Paper deep dive
CANDOR: Chance-Calibrated Discordance in Frozen Foundation Encoders
Soroosh Tayebi Arasteh, Sven Nebelung, Daniel Truhn
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 92%
Last extracted: 7/22/2026, 2:36:53 AM
Summary
The paper introduces CANDOR (Chance-cAlibrated Neighborhood DiscORdance), a metric to evaluate frozen foundation encoders by measuring the geometric separation of findings in feature space. Unlike standard AUROC metrics, CANDOR uses equal-size reference banks to fix the chance level at 0.5, revealing that while encoders are not 'blind' (performance is above chance), they encode fine-grained medical findings weakly, often placing positive cases nearer to opposite-label neighbors. The study analyzes 22 encoders across 20 datasets and 605,443 images, finding that collapse is associated with erasure retention rather than encoder scale or recency.
Entities (8)
Relation Signals (8)
CANDOR → fixeschancelevelat → 0.5
confidence 98% · fixing its chance level at exactly one half.
RAD-DINO → achieves → 84.5 AUROC
confidence 95% · the best chest model reads pneumothorax at 84.5 AUROC
CANDOR → analyzes → 22 encoders
confidence 95% · Across 22 encoders, 20 datasets from 7 domains, and 605,443 images
RAD-DINO → exhibits → 18.4% discordance
confidence 95% · still places 18.4% of those positives nearer an opposite-label film than its own kind
CANDOR → measures → geometric separation
confidence 90% · CANDOR is a discordance measure whose equal-size banks are symmetric under a label swap... measuring the geometry separates it.
DINOv3-L → performs → 4.5% discordance on bird species
confidence 90% · DINOv3-L places 4.5% of bird-species positives beside a discordant twin
DINOv3-L → performs → 42.8% discordance on chest findings
confidence 90% · but 42.8% of chest findings and 49.8% of glaucoma cases, at chance.
Erasure retention → correlateswith → collapse
confidence 85% · Erasure retention is associated with collapse
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Frozen encoders are chosen by how well a lightweight head reads a finding from their features, not whether the geometry separates it. Nearest-neighbor discordance does, but with unequal banks the opposite-label neighbor wins on density, not geometry, so prevalence alone makes an uninformed encoder look blind. We introduce CANDOR, a discordance measure whose equal-size banks are symmetric under a label swap, fixing its chance level at exactly one half. Across 22 encoders, 20 datasets from 7 domains, and 605,443 images, this correction reverses the conclusion. Collapse falls below chance almost everywhere, so no encoder is blind, yet all are weak: the best chest model reads pneumothorax at 84.5 AUROC and still places 18.4% of those positives nearer an opposite-label film than its own kind in the same hospital. The same encoder that resolves bird species at 4.5 leaves chest findings at 42.8 and glaucoma at 49.8, at chance and worse than random weights. Such a case caps the normalized margin of any Lipschitz head, yet some head among eleven is correct on all but 2.8% of cases where one head misses 35.9%: the deficit is selection, not information. Erasure retention is associated with collapse; we detect no association with the objective, scale, recency, or size of the finding. Because the chance level is fixed, CANDOR can be read before any head is trained, flagging which findings a frozen encoder supports poorly.
Tags
Links
- Source: https://arxiv.org/abs/2607.18451v1
- Canonical: https://arxiv.org/abs/2607.18451v1
Trouble viewing inline? Open PDF directly →
Full Text
50,646 characters extracted from source content.
Expand or collapse full text
CANDOR: Chance-Calibrated Discordance in Frozen Foundation Encoders Soroosh Tayebi Arasteh 1,2, Sven Nebelung1,2, Daniel Truhn1,2 Abstract Frozen encoders are chosen by how well a lightweight head reads a finding from their features, not whether the geometry separates it. Nearest-neighbor discordance does, but with unequal banks the opposite-label neighbor wins on density, not geometry, so prevalence alone makes an uninformed encoder look blind. We introduce CANDOR, a discordance measure whose equal-size banks are symmetric under a label swap, fixing its chance level at exactly one half. Across 22 encoders, 20 datasets from 7 domains, and 605,443 images, this correction reverses the conclusion. Collapse falls below chance almost everywhere, so no encoder is blind, yet all are weak: the best chest model reads pneumothorax at 84.5 AUROC and still places 18.4% of those positives nearer an opposite-label film than its own kind in the same hospital. The same encoder that resolves bird species at 4.5 leaves chest findings at 42.8 and glaucoma at 49.8, at chance and worse than random weights. Such a case caps the normalized margin of any Lipschitz head, yet some head among eleven is correct on all but 2.8% of cases where one head misses 35.9%: the deficit is selection, not information. Erasure retention is associated with collapse; we detect no association with the objective, scale, recency, or size of the finding. Because the chance level is fixed, CANDOR can be read before any head is trained, flagging which findings a frozen encoder supports poorly. Introduction Figure 1: A real pneumothorax film (finding outlined) and its five nearest RAD-DINO neighbors, same site and view, all pneumothorax-negative. Consider the strongest encoder in our study, RAD-DINO, a foundation model trained on chest radiographs. Take a frontal film with a pneumothorax. In RAD-DINO’s feature space, among films from the same hospital and projection, this case sits closer to films with no pneumothorax than to those that share its finding (Figure 1). Its neighborhood leans to its opposite, so any head reading those features is held to a small margin on it (Proposition 1), and on such cases heads err. This happens for 18.4 of every hundred pneumothorax positives, and 27.7 across the twelve chest findings we study, in the best of 22 frozen encoders. Foundation encoders are chosen and deployed by one number: how well a light head reads a finding off their frozen features, scored by the area under the receiver operating characteristic curve (AUROC). The regime is not hypothetical: general-purpose self-supervised features, trained on natural images and never on a radiograph, are already used for diagnostic tasks [49, 31]. That number governs the choice but cannot see the failure that governs the risk. So the question is not how well the head reads, but: how much of a fine-grained finding does a frozen encoder put into its geometry, and how would we