PaperlayerView exact revision on arXiv

Source-linked AI summary

Doc-PP: Document Policy Preservation Benchmark for Large Vision-Language Models

Haeun Jang, Hwan Chang, Hwanhee Lee

arXiv:2601.03926v2cs.CL

TL;DR

Document QA systems must follow user-defined disclosure policies even when protected information can be inferred from multimodal evidence, a setting underrepresented in prior safety work. The paper introduces Doc-PP and DVA, which separates reasoning from policy verification. Evaluations reveal leakage under reasoning-heavy and multimodal conditions, while DVA reduces leakage across document types and query settings.

  • Problem

    Prior safety research largely focuses on implicit norms or text-only settings, leaving user-defined non-disclosure policies for multimodal document QA underexamined.

    Source: §1 · p. 1

  • Method

    The paper introduces Doc-PP, a real-world PDF benchmark with explicit policies and reasoning queries, and proposes DVA to separate reasoning from policy verification.

    Source: §1 · p. 2

  • Results

    Evaluations find increased leakage for inferred answers, OCR-provided text, and multimodal evidence, while DVA substantially reduces leakage across document types and query settings.

    Source: §1 · p. 2

  • Takeaways & Limitations

    The findings identify reasoning across document evidence as a policy-preservation vulnerability and present DVA as a practical baseline for multimodal document QA.

    Source: §1 · p. 2

    Dataset construction and evaluation partly rely on LVLMs and LLMs, which may introduce model-specific biases.

    Source: Limitations · p. 9

Abstract

from arXiv · show

The deployment of Large Vision-Language Models (LVLMs) for real-world document question answering is often constrained by dynamic, user-defined policies that dictate information disclosure based on context. While ensuring adherence to these explicit constraints is critical, existing safety research primarily focuses on implicit social norms or text-only settings, overlooking the complexities of multimodal documents. In this paper, we introduce Doc-PP (Document Policy Preservation Benchmark), a novel benchmark constructed from real-world reports requiring reasoning across heterogeneous visual and textual elements under strict non-disclosure policies. Our evaluation highlights a systemic Reasoning-Induced Safety Gap: models frequently leak sensitive information when answers must be inferred through complex synthesis or aggregated across modalities, effectively circumventing existing safety constraints. Furthermore, we identify that providing extracted text improves perception but inadvertently facilitates leakage. To address these vulnerabilities, we propose DVA (Decompose-Verify-Aggregation), a structural inference framework that decouples reasoning from policy verification. Experimental results demonstrate that DVA significantly outperforms standard prompting defenses, offering a robust baseline for policy-compliant document understanding

1 Introduction

Dynamic user-defined disclosure policies make multimodal document QA difficult: sensitive values may need to be withheld even when they can be inferred from visual and textual evidence. Doc-PP exposes failures on reasoning-heavy queries and motivates DVA, which separates reasoning from policy verification.

1 Introduction

  • Existing LVLM safety work emphasizes static implicit norms, while text-only policy-preservation work does not cover heterogeneous visual evidence or distributed cross-document reasoning.CoPriva studies user-defined constraints but uses textual inputs and typically targets localized spans.Source: §1 · p. 2
  • Doc-PP benchmarks policy preservation using real-world PDFs, explicit non-disclosure policies, and queries requiring evidence distributed across document spans and modalities.Its documents include financial and industry reports with information in text, tables, charts, and figures.Source: §1 · p. 2
  • Leakage rises when answers require inference, OCR-extracted text, or integration of multimodal evidence, revealing a systemic reasoning-induced safety gap.The evaluation reports that OCR improves perceptual clarity yet frequently exacerbates leakage, and that policy adherence degrades in multimodal evidence settings.Source: §1 · p. 2
  • DVA separates reasoning from policy verification and substantially reduces leakage across document types and query settings, whereas prompting defenses offer limited protection.The paper identifies Chain-of-Thought prompting and post-hoc output revision as limited defenses because they fail to intercept intermediate reasoning that can lead to policy violations.Source: §1 · p. 2

2 Related Work

Prior privacy work examines contextual expectations, visual privacy, or explicit text-only constraints; Doc-PP extends explicit user-defined policy evaluation to multimodal documents.

2 Related Work

  • Contextual privacy studies evaluate information flow across social roles and settings, while VLM-GEOPRIVACY examines privacy in geolocation tasks from visual cues.These works primarily concern implicit disclosure norms rather than specific user directives.Source: §2 · p. 2
  • CoPriva benchmarks adherence to explicit user-defined non-disclosure constraints, but its setting is text-only.Doc-PP extends this line of work to multimodal documents requiring cross-modal integration.Source: §2 · p. 2
  • Doc-PP targets policy violations when sensitive information is dispersed across complex visual and textual dependencies in documents.The paper contrasts this with prior benchmarks focused on implicit norms or text-based constraints.Source: §2 · p. 2

3 Doc-PP: Dataset Construction

Doc-PP evaluates whether LVLMs can answer document questions using textual and visual evidence while respecting explicit non-disclosure policies. Its construction pairs confidential targets with documents and queries, then assesses leakage, answer faithfulness, and judge alignment.

