When given an image and a text prompt, vision-language models (VLMs) can produce seemingly sophisticated text responses. However, they are also prone to hallucinate objects in their output, which can have detrimental consequences in safety-critical applications. To detect these hallucinations, certain methods interestingly leverage internal signals from the VLM as it generates the text response; potentially, these methods use the same signals that led to a hallucination to detect it. We conduct an in-depth analysis to understand the robustness of these detection methods. First, we show that a naive baseline of a generated word's token position in the VLM text response achieves competitive performance. Further, we reveal how some detection methods rely on token position and use this heuristic as a shortcut. Second, we explore detection methods' sensitivity to language and vision modalities. Our experiments suggest that strong detection performance is often driven by detecting language-based hallucinations, and when methods rely on token position, they tend to be less visually grounded and exhibit reduced robustness when hallucinations occur earlier in a text response. Lastly, we demonstrate that different detection methods can carry complementary signals; when ensembling methods together, adding weaker methods to an ensemble of higher performing ones still offers performance improvements. Altogether, while there may be useful internal VLM signals to detect hallucinations, our investigation reveals important limitations of the current methods that try to leverage them.
Figures & tables
Figure 1: CL , GLSim , SVAR , and PAS are highly correlated with token position and each other.
Metric
Model
Black Box
White Box
Heuristic
Random
NLL
Entropy
IC
CL
GLSim
SVAR
PAS
Token Pos.
Token Pos. (norm.)
AUROC
LLaVA-1.5-13B
50.0
72.2
73.6
74.8
82.3
82.8
81.4
83.4
83.2
84.6
LLaVA-1.5-7B
72.4
73.4
78.6
79.3
83.5
81.1
84.0
83.4
84.7
InstructBLIP-7B
81.1
82.5
88.1
86.7
86.3
88.7
89.1
88.5
88.7
Qwen3VL-8B
66.5
68.5
69.1
67.4
64.7
79.3
77.1
73.9
74.2
InternVL2-8B
64.3
65.8
77.1
69.6
79.2
81.0
78.8
77.0
77.8
Table 1: Token position achieves evaluation scores on par with white box detection methods, despite being agnostic to the image and caption content. Across many VLMs, the token position heuristic achieves comparable AUROC (top) and AUPRC (bottom) to established detection methods, even achieving best or second best performance for certain VLMs. Token position is an object’s first token position in the caption, and normalized token position divides by the caption’s length.
Figure 2: Our experiments can reveal when white box methods ( CL , GLSim , SVAR , PAS ) demonstrate a reliance on token position. These four methods resemble behavior of the token position heuristic, especially attention-based methods: SVAR and PAS . On the other hand, black box methods tend to behave in the opposite direction. We only examine objects in sentence 5+ of the caption to ensure sufficiently long preceding context. Scores are normalized by mean and standard deviation to be on the same scale. Error bars represent 95% confidence intervals.
Figure 3: The competitive advantage of white box methods stems from detecting language-based hallucinations. White box methods outperform black box methods on language-based hallucinations (left) but not on image-sensitive hallucinations (right). We report AUPRC as it is more sensitive than AUROC to performance on hallucinations. Black box methods are NLL and Ent , token position is in gray for reference, and horizontal dashed lines represent the random baseline, i.e., hallucination rate.
Figure 4: Detection methods that depend on token position (i.e., SVAR , PAS for LLaVA-1.5-13B) exhibit less visual grounding than other detection methods. We compare detection method performance in AUPRC when using the original image (solid) compared to replacing the image with a blank gray image but retaining the original caption (hatched). A greater drop suggests greater grounding in visual signals, while negligible drops indicate little to no grounding in the image.
Figure 5: Token position and position-dependent methods (e.g., SVAR , PAS ) are not always reliable hallucination detectors. Left : While hallucinated objects tend to appear later in the caption for typical settings ( light blue ), prompting for small objects first can lead VLMs to hallucinate earlier in the caption ( dark blue ). Right : When LLaVA-1.5-13B is asked to describe small objects first, SVAR and PAS perform near random chance. To ensure fair comparisons, we plot AUPRC over the objects shared in captions from prompting for small objects first (bars) and in the original setting (dashed lines) for a given image.
