{"id":"0709a820-8f5e-42cd-9ea1-00156c299066","arxiv_id":"2505.11804","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"Prompting VLMs to say \"unknown\" on ambiguous inputs substantially improves classification reliability on natural images, and caption diversity tracks this abstention behavior, though the mechanism fails on specialized domains like galaxy morphology.","lead":"Vision language models can often be made to abstain from uncertain or anomalous images with a single extra line in the prompt, sharply improving their reliability on natural images. The paper also shows that the diversity of a model's own captions predicts when it will abstain, offering a way to spot uncertain inputs without labels.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The 'near-perfect robustness' claim rests on accuracy measured only for non-rejected images; without a fixed coverage or risk-coverage curve, the reliability gain may reflect selective abstention rather than robust classification.","rationale":"The reader's weakest assumption concerned the monotone ordering of ImageNet-C corruption severity. That is relevant to the paper's interpretation of trends as evidence of uncertainty awareness, but it is not the most load-bearing condition for the abstract's practical claim. The practical claim is that a practitioner can obtain substantially more reliable VLM classification by adding a rejection option. The evidence is accuracy on the non-rejected subset (Fig. 2b, 9). That metric is uninterpretable without knowing the fraction of inputs the model refuses to process. If rejection rates are high, the 'near-perfect accuracy' is a low-coverage artifact, and the method may not deliver the advertised robustness in deployment. A risk-coverage analysis would settle this. This concern is addressable with existing data: the algorithm in Sec. 3.2 can rank images by diversity, and Figure 2b already contains the accuracy and rejection rate components. Thus the verdict CONDITIONAL remains appropriate, with this analysis added as a required condition.","tokens_in":17718,"tokens_out":10893,"duration_ms":113669,"concrete_test":"For each model and each corruption level in Fig. 2b, rank the 1,000 images by the model's caption-diversity score (Sec. 3.2), and compute classification accuracy under the rejection prompt on the lowest-diversity (most certain) subsets covering 90%, 80%, 60%, and 40% of images. If the accuracy at 80% coverage is not substantially higher than the no-rejection accuracy at that corruption level, the abstract's reliability-gain claim is not established and should be rephrased as selective classification with unknown coverage cost.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim in the abstract -- that prompting VLMs to abstain yields 'significant reliability gains, achieving near-perfect robustness' -- is supported by accuracy computed only on the subset of images the model chooses to classify after being told to reject ambiguous inputs (Sec. 4.2, Fig. 2b). This is a selective classification metric. Its value can be high simply because the model declines to answer the hardest inputs; indeed, Figure 2b's bottom row shows rejection rates increasing from low at corruption level 1 to what appears to be a large fraction of the 1,000-image set at level 5. The paper never fixes a target coverage (the fraction of all inputs that must receive a label) and never reports a risk-coverage curve. Without controlling coverage, 'accuracy among classified samples' is not a well-defined robustness measure: a model that rejects almost everything would achieve near-perfect accuracy on the few remaining samples while being useless to a practitioner. The monotonicity of ImageNet-C severity invoked to interpret trends (Figs. 2, 5, 9) is a secondary issue; the primary gap is the missing accuracy-coverage trade-off.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper empirically investigates whether vision-language models (VLMs) can quantify and express uncertainty about their inputs. The authors evaluate six VLMs (Llama 3.2 11B, Qwen 2 7B, Qwen 2.5 3B/7B/72B, GPT-4o-mini) on two classic uncertainty tasks: anomaly detection (CIFAR-10 vs. non-CIFAR-10, ECG vs. non-ECG) and classification with rejection on ambiguous inputs (Gaussian-noise/blur/pixelate/pixmix corrupted ImageNet subsets mapped to CIFAR-10 classes, and Galaxy Zoo morphology with annotator disagreement as ambiguity). The main findings are: (i) explicit prompting to reject uncertain inputs improves accuracy on the non-rejected subset, sometimes to near-perfect levels; (ii) anomaly detection via prompting works well on natural images but degrades on the domain-specific ECG and galaxy tasks; and (iii) a proposed caption-diversity