💻 computer science

Witness Evidence Portfolios: Single-Prefill Risk Detection for Closed Multimodal Answers

The paper introduces Witness Evidence Portfolios (WEP), a white-box, inference-time risk detection method that analyzes layer-by-layer visual contributions to generate interpretable evidence routes, thereby significantly improving the reliability of closed multimodal answers without requiring image perturbation, backward passes, or external verifiers.

Original authors: Fexiang Liu, Shiye Wang, Qiang Qiu, Zheng Wang

Published 2026-07-31

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Fexiang Liu, Shiye Wang, Qiang Qiu, Zheng Wang

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are hiring a very smart, very confident robot to answer questions about pictures. You show it a photo of a garden and ask, "Are there carrots here?" The robot instantly shouts, "No!" with 99% certainty. But what if the robot is actually looking at the word "garden" in the corner of the image, or a random cloud, and just guessing? This is the tricky world of Multimodal Large Language Models (MLLMs). These are AI systems that can "see" images and "read" text, combining them to answer questions. The big problem isn't just getting the right answer; it's knowing when the AI is confidently wrong. In the real world, we need to know if we can trust a robot's answer or if we should double-check it. This paper tackles the question: How can we tell if a robot's confidence is real, or just a lucky guess based on the wrong part of the picture?

Enter Witness Evidence Portfolios (WEP), a new method developed by Feixiang Liu and colleagues to act as a detective for these AI robots. Think of the AI's brain as a giant library where every layer of its thinking process leaves a trail of breadcrumbs. Usually, we only look at the final answer the robot gives. WEP, however, goes back and checks the "breadcrumbs" left behind during the split second the robot was thinking. It asks two simple questions: Where did the robot look for its evidence, and how tightly was that evidence focused?

Here is how WEP works, using a playful analogy. Imagine the robot is a detective trying to solve the "Carrot Case."

The Witness Map: First, WEP identifies the "witnesses." If the question is about carrots, the witnesses are the parts of the image that actually look like carrots.
The Evidence Trail: As the robot thinks, it gathers "signed evidence." This is like a scorecard where positive numbers mean "this supports the answer" and negative numbers mean "this argues against it." WEP traces exactly which parts of the image contributed to the robot's final "No."
The Two Checks:
- Provenance (The "Where" Check): Did the robot's positive evidence actually land on the carrot witnesses? Or did it accidentally land on a background fence or a chart title? If the robot says "No carrots" but its positive evidence is stuck on a fence, WEP flags it as risky.
- Concentration (The "Focus" Check): Is the robot's evidence tightly packed on the right spot, or is it scattered all over the image like a confused person? If the evidence is spread out everywhere, it suggests the robot is guessing rather than seeing.

The researchers tested this "detective kit" on three different AI models (Qwen3-VL, LLaVA, and InternVL) and four different sets of tricky visual questions. They found that WEP is incredibly good at spotting the confident-but-wrong answers. In fact, across all 12 combinations of models and tests, WEP improved the ability to rank errors by an average of 0.134 (measured as Error Average Precision). This means that if you have a list of answers to review, WEP helps you find the mistakes much faster than just looking at the robot's confidence score alone.

What makes this special is that WEP doesn't need to ask the robot to try again, change the picture, or use a second robot to check the work. It uses the exact same "thinking path" the robot took the first time, just peeking at the internal notes it left behind. The team also proved that this works because the evidence actually matches the question, not just because of some random math trick. When they shuffled the evidence around so it didn't match the question anymore, the system stopped working, showing that the "where" and "how focused" of the evidence really matters.

In short, WEP gives us a way to peek under the hood of AI vision. It doesn't change the robot's answer, but it gives us a "risk score" that tells us, "Hey, this answer is confident, but the robot was looking at the wrong thing." This allows us to build safer systems where we can trust the robot when it's right, and catch it when it's confidently wrong, all without slowing things down or needing extra tools. It's like having a super-observant intern who quietly checks the detective's notes before the final report is filed.

Technical Summary: Witness Evidence Portfolios (WEP)

Problem Statement
The reliable deployment of Multimodal Large Language Models (MLLMs) requires mechanisms to determine whether a confident visual answer should be trusted, reviewed, or routed to a stronger system. While standard confidence scores (based on candidate margins) indicate how far a predicted answer is from its competitors, they fail to reveal the source of the decision. A model may produce a high-confidence "no" to a question like "Are there carrots in this image?" even when the internal visual readouts supporting that decision are concentrated on irrelevant regions (e.g., chart titles or backgrounds) rather than the actual visual evidence. Existing methods for hallucination detection or risk assessment often rely on generic internal states, require image perturbations, additional decoding passes, or external verifiers, leaving a gap in detecting unsupported decisions using only the original inference path.

