Beyond the Verdict: Evidence-Aligned Evaluation of Visual Prompt-Injection Guardrails

Suyoung Lee; Myungsub Choi

cs.CVSep 2, 2026

Beyond the Verdict: Evidence-Aligned Evaluation of Visual Prompt-Injection Guardrails

Authors: Suyoung Lee, Myungsub Choi

Organizations: Tynapse, Seoul, Republic of Korea

Abstract

Verdict-only evaluation does not reveal whether a vision-language model (VLM) used the visual evidence that should support its decision. We study this problem in web-agent guardrails, where a VLM judges whether on-screen text conflicts with a user instruction. We introduce Mind2Web-Injection, a benchmark of 9,954 instruction-screenshot pairs with instruction-relative labels, pixel-exact evidence boxes, and matched image-side counterfactuals. Across six VLMs, two models with nearly identical average precision differ ninefold in Evidence-Aligned Detection (EAD), the fraction of attacks both detected and correctly localized. To test whether a verdict depends on the command cited as evidence, we replace the instruction with one that endorses that command. Qwen3-VL-32B, the strongest open-weight localizer, returns aligned in only 58.7% of cases, whereas GPT-5.6-luna does so in 99.9%. To diagnose these failures, we propose two training-free interventions. ReadGate improves grounding without changing verdicts, while CmdCompare tests whether explicit instruction-command comparison resolves instruction-side inconsistency. These results motivate reporting verdict correctness, evidence localization, and counterfactual responsiveness separately.

Figures & tables

Figure 1: Same prompt, correct verdicts, different evidence. The panels show different samples and models evaluated with the same guardrail prompt: given a user instruction and screenshot, decide whether on-image text diverts the task and localize the responsible span. Left, Qwen3-VL-8B correctly predicts divergent and localizes the injected command. Right, Llama-4-Scout also predicts divergent correctly but localizes unrelated page imagery, missing the injected command marked in dashed green. The examples are illustrative; aggregate detection AP is nearly identical (0.752 vs. 0.751), whereas EAD 0.3 differs ninefold (0.426 vs. 0.047).

Panel of Figure 2 — Figure 2: Mind2Web-Injection construction. A real screenshot $I$ is (1) transcribed by OCR; (2) turned into benign instructions $T$ grounded in the OCR text; (3) paired with three style-matched injection candidates; and (4) composited by a large VLM at a model-chosen location, which fixes the exact evidence box $b$ .

Panel of Figure 3 — Figure 3: ReadGate . The model’s own regressed box $\hat{b}$ is drawn on the crop and the model is asked to transcribe the text inside it, without being shown the target. If the transcription matches the quoted evidence $\hat{q}$ (fuzzy match), $\hat{b}$ is trusted and kept; otherwise the box is rebuilt by hierarchical patch selection and a local OCR snap. The verdict $\hat{y}$ is never touched, so detection is unchanged.

Panel of Figure 4 — Figure 4: CmdCompare . An instruction-blind visual scan first supplies a quoted candidate $\hat{q}$ . A text-only call reduces $\hat{q}$ to one imperative command $B$ without seeing $T$ ; a second text-only call compares $B$ with $A{=}T$ . The candidate is divergent iff doing $B$ instead of $A$ deviates from $A$ .

Figure 5: All six VLMs separate from the no-skill baseline. Precision–recall curves use each model’s self-reported divergence score; the dashed line is the positive rate ( $0.620$ ). The precision axis starts at $0.6$ .

Model	AP	mIoU	G.ACC 0.3	EAD 0.3
GPT-5.6-luna	0.886	0.664	0.886	0.640
Qwen3-VL-32B	0.769	0.647	0.940	0.453
Qwen3-VL-8B	0.752	0.456	0.788	0.426
Gemma-4-31B	0.709	0.288	0.476	0.201
Gemma-3-27B	0.726	0.025	0.028	0.018
Llama-4-Scout	0.751	0.089	0.117	0.047

Table 1: Similar detection can hide a ninefold evidence gap. Qwen3-VL-8B and Llama-4-Scout differ by only

0.001

AP but score

0.426

and

0.047

EAD 0.3 , respectively. Best per column in bold.

