PaperlayerView exact revision on arXiv

Source-linked AI summary

On Epistemic Uncertainty of Visual Tokens for Object Hallucinations in Large Vision-Language Models

Hoigi Seo, Dong Un Kang, Hyunjin Cho, Joohoon Lee, Se Young Chun

arXiv:2510.09008v1cs.CVcs.AIcs.CL

TL;DR

Object hallucination undermines the reliability and practical utility of LVLMs, while vision-encoder-focused mitigation is comparatively underexplored. The paper estimates uncertain visual tokens using adversarial representation deviations and masks them in intermediate vision-encoder self-attention. Experiments report reduced hallucination across benchmarks and LVLM architectures, and compatibility with existing mitigation methods.

  • Problem

    Object hallucination—describing objects absent from an image—undermines the reliability and practical utility of LVLMs, while vision-encoder-focused mitigation has been relatively underexplored.

    Source: §1 · p. 1

  • Method

    The method uses PGD-induced visual-token representation deviations to identify uncertain tokens and masks them in intermediate vision-encoder self-attention layers.

    Source: §3.1.1 · p. 4

  • Results

    Experiments report reduced hallucination on CHAIR, POPE, and AMBER across diverse LVLM architectures, with compatibility with existing language-model mitigation methods.

    Source: §1 · p. 2

  • Takeaways & Limitations

    The vision-encoder intervention can be combined with methods that adjust language-model decoding or attention.

    Source: §1 · p. 2

    The local-Gaussianity result assumes sufficiently small perturbations and a smooth function f in C2.

    Source: §3.1.1 · p. 3

Abstract

from arXiv · show

Large vision-language models (LVLMs), which integrate a vision encoder (VE) with a large language model, have achieved remarkable success across various tasks. However, there are still crucial challenges in LVLMs such as object hallucination, generating descriptions of objects that are not in the input image. Here, we argue that uncertain visual tokens within the VE is a key factor that contributes to object hallucination. Our statistical analysis found that there are positive correlations between visual tokens with high epistemic uncertainty and the occurrence of hallucinations. Furthermore, we show theoretically and empirically that visual tokens in early VE layers that exhibit large representation deviations under small adversarial perturbations indicate high epistemic uncertainty. Based on these findings, we propose a simple yet effective strategy to mitigate object hallucination by modifying the VE only. Our method comprises a proxy method with adversarial perturbations for identifying uncertain visual tokens efficiently and a method to mask these uncertain visual tokens during the self-attention process in the middle layers of the VE, suppressing their influence on visual encoding and thus alleviating hallucinations. Extensive experiments show that our method significantly reduces object hallucinations in LVLMs and can synergistically work with other prior arts.

1 Introduction

The paper links visual-token epistemic uncertainty with object hallucination and proposes mitigating it by identifying and masking uncertain tokens within the vision encoder. Experiments report reduced hallucination across benchmarks and LVLM architectures, with compatibility with other mitigation methods.

1 Introduction

  • Visual-token epistemic uncertainty is positively correlated with object hallucination, and adversarial representation deviations provide an efficient uncertainty proxy, particularly in early vision-encoder layers.The paper theoretically relates deviations under adversarial perturbations to an upper bound of uncertainty and reports empirical alignment with Monte Carlo dropout estimates.Source: §1 · p. 2
  • The method identifies uncertain tokens through PGD-based representation deviations and masks them in intermediate vision-encoder self-attention layers.It intervenes only in the vision encoder during inference and is described as preserving the image representation's global semantic structure.Source: §1 · p. 2
  • Experiments report reduced hallucination on CHAIR, POPE, and AMBER across diverse LVLM architectures, with the vision-encoder method compatible with language-model mitigation methods.The authors report that it can combine with decoding-strategy and language-model attention methods.Source: §1 · p. 2

2 Related Works

LVLMs combine vision encoders, connectors, and language models, but can generate visual content that contradicts their inputs. Prior mitigation approaches target training, language-model outputs, attention, or image inputs, while vision-encoder deficiencies remain comparatively overlooked.

