We set out to reproduce a recent hallucination-mitigation result on the POPE benchmark. The LLaVA-1.5-7B baseline we measured, 82.21 F1 on the adversarial split, sat 1.21 to 8.67 points above the adversarial baselines we planned to compare against (81.00, 79.30, and 73.54). We looked at the evaluation code and found a readout choice that moves F1 on its own. A two-token logit readout decides yes versus no by comparing two vocabulary IDs, 3582 ("yes") and 1217 ("no"). Across 9,000 greedy-decode questions spanning all three splits, neither ID is generated even once. The model emits " Yes" (token 3869) and " No" (token 1939), because SentencePiece prepends a space byte after the prompt suffix "ASSISTANT:". Read with an eight-token lookup that covers the space-prefixed surface forms, LLaVA-1.5-7B scores F1 0.8221, 0.8498, and 0.8713 on the adversarial, popular, and random splits. That 6.13-point adversarial shift exceeds the adversarial gain reported by five of the six papers we surveyed. None of them states its readout, and our reference ran under 4-bit NF4 quantization, so we cannot say how much of any reported gain a matched evaluation would keep. That comparison stays unresolved until readout and precision are matched. On the fixed baseline we run nine inference-time corrections of our own (none beat it) and dissect why the adversarial split resists logit-level intervention. In a 3,000-question probe, wrong predictions draw more image attention than correct ones (Cohen's $d=-0.46$, $p=1.4\times10^{-24}$), the opposite of what grounding-based corrections assume. A four-readout audit across four further VLMs from three tokenizer families confirms the confound is protocol-level, not model-specific: porting the LLaVA-1.5 IDs verbatim drops F1 to 0.00 on the two disjoint-vocabulary models, whereas a tokenizer-derived readout holds between 0.80 and 0.92.
Sam: A model’s benchmark score can jump even when none of its answers changes. In this audit, changing how yes and no were read raised a visual hallucination score by about six points. The improvement belonged to the measurement, not the model.
Alex: That sounds consequential for anyone comparing methods. Is this a new benchmark, or an audit of how an existing one gets used?
Sam: It’s a technical audit, released as a preprint, by Kesav Kumar Jayakumar and Karthigeyan Thilak. They examine POPE, a benchmark that asks whether objects appear in images. Their finding concerns the code that converts model output into a yes-or-no label.
Alex: So the audience includes people trusting benchmark scores, not just people writing evaluation code.
Sam: Especially researchers comparing methods meant to reduce invented visual details. An extraction choice can obscure what actually improved. We’ll follow the mismatch, examine the evidence, and separate the demonstrated problem from claims the authors cannot settle.
Alex: Start with the task itself. What does an image model have to do here?
Sam: It sees an image and gets a question like, “Is there a refrigerator in the image?” POPE has different ways of selecting absent objects. Its adversarial questions choose objects that tend to occur alongside things actually present.
Alex: So a kitchen can invite a refrigerator question even when no refrigerator is visible. The model has to resist an association, not just recognize a familiar scene.
Sam: That’s the challenge. Each split balances present and absent objects. The authors initially wanted to test their own hallucination corrections, but their baseline scored higher than several published baselines. That sent them into the evaluation code.
Alex: What was the code doing that differed from simply reading the model’s answer?
Sam: It compared scores for two vocabulary entries: one for yes, one for no. Those scores are called logits. But a tokenizer, the component that maps text pieces to vocabulary identifiers, can give visually similar words different identifiers.
Alex: What difference matters here? To a human reader, yes is still yes.
Sam: A leading space matters. In the LLaVA baseline they tested, the prompt ends with “ASSISTANT” and a colon. In that context, the model generates a token containing a space followed by capitalized “Yes” or “No.” The code instead inspected lowercase forms without that leading space.
Alex: Could those inspected forms still be occasional answers, just less common than the spaced versions?
Sam: Not in these runs. Across nine thousand questions, neither inspected identifier was ever generated at the answer position. The model always produced one of the space-prefixed forms. That observation applies to their model, prompt, and greedy decoding, which selects the highest-scoring token.
Alex: Then the evaluator wasn’t reading the winning answer. It was comparing two alternatives that had already lost. But those alternatives could still carry information.
