Neural Uncertainty Principle: A Unified View of Adversarial Fragility and LLM Hallucination

Dong-Xiao Zhang; Hu Lou; Jun-Jie Zhang; Jun Zhu; Deyu Meng

cs.LGMar 20, 2026

Neural Uncertainty Principle: A Unified View of Adversarial Fragility and LLM Hallucination

Authors: Dong-Xiao Zhang, Hu Lou, Jun-Jie Zhang, Jun Zhu, Deyu Meng

Organizations: Northwest Institute of Nuclear Technology, Xi’an, Shaanxi 710024, China. · Department of Computer Science and Technology, Institute for AI, BNRist Center, THBI Lab, Tsinghua-Bosch Joint Center for ML, Tsinghua University, Beijing 10084, China · the School of Mathematics and Statistics and the Ministry of Education Key Lab of Intelligent Networks and Network Security, Xi’an Jiaotong University, Xi’an, Shaanxi 710049, China.

Abstract

Adversarial vulnerability in vision and hallucination in large language models are conventionally viewed as separate problems, each addressed with modality-specific patches. This study first reveals that they share a common geometric origin: the input and its loss gradient are conjugate observables subject to an irreducible uncertainty bound. Formalizing a Neural Uncertainty Principle (NUP) under a loss-induced state, we find that in near-bound regimes, further compression must be accompanied by increased sensitivity dispersion (adversarial fragility), while weak prompt-gradient coupling leaves generation under-constrained (hallucination). Crucially, this bound is modulated by an input-gradient correlation channel, captured by a specifically designed single-backward probe. In vision, masking highly coupled components improves robustness without costly adversarial training; in language, the same prefill-stage probe detects hallucination risk before generating any answer tokens. NUP thus turns two seemingly separate failure taxonomies into a shared uncertainty-budget view and provides a principled lens for reliability analysis. Guided by this NUP theory, we propose ConjMask (masking high-contribution input components) and LogitReg (logit-side regularization) to improve robustness without adversarial training, and use the probe as a decoding-free risk signal for LLMs, enabling hallucination detection and prompt selection. NUP thus provides a unified, practical framework for diagnosing and mitigating boundary anomalies across perception and generation tasks.

Figures & tables

Fig. 1: Illustration of the Neural Uncertainty Principle (NUP) in the $(\Delta\hat{m}_{u}^{\star},\Delta\hat{p}_{u})$ plane. Here $\Delta\hat{m}_{u}^{\star}$ is the minimum dispersion achievable by a mixed observable $\hat{m}_{u}(\lambda)=\hat{x}_{u}+\lambda\hat{p}_{u}$ , and $\Delta\hat{p}_{u}$ is the dispersion of the conjugate operator $\hat{p}_{u}$ under the loss-phase (boundary-emphasized) state. NUP implies the forbidden region $\Delta\hat{m}_{u}^{\star}\Delta\hat{p}_{u}<\tfrac{1}{2}$ . Vision boundary-stress concentrates toward the upper-left (small $\Delta\hat{m}_{u}^{\star}$ , large $\Delta\hat{p}_{u}$ ), whereas LLM under-conditioning / hallucination occupies a larger region away from the uncertainty boundary (large $\Delta\hat{m}_{u}^{\star}$ , uncontrolled $\Delta\hat{p}_{u}$ ). Reliable behavior lies in an intermediate “Goldilocks” band where neither term is extreme. Note. Strictly speaking, $\Delta\hat{m}_{u}^{\star}$ and $\Delta\hat{p}_{u}$ denote the dispersions of the operators $\hat{m}_{u}$ and $\hat{p}_{u}$ under the loss-induced state (hence the “hat” notation at the operator level). In the figure, to emphasize the phase-plane geometry and the experimentally observable quantities, we plot numerical estimates of these dispersions. We therefore omit the hats in the figure labels for notational simplicity; the plotted quantities correspond one-to-one to $\Delta\hat{m}_{u}^{\star}$ and $\Delta\hat{p}_{u}$ as defined in the equations.

Fig. 2: Evolution of the CC-Probe and accuracy during training. We plot evaluation accuracy (red, right axis) and the mean absolute input–gradient cosine

\bar{c}_{\text{img}}

(left axis; Eq. ( 33 )), computed on the held-out evaluation split every 10 epochs and reported separately for correctly classified versus misclassified samples (green vs. blue). Gradients are taken w.r.t. the standard cross-entropy loss using the ground-truth label. (a) CIFAR-10 (ResNet-18, DenseNet-121, ViT-Tiny, EfficientNet-B0). (b) Tiny-ImageNet-200 (ResNet-50, DenseNet-121, EfficientNet-B4, Swin-Tiny).

