Poison as Cure: Visual Noise for Mitigating Object Hallucinations in LVMs

🕒 Published (v1): 2025-01-01 · Source: NeurIPS · Venue: NeurIPS 2025 · link

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

VAP (Visual Adversarial Perturbation) is a training-free, black-box method that injects imperceptible adversarial noise into input images to suppress object hallucinations in large vision-language models (LVMs), without modifying model weights. By repurposing adversarial perturbations as beneficial "cures," VAP redirects LVM responses from parametric-knowledge biases toward actual visual content. It consistently reduces hallucinations across 8 state-of-the-art LVMs on POPE, BEAF, and CHAIR benchmarks.

Problem

LVMs hallucinate objects due to two interacting causes: (1) long-tail training distributions embed spurious correlations into parametric knowledge, and (2) the LLM backbone dominates the inference pipeline and suppresses visual signals. Existing mitigations—fine-tuning (e.g., REVERIE, HalluciDoctor) and decoding strategies (e.g., OPERA, HALC)—require model-internal access or modification, limiting plug-in applicability across diverse LVMs.

Method

VAP formulates hallucination suppression as an adversarial optimization over the visual input x, producing a perturbed image x̂ = x + δ bounded within an ε-ball.

Three complementary loss terms drive optimization: - Ls1 (alignment): maximizes semantic similarity between LVM responses to the perturbed image under the original query prompt c and under a null/empty prompt ∅. This forces the prompted response to remain grounded in freely-described visual content. - Ls2 (bias suppression, conditional): minimizes similarity between the response to x+δ under prompt c and the response to a heavily noise-corrupted distractor image x̄ (generated via a diffusion-like noise schedule) under ∅. This makes model responses discriminate real content from noisy inputs, reducing linguistic-prior reliance. - Ls3 (bias suppression, unconditional): same as Ls2 but compares unprompted responses to x+δ and x̄, further decoupling visual description from parametric priors.

Semantic similarity S(·,·) is computed via cosine similarity of CLIP text encoder embeddings applied to LVM response strings, providing a differentiable surrogate without LVM weight access. Because autoregressive LVM gradients are intractable, VAP uses zeroth-order (zero-gradient) optimization: the gradient is approximated by finite-difference perturbation sampling (N=10 queries per step). Final update: x̂ = x + α·∇_x{LS} with α=1/255, ε=2, β=8/255.

A proxy-based efficient variant generates perturbations using a smaller model (e.g., Intern-VL2-1B) and transfers them to the target larger model, achieving 1/8× computational overhead with only a minor accuracy drop.

Key Contributions

• Training-free, black-box VAP that adds per-image noise to mitigate hallucinations without any model modification.
• Three-term adversarial objective (Ls1, Ls2, Ls3) jointly targeting semantic grounding and parametric bias suppression.
• Zero-gradient optimization enabling black-box applicability to closed-API LVMs.
• Proxy-based noise transfer reducing inference overhead from +298ms to +39ms (A100) at comparable accuracy.
• Validated across 8 LVMs (LLaVA-v1.5, InstructBLIP, InternVL2, InternVL2-MPO, DeepSeek-VL2, Qwen-VL2, LLaVA-OV, Ovis1.6-Gemma2) on POPE, BEAF, CHAIR, AMBER, and MME.

Results

POPE (text-axis, MS-COCO 500 samples, 9,000 triplets): - All 8 LVMs improve under all three sampling strategies (Random, Popular, Adversarial). - Largest gain: Intern-VL2 under adversarial sampling: +2.81% accuracy, +2.09% F1. - Gains range from +0.34% (LLaVA-OV random, accuracy) to +2.81% (Intern-VL2 adversarial, accuracy). - Gaussian noise of equal strength (ε=2) degrades all 8 models by 1–3.7%, confirming VAP's targeted benefit.

BEAF (vision/text-axis, 26,064 triplets): - TU (True Understanding) improves by up to +2.31% (Ovis1.6-Gemma2). - SBp (Static Bias positive) improves up to +1.76%; SBn up to +1.04%; F1TUID up to +1.74%. - Some metrics (IG, ID) show slight degradation in a subset of models.

CHAIR (open-ended captioning, 1,000 MS-COCO samples): - Best result: Intern-VL2, prompt I1 — CHAIRI −0.68, CHAIRS −0.90. - Consistent reductions across all 8 models under both prompt variants.

Proxy efficiency: - Intern-VL2-8B with Intern-VL2-1B proxy: 84.07% vs. 84.81% (self-generated), runtime +39ms vs. +298ms (1/8× cost). - Qwen-VL2-7B with Qwen-VL2-2B proxy: 86.87% vs. 87.30%, runtime +48ms vs. +245ms (1/5× cost).

Limitations

• Per-image perturbation adds latency at inference (+39ms proxy, +298ms self-generated on A100); incompatible with high-throughput offline pipelines without proxy approximation.
• Requires model-specific hyperparameter tuning (balancing coefficients σ₁, σ₂, σ₃ and noise schedule timestep T differ per LVM).
• Absolute improvements are modest (typically <2%), with some BEAF sub-metrics (IG, ID) degrading for specific models.
• CHAIR evaluation is restricted to 80 COCO segmentation categories and 30-character response truncation, limiting scope of captioning evaluation.
• Black-box zeroth-order optimization is query-inefficient; N=10 queries per step may miss optimal perturbation directions in high-dimensional spaces.
• Generalization to non-object hallucinations (attribute, relation, spatial) is not evaluated.

Relevance to Vision-Language Models

VAP represents a complementary, data-centric approach to hallucination mitigation that is orthogonal to the dominant model-centric paradigm (fine-tuning, decoding interventions), making it stackable with methods like OPERA or VCD. Its black-box, training-free design means it applies to any deployed or proprietary LVM without weight access, directly addressing a practical deployment gap. The work deepens understanding of how visual inputs serve as factual anchors that can override parametric biases embedded in LLM backbones—a key open question in VLM reliability research. The proxy-transfer finding also has broader implications for adversarial transferability in multimodal settings.