PaperlayerView exact revision on arXiv

Source-linked AI summary

Encoded but Disconnected: Decomposing Vision-Language Model Failures under a Patching Null

Genpei Zhang

arXiv:2610.00024v1cs.CVcs.CLcs.LG

TL;DR

VLM failure research often reports aggregate hallucination rates, while the mechanisms of individual errors remain unresolved. This paper decomposes errors from model behavior and tests mid-layer signals across three architectures. Mid-layer answer encoding is common on POPE but is not causally active at the layer level under the reported patching test.

Abstract

from arXiv · show

Across three vision-language model architectures (LLaVA-1.5-7B, Qwen2.5-VL-7B, InternVL3-8B), we report a universal negative finding for mid-layer interpretability. On POPE -- the benchmark common to all three -- the mid layers encode the ground-truth answer in 68-91% of errors, yet this signal is not causally active for the final prediction: residual-stream patching yields 0% non-trivial flip at the layer level on all three architectures, and on two of three at the per-head level (Qwen: 0/12,600 patched forwards). The lone exception, InternVL3 layer-20 head-2, is a non-vocab, self-attending head whose effect is localized to that specific head (p < 1e-4). Despite the null, the errors separate operationally into three failure modes -- Perception Failure, Encoded-but-Disconnected, Prior-Override -- learnable above 60% on all three architectures, and the architecture's prior direction predicts which of two interventions elicits a category-specific response. We report these mitigation effects under oracle labels as evidence the categories are mechanistically real, not as a deployable method.

Introduction

The paper shifts VLM failure analysis from aggregate benchmark rates and uniform interventions to per-error mechanistic categories. Across three architectures, it finds widespread mid-layer answer encoding without layer-level causal patching effects, and reports category-specific intervention responses under oracle labels.

Introduction

  • The paper frames per-error analysis as an alternative to aggregate hallucination rates and uniform interventions, which may inconsistently address distinct failure modes.It evaluates three architectures and POPE, HallusionBench, and MMVP benchmark genres.Source: Introduction · p. 1
  • The decomposition asks whether visual evidence reaches the answer, whether mid-layers encode the ground truth, and whether the wrong answer follows the training prior.These observable tests partition errors into Perception Failure, Encoded-but-Disconnected, and Prior-Override.Source: Introduction · p. 1
  • On POPE, 68–91% of errors carry a mid-layer ground-truth top-1 hit despite a wrong final answer, while layer-level patching fails to flip predictions across three architectures.The per-head signal concentrates at one InternVL3 head, and intervention effects are measured under oracle category labels.Source: Introduction · pp. 1–2
  • Prior direction predicts which category-specific intervention elicits a response: prompt-debias for under-affirmative models and Re-Promote for over-affirmative LLaVA.The reported mitigation effects use oracle category labels.Source: Introduction · pp. 1–2
  • The three categories are separable from continuous mid-layer features above 60% on all three architectures.On LLaVA, those features add about 20 points over a prediction-direction baseline.Source: Introduction · p. 1

Related Work

Prior work measures VLM failures through aggregate benchmarks, probes internal representations, and applies decoding interventions uniformly. This paper distinguishes itself through per-sample failure classification, causal testing of mid-layer signals, and category-specific routing.

VLM hallucination phenomenology and benchmarks

  • POPE, MMVP, HallusionBench, MME, and MMStar surface aggregate failure rates, while this work classifies errors from the forward pass that produces them.Datta and Sundararaman (2025) measure hallucination through downstream metrics rather than per-error internal probes.Source: Related Work · p. 2

Mechanistic interpretability for vision–language models

  • The logit lens reads mid-layer states as final-layer predictions, while activation patching tests whether a localized representation contributes causally to a target prediction.The paper contrasts its per-sample categories with population-level decompositions by Xiong et al. (2026) and Hong and Quan (2026).Source: Related Work · p. 2
  • The paper adds a three-architecture patching study with a universal layer-level null and per-head nulls on two architectures, testing whether lens-accessible information is causally relevant.This causal-status test distinguishes the work from the concurrent tri-layer framework of Hong and Quan (2026).Source: Related Work · p. 2