score—computed as 1 minus the mean pairwise cosine similarity of multiple generated captions—correlates with corruption level and with whether a model rejects an image. The authors conclude that simple prompting can elicit calibrated abstention from modern VLMs, with the caveat that domain expertise is needed for specialized tasks.","tokens_in":17941,"tokens_out":7824,"duration_ms":72249,"significance":"If the main claim holds, the result has practical value: a black-box practitioner can improve classifier reliability without retraining, by prompting the model to abstain when uncertain. The study also provides a useful negative result for domain-specific applications (galaxy morphology, ECG), where general VLMs fail to express uncertainty. The caption-diversity idea is interesting and connects to prior semantic-uncertainty methods for LLMs, but the paper's contribution is the empirical demonstration on VLMs rather than a new predictor. The paper is careful in treating models as black boxes and in comparing multiple model families. However, the headline 'near-perfect robustness' is currently supported only by selective-classification accuracy, and the proposed diversity mechanism is not validated as a predictive tool.","major_comments":[{"comment":"The abstract's central claim that prompting abstention yields 'significant reliability gains, achieving near-perfect robustness' is supported only by accuracy computed over non-rejected images. The paper never reports a risk-coverage curve or fixes a target coverage; without this, the high post-rejection accuracy could be a consequence of selective abstention, since a model that rejects most high-corruption inputs would achieve near-perfect accuracy on the few remaining samples. The rejection-rate panels in Fig. 2b (bottom row) and Fig. 9 show that rejection is substantial at high corruption levels, so coverage is far below 100%. The authors should report accuracy as a function of the fraction of accepted inputs (a risk-coverage curve) or at a pre-specified coverage level, and state what fraction of inputs receive a label under their prompting protocol.","section":"4.2, Fig. 2b"},{"comment":"The paper claims that caption diversity 'enabl[es] practitioners to predict when models will successfully abstain without relying on labeled data' (abstract and Sec. 3.2), but no predictive evaluation is performed. The experiments show only aggregate correlations: mean diversity rises with corruption level, and rejected images have higher diversity than classified images in density plots. A predictive claim requires a quantitative test, such as the area under an ROC curve for using diversity to predict rejection or classification on held-out images, or a demonstration that a diversity threshold recovers the accuracy gains of prompted rejection. Without such evaluation, the diversity mechanism is descriptive rather than validated.","section":"3.2 and 4.2, Fig. 5"},{"comment":"Quantitative comparisons are reported as point estimates without error bars or statistical inference. For example, the diversity differences across corruption levels for Qwen2.5 3B in Fig. 5 (top) range over roughly 0.02, and the rejection-rate curves in Fig. 2b have no uncertainty estimates. Because the central trends (accuracy drop, diversity rise, improvement from rejection) are the basis for the paper's conclusions, the authors should provide bootstrap confidence intervals or repeated-seed runs for the key figures and tables, especially where monotonicity across corruption levels is claimed.","section":"4.2, Figs. 2, 5, 9"},{"comment":"The ImageNet-C experiments treat corruption severity as a monotone ground-truth ordering of perceptual ambiguity for the VLM. The Galaxy Zoo experiment is more convincing because it uses human annotator disagreement (leaf_prob) as an independent ambiguity measure. For ImageNet-C, the trends across corruption levels could reflect overall image degradation rather than the model's uncertainty awareness. The image-level relationship between diversity and the model's own rejection decision is shown only as density plots in Fig. 5 (bottom); reporting a quantitative association (e.g., AUROC of diversity for predicting rejection, or a calibration-style plot) would substantiate the uncertainty-link claim independent of the corruption-level ordering.","section":"4.2, Figs. 2, 5, 9, 6"}],"minor_comments":[{"comment":"The abstract's statement that 'simply prompting models to abstain' improves reliability is too strong in view of Appendix E: for Llama 3.2 and Qwen2, the direct 'Simple' prompt yields almost no rejection benefit, and only the 'Caption & answer' prompt elicits rejection. The main text should qualify the prompt conditions