know? Two avenues exist, and both fall short. The first ranks encoders by task performance on the frozen features [1]. It hides the failure by construction, since a high AUROC is compatible with a large minority of positives sitting nearer their opposite. The second looks at the geometry directly, asking which pairs an encoder cannot tell apart [50, 36]. That is the right instinct, but the discordance measure as built is confounded by prevalence: with reference banks of unequal size the opposite-label neighbor wins on density, not geometry, so an encoder that knows nothing is scored as collapsed and the reported severity tracks how rare a finding is, not how badly it is encoded. The measure manufactures the phenomenon it reports, worst for the rare findings that matter most. We do neither. We fix the estimator, and the correction reverses the conclusion. We introduce Chance-cAlibrated Neighborhood DiscORdance (CANDOR), a framework built on one operator: the share of positives an encoder places nearer the opposite label than their own kind, inside a context matched on acquisition. Its one design choice, equal-size reference banks, makes the label groups exchangeable under relabeling, so the chance level is exactly one half for every encoder and finding, by a one-line symmetry argument with no empirical null. Read honestly, discordant collapse sits below chance almost everywhere. Frozen encoders are not blind; they encode fine-grained findings weakly, and the weakness is measurable, irreducible, and mappable. What the correction leaves behind is sharper than what it replaces. With the chance level fixed, CANDOR becomes a map: DINOv3-L places 4.5% of bird-species positives beside a discordant twin but 42.8% of chest findings and 49.8% of glaucoma cases, at chance. The frozen regime is not broadly weak on fine-grained evidence; it fails on a specific kind, and CANDOR says which. The failure is also structural: a discordant twin caps the normalized margin of any Lipschitz head on that encoder (Proposition 1), since a wider head buys margin and Lipschitz constant in the same ratio. Yet one door stays open: a rule that selects which encoder to trust per image is not a Lipschitz function of any single geometry. The deficit is not information but selection. Our contributions are the following: • A chance-calibrated operator. We prove equal-size reference banks make the measure exchangeable, fixing its chance level at exactly one half, and show the uncorrected form manufactures collapse in proportion to class rarity. A planted-blind encoder lands on the predicted level. • An irreducibility bound, and the one escape it leaves. The Lipschitz bound caps every head’s margin on a discordant twin, but a rule that selects an encoder per image escapes it: on the cases a single head misses 35.9% of, some head among eleven is right on all but 2.8%. • A map of the frozen regime, and what predicts collapse. Across 22 encoders, seven medical and natural domains and 605,443 images, the operator resolves bird species and tumor tiles below 8 but leaves chest findings at a median 42.1 and glaucoma at chance. Collapse is associated with whether the representation moves when the evidence is erased (Spearman 0.8550.855), and with nothing else we tested. Related Work Blind pairs and the geometry of representation failure. Tong et al. [50] identify CLIP-blind pairs, images one encoder maps together and another separates. Because the construction is a difference between two encoders, it cannot say whether either holds the information, and it has no chance level, so its rates are not comparable across tasks. Concurrent work locates where in the forward pass the signal is lost, showing a frozen classification token discards small-lesion signal in chest radiography while patch-local pooling recovers it [36], and a separate line asks the same of the output, occluding the region that localizes a finding and testing whether a vision-language model still asserts it [32]. CANDOR asks it of the representation, before any head is trained: its pairs carry opposite clinical labels inside one acquisition context, its chance level is exact, and it caps the margin any Lipschitz head on one encoder can reach on the cases it flags. Neural collapse [40] concerns the terminal-phase geometry of a trained classifier, whereas we measure a frozen encoder failing to separate the classes at all. Failure detection and selective prediction. Unreliable predictions are commonly flagged by maximum softmax probability [19], energy [30], Mahalanobis distance [29], deep-ensemble disagreement [28], nearest-neighbor distance [48], and selective classification [16]. Each targets an input that is out of distribution or a head that is unsure, and a discordant twin is neither: it lies in distribution and the head is confident. We benchmark a collapse-aware, label-free score against all of them inside the same matched context, and it does not help. We also correct the baseline set, since for a per-target binary head the first three are monotone transforms of one logit: across our 2,532 cells, maximum softmax probability and maximum logit return the same AUROC to machine precision, and energy matches to within 0.005. They are one detector and should be reported as one. Shared representations, and whether failure is shared. Representations across architectures and objectives appear to be converging [21], and their similarity is routinely quantified [9]. Convergence of representations does not entail convergence of failure, and the difference matters: if encoders fail on the same images the deficit lies in the evidence and no ensemble can help. Testing the failure sets against the exact hypergeometric tail, we find they overlap above chance for every encoder pair in every medical domain but for barely half the pairs on natural images, so the sharing is real and partial. Shortcut learning explains a model keying on a confounder [17, 12], whereas matching within an acquisition context removes that route by construction. Neither coordinated failure across a panel [14] nor the gap between what a representation holds and what a deployable rule can extract [3] is unique to vision. The CANDOR Framework Problem formulation Take a chest radiograph positive for pneumothorax and ask a frozen encoder for its five nearest neighbors among films from the same hospital in the same projection. Suppose those neighbors lean, on average, to films with no pneumothorax, nearer than the films that have one. The encoder has placed the case on the wrong side of its own geometry, in a context where nothing but the finding