REVIEW 4 major objections 5 minor 35 references
Masking just four language-model neurons can collapse a 7-billion-parameter vision-language model into gibberish, and the fragile neurons sit in the FFN down-projection layer, not the vision encoder.
Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →
T0 review · deepseek-v4-flash
2026-08-03 19:18 UTC pith:5GWT6TFO
load-bearing objection A useful empirical extension of sparse-neuron findings to LVLMs, but the headline 'four neurons' figure is tied to one prompt distribution and post hoc thresholds, not the broad 'any valid input' claim. the 4 major comments →
Sparse Neuron Ablation Triggers Catastrophic Collapse of the Language Core in Large Vision-Language Models
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
Core claim
The paper claims that a small set of 'critical neurons' — identified by a combined activation-gradient importance ranking — exists in LVLMs, and zeroing them out in the language model's feed-forward network causes catastrophic collapse. For LLaVA-1.5-7b-hf, only four neurons in the down-projection layer suffice; for InstructBLIP-vicuna-7b, a few thousand. Critical neurons cluster at the first and last layers, and the down-projection layer is the most fragile bottleneck. Collapse is two-stage: first output quality degrades while comprehension stays, then a sharp phase transition to gibberish that is unrecoverable.
What carries the argument
CAN (Consistently Activated Neurons): an importance score that combines a neuron's average activation magnitude with the gradient of the loss with respect to that activation (Eq. 3), then globally ranks all neurons and progressively masks the top-k until the model hits a predefined catastrophic-collapse threshold (perplexity increase ≥10× and CLIP score ≤22, Eq. 8). The down-projection layer of the FFN is the specific structure where the fewest neurons produce collapse, acting as an information bottleneck.
Load-bearing premise
The headline 'four neurons' figure depends on collapse thresholds (perplexity jump ≥10× and CLIP score ≤22) and a per-model weighting α that were tuned on the same models' failure patterns, so the exact minimal count is partly a product of that calibration.
What would settle it
Run the same CAN ranking and progressive masking on LLaVA-1.5-7b-hf but with a stricter collapse definition, e.g., τ_PPL=10 (100× perplexity increase) and τ_CLIP=18 instead of 22. If the minimal neuron count changes from 4 to hundreds, the claimed extreme sparsity is an artifact of the chosen thresholds rather than an intrinsic property.
If this is right
- If correct, a tiny, precisely-targeted weight perturbation — far smaller than typical adversarial noise — could disable a deployed LVLM, so neuron-level robustness should become part of safety evaluation.
- The concentration of critical neurons in the first and last language-model layers suggests that architectural changes adding redundancy to those layers (or to down_proj) could harden models against collapse.
- The two-stage collapse signature (CLIP degradation with stable perplexity, then a sharp perplexity spike) could serve as an early-warning monitor during deployment.
- The same CAN procedure can be applied to other LVLMs and LLMs to map their fragile subnetworks, providing a transferable diagnostic.
Where Pith is reading between the lines
- The exact count (e.g., 'four neurons') likely depends on the empirically chosen collapse thresholds and the per-model hyperparameter α; the robust takeaway is the qualitative sparsity and language-localization, not the precise integer.
- The dissociation between perceptual failure (vision ablation) and complete collapse (language ablation) implies that the bottleneck for multimodal integrity is linguistic generation, not cross-modal alignment — an intuition worth testing in larger models.
- One testable extension: ablate the same four LLaVA neurons under different prompts or image distributions; if collapse is universal, these neurons act as global control points, which would be a stronger claim than the paper's current per-category results.
