Detect Before You Leap: Mirage Detection in Vision–Language Models

Table 4 provides the detailed dataset composition used in our mirage detection experiments. We evaluate across five visually diverse VQA domains: Chest VQA, PathVQA, TextVQA, DocVQA, and InfoVQA. For each domain, examples are organized into three input conditions: Related, where the image is semantically matched to the question; Unrelated-Real, where the image is visually valid but does not contain evidence relevant to the question. Unrelated-Real images are sampled cross-domain: for a question from domain $d$, the paired unrelated image is drawn uniformly at random from a different domain (e.g., a natural scene image paired with a medical question), ensuring visual plausibility without semantic relevance; and Blank/Noise, where the visual input is non-informative. This construction allows us to evaluate not only whether the detector preserves answerability for genuinely related image–question pairs, but also whether it can reject both low-level invalid inputs and harder semantic mismatches. The training set contains 100 samples per domain per condition, while the remaining examples are used for held-out evaluation.

The full system uses Python, PyTorch Paszke et al. (2019), OpenCLIP Ilharco et al. (2021), scikit-learn Pedregosa et al. (2011), XGBoost Chen and Guestrin (2016), and LightGBM Ke et al. (2017). All experiments use a fixed random seed of 42. Our anonymized code is provided here: https://anonymous.4open.science/r/Mirage_Detection_in_VLMS-779D/.

For the structured VLM output, we used a deterministic structured output prompt as shown in Fig. 8.

Algorithm 1 summarizes the runtime inference procedure for the proposed mirage detection framework. Given an image–question pair, the system first applies a lightweight blank/noise screen. Non-blank inputs are then processed through CLIP-based domain routing and TC-LIA feature extraction. The VLM is queried only for a structured preliminary class label and candidate answer, and the final decision is made by the ensemble classifier using pixel, routing, alignment, and VLM-derived features. If the ensemble predicts Related, the VLM answer is released; otherwise, the system returns a refusal response.

The five scalar TC-LIA features (Table 5) were selected from thirteen candidate features by evaluating each candidate’s ability to separate related from unrelated image–question pairs using AUROC on a controlled 200-pair dataset (100 related, 100 unrelated, balanced across natural and medical domains). The thirteen candidates spanned three families: CLS-based similarity (late_cls_sim_mean, slope_cls_sim), patch top-$k$ alignment (late_patch_topk_mean, gain_patch_topk_late_minus_early, slope_patch_topk), and attention-weighted patch alignment (late_attn_weighted_sim_mean, gain_attn_weighted_late_minus_early, slope_attn_weighted, late_attn_topk_semantic_mean).

CLS-based features were dropped because the CLS token aggregates global image information at the final layer and is therefore highly correlated with final_cos; adding them introduced redundancy without improving separability. Attention-weighted features were dropped because they inherit the same failure mode as raw RAPT: the encoder’s self-attention is not conditioned on the question text, so attention-weighted similarity reflects visual salience rather than question relevance. Patch top-$k$ features avoided this problem by selecting the patches with the highest cosine similarity to the text embedding directly, bypassing attention weights entirely.

The five retained features capture complementary and non-redundant evidence signals. final_cos measures global image–text compatibility as a strong baseline. late_patch_topk_mean measures whether localised question-relevant evidence appears in the deeper visual layers. gain_patch_topk_late_minus_early measures whether that evidence strengthens from early to late layers, suppressing layer-invariant shortcuts. slope_patch_topk summarises the global trajectory of alignment across all 32 layers. internal_alignment_score (IAS) combines these signals into a single compact scalar score:

An internal-only logistic-regression probe trained exclusively on the patch top-$k$ features (excluding final_cos) achieved AUROC above 0.90, confirming that the layerwise trajectory carries separable information beyond global cosine similarity alone.

