Detecting Misbehaviors of Large Vision-Language Models by Evidential Uncertainty Quantification¶

🕒 Published (v1): 2026-01-01 · Source: ICLR · Venue: ICLR 2026 · link

Why this paper was selected

Evidential uncertainty quantification detects VLM misbehaviors on shifted inputs

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

TL;DR¶

This paper proposes Evidential Uncertainty Quantification (EUQ), a training-free framework that decomposes epistemic uncertainty in LVLMs into two components — conflict (internal contradictions) and ignorance (missing information) — using Dempster-Shafer Theory applied to pre-logits features. EUQ detects four LVLM misbehavior categories (hallucinations, jailbreaks, adversarial attacks, OOD failures) in a single forward pass. It achieves up to 10.4% relative AUROC improvement over strong baselines across four state-of-the-art LVLMs.

Problem¶

Existing uncertainty quantification (UQ) methods for LVLMs capture only total predictive uncertainty, failing to distinguish between two qualitatively distinct sources of epistemic uncertainty: internal contradictions among model features (conflict) and absence of supporting information (ignorance). Sampling-based methods (semantic entropy, self-consistency) are computationally expensive and dependent on auxiliary models; softmax-based approaches are overconfident; verbal elicitation is uncalibrated. No prior work explicitly decomposes and leverages these fine-grained uncertainty types for misbehavior detection across hallucination, jailbreak, adversarial, and OOD failure scenarios simultaneously.

Method¶

EUQ operates on pre-logits features $Z = (z_1, \ldots, z_I) \in \mathbb{R}^I$ from the LVLM output head's linear projection layer without any additional training.

Belief Assignment. Each feature component $z_i$ is assigned an evidence weight $e_{ij}$ with respect to each output feature $h_j$ via an element-wise affine transformation $E = A \odot Z^\top + B$. Under the Least Commitment Principle, the optimal parameters are: $$A^* = W - \mu_0(W), \quad B^* = -(A^* - \mu_1(A^*)) \odot Z^\top$$ Evidence weights are split into positive $E^+ = \max(0, E)$ (support) and negative $E^- = \max(0, -E)$ (opposition) components, yielding simple mass functions $m^+_{ij}(\{h_j\}) = 1 - \exp(-e^+_{ij})$ and $m^-_{ij}(\{h_j\}) = 1 - \exp(-e^-_{ij})$.

Evidence Fusion and Uncertainty. An additivity lemma allows aggregating mass functions sharing the same focal sets directly ($e = e_1 + e_2$), avoiding combinatorial explosion over the power set. Final conflict (CF) and ignorance (IG) are: $$\text{CF} = \sum_j \eta_j^+ \cdot \eta_j^-, \quad \text{IG} = \sum_j \exp(-e_j^-)$$ where $\eta_j^+$ and $\eta_j^-$ are the support and opposition ratios for component $h_j$. Sentence-level uncertainty is the token-average.

Key Contributions¶

First explicit decomposition of epistemic uncertainty in LVLMs into conflict (CF) and ignorance (IG) using Dempster-Shafer Theory, requiring no model retraining.
Closed-form Lemma 1 for belief assignment parameters under the Least Commitment Principle, enabling single-forward-pass uncertainty estimation.
Layer-wise evidential uncertainty dynamics analysis: IG decreases with depth while CF increases, consistent with the information-bottleneck perspective; certain intermediate layers distinguish all four misbehavior categories.
Misbehavior-Bench: a new benchmark aggregating nine datasets across hallucination, jailbreak, adversarial, and OOD misbehavior scenarios for four diverse LVLMs.

Results¶

Overall (Table 3, average across all models and datasets): CF achieves AUROC = 0.812, IG = 0.783; baselines range from SC (0.626) to HiddenDetect (0.707). CF/IG AUPR = 0.783/0.785 vs. best baseline 0.730 (SC).
Relative improvement: +10.4% AUROC (CF) and +7.5% AUROC (IG) over the strongest baseline; +5.3%/+5.5% AUPR.
Misbehavior-specific findings: hallucinations correlate with high CF; OOD failures correlate with high IG; jailbreaks and adversarial attacks show distinct distributional signatures (Figure 4).
Models evaluated: DeepSeek-VL2-Tiny, Qwen2.5-VL-7B, InternVL2.5-8B, MoF-Models-7B.
Baselines: self-consistency (SC), semantic entropy (SE), predictive entropy (PE), length-normalized PE (LN-PE), HiddenDetect.

Limitations¶

Evaluated only on smaller-scale models (≤8B parameters); scale effects are analyzed but full large-model validation is deferred.
EUQ operates on pre-logits features of the output projection layer; applicability to architectures lacking a standard linear output head (e.g., diffusion-based or non-autoregressive VLMs) is unclear.
CF and IG are averaged across tokens for sentence-level scoring; finer-grained localization (e.g., which specific tokens trigger misbehavior) is demonstrated qualitatively but not benchmarked quantitatively.
Misbehavior-Bench is constructed from existing datasets with specific attack protocols; generalization to novel attack vectors not represented in these nine datasets is unverified.

Relevance to Vision-Language Models¶

This work directly addresses a core reliability problem in deployed LVLMs: unsupervised detection of failure modes without any access to ground-truth labels or model retraining. The decomposition of uncertainty into conflict vs. ignorance provides an interpretable diagnostic tool that differentiates hallucination (a cross-modal consistency problem, high CF) from OOD failure (a knowledge coverage problem, high IG), offering actionable signals for VLM developers. The layer-wise dynamics connect to active debates about where cross-modal grounding occurs in transformer architectures. For researchers tracking VLMs, EUQ is a lightweight, model-agnostic probe that can be retrofitted to any LLM-backbone LVLM, making it practically relevant for auditing multimodal systems across diverse deployment scenarios.