- If the collapse is caused by a narrow bottleneck in down_proj, then reparameterizing that layer (e.g., adding a residual connection) might provide a cheap defense.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper proposes Consistently Activated Neurons (CAN), an activation- and gradient-based importance score, to rank neurons in LVLMs and then progressively mask them until a joint perplexity/CLIP-score threshold declares catastrophic collapse. On LLaVA-1.5-7b-hf and InstructBLIP-Vicuna-7b, using 10 ILSVRC2013 categories with a fixed prompt, the authors report that masking as few as four LLaVA neurons (in the FFN down_proj) or 1,200–14,400 InstructBLIP neurons triggers large perplexity increases and CLIP-score drops. They further report that critical neurons concentrate in the language model rather than vision components, with down_proj being especially vulnerable, and that both models show a two-stage collapse pattern: expressive degradation followed by complete collapse.
Significance. If the finding holds, it is significant: it provides concrete evidence of sparse structural vulnerability in deployed-scale LVLMs and localizes the failure in the language backbone, challenging the expectation that multimodal alignment components are the main risk point. The two-stage collapse pattern is a useful empirical signature, and the random-ablation control mentioned in the footnotes is an appropriate specificity check. The paper does not provide code or data, which limits reproducibility assessment. However, the headline numerical claims depend on post-hoc calibrated thresholds and a narrow test distribution; until sensitivity and generalization are shown, the broader 'language core' conclusion outruns the evidence.
major comments (4)
- [Eq. (8), Tables 2 and 4] The collapse criterion is not strictly enforced in the reported collapse rows. Eq. (8) requires CLIP(Ck) ≤ τ_CLIP with τ_CLIP=22. Table 2 reports CLIP=22.14 for the 'orange' row and Table 4 reports CLIP=22.15 for 'pencil box'; both exceed the threshold. Since k* is the paper's headline quantity, the discrepancy between the stated operationalization and the reported data must be resolved (e.g., exact tie handling, per-category re-evaluation, or revised tables/captions).
- [Sec. 5, Eq. (3), Sec. 6.4] Several free parameters are calibrated on the same models and data after observing failure behavior: α=0 for LLaVA and α=1 for InstructBLIP in Eq. (3); τ_PPL=1 and τ_CLIP=22 in Eq. (8) are set in Sec. 6.4 'based on empirical failure patterns.' Because the reported k* depends on these choices, the exact numbers (four neurons; 1,200–14,400) may be artifacts of the calibration rather than intrinsic model properties. Please provide a sensitivity analysis in which α and τ are varied over a grid and report the range of k*, and use a validation split not used to set the thresholds.
- [Sec. 1, Sec. 6] The paper defines catastrophic collapse as severe corruption 'across any valid input' and concludes that the language model is the vulnerability 'core,' but the experiments use exactly one textual prompt ('Describe the object in this image'), 10 image classes from ILSVRC2013, and activations recorded after the first generated token. No text-only prompts, VQA-style instructions, or out-of-distribution images are tested. The four-neuron result may therefore characterize the image-conditioned first-token distribution rather than the language model as such. Please test the identified critical neurons on held-out prompts/tasks and report whether the same small set collapses the model there; otherwise limit the conclusion accordingly.
- [Tables 1–4, Sec. 6.1] Reported metrics are averages over 100 test images with no variance, confidence intervals, or repeated trials. The random-ablation control is mentioned in footnotes but never quantified. To support the specificity claim that masking exactly k* critical neurons is uniquely damaging, report the distribution of PPL/CLIP under random ablations of the same size (e.g., 100 random sets per k), with percentiles or p-values, and provide standard errors for the main k* estimates.
minor comments (5)
- [Sec. 6.2, footnote 1] There is a duplicated phrase: 'the models cannot recover their functionality the models cannot recover their functionality once collapsed.'
- [Eq. (7), Tables 1 and 2] CLIP score is undefined when generation is EOS-only; Table 1 treats NaN as 0 for percentage change. Please specify a consistent definition for CLIP in degenerate-output cases rather than relying on a footnote.
- [Tables 1–4] Captions do not consistently state the masking step size for each model/component (e.g., Table 1 says progressive steps of 100 for InstructBLIP, Table 2 says the same, but Tables 3 and 4 use other steps). Please make this uniform.