When no image is supplied to the pipeline — for example, when an API call omits the image field or when the image file fails to load — rather than introducing a separate detection branch, we propose a simple unified treatment: define a zero tensor $\mathbf{0}$ of the expected spatial dimensions and compute $\tilde{x}=x\oplus\mathbf{0}$, where $\oplus$ denotes element-wise addition. For an informative image $x$, this operation is a no-op and the image passes through the pipeline unchanged. When no image is provided, $x$ itself is treated as $\mathbf{0}$, yielding an all-black representation whose pixel statistics — near-zero grayscale standard deviation and zero patch-variance coefficient of variation — are immediately flagged by the Stage 1 blank/noise gate, triggering a refusal response. This approach requires no additional detection module: the no-image case is subsumed by the existing blank/noise safeguard at no extra cost.

Figure 9 directly validates the two core design assumptions of TC-LIA: that the fixed final-layer projection $W_{v}$ provides a content-neutral readout of intermediate tokens, and that the discriminative signal is concentrated in the late vision-encoder layers.

Figure 10 provides complementary evidence for the TC-LIA hypothesis through Representational Similarity Analysis (RSA). For each ViT-H/14 layer, we compute the Spearman correlation between the pairwise distance matrix of the projected patch representations and that of the final-layer representations (RSA to final-layer RDM), separately for Related and Unrelated pairs.

A key question for mirage detection is whether TC-LIA can distinguish a related image from an in-domain hard negative – an unrelated image drawn from the same visual domain (e.g., a different chest X-ray paired with a chest VQA question). Figure 11 reports a direct evaluation of this question across all five domains.

TC-LIA’s design rests on two structural properties of the visual encoder: softmax contrastive training that aligns patch tokens with text embeddings, and a $W_{v}$ projection that faithfully maps intermediate tokens into the joint CLIP space. Figure 12 tests both properties by comparing the late-layer alignment gap ($\Delta=\mu_{\text{related}}-\mu_{\text{unrelated}}$ over the final 20% of layers) across five encoders spanning different training objectives and architectures.

• •

  CLIP ViT-H/14 (laion2b), $\Delta=+0.0464$. Strongest signal. Related alignment rises sharply after normalized depth $\approx$0.6 while Unrelated remains flat, producing the widening late-layer gap across samples. This result justifies CLIP ViT-H/14 as the primary TC-LIA backbone.

• •

  MetaCLIP ViT-H-14, $\Delta=+0.0180$. Positive but weaker signal; separation appears only in the final 20% of layers. MetaCLIP uses the same softmax contrastive loss as CLIP on curated data: the same training objective reproduces the late-layer phenomenon, albeit attenuated.

• •

  SigLIP SO400M, $\Delta=+0.0098$. Marginal signal despite being a large contrastively trained model. SigLIP uses sigmoid binary loss rather than softmax, which fundamentally changes how patch tokens align to text and suppresses the late-layer amplification TC-LIA depends on.

• •

  DINOv2-Large, $\Delta=-0.0021$. Negative control. Both curves are nearly identical throughout all layers. DINOv2 has no text supervision; the random projection into text space produces noise. The near-zero gap confirms that TC-LIA requires text-visual co-training.

• •

  EVA-CLIP EVA02-L-14, $\Delta=-0.0012$. Despite contrastive training, near-zero signal with very wide confidence intervals. The $W_{v}$ approximation is likely lossy for EVA-CLIP’s TimmModel architecture, where intermediate token geometry may not map cleanly into the text embedding space via ln_post and proj.

These results establish that TC-LIA’s signal is gated on softmax contrastive co-training (CLIP-style loss): the method generalizes to MetaCLIP ($\Delta=+0.0180$) but degrades with sigmoid loss (SigLIP) or without text supervision (DINOv2), while EVA-CLIP’s architecture likely breaks the $W_{v}$ projection assumption. CLIP ViT-H/14 (laion2b) is empirically the optimal backbone, justified by direct comparison across encoder families.

Figure 13 provides a domain-wise view of the TC-LIA alignment trajectory. Across all five domains, Related examples generally show increasing top-$k$ patch–text similarity in later layers, consistent with the emergence of question-relevant visual evidence. In contrast, Unrelated-Real inputs remain flatter and lower, indicating weaker semantic correspondence between the question and image. Blank/Noise inputs often show unstable or non-semantic intermediate behavior, but lack the sustained late-layer rise observed for related pairs. These patterns support the use of late alignment, gain, and slope as complementary TC-LIA features.