Figure 6: Qualitative grounding, one column per model (GPT-5.6-luna, Qwen3-VL-32B, Gemma-4-31B). Red is the region the model flagged as its evidence, green the ground-truth injected span. Top row: well-localized detections (IoU $0.98$ , $0.93$ , $0.86$ ). Bottom row: mislocalized ones (IoU $\approx 0$ ).

Model	orig	recon.	gated	$\Delta$ vs. orig	oracle
GPT-5.6-luna	0.697	0.491	0.717	$+0.020$	0.810
Qwen3-VL-32B	0.807	0.443	0.814	$+0.007$	0.860
Qwen3-VL-8B	0.445	0.397	0.497	$+0.052$	0.642
Gemma-4-31B	0.253	0.487	0.490	$+0.237$	0.600
Gemma-3-27B	0.006	0.299	0.272	$+0.266$	0.302
Llama-4-Scout	0.038	0.407	0.327	$+0.289$	0.430

Table 2: ReadGate avoids a single unsafe localization policy. G.ACC 0.5 on correctly detected attacks from both splits; “orig” is the regressed box, “recon.” always reconstructs, and “gated” routes per sample. Best non-oracle policy in bold.

Figure 7: Gate decisions, one panel per model. Red is the model’s own regressed box $\hat{b}$ , blue the reconstruction $\hat{b}^{\star}$ , green the ground-truth injected span; the box the gate discarded is dashed. Left and middle: $\hat{b}$ sits on unrelated page content and is replaced. Right: $\hat{b}$ already marks the injected text, and the gate declines the reconstruction. The verdict and the quote are untouched in either direction.

Model	G.ACC 0.3	CFC T	CFC T +CC	$\Delta$	CFC I	CFC I +CC	$\Delta$
GPT-5.6-luna	0.886	0.999	0.987	$-0.012$	0.798	0.786	$-0.012$
Qwen3-VL-32B	0.940	0.587	0.731	$+0.144$	0.695	0.560	$-0.135$
Qwen3-VL-8B	0.788	0.552	0.882	$+0.330$	0.608	0.561	$-0.047$
Gemma-4-31B	0.476	0.898	0.993	$+0.095$	0.463	0.799	$+0.336$
Gemma-3-27B	0.028	0.529	0.270	$-0.259$	0.229	0.246	$+0.017$
Llama-4-Scout	0.117	0.299	0.912	$+0.613$	0.655	0.643	$-0.012$

Table 3: Grounding and counterfactual responsiveness are empirically separable. CFC T and CFC I are each shown for the base detector and with CmdCompare (CC). All columns are conditional on a correct detection.

Appendix figures & tables12 assets

Supplementary material from the paper’s appendix.

Appendix

Stage	Role	Model
OCR	page $\to$ $\mathrm{OCR}(I)$	PaddleOCR-VL [ 8 ]
Instruction gen.	write $T$	Qwen3-235B-A22B
Injection gen.	divergent/aligned/neutral	Qwen3-32B-abliterated
Placement	composite into $I$	Qwen3-235B-A22B

Appendix

Table 4: Models used to build Mind2Web-Injection.

Config	fine (px)	col (px)	hier 0.5	hybrid 0.5	hybrid 0.3
f6c6	133	213	0.044	0.300	0.575
f8c6	100	213	0.112	0.342	0.646
f12c6	67	213	0.212	0.376	0.679
f12c12	67	107	0.264	0.393	0.718
f16c12	50	107	0.286	0.398	0.714
f16c16	50	80	0.310	0.405	0.722

Appendix

Table 5: ReadGate grid-resolution sweep (Llama-4-Scout, test_task pilot,

200

images). “hybrid” is the OCR-snapped box.

Figure 8: A representative well-localized flagged sample per model. Red is the region the model returned as its evidence, green the ground-truth injected span. Each cell prints its IoU, because for Gemma-3-27B and Llama-4-Scout almost no sample reaches the level the other four routinely do: even their strong attempts overlap the span only partly, which is what the near-zero G.ACC of Tab. 1 looks like sample by sample.

Figure 9: A mislocalized flagged sample per model, colors as above. Every model, including the two strongest grounders, sometimes returns divergent while placing its evidence on unrelated page content — a footer menu, a headline, a photo strip. The models differ in how often this happens, not in whether it happens.