Fig. 3: Effect of gradient-aligned perturbations on accuracy and

\bar{c}_{\text{img}}

. We evaluate ResNet-18, ViT-Tiny, and Vim-Tiny on CIFAR-10 and ImageNet-100. Left column: accuracy; right column:

\bar{c}_{\text{img}}

. We compare Clean , +FGSM and –FGSM across perturbation levels

\epsilon

(see Supplementary Material for exact values).

Model	Method	Clean	PGD-20	APGD-CE	APGD-DLR	Timing (Sec. $\times$ 200)
ResNet-18	Base	91.52	0.01	0.02	0.10	–
	TRADES-PGD	74.57	44.14	43.92	42.27	$\sim$ 100
	ConjMask (Exp. 3)	85.27	77.55	77.02	1.28	$\sim$ 20
	ConjMask+LogitReg (Exp. 4)	87.64	62.71	36.92	43.29	$\sim$ 30
ViT-Tiny	Base	84.10	0.01	0.01	0.02	–
	TRADES-PGD	71.95	32.95	32.46	35.51	$\sim$ 120

TABLE I: Robust accuracy (%) under

L_{\infty}

attacks at

\epsilon=8/255

on CIFAR-10. Attacks: PGD-20, Auto-PGD with CE loss (APGD-CE), Auto-PGD with DLR loss (APGD-DLR). We use APGD-CE/APGD-DLR as objective-specific stress tests (components of AutoAttack), rather than claiming evaluation under the full AutoAttack suite. Timing is reported as provided (seconds

\times 200

), otherwise “–”. Results illustrate NUP-predicted, objective-specific shifts; interventions are demonstrations (not tuned for standardized leaderboard performance). TRADES-PGD is shown only as a reference.

Metric	AUROC Mean	95% CI	Interpretation
Strict Consensus ( $P_{\text{vote}}=1.0$ vs. Clean)
Risk-Cos (Ours)	0.6939	[0.58, 0.79]	Informative
Risk-Margin	0.6850	[0.57, 0.79]	Informative
Risk-Entropy	0.5323	[0.44, 0.63]	Near chance
Risk-Loss	0.3508	[0.25, 0.46]	Anti-correlated
Relaxed Consensus ( $P_{\text{vote}}\geq 0.8$ )

TABLE II: AUROC of prefill-stage hallucination risk signals on Benchmark-500. All metrics are computed without generating any answer tokens (prefill only). Risk-Cos (ours) and Risk-Margin are informative, while prompt-level entropy and NLL are weak under this constraint.

Prefill Risk Score	Top-1 Hit Rate $\uparrow$	Mean Regret $\downarrow$
Risk-Cos (ours)	0.83	0.433
Risk-Margin	0.81	0.591
Risk-Loss (NLL)	0.78	0.615
Risk-Entropy	0.77	0.636

TABLE III: Prefill-only prompt selection results on Perturbation-100 . For each five-prompt cluster, the prompt with the lowest predicted prefill risk is selected before decoding. Risk-Cos achieves the highest Top-1 Hit Rate and the lowest Mean Regret among all compared methods.

	Saturation / Boundary-stress (Vision)	Slack / Under-conditioning (LLM)
NUP mechanism	$\ \|\rho\|\uparrow\Rightarrow\sqrt{1-\rho^{2}}\downarrow\Rightarrow V\downarrow\$ (tight, near-bound)	$\ \|\rho\|\downarrow\ (\to 0)\Rightarrow\sqrt{1-\rho^{2}}\uparrow\Rightarrow V\uparrow\$ (loose, high slack)
Probe signal	high $\|\cos(x,p)\|$	low $\|\cos(\bar{x},\bar{p})\|$
Observed symptom	misclassification & adversarial fragility	higher hallucination risk
Actionable interventions	ConjMask + LogitReg	Prefill Risk Scoring + Prompt Screening/Selection

TABLE IV: Two regimes from the NUP. The NUP constrains an effective conjugate volume

V=\Delta x\,\Delta p\,\sqrt{1-\rho^{2}}\geq\kappa

, where

\rho

is the operator correlation between

\hat{x}_{u}

and

\hat{p}_{u}

in the RS inequality. Empirically, we diagnose the input–gradient coupling channel entering

\rho

using the CC-Probe: in vision we use

|\cos(x,p)|

(inputs are normalized), while in LLM prompting we use the centered

|\cos(\bar{x},\bar{p})|

Appendix figures & tables5 assets

Supplementary material from the paper’s appendix.