Figure 14 expands the aggregate IAS distribution in Fig. 3 (b) by showing each domain separately. The main pattern is consistent across datasets: Related examples tend to shift toward larger IAS values, Unrelated-Real examples occupy lower values, and Blank/Noise examples concentrate in a narrower intermediate range. The degree of separation varies by domain, motivating the use of ensemble fusion rather than a single universal IAS threshold.

Domain-adaptive routing improves medical-domain cosine similarity by switching to BioMedCLIP when the image is confidently medical, but it can slightly degrade document or natural-image domains when mixed-content images are routed imperfectly. We therefore use routing probabilities and the encoded routing decision as features rather than treating routing as a hard final decision.

Table 7 compares ensemble choices. XGBoost gives the best accuracy–mirage tradeoff, while Gradient Boosting, LightGBM, AdaBoost, and Random Forest remain close. The rule-based baseline is useful as a sanity check but is weaker and was evaluated in-sample, so it should not be treated as the main comparator.

Figure 15 reports answer quality across all three input conditions for both the base-prompt and ensemble-filtered settings. Each row corresponds to a condition among Related, Unrelated-Real, and Blank/Noise and each column reports a different metric: BLEU, ROUGE-L, and BERTScore F1. For Related inputs, answer quality is measured against ground-truth answers; for Unrelated-Real and Blank/Noise inputs, it is measured against a set of six canonical refusal phrases, so a higher score means the system correctly refused. TC-LIA + Ensemble matches or improves the base prompt in every cell of the $3\times 3$ grid. On Related inputs, ensemble filtering preserves answer quality, confirming that mirage suppression does not collapse into indiscriminate refusal. On Unrelated-Real and Blank/Noise inputs, the ensemble substantially raises refusal-match scores across all twelve VLM backbones, demonstrating that the detector reliably withholds responses when visual evidence is absent or mismatched.

Feature importance is reported only as a diagnostic because tree-based importances are not causal explanations. Nevertheless, the rankings provide useful evidence that TC-LIA contributes signal beyond what either final cosine similarity or VLM self-assessment alone could provide.

Figure 16 shows XGBoost and LightGBM importances aggregated over Qwen2.5-VL-7B. In XGBoost (left), internal_alignment_score is the single most important feature by a wide margin (importance $\approx$0.32), followed by vlm_class_enc ($\approx$0.17) and final_cos ($\approx$0.15). LightGBM (right) shows a more distributed ranking: final_cos, gain_patch_topk_late_minus_early, internal_alignment_score, and slope_patch_topk are roughly tied at the top, with domain-routing features (pm, pn) contributing moderately. The two classifiers agree that the composite IAS, final cosine, and the gain/slope trajectory are the most informative TC-LIA signals, while blank-gate features (s1_is_blank) rank near the bottom because blank inputs are trivially handled before the ensemble is invoked.

Figure 39 breaks down XGBoost importance across five representative VLM backbones. The pattern is consistent: IAS and final_cos are top-two features for BLIP2-2.7B, Gemma-3-4B, Phi-3.5-Vision, and LLaVA-OV-7B. The notable exception is Qwen2.5-VL-7B, where vlm_class_enc dominates ($\approx$0.47), indicating that Qwen’s structured responses are unusually discriminative and the ensemble relies heavily on self-assessment for that backbone. Across all five models, no single feature suffices alone, confirming that ensemble fusion over complementary signals is necessary for robust detection.

We train the TC-LIA ensemble on four domains and evaluate on the held-out fifth, using Gemma-3-4B-IT as the VLM backbone. Figure 17 shows that 3-class accuracy ranges from 72.0% (PathVQA) to 96.3% (InfoVQA), and mirage rate stays between 1.4% and 6.7% across all held-out domains. ChestVQA is the hardest generalisation target (6.7% mirage rate) due to its distinctive medical visual distribution. These results confirm that TC-LIA features transfer across domains without domain-specific fine-tuning.

