Contamination Detection for VLMs using Multi-Modal Semantic Perturbation

AI summary

Overview

Research area: Data contamination (test-set leakage) detection and benchmark integrity for Vision–Language Models (VLMs).

Technical level: Intermediate. Readers should be comfortable with multimodal fine-tuning concepts such as LoRA versus full fine-tuning, diffusion-model image generation with ControlNet, and standard multiple-choice benchmark evaluation.

Scope: The paper proposes and validates a contamination-detection method that perturbs the visual semantics of benchmark images while preserving overall composition, then flags a model as contaminated if its accuracy drops on the perturbed variant relative to the original.

What This Paper Is About

Vision–Language Models are trained on internet-scale, often proprietary corpora, so benchmark test data may have leaked into training, inflating reported performance. The authors ask whether a reliable, practical, and consistent method exists for detecting contamination in VLMs, and they argue that existing detection methods — mostly designed for text-only LLMs — fail or give inconsistent signals when applied to multimodal models. Their goal is a simple black-box detector that needs no knowledge of leaked data or clean-model behavior, and whose signal grows with how heavily a model was contaminated.

Key Contributions

1. A multi-modal semantic perturbation detection framework. The method generates new image–question pairs by changing the original answer to a different option, then generating a new image whose visual semantics support that new answer while preserving the original composition. Contaminated models that memorized the original image–text pair fail to generalize to the perturbed input, revealing the contamination.

2. Validation across multiple contamination settings. The authors deliberately contaminate open-source VLMs under varying fine-tuning epochs, data composition, and training strategies (standard fine-tuning versus LoRA), and show the method satisfies all three of their stated requirements: Practicality, Reliability, and Consistency.

3. The first systematic study of VLM behavior under diverse contamination and detection strategies. The paper demonstrates that detection methods built for LLMs are often unreliable on contaminated VLMs and evaluates them against three formal requirements, reporting which ones fail and why.

4. Open resources. Code and the perturbed dataset are released at https://github.com/jadenpark0/mm-perturb.

Main Findings

• The three requirements are Practicality (Req. 1), Reliability (Req. 2), and Consistency (Req. 3). Practicality means the method needs no prior knowledge of a clean model and relies only on black-box interactions. Reliability means it detects contamination across heterogeneous fine-tuning strategies such as standard fine-tuning versus LoRA. Consistency means the detection signal is positively correlated with the degree of contamination n = deg_D(M).

• The perturbation is generated with an LLM plus a diffusion model. The main experiments use GPT-4o and Flux + ControlNet, guided by Canny edge maps, to preserve global image structure while introducing new elements that minimally alter semantics. On RealWorldQA, 440 image–question pairs remain from the original 765, and on MMStar the paper reports 478 remaining from 1,500 in Section 5 while Table 3 labels the filtered MMStar set as 495 images.

• Clean models improve on the perturbed benchmarks; contaminated models degrade. On MMStar with LLaVA-v1.5-7B, the clean model scores 37.78 versus 69.29 on the perturbed version (Δ +31.51). Every contaminated LLaVA variant drops: LoRA at epochs 1–3 gives 52.53 → 44.24 (Δ –8.29), 50.71 → 37.58 (Δ –13.13), and 54.34 → 38.18 (Δ –16.16); LLM+MLP gives 41.82 → 33.33 (Δ –8.49), 48.89 → 37.37 (Δ –11.52), and 50.71 → 36.97 (Δ –13.74).

• Qwen2-VL-7B shows the same pattern, with very large drops. Clean: 62.02 → 78.18 (Δ +16.16). LoRA: 78.38 → 71.31 (Δ –7.07), 94.14 → 65.25 (Δ –28.89), 95.96 → 63.64 (Δ –32.32). LLM-only: 89.90 → 60.40 (Δ –29.50), 97.98 → 54.95 (Δ –43.03), 98.99 → 55.96 (Δ –43.03). Every contaminated model is detected in both model families.

• Multi-modal leakage (Chen et al., 2024a) fails Practicality by design. It requires clean models as a baseline, so it cannot detect the reference models themselves. It also fails Reliability, for example failing to detect LLaVA-v1.5-7B trained for 3 epochs with standard fine-tuning, and Consistency breaks across benchmarks and training strategies, such as Qwen2-VL-7B trained for 3 epochs with LoRA and LLaVA-v1.5-7B trained for 3 epochs with standard fine-tuning.

• CircularEval (Liu et al., 2024b) fails Practicality because it lacks a clear threshold-independent detection mechanism. Its contamination signals are inconsistent: it fails to detect LLaVA-v1.5-7B trained with LoRA for 2 and 3 epochs, and Qwen2-VL-7B trained with standard fine-tuning for 2 epochs.