Appendix

Exp.	Task	Dataset	Architecture & Adaptations	Optimizer	Epochs / Batch Size	LR / WD	Key Configuration
1	Diagnostic: Correlation Dynamics	CIFAR-10 ( $32{\times}32$ )	ResNet-18, DenseNet-121: Stem $7{\times}7,s{=}2\rightarrow 3{\times}3,s{=}1$ . EffNet-B0: stem stride $2\rightarrow 1$ , first MBConv dw-stride $\rightarrow 1$ . ViT-Tiny: patch size $16{\times}16\rightarrow 4{\times}4$ .	AdamW + CosineAnnealingLR	200 (300 for EffNet-B0) 512	$1\times 10^{-3}$ $1\times 10^{-4}$	Tracks $\bar{c}_{\text{img}}$ every 10 epochs on held-out data. Compares clean-correct vs. clean-incorrect samples using gradients w.r.t. normalized inputs.
1	Diagnostic: Correlation Dynamics	Tiny-ImageNet-200 ( $64{\times}64$ )	ResNet-50: stem $7{\times}7\rightarrow 3{\times}3$ , remove MaxPool. DenseNet-121: stem $7{\times}7\rightarrow 3{\times}3$ , remove pool0. EffNet-B4, Swin-Tiny: ImageNet-pretrained; the released Exp. 1 notebooks instantiate the active dataloaders at native $64{\times}64$ resolution (not an active $224{\times}224$ pipeline).	AdamW + CosineAnnealingLR	200 256	$1\times 10^{-3}$ $1\times 10^{-4}$ (most) $5\times 10^{-2}$ (Swin)	Validates cross-architecture and cross-dataset consistency. Same probe schedule ( $K{=}10$ ) on the official validation split.
2	Diagnostic: Signed-FGSM Intervention (IFA)	CIFAR-10 ( $32{\times}32$ )	ResNet-18: modified stem, FC $\rightarrow 10$ . ViT-Tiny: vit_tiny_patch4_32 . Vim-Tiny: vim_tiny_patch4_32 .	AdamW + CosineAnnealingLR	201 64	$1\times 10^{-3}$ $1\times 10^{-4}$	FGSM attack with $\epsilon_{\text{train}}=8/255$ ; final runs use no mixup. Evaluation sweeps signed FGSM magnitudes and reports accuracy plus cosine statistics by clean correctness.
2	Diagnostic: Signed-FGSM Intervention (IFA)	ImageNet-100 ( $224{\times}224$ )	ResNet-18: modified stem, FC $\rightarrow 100$ . ViT-Tiny: vit_tiny_patch16_224 . Vim-Tiny: Vim-Tiny (patch16, 224) .	AdamW + CosineAnnealingLR	201 128	$5\times 10^{-4}$ $1\times 10^{-4}$	Same FGSM attack setting as CIFAR-10. Validation-time signed-FGSM sweeps evaluate intervention effects across perturbation directions and magnitudes.
3	Robustness: Mask-Only Training	CIFAR-10 ( $32{\times}32$ )	ResNet-18: modified stem, FC $\rightarrow 10$ . ViT-Tiny: vit_tiny_patch4_32 . EfficientNet-B0: stem stride $2\rightarrow 1$ , first MBConv dw-stride $\rightarrow 1$ .	AdamW + warmup cosine	201 64	ResNet-18 / EffNet-B0: $1\times 10^{-3}$ / $1\times 10^{-4}$ ViT-Tiny: $5\times 10^{-4}$ / $5\times 10^{-2}$	Initialized from clean checkpoints. Uses mask_pelnaty_ablation with --no_logits_loss and --no_random_loss , i.e., $\mathcal{L}=\mathcal{L}_{\text{mask}}$ only. The released run commands use ratio_base =0.25 for ResNet-18 / EfficientNet-B0 and ratio_base =0.85 for ViT-Tiny.
4	Robustness: Mask + LogitReg	CIFAR-10 ( $32{\times}32$ )	Same architectures as Exp. 3: ViT-Tiny , ResNet-18 , and EfficientNet-B0 .	AdamW + warmup cosine	201 64	ResNet-18 / EffNet-B0: $1\times 10^{-3}$ / $1\times 10^{-4}$ ViT-Tiny: $5\times 10^{-4}$ / $5\times 10^{-2}$	Initialized from clean checkpoints. Uses mask_pelnaty_ablation with both logits_loss and random_loss . All runs share the same masking operator as Exp. 3. Use the centered-logit variance penalty on clean and masked logits, together with KL consistency to a per-sample mean-baseline auxiliary view. The consistency branch is enabled after epoch $5$ . The released run commands use ratio_base =0.25 for ResNet-18 / EfficientNet-B0 and ratio_base =0.85 for ViT-Tiny.

