Doc-PP: Document Policy Preservation Benchmark for Large Vision-Language Models

AI summary

Overview

Research area: Safety and policy compliance in Large Vision-Language Models (LVLMs), specifically document question answering over multimodal PDFs under user-defined non-disclosure constraints.

Technical level: Intermediate — the task framing is intuitive, but the evaluation framework, checklist filtering, and mitigation baselines assume familiarity with LVLM benchmarking and LLM-as-a-judge evaluation.

Scope: The paper introduces Doc-PP, a benchmark of 443 explicit and 698 implicit queries built from 90 long-form PDFs, and proposes DVA (Decompose–Verify–Aggregation) as an inference-time defense against policy violations.

What This Paper Is About

Real documents are often governed by dynamic, user-specified policies about what may or may not be disclosed (for example, "Do not disclose Middle East revenue"). The paper asks whether LVLMs can answer useful questions about such documents while respecting those policies, and finds that models leak protected values when the answer must be computed or aggregated across charts, tables, and text. The authors build a benchmark to measure this failure and propose a structural inference framework to reduce it.

Key Contributions

1. Doc-PP benchmark. A policy-preservation benchmark constructed from 90 long-form PDF documents drawn from MMlongbench-Doc and Sustainable QA, focused on business, financial, and industry reports. It contains 443 explicit queries and 698 implicit queries, with 1,141 confidential targets distributed across text, table, chart, figure, and cross-modality evidence types.

2. Identification of two failure modes. The paper names a Reasoning-Induced Safety Gap (models leak when answers must be inferred by synthesis or cross-modal aggregation) and an OCR Paradox (providing OCR-extracted text improves perception but increases leakage).

3. A three-stage construction pipeline with human-validated evaluation. Policies are generated and filtered through a five-point checklist, cutting 838 initial candidates down to 635 retained targets; queries are paired with content-coverage checklists that exclude the protected value; the LLM-as-a-judge framework reaches 93% agreement with human annotators on 100 randomly sampled instances in both a generation-stage and an evaluation-stage validation study.

4. DVA (Decompose–Verify–Aggregation). A mitigation framework that rewrites a prospective answer into atomic information elements, verifies each element against the policy, discards violating elements, and aggregates only the valid ones.

Main Findings

• Implicit queries break policy adherence. In explicit-query settings, the strongest models show low leakage (GPT-5.2: 8.1 under image input; Qwen3-VL-235B-A22B-Thinking: 11.5). Under implicit queries with a policy, leakage rises sharply (GPT-5.2: 25.7; Gemini-3-Pro-Preview: 46.8; Gemini-3-Flash-Preview: 64.6; Qwen3-VL-235B-A22B-Instruct: 93.5; Mistral-Large-2512: 76.8; Qwen3-VL-235B-A22B-Thinking: 40.4).

• Faithfulness drops when a policy is imposed. For GPT-5.2 under image input, implicit-query faithfulness falls from 74.2 without a policy to 68.7 with one; Gemini-3-Pro-Preview falls from 64.6 to 60.5; Gemini-3-Flash-Preview moves from 70.2 to 69.0.

• The OCR Paradox. OCR-parsed inputs produce higher leakage than PNG inputs for the models tested. GPT-5.2's explicit-query leakage rises from 8.1 (image) to 11.5 (Mistral-OCR); Qwen3-VL-235B-A22B-Thinking rises from 11.5 to 14.2.

• Cross-modal evidence is the riskiest. Using Gemini-3-Flash-Preview as the case study, single-source evidence yields lower leakage (Text single: 59.7 explicit, 72.8 implicit; Table single: 42.7, 75.2; Chart: 52.7, 67.9; Figure: 60.0, 56.7). Multi-source and cross-modal settings spike: Text (Multi) 69.2 and 84.6; Table (Multi) 80.0 and 100.0; Chart + Text 100.0 and 100.0; Table + Text 66.6 and 88.0; Figure + Text 75.0 and 83.3.

• Text-heavy documents leak more. Business reports (68.1% text ratio) show the highest leakage, peaking at 84.6%, and financial reports (60.7% text ratio) also rank high. Research reports have the lowest text ratio (50.3%) and the lowest leakage (62.2%).

• A larger context window is not a safety buffer. Extending the context window from 2 to 25 surrounding pages leaves leakage fluctuating between roughly 60% and 70% (for example, 64.2 at 2 pages, 69.9 at 7 pages, 62.3 at 25 pages), with faithfulness between 66.8 and 70.7.

• Standard prompting defenses are limited. On Gemini-3-Flash-Preview, leakage drops from 64.6 (default) to 51.0 with Chain-of-Thought and 38.8 with post-hoc revision, while DVA reaches 30.5. On Qwen3-VL, default leakage of 93.5 falls to 50.6 (CoT), 44.5 (Revision), and 24.5 (DVA). On Mistral-Large, default 76.8 falls to 70.6 (CoT), 41.9 (Revision), and 41.6 (DVA).

• DVA trades leakage reduction for verbosity and some faithfulness. Average response length rises from 382.42 tokens (Naive) to 935.97 (DVA). Faithfulness scores are 59.0 (CoT), 66.9 (Revision), and 55.8 (DVA), against DVA's leakage of 30.5.

