Vision-language models now allow a student to photograph a circuit diagram or a Karnaugh map and submit the image as a completed assignment. The paper calls this practice trivial plagiarism. Unlike text-based cheating, which requires prompt engineering and some subject familiarity, image-based cheating demands no intellectual engagement whatsoever. A student captures a problem, uploads it, and receives a solution. The authors argue that academic integrity requires defenses targeting the input itself, not just the output, because detecting AI-generated answers from a photograph is effectively impossible.
Evaluating the Semantic-to-Geometric Gap in Adversarial Defenses Against Vision-Language Model-Based Plagiarism comes from Christopher Burger, Christina Trotter, Joseph Carlisle, and Charles Walter. Submitted to arXiv on September 22, 2026, the paper investigates whether fast, heuristic image transformations can degrade VLM performance while keeping documents legible to humans. The central finding is that VLMs possess a fundamental weakness: they can recognize visual objects semantically but struggle with precise geometric and spatial computation. The authors call this the semantic-to-geometric gap, and it turns out to be exploitable as a defensive mechanism.
The Problem: Trivial Plagiarism and the Failure of Detection
Text-based plagiarism via LLMs has been well documented. Students use carefully crafted prompts to generate essays or code. This form of cheating still requires some engagement with the subject matter, and detection tools, despite their unreliability, offer some deterrent. Vision-language models remove even this soft barrier. A student can photograph a graphical problem, from a circuit schematic to a chemical equation, and receive a correct answer with no understanding of the underlying concepts.
Traditional plagiarism detection methods, including AI output detectors, have proven systematically unreliable. Recent studies demonstrate high false positive rates and failure to catch sophisticated AI use. This detection collapse forces a pivot toward input-level defenses. Rather than trying to identify AI-generated output, the goal becomes making the input itself resistant to VLM processing.
The key insight driving this paper is that adversarial perturbations effective against text models are impractical for images. Gradient-based attacks require white-box access to model internals, which is impossible against closed-source platforms like ChatGPT. Even if such access existed, these attacks are computationally prohibitive for high-volume educational content. The authors instead pursue heuristic, visually perceptible perturbations that mimic natural image degradation.
The Semantic-to-Geometric Gap as a Vulnerability
Modern VLMs have what amounts to holistic comprehension of visual environments. They can identify objects, recognize circuit symbols, and trace connections between nodes. Recent benchmarks reveal a critical deficiency: this holistic recognition does not translate into high-fidelity geometric computation. VLMs perform adequately on static spatial tasks or basic topological connections, but their performance drops appreciably on tasks requiring dynamic transformations, mental rotation, or strict coordinate geometry.
This gap between semantic recognition and geometric precision is what the authors target. A VLM can look at a logic gate diagram and correctly identify the gates and their connections, because topology is relatively robust to noise. But a VLM looking at a Karnaugh map must maintain precise 2D grid alignment, and minor visual warping can shift binary values across rigid cell boundaries, breaking the minimization logic entirely.
The paper frames this as exploitable. By applying heuristic perturbations that preserve human legibility while disrupting geometric precision, educators can degrade VLM performance without destroying the educational value of the assessment for human students.
Perturbation Methods and Experimental Design
The authors select three base perturbation types that mimic common image degradation. Warping applies piecewise affine transformations by shifting a grid of control points randomly, simulating physical paper distortion like crinkling or folding. Pixel noise randomly replaces a proportion of pixels with shades of grey, simulating sensor noise or print imperfections. Lines generate random straight strokes, simulating scratches on lenses or creases in paper. These base methods combine into a multi-stage Photocopy simulation that applies greyscale conversion, contrast and brightness adjustments, Gaussian blurring, skew, pixel noise, and JPEG compression artifacts in sequence over multiple iterations.
All perturbations are designed for speed, generating in fractions of a second per image on a desktop computer. The code is publicly available on GitHub. Perturbations can target the question text, the figure, or the full combined image, allowing the authors to isolate which region the model relies on most heavily.
The evaluation is structured in two phases. Phase 1 manually evaluates 25 introductory DC circuit problems containing both text and diagrams, using standard web interfaces to simulate a cheating student's workflow. Phase 2 transitions to a fully automated pipeline using 80 logic gate diagrams for topological routing and 30 Karnaugh maps for coordinate geometry. Each image is evaluated three times, with Pass@Any, Majority Vote, and Strict Consistency as metrics. Model outputs are parsed with regular expressions and checked against ground-truth expressions using SymPy for symbolic equivalence.
Models tested include Gemini 2.5 Pro, Gemini 2.5 Flash, Claude Sonnet 4, and GPT-4 Turbo in Phase 1, and Gemini 2.5 Pro, Gemini 2.5 Flash, GPT-4o-mini, and Claude 4.5 Haiku in Phase 2, selected to represent the threat landscape most accessible to undergraduate students.
Results: Phase 1, Manual Circuit Evaluation
The manual evaluation of 25 circuit problems established a baseline for real-world VLM interaction. From this set, seven representative problems were selected for perturbation testing across four models. Results varied substantially by model and perturbation type.
Claude Sonnet 4 was most susceptible to the Photocopy perturbation alone, with the standard noise-lines-warping suite actually reducing overall success in some cases, suggesting a paradoxical improvement effect. Gemini 2.5 Pro demonstrated the strongest resistance, maintaining correct answers on most problems even under perturbation, though not completely immune. GPT-4 showed intermediate robustness. The most notable finding was the presence of positive perturbations, where a degraded image caused an incorrect baseline output to become correct. However, web-interface stochasticity makes it difficult to confirm whether these are artifacts of the perturbation process or model variability.
