PaperlayerView exact revision on arXiv

Source-linked AI summary

Hydra: An Agentic Reasoning Approach for Enhancing Adversarial Robustness and Mitigating Hallucinations in Vision-Language Models

Chung-En, Yu, Hsuan-Chih, Chen, Brian Jalaian, Nathaniel D. Bastian

arXiv:2504.14395v1cs.CVcs.AIcs.MA

TL;DR

VLM research has often treated adversarial robustness and hallucination mitigation separately, despite both affecting factual accuracy. Hydra uses an iterative agentic framework with cross-model verification to refine outputs, and the paper reports improved robustness against both threats, including without explicit adversarial defenses.

  • Problem

    Prior work has mainly addressed adversarial robustness or hallucination mitigation in isolation, while VLMs face both joint-embedding attacks and intrinsic hallucinations.

    Source: §1 · p. 2

  • Method

    Hydra is a training-free agentic framework that iteratively retrieves and critiques visual information from multiple models to refine plug-in LVLM outputs.

    Source: §1 · p. 2, §3.1 · pp. 4–5

  • Results

    The paper reports that Hydra surpasses existing dehallucination methods while maintaining adversarial resilience, including without explicit adversarial defenses.

    Source: §1 · p. 2, §5 · p. 10

  • Takeaways & Limitations

    The authors present Hydra as a modular, training-free approach that unifies robustness to adversarial perturbations and intrinsic model errors.

    Source: §1 · p. 2, §5 · p. 10

    Iterative agentic reasoning increases inference time and may hinder real-time applications.

    Source: §5 · p. 10

Abstract

from arXiv · show

To develop trustworthy Vision-Language Models (VLMs), it is essential to address adversarial robustness and hallucination mitigation, both of which impact factual accuracy in high-stakes applications such as defense and healthcare. Existing methods primarily focus on either adversarial defense or hallucination post-hoc correction, leaving a gap in unified robustness strategies. We introduce \textbf{Hydra}, an adaptive agentic framework that enhances plug-in VLMs through iterative reasoning, structured critiques, and cross-model verification, improving both resilience to adversarial perturbations and intrinsic model errors. Hydra employs an Action-Critique Loop, where it retrieves and critiques visual information, leveraging Chain-of-Thought (CoT) and In-Context Learning (ICL) techniques to refine outputs dynamically. Unlike static post-hoc correction methods, Hydra adapts to both adversarial manipulations and intrinsic model errors, making it robust to malicious perturbations and hallucination-related inaccuracies. We evaluate Hydra on four VLMs, three hallucination benchmarks, two adversarial attack strategies, and two adversarial defense methods, assessing performance on both clean and adversarial inputs. Results show that Hydra surpasses plug-in VLMs and state-of-the-art (SOTA) dehallucination methods, even without explicit adversarial defenses, demonstrating enhanced robustness and factual consistency. By bridging adversarial resistance and hallucination mitigation, Hydra provides a scalable, training-free solution for improving the reliability of VLMs in real-world applications.

1 Introduction

VLM robustness must address both adversarial attacks and intrinsic hallucinations, yet prior work has generally treated them separately. Hydra combines agentic iterative reasoning and cross-model verification to refine plug-in LVLM outputs against both threats.

1 Introduction

  • Prior work largely addressed adversarial robustness or hallucination mitigation in isolation, leaving unified VLM robustness underexplored.The paper focuses on object-level hallucinations, which it identifies as foundational to higher-level reasoning.Source: §1 · p. 2
  • VLM attacks can manipulate visual, textual, or joint-embedding inputs, while intrinsic hallucinations can assert unsupported objects or attributes.The paper highlights object-level errors—incorrectly asserting an object's presence—as its initial target.Source: §1 · p. 2
  • Existing post-hoc correction methods can mitigate hallucinations but use rigid pipelines that do not integrate adversarial robustness.The introduction contrasts these methods with an adaptive approach intended to address both adversarial inputs and factual errors.Source: §1 · p. 2
  • Hydra is a training-free agentic framework that iteratively retrieves and critiques visual information to refine plug-in LVLM outputs against perturbations and intrinsic errors.Its structured Action-Critique Loop analyzes inconsistencies across multiple vision-based AI models.Source: §1 · p. 2
  • Experiments across four LVLMs, three hallucination benchmarks, two adversarial attacks, and two defense strategies report that Hydra outperforms state-of-the-art dehallucination methods.The paper presents this as an empirical validation of a unified robustness framework.Source: §1 · p. 2
  • The paper frames Hydra as a way to connect adversarial resistance with factual reliability in vision-language models.The stated motivation includes safety-critical domains such as autonomous systems, cybersecurity, and medical AI.Source: §1 · p. 2

2 Related Works

Prior work addresses joint-embedding attacks, hallucination correction, and agentic reasoning, but the paper identifies a gap: no agentic VLM approach systematically handles both adversarial and intrinsic errors. Hydra is proposed as an adaptive framework to address that gap.