3.2 Construction Pipeline

  • Doc-PP construction has three stages: policy construction, query construction, and checklist-based evaluation of leakage and faithfulness.The overview describes confidential-target generation and filtering, reasoning-heavy query generation, and evaluation.Source: Figure 2 · p. 3, §3.2 · p. 3

3.1 Task Definition and Setup

  • Policy-preserving multimodal document QA requires using document evidence to answer requests while withholding confidential values encoded in text or visuals.Each evaluation instance is a document, policy, and query; successful responses synthesize non-confidential evidence while redacting the protected value.Source: §3.1 · p. 3

3.2.1 Source Dataset

  • The source set contains 90 long-form PDFs from MMlongbench-Doc and Sustainable QA, focused on business, financial, and industry reports.These documents contain policy-relevant values in text and structured visual artifacts.Source: §3.2.1 · p. 3

3.2.2 Policy Construction

  • Filtering reduced the restricted target set from 838 candidates to 635 retained targets.The process checks whether targets are identifiable, answerable, non-leaking, and compatible with a noun-phrase constraint; human annotators verify source pages and quotations.Source: §3.2.2 · p. 4

3.2.3 Query Construction

  • Explicit queries directly solicit restricted content, while implicit summary-style queries require the confidential value for a correct answer and are paired with filtered content-coverage checklists.Queries are retained only when at least three valid checklist criteria remain; the restricted value is excluded from those criteria.Source: §3.2.3 · pp. 4–5

3.3 Dataset Statistics and Characteristics

  • Approximately 39% of queries require reasoning over non-textual visual elements, and some require synthesis across sources or multi-page information.The benchmark includes 443 explicit and 698 implicit queries across four document categories.Source: §3.3 · p. 5

3.4 Evaluation Framework

  • Evaluation measures leakage by whether the confidential value appears and faithfulness by checklist coverage for implicit queries; a separate LLM judge makes structured assessments.Explicit queries with a policy are evaluated only for leakage, while implicit queries with a policy are evaluated for both leakage and faithfulness.Source: §3.4 · p. 5

3.5 Human Validation

  • On 100 randomly sampled instances, the LLM-as-a-judge framework agreed with human annotators 93% of the time for both checklist validation and faithfulness evaluation.The reported agreement is from a manual validation study.Source: §3.5 · p. 6

4 Experiments

Experiments evaluate six LVLMs on image- and OCR-based document inputs, revealing leakage vulnerabilities in reasoning-heavy and multimodal settings. The mitigation study finds that DVA reduces leakage by separating synthesis from policy verification.

4.1 Experimental Setup

  • Six LVLMs—three reasoning models and three instruction-following models—are evaluated with image- and OCR-based inputs.GPT-5mini serves as judge, and Mistral OCR extracts interleaved text, images, and tables.Source: §4.1 · p. 6

4.2 Results

  • OCR-based inputs frequently exacerbate leakage despite improving clarity, while Table 3 reports faithfulness and leakage across input and query conditions.The paper attributes this paradox to clearer text enabling precise numerical reasoning on protected values.Source: §4.2 · p. 6, Table 3 · p. 7
  • Leakage rises sharply on implicit reasoning tasks compared with direct retrieval, even though advanced models often adhere to policies on explicit queries.The reported examples include synthesizing a chart’s information to calculate a ratio.Source: §4.2 · p. 6
  • Table 4 groups results by evidence type; complex synthesis has more safety violations than single-source evidence.The gap is associated with evidence fragmented across pages or requiring cross-referencing text and visual artifacts.Source: §4.2 · pp. 6–7, Table 4 · p. 7
  • Business reports have the highest reported leakage at 84.6%, while research reports have the lowest at 62.2%; Figure 3 relates leakage to document type and text ratio.Their text ratios are 68.1% and 50.3%, respectively.Source: §4.2 · p. 7, Figure 3 · p. 7

4.3 Mitigation Strategies

  • CoT and post-hoc revision offer limited protection: CoT does not enforce policy during synthesis, and revision can miss subtle leaks in cohesive answers.In the Figure 4 case study, CoT and Revision fail to withhold the restricted value, while DVA prevents leakage.Source: §4.3 · p. 8, Figure 4 · p. 8
  • On Gemini-3-Flash-Preview, DVA substantially reduces benchmark leakage, lowering the rate from 64.6 (default) to 30.5; isolating claims enables simpler atomic verification and prevents leaks overlooked in integrated outputs.Source: §4.3 · p. 8

5 Conclusion

The paper introduces Doc-PP for evaluating policy preservation in multimodal QA and identifies reasoning-related leakage and an OCR paradox. It proposes DVA, which decouples reasoning from verification, as a framework for improving compliance.