Figure 6: Detection methods can contain complementary signals to one another. We cumulatively build logistic-regression ensembles on top of token position adding methods in order of decreasing correlation and dependence with token position: (1) + SVAR , PAS ; (2) + CL , GLSim ; (3) + IC ; and (4) black box methods + NLL , Ent . Except for ( + SVAR , PAS ), each additional group of detection methods improves the ensemble’s performance, suggesting the groups carry non-overlapping signal to one another. Error bars are 95% confidence intervals computed via percentile bootstrap of validation predictions.
Appendix figures & tables32 assets
Supplementary material from the paper’s appendix.
Appendix
GLSim
SVAR
CL
PAS
VLM
w
k
l
l′
s
e
l
l
LLaVA-1.5-7B
0.6
32
32
31
5
18
30
0
LLaVA-1.5-13B
0.6
32
40
38
5
18
25
0
InstructBLIP-Vicuna-7B
0.8
4
32
32
1
7
30
0
Qwen3VL-8B-Instruct
0.3
8
35
35
2
21
20
14
InternVL2-8B
0.8
8
23
32
1
10
10
9
Appendix
Table 2: Hyperparameter values for GLSim , SVAR , CL , and PAS on all VLMs with MSCOCO. VLMs under the horizontal line are different versions of evaluated VLMs
GLSim
SVAR
CL
PAS
VLM
w
k
l
l′
s
e
l
l
LLaVA-1.5-7B
0.6
32
32
31
5
10
NA
0
LLaVA-1.5-13B
0.5
8
37
40
5
18
25
0
InstructBLIP-Vicuna-7B
0.7
8
32
32
1
15
20
0
Qwen3VL-8B-Instruct
0.1
8
35
35
10
35
30
34
InternVL2-8B
0.6
8
20
32
5
18
NA
9
Appendix
Table 3: Hyperparameter values for GLSim , SVAR , CL , and PAS on all VLMs with Objects365. NA indicates using the maximum across all layers yields best results.
Figure 7: Objects mentioned at later positions in the caption are more likely to be hallucinated. Plots demonstrate kernel density functions of token position distributions of hallucinated and correct (or real) objects. The effect is especially pronounced for LLaVA and InstructBLIP, which leverage Vicuna [ 63 ] backbones. While less pronounced for non-Vicuna VLMs, the trend still persists. Number of hallucinated and correct objects for each VLM is labeled in the legend.
Figure 8: Qualitative example of hallucination score and token position correlation (1/4) . SVAR , GLSim , and CL tend to score later words as more likely to be hallucinated, which sometimes is consistent with the hallucination patterns of the VLM . Captions are repeated to demonstrate scores from each detection method, bold indicates hallucinated object, green indicates low hallucination score, and red indicates high. Image caption generated is by LLaVA-1.5-13B.
Figure 9: Qualitative example of hallucination score and token position correlation (2/4) . SVAR , GLSim , and CL tend to score later words as more likely to be hallucinated, even if the object is the same . Captions are repeated to demonstrate scores from each detection method, bold indicates hallucinated object, green indicates low hallucination score, and red indicates high. Image caption generated is by LLaVA-1.5-13B.
Figure 10: Qualitative example of hallucination score and token position correlation (3/4) . SVAR , GLSim , and CL tend to score later words as more likely to be hallucinated, whereas NLL and Ent are less likely to do so . Captions are repeated to demonstrate scores from each detection method, bold indicates hallucinated object, green indicates low hallucination score, and red indicates high. Image caption generated is by LLaVA-1.5-13B.
Figure 11: Qualitative example of hallucination score and token position correlation (4/4) . SVAR , GLSim , and CL tend to score later words as more likely to be hallucinated, even for correct objects . Captions are repeated to demonstrate scores from each detection method, bold indicates hallucinated object, green indicates low hallucination score, and red indicates high. Image caption generated is by LLaVA-1.5-13B.
Figure 12: Correlations matrices between all methods and token position for all VLMs. The high correlation between SVAR and token position and between black box methods remains consistent across all VLMs. Other correlations appear to be more VLM-dependent.
Figure 13: Change in normalized hallucination scores when removing and replacing preceding context for all VLMs. Trends for all methods hold across VLMs, but we note CL and GLSim seem to be less text sensitive on certain VLMs.
Figure 14: White box detection methods gain their competitive performance over black box methods for language-based hallucinations but not necessarily for non-language-based hallucinations. We partition hallucinations into language and non-language-based depending on whether the generated token differs when using a blank image. White box methods are strong at detecting hallucinations that persist even when images are removed, suggesting a lack of image sensitivity.