The location of perturbation mattered counter-intuitively. Perturbations applied solely to question text were the least effective at forcing incorrect outputs. Perturbations applied to the full image were occasionally less effective than perturbations applied exclusively to the figure region. The authors hypothesize that introducing noise to text may trigger an error-correction state in the VLM's language pathway, causing it to expend greater computational effort aligning text with the image, inadvertently improving performance.
Results: Phase 2, Automated Topological and Geometric Evaluation
Phase 2 provides the most statistically robust evidence. The automated pipeline evaluated 80 logic diagrams and 30 Karnaugh maps under both clean and fully perturbed conditions.
On logic diagrams, which test topological routing through continuous paths between nodes, Gemini 2.5 Pro achieved 92.5 percent strict consistency under clean conditions, degrading to 71.2 percent when fully perturbed. Gemini 2.5 Flash achieved 95.0 percent strict consistency clean, dropping to 67.5 percent when perturbed. Claude 4.5 Haiku and GPT-4o-mini demonstrated limited foundational capability on topological tasks, achieving single-digit strict consistency scores under perturbation.
The contrast with Karnaugh maps is stark. GPT-4o-mini achieved 0.0 percent accuracy across all tiers on both clean and perturbed maps, suggesting a fundamental inability to maintain the rigid 2D grid alignment required for K-map minimization, possibly flattening the visual matrix into a linear sequence. Claude 4.5 Haiku achieved 16.7 percent Majority Vote on clean maps, dropping to 6.7 percent under perturbation. Gemini 2.5 Flash, which reached 80.0 percent Majority Vote and 73.3 percent strict consistency on clean maps, saw Strict Consistency fall to 53.3 percent under perturbation, a 20-point drop demonstrating that visual obfuscation successfully introduces instability into reasoning paths.
Gemini 2.5 Pro achieved 90.0 percent Strict Consistency on clean Karnaugh maps. Curiously, perturbation increased its Majority Vote accuracy to a perfect 100 percent while Strict Consistency simultaneously dropped to 70.0 percent. This paradoxical improvement, where degraded input yields better average performance, confirms that even the most capable models are affected. The perturbation does not simply degrade, it destabilizes.
The Semantic-to-Geometric Gap in Practice
The results confirm a clear capability hierarchy. VLMs are substantially more resilient to noise when tracing continuous topological connections than when interpreting geometric alignments. Logic gate diagrams, where the task is to trace wires between gates, tolerate significant visual degradation. Karnaugh maps, where the task requires precise spatial positioning of values within a rigid grid, collapse under the same perturbations.
This gap is not simply a matter of model size. GPT-4o-mini failed completely on K-maps, while Gemini 2.5 Flash, a smaller and cheaper model, achieved 80 percent accuracy on clean maps. The difference is in the spatial reasoning architecture, not raw capability. Vision transformers appear to process topological structure more robustly than coordinate geometry, a finding consistent with recent literature on VLM spatial reasoning deficiencies.
The Photocopy perturbation proved more effective than the isolated noise-lines-warping suite across all model types, generating 15 successful negative output shifts in Phase 1 compared to only 7 from the standard suite. This was counter-intuitive because the Photocopy perturbation is generally less visually disruptive. The authors hypothesize this may be another instance of paradoxical improvement, where the specific degradation pattern happens to trigger spatial confusion rather than simply adding visual noise.
Limitations and the Limits of Visual Obscurity
The authors acknowledge several important limitations. Phase 2 used a combined full perturbation suite due to computational and token costs, meaning no ablation study isolated individual perturbation effects. Cross-phase comparison is cautioned against because the problem domains differ substantially. The model selection was intentionally constrained to the threat landscape accessible to undergraduates; bleeding-edge frontier models such as the Gemini 3 or GPT-5 families were not evaluated, and higher-capacity models may possess greater resilience.
A more fundamental concern is that current VLMs demonstrate an alarming capacity to solve circuit problems degraded well beyond the threshold of human legibility. Because VLMs can already parse heavily corrupted images better than humans, attempting to secure visual assessments purely through image degradation is likely a futile arms race. As VLM capabilities increase, relying on security by visual obscurity will become infeasible.
There are also practical concerns. Degraded problem sets may create accessibility challenges for students with vision impairments or those relying on assistive technologies. Instructor workload increases when selecting perturbations that degrade VLM performance while remaining accessible to students. The paper explicitly frames visual perturbations as a near-term stopgap, not a long-term solution.
What This Means for Educators and Practitioners
For educators, the paper provides actionable data on VLM limitations. The finding that topology is more robust than geometry suggests that assessment redesign should favor problems requiring spatial reasoning over those requiring precise coordinate computation. If the goal is to create assessments resistant to VLM-based plagiarism, shifting from Karnaugh maps to logic gate problems would be a step in the right direction, though not a complete solution.
The code and datasets are publicly available on GitHub, enabling educators to experiment with the perturbation methods on their own materials. The transformation pipeline is simple, fast, and parameterized, allowing customization for specific use cases.
From a research perspective, the paper establishes that the semantic-to-geometric gap is a real and measurable vulnerability in VLMs. The observation that model complexity does not guarantee geometric robustness, and that perturbation can paradoxically improve performance in some cases, opens directions for further investigation into the spatial reasoning limitations of vision transformers.
The broader implication is that academic integrity in the age of multimodal AI requires a fundamental rethinking of assessment design rather than incremental defenses. Visual perturbations can serve as a temporary deterrent, buying time for the academic community to develop assessment structures inherently resistant to VLM-based plagiarism. But the authors are clear that the long-term solution lies not in obscuring the input, but in redesigning what is being assessed.