🤖 AI

GHOST: Hallucination-Inducing Image Generation for Multimodal LLMs

The paper introduces GHOST, an automatic method that generates natural-looking, object-free images by optimizing image embeddings to actively induce and expose hallucination vulnerabilities in Multimodal Large Language Models, achieving significantly higher success rates than prior approaches while also serving as a tool for improving model robustness through fine-tuning.

Original authors: Aryan Yazdan Parast, Parsa Hosseini, Hesam Asadollahzadeh, Arshia Soltani Moakhar, Basim Azam, Soheil Feizi, Naveed Akhtar

Published 2026-02-03

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Aryan Yazdan Parast, Parsa Hosseini, Hesam Asadollahzadeh, Arshia Soltani Moakhar, Basim Azam, Soheil Feizi, Naveed Akhtar

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Problem: The "Over-Imaginative" AI

Imagine you have a very smart robot assistant that can look at photos and describe what it sees. It's great at most things, but it has a weird glitch: sometimes, it sees things that aren't there.

If you show it a picture of a banana on a plate, it might confidently say, "Yes, I see a knife next to the banana," even though there is no knife. In the AI world, this is called hallucination. It's like a person who is so eager to please or so used to certain patterns that they invent details to fill in the blanks.

The Old Way: Checking a Static List

Previously, researchers tried to find these mistakes by showing the AI a fixed list of photos (like a multiple-choice test). They would ask, "Do you see a knife?" and see if the AI got it wrong.

The Flaw: This is like testing a driver only on a specific, empty parking lot. You might miss the fact that they panic when they see a red ball rolling into the street. The old tests were too rigid and couldn't find new or weird ways the AI might fail.

The New Solution: GHOST (The "Magic Trick" Artist)

The authors introduce GHOST (Generating Hallucinations via Optimizing Stealth Tokens). Think of GHOST as a magician who doesn't just show the AI a picture; they paint a new picture specifically designed to trick the AI into seeing a ghost.

Here is how GHOST works, step-by-step:

1. The "Invisible Ink" Optimization

GHOST starts with a normal photo (like the banana on the plate). It wants to make the AI think there is a knife.

Instead of drawing a knife (which would be obvious to a human), GHOST works in a "secret language" called embeddings. Imagine this as the AI's internal dream state.
GHOST tweaks this dream state just a tiny bit. It adds "invisible ink" cues. Maybe it changes the curve of the banana stem so it looks slightly like a knife handle to the AI, but to a human, it still looks exactly like a banana.

2. The "Translator" (The Mapper)

There's a problem: The AI that looks at the picture (the MLLM) speaks a different language than the AI that paints the picture (the Diffusion Model).

GHOST builds a translator (called a mapper). This translator takes the "secret dream tweaks" from the painter and translates them into instructions the painter can understand, without needing to ask the viewer (the MLLM) for help every single second. This makes the process super fast.

3. The "Dream Painter" (Diffusion)

Once the secret instructions are ready, GHOST uses a Diffusion Model (a type of AI that creates images from noise) to paint the final picture.

It starts with the original banana photo and gently "denoises" it based on the secret instructions.
The Result: The final image looks 100% natural to a human. It's still a banana on a plate. But to the AI, the subtle changes in the lighting or shape are enough to make it scream, "I SEE A KNIFE!"

Why This is a Big Deal

The paper claims three major victories with GHOST:

It's a Master Detective:
- Old methods found about 1% of hallucination cases.
- GHOST found over 28% of cases. It's like upgrading from a metal detector that misses 99% of coins to one that finds almost all of them.
It's a Universal Trap (Transferability):
- GHOST can trick one AI (like Qwen) and then show that same "tricked" image to a totally different AI (like GPT-4o).
- The Result: The second AI also hallucinates! This proves that different AIs share the same blind spots. It's like finding a specific type of optical illusion that tricks both your eyes and your friend's eyes, even though you have different vision.
It's a Cure, Not Just a Test:
- The authors didn't just use GHOST to break things; they used it to fix them.
- They took the "tricked" images GHOST created and showed them to the AI with the correct answer ("No, there is no knife").
- The Result: The AI got better at not hallucinating in the future. It's like showing a student the exact trick questions they got wrong so they can learn the right answer.

The Bottom Line

GHOST is a tool that automatically creates "trick photos" to stress-test AI vision systems. It proves that current AI models are fragile and can be easily fooled by subtle, natural-looking changes. But more importantly, it provides a way to find these weaknesses and train the AI to be more reliable, ensuring that when it says it sees a knife, it's actually seeing a knife.

Technical Summary: GHOST – Hallucination-Inducing Image Generation for Multimodal LLMs

Problem Statement

Multimodal Large Language Models (MLLMs) suffer from object hallucination, a failure mode where the model incorrectly predicts the presence of an object that is absent in the input image. Current evaluation methods rely on static benchmarks with fixed visual scenarios and curated image sets. These approaches constrain analysis to known scenarios, failing to uncover model-specific vulnerabilities or unanticipated hallucination patterns. Furthermore, existing methods for discovering hallucinations often lack a systematic way to assess which image types trigger errors or rely on resource-intensive pipelines that do not effectively decouple optimization from image generation.