2.1 Adversarial Attacks in VLMs’ Joint Embedding Space

  • VLM attacks can distort shared visual-textual representations, and preprocessing or adversarial-training defenses may degrade clean-input performance while leaving hallucinations unaddressed.Adversarial Prompt Tuning targets textual embeddings but leaves visual representations vulnerable and does not mitigate hallucinations.Source: §2.1 · p. 3

2.2 Hallucination Mitigation in VLMs

  • Object-level hallucinations matter because false claims about object presence underpin higher-level visual reasoning.Woodpecker uses external verification but requires multiple inference passes; LogicCheckGPT checks consistency but lacks external validation, and both follow static pipelines.Source: §2.2 · p. 3

2.3 Agentic AI for Reasoning and Robustness Enhancement

  • Agentic systems such as ReAct and CRITIC use iterative reasoning and external verification, but had not been systematically applied to both adversarial defense and hallucination reduction in VLMs.Their structured decision-making adjusts outputs using retrieved information.Source: §2.3 · p. 3

2.4 Research Gaps and Motivation for Hydra

  • The paper identifies the missing combination as an adaptive agentic approach to external adversarial threats and intrinsic generative errors, then proposes Hydra to address it.Hydra uses structured verification, adaptive critique loops, and evidence from multiple visual AI models; the paper reports improved adversarial robustness and performance over state-of-the-art dehallucination methods.Source: §2.4 · p. 4

3 Method

Hydra uses a single LLM-based agent and a suite of visual AI models to iteratively retrieve, critique, and refine evidence for plug-in LVLM outputs. Its task-specific workflows use attribute-based inquiries and cross-model verification to resolve inconsistencies.

3.1 Hydra Architecture Overview

  • Hydra coordinates a single LLM-based agent with a suite of visual AI models through an Action Space for querying and a Critique Space for evaluating evidence and selecting next steps.A shared memory stores retrieved information and critiques across iterations.Source: §3.1 · p. 4
  • When retrieved information conflicts, the Action-Critique Loop prompts further queries and re-evaluation until a confident conclusion or the iteration limit is reached.The loop is intended to address adversarial perturbations and hallucination errors.Source: §3.1 · pp. 4–5
  • Hydra uses CoT and ICL in a modular, plug-and-play design, with multiple visual encoders and cross-verification intended to reduce attack susceptibility and hallucinations.The paper also presents structured reasoning as a way to improve interpretability by exposing decision rationales.Source: §3.1 · p. 5
  • For binary object-presence VQA, Hydra compares an LVLM caption with detector results and finalizes consistent decisions, seeking more evidence when they conflict.It formulates attribute-based questions from earlier responses during verification.Source: §3.1 · p. 5
  • For captioning, Hydra flags objects missing from the summary but present in multiple retrieved captions, then verifies them across LVLMs and a VLP model.Validated objects are added to the summary caption.Source: §3.1 · p. 5

4.1 Experiment Setup

The experiments assess intrinsic hallucination errors and adversarial robustness on clean and attacked benchmark inputs, with and without preprocessing defenses. The setup combines object-level VQA and captioning benchmarks with several LVLMs, correction baselines, attacks, and defenses.

4.1.1 Robustness Evaluation Metrics

  • The evaluation defines four measures: intrinsic-error robustness, defense impact on hallucination performance, and adversarial robustness with and without defense.It tests defenses on clean images as well as attacked inputs to assess potential performance degradation.Source: §4.1.1 · pp. 5–6

4.1.2 Hallucination Benchmarks

  • POPE and MME Existence assess binary object-presence responses, while AMBER Generative evaluates image captions with hallucination and object-coverage metrics.The AMBER attack experiments use a 50-image sample; POPE samples 300 questions per subset.Source: §4.1.2 · p. 6

4.1.3 Implementation Details

  • Hydra is evaluated with four plug-in LVLMs, alongside DETR, Paligemma, and BLIPvqa; its Llama-3.2-Vision-Instruct agent reasons from textual inputs without direct image access.The four plug-in models are mPLUG-Owl, LLaVA-1.5, MiniGPT-4, and Qwen-VL-Chat.Source: §4.1.3 · p. 6
  • The dehallucination baselines are Woodpecker and LogicCheckGPT, both implemented with Llama-3.2-Vision-Instruct as correction model for comparison.This differs from GPT-3.5-turbo used in the original works.Source: §4.1.3 · p. 6
  • The attacks target images in hallucination benchmarks: Adversarial Illusions is white-box and uses ImageBind, while AttackVLM uses a transfer- and query-based strategy with Unidiffuser.The passage specifies attack budgets of ϵ = 16 255 and ϵ = 8 255, respectively.Source: §4.1.3 · p. 6
  • The setup applies JPEG compression and feature squeezing as image-preprocessing defenses to benchmark images.JPEG uses quality 50 and feature squeezing uses bit-depth 4.Source: §4.1.3 · p. 6

POPE-Ran POPE-Pop POPE-Adv

The table compares LVLM dehallucination methods across three POPE subsets; adversarial defenses trade computational efficiency against adversarial robustness.