differs. That is what CANDOR measures (Figure 1). An encoder g:→d−1g:X ^d-1 maps an image to the unit sphere, frozen, with features L2L_2 normalized so the inner product is the cosine. A head h:d−1→ℝh:S^d-1 reads out a binary finding F:→0,1F:X→\0,1\ by thresholding, y^(z)=[h(z)≥τ] y(z)=1[h(z)≥τ], and is the only trained component; adapting g is out of scope. A context s partitions X by acquisition covariates, never by the label: site and projection for a radiograph, source dataset elsewhere, coarse superclass for natural images. Matching within a context forbids separating the classes on scanner, view, or species, forcing the encoder onto the finding, and is only as good as the covariates recorded, the one assumption the data cannot check. Inside a context, fix a positive bank Bs+B^+_s and a negative bank Bs−B^-_s of equal size n. For a positive query x, let Nk(x;B)N_k(x;B) be its k nearest neighbors in B, excluding x where it is a member, and write c±(x) c^±(x) =1k∑z∈Nk(x;Bs±)⟨g(x),g(z)⟩, =\; 1k _z∈ N_k(x;\,B^±_s) g(x),\,g(z) , (1) DMg(x) _g(x) =c−(x)−c+(x). =\;c^-(x)-c^+(x). When DMg(x)>0DM_g(x)>0 we say x has a discordant twin: in the same context, its nearest opposite-label neighbors sit closer, on average, than its own kind. The term names this neighborhood condition, not a single matched image. Aggregating over positives gives the discordance operator, the one quantity the framework rests on, D(g;F,s)=Pr[DMg(x)>0|F(x)=1,x∈s].D(g;F,s)= [\,DM_g(x)>0\; |\;F(x)=1,\;x∈ s\, ]. (2) Intuitively, D is the share of positives an encoder sets beside their own opposite with the context held fixed. It needs no head, no training, and no threshold. The chance level is exactly one half Lemma 1 (Exact chance level). Fix a context s and draw (Bs+,Bs−)(B^+_s,B^-_s) as two disjoint blocks of equal size n, uniformly at random from the cases in s, with the query excluded from whichever block contains it. Then for any encoder g whose induced similarities are almost surely free of ties, Pr[DMg(x)>0]=12 [DM_g(x)>0]= 12. Proof. Let σ exchange the two blocks. They have equal size, so σ is an involution preserving the uniform law on such partitions. Applying σ swaps c+(x)c^+(x) with c−(x)c^-(x), self-exclusion included, and therefore sends DMg(x)DM_g(x) to −DMg(x)-DM_g(x). Hence [DMg>0]1[DM_g>0] and [DMg<0]1[DM_g<0] are equal in law, and with no ties they sum to one almost surely. Each has probability one half. ∎ Write H0:g(X)⟂F∣sH_0:\,g(X) F s for the null that the representation carries no information about the finding inside a context. Under H0H_0 equal banks make the two label groups exchangeable, so the expected discordance is exactly 12 12 for every encoder and finding. The value is fixed by construction, not estimated. A finite sample scatters around 12 12, so a rate clearly below it is evidence the encoder carries the finding, and the operator needs no empirical null. Unequal banks manufacture the phenomenon. Let |Bs−|=m>n=|Bs+||B^-_s|=m>n=|B^+_s|. Then σ does not exist and the symmetry is gone. Under exchangeability the banks couple by nesting a size-n sample inside a size-m one, so the top-k similarities to the larger bank dominate those to the smaller pointwise. Hence c−(x)c^-(x) stochastically dominates c+(x)c^+(x) and Pr[DMg>0]>12 [DM_g>0]> 12 for an encoder that knows nothing about F: the nearest negative wins on density, not geometry. The damage is systematic, since the imbalance m/nm/n is the negative-to-positive odds in the context and grows without bound as the finding gets rarer (its prevalence is n/(m+n)n/(m+n)). An uncorrected estimator therefore reports the most collapse for the rarest findings, measuring how uncommon a finding is and calling that a property of the encoder. Collapse caps the margin of any Lipschitz head Proposition 1 (Irreducibility). Let h be L-Lipschitz on d−1S^d-1 with decision rule [h(z)≥τ]1[h(z)≥τ], and say h separates an opposite-label pair (z+,z−)(z^+,z^-) with margin m>0m>0 if h(z+)≥τ+mh(z^+)≥τ+m and h(z−)≤τ−mh(z^-)≤τ-m. Then ∥z+−z−∥≥2mL⟺⟨z+,z−⟩≤ 1−2m2L2. z^+-z^- \;≥\; 2mL z^+,z^- \;≤\;1- 2m^2L^2. Proof. The margin conditions give h(z+)−h(z−)≥2mh(z^+)-h(z^-)≥ 2m, and the Lipschitz property gives h(z+)−h(z−)≤L∥z+−z−∥h(z^+)-h(z^-)≤ L z^+-z^- . Combining yields the first form; on the unit sphere ∥z+−z−∥2=2−2⟨z+,z−⟩ z^+-z^- ^2=2-2 z^+,z^- , which yields the second. ∎ The same inequality underlies certified robustness [52]; we run it from the geometry to the achievable margin. Corollary 1 (The cap is geometric, not architectural). Let x be a positive with DMg(x)>0DM_g(x)>0. A maximum is at least a mean, so some negative z−z^- in the same context has ⟨g(x),z−⟩≥c−(x) g(x),z^- ≥ c^-(x), and every L-Lipschitz head separating x from that z−z^- with margin m obeys mL≤12 2−2c−(x). mL\ ≤\ 12 \,2-2\,c^-(x)\,. (3) Here m and L mean nothing apart: rescaling h by α>0α>0 multiplies both, so the only scale-free quantity a head controls is the normalized margin m/Lm/L, which Eq. 3 caps with a number depending on the encoder alone. A wider, deeper, or larger-norm head buys m and L in the same ratio and moves nothing: lifting the margin needs a different geometry, not a different head. The bound caps the achievable margin, not correctness; two distinct embeddings can still be separated, but only at a margin that shrinks as they close, so the head is driven to where it is fragile. What the bound does not cover is a rule that selects, per image, which encoder to trust: that is not a Lipschitz function of any single geometry, so Proposition 1 is silent on it. That is the only open door, and we measure what lies behind it. Three instruments from the operator The blind set. ℬF(g)=x:F(x)=1,DMg(x)>0B_F(g)=\x:F(x)=1,\ DM_g(x)>0\ collects the positives an encoder confuses. If encoders trained on different data with different objectives share a blind set beyond chance, the failure lies in the evidence, not in one model. We test the overlap of ℬF(g)B_F(g) and ℬF(g′)B_F(g ) against the hypergeometric tail implied by holding both set sizes fixed. Erasure retention. The operator asks whether an encoder separates the finding; a second instrument asks whether it ever looked. Where an expert annotated the evidence region bFb_F of a positive x, write x⊖bFx b_F for the image with that region mean-filled, and set ρg(x)=⟨g(x),g(x⊖bF)⟩. _g(x)= \,g(x),\;g(x b_F)\, . (4) Retention near one means the representation barely moves when the evidence leaves the image, consistent with the finding not being in it. Because ρg _g uses no label and no neighbors, it reads a related but distinct property, the encoder’s sensitivity to the evidence region, through