Gupta28/judgebench-siglip-judge-v3-hardened

judgecliff SigLIP brand judge v3 (hardened)

Part of judgecliff: which image-QC judges survive optimization pressure? A brand-fidelity judge for rhode (beauty brand). A judge = these SigLIP weights

• calibration.json (rhode train-split centroid + Platt scaling params) in this repo.

Base: google/siglip-so400m-patch14-384 (full SiglipModel, contrastively fine-tuned).

Training: the v1 recipe plus SRPO-hacked images (outputs of the gradient attack on v1) folded in as a third negative class.

Report card (judgecliff Phase 1, 2,622-item test set): real-rhode brand AUC 0.997 (v1 0.99); real rhode scores 0.97 vs competitors 0.06.

The arms-race result: the seen attack is fully defeated (SRPO hack images: v1 scored 0.84 → v3 scores 0.00) while the unseen DPO attack is only dampened (0.47 → 0.28). Hardening against an observed exploit works; novel attacks still get partial traction.

Scoring

Score = Platt-calibrated cosine similarity between the image embedding and the rhode centroid:

import json, numpy as np, torch
from PIL import Image
from transformers import SiglipModel, SiglipImageProcessor
from huggingface_hub import hf_hub_download

repo = "Gupta28/judgebench-siglip-judge-v3-hardened"
model = SiglipModel.from_pretrained(repo)
proc = SiglipImageProcessor.from_pretrained(repo)
params = json.load(open(hf_hub_download(repo, "calibration.json")))
centroid = np.array(params["centroid"])  # L2-normalized rhode train centroid

img = Image.open("image.jpg")
with torch.no_grad():
    emb = model.get_image_features(**proc(images=img, return_tensors="pt"))
v = emb[0].numpy(); v /= np.linalg.norm(v)
cos = float(v @ centroid)
score = 1 / (1 + np.exp(-(params["platt_a"] * cos + params["platt_b"])))  # calibrated on-brand prob

Full evaluation protocol, test-set construction, and findings: https://github.com/amargupta0428/judgecliff.