Unified Hallucination Fuzzing for Multimodal Large Language Models

Affiliations: National University of Singapore, DAMO Academy Alibaba Group, Renmin University of China, Zhejiang University, Hupan Lab, University of California Berkeley, Rochester Institute of Technology, The Hong Kong University of Science and Technology

Published: arXiv:2608.07525v1 [cs.CL] 15 Jul 2026

The paper addresses the persistent challenge of hallucination in Multimodal Large Language Models (MLLMs), which severely limiting their reliability in high-stakes applications. The authors argue that existing evaluations, predominantly based on static benchmarks, suffer from narrow taxonomical coverage and rapid performance saturation, failing to reflect model robustness in evolving real-world scenarios.

The paper states: "While numerous benchmarks have been proposed to quantify this phenomenon, the current evaluation paradigm becomes insufficient due to coverage limitations and performance saturation. Previous efforts mainly rely on static datasets with fixed inputs and predefined answers. As models evolve, they rapidly saturate these benchmarks, effectively memorizing the exam without acquiring true robustness. Such evaluations also fail to capture the vast long-tail distribution of real-world hallucinations and cannot systematically probe model vulnerabilities under adversarial or complex instruction mutations. Consequently, high benchmark scores often mask underlying brittleness, creating a false sense of security that necessitates a paradigm shift from static measurement to dynamic, adversarial stress testing."

The authors summarize their contributions as follows:

• We introduce UniHall, a risk-aware benchmark built on a unified Object–Instruction–Knowledge hallucination taxonomy.

• We propose SAMF, the first mutation-driven MLLM fuzzing framework with adaptive evolution and structured oracle verification.

• We reveal an alignment tax through systematic stress testing, showing that helpfulness-oriented RL can reduce instruction-level faithfulness.

The paper states: "We first propose a comprehensive taxonomy that classifies hallucinations into three distinct dimensions: Object-level (e.g., fabricated existence, attributes), Instruction-level (e.g., failure to refuse, sycophancy), and Knowledge-level (e.g., fictitious facts)."

The taxonomy includes:

• Object-level Hallucination (≥1000 instances): Existence Hallucination (200+), Attribute Hallucination (600+ with subtypes: Category, Number, Spatial, Size, State, Color/Other Attribute), Relation Hallucination (200+)

• Instruction-level Hallucination (≥500 instances): Context Hallucination (200+), Failure-to-refuse Hallucination (200+), Sycophantic Hallucination (200+)

• Knowledge-level Hallucination (≥500 instances): Factual Hallucination (200+), Reference Hallucination (200+), Detail Hallucination (200+)

According to Table 2: Total instances: 2,170. Question Formats: Yes-or-No (YON): 900, Open-ended VQA (free-form): 1,270. Avg G: 1.65, Avg N: 0.84. Prompt length: 18/1,455/122 (Min/Max/Avg). Prompt Length After fuzzing: 135/29,086/2,042.

The paper states: The dataset integrates widely used open-domain benchmarks (e.g., Hallu-PI and BEAF) with domain-specific resources. The annotation workflow involves: "1. Source Allocation: 3 Meta-reviewers assign relevant raw source data (overprovisioned by 5-10× the target per category) to 10 annotators. 2. ID and Taxonomy Assignment: Annotators map each instance to a standardized instance id and annotate metadata field. 3. Seed Data Preparation: Each instance is classified as Yes/No (YON) or open-ended VQA. 4. Quality Control: Annotators cross-check image–text alignment, taxonomy consistency, and visual clarity."

The paper states: "SAMF functions as an automated red-teaming mechanism, employing evolutionary strategies including reinforcement learning to generate semantically preserved yet adversarial mutations. To enable scalable and reliable assessment of these dynamic inputs, SAMF incorporates a structured hallucination metric driven by complementary oracles, combining symbolic rules, detectors, and LLM verifiers in a coarse-to-fine pipeline."

Textual Mutations target "cognitive robustness and reasoning stability via (i) redundancy/interference control (e.g., irrelevant context expansion, constraint stacking), (ii) complexity traps (e.g., syntactic complication, explicitly negated distractors), and (iii) knowledge-conflict induction (e.g., authority-bias injection)."

Specific operators include:

• (Easy) Irrelevant Context Expansion

• (Common) Constraint Stacking

• (Medium) Syntactic Complication

• (Hard) Disturbance Exclusion

• (Extreme) Authority Bias Injection

Visual Mutations stress "attention control and selective grounding via (i) background distraction injection, (ii) redundant multi-view copies with controlled image quality degradation, and (iii) multi-image overload with selective grounding constraints."

Specific operators include:

• (Easy) Background Multimodal Interference Injection

• (Common) Multi-image Copy Variant 1

• (Medium) Multi-image Copy Variant 2

• (Hard) Multi-image Copy Variant 3

• (Extreme) Multi-image Composition with Selective Grounding

The paper states: "SAMF leverages all mutation operators for extensive and fine-grained robustness evaluation. For strategy discovery, we use a 20% pilot subset of the benchmark; on this dynamic pilot set, our basic implementation performs operator search via a heuristic algorithm to balance search efficiency with hallucination coverage improvements."