a channel independent of the neighbor geometry. An association between the two is therefore not a restatement of one measurement, though it stays correlational and establishes no mechanism on its own. Neighborhood impurity. Collapse would be actionable if a case could be flagged without its label. Fix a reference bank on the training split inside x’s context, let p^k(x,F) p_k(x,F) be the fraction of x’s k nearest training neighbors that are F positive, and set r(x,F)=1−| 2p^k(x,F)−1|.r(x,F)=1- \,2 p_k(x,F)-1\, . (5) It is high where the neighborhood mixes labels, which is where a discordant twin lives, and costs one forward pass with no label on x. We benchmark it against the standard failure-detection set. Experiments Scope. Table 1 names every dataset and encoder. The study covers 22 frozen encoders on 605,443 images from 20 public datasets, spanning 7 domains and 5 clinical modalities in seven countries. Chest radiography is the deep case: five sites harmonized to twelve findings across eleven acquisition contexts, an external site, and two sets of expert bounding boxes; the headline pools MIMIC-CXR and CheXpert, the two sites carrying every finding, over 22,142 positives. The panel spans 7M to 1.1B parameters, release years 2020 to 2025, and three objectives, self-supervised (SSL), image-text (I-T) and supervised (Sup.), so scale, objective and recency can each be tested. Every encoder is frozen at 224 pixels, so resolution, which governs transfer here [2], is never a confound. Table 1: The data and the encoder panel. Chest radiography is split into eleven site-by-view acquisition contexts. Domain Images Datasets Origin Chest radiography 551,969 MIMIC-CXR [23], CheXpert [22], PadChest [6], VinDr-CXR [37], VinDr-PCXR [42], Open-I [13], RSNA [45], MS-CXR [5] USA, Spain, Vietnam Histopathology 20,000 NCT-CRC [25], PatchCamelyon [53] Germany, Netherlands Bird species 11,788 CUB-200-2011 [55] — Aircraft variants 10,000 FGVC-Aircraft [35] — Fundus 6,030 Harvard-FairVision [34], APTOS [24], Messidor [11], IDRiD [43] USA, India, France Dermatology 4,656 Fitzpatrick17k [18], ISIC 2019 [20], DDI [10] USA, international Mammography 1,000 VinDr-Mammo [38] Vietnam Encoder family Count Models Chest 3 RAD-DINO [41], BiomedCLIP [58], DenseNet-121 [8] Histopathology 7 Phikon-v2 [15], UNI, UNI2 [7], Virchow [54], Virchow2 [60], Prov-GigaPath [56], CONCH [33] Fundus 2 RETFound [59], FLAIR [46] Dermatology 2 MONET [26], PanDerm [57] General purpose 7 DINOv3-S/B/L/H+ [47], DINOv2-L [39], CLIP-L/14 [44], SigLIP-2-L [51] No-skill anchor 1 Randomly initialized ViT-L Implementation. Features are L2L_2 normalized and k=5k=5. Each bank is capped at 4,000 rows and equalized, the step Lemma 1 requires, so a rate on a large site is a subsample estimate, not a census. Heads are a linear readout (primary) and a 256-unit hidden layer, 30 epochs of Adam [27] at 0.001, weight decay 10−410^-4, batch 256, on at most 25,000 train and 20,000 test rows. Rows are drawn once per pool from a stable hash and shared by every encoder, so every cross-encoder comparison is paired on identical images. The operating point is fixed per finding at sensitivity 80 on validation, the deep ensemble has 5 members, and the seed is 42. Reporting. Every collapse rate, retention and AUROC below is a percentage. By Lemma 1 the operator has an exact chance level of 50.0, and each collapse rate should be read against it; task AUROC carries its own 50.0 chance level, while retention is a cosine with no such reference and runs near 100 when the encoder ignores the evidence. Where we give an interval it comes from a bootstrap over 1,000 resamples clustered on the patient, and each family of p-values is corrected for the false discovery rate at 0.05 [4]. Baselines. CANDOR is a measurement framework, and we do not rank models. Two incumbents matter: the finding-level task metric, reported beside the operator to show it cannot see the failure, and, for r, the standard failure-detection set (confidence, meaning maximum softmax probability, maximum logit, and energy; deep-ensemble disagreement; Mahalanobis distance; k-nearest-neighbor distance), each computed inside the same matched context as r. Reproducibility. Every dataset is public and every encoder weight is on Hugging Face; the whole pipeline, with pinned library versions, is released at https://github.com/tayebiarasteh/candor. The corrected operator reorders the panel Table 2 reads the chest panel through three instruments. They agree, the first evidence the operator measures what it claims: RAD-DINO is best on all three, the random anchor worst and nearest chance. That is the ordering a working measure must produce, and the one the uncorrected estimator destroys: without equal banks the rate tracks rarity, not encoding. The level is the result, and Figure 2a places it against ground truth. An encoder we plant blind to the class-defining evidence scores 49.5, its interval from 43.0 to 56.0 containing the 50.0 that Lemma 1 predicts; one we plant to see it scores 0.0. So a blind encoder lands at chance with an interval that covers it. The eleven real encoders fall between, much nearer the blind end. Every one sits below chance, and that none is blind is confirmed by the test below, not by point estimates alone. Even RAD-DINO leaves 27.7 of every hundred positives with a discordant twin from the same hospital and projection, and seven of the ten trained encoders leave more than 40. Corollary 1 caps every head’s margin on these cases. The test is the margin classifier: it clears chance in all 132 encoder-finding cells, the bootstrap interval above 50.0 in every one, so the finding is in the geometry and none is blind. The task metric still cannot see the collapse, which persists at the top of its scale: binned by task AUROC, the mean rate falls only from 45.1 to 27.4, and nine of thirteen cells above 75.0 still leave over a quarter collapsed. The best cell, RAD-DINO on pneumothorax at 84.5, collapses 18.4. A model can look strong on the reported metric and place one positive in five beside its opposite. Table 2: Chest panel on MIMIC-CXR and CheXpert. Bold is best, underline second. Params Standard CANDOR Encoder Obj. (M) AUROC↑ Collapse↓ Retention↓ Chest specialists RAD-DINO SSL 86 75.3 27.7 62.2 DenseNet-121 Sup. 7 70.6 33.8 84.5 BiomedCLIP I-T 86 68.1 37.5 88.0 General purpose DINOv3-S SSL 22 64.9 40.5 94.8 SigLIP-2-L I-T 307 64.3 40.6 95.3 DINOv3-B SSL 86 65.0 42.1 97.2 DINOv3-H+ SSL 632 62.3 42.3 99.1 CLIP-L/14 I-T 307 61.4 42.4 96.2 DINOv3-L SSL 307 64.2 42.8 98.3 DINOv2-L SSL 307 62.8 42.8 98.4 Random ViT-L None 307 56.3 46.3 97.6 