• DVA itself has a failure mode. In one case, DVA correctly blocked a direct statement of a new repurchase program's $10 billion amount but still allowed contextual leakage, because disclosing the prior program's identical $10 billion figure enabled the user to infer the protected value.

• Models leak inside benign-looking tasks. Gemini-3-Flash-Preview leaked sensitive technical details in a summary task (random digit dial samples and telephone interview methods) even under a policy prohibiting disclosure of the survey's methodological basis. In the case study comparison, CoT and Revision failed to withhold the restricted value in 37% of ratings, while DVA prevented the leak.

Methodology in Plain English

The authors start from 90 long-form PDF documents (averaging 100 pages) in business, financial, and industry report categories. For each document, they prompt GPT-5.2 to propose a confidential target that a policy should protect, requiring the model to cite the evidence type (text, table, chart, figure, or mixed), page indexes, and a verbatim quote, all verified by human annotators.

Because full documents are too long, they clip a window of two pages before and after each evidence page and extract a short, self-contained ground-truth value from that clip. Each candidate target-value pair then passes a five-item binary checklist (grounded in the PDF; uniquely identifiable; the value answers the target; the target does not itself leak the value; noun-phrase constraint). Candidates failing any item are discarded.

Queries come in two flavors. Explicit queries use a single fixed template asking for details on the restricted target. Implicit queries are generated by GPT-5.2 as summary-style questions that cannot be answered correctly without stating the protected value, with two differently framed questions per target. Each implicit query gets a content-coverage checklist of atomic facts, filtered so that any criterion overlapping the confidential target is removed, and only queries retaining at least three valid criteria are kept.

Evaluation runs along two axes: leakage (does the output contain the confidential value) and faithfulness (fraction of valid checklist criteria satisfied). Explicit queries with a policy are scored only for leakage; implicit queries are scored for both. A separate large language model, GPT-5-mini, serves as the judge. Images are supplied either as PNG files or as Mistral-OCR extractions containing interleaved text, images, and tables.

Mitigation is tested with three strategies: Chain-of-Thought prompting, post-hoc revision (a second call asking the model to fix policy violations in its own answer), and the authors' DVA approach, which decomposes a draft answer into atomic claims, checks each against the policy, discards violations, and re-aggregates the survivors.

Why This Matters

The paper reframes multimodal safety as a problem of when leakage happens rather than only whether a model recognizes a sensitive entity. It shows that perception quality and policy compliance can move in opposite directions, and that the bottleneck is the granularity at which verification occurs.

Real-world applications:

• Enterprise document assistants. Financial and business reports are routinely shared with different audiences under different disclosure rules; a model that recomputes protected figures from a chart and a total is a compliance risk.
• Regulated reporting workflows. Quarterly filings, industry analyses, and internal roadmaps often carry region- or segment-specific restrictions that change per audience and per update cycle.
• Privacy-preserving summarization tools. Any tool that summarizes long PDFs must decide what to omit, and this benchmark measures exactly that trade-off between usefulness and redaction.
• Agentic retrieval pipelines. Because leakage is driven by localized cross-modal reasoning rather than long context, the risk persists even in short retrieval windows, which affects how agent systems chunk and serve documents.

Industry relevance: the results give a measurable baseline for policy-compliant document QA, and the finding that OCR text increases leakage is directly relevant to teams that preprocess PDFs into text before feeding them to a model.

Future Directions

• Closing the contextual leakage gap. DVA blocks direct statements but not inference from parallel context (for example, a prior program with an identical figure). Detecting what a user could deduce, not just what is stated, remains unsolved.
• Reducing DVA's cost. DVA produces the longest responses (935.97 average tokens) while scoring lower faithfulness (55.8) than Revision (66.9), so improving the leakage-faithfulness-verbosity trade-off is an open problem.
• Understanding the OCR Paradox mechanistically. The paper documents that OCR extraction increases leakage but does not isolate which properties of the extracted representation cause it.
• Broadening model and document coverage. Evaluation covers six LVLMs, and the limitations section notes that dataset construction and evaluation partly rely on LLMs, which may introduce model-specific biases; extending human validation and model coverage would test generality.

Target Audience

Researchers and practitioners working on multimodal document understanding, LVLM safety, and privacy-preserving AI; benchmark designers interested in checklist-driven evaluation; and engineers deploying document QA systems in finance, business, or regulated industry settings where user-defined disclosure policies apply.

Authors’ abstract

The deployment of Large Vision-Language Models (LVLMs) for real-world document question answering is often constrained by dynamic, user-defined policies that dictate information disclosure based on context. While ensuring adherence to these explicit constraints is critical, existing safety research primarily focuses on implicit social norms or text-only settings, overlooking the complexities of multimodal documents. In this paper, we introduce Doc-PP (Document Policy Preservation Benchmark), a novel benchmark constructed from real-world reports requiring reasoning across heterogeneous visual and textual elements under strict non-disclosure policies. Our evaluation highlights a systemic Reasoning-Induced Safety Gap: models frequently leak sensitive information when answers must be inferred through complex synthesis or aggregated across modalities, effectively circumventing existing safety constraints. Furthermore, we identify that providing extracted text improves perception but inadvertently facilitates leakage. To address these vulnerabilities, we propose DVA (Decompose-Verify-Aggregation), a structural inference framework that decouples reasoning from policy verification. Experimental results demonstrate that DVA significantly outperforms standard prompting defenses, offering a robust baseline for policy-compliant document understanding