- [General] The paper does not include a code or data availability statement. For reproducibility, please provide the ranked neuron lists, the scripts used to generate them, and the random-ablation control code.
- [Sec. 6.4] There are minor capitalization inconsistencies for the model name: 'InstructBLIP-Vicuna-7b' and 'InstructBLIP-vicuna-7b' both appear.
Circularity Check
No significant circularity: the findings are direct measured outcomes of a defined ablation protocol, not derivations equivalent to their inputs.
full rationale
The paper's central claims (four-neuron collapse, language-model localization, two-stage pattern) are empirical measurements obtained by a clearly specified search procedure (Eqs. 3, 6, 8) over actual model outputs, not predictions derived from fitted parameters. The collapse thresholds are explicit and applied uniformly; although τ_CLIP=22 is justified partly with reference to the authors' own observed convergence to chance-level CLIP scores, it is also grounded in external prior work (refs 9, 24, 32), and the LLaVA collapse rows are NaN or far below the threshold, so the headline four-neuron result is not forced by the threshold choice. The per-model α choices (0 for LLaVA, 1 for InstructBLIP) are stated hyperparameters rather than hidden fits that determine the outcome. There are no load-bearing self-citations, no imported uniqueness theorems, and no ansatz smuggled in via citation. Methodological limitations—single prompt, fixed image distribution, threshold calibration and a few table entries slightly above τ_CLIP—are validity concerns, not circularity, because no reported quantity reduces by construction to an input of the method.
Axiom & Free-Parameter Ledger
free parameters (4)
- α (gradient/activation balance in Eq. 3) =
0 for LLaVA-1.5-7b-hf; 1 for InstructBLIP-vicuna-7b
- τ_PPL (collapse threshold on log-ratio perplexity) =
1 (one order of magnitude)
- τ_CLIP (collapse CLIP-score threshold) =
22
- Masking step size Δk =
1 for LLaVA (implied by 4-5 neuron results); 100 for InstructBLIP
axioms (5)
- domain assumption The importance score in Eq. (3), with the chosen α, ranks neurons by causal relevance to model function.
- ad hoc to paper Catastrophic collapse is correctly operationalized by the joint threshold in Eq. (8): ΔPPL ≥ 1 and CLIP ≤ 22.
- domain assumption Perplexity computed on the masked model's own generated tokens is a valid measure of language-capability loss.
- domain assumption One fixed prompt and 10 object-category image sets are representative of 'any valid input.'
- standard math Gradients ∂L/∂a exist and are meaningful for the model's loss (standard backpropagation).
read the original abstract
Large Vision-Language Models (LVLMs) have shown impressive multimodal understanding capabilities, yet the structures that sustain their functionality remain poorly understood from a mechanistic interpretability standpoint. We propose Consistently Activated Neurons (CAN), a progressive neuron ablation method to identify critical neurons whose removal triggers catastrophic collapse, and use it to investigate structural vulnerabilities in representative 7B LVLMs. Experiments reveal that catastrophic collapse can be triggered by ablating as few as four neurons in \texttt{LLaVA-1.5-7b-hf} and a few thousand in \texttt{InstructBLIP-vicuna-7b}, both representing a small fraction of model parameters. Notably, critical neurons are predominantly localized in the language model, particularly in its down-projection layer, rather than in the vision components. We also observe a consistent two-stage collapse pattern: initial expressive degradation followed by sudden, complete collapse. These findings reveal that LVLM functionality depends on a sparse subset of neurons concentrated in the language backbone, offering mechanistic insights into how their functionality is structured and where these models are most vulnerable.
