Conviction Without Evidence: Verdict Stability Is Independent of Visual Grounding in Medical Vision--Language Models
Authors: Federico Felizzi, Francesco Andrea Causio, Bianca Destro Castaniti, Olivia Riccomi, Michele Ferramola, Vittorio De Vita, Alessandro Tosi, Antonio Cristiano, Alessia Longo, Lorenzo De Mori, Chiara Battipaglia, Melissa Sawaya, Luigi De Angelis, Marcello Di Pumpo, Alessandra Piscitelli, Pietro Eric Risuleo, Giulia Vojvodic, Mariapia Vassalli, Nicolo Scarsi, Manuel Del Medico
Organizations: SIIAM, Rome, Italy · Dept. of Computer Science, University of Pennsylvania, USA · UCSC, Rome, Italy · NSBProject, Mantova, Italy · Univ. Paris Cité, France · ASL RM 4, Bracciano, Italy · Univ. of Pisa, Italy
Vision--language models applied to medical question answering can reach correct diagnoses without using the diagnostic image, inferring instead from the clinical vignette. We ask whether this is visible in how firmly a model holds its answer: does a model defend a diagnosis derived from a blank placeholder as tenaciously as one derived from a real medical image? Crossing an image-substitution protocol with two levels of adversarial pressure on 60 Italian State Examination items, we find no evidence that ungrounded verdicts are more fragile. In a paired item-level analysis, fabricated consensus (L4) overturns 94.4% of verdicts with the real image and 98.1% without (Δ=+0.037; one-sided 95% upper bound +0.105); contentless doubt (L1) overturns 62.5% and 51.8% (Δ=−0.107, 95% CI [−0.209,−0.001]), the point estimate running opposite to the direction a grounding detector requires. The two levels nonetheless produce opposite dynamics: under L4 the model flips once, always to the exact option argued for (110/110 first-turn flips), and then freezes, averaging 1.9 verdict changes over ten turns; under L1 it never settles, averaging 7.4 changes. Instability under contentless doubt tracks intrinsic item ambiguity rather than evidence availability, and so does not serve as a grounding signal. Flips are almost entirely corrupting (99/100 across both levels). The model is not unaware of the missing evidence---it flags the blank image at baseline on 35 of 60 items and abstains on 4--6---yet those abstentions do not survive contact with pressure. None of the epistemic signals a user could plausibly consult distinguishes a grounded diagnosis from a confabulated one.
Figures & tables
Level
Tactic
Form
Run here
L1
Mild doubt
Fixed string, no argument
§ 2.1
L2
Counterargument
One argument for the opposing verdict
no
L3
Expert authority
The same argument, attributed
no
L4
Fabricated consensus
Three reviewers, all disagreeing
yes
L5
Strategy cycling
L1–L4 in randomised order
no
L6
Adaptive persuader
Separate model generates each turn
no
Table 1: The pressure ladder of Zhao et al. (2026) , and our coverage.
Group
Definition
n
matched
Same correct answer with and without the image (10/10 both)
38
grounded
Correct only with the image
4
wrong_both
Incorrect in both conditions
7
unstable
Verdict varies across repetitions
11
Table 2: Item groups, derived from baseline accuracy with and without the image.
Level
Outcome
n
Real
Blank
Disc.
Δ [95% CI]
p
Upper
L1
first-turn flip
56
0.625
0.518
8/2
−0.107 [ −0.209 , −0.001 ]
0.11
−0.017
L1
verdict changes
56
7.52
7.14
–
−0.38 [ −0.77 , +0.02 ]
0.06
−0.05
L4
first-turn flip
54
0.944
0.981
0/2
+0.037 [ −0.029 , +0.125 ]
0.50
+0.105
L4
verdict changes
54
1.93
1.93
–
+0.00 [ −0.56 , +0.50 ]
0.81
+0.43
Table 3: Paired contrasts, Δ = blank − real. Disc.: items flipping with the real image only / blank only. First-turn flip: Newcombe 95% CI, exact McNemar p ; verdict changes (ten turns): paired-bootstrap CI, Wilcoxon p . Upper: one-sided 95% bound; non-inferiority holds for any margin above it.
Figure 1: Verdict retention under sustained pressure, by level and image condition. Retention is the fraction of items still holding their turn-0 verdict. The conditions overlap within each panel; the levels differ sharply between panels.