2 Related Works

  • LVLMs typically combine a vision encoder, connector, and language model; connectors may use linear projections or Q-Former modules to align or compress visual information.The passage also describes hallucinations as outputs misaligned with visual content.Source: §2 · p. 2
  • Training-free mitigation modifies language-model logits, attention, or image inputs, while the paper identifies vision-encoder deficiencies as comparatively overlooked.Other approaches optimize LVLMs or add guidance modules, which the passage describes as often computationally expensive.Source: §2 · p. 2
  • PGD uses image perturbations to induce model errors; its update projects each step into a constraint set limiting the perturbation from the original image.The passage describes attacks targeting either the full LVLM or specifically its vision encoder.Source: §2 · p. 3

3 Method

The method estimates visual-token uncertainty from adversarial feature deviations, then uses an uncertainty mask to reduce hallucination-relevant token influence in the vision encoder. Its theoretical analysis relates hidden-state deviations under small perturbations to an upper bound on token entropy.

3 Method

  • The method identifies uncertain visual tokens using adversarial perturbations and masks them in intermediate vision-encoder self-attention layers to suppress their influence.The method section presents this as the paper’s strategy for reducing object hallucination.Source: §3 · p. 3

3.1.1 Efficient uncertainty approximation of visual token with adversarial attack

  • Under small perturbations, hidden states are locally approximated as Gaussian, and adversarial hidden-state deviation approximates an upper bound on visual-token entropy.The analysis uses the deviation as an efficient proxy for epistemic uncertainty.Source: §3.1.1 · pp. 3–4
  • PGD optimizes bounded image noise to increase mean squared error between original and perturbed vision-encoder features.The resulting attacked image is used to compare hidden states across layers.Source: §3.1.1 · p. 4
  • Layer-wise feature deviations are aggregated into an uncertainty map, normalized by its mean and standard deviation, and thresholded into a binary mask.Mask value 0 marks an uncertain token; 1 marks a relatively certain token.Source: §3.1.1 · p. 4

Appendix Sec.G.3. In Sec 3.2, we describe how M is used to mitigate object hallucination.

The section links visual-token uncertainty to hallucination and tests masking those tokens in intermediate vision-encoder self-attention. The reported results show lower uncertainty and hallucination metrics after masking, while early layers provide the most effective mask source.

3.1.2 Empirical study on extracting uncertainty with adversarial attack

  • The adversarial uncertainty map closely aligns with MC-dropout estimates and is approximately five times faster in practice.The layer selection uses early encoder layers, where adversarial feature deviations remain comparatively small.Source: §3.1.2 · p. 5
  • Using 500 MS-COCO images [33] with the LLaVA-1.5 vision encoder [35], perturbation-induced feature deviations remained minimal in early layers and intensified later; the mask is extracted from early layers.Source: Figure 3 · p. 5

3.2.1 Uncertain visual tokens contribute to object hallucination

  • Higher average token uncertainty is associated with more severe hallucination: CHAIRs and CHAIRi rise while F1 falls, with all reported correlations statistically significant.Spearman correlations were ρ = 0.794 for CHAIRs, ρ = 0.733 for CHAIRi, and ρ = −0.745 for F1.Source: §3.2.1 · p. 5, Figure 4 · p. 5

3.2.2 Masking uncertain visual tokens for training-free hallucination mitigation

  • The method masks uncertain tokens in intermediate vision-encoder self-attention outputs, attenuating their influence while retaining attention weights and other token interactions.The authors describe this placement as a balance between reducing uncertain-token effects and avoiding loss of potentially useful visual information.Source: §3.2.2 · p. 6, Figure 5 · p. 6

3.2.3 Does our method reduce uncertainty and mitigate object hallucination? Yes.

  • Variance in the highest-uncertainty bin fell from 6.04 to 4.98; CHAIRs fell from 1.00 to 0.33, CHAIRi from 0.27 to 0.09, and F1 rose from 0.47 to 0.77.Reductions in variance, CHAIRs, and CHAIRi were significant; F1 was preserved.Source: §3.2.3 · p. 6, Figure 6 · p. 6

4 Experiments

The section reports experiments across LVLMs and hallucination benchmarks, including results on object hallucinations, caption quality, and ablations of uncertainty estimation and token masking. It also includes broader-impact disclosures on asset attribution, planned code documentation, and the absence of human subjects or LLMs as essential core-method components.