Methodology: GHOST

The authors introduce GHOST (Generating Hallucinations via Optimizing Stealth Tokens), a fully automatic, unsupervised pipeline designed to stress-test MLLMs by synthesizing images that induce hallucinations without inserting the target object.

Core Architecture

GHOST operates by optimizing in the image embedding space rather than the pixel space, utilizing a diffusion model to generate the final image. The pipeline consists of three main components:

Embedding Space Mapper ( $\Pi$ ):
To bridge the gap between the vision encoder of the target MLLM ( $V_M$ ) and the CLIP embedding space used by the diffusion model, GHOST employs a lightweight Multi-Layer Perceptron (MLP). This mapper is trained to align CLIP embeddings with the MLLM's vision tokens using a Mean Squared Error (MSE) loss. This decoupling allows for efficient optimization without backpropagating through the entire MLLM and diffusion pipeline simultaneously.
Optimization Objective:
Given an input image $X_v$ (lacking the target object $t$ ) and a query prompt $X_q$ (e.g., "Do you see a $t$ ?"), GHOST optimizes a CLIP embedding $c$ to satisfy three constraints:
- Proximity: The optimized embedding $c$ must remain close to the original image's embedding $c_0$ (regularized via $\ell_2$ penalty) to preserve high-level semantics.
- Absence of Object Semantics: The embedding must not encode the target object itself. This is enforced by penalizing the cosine similarity between $c$ and a "compositional embedding" derived from diverse textual descriptions of the target object (including direct descriptions, generic templates, and mined COCO captions).
- Inducing Hallucination: The embedding must maximize the probability of the MLLM outputting a "Yes" token. The adversarial loss is defined as $-\log p(y^* | X_q, \Pi(c))$ , where $y^*$ is the target token.
Guided Diffusion:
Once an embedding $c$ satisfies the hallucination threshold, it conditions a Latent Diffusion Model (specifically Stable Diffusion unCLIP). Unlike standard generation from noise, GHOST starts the reverse diffusion process from a partially noised latent of the original image. This ensures the generated image retains the structural integrity of the input while introducing subtle, misleading semantic cues.
- Filtering: A strict open-vocabulary object detector (OWLv2) filters the generated images. If the detector identifies the target object, the sample is discarded. Success is defined only when the MLLM hallucinates the object while the detector confirms its absence.

Key Contributions

Active Generation of Failure Cases: Unlike static benchmarks, GHOST actively synthesizes images that expose specific model blind spots, uncovering novel and unanticipated visual triggers for hallucination.
Decoupled Optimization: By mapping CLIP embeddings to the MLLM's vision space, GHOST avoids the computational bottlenecks of end-to-end pixel-space optimization, achieving a 5x speedup compared to prior methods like DASH.
Semantic-Level Perturbations: The method introduces subtle, semantic-level cues (e.g., modifying a banana stem to resemble a knife edge) that are perceptible to humans as natural variations but sufficient to push the model across the decision boundary.
Transferability: The method demonstrates that hallucination-inducing images optimized for one model often transfer to others, revealing systemic vulnerabilities across different MLLM architectures.

Experimental Results

The authors evaluated GHOST on three open-source MLLMs: Qwen2.5-VL, LLaVA-v1.6, and GLM-4.1V-Thinking.

Success Rate: GHOST achieved hallucination success rates between 28.1% and 32.4% across the tested models. In contrast, the prior state-of-the-art method, DASH, achieved only 0.1% on the same COCO-based dataset.
Transferability: Images optimized for Qwen2.5-VL induced hallucinations in GPT-4o at a rate of 66.5%, and in other models (LLaMA3.2, Aya, Gemini) at rates ranging from 42% to 72%, indicating shared failure modes.
Image Quality: Quantitative metrics (FID) and human evaluation confirmed that generated images are high-quality and visually natural. Human annotators agreed that the target object was absent in 86–89% of GHOST images, comparable to baseline diffusion methods.
Mitigation: Fine-tuning Qwen2.5-VL on GHOST-generated synthetic images improved robustness on downstream hallucination benchmarks (POPE and CHAIR) while maintaining general vision-language capabilities (VQAv2, COCO Captioning).

Significance and Claims

The paper positions GHOST as both a diagnostic and corrective tool for building reliable multimodal systems.

Diagnostic: It reveals that MLLMs rely on spurious correlations and subtle visual cues rather than robust object detection, exposing vulnerabilities that static benchmarks miss.
Corrective: The authors demonstrate that training on these synthetic failure cases can mitigate hallucinations, suggesting a pathway for improving model robustness.
Scalability: By decoupling the optimization from the image generator, GHOST offers a scalable framework for stress-testing future MLLMs, including reasoning-based models like GLM-4.1V-Thinking, where it successfully shifted the model's reasoning trajectory to justify non-existent objects.

The authors acknowledge limitations, noting the method's reliance on diffusion models capable of image-embedding conditioning (like unCLIP) and the current focus primarily on object-centric hallucinations, though preliminary experiments suggest applicability to attribute and relation hallucinations.