Chance level 50.0 50.0 Figure 2: (a) The two planted encoders bracket the eleven chest encoders. (b) Collapse per task, one marker per encoder. Mapping the frozen regime across domains With the chance level fixed, Table 3 and Figure 2b turn CANDOR into a map. DINOv3-L, frozen and unchanged, places 4.5 of every hundred bird-species positives and 5.8 of aircraft variants beside a discordant twin, 42.8 of chest findings, and 49.8 of glaucoma cases, at chance. The same encoder, on one scale against one chance level, separates the tasks it solves from those it does not by a factor of ten. Three regimes separate. Histopathology and natural fine-grained recognition are solved, at 2.7 to 7.7; referable retinopathy and skin malignancy workable, at 9.9 to 21.5; chest findings weak, at 27.7 to 46.3. Glaucoma and mammographic malignancy are not encoded at all, the median encoder scoring 50.0 and 49.9. The anchor sharpens glaucoma: the median encoder is worse than a randomly initialized ViT-L of the same size (50.0 against 46.1), and RETFound reaches only 48.1. The anchor also shows why chance alone is not the whole reading: a random projection reaches 11.7 on histopathology, since coarse image statistics already separate tumor patches. An encoder’s learned contribution is its distance from the anchor. Table 3: Collapse, blind-set overlap, and error detection across the tasks. ΔJ J is Jaccard in excess of the hypergeometric null. Collapse rate ↓ (chance 50.0) Blind-set overlap Detection ↑ Task Modality n+n^+ Best Median Anchor ΔJ J Sig. r Conf. Tumor Histopathology 1,418 2.7 6.6 11.7 ++27.0 100.0 65.9 91.9 Variant (102 classes) Aircraft (non-medical) 8,700 3.5 7.7 44.1 ++10.4 13.5 60.1 84.6 Species (200 classes) Birds (non-medical) 9,837 4.5 5.7 43.6 ++31.2 24.3 41.9 82.6 Referable DR Fundus 1,300 9.9 17.7 24.4 ++24.8 100.0 63.9 65.7 Malignancy Dermatology 1,208 18.7 21.5 37.3 ++24.0 100.0 61.8 69.8 12 findings Chest X-ray 22,142 27.7 42.1 46.3 ++7.9 91.8 52.2 86.8 Glaucoma Fundus 1,016 43.1 50.0 46.1 ++13.1 100.0 55.0 62.9 Malignancy Mammography 500 46.4 49.9 53.6 ++11.7 100.0 52.3 55.6 Irreducible per encoder but recoverable across the panel Proposition 1 says a discordant twin caps the normalized margin of any Lipschitz head on that encoder. On a synthetic sweep of class overlap the achieved joint margin never exceeds the bound on any of 5,000 test pairs, while the bound itself stays between 4.9 and 7.1: the head fails not because the bound loosened but because the geometry closed. Linear error rises from 0.0 to 26.1 and the shallow network from 0.0 to 28.9, so the extra capacity never wins a cell. The constraint is not capacity but geometry. Table 4 puts the cap in clinical terms across two samples we keep apart. On the full positive set, 8,460 of 27,443 positives, 30.8 in every hundred, are blind under a majority of the eleven encoders. The head-error numbers use a different sample: an oracle and every single head can only be compared on cases all eleven encoders scored, so they are restricted to the 263 positives in that intersection. On those 263, a single head misses 35.9 on average, up to 77.8 for one finding, against an operating point at 80.0 sensitivity, while a selector shown the label and picking, per image, whichever head is right misses only 2.8, a gap of 33.1 points. The per-finding subsets run from four to fifty-eight cases, so we read the pooled figures as reliable and the per-finding rows as indicative only. Proposition 1 predicts this asymmetry and nothing else does: the bound binds any Lipschitz function of one encoder’s features, but a rule that selects which encoder to trust per image is not one, and is not bound. The information is in the panel, but reaching it needs the label we are trying to predict. We do not claim ensembling fails, but something narrower: the deficit is selection, not information. However, error on an all-positive set is a miss rate each head’s threshold shifts, which is why we compare against a single head at fixed thresholds. Against the exact hypergeometric null, agreement in medicine is total: all 268 encoder pairs across dermatology, fundus, histopathology, and mammography overlap above chance and remain significant after correction, and on chest 655 of 660 overlap and 606 remain. On natural images the agreement evaporates: only half the pairs clear chance on birds (51.3) and aircraft (50.2), and only 24.3 and 13.5 hold up after correction. Different encoders confuse different birds. They confuse the same chest films. Table 4: Chest consensus blind set. n+n^+ and Blind span all positives; Single and Best (of 11) use the shared Scored cases. Finding n+n^+ Blind Scored Single↓ Best↓ Pleural effusion 4,941 24.9 41 60.1 7.3 Atelectasis 3,942 30.1 36 50.5 16.7 Enl. cardiomed. 657 42.3 9 49.5 0.0 Cardiomegaly 3,855 26.4 36 49.2 8.3 Edema 2,385 27.5 19 45.9 0.0 Lung opacity 5,052 39.3 58 42.5 1.7 Consolidation 1,208 34.1 10 38.2 0.0 Pneumothorax 1,183 25.6 5 29.1 0.0 Fracture 530 30.9 4 22.7 0.0 Pneumonia 2,443 35.7 27 20.2 0.0 Lung lesion 766 31.9 8 13.6 0.0 Pleural other 481 24.5 10 9.1 0.0 Pooled 27,443 30.8 263 35.9 2.8 Erasure retention is associated with collapse Erasure retention asks a different question, with no labels and no neighbors: when the evidence is cut out of the image, how far does the representation move? Figure 3a shows the two questions have almost the same answer. Over the eleven chest encoders, mean retention and the collapse rate correlate at Spearman 0.8550.855 (p=0.0008p=0.0008), and retention against task AUROC at −0.782-0.782 (p=0.0045p=0.0045). RAD-DINO retains 62.2 of its embedding when the finding is occluded, 43.6 on pneumonia alone, while the random anchor retains 97.6 and so do six of the seven general-purpose encoders. An encoder that barely moves when the finding leaves the image is the one that places it beside its opposite. Per case the effect is weaker but consistent: retention correlates positively with the discordant margin in 19 of 22 cells, 15 significant after correction, at a median ρ of 0.109, and within the general-purpose encoders alone the direction holds (ρ=0.679ρ=0.679) without reaching significance. Erasure retention travels to fundus (Figure 3b). Occluding an expert-annotated lesion on IDRiD leaves RETFound retaining 94.0 to 97.4 of its embedding, second only to the random anchor’s 95.4 to 98.2 among ten encoders. On the evidence that defines diabetic retinopathy, a fundus foundation model moves almost as little as a random projection, while DINOv2-L, which never saw a retina, notices the lesion most at 73.6. We detect no association between