Appendix

TABLE II : Experimental Protocols (Exp. 1–Exp. 6). This table summarizes the protocols across diagnostic (Exp. 1–2), mitigation (Exp. 3–4), and LLM application (Exp. 5–6) experiments. Standard Random Crop and Horizontal Flip are used in vision training unless otherwise specified.

k

=kernel size,

s

=stride; “Stem” denotes the first convolutional layer. The LR / WD column reports learning rate and weight decay. Unless otherwise noted, experiments follow the released-script seeds (Exp. 2 uses the parser default seed

=0

; Exps. 1,3–6 use seed

=42

). Exp. 3 and Exp. 4 are summarized to match the released mask_train.py implementation; launcher artifacts should be interpreted with care.

Panel of Figure 14 — Fig. 1 : Benchmark-500 Samples. A subset of 10 examples from the constructed dataset covering algebra, calculus, and probability. The full dataset contains 500 such problems designed to test the model’s reasoning stability.

Panel of Figure 15 — Fig. 2 : Evaluation Taxonomy. A condensed view of the system prompt used by the judge panel. It explicitly distinguishes between semantic drift, conceptual clarification, and narrow hallucinations, while also requiring the judge to diagnose potential reasons for inter-annotator disagreement.

Panel of Figure 16 — Fig. 3 : Semantically Equivalent Prompt Variants. Two examples from Perturbation-100. The task is to identify which specific phrasing maximizes response faithfulness using only prompt-side signals, without generating the answers first.

Architecture	Clean Accuracy (%)		FGSM Robustness (%)
Architecture	Baseline	LCR (Ours)	Baseline	LCR (Ours)
ResNet-18	92.12	88.35 (-3.77)	6.84	29.14 (+22.30)
DenseNet-121	90.39	85.88 (-4.51)	8.10	13.71 (+5.61)
ViT-Tiny	81.14	80.45 (-0.69)	4.39	8.81 (+4.42)

Appendix

TABLE III : Evaluation of Latent Conjugate Regularization (LCR). Unlike Adversarial Training (AT) [ 14 ] , our method uses zero adversarial examples during optimization.

Hallucination in Language Models

Hallucination in language models studies how systems produce unsupported or false claims and how to detect, explain, and reduce them.

See all 254 papers

Risk-aware Selective Prompting for Hallucination Mitigation in Large Vision-Language Models
May 27, 2026Yuang Huang, Yafeng Zhang, Yu ZilanVision-Language Models Hallucination in Language Models
Shanghai Jiao Tong University · iFLYTEK · Tsinghua University
Adversarial Orthogonal Disentanglement for LVLM Hallucination Mitigation
May 25, 2026Ruoxi Cheng, Haoxuan Ma, Zhengfei Hai +6Adversarial Representation Learning Vision-Language Models
Fudan University · Tencent · Nanjing University +3
UHP Detection: LVLMs have their Unique Hallucination Pattern in the Consistency Space
Aug 4, 2026Amir Mohammad Ezzati, Kiyan Rezaee, Bardiya Kariminia +4Hallucination Detection in VLMs Vision-Language Models
Sharif University of Technology · Michigan State University · Shahid Beheshti University +2

May 27, 2026J/K move · Enter open · S save

Risk-aware Selective Prompting for Hallucination Mitigation in Large Vision-Language Models

Yuang Huang, Yafeng Zhang, Yu Zilan

Shanghai Jiao Tong University · iFLYTEK · Tsinghua University

Vision-Language Models Hallucination in Language Models VLM Hallucination Large Vision-Language Models VLM Hallucination Mitigation

Open paper AskPDF arXiv

Prompt-based verification is widely used to mitigate hallucinations in large vision-language models (LVLMs), yet when it helps remains poorly understood. We systematically study verification prompting across two representative LVLM architectures and hallucination benchmarks, and find that it is a risk-bearing intervention: its corrections increase with input difficulty, while newly introduced errors persist across difficulty levels. As a result, always-on prompting helps on hard inputs but offers little benefit -- and can harm -- easier ones. Our analysis further shows that this behavior is associated with a conservative output shift. Verification prompts redistribute attention from visual tokens toward instruction tokens and induce a distinct middle-layer entropy pattern absent in a neutral-prompt control, suggesting instruction-conditioned attention redistribution rather than uniformly improved visual grounding. Motivated by this input-dependent risk, we propose Risk-aware Selective Prompting (RSP), a training-free approach that uses pre-generation uncertainty signals to trigger verification selectively. RSP mitigates the degradation of always-on prompting while preserving baseline performance, and reveals that effective selection signals vary across architectures.

Abstract

Hallucination in Language Models

Explore similar work

Risk-aware Selective Prompting for Hallucination Mitigation in Large Vision-Language Models

Adversarial Orthogonal Disentanglement for LVLM Hallucination Mitigation

UHP Detection: LVLMs have their Unique Hallucination Pattern in the Consistency Space