Robustness of Internal Signals for Hallucination Detection in Vision-Language Models

Allison Chen; William Yang; Salma Abdel Magid; Jonathan Williams; Olga Russakovsky; Esin Tureci

cs.CVOct 19, 2026

Robustness of Internal Signals for Hallucination Detection in Vision-Language Models

Authors: Allison Chen, William Yang, Salma Abdel Magid, Jonathan Williams, Olga Russakovsky, Esin Tureci

Organizations: Department of Computer Science, Princeton University, Princeton, NJ 08544

Abstract

When given an image and a text prompt, vision-language models (VLMs) can produce seemingly sophisticated text responses. However, they are also prone to hallucinate objects in their output, which can have detrimental consequences in safety-critical applications. To detect these hallucinations, certain methods interestingly leverage internal signals from the VLM as it generates the text response; potentially, these methods use the same signals that led to a hallucination to detect it. We conduct an in-depth analysis to understand the robustness of these detection methods. First, we show that a naive baseline of a generated word's token position in the VLM text response achieves competitive performance. Further, we reveal how some detection methods rely on token position and use this heuristic as a shortcut. Second, we explore detection methods' sensitivity to language and vision modalities. Our experiments suggest that strong detection performance is often driven by detecting language-based hallucinations, and when methods rely on token position, they tend to be less visually grounded and exhibit reduced robustness when hallucinations occur earlier in a text response. Lastly, we demonstrate that different detection methods can carry complementary signals; when ensembling methods together, adding weaker methods to an ensemble of higher performing ones still offers performance improvements. Altogether, while there may be useful internal VLM signals to detect hallucinations, our investigation reveals important limitations of the current methods that try to leverage them.

Figures & tables

Figure 1: CL , GLSim , SVAR , and PAS are highly correlated with token position and each other.

Metric	Model		Black Box		White Box					Heuristic
Metric	Model	Random	NLL	Entropy	IC	CL	GLSim	SVAR	PAS	Token Pos.	Token Pos. (norm.)
AUROC	LLaVA-1.5-13B	50.0	72.2	73.6	74.8	82.3	82.8	81.4	83.4	83.2	84.6
	LLaVA-1.5-7B		72.4	73.4	78.6	79.3	83.5	81.1	84.0	83.4	84.7
	InstructBLIP-7B		81.1	82.5	88.1	86.7	86.3	88.7	89.1	88.5	88.7
	Qwen3VL-8B		66.5	68.5	69.1	67.4	64.7	79.3	77.1	73.9	74.2
	InternVL2-8B		64.3	65.8	77.1	69.6	79.2	81.0	78.8	77.0	77.8

Table 1: Token position achieves evaluation scores on par with white box detection methods, despite being agnostic to the image and caption content. Across many VLMs, the token position heuristic achieves comparable AUROC (top) and AUPRC (bottom) to established detection methods, even achieving best or second best performance for certain VLMs. Token position is an object’s first token position in the caption, and normalized token position divides by the caption’s length.

Figure 2: Our experiments can reveal when white box methods ( CL , GLSim , SVAR , PAS ) demonstrate a reliance on token position. These four methods resemble behavior of the token position heuristic, especially attention-based methods: SVAR and PAS . On the other hand, black box methods tend to behave in the opposite direction. We only examine objects in sentence 5+ of the caption to ensure sufficiently long preceding context. Scores are normalized by mean and standard deviation to be on the same scale. Error bars represent 95% confidence intervals.

Figure 3: The competitive advantage of white box methods stems from detecting language-based hallucinations. White box methods outperform black box methods on language-based hallucinations (left) but not on image-sensitive hallucinations (right). We report AUPRC as it is more sensitive than AUROC to performance on hallucinations. Black box methods are NLL and Ent , token position is in gray for reference, and horizontal dashed lines represent the random baseline, i.e., hallucination rate.

Figure 4: Detection methods that depend on token position (i.e., SVAR , PAS for LLaVA-1.5-13B) exhibit less visual grounding than other detection methods. We compare detection method performance in AUPRC when using the original image (solid) compared to replacing the image with a blank gray image but retaining the original caption (hatched). A greater drop suggests greater grounding in visual signals, while negligible drops indicate little to no grounding in the image.