under which the result holds.","section":"Appendix E, Fig. 8"},{"comment":"There is a typo: 'property knwon as calibration' should read 'property known as calibration'.","section":"Sec. 2.1"},{"comment":"The prompt texts contain formatting artifacts such as 'fo ll ow in g', 'f ol lo win g', and 'r ea so ni ng' that should be cleaned for readability and reproducibility.","section":"Appendix A.1 and A.2"},{"comment":"The color encoding (red vs. black text) used to distinguish the standard and rejection prompts is not accessible in black-and-white print; consider labels, boxes, or different line styles.","section":"Fig. 2a"},{"comment":"The limitation section acknowledges the Galaxy Zoo failure but does not mention the coverage/selective-classification issue or the lack of predictive validation of caption diversity; these should be acknowledged as limitations.","section":"Sec. 6"},{"comment":"The caption diversity score is computed from 20 captions per image; reporting the variance of the score over bootstrap resamples of the 20 captions would help assess the stability of the proposed metric.","section":"4.2"}],"recommendation":"major_revision","confidential_remarks":"The paper is an empirical study using proprietary and open models; reproducibility depends on the availability of GPT-4o-mini and the exact API versions. The novelty relative to prior semantic-uncertainty work for LLMs is modest, but the application to VLMs and the black-box rejection prompting are of interest to the cs.CV community. The abstract overstates the strength of the evidence; the requested coverage curves and predictive evaluation of the diversity mechanism should be feasible within the paper's scope and would substantially strengthen the contribution."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Hey,\n\nQuick take on arXiv:2505.11804. The paper is worth your time if you care about VLM reliability: prompting models to reject uncertain inputs does help a lot on corrupted natural images, and the galaxy result is a clean negative example where the trick falls apart. But the headline claim of \"near-perfect robustness\" is oversold, because accuracy is only measured on the images the model agrees to classify, with no fixed coverage or risk-coverage curve. The rejection rate is reported, so a careful reader can reconstruct the tradeoff, but the abstract as written overstates the guarantee.\n\nWhat's actually new: the broad cross-model evaluation (six VLMs, four tasks) and the domain-failure analysis. The caption diversity idea is a straightforward adaptation of semantic entropy to visual inputs, and the paper shows it correlates with both corruption level and rejection behavior. That correlation is decent evidence that the model has some internal uncertainty signal, though the paper doesn't go the next step and evaluate diversity as a predictor (AUC or similar). Also, the ablation on prompting style is a nice touch: some older models only abstain when forced to first produce a caption, which is a useful practical detail.\n\nSoft spots, in rough order. First, the coverage problem: with rejection rates climbing to maybe half or more at high corruption, \"near-perfect accuracy among classified\" doesn't mean near-perfect robustness in any unconditional sense. The paper should present a risk-coverage curve or at least report accuracy including abstentions treated as a separate category. Second, no error bars anywhere. For the classification runs it's deterministic decoding, so no sampling variance, but the selection of the 1,000-image subset introduces variance. That's minor if the trends are as clean as they look, but it should be acknowledged. Third, the monotonicity of ImageNet-C severity as a proxy for ambiguity is assumed, not established. The galaxy data, where ambiguity is measured by annotator disagreement, is on firmer ground, and it's a good thing the paper includes it.\n\nThere's no load-bearing flaw; the issues are about framing and missing controls. The stress-test note about selective classification is the main thing: it doesn't sink the paper, but it should be addressed in revision.\n\nThis is a paper for a serious empirical venue. I'd bring it to our reading group because it raises the coverage question nicely. Send it to peer review; just ask the authors to fix the overclaim and add at least a small predictive check for the diversity signal.