• Choice confusion (Yao et al., 2024) meets Practicality but not Reliability. Clean models gain substantially on the generalized benchmarks — up to +34.04 on MMStar and +21.30 on RQA — confirming generalization, whereas contaminated variants show much smaller gains or losses. However, it fails to detect LLaVA-v1.5-7B regardless of training strategy or epoch count, and for LLaVA-v1.5-7B trained with LoRA the model's performance improves as epochs increase.

• Other LLM-oriented detectors fail all three requirements. N-gram accuracy (Xu et al., 2024), shared likelihood (Oren et al., 2023), and guided prompting (Golchin and Surdeanu, 2024) are marked as failing reliability, practicality, and consistency in Table 1, with those results deferred to Appendix C. BGR shuffling (Lu et al., 2024a) and image masking / option shuffling (Song et al., 2025) also fail all three.

• Filtering does not bias the remaining data. Comparing full versus filtered datasets, LLaVA-v1.5-7B goes from 49.01% to 52.05% on RealWorldQA and from 32.87% to 37.78% on MMStar; Qwen2-VL-7B goes from 70.33% to 70.45% on RealWorldQA and from 59.80% to 61.62% on MMStar.

• Conditioning caption generation on the question and the new answer is essential. When captions were generated without that conditioning, clean-model performance on the generated images was much lower and invalid perturbations appeared far more frequently, for example because a critical image component was omitted, making the question ambiguous or unsolvable.

• Failure modes are rare. Manual inspection found that only 8 out of 440 images (approximately 1.8%) from perturbed RealWorldQA and 17 out of 495 images (approximately 3.4%) from perturbed MMStar deviate from the original question's visual details, cases where a contaminated model may answer both versions correctly.

• The method generalizes beyond synthetic edits. On NaturalBench (Li et al., 2024) real counterfactual pairs, clean LLaVA-v1.5-7B is stable (65.63 train, 65.89 test, Δ +0.26) while contaminated variants drop sharply: LoRA epoch 3 reaches 91.11 / 57.32 (Δ –33.79) and LLM+MLP epoch 3 reaches 98.63 / 53.05 (Δ –45.58), the largest drop reported at up to 45.95% in the text.

• Paraphrase-based contamination is still detected. With GPT-4o paraphrased RealWorldQA, LLaVA LoRA epoch 3 scores 59.09 on RQA versus 38.86 on RQA_P (Δ –20.23). With paraphrased MMStar, LoRA epoch 3 scores 62.22 versus 40.81 (Δ –21.41).

• The detector scales to larger models. With LLaVA-v1.5-13B on RealWorldQA, clean scores 51.14 versus 57.27 (Δ +6.13), while LoRA epoch 3 scores 77.05 versus 34.77 (Δ –42.28) and LLM+MLP epoch 3 scores 75.45 versus 37.27 (Δ –38.18).

• Pretraining-stage leakage is detectable. Mixing RealWorldQA into the 665K instruction-following pretraining corpus and training for one epoch yields a clean score of 52.05 versus 56.36 (Δ +4.31) and a contaminated score of 51.82 versus 50.00 (Δ –1.82) on the 440 filtered images.

• Weak contamination signals are still caught. Mixing MathVista (Lu et al., 2024b), MMMU (Yue et al., 2024), MMBench (Liu et al., 2024b), and CV-Bench (Tong et al., 2024) gives 11,280 image–question pairs, leaving RealWorldQA at approximately 6.7% and MMStar at approximately 13.3% of the training mixture, and detection remains clean and consistent.

• Filtering can be automated. Replacing manual validation with the o3 model removes 471 items and retains 294, of which 253 overlap with the manually kept set. These results satisfy all three requirements.

• The pipeline is not tied to GPT-4o. Substituting the open-source Molmo-7B-D (Deitke et al., 2024) for captioning yields 398 valid pairs after manual filtering and preserves the same detection trends.

Methodology in Plain English

The authors first define how contaminated a model is: the degree of contamination equals the number of times a data point appears across training epochs, which simplifies to the epoch count when a model is fine-tuned on the entire benchmark. They then deliberately contaminate open-source VLMs by training directly on evaluation data, using LLaVA-v1.5-7B and Qwen2-VL-7B on MMStar and RealWorldQA, with checkpoints at epochs 1, 2, and 3, and comparing standard fine-tuning variants (LLM plus adapter, LLM only, and full parameter unfreezing as in InternVL) against LoRA.

To build a perturbed benchmark, three steps are applied to each original item. First, the correct answer is randomly changed to a different option. Second, an LLM (GPT-4o in the main experiments) writes a dense caption of the image conditioned on the question and the newly chosen answer, so the caption emphasizes the specific visual features that must change. Third, Flux + ControlNet uses that caption together with Canny edge maps to regenerate the image, preserving the overall layout while introducing the semantic change. Because diffusion models can fail to render text or complex geometry, the authors filter the generated pairs using a single criterion: the perturbed question must be answerable unambiguously. Human filtering is used in the main results to show an upper bound, and an automated o3-based filter is tested as a replacement.

