Study: harmful-meme failures in VLMs are a routing problem
Researchers find Gemma-3 and Qwen3.5 often represent harmful-meme evidence internally but fail to route it to their outputs.
The facts
- Researchers used sparse autoencoders, role-conditioned probes, causal interventions and recovery experiments on Gemma-3 and Qwen3.5 across six harmful-content benchmarks plus Spanish and Hindi-English code-mixed evaluations
- Sparse readouts beat native model prediction on all six primary binary tasks: Qwen averages 0.740 macro-F1 versus 0.432 native, and Gemma improves from 0.532 to 0.714
- Qwen's silent features are 24-63 times more probe-sensitive, while routed-feature patching on yes/no tasks is 16-140 times more output-sensitive
- Native-only threshold calibration recovers 69.8% of the raw native-to-probe gap on five matched tasks, but direct routing still adds 0.094 mean macro-F1 beyond that; a Gemma-3-12B case study on Facebook Hateful Memes reaches 0.756 versus 0.685 native macro-F1
A new arXiv paper argues that vision-language models often do notice harmful memes. They just fail to act on what they noticed. Researchers Girish A. Koushik, Diptesh Kanojia and Helen Treharne used sparse autoencoders, role-conditioned probes, causal interventions and recovery experiments on Gemma-3 and Qwen3.5. Their goal was to separate two failure modes: evidence genuinely missing from a model's internal representations, and evidence that is present but never reaches the output.
The gap between the two is large. Across six harmful-content benchmarks, a supervised readout built on the models' internal sparse features beat the models' own native predictions on every task. Qwen's sparse readout averaged 0.740 macro-F1 against 0.432 for native generation; Gemma's improved from 0.532 to 0.714. The authors are careful about what this does and does not show. It demonstrates the label is accessible to a probe, not that the model's own generation process applies that decision rule.
Causal interventions sharpen the picture. In Qwen, silently-held features were 24 to 63 times more sensitive to probing than to output. Patching routed features on literal yes/no tasks moved outputs 16 to 140 times more than probe scores alone would predict.
The researchers also tested whether simple threshold recalibration could close the gap without touching internals. On five tasks with matched probe scores, native-only calibration recovered 69.8% of the raw gap between native and probe performance. But direct routing interventions still added another 0.094 mean macro-F1 on top of that calibrated baseline. A case study on Gemma-3-12B, using the Facebook Hateful Memes dataset, found a distributed rank-32 image-prompt interaction pattern. Routed readouts there reached 0.756 macro-F1 versus 0.685 for native predictions. Robustness checks confirmed the signal is not just picking up OCR text. It depends on genuine paired visual evidence, and it holds beyond English, including in Spanish and Hindi-English code-mixed memes.
Joint training that combined gold labels, probe-KL supervision and pairwise LoRA adaptation improved performance on the dedicated hateful-memes task specifically. But a simpler gold-label-only adapter performed better when averaged across the full seven-task set. Fixes tuned to one benchmark do not necessarily generalise.
Why it matters
For teams deploying VLM-based content moderation, some false negatives are not fixable by better pretraining data or bigger models. The evidence is already there; it just never reaches the decision layer. That means lightweight interventions on existing checkpoints could close real gaps that retraining would not.
Primary source
arXiv cs.LG — arxiv.orgWritten from the primary source above by The Neural Net’s automated desk (claude-sonnet-5, theneuralnet/pipeline@1) without human review. How this works. Corrections: check the source first — if we got it wrong, the source link is the record.