\n\nLet me know what you think.","headline":"Useful empirical paper on VLM abstention; the 'near-perfect robustness' claim is overstated because accuracy is only on non-rejected samples.","tokens_in":18423,"tokens_out":4033,"would_cite":true,"duration_ms":43075,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Adding a 'return unknown' instruction to the prompt lets VLMs reject ambiguous or anomalous images and raises the accuracy of the predictions they keep.","keywords":["vision language models","uncertainty quantification","classification with rejection","anomaly detection","caption diversity","ImageNet-C","galaxy morphology","prompt-based abstention"],"falsifier":"Generate class-blended images—for instance, superpositions of a cat and a dog from CIFAR-10 at varying mixing ratios, with the label space containing only one of those classes—and measure the model's rejection rate and caption diversity as the blend ratio moves from 0 to 1. If rejection rate and caption diversity do not rise monotonically with the blend ratio (i.e., with genuine ambiguity), the claim that prompting activates an internal uncertainty signal is refuted.","tokens_in":17533,"feed_emoji":"🛡️","tokens_out":8499,"duration_ms":75062,"temperature":0.7,"pith_summary":"Vision-language models are not automatically robust to ambiguous or anomalous inputs; they tend to follow the instruction to classify and produce confident nonsense. The paper shows that this failure can be largely overcome for natural images by adding one sentence to the prompt telling the model it may return 'unknown' when unsure. With that rejection option, accuracy on the images the model keeps rises to near-perfect levels across several corruption types and anomaly-detection settings. The same fix fails on specialist domains such as galaxy morphology, where the model lacks the knowledge needed to recognize its own uncertainty. The paper also proposes caption diversity—how much randomly sampled descriptions of an image vary—as a label-free signal predicting when a model will successfully abstain.","feed_headline":"One prompt line restores VLM reliability on corrupted images","feed_subtitle":"Simply instructing models to abstain when unsure turns rejection into a working safety valve.","key_machinery":"The central mechanism is the rejection prompt: a short instruction appended to a classification prompt telling the model that it may answer 'unknown' when the image is ambiguous or outside the specified classes. This single-prompt intervention lets a VLM condition its behavior on the instruction and abstain instead of hallucinating a confident label. The second mechanism is the caption diversity score: for each image, the model generates a set of captions under random decoding; the captions are embedded with a sentence transformer, and diversity is computed as one minus the average pairwise cosine similarity. The paper uses this score as a label-free probe of the model's uncertainty, and shows that it tracks both corruption level and rejection decisions on natural images but not on the galaxy-morphology task.","core_discovery":"The paper's central claim is that modern VLMs possess an implicit, prompt-activatable ability to quantify their own uncertainty, and that this ability is enough to make classification-with-rejection work without any retraining, fine-tuning, or architectural change. Evaluated on corrupted ImageNet images mapped to CIFAR-10 classes, models prompted to 'return unknown' when the input is ambiguous abstain at increasing rates as corruption intensifies, and the accuracy of the remaining predictions stays close to perfect. The same pattern appears in anomaly detection: instructed to reject inputs outside the class list, the models flag most out-of-scope images while keeping in-scope classification accurate. The mechanism is not universal: on Galaxy Zoo images, where annotator disagreement marks genuine ambiguity, the models do not reject more as disagreement rises and their accuracy after rejection barely improves, which the authors attribute to missing domain knowledge. Finally, the paper proposes caption diversity—one minus the average pairwise cosine similarity among multiple sampled captions—as an observable proxy for the model's internal uncertainty, showing that rejected images have higher diversity and that diversity rises with corruption level, while staying flat on the galaxy task where rejection fails.","pith_inferences":["If the caption-diversity signal is a portable uncertainty score, it could serve as a zero-shot selection criterion for choosing which inputs to route to a human or to a more expensive model, without needing a labeled validation set.","The flat diversity on Galaxy Zoo suggests a testable boundary condition: diversity rises only when the model's visual knowledge is rich enough to support alternate interpretations; on images outside that knowledge, 'uncertainty' is unrepresented. An intervention that injects domain structure (e.g., decision-tree prompts) might re-activate diversity and rejection.","One could extend the paired-prompt