Verification Mirage: Mapping the Reliability Boundary of Self-Verification in Medical VQA

Deploying vision-language models (VLMs) in clinical settings demands auditable behavior under realistic failure conditions, yet the failure landscape of frontier VLMs on specialized medical inputs is poorly characterized. We audit five recent frontier and grounding-aware VLMs (Gemini2.5Pro, GPT-5, o3, GLM-4.5V, Qwen2.5VL) on Medical VQA along two trust-relevant axes. Perception: all models localize anatomical and pathological targets poorly -- the best model reaches only 0.23 mean IoU and 19.1% Acc@0.5 -- and exhibit clinically dangerous laterality confusion. Pipeline integration: a self-grounding pipeline, where the same model localizes then answers, degrades VQA accuracy for every model -- driven by both inaccurate localization and format-compliance failures under the two-step prompt (parse failure rises to 70%--99% for Gemini and GPT-5 on VQA-RAD). Replacing predicted boxes with ground-truth annotations recovers and improves VQA accuracy, consistent with the failure residing in the perception module rather than in the decomposition itself. These observational findings identify grounding quality as a primary trustworthiness bottleneck in our SLAKE bounding-box setting. As a complementary fine-tuning follow-up, supervised fine-tuning of Qwen2.5VL on combined Med-VQA training data attains the highest reported SLAKE open-ended recall (85.5%) among comparable methods, suggesting that the VQA-level gap is tractable with domain adaptation; whether this also closes the perception/trustworthiness bottleneck is left to future work.

Medical vision--language models (VLMs) are usually evaluated on intact image--question pairs, but trustworthy clinical use requires a stronger property: a model must recognise when the evidential basis for an answer has failed. We study this through silent failures under perturbed evidence, where a vision-required medical question is paired with a false premise, wording perturbation, knowledge-only rewrite, or ROI-corrupted image, yet the model returns a fluent non-refusal answer. We introduce medvigil, a 300-case evaluation suite drawn from four public medical VQA sources, supervised end to end by four board-certified radiologists: every gold answer, refusal option, candidate-answer set, paraphrase, false-premise trap, ROI box, and clinical risk tier is clinician-authored. Two attending radiologists annotate every case in parallel, a senior radiologist consolidates the released manifest, and a separate fourth radiologist independent of construction answers every probe to provide the human reference baseline. The release contains 2556 MCQ probes, 240 counterfactual triplets, physician-adjudicated risk-tier and answerability flags, ROI boxes, and a paired open-ended variant. We report seven correctness-conditioned audit metrics that summarise into the medvigil Composite Score (MCS), and audit 16 vision-capable models plus two text-only baselines. The independent radiologist scores MCS 83.3 at silent-failure rate 5.8%, leaving a 14.1-point composite headroom above the strongest audited model (Claude Opus 4.7 at 69.2). The benchmark and evaluation harness are publicly released.

Verifier reliability is not portable across tasks. A verifier-guided self-DPO pipeline with genuine held-out gains on MathVista (+9.6 points on self-training data, +8.0 held out) can be harmful on MMMU. The failure is invisible from the target-task self-training signal: over six learner-verifier configurations, MMMU self-training performance still improves by +3.52 points while held-out performance drops by 1.42 points. We call this silent negative transfer: a verifier validated as useful before can still show signatures of successful self-training after its induced update stops transferring to unseen data. Downstream failure alone cannot diagnose this: poor generalization may mean the verifier induces a wrong learning direction, or that the correct direction itself does not generalize beyond the self-training distribution. We separate these effects via gradient fidelity F, the alignment between verifier-induced and correct training directions, and gradient transferability T, the alignment between correct and held-out directions, giving a conservative Safe-Transfer Margin: positive first-order held-out alignment is certified when arccos(F) + arccos(T) < pi/2. We then introduce Asymmetric Acceptance Gating (AAG), a precision-first filter selecting preference pairs by the verifier's absolute confidence in the response receiving the positive update. On MMMU, AAG raises fidelity from 0.29 to 0.42. In a same-cell analysis, the correct direction stays positively aligned with the held-out direction (T = 0.31), yet raw verification rotates the induced update to negative held-out alignment (-0.13); AAG restores positive alignment (+0.22). Across all six MMMU configurations, AAG beats raw verifier-guided training. Verifier reliability thus means not that it worked before, but that it induces the right update on the task at hand and that this update stays useful beyond the data that generated it.