Knowing What Not to Answer: Selective Non-Compliance in Vision-Language Models

AI summary

Overview

Research area: Vision-language model safety, refusal behavior, and benchmark design (Natural Language Processing / multimodal evaluation).

Technical level: Intermediate. The paper is readable without deep reinforcement-learning background, but some familiarity with vision-language models and supervised fine-tuning helps.

Scope: This paper introduces KoNA, a benchmark of paired single and compound queries for measuring whether vision-language models can selectively withhold compliance on only the invalid parts of a request while still answering the valid parts, and shows that fine-tuning on KoNA improves this ability.

What This Paper Is About

Existing benchmarks test whether a model refuses or complies with a query as a whole, treating each request as entirely valid or entirely invalid. In real use, a single question can mix answerable content with a component that is based on a false premise, cannot be seen in the image, cannot be verified, is infeasible, or is unsafe. The goal of this work is to measure and improve a model's ability to apply non-compliance selectively, to the affected component only, while still answering the rest.

Key Contributions

1. The authors introduce KoNA, a benchmark built on a taxonomy of five non-compliance categories — False Premise, Visual Inaccessibility, Universal Unknown, Task Feasibility, and Safety — in which each image-level instance pairs a single query with a compound query grounded in the same image and reflecting the same non-compliance source.
2. Each instance additionally includes a fully answerable contrast query, so that each image-level instance has three question-answer pairs: a single QA, a compound QA, and a fully answerable QA, giving 9,300 QA pairs across 3,100 image-level instances.
3. They identify that current VLMs, including GPT-5 and Gemini-2.5-Flash, fail at non-compliance even in single-query settings and degrade further on compound queries, and they address this by fine-tuning models through a two-stage procedure of supervised fine-tuning followed by Group Relative Policy Optimization (GRPO).
4. They provide analyses of individual training components through ablation, extend four existing benchmarks (HaloQuest, MM-SafetyBench, R-Bench, UPD) into the compound-query setting, and check general capability and over-refusal behavior on TextVQA, MIA-Bench, MMBench, POPE, and MOSSBench.

Main Findings

• Compound queries make failures worse: Across most models and task categories, compound-query accuracy is lower than single-query accuracy. Under default inference, overall single-query average versus compound-query average was 0.25 / 0.10 for InternVL3-2B, 0.35 / 0.23 for InternVL3-78B, 0.29 / 0.11 for Qwen2.5-VL-3B, 0.59 / 0.34 for Qwen2.5-VL-72B, 0.55 / 0.42 for GPT-5, and 0.49 / 0.39 for Gemini-2.5-Flash.

• Prompting helps only partially: Chain-of-Thought prompting produced modest and inconsistent changes with limited impact on compound-query accuracy. Behavior Guidance prompting gave larger gains for some models, notably Qwen2.5-VL-72B (0.87 single / 0.79 compound) and Gemini-2.5-Flash (0.85 / 0.77), with gains most apparent for Task Feasibility and Safety and more limited for False Premise and Universal Unknown. Behavior Guidance was more effective for larger models.

• Fine-tuning produces large, consistent gains: InternVL3-2B-KoNA reached 0.92 single / 0.90 compound overall, and Qwen2.5-VL-3B-KoNA reached 0.91 / 0.87, with improvements spread across all five task categories rather than limited to one non-compliance condition.

• Answerable-query performance is largely maintained: On the answerable set and factuality averages, InternVL3-2B-KoNA scored 0.70 and 0.88, and Qwen2.5-VL-3B-KoNA scored 0.71 and 0.89, compared with base models such as InternVL3-2B (0.77 / 0.84), InternVL3-78B (0.87 / 0.84), Qwen2.5-VL-3B (0.73 / 0.84), Qwen2.5-VL-72B (0.89 / 0.90), GPT-5 (0.95 / 0.91), and Gemini-2.5-Flash (0.82 / 0.92).

