We study six production image-to-image AI systems (gpt-image-1, Gemini 2.5 Flash Image, Flux Kontext, SDXL img2img, SD3 img2img, and Qwen Image Edit) under a content-adaptive sub-JND adversarial perturbation pipeline, scoring all outputs by frozen DINOv2 ViT-B/14 token distances against clean references. Across a 3,588-call corpus spanning COCO photographs, CelebA-HQ portraits, and AI-generated inputs, the six systems partition into two image-invariant behavioral bands on a 2D (patch_mean, ssim_clean) plane: edit-trained models (Flux Kontext, Qwen Edit, Gemini) cluster in a tight band, while T2I-base models adapted at sampling time (SDXL, SD3, gpt-image-1) cluster in a drift band.

翻译：我们针对六类生产级图像到图像AI系统（gpt-image-1、Gemini 2.5 Flash Image、Flux Kontext、SDXL img2img、SD3 img2img及Qwen Image Edit），在内容自适应亚阈值对抗扰动流水线下开展研究。通过冻结DINOv2 ViT-B/14模型计算所有输出与干净参考图像的token距离，对包含COCO照片、CelebA-HQ人像及AI生成图像在内的3588次调用语料进行分析。研究发现，在二维（patch_mean, ssim_clean）平面中，这六类系统呈现两种与图像无关的行为带：基于编辑训练的模型（Flux Kontext、Qwen Edit、Gemini）聚集成紧密行为带，而采样时适配的T2I基模型（SDXL、SD3、gpt-image-1）则聚集成偏移行为带。