Figures
Reference graph
Works this paper leans on
-
[1]
Alexos, A., Tsai, Y.D., Domingo, I., Pishgar, M., Baldi, P.: Neural erosion: Emulating controlled neurodegeneration and aging in AI systems (2024), https: //arxiv.org/abs/2403.10596
Pith/arXiv arXiv 2024
-
[2]
AlKhamissi, B., Tuckute, G., Bosselut, A., Schrimpf, M.: The LLM language net- work: A neuroscientific approach for identifying causally task-relevant units (2024), https://arxiv.org/abs/2411.02280
Pith/arXiv arXiv 2024
-
[3]
IEEE Transactions on Pattern Analysis and Machine IntelligenceP AMI-5(2), 179–190 (1983)
Bahl, L.R., Jelinek, F., Mercer, R.L.: A maximum likelihood approach to con- tinuous speech recognition. IEEE Transactions on Pattern Analysis and Machine IntelligenceP AMI-5(2), 179–190 (1983). https://doi.org/10.1109/TPAMI.1983. 4767370
-
[4]
Nature neuroscience6(5), 448–450 (2003) 14 Cen Lu, Yung-Chen Tang, Andrea Cavallaro
Bates, E., Wilson, S.M., Saygin, A.P., Dick, F., Sereno, M.I., Knight, R.T., Dronkers, N.F.: Voxel-based lesion–symptom mapping. Nature neuroscience6(5), 448–450 (2003) 14 Cen Lu, Yung-Chen Tang, Andrea Cavallaro
2003
-
[5]
Chen, J., Wang, X., Yao, Z., Bai, Y., Hou, L., Li, J.: Finding safety neurons in large language models. CoRRabs/2406.14144(2024). https://doi.org/10.48550/ ARXIV.2406.14144, https://doi.org/10.48550/arXiv.2406.14144
-
[6]
Dai, W., Li, J., Li, D., Tiong, A.M.H., Zhao, J., Wang, W., Li, B., Fung, P., Hoi, S.C.H.: Instructblip: Towards general-purpose vision-language models with instruction tuning. In: Advances in Neural Information Processing Sys- tems 36 (NeurIPS) (2023), http://papers.nips.cc/paper_files/paper/2023/hash/ 9a6a435e75419a836fe47ab6793623e6-Abstract-Conference.html
2023
-
[7]
In: 2009 IEEE conference on computer vision and pattern recognition
Deng, J., Dong, W., Socher, R., Li, L.J., Li, K., Fei-Fei, L.: Imagenet: A large- scale hierarchical image database. In: 2009 IEEE conference on computer vision and pattern recognition. pp. 248–255. Ieee (2009)
2009
-
[8]
Neuron55(2), 187–199 (2007)
Hallett, M.: Transcranial magnetic stimulation: a primer. Neuron55(2), 187–199 (2007)
2007
-
[9]
In: Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing
Hessel,J.,Holtzman,A.,Forbes,M.,LeBras,R.,Choi,Y.:CLIPScore:Areference- free evaluation metric for image captioning. In: Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing. pp. 7514–7528. Online and Punta Cana, Dominican Republic (Nov 2021). https://doi.org/10.18653/v1/2021. emnlp-main.595, https://aclanthology.org/2021...
doi:10.18653/v1/2021 2021
-
[10]
Huo, J., Yan, Y., Hu, B., Yue, Y., Hu, X.: MMNeuron: Discovering neuron-level domain-specificinterpretationinmultimodallargelanguagemodel.In:Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing. pp. 6801–6816. Miami, Florida, USA (Nov 2024). https://doi.org/10.18653/v1/2024. emnlp-main.387, https://aclanthology.org/2024.e...