Figure 15: Across most VLMs except Qwen3VL-8B-Instruct and InternVL2-8B, SVAR and PAS do not exhibit image sensitivity, suggesting they are not visually grounded. We replace the original image (solid) with a blank image (hatched) and examine the performance drop. Larger performance drops, i.e., to random chance, suggest the detection method is sensitive to image-based signals.
Figure 16: Unreliability of token position when prompted to mention small objects first. Left : Comparing AUPRC between original (dots) and small objects first setting (bars) over subset of objects that appear for an image in both settings. Graphs demonstrate how much of the performance drop is due to token position changes, which varies by VLM. Right : Comparing hallucinated token position distribution and performance with AUPRC of the original prompt and the small objects first prompt over all objects . Across many VLMs, especially LLaVA-1.5-13B, LLaVA-1.5-7B, and InstructBLIP-Vicuna-7B, the performance of SVAR (dark green), PAS (light green), and token position reduce in their competitive advantage, dropping to on par with other methods or even below.
Figure 17: Ensemble method performances for each VLM, where we add { SVAR , PAS }, { GLSim , CL }, { IC } and { NLL , Ent } incrementally on top of token position. In all VLMs we observe that token position is a strong baseline. Despite high correlation between token position and { SVAR , PAS }, this group improves the AUPRC substantially over token position for Qwen3VL-8B-Instruct, InternVL2-8B, and Gemma-4-E4B-it. Meanwhile, { CL , GLSim } contribute significant signal for LLaVA-1.5-13B, LLaVA-1.5-7B, InstructBLIP-Vicuna-7B, InternVL2-8B, and Gemma-4-E4B-it. { IC } has additional discriminative power over this ensemble for LLaVA-1.5-13B and LLaVA-1.5-7B. Lastly, black box methods { NLL , Ent } the most improvement for LLaVA-1.5-13B and LLaVA-1.5-7B, but less so for other VLMs.
Figure 18: Disentangling caption-generation process from VLM specificity. We observe that independent of the VLM that generated the caption, the relative performance of using InternVL2-8B, Qwen3VL-8B-Instruct, and Gemma-4-E4B-it to detect hallucinations is relatively consistent. We use CL and GLSim on certain VLMs (indicated by colored bars) to detect hallucinations in captions from other VLMs (indicated by each grouping). We plot AUPRC and dashed horizontal lines indicated the random baseline (i.e., hallucination rate).
Metric
Model
Black Box
White Box
Heuristic
Random
NLL
Entropy
IC
CL
GLSim
SVAR
PAS
Token Pos.
Token Pos. (norm.)
AUROC
Qwen3.5-9B
50.0
68.2
70.8
74.2
69.8
79.7
78.7
79.1
78.3
78.3
InternVL3.5-8B
66.9
69.0
62.8
65.2
74.6
77.4
78.3
76.3
77.2
Average
50.0
67.6
69.9
68.5
67.5
77.2
78.1
78.7
77.3
77.8
AUPRC
Qwen3.5-9B
21.3
37.4
42.9
47.5
38.9
52.6
49.5
48.7
43.5
43.5
InternVL3.5-8B
15.0
28.9
31.3
22.2
24.7
35.5
35.5
33.5
30.0
33.7
Appendix
Table 4: Hallucination detection performance on updated versions of Qwen and InternVL on MSCOCO.
Metric
Model
Black Box
White Box
Heuristic
Random
NLL
Entropy
IC
CL
GLSim
SVAR
PAS
Token Pos.
Token Pos. (norm.)
AUROC
LLaVA-1.5-13B
50.0
69.0
69.4
64.2
71.0
74.6
70.0
72.2
72.1
72.7
LLaVA-1.5-7B
69.8
69.9
67.0
70.5
75.4
72.1
73.9
72.9
73.4
InstructBLIP-7B
73.1
73.8
72.9
66.7
74.9
76.1
76.3
75.8
75.9
Qwen3VL-8B
56.0
56.7
68.8
60.4
63.1
71.5
64.2
56.8
57.0
InternVL2-8B
57.7
58.4
69.3
61.6
68.9
69.1
66.1
62.3
63.1
Appendix
Table 5: Token position remains competitive on a different dataset (Objects365). Compared to MSCOCO, hallucination rates tend to be higher and black box methods ( NLL , Ent ) tend to perform relatively better on Objects365. Token position (or normalized token position) is still competitive, outperforming at least one other white box method for all VLMs on AUPRC, except for Qwen3VL-8B-Instruct. We report AUROC and AUPRC of hallucination detection methods across the six main VLMs on 5,000 images from Objects365.