POPE-Ran POPE-Pop POPE-Adv

  • Table 1 compares LVLM performance with dehallucination methods across POPE subsets.The best results for each model are bolded.Source: Table 1 · p. 7
  • POPE-Random, POPE-Popular, and POPE-Adversarial are abbreviated Ran, Pop, and Adv.Source: Table 1 · p. 7
  • Adversarial defenses offer a practical trade-off between computational efficiency and robustness.The described defenses target high-level structures rather than fine-grained perturbations.Source: POPE-Ran POPE-Pop POPE-Adv · p. 7

4.2 Results Analysis

Across clean and adversarial settings, Hydra outperforms state-of-the-art dehallucination methods on the reported benchmarks. The results also show that preprocessing defenses can reduce coverage or consistency, while some attacks coincide with improved performance.

4.2.1 Robustness to Intrinsic Model Errors

  • Hydra achieves average accuracy above 90% across POPE subsets and multiple LVLMs while keeping Yes Ratio around 50%.On mPLUG-Owl, accuracy improves by over 40%; on MiniGPT-4, it is 20% higher than baseline.Source: §4.2.1 · p. 7

4.2.2 Impact of Adversarial Defenses on Dehallucination

  • 96.2% accuracy with JPEG compression on MiniGPT-4; AMBER results show reduced hallucinations and cognitive errors but lower object coverage.The reported preprocessing defenses can degrade dehallucination consistency.Source: §4.2.2 · p. 7, Table 2 · p. 8

4.2.3 Adversarial Robustness Without Defense

  • Hydra outperforms plug-in LVLMs and state-of-the-art dehallucination methods on POPE even without explicit defenses.Figure 3 compares dehallucination methods before and after adversarial attacks.Source: §4.2.3 · pp. 7–8, Figure 3 · p. 8

4.2.4 Adversarial Robustness With Defense

  • Across clean and adversarial settings, Hydra consistently outperforms state-of-the-art dehallucination methods.The reported comparison spans POPE-Random, MME-Existence, and AMBER-Generative.Source: §4.2.4 · p. 8, Table 3 · p. 9, Table 4 · p. 9
  • -5% in Total: Hydra’s MME-Existence performance drop is minimal under Adversarial Illusions and AttackVLM.Some MME-Existence and AMBER cases improve after attack, for reasons the authors leave open.Source: §4.2.4 · p. 8, Table 4 · p. 9
  • On AMBER-Generative, Hydra reduces hallucination rate and cognitive errors across defenses, but its Cover metric does not outperform baseline VLMs.The authors attribute lower coverage to Hydra’s more conservative approach to asserting object existence.Source: §4.2.4 · p. 9, Table 5 · p. 10

5 Conclusion

Hydra combines adaptive agentic reasoning with an action-critique loop to address hallucinations and adversarial perturbations. The conclusion reports resilience without explicit adversarial defenses while identifying inference-time and hallucination-scope limitations.

5 Conclusion

  • Hydra surpasses existing dehallucination methods while showing resilience to adversarial manipulations across evaluated VLMs, benchmarks, and attack scenarios.The conclusion describes the approach as training-free and model-agnostic.Source: §5 · p. 10
  • Hydra’s modular design is reported to improve factual alignment and interpretability while enhancing VLM robustness.The conclusion characterizes the framework as training-free and model-agnostic.Source: §5 · p. 10
  • Hydra exhibits strong adversarial resistance even without explicit adversarial defenses, with improvements from small-scale models under 3B, particularly under computational constraints.The conclusion highlights agent-based frameworks as a potential way to unify robustness against adversarial perturbations and generative errors.Source: §5 · p. 10
  • Iterative agentic reasoning increases inference time and may hinder real-time applications.The conclusion suggests exploring more efficient multimodal agentic architectures that reduce computational overhead.Source: §5 · p. 10
  • The framework mitigates object-level hallucinations, while extending it to attribute- and relationship-level hallucinations remains an open challenge.Source: §5 · p. 10
  • Adaptive defenses tailored to multimodal embedding spaces remain an avenue for future exploration.The conclusion identifies a gap in defenses targeting VLM joint embedding spaces and suggests exploring adaptive mechanisms for multimodal embedding spaces.Source: §5 · p. 10
Loading 2504.14395v1…