Decoding-time mitigation and the gap our work fills

  • VCD, OPERA, M3ID, and DoLa use uniform decoding interventions, whereas Re-Promote uses a sweet-zone mid-layer and gates promotion by predicted failure category.VISTA also promotes uniformly; on LLaVA, oracle-gated promotion separates Encoded-but-Disconnected and Prior-Override flip rates, 85.9% versus 0%.Source: Related Work · p. 2
  • The proposed contribution is mechanism-aware routing: one forward pass classifies failure mode, and the classification predicts which prior-direction-appropriate intervention to apply.Operational distinctions from VCD, OPERA, M3ID, DoLa, and VISTA are detailed in Appendix I.Source: Related Work · p. 2

Method

The method defines answer encoding through a raw logit lens, assigns operational error categories from observable behavior, and tests causal relevance with cross-instance activation patching. It also trains a per-architecture classifier to route errors to category-specific interventions.

The Encoded Answer Signal (EAS)

  • The raw logit lens applies the model’s final layer normalization and unembedding to a mid-layer state, and EAS marks an error with a mid-layer ground-truth top-1 hit despite a wrong final prediction.EAS is a per-sample binary property of one forward pass.Source: The Encoded Answer Signal (EAS) · pp. 2–3
  • The sweet zone is selected on held-out correctly answered samples by maximizing aggregate mid-layer top-1 hit rate, with architecture-specific windows defining the EAS scan.The windows are layers 12–24 for LLaVA, 10–21 for Qwen, and 6–26 for InternVL3.Source: The Encoded Answer Signal (EAS) · p. 3

Three-Way Decomposition of Errors

  • Two binary observations—EAS status and whether the emitted token follows the empirical prior direction—assign mutually exclusive, exhaustive error classes.Prior-Override follows the prior; Encoded-but-Disconnected has EAS but a non-prior error; Perception Failure has neither EAS nor a prior-direction error.Source: Three-Way Decomposition of Errors · p. 3

Activation Patching Protocol

  • Cross-instance patching replaces an error sample’s residual stream with that of a correctly answered donor and counts a flip to the ground truth as success.The sweep varies layer and position, and also individual attention heads; strict label-level donor pairs exclude answer-transplant artifacts.Source: Activation Patching Protocol · p. 3

Per-Sample Classifier and Per-Class Mitigation

  • At inference, the predicted category selects prompt-debias for Prior-Override, mid-layer Re-Promote for Encoded-but-Disconnected, or no helpful intervention for Perception Failure.The algorithm obtains predictions and routing features in a single forward pass; the ground-truth correctness gate is diagnostic-only.Source: Activation Patching Protocol · p. 3, Per-Sample Classifier and Per-Class… · pp. 3–4
  • A per-architecture classifier uses 24-dimensional forward-pass features that exclude the token and EAS indicators defining the target labels.GBDT and logistic-regression variants are trained with five-fold cross-validation on weakly supervised error labels, without human annotation.Source: Per-Sample Classifier and Per-Class… · pp. 3–4

Experiments

Across three architectures, ground-truth answers often appear in mid-layer representations, but layer-level patching does not make those signals causally active for final predictions. The experiments also find separable failure categories and one localized InternVL3 head exception.

Phenomenology

  • On POPE errors, mid-layer top-1 hit rates were 74.5% for LLaVA, 91.0% for Qwen, and 68.5% for InternVL3; signal peaks at different relative depths.The reported peak bands are LLaVA layers 13–? (text is incomplete), Qwen 10–17, and InternVL3 18–21; architecture differs in where the answer crystallizes, not whether it does.Source: Phenomenology: EAS is large and… · p. 4

Classifier learnability

  • A 24-feature classifier reached 82.5% ± 3.8 (LLaVA), 68.0% ± 3.9 (Qwen), and 79.7% ± 3.2 (InternVL3) five-fold accuracy on the three failure labels.Features exclude label-defining indicators; the gain over prediction direction is large on LLaVA, while direction alone is already 93–94% on Qwen and InternVL3.Source: Classifier learnability and bimodal POPE · p. 4

POPE failure pattern

  • On POPE, pred-No errors were 95–100% EAS-positive while pred-Yes errors were below 5%, across five model-by-benchmark cells.The prediction-direction split is definitional; the distinguishing observation is that the two groups also differ in mid-layer signal.Source: Classifier learnability and bimodal POPE · p. 4

