Static benchmarks for evaluating hallucination in multimodal large language models (MLLMs) have a well-known problem: models saturate them quickly, often by memorising evaluation patterns rather than developing genuine robustness. This means high scores on benchmarks like POPE or HallusionBench do not reliably predict model behaviour on novel, complex, or adversarially constructed inputs. The paper "Unified Hallucination Fuzzing for Multimodal Large Language Models" addresses this directly, proposing both a richer benchmark and a dynamic stress-testing framework to surface failure modes that static evaluation systematically misses.
Key Contributions
The paper makes three substantive contributions that build on each other:
- UniHall: A benchmark of 2,170 image-question instances organised under a three-dimensional taxonomy covering Object-level hallucinations (fabricated existence, attributes, relations), Instruction-level failures (context misinterpretation, refusal failures, sycophancy), and Knowledge-level errors (fictitious facts, citation failures, referential errors). Each instance carries a risk-tier annotation from 1 to 5 reflecting the potential harm of a wrong response. This is a meaningful extension over prior work, which almost universally focused on object-level errors alone.
- SAMF (Self-Adaptive Multimodal Fuzzing): A mutation-driven evaluation framework that treats hallucination probing as a policy search problem. The framework applies semantically-preserving but cognitively adversarial perturbations to both text prompts and images, using either a multi-armed bandit formulation or a hill-climbing heuristic to discover which mutation strategies most reliably induce model failures.
- A structured oracle suite: Rather than relying on a single judge model, the evaluation pipeline chains symbolic rule checkers, visual object detectors, cross-modal alignment models, and LLM judges in a coarse-to-fine pipeline. This produces claim-level hallucination scores with graded severity rather than binary correctness labels.
Methodology
The SAMF framework is worth unpacking in some detail. Given a seed instance, an Orchestrator extracts structural attributes (question type, hallucination subcategory) and activates an Agent that specifies a fuzzing policy. A policy defines which text operators to apply (e.g., expand_context, authority_bias_context, constraint_stack), which image operators to apply (e.g., attention_distraction, complexity_multi_source), and the perturbation intensity level on a 1-5 scale. The policy search objective is to maximise the expected hallucination score across a dataset partition, formalised as a reward signal fed back to update the fuzzing controller.
The bandit formulation maintains a pool of 1,024 candidate policies per (subtype, question-type) group, with mutation operations including operator add/remove/swap and level adjustments. A hybrid initialisation strategy generates 40% of policies randomly and 60% by mutating existing ones, balancing exploration against exploitation. The hill-climbing baseline maintains a single current policy and accepts greedy improvements, providing a lower-complexity comparison point. Prompt lengths after fuzzing reach a maximum of 29,086 characters compared to 1,455 for seed prompts, giving a sense of the perturbation scale involved.
The oracle pipeline addresses a real methodological gap. Existing metrics like CHAIR conflate plausibility with correctness and produce no explanation of failure mode or severity. The General Hallucination Rate (GHR) metric used here incorporates negative annotation sets and asymmetric decision logic to flag unsupported responses even when they appear fluent. Claim-level metrics (BHR) decompose responses into verifiable claims and match them against evidence. A GPT-based scoring function (GHS) captures partial hallucinations and severity gradients. Each metric has acknowledged weaknesses discussed honestly in the paper, which is a good sign.
Results and Findings
The experimental results across a broad range of models are the most practically interesting part of the paper. Several findings stand out:
- All evaluated models show measurable performance degradation under fuzzing relative to static evaluation. Qwen2.5-VL-7B drops from an accuracy of 0.702 to 0.635 overall. GPT-5.2, the strongest model tested on static evaluation, still sees its generic hallucination rate rise from 0.282 to 0.342 under fuzzing. No model is immune.
- The GPT-5 series (GPT-5, GPT-5.1, GPT-5.2) achieves the lowest hallucination rates on static evaluation, with GPT-5 and GPT-5.1 both around 25-26% GHR overall. The LLaVA-v1.6 family performs substantially worse, with hallucination rates in the 43-47% range. This ordering is broadly expected, but the absolute magnitudes under fuzzing are sobering.
- There is a clear helpfulness-hallucination tradeoff. Models trained with reinforcement learning for user helpfulness show increased sycophancy on instruction-level tasks, fabricating plausible-sounding information in response to misleading prompts rather than refusing or expressing uncertainty. The InternVL3.5 Cascade RL variants consistently show higher sycophancy scores than their pretrained counterparts across model sizes. This is an alignment tax that current RLHF pipelines appear to introduce systematically.
- Stronger general reasoning capability does not reliably predict lower hallucination rates, a finding consistent with prior literature. Some larger or more capable models produce more severe hallucinations on specific subtypes, particularly knowledge-level fabrication.
- The sycophancy (Syco) scores are particularly striking: nearly every model tested scores near 100% on the refusal subtype, meaning models almost universally fail to refuse when they should. This is a known problem but the near-universal failure rate across architectures and scales is notable.
Limitations and Implications
The paper is methodologically careful but some limitations deserve attention. The oracle pipeline, while more sophisticated than prior work, still relies heavily on LLM judges for ambiguous cases, which introduces its own reliability concerns. The GHR metric is described as coarse-grained and unable to localise hallucination sources, and BHR is acknowledged to be brittle under linguistic variation. The framework's reliance on GPT-based scoring (GHS) for severity grading creates a dependency on proprietary model behaviour that may shift over time.
The fuzzing policy search is also computationally expensive. Maintaining a pool of 1,024 policies per subtype-question-type combination and evaluating them against a target model requires substantial inference budget, which may limit adoption for researchers without access to large compute resources. The paper does not provide a detailed cost analysis.
The broader implication is that the field needs to take benchmark saturation more seriously as a methodological problem. The dissociation between static benchmark performance and fuzzing performance suggests that published leaderboard rankings may overstate model reliability in deployment conditions. The helpfulness-hallucination tradeoff finding has direct relevance for anyone deploying MLLMs in high-stakes settings: RLHF alignment for user satisfaction may be actively making models less trustworthy on adversarial or ambiguous inputs.
The code and benchmark are available at github.com/LanceZPF/EvalHall, which should allow the community to reproduce results and extend the framework to new model families as they emerge. Given how rapidly the MLLM space is moving, a self-evolving evaluation framework of this kind addresses a genuine need.