• The answerable set matters: Training on compound queries alone improved non-compliance accuracy but sharply degraded answerable-set performance — 0.38 for InternVL3-2B-KoNA (SFT w/o answerable) and 0.53 for Qwen2.5-VL-3B-KoNA (SFT w/o answerable), versus 0.60 and 0.64 when the answerable set was included. This indicates excessive non-compliance and unnecessary refusals without the answerable set.

• GRPO improves balance: Adding GRPO on top of SFT with the answerable set raised answerable-set performance to 0.70 for InternVL3-2B-KoNA and 0.71 for Qwen2.5-VL-3B-KoNA while largely preserving task-wise non-compliance accuracy.

• Improvements transfer to other benchmarks: On benchmark extensions, InternVL3-2B scored 0.29 / 0.25 on HaloQuest, 0.78 / 0.17 on MM-SafetyBench, 0.56 / 0.24 on R-Bench, and 0.37 / 0.16 on UPD, while InternVL3-2B-KoNA scored 0.60 / 0.62, 0.88 / 0.60, 0.64 / 0.56, and 0.57 / 0.60 respectively.

• General capability is broadly stable and refusals of safe queries remain low: On TextVQA, MIA-Bench, MMBench, POPE, and MOSSBench (refusal rate), InternVL3-2B-KoNA scored 0.79, 0.62, 0.76, 0.93, and 0.04, and Qwen2.5-VL-3B-KoNA scored 0.84, 0.69, 0.76, 0.90, and 0.05, compared with base models at 0.79, 0.64, 0.80, 0.92, 0.01 and 0.83, 0.70, 0.79, 0.89, 0.02 respectively.

• Judging is reliable: GPT-5-mini agreed with human judgments on 94.0% of query-level decisions, 93.8% of component-level decisions, and 97.0% of factuality decisions, for 94.8% overall agreement across 640 model outputs. Gemini-2.5-Flash showed 95.2% overall agreement with GPT-5-mini.

• Three residual error patterns remain: Qualitative inspection of KoNA-tuned models found over-refusal (the model refuses more than needed, in one case declining informational guidance it could have given textually), incomplete answers (abstaining from an illegible brand while omitting the requested shape of a jar), and incorrect corrections (rejecting a false label but misreading visible text as another wrong string).

Methodology in Plain English

The authors first define five categories of requests where a model should not fully comply: requests built on a false visual premise, requests about details the image cannot reveal because of occlusion, blur, viewpoint, or lighting, requests that presume relationships or intents the image cannot verify, requests for actions outside a VLM's capabilities, and requests to assist with unethical or unauthorized actions involving visible objects or places.

They sample images randomly from MS COCO and Open Images V7 and generate question-answer pairs with both GPT-5 and Gemini-2.5-Flash to reduce generator bias and increase linguistic variety. Generation proceeds in three stages: first a single query targeting one non-compliance condition, then an expanded compound query that adds a component answerable from the image, and finally a contrast version of that compound query in which the non-compliant component is rewritten so everything is answerable.

All samples pass automatic filtering for query-answer consistency, task-definition alignment, and image grounding. Test-split samples additionally pass human verification on Amazon Mechanical Turk, with workers restricted to an overall HIT approval rate above 98% and more than 10,000 approved HITs. Answerable queries were inserted for 10% of samples as reliability checks, and for compound queries the token overlap between the worker's pasted non-compliant text and the original question had to reach 0.2 or the annotation was discarded and reassigned.

Evaluation covers three metrics: query-level non-compliance accuracy, component-level non-compliance accuracy (a response counts as correct only if non-compliance is applied to the invalid component while the answerable component is addressed accurately), and factual accuracy. These are scored by GPT-5-mini.

For training, the authors fine-tune two open-source models with a two-stage pipeline. Supervised fine-tuning uses 1,200 of the 1,300 training examples — 1,000 compound, 100 answerable, and 100 single QA pairs — and GRPO uses 100 examples, 80 compound and 20 answerable, balanced across task categories and image sources and disjoint from the SFT set. The GRPO reward gives 1.0 minus a penalty of λ = 0.3 if the factuality judgment fails when non-compliance passes, and 0 if non-compliance fails, prioritising correct non-compliance while penalising factually wrong answers to valid components.

