- Attack uses the full 13-tower ensemble again; add never-attacked cross-architecture
judges (C-RADIOv3-H, Qwen3-VL-8B vision) so held-out transfer measures real
cross-architecture generalization rather than CLIP self-similarity.
- Add differentiable loaders for the Qwen3-VL and C-RADIO towers; feature-tower decoy
centroids (targets.py) let feature-only towers be steered and scored.
- Ablation-gate two Tier-1 contrastive giants (SigLIP2-giant, MetaCLIP2-H): rejected
because they reduced frontier and held-out transfer.
- Frontier judges: drop the output-token cap so reasoning models (GPT-5.5) are not
truncated into empty labels; re-scored on 60 images with bootstrap CIs.
- Rewrite the model card for v0.2.1 (n=60 results, natural prose, clean LaTeX) and bump
version metadata.
Co-authored-by: Cursor <cursoragent@cursor.com>