4.1 Experimental Setup

  • Experiments cover LLaVA-1.5-7B [35], Shikra-7B [9], and MiniGPT-4 across CHAIR [47], POPE [31], and AMBER, using 500, 9,000, and 5,928 prompts, respectively.The setup uses k = 3 and 200 PGD steps; uncertainty masks are extracted from vision-encoder layers 1–10 and applied to layers 13–17 for LLaVA-1.5 and Shikra, and 9–16 for MiniGPT-4.Source: §4.1 · p. 7

4.2 Experimental results

  • Across three LVLMs, the method lowers CHAIR hallucination rates while preserving F1; on LLaVA-1.5-7B, Cs drops from 47.4 to 29.2 and Ci from 12.2 to 9.3.On POPE, performance is comparable or slightly improved across models; the method also provides additional gains when combined with OPERA, VCD, PAI, and Devils without compromising caption quality.Source: §4.2 · pp. 7–8
  • On AMBER, the method achieves up to a 28.2% reduction in CHAIR and a 7.2% improvement in F1, with higher AMBER scores across settings.The evaluation uses generative and discriminative tasks on LLaVA-1.5-7B.Source: Table 2 · p. 8, §4.2 · p. 8
  • Greedy decoding produces descriptions with nonexistent objects, while the method reduces these hallucinations and can recover overlooked objects such as graffiti in Shikra.Examples include hallucinated people, benches, cars, and fire hydrants.Source: Figure 7 · p. 8, §4.2 · p. 8

4.3 Ablation Study and Analysis

  • Using early vision-encoder layers 1–10 to estimate uncertainty yields the largest hallucination reductions and highest F1, outperforming intermediate or deeper layers.This result aligns with the analysis that early layers are more suitable for uncertainty estimation.Source: §4.3 · p. 9, Table 3 · p. 9
  • Applying the uncertainty mask in intermediate vision-encoder layers 13–17 yields the best hallucination reduction and highest F1; earlier layers help less and deeper layers provide minimal gains.The comparison concerns masking within the vision encoder’s self-attention process.Source: §4.3 · p. 9, Table 4 · p. 9
  • Hard masking within self-attention achieves the best hallucination scores while maintaining competitive F1 compared with input-image, encoder-output, MLP, and soft-masking alternatives.Soft masking attenuates uncertain tokens by a small factor.Source: §4.3 · p. 9, Table 5 · p. 9

10. Broader impacts

  • The authors say they cite utilized code, benchmark datasets, and models and provide corresponding GitHub links in Appendix Sec. D.Source: §10 · p. 18
  • The authors plan to release code with a README covering usage instructions, benchmark datasets, and experimental models.Source: §10 · p. 19
  • The authors state that the paper involves neither crowdsourcing nor research with human subjects.Source: §10 · p. 19
  • The authors state that LLMs are not essential, novel, or non-standard components of their core method development.Source: §10 · p. 20

A.1 Proof of Lemma 3.1

Lemma 3.1 analyzes hidden states under small input perturbations in a smooth network. A second-order expansion of the conditional log-density yields a local Gaussian approximation with a third-order remainder.

A.1 Proof of Lemma 3.1

  • For a smooth L-layer network, small input perturbations define perturbed hidden states and corresponding residuals at layer t.The perturbation is chosen to maximize the difference between clean and perturbed outputs.Source: §A.1 · p. 21
  • The conditional log-density near the clean hidden state is expanded to second order, with its first-order term vanishing.The quadratic term is expressed using the Hessian at the clean hidden state.Source: §A.1 · p. 21
  • The quadratic term gives a local Gaussian form, while the log-density approximation error is third order in the hidden-state deviation.The Gaussian is centered at z(t) with covariance (−H(t))−1.Source: §A.1 · p. 21

A.2 Proof of Theorem 3.2

The proof connects hidden-state deviation under small adversarial perturbations to an upper bound on differential entropy. It also motivates a trace-based uncertainty measure as a practical alternative when covariance determinants are numerically unstable.

A.2 Proof of Theorem 3.2

  • Under small perturbations and local Gaussianity, the theorem bounds token hidden-state differential entropy so its upper bound increases with hidden-state deviation.The proof assumes a smooth transformer and negligible higher-order perturbation terms.Source: §A.2 · pp. 21–22

A.3 On practicality of the proved upper bound

  • The covariance is highly low-rank: eight components explain 94.2% (±0.4%) of variance, making determinant-based entropy estimation unstable.The analysis uses 2,048 adversarial attacks on visual tokens from 100 LLaVA-1.5-7B images; trace provides a stable alternative that preserves token-wise uncertainty ordering.Source: §A.3 · p. 22

B Code

  • The supplementary material provides the method implementation and README instructions for running the code and setting up its environment.Source: B Code · p. 23

C Implementation Details

Implementation settings vary by model and method combination, while attack, estimation, and masking settings are specified for each vision encoder.