Metric
Model
Black Box
White Box
Heuristic
Random
NLL
Entropy
IC
CL
GLSim
SVAR
PAS
Token Pos.
Token Pos. (norm.)
AUROC
LLaVA-1.5-13B
50.0
74.4
76.1
75.2
82.8
83.4
81.5
84.4
84.0
85.7
LLaVA-1.5-7B
72.4
73.4
78.6
79.3
83.5
81.1
84.0
83.4
84.7
InstructBLIP-7B
79.9
81.4
86.2
84.3
82.1
87.5
87.8
87.4
87.4
Qwen3VL-8B
66.7
68.8
66.0
71.0
64.0
78.9
78.4
77.1
77.5
InternVL2-8B
65.2
66.5
76.2
70.0
79.8
81.0
79.3
78.7
80.0
Appendix
Table 6: Token position remains competitive with prompt variations.
Figure 19: Evaluation performance, token position dependency, and image-signal sensitivity are similar for newer versions of Qwen3.5-9B and InternVL3.5-8B. Overall performance of detection methods (1st and 3rd rows) on newer versions of VLMs are are similar. The blue remove/replace graphs (2nd and 5th rows) show that PAS on Qwen3.5-9B exhibits less context dependency than with Qwen3VL-8B-Instruct. However the image sensitivity graphs (3rd and 6th rows) show SVAR on Qwen3.5-9B exhibits even less image sensitivity than with Qwen3VL-8B-Instruct. On the other hand, PAS with InternVL3.5-8B seems much more sensitive to position and context than with InternVL2-8B while other trends are similar.
Figure 20: Ensemble method performances for Qwen3.5-9B and InternVL3.5-8B, where we add { SVAR , PAS }, { GLSim , CL }, { IC } and { NLL , Ent } incrementally on top of token position. For these models, beyond adding CL and GLSim , additional methods do not seem to contribute much additional signal.
Figure 21: Hallucination patterns on Objects365 slightly differ from MSCOCO. While LLaVA-1.5-13B, LLaVA-1.5-7B, and InstructBLIP-Vicuna-7B still hallucinate objects later than real objects, the distinction is not as pronounced for Qwen3VL-8B-Instruct and InternVL2-8B. We plot token position distributions of real and hallucinated objects on Objects365 dataset.
Figure 22: Left: Performance of hallucination detection methods on LLaVA-1.5-13B generalizes across various data and prompt settings. Right: Method behavior with remove/replace preceding sentences LLaVA-1.5-13B generalizes across various data and prompt settings.
Figure 23: Method behavior partitioning by hallucination modality and visual groundedness on LLaVA-1.5-13B generalizes across various data and prompt settings.
Figure 24: Left: Performance of hallucination detection methods on LLaVA-1.5-7B generalizes across various data and prompt settings. Right: Method behavior with remove/replace preceding sentences LLaVA-1.5-7B generalizes across various data and prompt settings.
Figure 25: Method behavior partitioning by hallucination modality and visual groundedness on LLaVA-1.5-7B generalizes across various data and prompt settings.
Figure 26: Left: Performance of hallucination detection methods on InstructBLIP-Vicuna-7B generalizes across various data and prompt settings. Right: Method behavior with remove/replace preceding sentences InstructBLIP-Vicuna-7B generalizes across various data and prompt settings.
Figure 27: Method behavior partitioning by hallucination modality and visual groundedness on InstructBLIP-Vicuna-7B generalizes across various data and prompt settings.
Figure 28: Left: Performance of hallucination detection methods on Qwen3VL-8B-Instruct generalizes across various data and prompt settings. Right: Method behavior with remove/replace preceding sentences Qwen3VL-8B-Instruct generalizes across various data and prompt settings.
Figure 29: Method behavior partitioning by hallucination modality and visual groundedness on Qwen3VL-8B-Instruct generalizes across various data and prompt settings.
Figure 30: Left: Performance of hallucination detection methods on InternVL2-8B generalizes across various data and prompt settings. Right: Method behavior with remove/replace preceding sentences InternVL2-8B generalizes across various data and prompt settings.