Detection is then a simple comparison. The same model is evaluated on the original benchmark and the perturbed benchmark. Clean models should hold steady or improve, since the perturbed questions are of comparable or lower difficulty; contaminated models that memorized the original pair should lose accuracy. A performance drop flags contamination. The authors note the approach can also be used at the sample level rather than only in aggregate. Comparisons are made against multi-modal leakage, CircularEval, and choice confusion, judged against the three requirements of practicality, reliability, and consistency.

Why This Matters

Impact on research. Reported benchmark scores for VLMs are only meaningful if test data was excluded from training, and the paper shows that several widely discussed detection methods — including CircularEval and choice confusion — do not behave consistently on multimodal models. By formalizing practicality, reliability, and consistency as explicit requirements, the work gives evaluation researchers a concrete checklist, and it shows that a detection signal can track the degree of contamination rather than only producing a binary verdict.

Real-world applications:

• Model and benchmark auditing: a third party can test a released VLM for leakage using only black-box queries, without access to the training corpus or a trusted clean baseline.
• Benchmark maintenance: dataset curators can release perturbed variants alongside originals to make future benchmarks harder to memorize.
• Procurement and compliance decisions: organizations choosing among vendor VLMs can check whether headline numbers reflect reasoning or memorization.
• Reproducibility checks in leaderboards: perturbed variants offer a way to sanity-check submissions that improve dramatically on a specific benchmark.

Industry relevance. The method needs no knowledge of proprietary pretraining data and no clean reference model, which matters because the models most at risk of leakage are exactly those whose corpora are undisclosed. The reported cost is low: the perturbed benchmark is constructed once, and per the paper's cost analysis, generating captions averaged approximately 75 input tokens and approximately 125 output tokens per image, so generating 1,000 captions would cost less than $1.50 (USD). The paper's cost discussion is truncated in the provided content, so full pipeline cost figures are not reported here. The method is also model-agnostic — it works with GPT-4o, with the open-source Molmo-7B-D, and with o3-based filtering — which lowers the barrier to adoption.

Future Directions

• Scaling and automating the filtering step. Manual inspection was needed only because of current diffusion-model limitations, and the paper notes that as generative models improve, manual filtering should become unnecessary. The o3 filter retained 294 items with 253 overlapping the manual set, leaving room to measure and improve automated agreement.

• Extending beyond multiple-choice, visually grounded benchmarks. The framework requires that visual semantics determine the answer, which is why the study is restricted to RealWorldQA and MMStar. The authors suggest free-form tasks could be handled with string matching, likelihood-based scoring, or LLM-as-a-judge approaches, with exploratory results in Appendix F.7.

• Applying the method to newer and larger VLMs. The paper notes that larger models are more prone to memorization, and the LLaVA-v1.5-13B results are presented as evidence of scalability. Testing on stronger, more recent VLMs — and on models that do publish decontamination policies — is a natural next step.

• Understanding and reducing perturbation failure modes. Cases where the perturbed image no longer resembles the original, occurring in 8 out of 440 RealWorldQA images and 17 out of 495 MMStar images, can hide contamination. Better preservation of visual details would tighten the detector.

Target Audience

This paper is most useful to benchmark and evaluation researchers, VLM developers and auditors concerned with test-set leakage, and practitioners who must judge whether strong reported numbers reflect genuine multimodal reasoning. It also suits graduate students and engineers working on data curation and decontamination, since it documents how contamination behaves under standard fine-tuning, LoRA, and full parameter unfreezing, and it provides released code and a perturbed dataset for reuse. Readers who need only a conceptual takeaway about benchmark validity can read the abstract, Table 1, and Table 2 and skip the appendices.

Authors’ abstract

Recent advances in Vision-Language Models (VLMs) have achieved state-of-the-art performance on numerous benchmark tasks. However, the use of internet-scale, often proprietary, pretraining corpora raises a critical concern for both practitioners and users: inflated performance due to test-set leakage. While prior works have proposed mitigation strategies such as decontamination of pretraining data and benchmark redesign for LLMs, the complementary direction of developing detection methods for contaminated VLMs remains underexplored. To address this gap, we deliberately contaminate open-source VLMs on popular benchmarks and show that existing detection approaches either fail outright or exhibit inconsistent behavior. We then propose a novel simple yet effective detection method based on multi-modal semantic perturbation, demonstrating that contaminated models fail to generalize under controlled perturbations. Finally, we validate our approach across multiple realistic contamination strategies, confirming its robustness and effectiveness. The code and perturbed dataset are released at https://github.com/jadenpark0/mm-perturb.