Figure 10: One ReadGate decision per model, colors as in Fig. 7 : red is the model’s own box, blue the reconstruction, green the injected span, and the discarded box is dashed. Top row: the transcription matches the quote and the model’s box is kept. Bottom row: it does not, and the reconstruction replaces it. The gate takes both actions on every model; the mix simply follows how reliable that model’s coordinates are.

	test_task			test_website
Model	AP	mIoU	EAD 0.3	AP	mIoU	EAD 0.3
GPT-5.6-luna	0.884	0.677	0.642	0.890	0.647	0.636
Qwen3-VL-32B	0.769	0.652	0.445	0.770	0.641	0.464
Qwen3-VL-8B	0.753	0.464	0.426	0.751	0.444	0.425
Gemma-4-31B	0.704	0.297	0.198	0.716	0.277	0.205
Gemma-3-27B	0.727	0.027	0.022	0.725	0.021	0.013

Appendix

Table 6: Per-split detection and grounding, at the same

\tau{=}0.3

as Tab. 1 , which pools the two splits.

Model	$0.2$	$0.3$	$0.4$	$0.5$	$0.6$	$0.7$	$0.8$
GPT-5.6-luna	0.934	0.886	0.807	0.698	0.594	0.510	0.439
Qwen3-VL-32B	0.956	0.940	0.898	0.807	0.616	0.414	0.276
Qwen3-VL-8B	0.873	0.788	0.648	0.445	0.260	0.116	0.036
Gemma-4-31B	0.573	0.476	0.368	0.250	0.139	0.054	0.014
Gemma-3-27B	0.051	0.028	0.014	0.006	0.003	0.001	0.000
Llama-4-Scout	0.190	0.117	0.070	0.037	0.020	0.007	0.002

Appendix

Table 7: G.ACC (fraction of gated samples with IoU

{>}\tau

) vs. threshold, pooled over both splits.

Model	quote acc	crop acc	FP: Q2-type	FP: Q1-type
GPT-5.6-luna	0.900	0.978	0.809	0.191
Qwen3-VL-32B	0.985	0.979	0.974	0.026
Qwen3-VL-8B	0.981	0.976	0.947	0.053
Gemma-4-31B	0.822	0.962	0.779	0.221
Gemma-3-27B	0.425	0.812	0.233	0.767
Llama-4-Scout	0.913	0.953	0.811	0.189

Appendix

Table 8: Failure decomposition on the gated set. Quote and crop accuracy are read-side; the point side is Tab. 7 (IoU sweep) and the “orig” column of Tab. 2 . FP columns split false positives into Q2-type (quotes injected text but skips the instruction check) and Q1-type (flags ordinary UI).

Model	$n$	base FPR	$\Delta$ FPR	recall	CFC I	CFC ${}_{I}^{\text{gr}}$	$n_{\text{ead}}$
GPT-5.6-luna	6067	0.110	+0.056	0.734	0.798	0.797	3945
Qwen3-VL-32B	6168	0.126	+0.072	0.482	0.695	0.697	2793
Qwen3-VL-8B	6132	0.179	+0.096	0.541	0.608	0.616	2612
Gemma-4-31B	6168	0.176	+0.134	0.421	0.463	0.464	1238
Gemma-3-27B	6140	0.477	+0.125	0.634	0.229	0.144	111
Llama-4-Scout	6165	0.118	+0.068	0.403	0.655	0.682	292

Appendix

Table 9: Full results of the image-side counterfactual: every divergent instance re-evaluated on its aligned twin, identical except for the overlay text. base FPR is the false-positive rate on the benchmark’s own benign (aligned/neutral) instances;

\Delta

FPR the extra false-positive rate on the aligned twin beyond that base; recall is measured on divergent instances; CFC I is the share of correctly detected attacks that return aligned on the twin; CFC