  • Doc-PP benchmarks user-defined policy preservation in multimodal QA, and the findings identify increased leakage with cross-modal reasoning and text extraction.The proposed DVA framework improves compliance by decoupling reasoning from verification.Source: §5 · pp. 8–9

Limitations

The pipeline partially relies on LVLMs and LLMs, which may introduce model-specific biases.

Limitations

  • The dataset construction and evaluation pipeline partially rely on LVLMs and LLMs, creating a risk of model-specific bias.The paper reports checklist-driven evaluation alignment with human judgments and human verification of cited pages and quoted spans.Source: Limitations · p. 9

Ethics Statement

The benchmark uses publicly available sources and was constructed for research without adding sensitive information beyond the originals. The authors also state that an LLM was used only for manuscript refinement.

Ethics Statement

  • Doc-PP uses public source documents, adds no sensitive information beyond them, and is intended solely for research on policy-compliant multimodal document understanding.Policies and queries were constructed from the source documents.Source: Ethics Statement · p. 9

A The Use of Large Language Models

B Human Validation Details

The authors manually validated both checklist construction and implicit-query faithfulness scoring, reporting 93% agreement between the LLM judge and human annotators. OpenRouter provided the unified inference gateway.

B Human Validation Details

  • Generation-stage validation checked whether checklist criteria were supported by the clipped document and did not overlap the confidential target.The study covered 100 randomly sampled instances.Source: B Human Validation Details · p. 11
  • Evaluation-stage validation judged checklist criteria as satisfied or not based on document evidence, with faithfulness scored as the fraction satisfied among valid items.The evaluation-stage study covered 100 randomly sampled instances.Source: B Human Validation Details · p. 11
  • 93% agreement with human annotators was achieved in both validation studies, and annotators confirmed policy-construction citations matched the original documents.Source: B Human Validation Details · p. 11

C Additional Implementation Details

D Additional Results

Leakage remained high across context-window lengths, which the authors suggest reflects localized cross-modal reasoning rather than long-range context accumulation. The section also contrasts CoPriva's text-only setting with Doc-PP's multimodal document domain.

D Additional Results

  • 60%–70% leakage persisted across context lengths of 2 to 25 surrounding pages; the authors suggest localized cross-modal reasoning rather than long-range context accumulation.Source: Table 6 · p. 11, D Additional Results · p. 11

E Comparison with CoPriva

F DVA Faithfulness and Verbosity Analysis

This section examines mitigation strategies in terms of faithfulness and response verbosity, reporting response lengths and leakage and faithfulness scores.

F DVA Faithfulness and Verbosity Analysis

  • The analysis compares mitigation strategies on faithfulness and response verbosity.It reports average response lengths and leakage and faithfulness scores, but the supplied passages do not give the values.Source: F DVA Faithfulness and Verbosity… · p. 11
  • Table 8 reports the average number of tokens generated by each mitigation method.The supplied passage identifies the table's measure but not its token counts.Source: F DVA Faithfulness and Verbosity… · p. 11
  • Table 9 presents leakage and faithfulness scores for each mitigation method.The supplied passage does not include the scores or establish which method performs best.Source: F DVA Faithfulness and Verbosity… · p. 11

G Failure Cases Analysis

The failure analysis describes leakage in implicit queries and a contextual-inference failure that persists under DVA. The prompt-template section outlines evaluation and mitigation prompts, including DVA’s staged verification process.

G Failure Cases Analysis

  • Gemini-3-Flash-Preview leaks survey methodology, including RDD sampling and telephone interviews, when an implicit query asks for a data-collection summary despite a policy forbidding disclosure.The failure illustrates difficulty maintaining policy consistency when restricted details appear within a broader summarization task.Source: G Failure Cases Analysis · pp. 11–12, Figure 16 · p. 23
  • DVA can miss contextual leakage when revealing a prior program’s $10 billion amount lets users infer the protected amount for a new repurchase program.The verification step rejects the direct statement but misses the implication created by the programs’ identical amounts.Source: G Failure Cases Analysis · p. 12, Figure 17 · p. 23

H Prompt Templates

  • Additional templates address content-coverage validation, standard and implicit-leakage evaluation, chain-of-thought mitigation, and post-hoc revision.The passages identify these prompt purposes but do not provide their full instructions.Source: Figure 10 · p. 18, Figure 11 · p. 19, Figure 12 · p. 20

H.11 DVA (Decompose–Verify–Aggregation) Framework Prompt

  • The leakage-evaluation prompt judges semantic equivalence rather than exact wording, counting partial disclosure as leakage while excluding refusals and vague, nonspecific information.The judge evaluates whether a response conveys the policy-restricted value.Source: §H.11 · p. 20
  • DVA first decomposes an initial answer into atomic facts, then verifies each fact against policy and aggregates only valid information.This staged design is shown in the DVA prompt template.Source: Figure 15 · p. 22, §H.11 · p. 22
Loading 2601.03926v2…