PaperlayerView exact revision on arXiv

Source-linked AI summary

Knowing What Not to Answer: Selective Non-Compliance in Vision-Language Models

Minji Kim, Jihyoung Jang, Hyounghun Kim

arXiv:2609.04720v1cs.CLcs.AI

TL;DR

VLM benchmarks often evaluate non-compliance for entire queries, leaving selective behavior in mixed answerable and non-answerable requests underexplored. KoNA introduces paired single and compound evaluations across five categories, then fine-tunes models with selective and fully answerable examples. Existing models frequently fail at appropriate non-compliance, especially in compound queries, while KoNA fine-tuning improves selective behavior and preserves performance on fully answerable components.

  • Problem

    Existing benchmarks largely evaluate non-compliance at the whole-query level, leaving selective behavior in queries mixing answerable and non-answerable components underexplored.

  • Method

    KoNA evaluates query-level and component-level non-compliance across five categories using paired single and compound queries, and fine-tunes VLMs with selective and fully answerable examples.

  • Results

    Current VLMs frequently fail to perform appropriate non-compliance, especially in compound queries, while KoNA fine-tuning enables selective task-appropriate non-compliance and preserves performance on fully answerable queries.

  • Takeaways & Limitations

    The results indicate that VLMs can better distinguish components requiring non-compliance from answerable components after fine-tuning on KoNA.

  • Takeaways & Limitations

    The study excludes open-source VLMs larger than 80B parameters and modalities beyond vision-language models.

Abstract

from arXiv · show

Vision-language models (VLMs) are expected to respond helpfully to appropriate requests while withholding compliance with requests that are incorrect, unsafe, infeasible, or unanswerable. However, existing benchmarks predominantly evaluate non-compliance at the level of the query as a whole, assuming that each request either warrants compliance or requires withholding compliance. In practice, real-world queries can contain a mixture of answerable content and components for which compliance should be withheld. In this paper, we introduce KoNA, a benchmark for evaluating selective non-compliance in VLMs across five categories: False Premise, Visual Inaccessibility, Universal Unknown, Task Feasibility, and Safety. Each task evaluates two capabilities: query-level non-compliance and component-level non-compliance under paired single and compound queries. Our evaluation across diverse VLMs shows that models often fail to refuse, correct, or abstain appropriately, and these failures become more pronounced when queries require selective non-compliance. To address this challenge, we fine-tune VLMs using KoNA examples that require selective non-compliance, together with a fully answerable set that should receive direct answers. Our fine-tuned models achieve substantial improvements in non-compliance accuracy while largely maintaining performance on fully answerable tasks. These results suggest that the fine-tuned models can distinguish between answerable components and those requiring non-compliance and respond in a task-appropriate manner.

1 Introduction

VLMs should withhold compliance when requests are incorrect, unanswerable, unsafe, or infeasible, yet existing evaluations largely treat queries as wholly compliant or non-compliant. KoNA addresses this gap by testing selective non-compliance in compound queries and fine-tuning models to separate answerable from non-answerable components.

  • Existing non-compliance evaluations mostly treat each query as requiring either compliance or withholding compliance.
  • KoNA evaluates query-level and component-level non-compliance across five categories using paired single and compound queries.The compound query adds answerable components to the same non-compliant condition.
  • The benchmark evaluates whether models refuse, correct, or abstain only for affected components while answering the remaining components.
  • Fine-tuning with KoNA examples and fully answerable examples improves selective non-compliance while maintaining performance on answerable components.The training procedure combines supervised fine-tuning with GRPO.

1. We introduce KoNA, which defines five task

KoNA defines five task categories and uses paired single and compound queries to evaluate selective non-compliance in VLMs. The study also uses fine-tuning with selective non-compliance and fully answerable instances to address observed failures.

  • KoNA defines five task categories requiring explicit non-compliance and uses paired single and compound queries.
  • The authors identify VLM failures on both single and compound queries and address them through fine-tuning.The training data include selective non-compliance and fully answerable instances.
  • Analyses examine framework extensibility and the importance of individual training components.

2 Related Work

Prior visual question answering and non-compliance work commonly evaluates valid or adversarial conditions in isolation. KoNA instead studies intertwined multimodal queries that require answering valid components while withholding compliance from others.

  • Visual question answering: Traditional VQA benchmarks generally assume that questions are valid and answerable.This assumption is problematic because VLMs may rely on language priors or hallucinate visual details.
  • Visual question answering: Recent adversarial and counterfactual benchmarks typically evaluate problematic conditions in isolation.
  • Non-compliance responses: KoNA focuses on realistic queries embedding non-compliant conditions within broader multimodal requests.
  • Non-compliance responses: The benchmark tests whether models answer valid components while refusing, correcting, or abstaining on remaining components.

3 KoNA

KoNA organizes selective non-compliance into five task categories and constructs paired single, compound, and fully answerable queries. Its dataset-generation pipeline combines diverse images, multiple generators, filtering, and human verification.