Methodology: Witness Evidence Portfolios (WEP)
WEP is a white-box risk detection framework designed for closed-answer MLLMs. It operates during a single prefill pass, utilizing the same forward path that generates the answer, without requiring backward passes, image perturbation, or external models.

Question-Bound Witness Maps:
The method first identifies "witnesses" in the visual space bound to the question. For a question token $j$ , a binding distribution $B_j(v)$ over visual tokens $v$ is computed. These are aggregated into a question witness map $P_Q(v)$ , weighted by the token's importance to the final decision. This distinguishes question-relevant regions from generic salient regions. A uniform visual reference $U(v)$ is also defined to control for general visual overlap.
Estimated Signed Decision Evidence:
WEP estimates the contribution of internal visual tokens to the predicted candidate margin. For a candidate $y$ , a readout direction $d_y$ is defined based on the unembedding matrix and competitor logits. The contribution $C_{\ell,y}(s)$ of a source token $s$ at layer $\ell$ is calculated by projecting internal value vectors onto this direction. These contributions are transported back to visual space to form signed evidence maps $E_{\ell,y}(v)$ , where positive values support the prediction and negative values contradict it.
Route Families:
WEP summarizes these evidence maps into two interpretable route families:
- Provenance Routes: These measure the overlap between the signed evidence and the question-bound witnesses ( $P_Q$ ) versus the uniform reference ( $U$ ). They specifically track whether evidence aligns with the specific entities requested (e.g., "carrots") or generic image regions. A residual score captures the excess alignment with question-specific witnesses.
- Concentration Routes: These measure the spatial distribution of the signed evidence. They calculate normalized entropy to determine if supportive evidence is narrowly concentrated (potentially relying on a shortcut) or if contradictory evidence is diffusely distributed.
Nested Validation and Portfolio Fusion:
To avoid overfitting and select the most reliable signal, WEP employs a nested grouped validation process. An inner fold selects the superior route family (Provenance or Concentration) based on error ranking performance without accessing outer-fold labels. A sparse top- $k$ portfolio of routes from the selected family is then fitted on the calibration set. Finally, these selected route scores are standardized and fused with the baseline candidate-margin confidence to produce the final risk score.

Key Contributions

Signed Decision-Evidence View: The paper introduces a novel perspective on risk ranking that evaluates whether internal visual contributions support or contradict the current candidate margin, going beyond simple confidence metrics.
Complementary Decompositions: It proposes two complementary decompositions of signed visual evidence: provenance (question-specific alignment) and concentration (spatial distribution), coupled with a low-capacity selector to choose the optimal family.
Efficient White-Box Detection: WEP achieves risk detection using only a single instrumented prefill pass with sparse read-row recomputation, requiring no image perturbation, backward passes, or external verifiers.

Results
The method was evaluated across three MLLM backbones (Qwen3-VL-8B, LLaVA-1.5-7B, InternVL3.5-8B) and four binary-answer benchmarks (AMBER-D, Causal-HalBench, VSR, HallusionBench).

Performance: WEP improved the mean error Average Precision (AP) by 0.134 across all 12 model-dataset pairs. All 12 pairs showed positive gains, and 10 of 12 image-cluster bootstrap intervals were strictly positive.
Triage Utility: At low review budgets (1%, 5%, 10%), WEP significantly improved the precision of error detection compared to confidence baselines, effectively concentrating errors at the top of the review queue.
Ablations:
- Unsigned evidence and uniform route averaging yielded minimal gains.
- Provenance and Concentration families individually performed well but were outperformed by the nested selection strategy, which adaptively chose the best family for each context.
- Controls using extra paths (e.g., Visual Contrastive Decoding) performed worse than WEP on the strict same-prediction subset, highlighting WEP's efficiency.
- Evidence-shuffling controls confirmed that gains depend on matched internal evidence rather than score-distribution shifts.

Significance and Claims
The paper claims that WEP establishes question-related visual provenance as a practical and effective signal for deciding which closed multimodal answers warrant review or routing. By augmenting candidate confidence with signed evidence provenance and concentration, WEP provides an inspectable, low-overhead mechanism for reliable MLLM deployment. The authors emphasize that the method does not replace the risk-control layer of selective routing but augments it with interpretable, question-aligned signals derived directly from the model's existing inference path. The results suggest that analyzing the source and distribution of internal visual evidence offers a complementary view to confidence scores for detecting unsupported or hallucinated answers.

Technical Summary: Witness Evidence Portfolios (WEP)

More like this