Causal null

  • 0/50 LLaVA and 0/44 Qwen layer-position tuples flipped above noise; InternVL3 reached at most 1/50, supporting a layer-level patching null across all three architectures.The maximum InternVL3 tuple was 2%, below the 5% decision threshold.Source: The causal null: mid-layer encoding is… · p. 4

InternVL3 exception

  • 26% (13/50) of InternVL3 L20 H2 last-text patches flipped predictions, with the same-layer H3 substitution producing 0% (0/50).The H2 effect was localized; the comparison with norm-matched random was borderline (p = 0.056).Source: L20 head 2 on InternVL3: causal but… · pp. 5–6, Figure 3 · p. 6
  • InternVL3 L20 H2 is non-vocabulary-encoding and self-attending, with 96.0% ± 2.1 of attention mass on its own last-text position.The head’s specificity is consistent with an architecture-specific aggregation step rather than a direct decoding pathway.Source: L20 head 2 on InternVL3: causal but… · pp. 5–6

Per-Category Intervention

The section routes each error category to an intervention chosen according to the model’s prior direction. Under oracle labels, the interventions produce class-conditional responses, but deployment net-accuracy gains remain unestablished.

Per-Category Intervention

  • The interventions target different stages: prompt-debias changes the input distribution, while mid-layer Re-Promote changes the decoding distribution.The section associates prior pressure with the input-side intervention and disconnected encoding with the decoding-side intervention.Source: Per-Category Intervention · p. 6
  • Table 2 reports per-category flip-rate counts of 0/51, 122/142, and 6/7 for LLaVA; 31/158, 0/24, and 0/18 for Qwen; and 19/89, 2/56, and 0/55 for InternVL3.The table says results are conditional on the operational label; Debias and Re-Promote rows use separate runs.Source: Table 2 · p. 6
  • Each architecture admits a category-targeted intervention with a flip rate well above its prior-aligned class, and the matching intervention is predicted by prior direction.These results use oracle category labels and are reported as class-conditional effects, not a deployable method.Source: Per-Category Intervention · pp. 6–7
  • LLaVA’s POPE errors are 74% EBD, while Qwen’s and InternVL3’s are 79% and 42% PO, respectively.The section links these different dominant failure modes to the architectures’ different matched interventions.Source: Per-Category Intervention · p. 7
  • Re-Promote is not specific to EBD: on LLaVA it leaves PO at 0% but also flips PF in 6/7 cases.PF is essentially absent in the LLaVA POPE classifier run, so the reported result does not change the POPE conclusion, but may matter where PF is common.Source: Per-Category Intervention · p. 7
  • Under-affirmative models respond to a positive-tone suffix by 17–20 points, while LLaVA responds to the negative-tone counterpart by 4 points on PO.The authors treat this asymmetry as a hypothesis because each direction used one length-unmatched suffix, leaving wording as an alternative explanation.Source: Per-Category Intervention · p. 7
  • Per-category flip rates condition on correct predicted labels, and the authors make no net-accuracy claim for applying one intervention benchmark-wide.Deployment gains would also depend on classifier precision and recall; converting the conditional effects into a net gain is left to future work.Source: Per-Category Intervention · p. 7

Discussion

The discussion distinguishes mid-layer answer encoding from causal influence on the final prediction. It presents a three-way failure decomposition and prior-aware interventions while limiting the scope of the causal null and the single-head exception.

Discussion

  • Mid-layer answers can be encoded without being emitted, but the layer-level encoding is correlational rather than causal; the only causal pathway found is a non-vocab, self-attending InternVL3 L20 H2 head.The reported per-head effect has no analog on the other two architectures, and the paper does not claim it generalizes.Source: Discussion · p. 7
  • The taxonomy is not exhaustive and need not transfer to non-binary tasks; the negative finding concerns standard residual-stream and per-head patching.The authors state that a finer-grained attribution or path-patching result reaching ≥15% flip at the encoding layer would reopen the causal claim.Source: Discussion · p. 7
  • The single-forward-pass decomposition separates Perception Failure, Encoded-but-Disconnected, and Prior-Override, and the paper reports a universal layer-level causal null across three backbones.The summary also identifies one architecture-specific exception, InternVL3 L20 H2, and a prior-direction-predicted intervention choice.Source: Discussion · p. 7

A Models, Datasets, and Compute

The experiments use three open-source vision–language models and report model, dataset, precision, and inference details. Total compute is approximately 46 A100-hour-equivalents.