collapse and any other factor. The pretraining objective shows none, under the only test that isolates it: six encoders from one DINOv3 initialization on the same MIMIC-CXR images, at matched architecture, scale and compute and differing only in objective, give 44.6 [95% CI: 32.5, 65.2] for image-text, 37.8 [30.6, 45.1] for self-supervised contrastive, and 32.9 [24.0, 44.5] for supervised, with intervals overlapping heavily at six cells per arm, so the contrast is underpowered for an effect this small. Parameter count shows none (p=0.117p=0.117, n=10n=10): with objective, data and architecture fixed, DINOv3 across four scales spans only 40.5 to 42.8, a twenty-nine-fold size increase moving collapse 2.3 points, while the 7M supervised DenseNet is second best on both readouts. We detect none with release year (p=0.436p=0.436) or finding size (slope 0.0410.041, p=0.479p=0.479, n=132n=132): pneumothorax, small and subtle, collapses at 35.0, while lung opacity, large and diffuse, collapses at 44.9. Figure 3: (a) The chest encoders ordered by erasure retention, with collapse on the same axis. (b) Retention on IDRiD. A label-free flag does not beat confidence The neighborhood impurity score r of Eq. 5 is the natural label-free candidate: same geometry, no query label, one forward pass. It does not work. Against the head’s own errors it reaches 52.2 AUROC on chest, pooled over six sites and 573 cells, and barely more on its calibration site (54.6 on MIMIC-CXR, 49.1 on VinDr-CXR). Confidence reaches 86.8 on the same cases, a paired gap of −34.6-34.6 points, significant in 545 of 573 cells, 7 favoring r. The deep ensemble reaches 75.9, k-nearest-neighbor distance 67.7, and Mahalanobis 65.9, and r loses to each (gaps −23.6-23.6, −15.5-15.5, −13.7-13.7; significant in 538, 508, 501 cells). The pattern holds across the map (Table 3): r never beats confidence in any of the seven domains, and on birds falls below chance at 41.9. It beats the two geometric baselines on the four non-chest medical modalities by 2.8 to 16.4 points, the honest extent of its value. The failure shows that a score built from the neighborhood inherits the degeneracy it is trying to flag, uninformative exactly where it is needed. Ablation Studies (1) A planted encoder with known invariance calibrates the operator against ground truth. We build 200 images differing only by a small localized token defining the class, and two encoders: one blurred to be invariant to the token, one that sees it. Lemma 1 predicts the invariant encoder lands at chance, and it does, at 49.5 with an interval containing 50.0. The token-sensitive encoder scores 0.0, the no-collapse floor; the Lemma does not predict that value, but the separation confirms the operator reads the invariance it should. (2) A randomly initialized anchor bounds the no-skill end on every modality, and is nearest chance on every chest readout (46.3 collapse, 56.3 task AUROC, 97.6 retention). It is carried in Table 3 because chance alone is not the whole reading: where low-level statistics already separate the classes, the anchor moves off chance too. (3) Box-verified positives remove label noise. On MS-CXR, whose boxes come from the reference pool itself, every encoder stays at or below chance and RAD-DINO reaches 16.7 against its 18.4 on the full positive set. On the RSNA arm the queries come from outside the pool, so the context match falls back across a domain shift and the level inflates for general-purpose encoders. The operator is a within-context measure and must be read as one. (4) Removing the context match tests whether stratification is doing the work. Pooling the banks across sites and views moves the rate by a few points, and the direction is finding-dependent: the matched rate is the lower one in 9 of 22 cells. The check is inconclusive; we report the matched rate as the conservative comparison, forbidding an encoder from winning on scanner or projection. (5) The confidence baseline set collapses to one baseline. Maximum softmax probability, maximum logit, and energy are reported as three independent detectors in the literature. For a per-target binary head they are monotone transforms of one logit, and the data confirm it: across all 573 chest cells the three agree to within 10−610^-6 AUROC, and over the full 2,532 cells the first two agree to machine precision while energy departs by at most 0.005. We report them as one. Conclusion A measure of representation quality that depends on class prevalence is measuring prevalence. Equalizing the two reference banks costs nothing and buys an exact chance level, and once the estimator is calibrated the conclusion inverts: frozen encoders are not blind to fine-grained clinical findings, they encode them weakly. The distinction is not semantic. A blind encoder is hopeless; a weak one is a geometry with a measurable deficit, and we can say where it sits. It sits where the encoder is least sensitive to the evidence: the encoders that barely move when the annotated evidence is cut out place a positive beside its opposite, and no other factor we tested is associated with the failure. Two limits bound the claim. The failure belongs to one encoder, not the panel, and the distance between what eleven heads jointly know and what any label-free rule we tested can extract is this study’s clearest open problem. The analysis also lives entirely in the frozen regime, so it says nothing about what fine-tuning could recover. Closing that gap, by selecting an encoder per image or training one that must notice its own evidence, is where the next gain lies. Until then, a chance-calibrated measure will at least say where the ground is soft. Acknowledgments STA is supported by the Excellence Strategy of the German Federal Government, the Länder, and RWTH ERS (START_526-26). SN was supported by grants from the Deutsche Forschungsgemeinschaft (DFG) (NE 2136/3-1, LI 3893/6-1, TR 1700/7-1). DT was supported by grants from the DFG (NE 2136/3-1, LI 3893/6-1, TR 1700/7-1) and is supported by the German Federal Ministry of Education (TRANSFORM LIVER, 031L0312A; SWAG, 01KD2215B) and the European Union’s Horizon Europe research and innovation programme (ODELIA, Open Consortium for Decentralized Medical Artificial Intelligence, 101057091). References [1] G. Alain and Y. Bengio (2018) Understanding intermediate layers using linear classifier probes. External Links: 1610.01644, Link Cited by: Introduction. [2] S. T. Arasteh, M. Shaigan, C. Kuhl, J. N. Kather, S. Nebelung, and D. Truhn (2026) Resolution scaling governs dinov3 transfer performance in chest radiograph classification. External Links: 