{}_{I}^{\text{gr}}

is the same share restricted to correctly localized pairs (IoU

{\geq}0.3

), with denominator

n_{\text{ead}}

Model	$n$	recall	CFC I	CFC ${}_{I}^{\text{gr}}$	twin FPR
GPT-5.6-luna	6067	[0.722, 0.745]	[0.785, 0.809]	[0.784, 0.809]	[0.157, 0.176]
Qwen3-VL-32B	6168	[0.469, 0.494]	[0.679, 0.712]	[0.680, 0.715]	[0.188, 0.209]
Qwen3-VL-8B	6132	[0.528, 0.553]	[0.590, 0.625]	[0.597, 0.634]	[0.264, 0.286]
Gemma-4-31B	6168	[0.408, 0.435]	[0.443, 0.482]	[0.436, 0.491]	[0.298, 0.322]
Gemma-3-27B	6140	[0.619, 0.647]	[0.215, 0.242]	[0.081, 0.212]	[0.588, 0.614]
Llama-4-Scout	6165	[0.388, 0.417]	[0.636, 0.675]	[0.629, 0.734]	[0.177, 0.196]

Appendix

Table 10:

95\%

cluster-bootstrap intervals for the image-side counterfactual of Tab. 9 , resampling source pages rather than instances: the

6{,}168

pairs come from only

{\sim}2{,}054

pages, so resampling instances would treat the up-to-five prompt types sharing one page and one overlay as independent draws. The widths are what make the CFC

{}_{I}^{\text{gr}}

caveat concrete: Gemma-3-27B’s interval is five times wider than GPT-5.6-luna’s, on an

n_{\text{ead}}

an order of magnitude smaller.

Model	$n$	recall		CFC I		twin FPR
Model	$n$	✗	✓	✗	✓	✗	✓
GPT-5.6-luna	6156	0.734	0.700	0.798	0.786	0.166	0.177
Qwen3-VL-32B	6168	0.482	0.701	0.695	0.560	0.198	0.331
Qwen3-VL-8B	6162	0.541	0.744	0.608	0.561	0.275	0.351
Gemma-4-31B	6156	0.421	0.400	0.463	0.799	0.310	0.111
Gemma-3-27B	6152	0.634	0.760	0.229	0.246	0.601	0.638

Appendix

Table 11: CmdCompare on the image-side (aligned-twin) counterfactual: the same pairs as Tab. 9 , judged by the single-call detector ( ✗ ) and by the CmdCompare reframing ( ✓ ) in both cells. recall is on the divergent cell and is CFC I ’s denominator; twin FPR is the false-positive rate on the aligned twin.

n

is the CmdCompare run’s pair count, which differs slightly from Tab. 9 ’s where a call errored.

Model	$n_{\text{CFC}_{I}}$	CFC I	compared	no command	no candidate
GPT-5.6-luna	4310	0.786	0.471	0.223	0.092
Qwen3-VL-32B	4325	0.560	0.217	0.160	0.183
Qwen3-VL-8B	4587	0.561	0.268	0.204	0.089
Gemma-4-31B	2463	0.799	0.367	0.161	0.271
Gemma-3-27B	4678	0.246	0.038	0.172	0.035
Llama-4-Scout	3694	0.643	0.336	0.182	0.125

Appendix

Table 12: CFC I under CmdCompare , split by the route that produced an aligned verdict on the aligned twin. compared : the extracted command was compared against

T

and found not to deviate — the mechanism of Sec. 3.3 . no command : text was quoted but names no action, so nothing could deviate. no candidate : the quoting step returned nothing and the verdict short-circuited, a route in which the comparison never participated in. Columns sum to CFC I ; the denominator is CFC I ’s, the pairs whose divergent cell was judged correctly.