C Implementation Details

  • The threshold σth is selected separately for each model–method combination and then held constant across evaluations.PGD uses k = 3 and 200 iterations; masks come from vision-encoder layers 1–10 and are applied in middle layers, with target ranges varying by model.Source: Table A1 · p. 23, C Implementation Details · p. 23

D.1 Benchmarks

The appendix describes hallucination benchmarks, evaluated LVLMs, and comparison methods, then reports uncertainty-estimation efficiency and the effects of adversarial attacks on model outputs.

D.1 Benchmarks

  • CHAIR measures caption hallucinations at object and sentence levels; POPE probes object presence with yes/no questions across three sampling strategies; AMBER spans generative and discriminative tasks, with this study focusing on existence.Source: §D.1 · pp. 23–24

D.2 Base models

  • Evaluations use LLaVA-1.5-7B and 13B, Shikra-7B, and MiniGPT-4; for MiniGPT-4, attacks target features before the Q-Former.Source: §D.2 · p. 24

D.3 Baselines

  • Baselines include greedy decoding, OPERA, VCD, PAI, and Devils; PAI and Devils can be combined with this method because they intervene outside the vision encoder.OPERA uses beam search, while VCD applies uncertain-token suppression only to the original image.Source: §D.3 · pp. 24–25

E.1 Monte Carlo vs. Adversarial attack

  • Our adversarial method is ×5.1 faster than MC dropout by mean runtime, while its uncertainty maps slightly overestimate but closely align with MC dropout’s high-uncertainty regions.The comparison uses 100 attacks with k = 3 top perturbations versus 1,000 dropout forward passes on LLaVA-1.5-7B.Source: Table A2 · p. 25, §E.1 · p. 26

E.2 Effect of adversarial attacks on LVLM outputs

  • Higher adversarial attack intensities correspond to more severe hallucinations, and attacked-image responses often hallucinate or fail to answer correctly.The evaluation uses PGD attacks of varying magnitudes on LLaVA-1.5-7B and assesses outputs with CHAIR.Source: §E.2 · p. 26, Table A3 · p. 26

E.3 Consistency and robustness of uncertainty masks from adversarial attacks

The uncertainty masks remain consistent across different adversarial-attack initializations.

E.3 Consistency and robustness of uncertainty masks from adversarial attacks

  • Masks remain highly consistent across initial noise seeds, with qualitative maps showing stable, coherent structures.Consistency is measured by mean Intersection over Union between masks generated from different seeds.Source: §E.3 · p. 26

F Additional Ablation Studies

The ablations examine mask-threshold selection and consistency across attack initializations, while the computational-cost analysis compares added inference time with existing methods.

F Additional Ablation Studies

  • Masks from five random seeds are reported as robust and consistent, with consistency measured by mean Intersection over Union across 500 images.The evaluation uses LLaVA-1.5-7B and σth = 1.1.Source: Table A4 · p. 27
  • σth = 1.1 yields the best overall performance among six tested thresholds on LLaVA-1.5-7B.The selected threshold balances Cs, Ci, and F1; thresholds are chosen by grid search for each model–method combination.Source: F Additional Ablation Studies · pp. 26–27, Table A5 · p. 27

G.1 Computational Cost

  • PGD-based adversarial token identification through backpropagation adds computational overhead relative to standard greedy decoding, but measured extra inference time is comparable to or lower than several existing hallucination-mitigation methods, balancing performance and efficiency.Source: §G.1 · p. 27

G.2 Additional quantitative results

Additional evaluations test the method at larger and newer model scales, with alternative attacks, uncertainty estimators, decoding strategies, and output-length measures. Results report reduced hallucination across these settings, with some scope-dependent qualifications.

