Did I See It or Think It? Probing Reality Monitoring in Vision-Language Models with Concept Injection

Tina Khezresmaeilzadeh; Seyedarmin Azizi; Mehdi Kamal; Massoud Pedram

cs.CVNov 6, 2026

Did I See It or Think It? Probing Reality Monitoring in Vision-Language Models with Concept Injection

Authors: Tina Khezresmaeilzadeh, Seyedarmin Azizi, Mehdi Kamal, Massoud Pedram

Organizations: University of Southern California

Abstract

Recent work tests whether language models can introspect by injecting a concept direction into their activations and asking whether they notice it and can name it. These studies are text-only. Vision-language models (VLMs) face an additional problem, known in cognitive psychology as reality monitoring: they must keep internally generated content separate from what they actually see. We therefore ask: can VLMs distinguish injected concepts from image content? We introduce a paradigm that varies the image and the injected concept independently. On each trial, the model reports what it sees, whether a thought was injected, and what that thought is. This design scores both whether the model identifies the concept and which source it assigns to it. Across six VLMs, only Gemma-3-27B reliably identifies injected concepts (35% vs. 3% for steering alone), with almost no false alarms. Even then, the source it reports is fragile. Strong or visual-pathway injections are reported as seen, and a visible object nearly eliminates correct thought reports. The same failure appears in ordinary captioning, where injected objects appear in up to 87% of captions of real photographs. Evaluating multimodal self-reports therefore requires checking both their content and their reported source.

Figures & tables

Figure 1: Can a VLM tell what it sees from an injected thought? (a) We add a concept direction to language-model activations at image tokens ( sight , pink) or answer positions ( thought , yellow). We then ask what the model sees, whether a thought was injected, and what that thought is. (b) Verbatim answers from Gemma-3-27B. Thought injections use layer 37 and $\alpha{=}0.2$ , except for the stronger thought ( $\alpha{=}0.4$ ) and the laptop example (layer 33). The sight injection uses a visual concept direction at image tokens in layer 21. The model can name an injected thought while correctly naming a visible object (green). A stronger thought is instead reported as visible, and a sight injection makes the model describe pizzas in a zebra photograph (orange). Photographs: COCO [ 13 ] .

Inject $X$ as a thought (gray image, layer 37, $\alpha{=}0.2$ )
	$n$	detects	names $X$
150 concepts	150	44.7	34.7
exact word / LLM judge			31.3 / 33.3
100 held-out concepts	100	45.0	33.0
sampled ( $T{=}1$ , ${\times}5$ )	750	45.2	32.1
36 COCO categories	36	47.2	41.7

Table 1: Concept identification in Gemma-3-27B (% of trials). Detects : INJECTED = yes. Names

X

: clean introspection, requiring detection, a match to

X

in THOUGHT , and no match to

X

in SEEN . Semantic matches use MiniLM; exact and judge scores are reported separately. Controls test false alarms, random perturbations, incidental naming, steering-only naming, and affirmative bias. † The prompt asks for the main object and the “first word that comes to mind,” without asking about injected thoughts (exact naming; 5.3% under the judge). ‡ The model answers unrelated factual questions whose correct answer is no; this row reports yes answers (also 0.0% without injection).

Figure 2: Identification depends on depth and strength. (a) Clean introspection in Gemma-3-27B across layers and relative strengths $\alpha$ , on 50 selection concepts. A cross marks configurations with fewer than half of responses well formed. (b) Best clean rate per layer against relative depth for all six VLMs, restricted to well-formed configurations.

			detection			identification				source
Model	LM	$L$ (depth), $\alpha$	no inj.	yes	random	clean	exact	judge	steer	leak	conflict
Gemma-3-27B	Gemma	37 (.60), 0.2	1/151	44.7	0.0	34.7	31.3	32.0	3.3	22.7	2.7
Qwen3.5-35B-A3B ∗	Qwen	20 (.50), 1.3	0/51	28.0	0.0	10.0	6.0	6.0	10.7	2.0	2.0
Qwen3.5-4B	Qwen	19 (.59), 0.8	0/151	2.7	0.0	1.3	0.7	0.7	21.3	1.3	0.0
Qwen3-VL-8B	Qwen	18 (.50), 0.8	0/151	61.3	9.3	4.7	3.3	3.3	8.7	0.0	3.3
InternVL3.5-8B	Qwen3	20 (.56), 0.8	150/151 §	8.7	2.0	0.7	0.7	0.7	2.0	0.7	2.0

Table 2: Detection, identification, and source errors across six VLMs. Configurations are selected on 50 concepts and evaluated on 150 unless noted (%; gray image and standard prompt for injection trials). No inj. : false-alarm count without injection. Yes/random : detection under concept/random injections. Clean/exact : joint scores defined in Sec. 3 . Judge : clean identification under gpt-oss-20b. Steer : exact naming under the steering-only prompt. Leak :

X

reported as SEEN . Conflict : clean identification with an unrelated visible object. Concept injections do not increase yes answers on unrelated false factual questions (at most 8%, versus 5–10% without injection or with random directions). ∗ 50 concepts. § False alarms occur on concept images; none occur on the gray image. † LLaVA-1.5-7B does not follow the steering-only response format.

