💬 NLP

When Correct Decisions Hide Internal Stress: Decision-State Probing in Multimodal Language Models

This paper introduces the S $^3$ E framework to reveal that multimodal language models can exhibit consistent correct external behavior while harboring significant internal decision-state instability when exposed to semantic stress, demonstrating that surface-level accuracy alone is insufficient to guarantee robust internal reasoning.

Original authors: Haoran Zhao, Soyeon Caren Han, Eduard Hovy

Published 2026-06-09

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Haoran Zhao, Soyeon Caren Han, Eduard Hovy

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Idea: The "Perfect Student" Who is Panicking Inside

Imagine you are a teacher grading a student's multiple-choice test. The student gets every answer right. On the surface, they look like a genius. They are calm, confident, and their final answers are perfect.

But what if, inside their brain, the student is actually panicking? What if their mind is racing, sweating, and scrambling every time they see a tricky question, even though they manage to pick the right answer in the end?

Traditional AI testing is like the teacher who only looks at the final bubble sheet. If the answer is correct, the AI gets a gold star. This paper argues that this isn't enough. Just because an AI gets the right answer doesn't mean it understood the question calmly or stably. It might be "stressed" internally, even if it looks perfect on the outside.

The Problem: The "Black Box" of AI

Multimodal Language Models (MLLMs) are AI systems that can see pictures and read text. Usually, we test them by asking:

"Does this caption match this picture?"
"Is this description fake?"

If the AI says "Yes" or "No" correctly, we assume it's working well. But the authors of this paper say: "Wait a minute. We don't know what's happening inside the machine while it's deciding."

They call this gap between External Behavior (the answer) and Internal State (the brain activity) a "blind spot."

The Solution: S3E (The "Stress Test" for AI Brains)

The authors created a new way to test AI called S3E (Structured Semantic Stress Evaluation). Think of S3E not as a test of what the AI knows, but a test of how it feels when it knows.

Here is how their experiment works, step-by-step:

1. The Setup: The "A/B" Choice

Imagine showing the AI a picture of a red cat.

Option A: "A red cat." (The correct answer).
Option B: "A blue dog." (The wrong answer).

The AI picks A. Easy.

2. The Stress: The "Tricky" Distraction

Now, the researchers create a "Stress Candidate." This is a sentence that looks very similar to the truth but has a hidden trap.

Option A: "A red cat."
Option B: "A red dog." (The color is right, but the animal is wrong).

This is a "semantic stress" test. The AI has to look closely to see the difference between a cat and a dog.

3. The Twist: Swapping the Order

To make sure the AI isn't just guessing or favoring the first option, they swap the order:

Trial 1: A = Red Cat, B = Red Dog.
Trial 2: A = Red Dog, B = Red Cat.

If the AI picks the "Red Cat" in both trials, it passes the "Strict-Correct" test. It got the right answer, no matter how the options were shuffled.

4. The Secret Probe: Looking at the "Pre-Answer" Brain

This is the magic part. While the AI is thinking but before it clicks "A" or "B," the researchers peek inside the computer's "brain" (its hidden states).

They measure the distance between the AI's internal thought process for the "Red Cat" vs. the "Red Dog."

The Control: They compare this to a "boring" change, like changing "Red Cat" to "Feline Cat" (same meaning, different words). This is like asking the AI to think about the same thing but with a synonym.
The Stress: They compare it to the "Red Dog" (wrong meaning).

The Discovery: The "Hidden Shiver"

The paper found something surprising across several different AI models (like Qwen, Gemma, and InternVL):

Even when the AI got the answer 100% correct (choosing the cat over the dog in both orders), its internal brain state showed a "shiver" or a large jump when facing the "Red Dog" option.

Normal Situation: When the AI sees a synonym ("Feline Cat"), its internal brain state stays calm and close to the original thought.
Stress Situation: When the AI sees the trap ("Red Dog"), its internal brain state wobbles or moves far away, even though it still manages to pick the right answer.

The Analogy:
Imagine a tightrope walker.

Scenario A: They walk across a calm day. They reach the other side safely.
Scenario B: They walk across a windy day. They reach the other side safely.
The Paper's Finding: If you only look at the finish line, both walks look identical (Success!). But if you look at their muscle tension (internal state), the walker in Scenario B was shaking violently the whole time, even though they didn't fall.

What Does This Mean?

The authors are not saying these AI models are broken or that they will fail in the future. They are saying:

Correctness is not enough: Just because an AI gives the right answer doesn't mean its internal logic is stable.
Stress is hidden: The AI can be "stressed" (internally unstable) while still performing perfectly on the outside.
It's a diagnostic tool: This new method (S3E) is like an MRI for AI. It lets researchers see the "internal stress" that normal tests miss.

Summary in One Sentence

This paper introduces a new way to test AI that looks inside the machine's "brain" while it's thinking, revealing that even when AI models give perfect answers, they can be internally unstable and "stressed" by tricky questions that normal tests would miss.

Technical Summary: Decision-State Probing in Multimodal Language Models

Problem Statement

Multimodal Language Models (MLLMs) are predominantly evaluated through externally observable behaviors, such as selecting the correct image-text match or answering visual queries accurately. While benchmarks like MMBench and MM-Vet measure these outputs effectively, the paper argues that correct external behavior does not guarantee internal stability. A model may consistently select the correct caption (strict-correct behavior) while its internal decision state exhibits significant instability or "stress sensitivity" when exposed to structured semantic perturbations. This creates an evaluation blind spot where behavior-only metrics report success, masking a hidden internal decision-state stress-sensitivity signal.

Methodology: S3E Framework

The authors introduce S3E (Structured Semantic Stress Evaluation), a framework designed to analyze the decoupling between external behavior and internal decision states.