Figure 31: Method behavior partitioning by hallucination modality and visual groundedness on InternVL2-8B generalizes across various data and prompt settings.
Figure 32: Left: Performance of hallucination detection methods on Gemma-4-E4B-it generalizes across various data and prompt settings. Right: Method behavior with remove/replace preceding sentences Gemma-4-E4B-it generalizes across various data and prompt settings.
Figure 33: Method behavior partitioning by hallucination modality and visual groundedness on Gemma-4-E4B-it generalizes across various data and prompt settings.
Hallucinations remain a persistent challenge for vision-language models (VLMs), which often describe nonexistent objects or fabricate facts. Existing detection methods typically operate after text generation, making intervention both costly and untimely. We investigate whether hallucination risk can instead be predicted before any token is generated by probing a model's internal representations in a single forward pass. Across a diverse set of vision-language tasks and eight modern VLMs, including Llama-3.2-Vision, Gemma-3, Phi-4-VL, and Qwen2.5-VL, we examine three families of internal representations: (i) visual-only features without multimodal fusion, (ii) vision-token representations within the text decoder, and (iii) query-token representations that integrate visual and textual information before generation. Probes trained on these representations achieve strong hallucination-detection performance without decoding, reaching up to 0.93 AUROC on Gemma-3-12B, Phi-4-VL 5.6B, and Molmo 7B. Late query-token states are the most predictive for most models, while visual or mid-layer features dominate in a few architectures (e.g., ~0.79 AUROC for Qwen2.5-VL-7B using visual-only features). These results demonstrate that (1) hallucination risk is detectable pre-generation, (2) the most informative layer and modality vary across architectures, and (3) lightweight probes have the potential to enable early abstention, selective routing, and adaptive decoding to improve both safety and efficiency.
Sai Akhil Kogilathota, Sripadha Vallabha E G, Luzhe Sun +1
Stony Brook University · Toyota Technological Institute at Chicago
Vision Language models (VLMs) often hallucinate non-existent objects. Detecting hallucination is analogous to detecting deception: a single final statement is insufficient, one must examine the underlying reasoning process. Yet existing detectors rely mostly on final-layer signals. Attention-based methods assume hallucinated tokens exhibit low attention, while entropy-based ones use final-step uncertainty. Our analysis reveals the opposite: hallucinated objects can exhibit peaked attention due to contextual priors; and models often express high confidence because intermediate layers have already converged to an incorrect hypothesis. We show that the key to hallucination detection lies within the model's thought process, not its final output. By probing decoder layers, we uncover a previously overlooked behavior, overthinking: models repeatedly revise object hypotheses across layers before committing to an incorrect answer. Once the model latches onto a confounded hypothesis, it can propagate through subsequent layers, ultimately causing hallucination. To capture this behavior, we introduce the Overthinking Score, a metric to measure how many competing hypotheses the model entertains and how unstable these hypotheses are across layers. This score significantly improves hallucination detection: 78.9% F1 on MSCOCO and 71.58% on AMBER.
Abin Shoby, Ta Duc Huy, Tuan Dung Nguyen +6
Australian Institute for Machine Learning, University of Adelaide · Hanoi University of Science and Technology · Mohamed bin Zayed University of Artificial Intelligence
Despite remarkable progress in vision-language generation, Vision-Language Models (VLMs) remain prone to hallucinations, producing content that is inconsistent with or unsupported by the input image. Existing works largely design detection or mitigation methods around one specific hallucination pattern, such as visual-textual imbalance, but real VLM hallucinations arise from a mixture of multiple patterns, so signals bound to a single pattern struggle to remain stable across models and tasks. Under a unified head-level view, we find that hallucination-induced changes manifest as localized deviations from each head's faithful contextual behavior, a phenomenon we term Role-Break. Detailed analysis reveals that these deviations are systematically organized across attention heads, contextual sources, and deviation directions, and that the resulting signal is linearly readable once head identity is preserved. Based on these findings, we build a lightweight linear detector on top of Role-Break that requires no fine-tuning of the VLM, whose feature dimension stays below 5,000 and reaches an average AUROC of 93.23 across six VLMs and four benchmarks. A small-scale intervention experiment further shows that the detected tokens can be directly acted upon in the discriminative setting.
Mingyu Wang, Weilin Jin, Wenbo Li +5
Peking University, Beijing, China · Joy Future Academy, Beijing, China