For RL-based fuzzing: "RL agents learn adaptive policies that optimize operator selection and mutation intensity from oracle feedback; compared to heuristic strategies, RL-based fuzzing offers better long-horizon exploration and parallel-training efficiency for model-specific weakness discovery. Empirically, both are effective, but RL achieves higher hallucination discovery efficiency and more stable cross-model coverage."

The RL approach uses a Multi-Armed Bandit formulation: We formulate policy search as a multi-armed bandit problem where each arm represents a candidate fuzzing policy. For each (s, q) group, we maintain a pool of K policies (default K = 1024). Two bandit algorithms are supported: UCB and Epsilon-Greedy.

Training efficiency: "On a single node with 8 × NVIDIA H20 (96GB) GPUs, our RL-based fuzzing controller is trained in 37m28s (2248s) using 8-GPU data parallelism. In contrast, our heuristic fuzzing baseline is trained on a single GPU on one node and takes 10h31m4s (37864s). The significant reduction in training time of RL-based fuzzing represents a speedup of approximately 16.8×."

The paper proposes a multi-layered metric suite with (i) multi-stage deterministic logic, (ii) claim-level structural decomposition, and (iii) oracle-based verification grounded in evidence sets.

GHR addresses the failure of surface-level matching by employing asymmetric decision logic to detect unsupported but fluent responses. The decision function is defined as:

• 1 if SimNLP(y, N) ≥ τ1

• 1 if JudgeGPT(y, N) = TRUE

• 0 if Simtok(y, G) ≥ τ3

• 0 if SimNLP(y, G) ≥ τ2

• 0 otherwise

BHR utilizes deterministic oracles φ to verify claims against evidence E = A, C, E, V (Answers, Constraints, External knowledge, Visual facts). Claims are decomposed into atomic claims represented as tuples: ci = (typei, framei, spani), with typei ∈ Object, Instruction, Knowledge.

SHR generalizes BHR by replacing NLP components with GPT-based judges, including claim decomposition C(y) and oracle judgments φ(·). Each instance receives a continuous score: SHR(y) = (1/C(y)) Σ s(ci), where s(ci) ∈ [0, 1] reflects the severity of hallucination inferred from the judge output.

GHS directly captures subjective severity through graded GPT-based scoring. Each response is scored on a discrete 0–10 scale and normalized to [0, 1].

Defined as: M risk = (Σ x∈D rx · M(x)) / (Σ x∈D rx) where rx is the instance-level risk.

Models include: Qwen2.5-VL-7B, Qwen3-VL-8B, LLaVA-Next-Llama3-8B, LLaVA-v1.6 (Mistral-7B, Vicuna-7B, Vicuna-13B, 34B), GLM-4.1V-9B-Base, GLM-4.6V-Flash, InternVL3.5 (8B, 14B, 30B-A3B, 38B with variants), MiMo-VL-7B (with RL, RL+Thinking, SFT, SFT+Thinking variants), GPT-5 series (nano, mini, 5, 5.1, 5.2), Gemini-2.5 series (Flash, Pro), Gemini-3 series (Flash, Pro).

The Reasoning-Grounding Dissociation: "Our results challenge the assumption that stronger general-purpose reasoning yields better hallucination resistance. In the open-source domain, Qwen3-VL-8B, despite better performance on standard VQA benchmarks and reasoning tasks than Qwen2.5-VL-7B, consistently shows higher hallucination rates across the Object and Knowledge dimensions. Similarly, in the proprietary models, GPT-5.2 exhibits higher hallucination rates than its predecessors (GPT-5.0/5.1). This suggests that iterations emphasizing complex reasoning can inadvertently weaken factual grounding, especially as longer reasoning rationales may introduce more unsupported claims."

The Alignment Tax: "We observe that aggressive reinforcement learning (RL) alignment, while improving conversational fluency, can exacerbate hallucinations. For example, models such as Gemini-Pro often produce more comprehensive and verbose responses under RL incentives, increasing opportunities for unsupported details. To satisfy reward preferences for helpfulness, models may fabricate plausible information rather than answer concisely or admit uncertainty. We term this phenomenon the alignment tax: improving perceived helpfulness can come at the cost of factual faithfulness."

The Challenge of Knowledge Hallucination: Among the three dimensions, knowledge-level hallucinations show the highest variance and instability. Static benchmarks are ill-suited here because world facts change over time.

Metric Sensitivity and Verbosity Bias: "We observe a divergence between Generic Hallucination Rate (GHR) and structured metrics (SHR/BHR). Verbose models such as Gemini can be penalized by GHR because longer outputs raise the chance of triggering surface-level detectors. In contrast, SHR/BHR decompose responses into atomic claims before verification and suggest that Gemini is not substantially more prone to fabrication than GPT."

The paper states: All models show notable performance decreases from static to fuzzing evaluation. For example, Qwen2.5-VL-7B's overall accuracy drops from 0.702 to 0.635, while the generic hallucination rate rises from 0.298 to 0.365.