We pool training data from eight VLMs and evaluate on the held-out ninth, testing two variants: the full 11-feature ensemble (with vlm_class) and the same ensemble with the VLM class encoding removed (no vlm_class). Figure 18 shows that accuracy remains consistently high (85–90%) across all held-out VLMs, confirming that the ensemble generalises across unseen model families. Removing the VLM class feature raises mirage rate noticeably for BLIP2-2.7B and Gemma-3-4B, the two models whose structured outputs differ most from the training pool, demonstrating that vlm_class_enc encodes model-specific response style that aids detection when that style is familiar. The gap is small for the larger models (AyaVision-32B, Qwen2.5-VL-32B), suggesting that TC-LIA features alone are sufficient when the VLM backbone is more capable.

Let $a_{L}$ denote the late-layer top-$k$ patch alignment statistic. Assume that $a_{L}|R$ and $a_{L}|U$ are sub-Gaussian with means $\mu_{R}$ and $\mu_{U}$, respectively, and with common proxy variance $\sigma^{2}$. Thus, for any $t>0$,

and

Let $\Delta=\mu_{R}-\mu_{U}>0$ and define the decision threshold

The threshold classifier predicts $\hat{y}=R$ if $a_{L}>\tau$ and predicts $\hat{y}=U$ otherwise.

For a related pair, an error occurs when $a_{L}\leq\tau$. Therefore,

Since

we have

Applying the sub-Gaussian lower-tail bound with $t=\Delta/2$ gives

Similarly, for an unrelated pair, an error occurs when $a_{L}>\tau$. Thus,

Since

we obtain

Applying the sub-Gaussian upper-tail bound with $t=\Delta/2$ gives

Therefore, the per-class error of the threshold classifier is bounded by

This proves Lemma 1.

Assume that the layer-wise alignment statistic can be written as

where $c(x,q)$ is a layer-invariant global image–text prior, $r_{\ell}(x,q)$ is a localized evidence term that varies across layers, and $\epsilon_{\ell}$ is noise. Let $\mathrm{early}$ and $\mathrm{late}$ denote the average alignment over the early and late layer sets:

Substituting the decomposition of $a_{\ell}$ gives

and

where $r_{E}$ and $r_{L}$ are the average localized evidence terms in the early and late layers, and $\epsilon_{E}$ and $\epsilon_{L}$ are the corresponding average noise terms.

The gain feature is

Thus, the layer-invariant term $c(x,q)$ cancels exactly. Consequently, the gain feature suppresses global similarity shortcuts that persist across layers and instead emphasizes the emergence of localized evidence from early to late layers. This proves Lemma 2.

Let $B$ denote the event that the input is blank/noise, and let $U$ denote the event that the input is unrelated-real. A mirage error occurs when a non-related input is incorrectly passed as related. Therefore,

Since $B$ and $U$ are disjoint classes,

For a blank/noise input to be passed as related, it must first fail to be rejected by the blank/noise gate. Therefore,

Using the product rule,

By definition, $\epsilon_{B}=P(g_{B}\neq B\mid B)$, so

For unrelated-real inputs, the relevant failure mode is that the non-blank related/unrelated detector passes the input as related. Thus,

Again applying the product rule,

By definition, $\epsilon_{U}=P(g_{N}=R\mid U)$, so

Combining the two bounds gives

This proves Proposition 1. The result shows that the overall mirage risk can be reduced by separately controlling blank/noise failures through $g_{B}$ and semantic mismatch failures through $g_{N}$, which matches the staged design of the proposed detector.

We first constructed a small image–text relevance dataset containing natural images, medical images, related prompts, and unrelated prompts. Standard OpenCLIP/BioMedCLIP final cosine similarity performed perfectly on the tiny 16-pair setting. However, this was not evidence of a robust solution: the dataset was too small, the negatives were often easy cross-domain mismatches, and final cosine did not test whether internal localized evidence emerged across layers.

Takeaway. Initial CLIP-only experiments were useful as a sanity check but were not sufficient as a main method because they overestimated performance on small/easy negatives and did not explain layer-wise evidence emergence.

We next tested several layer-wise attention and GradCAM-style metrics. These included attention concentration, late-layer attention mass, Gini-like attention sparsity, text-conditioned GradCAM maps, and visualizations over related, unrelated, and blank images. These metrics produced interpretable plots, but they were not stable enough as standalone classifiers. Attention maps could be sparse for both correct and incorrect cases, and blank or unrelated cases could still produce visually salient but semantically meaningless hotspots.