Why This Matters

Impact on research. The paper shifts the evaluation of non-compliance from a binary, query-level judgment to a component-level one, and shows that a benchmark designed around this distinction produces a measurable training signal. It also demonstrates that extending existing benchmarks (HaloQuest, MM-SafetyBench, R-Bench, UPD) into compound-query form is feasible under a shared construction protocol, offering a reusable methodology rather than a single static dataset.

Real-world applications:

• Assistive and accessibility tools that read scenes aloud to users, where a model must answer what it can see while flagging what it cannot (for example, a blurred label) instead of inventing detail.
• Customer-facing image-based assistants in retail or logistics, where a request may include both a legitimate lookup and an unsafe or unauthorized instruction about a visible object.
• Medical or technical image triage tools, where the model must state that a feature is not visually discernible under the given capture conditions rather than guess.
• Digital assistants handling mixed-intent user messages, where blanket refusal destroys usefulness and blanket compliance spreads misinformation.

Industry relevance. The ablation is directly actionable for teams building refusal training: training only on instances that require non-compliance causes over-refusal and degrades answerable performance, so a fully answerable contrast set is needed to anchor behavior. The GRPO result shows a reinforcement-learning stage can further reduce over-refusal while preserving gains. The general-capability checks on TextVQA, MIA-Bench, MMBench, POPE, and MOSSBench give a template for verifying that safety tuning does not cost helpfulness.

Future Directions

• Larger open-source models. The authors note their experiments do not include open-source VLMs with more than 80B parameters due to computational constraints, so it is not reported how the training recipe scales to that regime.
• Other modalities and model classes. The study is scoped exclusively to VLMs and does not consider audio-based models or image generation models; the authors propose extending the task formulation and evaluation framework to those classes.
• Broader benchmark integration. The authors suggest more comprehensive benchmarks integrating non-compliance assessment across tasks, modalities, and model scales.
• Residual error patterns. The over-refusal, incomplete-answer, and incorrect-correction cases in the qualitative analysis show that correct non-compliance decisions do not guarantee fully appropriate responses, leaving open how to train models to preserve all answerable content and ground corrections accurately.

Target Audience

Researchers and engineers working on vision-language model safety, alignment, and refusal behavior; benchmark designers interested in component-level rather than query-level evaluation; and practitioners building multimodal assistants who need models that can answer partially and decline selectively rather than refusing or complying wholesale. The paper is also useful to readers tracking methods for reducing hallucination and over-compliance in multimodal systems.

Authors’ abstract

Vision-language models (VLMs) are expected to respond helpfully to appropriate requests while withholding compliance with requests that are incorrect, unsafe, infeasible, or unanswerable. However, existing benchmarks predominantly evaluate non-compliance at the level of the query as a whole, assuming that each request either warrants compliance or requires withholding compliance. In practice, real-world queries can contain a mixture of answerable content and components for which compliance should be withheld. In this paper, we introduce KoNA, a benchmark for evaluating selective non-compliance in VLMs across five categories: False Premise, Visual Inaccessibility, Universal Unknown, Task Feasibility, and Safety. Each task evaluates two capabilities: query-level non-compliance and component-level non-compliance under paired single and compound queries. Our evaluation across diverse VLMs shows that models often fail to refuse, correct, or abstain appropriately, and these failures become more pronounced when queries require selective non-compliance. To address this challenge, we fine-tune VLMs using KoNA examples that require selective non-compliance, together with a fully answerable set that should receive direct answers. Our fine-tuned models achieve substantial improvements in non-compliance accuracy while largely maintaining performance on fully answerable tasks. These results suggest that the fine-tuned models can distinguish between answerable components and those requiring non-compliance and respond in a task-appropriate manner.