Contamination Detection for VLMs using Multi-Modal Semantic Perturbation

Introduction

As Vision-Language Models (VLMs) like LLaVA and Qwen2-VL continue to scale, they are increasingly trained on massive, internet-scale datasets. This trend has exacerbated the "test-set leakage" problem, where benchmark data is inadvertently included in training sets. Consequently, high benchmark scores may reflect memorization rather than genuine reasoning. While detection methods exist for Large Language Models (LLMs), they often overlook the visual modality in VLMs. This paper introduces a novel framework to detect such contamination by subtly altering the semantics of benchmark images.

Expand

Source, p. 1

Methodology: Multi-Modal Semantic Perturbation

The proposed method creates "counterfactual" versions of benchmark questions that require identical reasoning but lead to different correct answers. The pipeline consists of three primary stages:

1. Answer Swapping: A new correct answer is randomly selected from the existing multiple-choice options.
2. Semantic Image Editing: The system utilizes GPT-4o to generate a dense caption describing the necessary visual modifications (e.g., changing a "35" speed limit sign to "45"). These instructions guide the Flux diffusion model, which uses ControlNet to ensure the original image's layout and composition remain intact.
3. Generalization Testing: The model is evaluated on both original and perturbed versions. A "clean" model should generalize easily, whereas a "contaminated" model—relying on pixel-to-answer memorization—will show a significant performance drop.

Expand

Source, p. 5

Experimental Setup and Datasets

To validate the framework, the authors intentionally contaminated open-source models (LLaVA-v1.5-7B and Qwen2-VL-7B) using LoRA and full fine-tuning. Evaluation was conducted across three key benchmarks:

• MMStar: Focused on questions requiring explicit visual evidence.
• RealWorldQA: Targeted at spatial and physical world understanding.
• NaturalBench: Used for testing against real-world counterfactual image pairs.

Key Insights

• Brittle Memorization: Contamination-based performance is highly sensitive to semantic changes. Altering a single detail, like a number or color, disrupts the model's ability to "recall" the correct answer.
• Generative AI as a Diagnostic: High-fidelity diffusion models like Flux can effectively serve as "truth serums," probing the limits of a model's understanding through consistent semantic edits.
• Clean Model Robustness: Interestingly, clean models often performed better on perturbed images, likely because the generative process clarifies salient visual cues compared to noisy real-world photos.

Results

The method proved to be reliable and consistent across various architectures. On the MMStar dataset, clean models exhibited a performance gain of ~31% on perturbed sets. In contrast, contaminated models suffered accuracy drops between 8% and 32%, with the magnitude of the drop correlating strongly with the degree of training on leaked data. Traditional text-only detection methods were found to be inconsistent for VLMs, as they ignore the critical visual features models might have memorized.

Conclusion and Future Work

Multi-modal Semantic Perturbation offers a practical and scalable solution for identifying data contamination in VLMs. While the method currently faces some limitations—such as Flux's difficulty with complex geometries or fine text at low resolutions—it represents a significant step toward more honest AI evaluation. Future work aims to automate this process further, potentially integrating it directly into benchmark releases to prevent pre-contamination.