doi:10.18653/v1/2024 2024
-
[11]
Journal of cognitive neuroscience19(7), 1067–1080 (2007)
Kimberg, D.Y., Coslett, H.B., Schwartz, M.F.: Power in voxel-based lesion- symptom mapping. Journal of cognitive neuroscience19(7), 1067–1080 (2007)
2007
-
[12]
Lee, N., Ajanthan, T., Torr, P.H.S.: Snip: Single-shot network pruning based on connection sensitivity (2019), https://arxiv.org/abs/1810.02340
Pith/arXiv arXiv 2019
-
[13]
In: Findings of the Association for Computational Linguistics: EMNLP 2025
Li, C., Wang, H., Fang, Y.: Attack as defense: Safeguarding large vision-language models from jailbreaking by adversarial attacks. In: Findings of the Association for Computational Linguistics: EMNLP 2025. pp. 20138–20152 (2025)
2025
-
[14]
In: Advances in Neu- ral Information Processing Systems 38 (2024), http://papers.nips.cc/paper_files/ paper/2024/hash/c55e6792923cc16fd6ed5c3f672420a5-Abstract-Conference.html
Li, M., Janson, L.: Optimal ablation for interpretability. In: Advances in Neu- ral Information Processing Systems 38 (2024), http://papers.nips.cc/paper_files/ paper/2024/hash/c55e6792923cc16fd6ed5c3f672420a5-Abstract-Conference.html
2024
-
[15]
Information Fusion118, 102995 (2025)
Li, X., Li, L., Jiang, Y., Wang, H., Qiao, X., Feng, T., Luo, H., Zhao, Y.: Vision-language models in medical image analysis: From simple fusion to general large models. Information Fusion118, 102995 (2025). https://doi.org/https://doi. org/10.1016/j.inffus.2025.102995, https://www.sciencedirect.com/science/article/ pii/S1566253525000685
arXiv 2025
-
[16]
Liang, W., Zhang, Y., Kwon, Y., Yeung, S., Zou, J.: Mind the gap: Understanding the modality gap in multi-modal contrastive representation learning (2022), https: //arxiv.org/abs/2203.02053
Pith/arXiv arXiv 2022
-
[17]
Liang, X., Lai, H., Wang, H., Zhang, W., Zhang, L., Chen, Y., Xiong, F., Li, Z.: Dissecting role cognition in medical LLMs via neuronal ablation (2025), https: //arxiv.org/abs/2510.24677
arXiv 2025
-
[18]
Lin, T.Y., Goyal, P., Girshick, R., He, K., Dollár, P.: Focal loss for dense object detection (2018), https://arxiv.org/abs/1708.02002
Pith/arXiv arXiv 2018
-
[19]
Liu, H., Li, C., Li, Y., Lee, Y.J.: Improved baselines with visual instruction tuning. In: IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2024, Seattle, WA, USA, June 16-22, 2024. pp. 26286–26296. IEEE (2024). https: //doi.org/10.1109/CVPR52733.2024.02484 Minimal neuron ablation triggers catastrophic collapse in LVLMs 15
arXiv 2024
-
[20]
In: Advances in Neu- ral Information Processing Systems 36 (2023), http://papers.nips.cc/paper_files/ paper/2023/hash/6dcf277ea32ce3288914faf369fe6de0-Abstract-Conference.html
Liu, H., Li, C., Wu, Q., Lee, Y.J.: Visual instruction tuning. In: Advances in Neu- ral Information Processing Systems 36 (2023), http://papers.nips.cc/paper_files/ paper/2023/hash/6dcf277ea32ce3288914faf369fe6de0-Abstract-Conference.html
2023
-
[21]
NeuroIm- age: Clinical10, 257–266 (2016)
Meyer, S., Kessner, S.S., Cheng, B., Bönstrup, M., Schulz, R., Hummel, F.C., De Bruyn, N., Peeters, A., Van Pesch, V., Duprez, T., et al.: Voxel-based lesion- symptom mapping of stroke lesions underlying somatosensory deficits. NeuroIm- age: Clinical10, 257–266 (2016)
2016
-
[22]
CoRRabs/1901.08644(2019), http://arxiv.org/abs/1901.08644
