PaperlayerView exact revision on arXiv

Source-linked AI summary

Token-Set Choice Confounds POPE: A Systematic Audit of Yes/No Extraction in VLM Hallucination Evaluation

Kesav Kumar Jayakumar, Karthigeyan Thilak

arXiv:2610.25964v2cs.CVcs.CL

TL;DR

The paper asks how POPE answer readouts affect hallucination-mitigation comparisons when published baselines do not state their readout. It audits token generation and alternative readouts, finding a 6.13-point adversarial F1 shift while leaving matched comparisons unresolved.

  • Problem

    Published comparisons are difficult to interpret because surveyed papers do not state which readout produced their baselines.

    Source: §1 · p. 2

  • Method

    The paper audits LLaVA-1.5-7B token outputs and readout effects, then organizes comparisons with published baselines and extends the audit to four additional VLMs.

    Source: §1 · p. 2

  • Results

    The readout alone shifts adversarial F1 by 6.13 points, exceeding the adversarial gain reported by five of six surveyed papers.

    Source: §1 · p. 2

  • Takeaways & Limitations

    Comparisons with published gains remain unresolved until readout and precision are matched.

    Source: §1 · p. 2

    The main audit uses one checkpoint at 4-bit NF4, so whether the 6.13-point shift holds at higher precision is unknown.

    Source: §7 · p. 8

Abstract

from arXiv · show

We set out to reproduce a recent hallucination-mitigation result on the POPE benchmark. The LLaVA-1.5-7B baseline we measured, 82.21 F1 on the adversarial split, sat 1.21 to 8.67 points above the adversarial baselines we planned to compare against (81.00, 79.30, and 73.54). We looked at the evaluation code and found a readout choice that moves F1 on its own. A two-token logit readout decides yes versus no by comparing two vocabulary IDs, 3582 ("yes") and 1217 ("no"). Across 9,000 greedy-decode questions spanning all three splits, neither ID is generated even once. The model emits " Yes" (token 3869) and " No" (token 1939), because SentencePiece prepends a space byte after the prompt suffix "ASSISTANT:". Read with an eight-token lookup that covers the space-prefixed surface forms, LLaVA-1.5-7B scores F1 0.8221, 0.8498, and 0.8713 on the adversarial, popular, and random splits. That 6.13-point adversarial shift exceeds the adversarial gain reported by five of the six papers we surveyed. None of them states its readout, and our reference ran under 4-bit NF4 quantization, so we cannot say how much of any reported gain a matched evaluation would keep. That comparison stays unresolved until readout and precision are matched. On the fixed baseline we run nine inference-time corrections of our own (none beat it) and dissect why the adversarial split resists logit-level intervention. In a 3,000-question probe, wrong predictions draw more image attention than correct ones (Cohen's $d=-0.46$, $p=1.4\times10^{-24}$), the opposite of what grounding-based corrections assume. A four-readout audit across four further VLMs from three tokenizer families confirms the confound is protocol-level, not model-specific: porting the LLaVA-1.5 IDs verbatim drops F1 to 0.00 on the two disjoint-vocabulary models, whereas a tokenizer-derived readout holds between 0.80 and 0.92.

1 Introduction

A reproduction of the LLaVA-1.5-7B POPE adversarial baseline surfaced a two-token readout choice that changes F1 without changing generated tokens. The paper audits the choice and explains why its effect leaves comparisons with published gains unresolved.

1 Introduction

  • The measured LLaVA-1.5-7B baseline is 82.21 F1 on POPE adversarial, above the planned comparison baselines of 73.54, 79.30, and 81.00.The reference ran in 4-bit on an NVIDIA RTX 3070 Ti.Source: §1 · p. 1
  • The 3582/1217 comparison uses IDs never generated in this context: the model instead emits space-prefixed ‘ Yes’ and ‘ No’ tokens.The prompt ends in ASSISTANT:, where the LLaMA-2 SentencePiece tokenizer prepends a whitespace byte to word-initial tokens.Source: §1 · pp. 1–2
  • The two-token readout gives adversarial F1 0.7608, while the eight-token rule reads the same predictions differently; the Figure 1 path shows how 924 ‘ No’ answers flip to yes.Those flips raise the yes-rate to 0.760 on a split that is 50% positive.Source: §1 · p. 2, Figure 1 · p. 2
  • The 6.13-point shift exceeds the adversarial gains reported by five of six surveyed papers, but their readouts are unstated and precision may differ from the 4-bit NF4 reference.The paper therefore leaves matched comparisons unresolved and does not estimate corrected gains.Source: §1 · p. 2
  • The paper organizes its audit around tokenizer behavior, comparability with published results, and extension to four additional VLMs.The nine inference-time corrections and attention probe are secondary findings.Source: §1 · p. 2

