GHOST: Hallucination-Inducing Image Generation for Multimodal LLMs¶

🕒 Published (v1): 2026-01-01 · Source: ICLR · Venue: ICLR 2026 · link

Why this paper was selected

ICLR 2026; adversarial image synthesis stress-tests MLLM hallucination failure modes

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

TL;DR¶

GHOST (Generating Hallucinations via Optimizing Stealth Tokens) is an automated adversarial image generation method that stress-tests Multimodal LLMs (MLLMs) for object hallucination. It optimizes a CLIP image embedding to mislead a target model's vision encoder, then conditions a diffusion model on that embedding to produce visually natural, object-free images that nonetheless cause the model to hallucinate the target object. On COCO, GHOST achieves hallucination success rates of 28–32%, roughly 300× higher than the closest prior method.

Problem¶

Static hallucination benchmarks (e.g., POPE, CHAIR) use fixed curated image sets, precluding discovery of model-specific or structurally latent failure modes. Existing synthesis-based approaches either ignore feedback from the target model (missing model-specific blind spots) or require the MLLM, diffusion model, and object detector all in one monolithic optimization loop (DASH), making them slow and constrained to distilled single-step diffusion models. There is no scalable, model-aware method for generating diverse hallucination-inducing images on demand.

Method¶

GHOST decouples optimization from generation via three components:

Mapper $\Pi$: A lightweight MLP trained with MSE loss $\mathcal{L}_\text{align} = \|\Pi(V_\text{CLIP}(X_v)) - V_M(X_v)\|_2^2$ to align CLIP embedding space with the target MLLM's vision token space, avoiding expensive end-to-end backpropagation.
Embedding optimization: Given an input image $X_v$ free of target object $t$, GHOST optimizes the CLIP embedding $c$ initialized at $c_0 = V_\text{CLIP}(X_v)$ by minimizing: $$\mathcal{L}_\text{total} = \mathcal{L}_\text{adv} + \lambda_\text{clip}\mathcal{L}_\text{clip} + \lambda_\text{reg}\mathcal{L}_\text{reg}$$ where $\mathcal{L}_\text{adv} = -\log p(y^* | X_q, \Pi(c))$ maximizes the probability of the hallucinated answer, $\mathcal{L}_\text{clip} = \mathbb{E}[\cos(c, V_\text{CLIP}(T_q))]$ penalizes semantic similarity to the target object's text embeddings (preventing actual object insertion), and $\mathcal{L}_\text{reg} = \|c - c_0\|_2^2$ regularizes proximity to the original embedding.
Guided diffusion: Stable Diffusion unCLIP is conditioned on the optimized $c$ starting from a partially noised latent of $X_v$, preserving high-level structure while permitting semantic drift. OWLv2 is applied post-hoc to filter any generated image that actually contains the target object.

Key Contributions¶

A decoupled adversarial pipeline that optimizes only in CLIP embedding space, enabling efficient per-sample stress-testing (~10 sec/sample on A100)
A learned MLP mapper bridging CLIP and MLLM vision encoder spaces without requiring joint backpropagation
Empirical demonstration that GHOST images expose transferable cross-model vulnerabilities (shared spurious biases)
Extension to reasoning MLLMs (GLM-4.1V-Thinking) by targeting the first token after <think>
Demonstration that fine-tuning on GHOST images improves hallucination robustness on POPE and CHAIR

Results¶

Hallucination success rate on COCO (10 object classes):
Qwen2.5-VL-7B: 2,816/9,423 = 29.9%
LLaVA-v1.6-Mistral-7B: 2,468/8,786 = 28.1%
GLM-4.1V-Thinking: 2,880/8,889 = 32.4%
DASH-LLM baseline (on 118,000 images): 0.1% for both Qwen2.5-VL and LLaVA-v1.6
Transferability (images optimized on source → % success on target):
Qwen2.5-VL → GPT-4o: 66.5%; → Aya 32B: 71.1%; → LLaMA3.2 11B: 65.8%
GLM4.1V → GPT-4o: 63.8%; → Qwen2.5-VL: 63.2%
Image quality (FID, lower is better):
Semantic fidelity (vs. initial images): GHOST 25.00, SD unCLIP 31.67, SD v2.1 41.71 (Qwen column)
Distributional realism (vs. COCO val): GHOST 47.03, SD unCLIP 46.51, SD v2.1 46.19 (comparable)
Human evaluation: 89% (LLaVA) and 86.3% (Qwen) of raters confirm the target object is absent in GHOST images
Runtime: ~10 sec/sample on A100, ~5× faster than DASH

Limitations¶

Evaluation confined to 10 COCO object classes; generalization to long-tail or fine-grained objects is not established
GLM-4.1V-Thinking optimization is indirect (targeting the first <think> token), yielding higher FID and less stable image quality
The mitigation experiment is explicitly described as a "toy setup" (LoRA fine-tuning on a small synthetic set); large-scale mitigation efficacy is undemonstrated
OWLv2 filtering may have false negatives for subtle or abstract target objects, potentially inflating reported success rates
The mapper $\Pi$ must be retrained for each new MLLM, adding setup overhead for novel architectures

Relevance to Vision-Language Models¶

GHOST directly probes a structural failure mode of VLMs—object hallucination—that persists across model families (LLaVA, Qwen, GLM, GPT-4o, Gemini) and is not captured by static benchmarks. The transferability results (up to 71% cross-model success) imply that different VLMs share spurious visual biases inherited from CLIP-based vision encoders, which is actionable knowledge for anyone working on VLM robustness or evaluation. The decoupled CLIP-space optimization design is broadly applicable to any VLM that uses a CLIP-family encoder, making GHOST a reusable diagnostic tool. For VLM researchers, the dual use case—adversarial discovery and fine-tuning data generation for mitigation—positions GHOST as a closed-loop robustness improvement pipeline.