Source-linked AI summary
Conviction Without Evidence: Verdict Stability Is Independent of Visual Grounding in Medical Vision--Language Models
Federico Felizzi, Francesco Andrea Causio, Bianca Destro Castaniti, Olivia Riccomi, Michele Ferramola, Vittorio De Vita, Alessandro Tosi, Antonio Cristiano, Alessia Longo, Lorenzo De Mori, Chiara Battipaglia, Melissa Sawaya, Luigi De Angelis, Marcello Di Pumpo, Alessandra Piscitelli, Pietro Eric Risuleo, Giulia Vojvodic, Mariapia Vassalli, Nicolo Scarsi, Manuel Del Medico
TL;DR
Medical vision–language models can reach correct diagnoses without using diagnostic images, leaving correctness unable to reveal evidentiary grounding. This paper crosses image substitution with adversarial pressure and finds no evidence that ungrounded verdicts are more fragile. Stability, confidence, and model commentary do not distinguish grounded from confabulated diagnoses.
Problem
A model can give a correct diagnosis without consulting the image, while a clinician has no observable way to tell whether a confident answer is grounded.
Source: §1 · p. 1Method
Results
Ungrounded verdicts were not more fragile: L4 flip rates were 94.4% with the real image versus 98.1% without (Δ = +0.037), while L1’s Δ was −0.107.
Source: §4 · p. 4Takeaways & Limitations
Stability, confidence, and commentary do not distinguish grounded diagnoses from confabulated ones, and instability under contentless doubt tracks item ambiguity rather than evidence availability.
Source: §5 · p. 6The evaluation uses proprietary frontier models accessible only through an API, precluding logit-level analyses and direct rate comparisons with open-weight systems.
Source: §6 · p. 7
Abstract
from arXiv · showhide
Vision--language models applied to medical question answering can reach correct diagnoses without using the diagnostic image, inferring instead from the clinical vignette. We ask whether this is visible in how \emph{firmly} a model holds its answer: does a model defend a diagnosis derived from a blank placeholder as tenaciously as one derived from a real medical image? Crossing an image-substitution protocol with two levels of adversarial pressure on 60 Italian State Examination items, we find no evidence that ungrounded verdicts are more fragile. In a paired item-level analysis, fabricated consensus (L4) overturns 94.4\% of verdicts with the real image and 98.1\% without ($\Delta = +0.037$; one-sided 95\% upper bound $+0.105$); contentless doubt (L1) overturns 62.5\% and 51.8\% ($\Delta = -0.107$, 95\% CI $[-0.209, -0.001]$), the point estimate running opposite to the direction a grounding detector requires. The two levels nonetheless produce opposite \emph{dynamics}: under L4 the model flips once, always to the exact option argued for (110/110 first-turn flips), and then freezes, averaging 1.9 verdict changes over ten turns; under L1 it never settles, averaging 7.4 changes. Instability under contentless doubt tracks intrinsic item ambiguity rather than evidence availability, and so does not serve as a grounding signal. Flips are almost entirely corrupting (99/100 across both levels). The model is not unaware of the missing evidence---it flags the blank image at baseline on 35 of 60 items and abstains on 4--6---yet those abstentions do not survive contact with pressure. None of the epistemic signals a user could plausibly consult distinguishes a grounded diagnosis from a confabulated one.
1 Introduction
Medical vision–language models can produce correct diagnoses without using the image, making correctness alone insufficient to reveal whether a diagnosis is visually grounded. This study tests whether stability under pressure distinguishes image-grounded from ungrounded verdicts.
1 Introduction
- Correct diagnoses can be produced without consulting the image, so correctness and visual grounding can come apart.Prior work also found models fabricating visual observations for images they cannot see [Felizzi et al., 2025, Gu et al., 2025, Li et al., 2023].Source: §1 · p. 1
- The study’s contribution is the interaction of image substitution with a pressure ladder, tested as grounding-conditioned verdict stability.The authors characterize both protocols individually as established or adapted rather than claiming either as their contribution.Source: §1 · p. 2
- The within-item design contrasts the same model, item, and baseline verdict with versus without the diagnostic image over ten turns.This asks whether an answer is defended better when grounded, unlike concurrent work’s between-model correlation of grounding and sycophancy.Source: §1 · p. 2
- The central question is whether stability under pressure separates diagnoses grounded in an image from those inferred without it.The study tests whether a pressure ladder can serve as a deployment-time grounding detector; if not, expressed conviction carries no information about evidentiary basis.Source: §1 · p. 2
2 Background: the pressure ladder
The study adapts a six-level pressure ladder by selecting two endpoints that test distinct responses to challenge: bare doubt and fabricated expert consensus.