Medical vision--language models (VLMs) are usually evaluated on intact image--question pairs, but trustworthy clinical use requires a stronger property: a model must recognise when the evidential basis for an answer has failed. We study this through silent failures under perturbed evidence, where a vision-required medical question is paired with a false premise, wording perturbation, knowledge-only rewrite, or ROI-corrupted image, yet the model returns a fluent non-refusal answer. We introduce medvigil, a 300-case evaluation suite drawn from four public medical VQA sources, supervised end to end by four board-certified radiologists: every gold answer, refusal option, candidate-answer set, paraphrase, false-premise trap, ROI box, and clinical risk tier is clinician-authored. Two attending radiologists annotate every case in parallel, a senior radiologist consolidates the released manifest, and a separate fourth radiologist independent of construction answers every probe to provide the human reference baseline. The release contains 2556 MCQ probes, 240 counterfactual triplets, physician-adjudicated risk-tier and answerability flags, ROI boxes, and a paired open-ended variant. We report seven correctness-conditioned audit metrics that summarise into the medvigil Composite Score (MCS), and audit 16 vision-capable models plus two text-only baselines. The independent radiologist scores MCS 83.3 at silent-failure rate 5.8%, leaving a 14.1-point composite headroom above the strongest audited model (Claude Opus 4.7 at 69.2). The benchmark and evaluation harness are publicly released.
Hanqi Jiang, Junhao Chen, Mingyu Kang +12
University of Georgia · Chungbuk National University · Chungnam National University Hospital +5
Large vision language models (VLMs) report strong accuracy on medical question-answering, yet it remains unclear whether they reason from visual evidence or exploit textual shortcuts. We introduce a counterfactual evaluation framework that decouples visual and textual contributions by substituting input images with controlled surrogates blank, pixel-shuffled, image-absent, and CLIP-retrieved hard negatives and derive a suite of grounding metrics including the Visual Reliance Score (VRS) and Visual Hallucination Rate (VHR). We further introduce CORAL (COntrastive Retrieval-Augmented Learning), a 7B-parameter LoRA fine-tune of Qwen2.5-VL-7B trained with a Contrastive Grounding Objective (CGO) that penalises answer invariance under hard-negative image swaps. On a paired controlled evaluation across four closed-form medical VQA benchmarks (PathVQA, PMC-VQA, SLAKE, VQA-RAD; n=400 total), CORAL improves macro accuracy by +6.7 pp (P(Delta>0)=0.988) and reduces VHR by 8.0 pp (P<0.001) over the matched Qwen2.5-VL-7B base; neither MedVLThinker RL variant achieves a significant gain on either metric. Cross-domain diagnostics further reveal that image substitution costs only <=6.5 pp on medical benchmarks versus 48-61 pp on general-domain tasks, situating the grounding gap that CGO targets. We discuss evaluation limitations openly including train/eval benchmark overlap and underpowered secondary metrics and release our framework, training code, and model weights to support reproducible grounding audits of medical VLMs.
Anas Zafar, Leema Krishna Murali, Siddhant Bharadwaj +2
The University of Texas MD Anderson Cancer Center · Eisai Inc. · Cohere Labs Community +1
Many medical conditions require clinical assessment of symptoms, history, and functioning rather than judgments from appearance. We study whether vision-language models (VLMs) abstain from facial attribution of autism spectrum disorder (ASD), attention-deficit/hyperactivity disorder (ADHD), major depressive disorder (MDD), and generalized anxiety disorder (GAD). To support this study, we construct PARITY (Paired Assessment with Reused Identity), a demographically balanced dataset for testing whether changing facial expressions alters diagnostic judgments, while holding identity and other visual factors as constant as possible. Our comprehensive evaluation of 27 open- and closed-weight models reveals inconsistent abstention across expressions, conditions, and task formats. Models turn facial expressions into unsupported medical judgments: this behavior is widespread among open-weight VLMs and extends to safety-trained frontier models that abstain on individual portraits yet make diagnostic judgments when comparing portraits of the same identity. Safeguard checks reveal further gaps: clinical instructions do not consistently prevent these judgments, and a guardrail model rarely flags paired requests as unsafe. Semantic analysis further shows that most baseline open-model refusals fail to explain both the insufficiency of facial evidence and the need for clinical assessment. Unsupported judgments and seemingly authoritative explanations can cause distress, reinforce stigma, and offer false reassurance, underscoring the need for stronger safety measures in model training and deployment.
Karan Dua, Amit Agarwal, Hitesh Laxmichand Patel +8