design into an ensemble: run the same image through several prompt variants and treat disagreement across variants as an additional uncertainty signal, potentially capturing ambiguity the single-rejection prompt misses.","A direct test of the mechanism would be to compare rejection behavior on images matched for difficulty but differing in ambiguity, such as class-blended images."],"forward_implications":["Practitioners using black-box VLMs on natural images can obtain a meaningful reliability guarantee for free: add an abstention option to the prompt, and treat 'unknown' as a rejection before downstream use.","The caption-diversity heuristic gives a way to audit a VLM's uncertainty without labels or logits, so it can be applied to closed models behind APIs.","The method's failure on galaxy morphology shows that a prerequisite for successful rejection is domain competence; scaling alone does not create uncertainty awareness in specialized tasks.","The results suggest that instruction-following, usually seen as a source of sycophantic hallucination, can be redirected to produce calibrated abstention behavior.","Accuracy after rejection approaching near-perfect values across corruption types implies that the models' errors on corrupted natural images are largely concentrated on samples the model can itself flag as ambiguous."],"supporting_citations":[{"why":"Supplies the ImageNet-C corruption benchmark whose severity levels structure the main classification-with-rejection experiment and the caption-diversity trends.","marker":"Hendrycks & Dietterich, 2019"},{"why":"Provides the ImageNet images and class definitions that anchor the natural-image evaluation and the CIFAR-10 class mapping.","marker":"Deng et al., 2009"},{"why":"Defines the four Galaxy Zoo morphology categories and the dataset construction used for the domain-specific failure case.","marker":"Walmsley, 2022"},{"why":"Supplies the PTB-XL ECG signals used in the anomaly-detection experiment that compares rejection behavior on specialist inputs.","marker":"Wagner et al., 2020"},{"why":"Provides the sentence-transformer model (all-mpnet-base-v2) used to embed captions for the diversity score.","marker":"Reimers & Gurevych, 2019"},{"why":"Documents the instruction-following/sycophancy tendency that the paper identifies as the source of hallucinated confident outputs before the rejection prompt is added.","marker":"Sharma et al., 2023"},{"why":"Supplies the PixMix corruption type used alongside ImageNet-C to show the rejection effect holds across different corruptions.","marker":"Hendrycks et al., 2022"}],"fun_headline_variants":["Prompting 'unknown' turns VLM rejection into a safety valve","One prompt line restores VLM reliability on corrupted images","Abstain prompt makes VLMs reliably reject corrupt inputs","Caption diversity predicts when VLMs can abstain accurately"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The central results assume that the ImageNet-C corruption levels provide a valid, monotone ordering of how genuinely ambiguous an image is to the model, so that rising rejection rates and rising caption diversity measure uncertainty about the input rather than mere task difficulty.","fun_headline_variants_meta":{"raw":{"variants":["Prompting 'unknown' turns VLM rejection into a safety valve","One prompt line restores VLM reliability on corrupted images","Abstain prompt makes VLMs reliably reject corrupt inputs","Caption diversity predicts when VLMs can abstain accurately"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000639,"raw_usage":{"total_tokens":2950,"prompt_tokens":960,"completion_tokens":1990,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":576,"completion_tokens_details":{"reasoning_tokens":1922}},"tokens_in":576,"tokens_out":1990,"duration_ms":15328,"temperature":1.0,"reasoning_tokens":1922,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T20:47:20.418841+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Generate class-blended images—for instance, superpositions of a cat and a dog from CIFAR-10 at varying mixing ratios, with the label space containing only one of those classes—and measure the model's rejection rate and caption diversity as the blend ratio moves from 0 to 1. If rejection rate and caption diversity do not rise monotonically with the blend ratio (i.e., with genuine ambiguity), the claim that prompting activates an internal uncertainty signal is refuted.","supporting_citations":[{"cited_title":"Pixmix: Dreamlike pictures comprehensively improve safety measures","cited_arxiv_id":null,"evidence_quote":"Supplies the PixMix corruption type used alongside ImageNet-C to show the rejection effect holds across different corruptions."}],"review_version":1}