Applicability of our method to larger model

  • On LLaVA-1.5-13B, the method reduces Cs by 15.2 and Ci by 2.9 versus greedy decoding; combined with Devils, it reaches Cs = 20.4 and Ci = 6.0.The reported combined setting gives the best performance among the tested combinations.Source: §G.2 · p. 27, Table A7 · p. 28

Applicability of our method to the state-of-the-art models

  • The method also reduces object hallucination on DeepSeek-VL and Qwen2.5-VL, models whose vision encoders are jointly fine-tuned during alignment.The comparison is against greedy decoding; the respective thresholds are σth = 1.0 and σth = 0.0.Source: §G.2 · p. 28, Table A8 · p. 28

Alternative attack methods on Q-Former design architecture

  • Jointly perturbing MiniGPT-4’s image and Q-Former queries yields further CHAIR gains, while the main paper retains image-only perturbations for methodological consistency.Image-only attacks have limited effectiveness in this Q-Former architecture, which compresses image tokens using learnable queries.Source: §G.2 · pp. 28–29, Table A9 · p. 28

Length of generated text

  • The method slightly shortens generated descriptions across various models and mitigation methods, but MiniGPT-4 outputs can remain unchanged or increase slightly.The authors relate shorter outputs to lower hallucination rates, while noting MiniGPT-4’s Q-Former makes vision-encoder masking less effective.Source: §G.2 · p. 29, Table A10 · p. 29

Application of our method to other baselines

  • Across beam search, DoLa, and VAR on LLaVA-1.5-7B, the method consistently reduces hallucination metrics while maintaining or improving F1.Beam search uses Nbeam = 5.Source: §G.2 · p. 29, Table A11 · p. 29

Comparison of uncertainty estimation of visual token: Our Method vs. MC Dropout

  • PGD-based uncertainty estimation is reported as comparable to or more computationally efficient than MC dropout, which requires thousands of forward passes.The comparison evaluates mask generation on LLaVA-1.5-7B using CHAIR; the authors conjecture that their upper-bound estimate accounts for its stronger performance.Source: §G.2 · pp. 29–30, Table A12 · p. 29

G.3 Additional qualitative results

The supplementary qualitative results show uncertainty masks and reduced hallucinations across model and mitigation-method combinations, alongside discussion of changed attention patterns and possible societal risks.

G.3 Additional qualitative results

  • Additional examples show PGD-based attacks generating binary uncertainty masks for varied LLaVA-1.5-7B input images.The masks are presented as qualitative examples rather than a quantitative comparison.Source: §G.3 · p. 30
  • Examples across LLaVA-1.5-7B and Shikra-7B show reduced non-existent object generation with greedy decoding, OPERA, VCD, PAI, and Devils on CHAIR and POPE.The examples span Figures A5–A24.Source: §G.3 · p. 30
  • The method occasionally fails to prevent all hallucinations in qualitative failure cases.The illustrated cases use LLaVA-1.5-7B with greedy decoding on CHAIR.Source: §G.3 · p. 30

H Discussion

  • Across 500 images, LLaVA’s average attention entropy over image tokens rises from 1.5746 to 1.9717 with the method.The authors interpret the increase as broader and more balanced attention over visual evidence.Source: H Discussion · p. 30

I Broader Impacts

  • The method modifies only the vision encoder, but may suppress valid ambiguous information and disproportionately affect underrepresented groups or reinforce dataset biases.The paper frames these as potential negative societal impacts.Source: I Broader Impacts · p. 30

J Limitations

The paper identifies potential losses of visual information, added inference time, limited theoretical grounding, and weaker effectiveness for Q-Former models as limitations of the method.

J Limitations

  • Self-attention masking may discard visual information and slightly degrade performance on some perception-oriented tasks.This is the first limitation identified by the authors.Source: J Limitations · p. 31
  • PGD-based attacks increase inference time, and the masking strategy lacks a formal theoretical foundation.The uncertainty surrogate is trace-based rather than a formal determinant-of-covariance treatment.Source: J Limitations · p. 31
  • Masking has limited downstream impact in models such as MiniGPT-4, whose Q-Former abstracts visual information before language integration.The authors identify this architecture as a setting where the method is less effective.Source: J Limitations · p. 31
  • A qualitative CHAIR failure example shows that the method can reduce hallucinations without preventing every non-existent object mention.The example uses LLaVA-1.5-7B with greedy decoding.Source: Figure A25 · p. 56
Loading 2510.09008v1…