A Models, Datasets, and Compute

  • The evaluation uses three open-source vision–language models, with model identifiers, dataset versions, precision, and empirical prior direction listed alongside.Inference uses sdpa attention except for InternVL3, which uses eager attention and bfloat16; fp16 produced NaN logits on that architecture.Source: A Models, Datasets, and Compute · p. 9
  • Disabling cuDNN due to a cluster-wide ptrace-related CUDA initialization bug had no measurable speed impact.The bug affected CUDA initialization on the CLIP vision encoder.Source: A Models, Datasets, and Compute · p. 9
  • Total experimental compute is approximately 46 A100-hour-equivalents, including main and ablation experiments.Diagnostic extraction accounts for approximately 43 A100h, while per-head sweeps and the L20 H2 sanity check add approximately 2 A100h; mitigation experiments use under 0.5 A100h.Source: A Models, Datasets, and Compute · p. 9

B Sweet-Zone Layer Selection

The EAS scan window is selected using held-out correctly answered samples, while a narrower peak band supports relative-depth statements.

B Sweet-Zone Layer Selection

  • The EAS scan window is the layer range checked for a mid-layer top-1 hit and is selected on a held-out audit of approximately 1,000 correctly answered samples per model.The audit is disjoint from the error sets used in the main-paper analyses.Source: B Sweet-Zone Layer Selection · p. 9
  • The selection criterion is the smallest contiguous range retaining at least 90% of the cross-layer top-1 hit rate on correct samples.The wider scan window is designed to make EAS insensitive to its exact edges.Source: B Sweet-Zone Layer Selection · p. 9
  • A narrower peak band within each scan window is used for relative-depth statements.The table reports both the scan window and peak band, along with each architecture’s language-model layer count.Source: B Sweet-Zone Layer Selection · p. 9

C Per-Head Patching: Full Sweep Details

Per-head patching was null across the Qwen sweep and yielded only a noise-level LLaVA result, while InternVL3 showed a localized effect at L20 H2.

C Per-Head Patching: Full Sweep Details

  • Qwen had 0 flips across 12,600 patched forwards; LLaVA’s single 1/32 tuple remained below the stated baseline confidence bound and was treated as noise.The Qwen sweep covered 21 layers, three positions, 32 heads, and about 50 strict pairs per tuple.Source: C Per-Head Patching: Full Sweep Details · p. 9
  • The L20 H2 sanity sweep used an independent 50-pair strict sample, distinct from the earlier sweep that first flagged the head at 13/50.The two samples account for the reported 26% and 32% baseline figures for this head.Source: C Per-Head Patching: Full Sweep Details · p. 9
  • InternVL3 L20 H2’s flip rate fell to 0/50 when substituting L20 H3 and to 6% with L19 H2, supporting a location-specific effect.The comparison with norm-matched Gaussian noise was borderline (p = 0.056), so the authors stop short of assigning a stronger mechanistic role.Source: C Per-Head Patching: Full Sweep Details · p. 9

D Classifier: Features, Class Proportions, and Accuracy

The classifier uses continuous mid-layer logit features to separate the operational error categories, whose prevalence varies by architecture. Cross-validated accuracy exceeds 60% on all three models, while controls and intervention tests qualify what the classifier and mitigations establish.