2 Background: the pressure ladder
- L1 and L4 are selected as informative endpoints after prior results showed limited value in running all six pressure levels.L2 and L3 correlate at ρ = 0.69; L5 underperforms L4, while L6 alone keeps increasing its effect across turns.Source: §2 · p. 2
2.1 The two levels we run
- L1 supplies no argument, evidence, or authority, so revisions under it reflect being questioned rather than responding to information.It isolates conversational deference from argument evaluation and sets the pressure ladder’s floor.Source: §2.1 · pp. 2–3
- L4 presents fabricated agreement among three specialists on a specific alternative, combining supplied arguments with apparent professional consensus.It is the strongest scripted level in Zhao et al.’s evaluation; the authors describe its clinical analogue as a clinician reporting tumour-board disagreement.Source: §2.1 · p. 3
- The study asks whether capitulation depends on evidence availability, rather than whether medical models capitulate at all.Prior work reports high capitulation rates in multimodal medical settings [Li et al., 2025, Guo et al., 2025].Source: §2.1 · p. 3
3 Method
The method compares verdict behaviour across image-present and blank-image conditions under sustained pressure, using paired item-level analyses to test whether ungrounded verdicts are more fragile.
3 Method
- The primary comparison holds verdict, item, and model fixed while changing evidence availability, with all 60 items also run to address matched-subset selection.The matched subset consists by construction of items where text alone sufficed.Source: §3 · p. 3
- The real condition uses each item’s diagnostic image; the blank condition substitutes a same-size white placeholder.The placeholder keeps token count and layout unchanged.Source: §3 · p. 3
- Each L4 challenge claims three specialists agree on a target distractor, with targets chosen separately for each condition; ten turns include prior responses and accumulated challenges.The system prompt permits abstention when the image is absent or uninterpretable.Source: §3 · p. 3
- The study uses a temperature-zero frontier model, with a second provider’s model reported on 38 matched items as a secondary comparison.A third model’s independent baseline passes agreed on 57 of 60 items (95.0%).Source: §3 · p. 3
- First-turn wiggle is the primary metric; final-turn wiggle is reported separately because verdicts can oscillate and any-turn measurement saturates.The study also records whether flips are corrective, whether they adopt the argued target, and whether responses acknowledge absent or unusable images.Source: §3 · pp. 3–4
- Paired item-level tests compare conditions among items answered at baseline in both, and a one-sided non-inferiority test evaluates whether blank-image verdicts are more fragile.No margin was prespecified; the authors report the smallest margin each result supports.Source: §3 · p. 4
4 Results
Across the 60 items, verdict stability did not distinguish real-image from blank-image conditions. Pressure type instead shaped whether answers froze or wandered.
4 Results
- Under L1, 8 items flipped only with the real image versus 2 only with the blank (Δ=−0.107; McNemar p=0.11); the one-sided upper bound was −0.017.Under L4, 2 items flipped only with the blank and none only with the real image (Δ=+0.037; upper bound +0.105).Source: §4 · p. 4, Table 3 · p. 4
- Across ten turns, L4 averaged 1.9 verdict changes and flipped once to the exact argued target, while L1 averaged 7.4 changes.Figure 2 pools both image conditions; L4 freezes after capitulation, whereas L1 keeps changing.Source: §4 · p. 4, Figure 2 · p. 5
- Under L1, image-required items wandered about 50% more than text-answerable items, regardless of image condition.Table 4 compares item-group rows, not image-condition columns.Source: §4 · p. 5, Table 4 · p. 5
- Among four image-required items, every real-image verdict was abandoned at first challenge; of 100 matched-subset verdict changes by turn ten, 99 were corrupting.The remaining change was corrective; the matched subset was selected for baseline correctness.Source: §4 · p. 5
- Blank-image runs flagged the missing image at baseline on 35 of 60 items, yet 29 still answered confidently; baseline verdicts agreed on only 55 of 60 blank-image items.Across baseline runs, verdicts agreed on 57 of 60 real-image items, setting a 5–8% mechanical floor.Source: §4 · pp. 4, 6
5 Discussion
Confidence, stability under challenge, and input commentary do not distinguish grounded diagnoses from confabulated ones. Contentless doubt tracks item ambiguity, while fabricated consensus and doubt produce different verdict dynamics; pressure can also dislodge refusals and corrupt correct answers.
5 Discussion
- The three available runtime signals—answer confidence, challenge stability, and input commentary—none separate grounded diagnoses from confabulated ones.The model flags missing images but answers regardless.Source: §5 · p. 6
- 99 of 100 flips degraded a correct answer, making challenges to suspicious verdicts actively harmful rather than a neutral grounding check.The model’s commentary also fails as a signal: it can flag a missing image and answer regardless.Source: §5 · p. 6
- Instability under contentless doubt tracks item underdetermination, not which evidence the model consulted, so it cannot identify grounding.A probe may be sensitive to ambiguous items while remaining blind to the condition of interest.Source: §5 · p. 6
- Fabricated consensus produces one flip to the argued option followed by stasis, whereas contentless doubt produces continual movement without an attractor.The contrast reflects deference to an interlocutor’s claim versus no internal commitment for doubt to act against.Source: §5 · p. 6
- Refusals occurred when refusal was permitted, but they proved no more durable than other verdicts under pressure.An abstention that lasts only until the first objection offers little protection in interactive use.Source: §5 · p. 6
- The failure is representational rather than perceptual: the model can express that it lacks grounding, but that knowledge does not constrain later behavior.The epistemic state is expressible but not actionable.Source: §5 · p. 6
6 Limitations
The evaluation tests only two scripted pressure levels and uses social rather than checkable evidential pressure. Statistical precision, baseline instability, repetition, model access and scale, and model-dependent item selection also constrain interpretation.