2 Background

The background defines POPE’s balanced yes/no task and distinguishes its dataset and metric from alternative answer readouts. It then explains how the LLaVA tokenizer and prompt template make evaluation protocol-sensitive.

2.1 The POPE benchmark

  • POPE asks whether a target object is present in an image, using random, popular, and adversarial negative sampling across three balanced 3,000-question splits.The adversarial split samples absent objects that co-occur with present objects.Source: §2.1 · p. 3
  • The paper distinguishes official POPE metrics, string parsing, a two-token logit readout, and an eight-token logit readout that includes forms emitted after ASSISTANT:.It does not claim the official benchmark mandates the two-token readout.Source: §2.1 · p. 3

2.2 LLaVA-1.5 and its tokenizer

  • LLaVA-1.5’s ASSISTANT: suffix puts the answer in mid-sentence position, where SentencePiece prepends a space and the model uses IDs 3869 (‘ Yes’) or 1939 (‘ No’).The vocabulary also has separate start-of-sentence and mid-sentence IDs for yes/no forms.Source: §2.2 · p. 3

2.3 Evaluation-protocol sensitivity

  • Protocol sensitivity is scoped to LLaMA-family tokenization, the ASSISTANT: template, and greedy decoding; string-parsing methods are not touched by the two-token readout.Methods inheriting the two-ID lookup are affected according to the share of negative examples answered ‘no’.Source: §2.3 · p. 3

3 The Token-Extraction Artifact

The audit records first-token outputs and paired readout decisions, showing that the two-token rule compares IDs the decoder never selects. Its consequences are quantified across protocols and expressed as a split-specific accounting identity.

3.1 Experimental setup

  • The full 9,000-question sweep took 76.3 minutes, or 0.508 seconds per question on the reported hardware.The experiment used 4-bit NF4, greedy generation with one new token, and logged each argmax token and readout decision.Source: §3.1 · pp. 3–4

3.2 What the model actually generates

  • Across all 9,000 questions, only tokens 3869 (‘ Yes’) and 1939 (‘ No’) appear as first tokens; IDs 3582 and 1217 are never argmax.The records retain neither excluded logit, though their difference’s sign tracks the emitted answer.Source: §3.2 · p. 4, Table 1 · p. 4

3.3 F1 under each protocol

  • On the adversarial split, the two-token readout reaches recall 0.9587 through a 0.760 yes-bias, while precision falls to 0.6307.The table compares both readouts on the same predictions.Source: §3.3 · p. 4, Table 2 · p. 4

3.4 The arithmetic in one line

  • The eight-token rule preserves generated decisions, while the two-token rule flips fractions of true-negative and false-negative ‘ No’ emissions, yielding a closed-form F1 gap.On adversarial, the observed rates ρN = 0.501 and φ = 0.810 reproduce F18 = 0.8221 and F12 = 0.7608; rates are counted separately by split and do not independently test the mechanism.Source: §3.4 · p. 5

4 Comparability with Published Results

Published POPE results cannot be compared directly with the audit because their readouts are unstated and the reference uses 4-bit NF4 quantization. The reported adversarial gains vary widely, while matched reruns are needed to separate protocol effects.