2510.07191, Link Cited by: Scope.. [3] S. T. Arasteh (2026) The strength of clinical evidence is recoverable from language model representations but not from their stated grades. External Links: 2606.29034, Link Cited by: Shared representations, and whether failure is shared.. [4] Y. Benjamini and Y. Hochberg (1995) Controlling the false discovery rate: a practical and powerful approach to multiple testing. Journal of the Royal statistical society: series B (Methodological) 57 (1), p. 289–300. Cited by: Reporting.. [5] B. Boecking, N. Usuyama, S. Bannur, D. C. Castro, A. Schwaighofer, S. Hyland, M. Wetscherek, T. Naumann, A. Nori, J. Alvarez-Valle, H. Poon, and O. Oktay (2022) Making the most of text semantics to improve biomedical vision–language processing. In ECCV 2022, p. 1–21. External Links: Document Cited by: Table 1. [6] A. Bustos, A. Pertusa, J. Salinas, and M. de la Iglesia-Vayá (2020) PadChest: a large chest x-ray image dataset with multi-label annotated reports. Medical Image Analysis 66, p. 101797. External Links: ISSN 1361-8415, Document Cited by: Table 1. [7] R. J. Chen, T. Ding, M. Y. Lu, D. F. Williamson, G. Jaume, A. H. Song, B. Chen, A. Zhang, D. Shao, M. Shaban, et al. (2024) Towards a general-purpose foundation model for computational pathology. Nature medicine 30 (3), p. 850–862. Cited by: Table 1. [8] J. P. Cohen, J. D. Viviano, P. Bertin, P. Morrison, P. Torabian, M. Guarrera, M. P. Lungren, A. Chaudhari, R. Brooks, M. Hashir, et al. (2022) TorchXRayVision: a library of chest x-ray datasets and models. In MIDL, p. 231–249. Cited by: Table 1. [9] A. Csiszárik, P. Kőrösi-Szabó, Á. K. Matszangosz, G. Papp, and D. Varga (2021) Similarity and matching of neural network representations. In NeurIPS 2021, External Links: Link Cited by: Shared representations, and whether failure is shared.. [10] R. Daneshjou, K. Vodrahalli, R. A. Novoa, et al. (2022) Disparities in dermatology ai performance on a diverse, curated clinical image set. Science Advances 8 (32), p. eabq6147. External Links: Document Cited by: Table 1. [11] E. Decencière, X. Zhang, G. Cazuguel, et al. (2014) Feedback on a publicly distributed image database: the messidor database. Image Analysis & Stereology, p. 231–234. Cited by: Table 1. [12] A. J. DeGrave et al. (2021) AI for radiographic covid-19 detection selects shortcuts over signal. Nature Machine Intelligence 3 (7), p. 610–619. Cited by: Shared representations, and whether failure is shared.. [13] D. Demner-Fushman, M. D. Kohli, M. B. Rosenman, S. E. Shooshan, L. Rodriguez, S. Antani, G. R. Thoma, and C. J. McDonald (2016) Preparing a collection of radiology examinations for distribution and retrieval. Journal of the American Medical Informatics Association 23 (2), p. 304–310. Cited by: Table 1. [14] M. Farajiamiri, J. Sopa, S. Afza, L. Adams, F. B. Ordonez, T. Nguyen, M. Lotfinia, S. Wind, K. Bressem, S. Nebelung, D. Truhn, and S. T. Arasteh (2026) Agentic retrieval-augmented reasoning reshapes collective reliability under model variability in radiology question answering. External Links: 2603.06271, Link Cited by: Shared representations, and whether failure is shared.. [15] A. Filiot, P. Jacob, A. M. Kain, and C. Saillard (2024) Phikon-v2, a large and public feature extractor for biomarker prediction. External Links: 2409.09173, Link Cited by: Table 1. [16] Y. Geifman and R. El-Yaniv (2017) Selective classification for deep neural networks. In NeurIPS 2017, NIPS’17, Red Hook, NY, USA, p. 4885–4894. Cited by: Failure detection and selective prediction.. [17] R. Geirhos, J. Jacobsen, C. Michaelis, R. Zemel, W. Brendel, M. Bethge, and F. A. Wichmann (2020) Shortcut learning in deep neural networks. Nature Machine Intelligence 2 (11), p. 665–673. Cited by: Shared representations, and whether failure is shared.. [18] M. Groh, C. Harris, L. Soenksen, F. Lau, R. Han, A. Kim, A. Koochek, and O. Badri (2021) Evaluating deep neural networks trained on clinical images in dermatology with the fitzpatrick 17k dataset. In CVPR 2021, p. 1820–1828. Cited by: Table 1. [19] D. Hendrycks and K. Gimpel (2017) A baseline for detecting misclassified and out-of-distribution examples in neural networks. In ICLR, External Links: Link Cited by: Failure detection and selective prediction.. [20] C. Hernández-Pérez, M. Combalia, et al. (2024) Bcn20000: dermoscopic lesions in the wild. Scientific data 11 (1), p. 641. Cited by: Table 1. [21] M. Huh, B. Cheung, T. Wang, and P. Isola (2024) Position: the platonic representation hypothesis. In ICML 2024, ICML’24. Cited by: Shared representations, and whether failure is shared.. [22] J. Irvin, P. Rajpurkar, M. Ko, et al. (2019) Chexpert: a large chest radiograph dataset with uncertainty labels and expert comparison. In Proceedings of the AAAI conference on artificial intelligence, Vol. 33, p. 590–597. Cited by: Table 1. [23] A. E. Johnson, T. J. Pollard, S. J. Berkowitz, N. R. Greenbaum, M. P. Lungren, C. Deng, R. G. Mark, and S. Horng (2019) MIMIC-cxr, a de-identified publicly available database of chest radiographs with free-text reports. Scientific data 6 (1), p. 317. Cited by: Table 1. [24] M. Karthik and S. Dane (2019) APTOS 2019 blindness detection. kaggle. Cited by: Table 1. [25] J. N. Kather, N. Halama, and A. Marx (2018) 100,000 histological images of human colorectal cancer and healthy tissue. . Cited by: Table 1. [26] C. Kim, S. U. Gadgil, A. J. DeGrave, J. A. Omiye, Z. R. Cai, R. Daneshjou, and S. Lee (2024) Transparent medical image ai via an image–text foundation model grounded in medical literature. Nature medicine 30 (4), p. 1154–1165. Cited by: Table 1. [27] D. P. Kingma and J. Ba (2017) Adam: a method for stochastic optimization. External Links: 1412.6980, Link Cited by: Implementation.. [28] B. Lakshminarayanan, A. Pritzel, and C. Blundell (2017) Simple and scalable predictive uncertainty estimation using deep ensembles. In NeurIPS 2017, NIPS’17, Red Hook, NY, USA, p. 6405–6416. Cited by: Failure detection and selective prediction.. [29] K. Lee, K. Lee, H. Lee, and J. Shin (2018) A simple unified framework for detecting out-of-distribution samples and adversarial attacks. In NeurIPS 2018, NIPS’18, p. 7167–7177. Cited by: Failure detection and selective prediction.. [30] W. Liu, X. Wang, J. D. Owens, and Y. Li (2020) Energy-based out-of-distribution detection. In NeurIPS 2020, NIPS ’20, Red Hook, NY, USA. External Links: ISBN 9781713829546 Cited by: Failure detection and selective prediction.. [31] M. Lotfinia, A. Tayebiarasteh, S. Samiei, M. Joodaki, and S. T. Arasteh (2025) Boosting multi-demographic federated learning for chest radiograph analysis using