Specific results from Table 11:

• Gemini3-Flash: GHR rises from 31.97% (Standard) to 51.27% (RL-based Fuzz)

• Qwen2.5-VL-7B: GHR rises from 29.76% (Standard) to 42.65% (RL-based Fuzz)

• GPT-5.2: GHR rises from 27.68% (Standard) to 38.74% (RL-based Fuzz)

Category-wise Robustness: "Object-level hallucinations are relatively well handled: models reach high accuracy (e.g., 0.910 and 0.830 for Qwen2.5-VL-7B) and low hallucination rates. By contrast, instruction-level challenges such as refusal and sycophancy degrade markedly under fuzzed inputs (e.g., the hallucination rate for Refuse exceeds 0.9)."

Failure Mechanisms: "First, overgeneralization: with visual noise or style transfer, models may generate false object claims associated with the style rather than the actual content. Second, context misalignment: complex instruction mutations can shift the model toward language priors, causing it to ignore the visual context and follow the prompt's semantic trajectory."

Sycophancy under Stress: "When prompts contain authoritative bias or misleading preconditions (e.g., Authority Bias Injection), models show increased sycophancy. In severe cases, instruction-level tasks such as Refusal degrade most under fuzzing, with hallucination scores exceeding 0.8. Instead of relying on visual evidence, models may agree with the prompt premise."

Table 4 shows: "GHS aligns best with human judgments, achieving the highest Accuracy/F1/Kappa and strongest Pearson/Spearman in both original and risk-weighted settings. This suggests that humans often assess hallucination severity through holistic subjective intuition, which is closer to graded judge-based scoring (GHS) than deterministic claim verification."

The paper concludes: "In this work, we addressed the limitations of static evaluation paradigms by introducing SAMF, a dynamic framework that stresses MLLMs. Grounded in the proposed comprehensive taxonomy and UniHall benchmark, our approach systematically challenges MLLMs across Object, Instruction, and Knowledge dimensions through semantically guided mutations. By integrating adaptive perturbations with an ensemble of oracle-based detectors, SAMF reveals latent vulnerabilities and robustness of current MLLMs. Ultimately, this work establishes a new framework for universal hallucination assessment, offering critical insights into the development of trustworthy multimodal systems."

The framework, code and benchmark are available at https://github.com/LanceZPF/EvalHall.

Based on the paper, here are the specific improvements I can implement in an AI system, along with what the improved system can do:

Improvement: Implement a fuzzing engine that automatically mutates inputs (text and images) during evaluation, rather than relying on static benchmarks.

What the improved system can do:

• Automatically generate adversarial test cases by applying operators like:

• Textual: Irrelevant context expansion, constraint stacking, syntactic complication, disturbance exclusion, authority bias injection

• Visual: Background distraction injection, multi-image copies with degradation, style transfer, selective grounding constraints

• Use a reinforcement learning-based bandit controller (UCB or epsilon-greedy) to learn which mutation policies most effectively expose hallucinations for a specific model

• Retrain the fuzzing controller in 37 minutes on 8 GPUs, enabling rapid adaptation to new model architectures

• Achieve up to 16.8× faster policy search than heuristic hill-climbing methods

The improved AI system can:

1. Self-test for hallucinations using adaptive fuzzing without human intervention

2. Localize failures to specific subtypes (e.g., sycophancy under authority bias)

3. Quantify severity in a way that aligns with human judgment

4. Detect alignment tax from RL training

5. Avoid verbosity bias in evaluation

6. Verify knowledge against current, dynamic evidence

7. Signal when to refuse answering

8. Scale to new models rapidly (37-minute retraining of fuzzing policies)

Hallucination remains a persistent challenge for Multimodal Large Language Models (MLLMs), severely limiting their reliability in high-stakes applications. Existing evaluations, predominantly based on static benchmarks, suffer from narrow taxonomical coverage and rapid performance saturation, failing to reflect model robustness in evolving real-world scenarios. To bridge this gap, we present a systematic evaluation framework integrating a comprehensive benchmark with self-evolving stress testing. First, we introduce UniHall, a fine-grained dataset grounded in a unified taxonomy spanning Object, Instruction, and Knowledge dimensions. Second, to address benchmark saturation, we propose Self-Adaptive Multimodal Fuzzing (SAMF), a self-adaptive framework that employs evolutionary mutation strategies to explore the boundaries of model hallucinations. Crucially, to ensure reliable assessment of dynamic inputs, SAMF incorporates a structured metric suite driven by an ensemble of multi-modal oracles. Our extensive experiments reveal that state-of-the-art MLLMs exhibit significant performance degradation under fuzzing compared to conventional settings, exposing a dissociation between reasoning capabilities and factual grounding. Furthermore, we identify a helpfulness-hallucination trade-off, where reinforcement learning alignment inadvertently exacerbates sycophancy in instruction-following tasks. The framework, code and benchmark are available at https://github.com/LanceZPF/EvalHall.