4 Comparability with Published Results

  • Because published papers omit readout details and may use higher precision, the table computes no gain against the 4-bit NF4 reference.Prompt format and decoding are additional possible sources of cross-paper baseline variation; matched reruns must fix and log readout and precision.Source: §4 · pp. 5–6
  • 6.13 points of adversarial F1 shift exceeds the reported gains of five of six surveyed papers; Tang et al. report +10.81.The table reports adversarial gains from +0.70 to +10.81, but does not assign a readout to any paper.Source: §4 · p. 5
  • The table reports adversarial baselines from 73.54 (Tang et al.) to 82.07 (Jana et al.), an 8.53-point spread on one frozen checkpoint.Tang, Seo, and Chen report baselines of 73.54, 79.30, and 81.00, respectively.Source: §4 · p. 5
  • Tang et al. [2025] report gains of +10.81, +10.56, and +8.01 on adversarial, popular, and random splits, from baselines of 73.54, 76.53, and 81.54.The papers do not state whether their gains share one readout and precision; the matched-protocol gain remains unknown.Source: §4 · p. 6

5 Multi-Model Validation

A four-readout audit across four additional VLMs finds that hard-coded LLaVA-1.5 token IDs fail on disjoint vocabularies, while tokenizer-derived single-token readout remains robust. String parsing also depends on reading the answer token from the correct position.

5 Multi-Model Validation

  • The audit tested four additional VLMs across three tokenizer families, with 9,000 questions per model over all three splits.Qwen2-VL used its native chat template; the other three models used the LLaVA-1.5 template.Source: §5 · p. 6
  • The tokenizer-derived dynamic_single readout stays between 0.80 and 0.92 F1 on every model and split, while legacy_8tok scores 0.00 on LLaVA-1.6-Mistral and Qwen2-VL.The two zero-score models have vocabularies that place no yes/no mass on the fixed LLaVA-1.5 IDs; the fixed set still works on the two LLaMA-family models.Source: §5 · pp. 6–7
  • String parsing matches dynamic_single to four decimals on LLaVA-1.6-Mistral, mPLUG-Owl2, and Qwen2-VL, but InstructBLIP collapses to the 0.6667 all-yes floor.For InstructBLIP, the harness text did not begin with the answer token, so parsing selected a yes/no substring from the wrong position; dynamic_single remains at 0.82 to 0.88.Source: §5 · p. 7

6 Practitioner Recommendations

The paper recommends verifying the first-token readout under each model-template pairing and making prediction-level behavior reproducible. Its proposed tokenizer-derived readout is designed to work across the audited tokenizer families.

6 Practitioner Recommendations

  • Use a tokenizer-derived single-token logit readout rather than a fixed token set; it depends on the logit vector, not generation-loop text.The recommended listing derives yes/no IDs from the model tokenizer and compares first-token max-logits across all five audited models.Source: §6 · p. 7
  • Log each question’s generated token ID and decoded string, and verify yes/no token sets under the exact prompt template.The ASSISTANT: suffix places the answer on the space-prefixed ‘ Yes’/‘ No’ forms, while different suffixes can shift first-token mass.Source: §6 · p. 7
  • Release prediction-level records so reviewers can recompute aggregate metrics and independently check the readout convention.String parsing is equivalent to the tokenizer-derived readout only when it reads exactly the first generated token.Source: §6 · p. 7
  • The recommended readout adds no generation cost beyond encoding four short strings once at setup.The code generates one token and compares the maximum logits for tokenizer-derived yes/no IDs.Source: §6 · p. 7

7 Limitations and Conclusion

The reported mismatch is a narrow comparison between two IDs that LLaVA-1.5-7B does not generate after the ASSISTANT: suffix, but it shifts adversarial F1 by 6.13 points. Cross-study comparisons remain unresolved without matched readout and precision, and the audit has limited scope.

7 Limitations and Conclusion

  • 6.13 points is the adversarial F1 shift from the readout change, but published gains cannot be corrected without knowing their readouts and matching precision.The reference ran under 4-bit NF4, and the authors estimate no corrected gains or claim that any method is broken.Source: §7 · pp. 7–8
  • The main audit uses one checkpoint at 4-bit NF4, so whether the shift persists at higher precision is unknown.The paper also confines its nine inference-time corrections to the adversarial split.Source: §7 · p. 8
  • The fixed eight-token set does not transfer across vocabularies; the diagnostic, rather than those specific IDs, is what carries to new models.The reported whitespace-prefix behavior is shared across LLaMA-family tokenizers, but the specific IDs differ by vocabulary.Source: §7 · p. 8

A Token ID Reference and Tokenizer Traces

The token reference distinguishes eight LLaMA-family yes/no IDs, but only the space-prefixed “ Yes” and “ No” IDs occur as first tokens in the runs.