Figure 5: Token position and position-dependent methods (e.g., SVAR , PAS ) are not always reliable hallucination detectors. Left : While hallucinated objects tend to appear later in the caption for typical settings ( light blue ), prompting for small objects first can lead VLMs to hallucinate earlier in the caption ( dark blue ). Right : When LLaVA-1.5-13B is asked to describe small objects first, SVAR and PAS perform near random chance. To ensure fair comparisons, we plot AUPRC over the objects shared in captions from prompting for small objects first (bars) and in the original setting (dashed lines) for a given image.

Figure 6: Detection methods can contain complementary signals to one another. We cumulatively build logistic-regression ensembles on top of token position adding methods in order of decreasing correlation and dependence with token position: (1) + SVAR , PAS ; (2) + CL , GLSim ; (3) + IC ; and (4) black box methods + NLL , Ent . Except for ( + SVAR , PAS ), each additional group of detection methods improves the ensemble’s performance, suggesting the groups carry non-overlapping signal to one another. Error bars are

95\%

confidence intervals computed via percentile bootstrap of validation predictions.

Appendix figures & tables32 assets

Supplementary material from the paper’s appendix.

Appendix

	GLSim				SVAR		CL	PAS
VLM	$w$	$k$	$l$	$l^{\prime}$	$s$	$e$	$l$	$l$
LLaVA-1.5-7B	0.6	32	32	31	5	18	30	0
LLaVA-1.5-13B	0.6	32	40	38	5	18	25	0
InstructBLIP-Vicuna-7B	0.8	4	32	32	1	7	30	0
Qwen3VL-8B-Instruct	0.3	8	35	35	2	21	20	14
InternVL2-8B	0.8	8	23	32	1	10	10	9

Appendix

Table 2: Hyperparameter values for GLSim , SVAR , CL , and PAS on all VLMs with MSCOCO. VLMs under the horizontal line are different versions of evaluated VLMs

	GLSim				SVAR		CL	PAS
VLM	$w$	$k$	$l$	$l^{\prime}$	$s$	$e$	$l$	$l$
LLaVA-1.5-7B	0.6	32	32	31	5	10	NA	0
LLaVA-1.5-13B	0.5	8	37	40	5	18	25	0
InstructBLIP-Vicuna-7B	0.7	8	32	32	1	15	20	0
Qwen3VL-8B-Instruct	0.1	8	35	35	10	35	30	34
InternVL2-8B	0.6	8	20	32	5	18	NA	9

Appendix

Table 3: Hyperparameter values for GLSim , SVAR , CL , and PAS on all VLMs with Objects365. NA indicates using the maximum across all layers yields best results.

Panel of Figure 7 — Figure 7: Objects mentioned at later positions in the caption are more likely to be hallucinated. Plots demonstrate kernel density functions of token position distributions of hallucinated and correct (or real) objects. The effect is especially pronounced for LLaVA and InstructBLIP, which leverage Vicuna [ 63 ] backbones. While less pronounced for non-Vicuna VLMs, the trend still persists. Number of hallucinated and correct objects for each VLM is labeled in the legend.

Figure 8: Qualitative example of hallucination score and token position correlation (1/4) . SVAR , GLSim , and CL tend to score later words as more likely to be hallucinated, which sometimes is consistent with the hallucination patterns of the VLM . Captions are repeated to demonstrate scores from each detection method, bold indicates hallucinated object, green indicates low hallucination score, and red indicates high. Image caption generated is by LLaVA-1.5-13B.

Figure 9: Qualitative example of hallucination score and token position correlation (2/4) . SVAR , GLSim , and CL tend to score later words as more likely to be hallucinated, even if the object is the same . Captions are repeated to demonstrate scores from each detection method, bold indicates hallucinated object, green indicates low hallucination score, and red indicates high. Image caption generated is by LLaVA-1.5-13B.

Figure 10: Qualitative example of hallucination score and token position correlation (3/4) . SVAR , GLSim , and CL tend to score later words as more likely to be hallucinated, whereas NLL and Ent are less likely to do so . Captions are repeated to demonstrate scores from each detection method, bold indicates hallucinated object, green indicates low hallucination score, and red indicates high. Image caption generated is by LLaVA-1.5-13B.

Figure 11: Qualitative example of hallucination score and token position correlation (4/4) . SVAR , GLSim , and CL tend to score later words as more likely to be hallucinated, even for correct objects . Captions are repeated to demonstrate scores from each detection method, bold indicates hallucinated object, green indicates low hallucination score, and red indicates high. Image caption generated is by LLaVA-1.5-13B.