  • Task taxonomy: KoNA covers False Premise, Visual Inaccessibility, Universal Unknown, Task Feasibility, and Safety conditions.The categories target incorrect assumptions, inaccessible or unverifiable information, unsupported actions, and harmful requests.
  • Task taxonomy: Visual Inaccessibility requires models to state when occlusion, blur, viewpoint, or lighting prevents determining an attribute.
  • Task taxonomy: Universal Unknown requires explicit acknowledgment that relationships, roles, or intents cannot be verified from the image alone.Plausible inferences are acceptable only when clearly presented as unconfirmed.
  • Task taxonomy: Task Feasibility and Safety require models to acknowledge unsupported actions or refuse harmful, malicious, or unauthorized assistance.
  • Dataset generation: The generation pipeline creates single instances, expands them with answerable components into compound queries, and converts them into fully answerable contrast instances.
  • Dataset generation: The final dataset contains 3,100 image-level instances and 9,300 QA pairs after automatic filtering and human verification.Each image-level instance includes single, compound, and fully answerable QA versions.

4 Experiments

The experiments evaluate KoNA across diverse VLMs using standardized metrics, prompting variants, and a two-stage fine-tuning setup designed for selective non-compliance.

  • Training setup: Fine-tuning uses supervised fine-tuning followed by GRPO to balance selective non-compliance with factual accuracy on answerable components.SFT primarily uses compound queries, while GRPO further refines the balance between non-compliance and factuality.
  • Training setup: The training split contains 1,300 examples, with 1,200 allocated to SFT and 100 to GRPO.SFT includes 1,000 compound, 100 answerable, and 100 single QA pairs; GRPO uses 80 compound and 20 answerable instances.
  • Evaluation setup: KoNA evaluation covers open- and closed-source VLMs under a unified protocol with standardized inputs and default inference settings.The evaluated families include Qwen2.5-VL, InternVL3, GPT-5, and Gemini-2.5-Flash.
  • Inference setup: Inference experiments compare default inference with Chain-of-Thought and Behavior Guidance prompting.Behavior Guidance explicitly instructs models when to correct premises, express uncertainty, or refuse actions.
  • Evaluation metrics: Models are assessed using query-level non-compliance, component-level non-compliance, and factual accuracy.The metrics measure recognition of category-specific triggers, selective handling of invalid and answerable components, and visually grounded answers.
  • Evaluation reliability: Human evaluation shows GPT-5-mini agrees with human judgments on 94.8% of decisions overall.Agreement is 94.0% for query-level decisions, 93.8% for component-level decisions, and 97.0% for factuality decisions.

5 Results

Baseline VLMs struggle more with selective non-compliance in compound queries than in single queries, while prompting gives limited gains and KoNA fine-tuning produces broad, stable improvements.

  • Baseline performance: Compound-query accuracy is generally lower than single-query accuracy across models and task categories.The results indicate difficulty isolating components requiring non-compliance from answerable components.
  • Baseline performance: The single–compound performance gap tends to be larger for open-source models than for closed-source models, although the pattern is not uniform.
  • Prompting: Inference-time prompting generally improves non-compliance accuracy, but gains vary across models and task categories.Chain-of-Thought produces modest, inconsistent changes, while Behavior Guidance helps some models more substantially.
  • Prompting: Behavior Guidance helps more on Task Feasibility and Safety than on False Premise and Universal Unknown.The latter tasks require assessing unverifiable assumptions and producing context-dependent responses rather than outright refusal.
  • Prompting: Inference-time prompting alone does not reliably support selective non-compliance in compound queries.
  • Fine-tuning: KoNA fine-tuning substantially improves single- and compound-query accuracy across all five task categories while narrowing their performance gap.Fine-tuned models largely maintain accuracy on fully answerable queries while improving handling of invalid components.

6 Analysis

The analysis examines ablations, benchmark transfer, general capabilities, and qualitative errors in KoNA-tuned models. Results show that answerable examples and GRPO improve balance, while selective non-compliance still produces over-refusal, incomplete answers, and inaccurate corrections.

  • 6.1 Ablation Study: Training only on selective non-compliance queries improves non-compliance accuracy but sharply degrades performance on fully answerable queries.The answerable set prevents unnecessary refusals and incomplete responses by anchoring compliance on valid queries.
  • 6.1 Ablation Study: GRPO improves answerable-set performance while largely preserving accuracy across the five non-compliance categories.Compared with SFT-only training, GRPO reduces over-refusal while maintaining task-wise accuracy.
  • 6.2 Cross-Benchmark Evaluation: KoNA’s compound-query construction transfers to HaloQuest, MM-SafetyBench, R-Bench, and UPD, where fine-tuned models more reliably separate invalid from answerable components.Base models often hallucinate or issue blanket refusals, whereas KoNA-tuned models improve refusal, correction, and abstention while answering valid components.
  • 6.3 General Capability Evaluation: KoNA tuning causes no broad degradation across evaluated general vision-language capabilities and maintains low refusal rates on safe queries.The evaluated benchmarks cover visual text understanding, instruction following, multimodal reasoning, object-hallucination robustness, and safe-query responsiveness.
  • 6.4 Error Pattern Analysis: Qualitative errors remain: models may extend a valid refusal, omit answerable content, or misread evidence while correcting a false premise.These cases indicate that selective non-compliance requires both correct withholding decisions and accurate preservation of answerable information.