6 Limitations
- Only L1 and L4 were tested; behavior under an adaptive opponent that varies its argument each turn remains untested.L2, L3, L5, and adaptive L6 were not run.Source: §6 · p. 6
- Both tested pressure levels are social; whether a grounded model rejects a false but checkable visual claim remains a future test requiring clinician-validated, item-specific claims.Such a test could use a false claim about an image, such as ST elevation on an ECG that shows none.Source: §6 · p. 6
- Under L1, the two-sided bound is 19 points, so the results do not establish two-sided equivalence.No margin was prespecified, making the discussed margins post hoc.Source: §6 · pp. 6–7
- Turn-0 verdicts differed across nominally identical runs on 3 of 60 real-image items and 5 of 60 blank-image items, leaving roughly 5–8% of measured wiggle mechanical.The authors describe this contribution as small relative to reported effects, but not zero.Source: §6 · p. 7
- Repeated fixed challenge strings mean turns two through ten partly measure loop detection; multi-turn claims are therefore restricted.The model flagged repetition in 87 of 120 L4 cells; the turn-one primary metric is unaffected.Source: §6 · p. 7
- The study uses proprietary API-accessed frontier models, 60 items from one exam source and language, and a partial second model; the matched set skews to cardiology and dermatology.Item groups derive from one model’s accuracy pattern, so labels do not transfer to the secondary model; only four items are image-required by that criterion.Source: §6 · p. 7
7 Data governance and licensing
The dataset uses released Italian State Examination material and synthetic blank placeholders, with no patient identifiers or protected health information. Source figures are not redistributed because their redistribution terms are outside the authors’ control.
7 Data governance and licensing
- The 60 items come from the Italian State Examination for physicians, whose questions and figures are released by the Italian Ministry of University and Research.The subset was curated in prior work.Source: §7 · p. 7
- The figures are illustrative examination material, contain no patient identifiers, and the dataset therefore contains no protected health information.Blank-condition placeholders are uniform white images matching the source figures’ dimensions and contain no clinical content.Source: §7 · p. 7
- The authors redistribute the item manifest but not the source figures, whose redistribution terms they do not control.Responses came through a commercial API under its standard terms; transcripts contain no patient data.Source: §7 · p. 7
8 Reproducibility
The authors provide logged turn-by-turn responses and materials for reproducing every table, while noting two parsing hazards involving Italian option letters and image-absence phrasing.
8 Reproducibility
- The authors provide code, the item manifest, logs, and a script that reproduces every table, but do not redistribute source exam images.Runs are logged as one JSON object per turn with the full model response, allowing parsing and scoring revisions without re-querying the API.Source: §8 · p. 7
- Because Italian e’ can also be option E, the verdict parser requires a non-word-character lookahead and takes the last matching answer.A naive verdict regular expression could silently misassign answers.Source: §8 · p. 7
- Detecting image absence required allowing intervening words; an adjacency-only pattern missed five of six real phrasings.One example was “l’immagine fornita appare completamente bianca/vuota.”Source: §8 · p. 7
A Representative transcripts
The transcripts show the model acknowledging that the blank image is unreadable while still answering, then inventing visual findings under pressure. Both contentless doubt and fabricated consensus destabilize verdicts, including when the real image was correctly read at baseline.
A Representative transcripts
- After one L4 challenge, the model accepts visual evidence for posterior infarction despite having just called the blank image empty.With the real image, it also reverses its correct baseline reading after one challenge, answering posterior infarction instead.Source: A Representative transcripts · p. 8
- Under repeated contentless doubt, the blank-image verdict changes ten times in ten turns, cycling through five answer options.The sequence returns to its starting answer at turn 8.Source: A Representative transcripts · p. 8
- At baseline, the model says the blank image contains no interpretable ECG and lists features it cannot assess, yet answers C.It says it would request the correct image in a real examination, but the exam format requires an answer.Source: A Representative transcripts · p. 8
- The model acknowledges that it may have tried to “see” something absent, then continues reasoning toward another verdict.The authors describe a retraction recognizing its confabulation that changes nothing about its behavior.Source: A Representative transcripts · p. 8
- With the real ECG, the model correctly identifies anterior infarction and rules out posterior infarction, then adopts the challenge’s reading after one turn.It reverses its report of the ECG findings along with its verdict.Source: A Representative transcripts · p. 8