Panel of Figure 12 — Figure 12: Correlations matrices between all methods and token position for all VLMs. The high correlation between SVAR and token position and between black box methods remains consistent across all VLMs. Other correlations appear to be more VLM-dependent.

Figure 13: Change in normalized hallucination scores when removing and replacing preceding context for all VLMs. Trends for all methods hold across VLMs, but we note CL and GLSim seem to be less text sensitive on certain VLMs.

Figure 14: White box detection methods gain their competitive performance over black box methods for language-based hallucinations but not necessarily for non-language-based hallucinations. We partition hallucinations into language and non-language-based depending on whether the generated token differs when using a blank image. White box methods are strong at detecting hallucinations that persist even when images are removed, suggesting a lack of image sensitivity.

Figure 15: Across most VLMs except Qwen3VL-8B-Instruct and InternVL2-8B, SVAR and PAS do not exhibit image sensitivity, suggesting they are not visually grounded. We replace the original image (solid) with a blank image (hatched) and examine the performance drop. Larger performance drops, i.e., to random chance, suggest the detection method is sensitive to image-based signals.

Panel of Figure 16 — Figure 16: Unreliability of token position when prompted to mention small objects first. Left : Comparing AUPRC between original (dots) and small objects first setting (bars) over subset of objects that appear for an image in both settings. Graphs demonstrate how much of the performance drop is due to token position changes, which varies by VLM. Right : Comparing hallucinated token position distribution and performance with AUPRC of the original prompt and the small objects first prompt over all objects . Across many VLMs, especially LLaVA-1.5-13B, LLaVA-1.5-7B, and InstructBLIP-Vicuna-7B, the performance of SVAR (dark green), PAS (light green), and token position reduce in their competitive advantage, dropping to on par with other methods or even below.

Figure 17: Ensemble method performances for each VLM, where we add { SVAR , PAS }, { GLSim , CL }, { IC } and { NLL , Ent } incrementally on top of token position. In all VLMs we observe that token position is a strong baseline. Despite high correlation between token position and { SVAR , PAS }, this group improves the AUPRC substantially over token position for Qwen3VL-8B-Instruct, InternVL2-8B, and Gemma-4-E4B-it. Meanwhile, { CL , GLSim } contribute significant signal for LLaVA-1.5-13B, LLaVA-1.5-7B, InstructBLIP-Vicuna-7B, InternVL2-8B, and Gemma-4-E4B-it. { IC } has additional discriminative power over this ensemble for LLaVA-1.5-13B and LLaVA-1.5-7B. Lastly, black box methods { NLL , Ent } the most improvement for LLaVA-1.5-13B and LLaVA-1.5-7B, but less so for other VLMs.

Figure 18: Disentangling caption-generation process from VLM specificity. We observe that independent of the VLM that generated the caption, the relative performance of using InternVL2-8B, Qwen3VL-8B-Instruct, and Gemma-4-E4B-it to detect hallucinations is relatively consistent. We use CL and GLSim on certain VLMs (indicated by colored bars) to detect hallucinations in captions from other VLMs (indicated by each grouping). We plot AUPRC and dashed horizontal lines indicated the random baseline (i.e., hallucination rate).

Metric	Model		Black Box		White Box					Heuristic
Metric	Model	Random	NLL	Entropy	IC	CL	GLSim	SVAR	PAS	Token Pos.	Token Pos. (norm.)
AUROC	Qwen3.5-9B	50.0	68.2	70.8	74.2	69.8	79.7	78.7	79.1	78.3	78.3
	InternVL3.5-8B	50.0	66.9	69.0	62.8	65.2	74.6	77.4	78.3	76.3	77.2
	Average	50.0	67.6	69.9	68.5	67.5	77.2	78.1	78.7	77.3	77.8
AUPRC	Qwen3.5-9B	21.3	37.4	42.9	47.5	38.9	52.6	49.5	48.7	43.5	43.5
	InternVL3.5-8B	15.0	28.9	31.3	22.2	24.7	35.5	35.5	33.5	30.0	33.7

Appendix

Table 4: Hallucination detection performance on updated versions of Qwen and InternVL on MSCOCO.