Cultural Safety Evaluation of VLMs

See all 14 papers

Aug 24, 2026

EviSafe: Evidence-Grounded Safety Evaluation for Vision-Language Models

Vision-language model safety benchmarks typically evaluate only final responses: whether a model refuses, warns, or complies. This outcome-level view cannot tell whether a model is safe for the right multimodal reason. Safelooking behavior may reflect keyword-triggered refusal, missed visual hazards, or over-refusal of benign-sensitive inputs. We introduce EviSafe, an evidence-grounded framework for VLM safety that jointly evaluates natural user-facing behavior, explicit grounding in textual and visual evidence, and behavioral sensitivity to counterfactual changes in safety-critical evidence. EviSafeBench instantiates the framework as a controlled benchmark with 1,181 gold image-text scenarios and 2,452 targeted counterfactual variants across eight safety domains and eight risk-source types. Each scenario includes a gold safety decision, evidence annotations, a safe-response policy, and counterfactual interventions. The three-probe protocol queries models with natural-response, evidencereporting, and counterfactual-response prompts, then scores them using an evidence-aware judge. Across eleven evaluated VLMs, natural severity accuracy ranges from 27.6% to 52.8%, relaxed diagnostic consistency from 6.1% to 29.3%, and unsafe-to-safe counterfactual transition success from 30.4% to 58.4%. These gaps show that the evaluated VLMs are not reliably safe for the right multimodal reason and motivate evaluation beyond refusal counts.

Xuetong Li, Gaofeng Liu

School of Mathematical Sciences, MOE Key Lab of Scientific and Engineering Computing, Shanghai Center for Applied Mathematics, Shanghai Jiao Tong University · Department of Automation, Shanghai Jiao Tong University

Cultural Safety Evaluation of VLMs VLM Safety VLM Evaluation VLM Safety Alignment Counterfactual Evaluation of VLMs

Ask PDF

Mar 19, 2026

To See or To Please: Uncovering Visual Sycophancy and Split Beliefs in VLMs

When VLMs answer correctly, do they genuinely rely on visual information? We introduce a Tri-Layer Diagnostic Framework with three per-sample metrics: Latent Anomaly Detection, Visual Necessity Score, and Competition Score, which disentangle perception, dependency, and alignment failures. Across 9 VLMs and 9,000 model-sample pairs under counterfactual blind, noise, and conflict interventions, 72.9% of samples exhibit Visual Sycophancy, a Split Beliefs pattern in which internal evidence is preserved yet a hallucinated answer is decoded, while zero samples show Robust Refusal, indicating that current alignment training has eliminated refusal as a decoding outcome. Scaling within the Qwen-VL family, both within- and across-generation, monotonically reduces Language Shortcuts but amplifies Visual Sycophancy, showing that scale and newer post-training alone cannot resolve the grounding problem. Diagnostic scores further enable a training-free selective-prediction strategy yielding up to +9.5 percentage points accuracy at 50% coverage.

Rui Hong, Shuxue Quan

George Mason University, Fairfax, VA, USA · Independent Researcher

Selective Prediction for VLMs Sycophancy in VLMs Vision-Language Models Vision-Language Grounding Visual Evidence Sensitivity in VLMs Hallucination Detection in VLMs+1

Ask PDF

Aug 5, 2026

ComplexityWorld: Benchmarking Vision-Language Models on Verifiable Visual Decision Making

Vision-language models (VLMs) have made rapid progress in visual perception and increasingly support real-world tasks that depend on images. Many such tasks, however, require more than rec- ognizing what an image contains: a model must use visual evidence to make a complete decision whose parts jointly satisfy global constraints. We introduce COMPLEXITYWORLD, a benchmark of 390 tasks across 39 domain-inspired visual worlds and 29 decision categories. Each task is generated from a hidden structured specification, rendered as a visual scene, and scored by an exe- cutable verifier that accepts any feasible solution. Under direct inference, all evaluated models ex- cept GPT-5.6-Sol remain below 40% verifier ac- ceptance rate (VAR), while GPT-5.6-Sol reaches 75.6%. Performance improves substantially when the same decision information is made explicit in structured form, yet varies sharply across equiva- lent visual presentations. Agent scaffolds provide smaller, model-dependent gains. Together, these results reveal a persistent visual-to-decision bot- tleneck that additional inference alone does not remove.

Ningxin Pan, Hanyu Li, Yehui Tang

Peking University, Beijing, China.

VLM Evaluation Visually Grounded Reasoning Constraint Satisfaction

Ask PDF

Abstract

Cultural Safety Evaluation of VLMs

Explore similar work

EviSafe: Evidence-Grounded Safety Evaluation for Vision-Language Models

To See or To Please: Uncovering Visual Sycophancy and Split Beliefs in VLMs

ComplexityWorld: Benchmarking Vision-Language Models on Verifiable Visual Decision Making