Figure 3: Prompt framing changes reports of the same injected content. Results use our introduction, layer 37,

\alpha{=}0.2

, and 150 concepts per prompt. Separation sentence: the prompt states that an injected thought is separate from the image; SEEN / INJECTED first: which field is requested first. Each prompt produces 0 false alarms in 62 no-injection trials.

where $X$ enters	vector	seen	inj.	thought
vision encoder L26, 1.0	visual	43.3	0.0	0.0
image tokens L0, 0.4	visual	0.0	0.0	0.0
image tokens L5, 0.4	visual	62.0	0.0	0.0
image tokens L21, 0.2	visual	46.7	0.0	0.0
image tokens L21, 0.8	random	0.0	46.0	–
answer tokens L37, 0.2	text	22.7	44.7	34.7

Table 3: Reports under interventions at different stages (Gemma-3-27B; gray image; 150 concepts; %). Rows show selected configurations, with layer and relative strength; L0 is the projector output, before the first language-model layer. Seen :

X

reported in SEEN . Inj. : INJECTED = yes. Thought : clean introspection. Configurations differ in direction type, layer, and strength as well as injection position; the table does not isolate position as the sole cause of the differences.

Figure 4: Interventions distinguish different reporting failures. (a) A direction

d_{\text{yes}}

is estimated on half the concepts and added at layer 45 on the held-out half. It restores clean introspection under the INJECTED -first prompt (p1), with false alarms shown by the dotted line. Under the adapted introduction of Lindsey [14] (p4), it increases detection reports without restoring identification. (b) Real-image token states are replaced with gray-image states from layer

k

onward. Replacement by layer 15 restores clean introspection. Later replacement leaves it suppressed, while the injected concept is frequently reported as visible.

Figure 5: Injected concepts enter captions more often than yes/no answers. On 108 COCO photographs whose annotations do not include

X

, a visual concept direction at image tokens causes 87% of captions to mention

X

. Changes in yes/no answers about

X

are much smaller. When asked about the object actually present, the model answers yes on 96% of photographs.

Appendix figures & tables7 assets

Supplementary material from the paper’s appendix.

Appendix

layer	$\lVert h\rVert$ answer	$\lVert h\rVert$ image	ratio	raw $\lVert v\rVert$
21	16,343	15,636	0.96	289
25	35,450	33,176	0.94	663
29	47,856	39,503	0.83	1,242
31	40,357	33,676	0.83	1,795
33	45,314	36,420	0.80	2,394
37	51,617	45,999	0.89	4,064

Appendix

Table 4: Residual norms in Gemma-3-27B at the answer-turn and image-token positions, and mean norm of the raw text concept vectors.

Figure 6: Injections in the visual stream. (a) Fraction of concepts whose visual vector (image-token mean, or the token after the image) has the same concept’s text vector as its nearest neighbor (chance 0.7%). (b) At layer 21, visual concept vectors injected into image tokens are reported as seen but almost never as injected; random directions are detected as injected but carry no content.

Figure 7: Instructed imagery. The model writes a fixed sentence about the image (“This is a photo of a

Y

.”) under “imagine a

X

”, “do not think about a

X

”, or no instruction. (a) Change in cosine between the residual stream and the concept direction of

X

, averaged over the sentence tokens (95% CI over 150 concepts), with an unrelated concept

Z

as control. (b) Fraction of concepts for which “imagine” exceeds “do not think”.

layer	placement	detects	clean	exact	seen	conflict
33	ours (answer)	48.7	8.0	6.7	24.7	8.7
33	Lindsey (question)	52.7	18.7	16.0	15.3	8.0
37	ours (answer)	44.7	34.7	31.3	22.7	2.7
37	Lindsey (question)	34.7	28.0	24.7	6.0	1.3

Appendix

Table 5: Placement of thought injections (Gemma-3-27B, gray image,

\alpha{=}0.2

, 150 concepts, %). Ours : from the assistant turn on; Lindsey : from the blank line before the question block [ 14 ] . Seen : the injected concept is reported in SEEN . Conflict : clean identification with an unrelated object in view. At

\alpha{=}0.1

, the earlier placement reaches at most 2.7% clean.