Metric	Model		Black Box		White Box					Heuristic
Metric	Model	Random	NLL	Entropy	IC	CL	GLSim	SVAR	PAS	Token Pos.	Token Pos. (norm.)
AUROC	LLaVA-1.5-13B	50.0	69.0	69.4	64.2	71.0	74.6	70.0	72.2	72.1	72.7
	LLaVA-1.5-7B		69.8	69.9	67.0	70.5	75.4	72.1	73.9	72.9	73.4
	InstructBLIP-7B		73.1	73.8	72.9	66.7	74.9	76.1	76.3	75.8	75.9
	Qwen3VL-8B		56.0	56.7	68.8	60.4	63.1	71.5	64.2	56.8	57.0
	InternVL2-8B		57.7	58.4	69.3	61.6	68.9	69.1	66.1	62.3	63.1

Appendix

Table 5: Token position remains competitive on a different dataset (Objects365). Compared to MSCOCO, hallucination rates tend to be higher and black box methods ( NLL , Ent ) tend to perform relatively better on Objects365. Token position (or normalized token position) is still competitive, outperforming at least one other white box method for all VLMs on AUPRC, except for Qwen3VL-8B-Instruct. We report AUROC and AUPRC of hallucination detection methods across the six main VLMs on 5,000 images from Objects365.

Metric	Model		Black Box		White Box					Heuristic
Metric	Model	Random	NLL	Entropy	IC	CL	GLSim	SVAR	PAS	Token Pos.	Token Pos. (norm.)
AUROC	LLaVA-1.5-13B	50.0	74.4	76.1	75.2	82.8	83.4	81.5	84.4	84.0	85.7
	LLaVA-1.5-7B		72.4	73.4	78.6	79.3	83.5	81.1	84.0	83.4	84.7
	InstructBLIP-7B		79.9	81.4	86.2	84.3	82.1	87.5	87.8	87.4	87.4
	Qwen3VL-8B		66.7	68.8	66.0	71.0	64.0	78.9	78.4	77.1	77.5
	InternVL2-8B		65.2	66.5	76.2	70.0	79.8	81.0	79.3	78.7	80.0

Appendix

Table 6: Token position remains competitive with prompt variations.

Panel of Figure 19 — Figure 19: Evaluation performance, token position dependency, and image-signal sensitivity are similar for newer versions of Qwen3.5-9B and InternVL3.5-8B. Overall performance of detection methods (1st and 3rd rows) on newer versions of VLMs are are similar. The blue remove/replace graphs (2nd and 5th rows) show that PAS on Qwen3.5-9B exhibits less context dependency than with Qwen3VL-8B-Instruct. However the image sensitivity graphs (3rd and 6th rows) show SVAR on Qwen3.5-9B exhibits even less image sensitivity than with Qwen3VL-8B-Instruct. On the other hand, PAS with InternVL3.5-8B seems much more sensitive to position and context than with InternVL2-8B while other trends are similar.

Figure 20: Ensemble method performances for Qwen3.5-9B and InternVL3.5-8B, where we add { SVAR , PAS }, { GLSim , CL }, { IC } and { NLL , Ent } incrementally on top of token position. For these models, beyond adding CL and GLSim , additional methods do not seem to contribute much additional signal.

Panel of Figure 21 — Figure 21: Hallucination patterns on Objects365 slightly differ from MSCOCO. While LLaVA-1.5-13B, LLaVA-1.5-7B, and InstructBLIP-Vicuna-7B still hallucinate objects later than real objects, the distinction is not as pronounced for Qwen3VL-8B-Instruct and InternVL2-8B. We plot token position distributions of real and hallucinated objects on Objects365 dataset.

Figure 22: Left: Performance of hallucination detection methods on LLaVA-1.5-13B generalizes across various data and prompt settings. Right: Method behavior with remove/replace preceding sentences LLaVA-1.5-13B generalizes across various data and prompt settings.

Figure 23: Method behavior partitioning by hallucination modality and visual groundedness on LLaVA-1.5-13B generalizes across various data and prompt settings.

Figure 24: Left: Performance of hallucination detection methods on LLaVA-1.5-7B generalizes across various data and prompt settings. Right: Method behavior with remove/replace preceding sentences LLaVA-1.5-7B generalizes across various data and prompt settings.

Figure 25: Method behavior partitioning by hallucination modality and visual groundedness on LLaVA-1.5-7B generalizes across various data and prompt settings.

Figure 26: Left: Performance of hallucination detection methods on InstructBLIP-Vicuna-7B generalizes across various data and prompt settings. Right: Method behavior with remove/replace preceding sentences InstructBLIP-Vicuna-7B generalizes across various data and prompt settings.

