure to host their AI models, the risk of internal parameter leakage becomes critical.
For organizations developing AI for businesses, protecting these implementation details is as relevant as safeguarding training data. A leaked patch configuration allows manipulating the model's behavior with high precision, generating everything from imperceptible visual distortions to complete changes in system output. This directly affects cybersecurity services that must ensure the integrity of models deployed in production.
Beyond the attack itself, this finding underscores the need to redesign how machine learning architectures are protected. Traditional obfuscation techniques (such as hiding weights or using intermediate APIs) are insufficient when a side channel based on the model's response exists. The solution involves incorporating security principles from the design phase, including randomizing patch sizes, applying controlled noise in tokenization, and monitoring anomalous query patterns that may be exploring these properties.
At Q2BSTUDIO, as a software and technology development company, we understand that artificial intelligence must be implemented with a holistic view of security. Our teams integrate vulnerability analysis into every phase of the custom software lifecycle, from requirements definition to deployment on AWS and Azure cloud services. We also apply business intelligence services and Power BI to detect unusual usage patterns in deployed models, complemented by AI agents that automate threat response.
Research on patch size stealing reminds us that the transparency of modern models comes at a price: each response reveals information about its architecture. For companies betting on custom applications based on computer vision, understanding and mitigating these side channels becomes an indispensable non-functional requirement. It is not just about protecting the model, but about safeguarding the competitive advantage that a secure implementation of artificial intelligence represents.