A Token ID Reference and Tokenizer Traces

B Where the Mass Goes: Confusion Matrices and Convergence

The two-token protocol shifts adversarial POPE predictions toward yes, sharply increasing false positives relative to the eight-token rule. Its yes-rate also settles well above the ground-truth rate.

B Where the Mass Goes: Confusion Matrices and Convergence

  • 842 false positives under two tokens versus 182 under eight tokens, as 660 true-negative “ No” emissions flip to yes.The eight-token confusion matrix has TP 1,174, TN 1,318, FP 182, and FN 326.Source: B Where the Mass Goes: Confusion… · p. 10
  • Of 924 flipped emissions, 264 become true positives on borderline label-yes questions, while the 660 true-negative flips explain the false-positive increase.The passage attributes the resulting metric trade-off to lower precision and higher recall.Source: B Where the Mass Goes: Confusion… · p. 10
  • By question 600, the eight-token yes-rate settles at 0.452, near the 0.500 ground-truth rate, while the two-token rate settles at 0.760.Figure 4 extends the comparison across all three splits; Figure 5 plots first-token frequencies for all eight forms.Source: B Where the Mass Goes: Confusion… · p. 10
  • Figure 6 presents eight adversarial examples, with two samples for each confusion-matrix outcome under the eight-token rule.Source: B Where the Mass Goes: Confusion… · p. 10

C Full Derivation of the Protocol Gap

The derivation shows how comparing two logits the decoder never selects changes POPE decisions, and formalizes when a single-token logit readout agrees with parsing the greedy output. It also proposes a diagnostic for choosing token sets and reports that none of nine tested inference-time corrections improved the adversarial baseline.

C Full Derivation of the Protocol Gap

  • 0.7608 is the two-token adversarial F1 reconstructed exactly from the observed transition rates, versus the eight-token confusion matrix’s 1,174 TP, 1,318 TN, 182 FP, and 326 FN.The reconstructed two-token cells are TP 1,438, FP 842, FN 62, and TN 658; the 924 flips comprise 660 true negatives and 264 borderline true positives.Source: C Full Derivation of the Protocol Gap · pp. 11–12
  • Across the three splits, pooled fractions of ‘ No’ emissions read as yes are 924/1,644 = 0.562, 817/1,697 = 0.481, and 698/1,766 = 0.395, so rates must be counted per split.Applying adversarial rates to popular and random instead gives 0.7690 and 0.7761, rather than the eight-token values 0.8498 and 0.8713.Source: C Full Derivation of the Protocol Gap · pp. 13–14

D Formal Equivalence of String-Parse and Single-Token Readouts

  • For disjoint single-token yes/no sets, the logit readout equals parsing the greedy token when its argmax lies in either set, except for a tie across the sets resolved differently.The corollary notes that restricting the comparison to strict subsets can break this guarantee when the argmax is an excluded yes/no token.Source: D Formal Equivalence of String-Parse… · p. 14

E The Eight-Token Standard

  • For a new model-template pairing, the proposed eight-token procedure first samples 100 questions and adds any missing argmax token IDs to the yes/no sets.The fixed LLaMA-family token sets are context-dependent; the diagnostic is the part intended to port to new pairings.Source: E The Eight-Token Standard · p. 15

F Inference-Time Correction Experiments

F.1 Methods tested

  • The tested corrections comprise certainty, entropy, magnitude, feature-similarity, uniform-suppression, generation-midpoint, and VCD-noise approaches.The methods include CLIP-based signals and a contrastive second pass with Gaussian noise on the image embedding.Source: §F.1 · p. 16

F.2 Results

  • Every yes-suppression variant gained 1.5 to 6.0 precision points but lost 3.0 to 5.8 recall points, and none gained enough precision to offset the recall loss.Table 8 reports F1, precision, and recall for all nine variants.Source: §F.2 · p. 16, Table 8 · p. 16

F.3 Why the adversarial split resists correction

The nine tested inference-time corrections do not beat the corrected adversarial baseline. The section traces this resistance to weak or misaligned correctness signals and shows that token sets also diverge across models.