7 Conclusion

KoNA evaluates query-level and component-level selective non-compliance through paired single and compound queries across five task categories. Experiments show that current VLMs struggle more when valid and invalid components are mixed, while KoNA fine-tuning improves task-appropriate non-compliance and preserves performance on fully answerable queries.

  • 7 Conclusion: KoNA evaluates non-compliance across five task categories using paired single and compound queries.The paired design measures both query-level and component-level selective non-compliance.
  • 7 Conclusion: Current VLMs frequently fail on non-compliance, with errors becoming more pronounced in compound queries mixing valid and invalid components.The benchmark targets the distinction between answering valid components and refusing, correcting, or abstaining on the rest.
  • 7 Conclusion: Fine-tuning on KoNA enables more selective task-appropriate non-compliance while preserving performance on fully answerable queries.Additional analyses cover ablations, cross-benchmark evaluation, general capabilities, over-refusal, and qualitative failure patterns.

Limitations

The study evaluates query-level and component-level non-compliance only in VLMs, excluding larger open-source models and other modalities.

  • The experiments exclude open-source VLMs with more than 80B parameters because of computational constraints.
  • The study focuses exclusively on vision-language models and does not evaluate audio-based or image-generation models.
  • Future work could extend the framework to additional modalities, model classes, tasks, and model scales.

Ethics Statement

The study uses controlled data construction, automated filtering, human verification, and human-checked automatic evaluation while documenting training and benchmark procedures.

  • Dataset construction: All task instances are independently constructed under a unified generation framework rather than directly adopted from existing benchmarks.The framework uses consistent image sources, question templates, and answer formats to support controlled comparisons.
  • Quality control: Automated filtering checks query–answer consistency, image grounding, task-specific non-compliance criteria, and answerability.
  • Human verification: Human verification on MTurk reviews all test samples, including whether compound-query non-compliant components are correctly identified and grounded.Workers had approval rates above 98% and more than 10,000 approved HITs.
  • Human verification: Answerable control queries are randomly inserted into 10% of samples to monitor worker reliability.Workers who incorrectly flag answerable queries as non-compliant are treated as unreliable.
  • Annotation validation: Compound-query annotations are retained only when extracted non-compliant text has at least 0.2 token overlap with the original question and is judged correct and image-grounded.
  • Evaluation validation: GPT-5-mini agrees with human judgments on 94.0% of query-level, 93.8% of component-level, and 97.0% of factuality decisions.Overall agreement is 94.8% across the human-verified sample.

G Qualitative Analysis

Qualitative analysis finds that KoNA-tuned models generally separate answerable components from those requiring non-compliance, but several over-refusal, incomplete-answer, attribution, and correction errors remain.

  • Observed behavior: KoNA-tuned models generally correct false premises, abstain from unverifiable details, and decline infeasible or unsafe requests while preserving valid descriptive content.
  • Failure modes: Task Feasibility models may over-refuse by declining an unsupported action together with informational guidance they can provide textually.
  • Failure modes: Visual Inaccessibility models may omit answerable attributes or attribute uncertainty to unsupported causes such as blur, distance, or low resolution.
  • Failure modes: False Premise models may identify an incorrect premise but provide an inaccurate correction.
  • Judge analysis: GPT-5-mini disagreements with human judgments more often involve FAIL labels caused by stricter interpretations of secondary rubric requirements.

H Out-of-Distribution Evaluation

Out-of-distribution and transfer evaluations test whether selective non-compliance learned from KoNA persists across new image sources, prompting settings, training variants, and human-originated queries.

  • CC3M evaluation: The CC3M out-of-distribution split contains 750 instances, with 150 instances for each of the five task categories.It uses images distinct from the MS COCO and Open Images V7 sources used in the main benchmark.
  • CC3M evaluation: Base VLMs retain lower compound-query than single-query performance under the CC3M image-source shift, whereas KoNA-fine-tuned models maintain strong performance.The pattern suggests transfer beyond the original image sources.
  • In-context learning: Five-shot in-context learning uses one compound-query demonstration from each of the five task categories without evaluation-instance overlap.
  • In-context learning: KoNA-fine-tuned models remain the strongest configuration, while in-context learning provides modest gains for smaller models and larger models use examples more effectively.
  • Training ablation: The two-stage SFT+GRPO strategy achieves comparable or better non-compliance performance than SFT alone while improving fully answerable-query performance.The comparison controls for the total number of training instances.
  • Training ablation: Using fewer GRPO instances weakens both selective non-compliance and answerable-query performance, while adding more provides no consistent additional gains.The study therefore uses 100 GRPO instances as a balance between performance and training efficiency.
  • VizWiz transfer: KoNA tuning raises selective non-compliance rates from 0.32 to 0.72 for InternVL3-2B and from 0.39 to 0.73 for Qwen2.5-VL-3B on filtered human-originated VizWiz queries.These results apply to a subset selected for compound structure and partial unanswerability, not the full VizWiz-VQA distribution.
Loading 2609.04720v1…