general-purpose self-supervised representations. European Journal of Radiology Artificial Intelligence 3, p. 100028. Cited by: Introduction. [32] M. Lotfinia, S. Ziegelmayer, L. Adams, D. Truhn, A. Maier, and S. T. Arasteh (2026) Vision-language models for chest radiography do not always need the image. External Links: 2606.17710, Link Cited by: Blind pairs and the geometry of representation failure.. [33] M. Y. Lu, B. Chen, D. F. Williamson, et al. (2024) A visual-language foundation model for computational pathology. Nature medicine 30 (3), p. 863–874. Cited by: Table 1. [34] Y. Luo, M. O. Khan, Y. Tian, M. Shi, Z. Dou, T. Elze, Y. Fang, and M. Wang (2024) FairVision: equitable deep learning for eye disease screening via fair identity scaling. External Links: 2310.02492, Link Cited by: Table 1. [35] S. Maji, E. Rahtu, J. Kannala, M. Blaschko, and A. Vedaldi (2013) Fine-grained visual classification of aircraft. External Links: 1306.5151, Link Cited by: Table 1. [36] R. Muthyala, Z. Yin, A. Jilla, F. Li, T. Dapamede, B. Khosravi, M. Chavoshi, J. Gichoya, and S. Purkayastha (2026) Frozen foundation-model embeddings discard small-lesion signal in chest radiography: implications for pre-deployment evaluation. External Links: 2606.11606, Link Cited by: Introduction, Blind pairs and the geometry of representation failure.. [37] H. Q. Nguyen, K. Lam, L. T. Le, et al. (2022) VinDr-cxr: an open dataset of chest x-rays with radiologist’s annotations. Scientific Data 9 (1), p. 429. Cited by: Table 1. [38] H. T. Nguyen, H. Q. Nguyen, H. H. Pham, K. Lam, L. T. Le, M. Dao, and V. Vu (2023) VinDr-mammo: a large-scale benchmark dataset for computer-aided diagnosis in full-field digital mammography. Scientific Data 10 (1), p. 277. Cited by: Table 1. [39] M. Oquab, T. Darcet, T. Moutakanni, et al. (2024) DINOv2: learning robust visual features without supervision. Transactions on Machine Learning Research. External Links: ISSN 2835-8856, Link Cited by: Table 1. [40] V. Papyan, X. Han, and D. L. Donoho (2020) Prevalence of neural collapse during the terminal phase of deep learning training. Proceedings of the National Academy of Sciences 117 (40), p. 24652–24663. Cited by: Blind pairs and the geometry of representation failure.. [41] F. Pérez-García, H. Sharma, S. Bond-Taylor, K. Bouzid, V. Salvatelli, M. Ilse, S. Bannur, D. C. Castro, A. Schwaighofer, M. P. Lungren, et al. (2025) Exploring scalable medical image encoders beyond text supervision. Nature Machine Intelligence 7 (1), p. 119–130. Cited by: Table 1. [42] H. H. Pham, N. H. Nguyen, T. T. Tran, T. N. Nguyen, and H. Q. Nguyen (2023) PediCXR: an open, large-scale chest radiograph dataset for interpretation of common thoracic diseases in children. Scientific data 10 (1), p. 240. Cited by: Table 1. [43] P. Porwal, S. Pachade, R. Kamble, M. Kokare, G. Deshmukh, V. Sahasrabuddhe, and F. Meriaudeau (2018) Indian diabetic retinopathy image dataset (idrid): a database for diabetic retinopathy screening research. Data 3 (3), p. 25. Cited by: Table 1. [44] A. Radford et al. (2021) Learning transferable visual models from natural language supervision. In ICLR, p. 8748–8763. Cited by: Table 1. [45] G. Shih, C. C. Wu, et al. (2019) Augmenting the national institutes of health chest radiograph dataset with expert annotations of possible pneumonia. Radiology: Artificial Intelligence 1 (1), p. e180041. Cited by: Table 1. [46] J. Silva-Rodriguez, H. Chakor, R. Kobbi, J. Dolz, and I. B. Ayed (2025) A foundation language-image model of the retina (flair): encoding expert knowledge in text supervision. Medical Image Analysis 99, p. 103357. Cited by: Table 1. [47] O. Siméoni, H. V. Vo, M. Seitzer, et al. (2025) DINOv3. External Links: 2508.10104, Link Cited by: Table 1. [48] Y. Sun, Y. Ming, X. Zhu, and Y. Li (2022) Out-of-distribution detection with deep nearest neighbors. In ICLR 2022, p. 20827–20840. Cited by: Failure detection and selective prediction.. [49] S. Tayebi Arasteh, L. Misera, J. N. Kather, D. Truhn, and S. Nebelung (2024) Enhancing diagnostic deep learning via self-supervised pretraining on large-scale, unlabeled non-medical images. European Radiology Experimental 8 (1), p. 10. Cited by: Introduction. [50] S. Tong, Z. Liu, Y. Zhai, Y. Ma, Y. LeCun, and S. Xie (2024-06) Eyes Wide Shut? Exploring the Visual Shortcomings of Multimodal LLMs . In CVPR 2024, Vol. , p. 9568–9578. External Links: ISSN , Document Cited by: Introduction, Blind pairs and the geometry of representation failure.. [51] M. Tschannen, A. Gritsenko, X. Wang, M. F. Naeem, I. Alabdulmohsin, N. Parthasarathy, T. Evans, L. Beyer, Y. Xia, B. Mustafa, O. Hénaff, J. Harmsen, A. Steiner, and X. Zhai (2025) SigLIP 2: multilingual vision-language encoders with improved semantic understanding, localization, and dense features. External Links: 2502.14786, Link Cited by: Table 1. [52] Y. Tsuzuku, I. Sato, and M. Sugiyama (2018) Lipschitz-margin training: scalable certification of perturbation invariance for deep neural networks. NeurIPS 2018 31. Cited by: Collapse caps the margin of any Lipschitz head. [53] B. S. Veeling, J. Linmans, J. Winkens, T. Cohen, and M. Welling (2018) Rotation equivariant cnns for digital pathology. In MICCAI 2018, p. 210–218. External Links: Document Cited by: Table 1. [54] E. Vorontsov, A. Bozkurt, A. Casson, G. Shaikovski, M. Zelechowski, K. Severson, E. Zimmermann, J. Hall, N. Tenenholtz, N. Fusi, et al. (2024) A foundation model for clinical-grade computational pathology and rare cancers detection. Nature medicine 30 (10), p. 2924–2935. Cited by: Table 1. [55] C. Wah, S. Branson, P. Welinder, P. Perona, and S. Belongie (2011) The caltech-ucsd birds-200-2011 dataset. Cited by: Table 1. [56] H. Xu, N. Usuyama, et al. (2024) A whole-slide foundation model for digital pathology from real-world data. Nature 630 (8015), p. 181–188. Cited by: Table 1. [57] S. Yan, Z. Yu, C. Primiero, et al. (2025) A multimodal vision foundation model for clinical dermatology. Nature Medicine 31 (8), p. 2691–2702. Cited by: Table 1. [58] S. Zhang, Y. Xu, N. Usuyama, H. Xu, J. Bagga, R. Tinn, S. Preston, R. Rao, M. Wei, N. Valluri, et al. (2025) A multimodal biomedical foundation model trained from fifteen million image–text pairs. Nejm Ai 2 (1), p. AIoa2400640. Cited by: Table 1. [59] Y. Zhou, M. A. Chia, S. K. Wagner, et al. (2023) A foundation model for generalizable disease detection from retinal images. Nature 622 (7981), p. 156–163. Cited by: Table 1. [60] E. Zimmermann, E. Vorontsov, et al. (2024) Virchow2: scaling self-supervised mixed magnification models in pathology. External Links: 2408.00738, Link Cited by: Table 1.