Figure 19 shows text-conditioned GradCAM maps computed over the late six ViT-H/14 layers for image–question pairs across three conditions: related, unrelated-real, and blank. Two failure patterns are immediately visible. First, for unrelated inputs the GradCAM map fires on visually salient but semantically irrelevant regions — for example, activating on structural edges of a chest X-ray when the question concerns a rocket launch, or highlighting fur texture on a cat image when the question asks about lung opacity. The model attends to whatever is visually prominent, not to what is question-relevant. Second, for blank images GradCAM produces near-uniform or randomly scattered activations, confirming there is no stable grounding signal to detect.

These observations are confirmed quantitatively. Across nine prompts $\times$ three conditions (27 samples), GradCAM achieved only 22% three-way accuracy and AUROC 0.543 — barely above chance. The other six attention-only metrics (Raw RAPT, PIA, MHVF, ATS, LER, Gini) all scored below 0.640 AUROC, with most below 0.450. Attention rollout reached AUROC 0.750 but still failed to reliably separate unrelated-real from related inputs in per-prompt evaluation. These results confirm that visual attention in a CLIP-style encoder is not text-conditioned at the feature level: the encoder attends to visually salient patches regardless of whether they are semantically matched to the query. This motivated the shift to TC-LIA, which replaces attention weights with direct patch–text cosine similarity computed against the question embedding.

Conclusion: Attention/saliency is useful for qualitative diagnosis, but a scalar mirage detector needs text-conditioned semantic alignment rather than attention concentration alone.

Figure 20 further illustrates why output-overlap metrics alone are insufficient for mirage detection. Even when the visual evidence is absent or mismatched, the model can retain nontrivial lexical overlap with reference answers, suggesting that answer quality does not by itself certify groundedness.

Figure 21 shows that the impact of layer-wise intervention is highly condition-dependent. While some layers exhibit stronger degradation under perturbation, the overall patterns are not cleanly separable enough to define a reliable decision rule for mirage detection.

We also tested a RAPT-style probe inspired by the “seeing but not believing” line of work Liu et al. (2026). The probe used Gemma-3-4B-IT and extracted relative attention per token for image and question spans over a 400-example, five-condition experiment. The conditions were: matched real image/question, unrelated image with real question, blank image with real question, real image with unrelated question, and real image with no question.

The key observation is that RAPT is diagnostic but not decisional. It shows whether the decoder allocates relative attention to image or question tokens, but it does not directly verify that the attended image content semantically answers the question. For example, unrelated image–question pairs still receive image attention, and real images without questions can produce high image RAPT even though no VQA answer is meaningful. This motivated TC-LIA’s focus on patch–text semantic alignment rather than aggregate modality attention.

Figure 22 complements the heatmap by summarizing how attention allocation moves under controlled perturbations. The deltas are meaningful as diagnostics, yet they still do not provide a robust criterion for separating related from unrelated-real cases.

A larger natural-image sanity check used 100 Oxford-IIIT Pet image pairs with related and unrelated breed prompts. Final cosine and TC-LIA both performed extremely well because the task was comparatively easy. The internal-only probe also achieved high AUROC, confirming that intermediate features contain meaningful semantic information. However, this experiment did not represent the harder medical/document mirage setting, where same-domain and near-domain negatives are more challenging.

A mixed 200-pair experiment combined natural and medical images with related and unrelated prompts. TC-LIA features, including final cosine, late patch top-$k$, gain, slope, and internal alignment score, separated related and unrelated pairs well. This experiment motivated the final DiverseVQA-style evaluation but was still too small to support the main paper claim.

• •

  Final CLIP cosine is a strong baseline but can be overly optimistic on easy negatives.

• •

  Attention concentration alone does not imply semantic relevance.

• •

  RAPT captures modality allocation but not whether the image evidence answers the question.

• •

  GradCAM/SAM-style maps are valuable for visualization but require a scalar decision layer for deployment.

• •

  The final system needs both semantic alignment and supervised fusion to handle blank, unrelated-real, and related cases simultaneously.