D Classifier: Features, Class Proportions, and Accuracy

  • The 24-dimensional feature vector combines sweet-zone and final-layer logits and margins from the prediction-producing forward pass, excluding label-defining bits and raw token identities.The selected layers are subsampled to keep the feature count fixed across architectures.Source: D Classifier: Features, Class… · p. 9, Table 6 · p. 11
  • On POPE, EBD comprised 74% of LLaVA errors, while Prior-Override comprised 79% of Qwen and 42% of InternVL3 errors.Perception Failure was absent for LLaVA, small for Qwen, and 50% for InternVL3; these proportions vary with the EAS scan window.Source: D Classifier: Features, Class… · p. 9, Table 7 · p. 11
  • 82.5% on LLaVA, 68.0% on Qwen, and 79.7% on InternVL3 were the logistic-regression cross-validated accuracies, each above 60%.Gradient boosting was within a few points and did not change the conclusion.Source: D Classifier: Features, Class… · p. 10
  • On LLaVA, continuous features raised accuracy over the prediction-direction bit from 62.5% to 82.5%, a 20-point gain; direction already strongly predicted labels on Qwen and InternVL3.The continuous features reached 68–82%, below the 100% oracle using both label-defining bits.Source: D Classifier: Features, Class… · pp. 10–11
  • Real features beat same-shape random features by 21–43 points on every architecture-classifier cell under the balanced margin-strength partition.With gradient boosting, real-feature accuracy was 66–76% versus 32–43% for random features.Source: D Classifier: Features, Class… · p. 11
  • At the selected LLaVA Re-Promote setting, EBD flips exceeded 85% while prior-aligned PO flips remained at 0%.The intervention also flipped 85.7% of the small PF group (6/7), so it targets non-prior-aligned errors rather than EBD alone.Source: E Mitigation: α Sensitivity and Prompts · p. 11
  • Prompt-debias was tested with one suffix per prior direction, and the suffixes differed in length and lexical strength, potentially affecting their asymmetric responses.A phrasing-matched suffix battery is left to future work.Source: E Mitigation: α Sensitivity and Prompts · p. 11

F Statistical Methodology

The analysis uses exact binomial intervals, Fisher’s exact test for the head sanity sweep, and fold-based uncertainty reporting for classifier accuracy.

F Statistical Methodology

  • Clopper–Pearson exact binomial intervals quantify per-pair flip rates and their 95% confidence intervals.The intervals are used for patching flip rates.Source: F Statistical Methodology · p. 11
  • Fisher’s exact test compares intervention variants in the L20 H2 sanity sweep, with exact p-values reported.Tests are two-sided unless otherwise noted.Source: F Statistical Methodology · p. 11
  • Classifier accuracy uncertainty is assessed across five stratified cross-validation folds; reported standard deviations are across folds, not bootstrap resamples.Bootstrap confidence intervals are computed over the five folds.Source: F Statistical Methodology · p. 11

G Datasets and Benchmarks

The appendices describe the evaluated benchmarks, formalize the metrics used to analyze errors and interventions, and contrast the paper’s conditional mitigations with uniform decoding-time baselines.

G Datasets and Benchmarks

  • POPE adversarial uses 1,500 binary object-presence questions; analyses use the first 200 errors per architecture, with negative-object co-occurrence designed to make language priors more likely to override visual evidence.Samples come from publicly released splits.Source: G Datasets and Benchmarks · pp. 11–12
  • The classifier uses stratified five-fold accuracy on the main PF/EBD/PO labels; controls compare label-defining bits, continuous features, and same-shape random features.The random-feature ablation instead uses a balanced margin-strength partition, explicitly not the main taxonomy.Source: Table 8 · p. 12, Table 9 · p. 12, Table 10 · p. 12
  • MMVP supplies 300 visually similar image pairs for LLaVA-only five-option discrimination, while HallusionBench has about 1,000 yes/no samples spanning visually entailed and hallucination-inducing questions.The pipeline uses the model output, ground truth, and same-pass hidden states without additional dataset-specific preprocessing.Source: G Datasets and Benchmarks · p. 12

H Metrics and Formal Definitions

  • EAS top-1 rate counts errors with a mid-layer top-1 ground-truth answer hit, while non-trivial patch flip rate counts successful final-answer changes across strict pairs.Strict pairs exclude the same-ground-truth donor artifact that can naturally imprint its label on a patched receiver.Source: H Metrics and Formal Definitions · pp. 12–13
  • Per-category intervention flip rate measures corrected predictions within a labeled error category; the reported category-conditional gap compares the target class with the prior-aligned class.The prior-aligned class is the reference because Re-Promote can also flip PF errors.Source: H Metrics and Formal Definitions · p. 13

I Decoding-Time Mitigation Baselines

  • Existing decoding-time baselines intervene uniformly, whereas this paper gates Re-Promote or prompt-debias on a predicted failure category; no controlled end-to-end numerical comparison is run.Re-Promote blends sweet-zone mid-layer predictions into final logits; prompt-debias acts on the input prompt.Source: I Decoding-Time Mitigation Baselines · p. 13
Loading 2610.00024v1…