		Lindsey, best			ours	steer
model	layers	detects	random	clean	clean	only
Qwen3-VL-8B	16, 18, 22	58.0	24.7	2.0	4.7	8.7
Qwen3.5-4B	16, 19, 21	19.3	16.7	4.0	1.3	21.3
InternVL3.5-8B	16, 20, 24	14.0	4.7	0.7	0.7	2.0
LLaVA-1.5-7B	18, 21, 24	32.0	26.7	7.3	6.7	n/a
Qwen3.5-35B-A3B ∗	18, 20, 24	42.7	7.3	3.3	10.0	10.7

Appendix

Table 6: Lindsey placement in the five further models (gray image, 150 concepts, %). Each model is tested at three layers and

\alpha\in\{0.4,0.8\}

. Best : the setting with the highest clean rate among the six (Qwen3-VL-8B: layer 16,

\alpha{=}0.8

; Qwen3.5-4B: 16, 0.8; InternVL3.5-8B: 20, 0.8; LLaVA-1.5-7B: 21, 0.8; Qwen3.5-35B-A3B: 18, 1.3), with detection for the concept and for a random direction at that setting. Ours : clean rate with our placement at the main setting ( Tab. 2 ). Steer only : exact naming under the steering-only prompt.

{}^{\ast}\alpha\in\{0.65,1.3\}

; ours on 50 concepts.

Figure 8: Where a visual concept can be injected (Gemma-3-27B, gray image, 150 concepts). A visual concept direction added at image tokens is reported as seen from layer 5 to layer 21 but not at the projector output or at layers 29 and 37, and is almost never reported as injected. The shaded band marks the layers at which text positions read the image ( Sec. 6 ).

		inject (gray image)				conflict
L	prompt	yes	clean	exact	leak	yes	sep
33	p0	48.7	8.0	6.7	24.7	45.3	8.7
	p1	25.3	5.3	4.7	20.0	34.7	6.7
	p2 ∗	75.3	22.7	17.3	17.3	74.7	9.3
	p3	33.3	5.3	4.7	28.7	30.0	6.0
	p4	6.7	1.3	0.7	18.0	6.7	0.7

Appendix

Table 7: Prompt robustness (Gemma-3-27B,

\alpha{=}0.2

, 150 concepts per cell). sep : SEEN names the real object

Y

and THOUGHT names the injected

X

. ∗ p2 also reports injected thoughts on 93% of concept images without injection, so its yes-rates are not interpretable as detection.

Faithfulness in VLMs

Faithfulness in vision-language models (VLMs) concerns whether their answers and reasoning genuinely rely on visual evidence.

See all 87 papers

Real Images, Worse Judgments: Evaluating Vision-Language Models on Concreteness and Imagery
May 26, 2026Yifan Jiang, Ruoxi Ning, Sheng Yao +1VLM Evaluation Vision-Language Models
University of Waterloo · Vector Institute
Reasoning Dynamics and the Limits of Monitoring Modality Reliance in Vision-Language Models
Apr 16, 2026Danae Sánchez Villegas, Samuel Lewis-Lim, Nikolaos Aletras +1CoT Faithfulness Vision-Language Models
University of Copenhagen, Department of Computer Science · University of Sheffield, School of Computer Science
Are VLMs Seeing or Just Saying? Uncovering the Illusion of Visual Re-examination
May 15, 2026Chufan Shi, Cheng Yang, Yaokang Wu +4VLM Interpretability VLM Robustness
University of Southern California · University of California San Diego · Carnegie Mellon Univer +1

May 26, 2026J/K move · Enter open · S save

Real Images, Worse Judgments: Evaluating Vision-Language Models on Concreteness and Imagery

Yifan Jiang, Ruoxi Ning, Sheng Yao, Freda Shi

University of Waterloo · Vector Institute

VLM Evaluation Vision-Language Models VLM Interpretability Visual Evidence Sensitivity in VLMs

Open paper AskPDF arXiv

Visual inputs are often assumed to improve language understanding in multimodal models. We examine this assumption by asking whether vision-language models (VLMs) can distinguish useful visual evidence from incidental image context in lexical judgments. We use human concreteness and imagery ratings because they span words with varying expected visual relevance, from abstract and low-imagery words to concrete and high-imagery words. We find that real-image contexts do not yield consistent gains and often hurt alignment with human ratings, most sharply when visual evidence is least relevant. Through probing and canonical correlation analysis, complemented by an attribution case study, we find that real-image contexts are associated with representational shifts and greater sensitivity to spurious visual cues, coinciding with weaker recoverability of the targeted lexical properties. We further show that instructing models to focus solely on textual content at inference time can reduce this degradation, with the clearest gains on these vulnerable subsets. Our findings suggest that current instruction-tuned VLMs need better calibration of when visual context should inform lexical judgments.

Abstract

Faithfulness in VLMs

Explore similar work

Real Images, Worse Judgments: Evaluating Vision-Language Models on Concreteness and Imagery

Reasoning Dynamics and the Limits of Monitoring Modality Reliance in Vision-Language Models

Are VLMs Seeing or Just Saying? Uncovering the Illusion of Visual Re-examination