F.3 Why the adversarial split resists correction

  • The 3,000-question diagnostic records 2,490 correct and 510 wrong predictions, with two cases differing from the main sweep because of fp16 ties or near-ties.Its confusion counts are 1,173 TPs, 1,317 TNs, 183 FPs, and 327 FNs.Source: §F.3 · p. 16
  • None of the nine corrections crosses the adversarial baseline’s F1=0.8221 iso-curve.Every yes-suppression variant moves north and west of the baseline in precision-recall space.Source: Figure 7 · p. 17
  • CLIP-L similarity separates TPs from FPs by only 0.0132, a small but reliable margin that makes thresholding costly under the precision-recall tradeoff.The authors relate this pattern to adversarial negatives co-occurring with queried objects and CLIP’s encoding of co-occurrence statistics.Source: §F.3 · p. 17
  • Wrong predictions draw more image attention than correct ones: 0.0801 versus 0.0738, with Cohen’s d = −0.46.The 3,000-question diagnostic associates higher attention with wrong predictions, contrary to the grounding-gate assumption that more grounding means more correctness.Source: §F.3 · p. 17, Figure 8 · p. 18
  • The logit gap tracks confidence more than correctness: TP, TN, FN, and FP means are 2.066, 1.482, 0.962, and 0.700, respectively.Suppressing small-gap questions trades TPs for FNs and FPs for TNs at roughly offsetting rates; the net F1 effect was negative in these runs.Source: §F.3 · p. 17, Figure 9 · p. 18
  • The adversarial split’s co-occurring negatives make image evidence ambiguous, while the tested methods assume a separable correctness signal.The authors report no candidate decoding-step signal that escapes this dataset constraint; they expect suppression to fare better on easier splits.Source: §F.3 · pp. 17–18

G.1 Token-set divergence: the LLaVA-1.6-Mistral map

  • On LLaVA-1.6-Mistral, LLaMA-2 token IDs point to the wrong surface forms, and Mistral’s space-prefixed forms split into two tokens.Figure 10 distinguishes generated forms from valid-but-never-generated IDs and multi-token forms.Source: §G.1 · p. 18, Figure 10 · p. 19

G.2 Prompt-template robustness

The LLaVA-1.6-Mistral audit finds that tokenizer-derived readouts remain stable across two prompt templates, while transferring LLaVA-1.5 IDs fails. The paper leaves comparisons with surveyed results unresolved and gives diagnostic checks for readout trust and split-level errors.

G.2 Prompt-template robustness

  • Under both tested templates, LLaVA-1.6-Mistral generated only IDs 5592 (Yes) and 1770 (No); dynamic and string-parse readouts agree to four decimals, while the legacy eight-token readout is 0.The 0.8719 result is for the 500-question slice; on the full 3,000-question split, dynamic readout gives 0.8521.Source: §G.2 · p. 19, Table 11 · p. 20
  • Verification was not uniform across models: Qwen2-VL reproduced exactly, while InstructBLIP’s adversarial F1 differed by about 0.004 in a newer environment.The mPLUG-Owl2 random-split regeneration produced a degenerate all-yes output after a storage error; the reported metrics use one coherent environment.Source: §G.2 · pp. 19–20
  • The four space-prefixed Mistral surface forms tokenize to two tokens each and therefore cannot enter the dynamic single-token readout.Table 10 lists tokenizer-derived IDs for the model’s yes/no surface forms.Source: Table 10 · p. 20

H Literature Survey and Comparability

  • The surveyed comparison remains unresolved because no surveyed paper states its readout, and the reference uses 4-bit NF4 quantization.The reported adversarial baselines span 73.54 to 82.07, but readout, precision, prompt format, and decoding differences cannot be decomposed without matched reruns.Source: H Literature Survey and Comparability · pp. 20–21, Table 12 · p. 20

I Diagnostic Script and Per-Split Confusion Matrices

  • The diagnostic recommends adding any generated first-token ID missing from the active readout set before trusting that model-template pairing.The output JSON’s top_tokens_generated field lists first-token IDs by frequency.Source: I Diagnostic Script and Per-Split… · p. 21
  • Under eight-token evaluation, adversarial false positives are 12.1% (182/1500), roughly 4.2× the random-split rate of 2.9% (43/1500).The paper notes that this contrast is consistent with the co-occurrence design of adversarial negatives; Table 13 contains the full confusion matrices.Source: I Diagnostic Script and Per-Split… · p. 21, Table 13 · p. 21

Related papers

Loading 2610.25964v2…