Sam: The authors make that distinction. Their records suggest the excluded scores still track the model’s lean toward yes. They don’t call those scores meaningless, and they didn’t save their individual values. The demonstrated failure is excluding the candidates the model actually chose.
Alex: How do they fix that without replacing one arbitrary pair of entries with another?
Sam: For this model, they include capitalization and leading-space variants of both answers. Then they compare the highest yes score with the highest no score. Taking the maximum preserves the decoder’s choice here, rather than pooling scores from forms it never generates.
Alex: What did that change in actual errors? A score shift alone doesn’t tell us which answers were misread.
Sam: On the adversarial split, the old rule read more than half the model’s “No” answers as yes. Some of those changes happened to repair missed positives. But many more turned correct rejections into false alarms, creating a strong yes bias.
Alex: So high recall could look encouraging while masking that the evaluator was saying yes far too often.
Sam: That’s what they found. With the expanded readout, adversarial F1 reached about eighty-two percent. F1 balances precision and recall. Crucially, this wasn’t a newly trained model or better generation: the same outputs received a different interpretation.
Alex: Before we generalize, is the faulty rule part of the official benchmark? Or is it one implementation choice?
Sam: One implementation choice. The authors explicitly do not claim official POPE evaluation requires it. Generating an answer and correctly parsing its text avoids this particular token-identifier mismatch. The audit targets the two-token logit readout, not the dataset or every way of scoring it.
Alex: Does it travel beyond this particular LLaVA setup? Otherwise the lesson might just be to patch that evaluator.
Sam: They audited four additional vision-language models, spanning different tokenizer families. Transferring the original model’s fixed vocabulary identifiers caused a different failure in models with incompatible vocabularies. Those identifiers no longer represented the intended answer forms.
Alex: How severe was that vocabulary mismatch compared with deriving the answers from the right tokenizer?
Sam: The copied expanded lookup produced zero F1 on the Mistral-based model and Qwen model. Deriving answer candidates from each model’s own tokenizer instead produced substantially higher scores across every tested model and split. The portable part is the procedure, not the identifier list.
Alex: You said parsing text can avoid this mismatch. Does that make text parsing the safer default?
Sam: Only if it reads the intended answer. Their InstructBLIP harness decoded text that didn’t begin with the answer token. Searching for the first yes-or-no substring picked up text from the wrong place. That’s a separate extraction failure, not evidence that the model itself always answered yes.
Alex: Both failures point to the same practical check: inspect what the harness actually returns before trusting its labels.
Sam: The authors recommend logging each generated identifier and its decoded text. Verify answer forms under the exact prompt template. Derive single-token candidates from that model’s tokenizer, and release prediction-level records. That lets others recompute scores rather than infer your conventions.
Alex: The striking comparison is with published improvements. Does this audit show that earlier hallucination methods didn’t really help?
Sam: No. The readout shift exceeds the gains reported by most papers they surveyed, but none states its readout. The authors cannot establish which, if any, used the faulty rule. Their own reference also used four-bit quantization, a reduced-precision setup that further limits comparisons with other baselines.
Alex: So substituting their higher baseline into somebody else’s results wouldn’t reveal a corrected improvement.
Sam: It would mix unknown differences in extraction, precision, prompts, and decoding. Resolving that needs matched reruns. My reading is that the direct extraction evidence is strong; the effect on specific published claims remains unresolved.
Alex: What happened to the authors’ original goal of improving hallucination performance?
Sam: None of their tested inference-time corrections beat the corrected adversarial baseline. A secondary attention probe also found wrong predictions drew more image attention than correct ones. That association challenges a simple “more looking means more correct” assumption, but doesn’t prove why errors happen.
Alex: Who should read the full document, and where should they begin?
Sam: Anyone implementing these evaluations should start with “The Token-Extraction Artifact,” then “Multi-Model Validation” and “Practitioner Recommendations.” Researchers comparing mitigation claims should read “Comparability with Published Results” before drawing conclusions about earlier work. For everyone else: before asking whether the model improved, check whether the evaluator read its answer.
Alex: A useful check before trusting the next benchmark gain.