In vision--language models, commonsense-driven hallucination (CDH) occurs when a model's commonsense prior overrides clear visual evidence of an atypical state. For example, a model may report that a visibly six-fingered hand has five fingers. We show that these errors are systematically directed: when a model answers a question about a counterfactual (CF) image incorrectly, its answer often coincides with the candidate it prefers without access to the image. Suppressing this prior indiscriminately can repair CF errors, but may also disrupt correct answers on matched commonsense (CS) images, where the same prior is helpful. We therefore propose Selective Prior Calibration (SPC), which subtracts candidate-level prior-preference estimates from image-conditioned scores with an instance-dependent strength and revises the original prediction only when the resulting score pattern strongly supports an alternative. Extensive experiments demonstrate that SPC substantially improves accuracy on CF images while largely preserving accuracy on matched CS images. Furthermore, these gains generalize across CDH categories, candidate-answer permutations, and other conflict benchmarks, while SPC rarely alters predictions on benchmarks without such conflicts.
Retrieval-Augmented Generation (RAG) systems typically consist of a dense retrieval (DR) model for initial retrieval and a neural ranking model (NRM) for re-ranking.Existing robustness studies in RAG mainly focus on NRMs, while adversarial attacks on DR models are mostly limited to word-level perturbations.For low-ranked target documents that are irrelevant to the query, simple word-level attacks are insufficient to mislead DR models into substantially promoting their rankings.To solve these problems, we propose SentAttack, a sentence-level black-box adversarial attack method for DR models.SentAttack is designed as a two-stage method.In the first stage, SentAttack interacts with the black-box RAG system via iterative retrieval to collect ranked documents and ranking information for training a surrogate DR model.In the second stage, SentAttack uses the surrogate DR model to encode and cluster documents relevant to the target query, yielding multiple cluster centroids.These centroids are concatenated with the target document at the sentence level to form an initial set of adversarial candidates.SentAttack then optimizes these candidates using a query- and centroid-guided objective combined with gradient-guided beam search.Extensive experiments demonstrate that SentAttack outperforms existing adversarial attacks on DR models, with especially strong performance on low-ranked target documents.
Luping Wei, Yamin Hu, Sihan Shang et al.· 0 citations