Figure 27: Method behavior partitioning by hallucination modality and visual groundedness on InstructBLIP-Vicuna-7B generalizes across various data and prompt settings.

Figure 28: Left: Performance of hallucination detection methods on Qwen3VL-8B-Instruct generalizes across various data and prompt settings. Right: Method behavior with remove/replace preceding sentences Qwen3VL-8B-Instruct generalizes across various data and prompt settings.

Figure 29: Method behavior partitioning by hallucination modality and visual groundedness on Qwen3VL-8B-Instruct generalizes across various data and prompt settings.

Figure 30: Left: Performance of hallucination detection methods on InternVL2-8B generalizes across various data and prompt settings. Right: Method behavior with remove/replace preceding sentences InternVL2-8B generalizes across various data and prompt settings.

Figure 31: Method behavior partitioning by hallucination modality and visual groundedness on InternVL2-8B generalizes across various data and prompt settings.

Figure 32: Left: Performance of hallucination detection methods on Gemma-4-E4B-it generalizes across various data and prompt settings. Right: Method behavior with remove/replace preceding sentences Gemma-4-E4B-it generalizes across various data and prompt settings.

Figure 33: Method behavior partitioning by hallucination modality and visual groundedness on Gemma-4-E4B-it generalizes across various data and prompt settings.

Hallucination Detection in VLMs

Hallucination detection in vision-language models identifies claims that are unsupported by images, video, or other visual evidence.

See all 71 papers

HALP: Detecting Hallucinations in Vision-Language Models without Generating a Single Token
Mar 5, 2026Sai Akhil Kogilathota, Sripadha Vallabha E G, Luzhe Sun +1Hallucination Detection in VLMs
Stony Brook University · Toyota Technological Institute at Chicago
Overthinking Causes Hallucination: Tracing Confounder Propagation in Vision Language Models
Mar 8, 2026Abin Shoby, Ta Duc Huy, Tuan Dung Nguyen +6Hallucination Detection in VLMs Object Hallucination in VLMs
Australian Institute for Machine Learning, University of Adelaide · Hanoi University of Science and Technology · Mohamed bin Zayed University of Artificial Intelligence
Role-Break in Attention Heads: Understanding and Detecting Hallucinations in VLMs
Jul 31, 2026Mingyu Wang, Weilin Jin, Wenbo Li +5Hallucination Detection in VLMs Attention Head Analysis
Peking University, Beijing, China · Joy Future Academy, Beijing, China

Mar 5, 2026J/K move · Enter open · S save

HALP: Detecting Hallucinations in Vision-Language Models without Generating a Single Token

Sai Akhil Kogilathota, Sripadha Vallabha E G, Luzhe Sun, Jiawei Zhou

Stony Brook University · Toyota Technological Institute at Chicago

Hallucination Detection in VLMs

Open paper AskPDF arXiv

Hallucinations remain a persistent challenge for vision-language models (VLMs), which often describe nonexistent objects or fabricate facts. Existing detection methods typically operate after text generation, making intervention both costly and untimely. We investigate whether hallucination risk can instead be predicted before any token is generated by probing a model's internal representations in a single forward pass. Across a diverse set of vision-language tasks and eight modern VLMs, including Llama-3.2-Vision, Gemma-3, Phi-4-VL, and Qwen2.5-VL, we examine three families of internal representations: (i) visual-only features without multimodal fusion, (ii) vision-token representations within the text decoder, and (iii) query-token representations that integrate visual and textual information before generation. Probes trained on these representations achieve strong hallucination-detection performance without decoding, reaching up to 0.93 AUROC on Gemma-3-12B, Phi-4-VL 5.6B, and Molmo 7B. Late query-token states are the most predictive for most models, while visual or mid-layer features dominate in a few architectures (e.g., ~0.79 AUROC for Qwen2.5-VL-7B using visual-only features). These results demonstrate that (1) hallucination risk is detectable pre-generation, (2) the most informative layer and modality vary across architectures, and (3) lightweight probes have the potential to enable early abstention, selective routing, and adaptive decoding to improve both safety and efficiency.

Abstract

Hallucination Detection in VLMs

Explore similar work

HALP: Detecting Hallucinations in Vision-Language Models without Generating a Single Token

Overthinking Causes Hallucination: Tracing Confounder Propagation in Vision Language Models

Role-Break in Attention Heads: Understanding and Detecting Hallucinations in VLMs