Meyes, R., Lu, M., de Puiseau, C.W., Meisen, T.: Ablation studies in artificial neu- ral networks. CoRRabs/1901.08644(2019), http://arxiv.org/abs/1901.08644
Pith/arXiv arXiv 1901
-
[23]
Qin, Z., Lyu, K., Yu, Q., Sun, Y., Fan, Z.: The Achilles’ heel of LLMs: How altering a handful of neurons can cripple language abilities (2025), https://arxiv.org/abs/ 2510.10238
arXiv 2025
-
[24]
Radford, A., Kim, J.W., Hallacy, C., Ramesh, A., Goh, G., Agarwal, S., Sastry, G., Askell, A., Mishkin, P., Clark, J., Krueger, G., Sutskever, I.: Learning transferable visual models from natural language supervision (2021), https://arxiv.org/abs/ 2103.00020
Pith/arXiv arXiv 2021
-
[25]
Rorden, C., Karnath, H.O.: Using human brain lesions to infer function: a relic from a past era in the fMRI age? Nat. Rev. Neurosci.5(10), 812–819 (2004)
2004
-
[26]
Journal of communication disorders38(1), 1–27 (2005)
Simmons-Mackie, N., Threats, T.T., Kagan, A.: Outcome assessment in aphasia: A survey. Journal of communication disorders38(1), 1–27 (2005)
2005
-
[27]
Simonyan, K., Vedaldi, A., Zisserman, A.: Deep inside convolutional networks: Visualising image classification models and saliency maps (2014), https://arxiv. org/abs/1312.6034
Pith/arXiv arXiv 2014
-
[28]
Stolfo, A., Wu, B., Gurnee, W., Belinkov, Y., Song, X., Sachan, M., Nanda, N.: Confidence regulation neurons in language models (2024), https://arxiv.org/abs/ 2406.16254
Pith/arXiv arXiv 2024
-
[29]
Tang, T., Luo, W., Huang, H., Zhang, D., Wang, X., Zhao, X., Wei, F., Wen, J.R.: Language-specific neurons: The key to multilingual capabilities in large language models (2024), https://arxiv.org/abs/2402.16438
Pith/arXiv arXiv 2024
-
[30]
Ye, J., Tang, H.: Multimodal large language models for medicine: A comprehensive survey (2025), https://arxiv.org/abs/2504.21051
Pith/arXiv arXiv 2025
-
[31]
Yu, M., Wang, D., Shan, Q., Reed, C.J., Wan, A.: The super weight in large language models (2025), https://arxiv.org/abs/2411.07191
Pith/arXiv arXiv 2025
-
[32]
Yuksekgonul, M., Bianchi, F., Kalluri, P., Jurafsky, D., Zou, J.: When and why vision-language models behave like bags-of-words, and what to do about it? arXiv preprint arXiv:2210.01936 (2022)
Pith/arXiv arXiv 2022
-
[33]
In: The Thir- teenth International Conference on Learning Representations, ICLR 2025, Singa- pore, April 24-28, 2025 (2025), https://openreview.net/forum?id=yR47RmND1m
Zhao, Y., Zhang, W., Xie, Y., Goyal, A., Kawaguchi, K., Shieh, M.: Understanding and enhancing safety mechanisms of llms via safety-specific neuron. In: The Thir- teenth International Conference on Learning Representations, ICLR 2025, Singa- pore, April 24-28, 2025 (2025), https://openreview.net/forum?id=yR47RmND1m
2025
-
[34]
Zhou, X., Liu, M., Yurtsever, E., Zagar, B.L., Zimmer, W., Cao, H., Knoll, A.C.: Visionlanguagemodelsinautonomousdriving:Asurveyandoutlook(2024),https: //arxiv.org/abs/2310.14414
Pith/arXiv arXiv 2024
-
[35]
Zhou, Z., Yu, H., Zhang, X., Xu, R., Huang, F., Wang, K., Liu, Y., Fang, J., Li, Y.: Ontheroleofattentionheadsinlargelanguagemodelsafety.In:TheThirteenthIn- ternational Conference on Learning Representations, ICLR 2025, Singapore, April 24-28, 2025 (2025), https://openreview.net/forum?id=h0Ak8A5yqw
2025
discussion (0)
Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.