1. Evaluation Protocol

Positive-Anchored A/B Forced-Choice: The evaluation presents an image, a positive caption ( $c^+$ ) supported by the image, and a candidate caption ( $c$ ). The model must choose which caption better matches the image.
Order Balancing: To eliminate position bias, trials are evaluated in both original ( $[c^+, c]$ ) and swapped ( $[c, c^+]$ ) option orders.
Strict-Correct Filtering: The analysis conditions on "strict-correct" trials, where the model selects the positive caption $c^+$ in both option orders against the candidate. This ensures the internal analysis focuses on cases where external behavior is stable and correct.

2. Candidate Conditions

The framework utilizes a "base–preserve–stress" substrate derived from public benchmarks (Winoground, SugarCrepe, ARO):

Positive ( $c^+$ ): The gold-standard, image-supported caption.
Preserve ( $c_{pres}$ ): A meaning-preserving rewrite of $c^+$ (tests internal stability of correct reformulations).
Lexical ( $c_{lex}$ ): A distinct meaning-preserving surface control (tests ordinary word-level variation).
Stress ( $c_{stress}$ ): A meaning-changing candidate introducing semantic conflict (object, attribute, relation, or compositional changes).
Random ( $c_{rand}$ ): A generic mismatch caption from a different source item.

3. Decision-State Probing

Extraction Point: Hidden states are extracted at the pre-answer decision state, immediately before the model emits the forced-choice token.
Metric: The authors use a positive-anchored cosine distance. For a candidate condition $k$ , the score $S^{(m,\ell)}_{i,o,k}$ is defined as $1 - \cos(h^{(m,\ell)}_{i,o,k}, h^{(m,\ell)}_{i,o,+})$ , where $h^{(m,\ell)}_{i,o,+}$ is the hidden state for the positive caption.
Control-Normalized Contrast: The primary metric is the excess displacement of the stress condition relative to controls:
- $\Delta_{lex} = S_{stress} - S_{lex}$ (Semantic stress vs. lexical variation).
- $\Delta_{pres} = S_{stress} - S_{pres}$ (Semantic stress vs. meaning-preserving reformulation).
- $\Delta_{rand} = S_{stress} - S_{rand}$ (Semantic stress vs. generic mismatch).

4. Diagnostic Profile

Results are reported across four dimensions (CA, SO, SI, BE):

CA (Compression–Anisotropy): Effective rank and variance concentration.
SO (Structural Organization): Layerwise drift and peak-layer localization.
SI (Selectivity–Identifiability): Specificity of the stress signal against controls.
BE (Behavioral Exposure): Accuracy and strict-correct rates.

Key Results

The study was conducted on five open-source models: Qwen3VL (2B, 4B, 8B), Gemma3-4B, and InternVL3-2B.

Existence of Hidden Stress Sensitivity: Across all tested models, semantic stress consistently produced positive selected-layer excess displacement ( $\Delta_{lex}$ ) relative to lexical controls, even when the model made the correct forced-choice decision.
- For Qwen3VL-8B, the paired standardized effect size ( $d_p$ ) was 2.85 with a $\Delta_{lex}$ of 0.1293.
- For Gemma3-4B, $\Delta_{lex}$ was 0.0093 with a $d_p$ of 5.45.
- Confidence intervals for $\Delta_{lex}$ excluded zero for all high-support runs.
Scale Does Not Eliminate the Gap: Increasing model scale (Qwen3VL 2B $\to$ 8B) did not collapse the behavior-internal decoupling. In fact, the semantic-specific contrast grew with scale (0.0190 $\to$ 0.1293), suggesting larger models may exhibit stronger or more identifiable stress-specific decision-state structures even when externally correct.
Specificity of the Signal:
- The effect is semantic-specific: $\Delta_{lex}$ was consistently positive, indicating the displacement is not merely due to lexical or surface-form variation.
- The effect is not generic mismatch: $\Delta_{rand}$ (stress vs. random negative) was model-dependent and often negative or near zero, confirming that random negatives serve as a stronger raw-mismatch reference rather than the primary semantic baseline.
Layer Localization: The stress response was localized to specific "peak" layers (identified via an E3 stress-specificity profile) but was also visible in a pre-specified top-half layer check, suggesting the response is not confined to a single isolated layer.

Significance and Claims

The paper makes modest, scoped claims regarding its findings:

Diagnostic Lens, Not Failure Certificate: The authors explicitly state that S3E is a scoped diagnostic target, not a certificate of downstream failure, hallucination, or safety. The presence of excess displacement under strict-correct behavior indicates "decision-state stress sensitivity," not necessarily that the model will fail in free-form generation or downstream tasks.
Insufficiency of Forced-Choice Correctness: The primary conclusion is that forced-choice correctness alone is not a sufficient certificate of invariant internal decision geometry. A model can be behaviorally robust while internally sensitive to semantic stress.
Interpretation of the Signal: The observed displacement is interpreted as a signal of how the model's pre-answer decision geometry changes when a candidate introduces semantic conflict. This signal survives controls for lexical variation, answer margin, and surface overlap.
Limitations: The authors acknowledge that the substrate is English-centric and derived from public benchmarks, which may limit generalizability. They also note that the analysis relies on white-box access (hidden states), limiting applicability to closed-source models. The metric $\Delta_{lex}$ is a geometric response in the pre-answer state and should not be conflated with calibration or future behavioral failure without further evidence.

In summary, S3E provides a method to detect "hidden stress" in MLLMs, revealing that internal decision states can be unstable even when external outputs appear correct, thereby motivating future work on layer-neutral estimates and robustness tests.