Paper deep dive
Recompute or Reuse? Diagnosing and Mitigating Textual Shortcuts in VLM Self-Reflection
Wenxiao Fan, Jingling Fu, Fang Li, Luohang Liu, Yu He, Lichen Ma, Zhiyang Yu, Weishan Bi, Junshi Huang, Yan Li, Gu Simiu, Kan Li
Intelligence
Status: not_run | Model: - | Prompt: - | Confidence: 0%
Entities (0)
Relation Signals (0)
No relation signals yet.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Vision-language models (VLMs) are expected to revise their reasoning when visual evidence changes. Failures to do so are often attributed to insufficient visual attention or contextual inertia, leaving unclear what models reuse instead of recomputing from the current image. We show that evidence-bearing reasoning in a prior chain of thought (CoT) can form a textual shortcut that competes behaviorally with visual recomputation. Across 16 VLMs, a matched counterfactual analysis identifies evidence-bearing content as the most robust carrier of prior-CoT influence. Removing this evidence-bearing content shifts answer preference more than removing length-matched non-evidence context or the final-answer span, with prior control weakening progressively as more stale evidence is removed. Reordering this evidence also weakens prior control, showing that its organization modulates shortcut strength. Beyond the immediate answer, the shortcut can retain residual influence after answer correction: weakening current-image support shifts preference back toward the prior answer, while repeated prior answers and reused premises arise mainly when the shortcut remains active. To limit this influence, we introduce Fresh-State Attention Firewall (FSAF), a training-free intervention that isolates fresh computation from the prior CoT. Across five VLMs, FSAF raises visual update rate from 35.28% to 53.61% and reduces prior-answer rate from 39.22% to 3.67%. Reliable VLM self-reflection therefore requires more than looking again: fresh visual recomputation must be protected from stale textual reuse.
Tags
Links
- Source: https://arxiv.org/abs/2608.01930v1
- Canonical: https://arxiv.org/abs/2608.01930v1
Trouble viewing inline? Open PDF directly →
Full Text
124,083 characters extracted from source content.
Expand or collapse full text
Recompute or Reuse? Diagnosing and Mitigating Textual Shortcuts in VLM Self-Reflection Wenxiao Fan 1∗ , Jingling Fu 2 , Fang Li 2 , Luohang Liu 2 , Yu He 2 , Lichen Ma 2,3 , Zhiyang Yu 2 , Weishan Bi 2 , Junshi Huang 2 , Yan Li 2 , Gu Simiu 2 , Kan Li 1† 1 School of Computer Science, Beijing Institute of Technology 2 JD.COM 3 Institute of Artificial Intelligence and Robotics, Xi’an Jiaotong University wenxiaofan, likan@bit.edu.cn Abstract Vision-language models (VLMs) are expected to revise their reasoning when visual evidence changes. Failures to do so are often attributed to insufficient visual attention or con- textual inertia, leaving unclear what models reuse instead of recomputing from the current image. We show that evidence- bearing reasoning in a prior chain of thought (CoT) can form a textual shortcut that competes behaviorally with visual recom- putation. Across 16 VLMs, a matched counterfactual analysis identifies evidence-bearing content as the most robust car- rier of prior-CoT influence. Removing this evidence-bearing content shifts answer preference more than removing length- matched non-evidence context or the final-answer span, with prior control weakening progressively as more stale evidence is removed. Reordering this evidence also weakens prior con- trol, showing that its organization modulates shortcut strength. Beyond the immediate answer, the shortcut can retain residual influence after answer correction: weakening current-image support shifts preference back toward the prior answer, while repeated prior answers and reused premises arise mainly when the shortcut remains active. To limit this influence, we in- troduce Fresh-State Attention Firewall (FSAF), a training- free intervention that isolates fresh computation from the prior CoT. Across five VLMs, FSAF raises visual update rate from 35.28% to 53.61% and reduces prior-answer rate from 39.22% to 3.67%. Reliable VLM self-reflection therefore re- quires more than looking again: fresh visual recomputation must be protected from stale textual reuse. Introduction Vision-language models (VLMs) are increasingly expected to inspect their reasoning and revise answers when visual evidence changes, extending the broader paradigm of self- feedback and self-correction (Madaan et al. 2023; Kamoi et al. 2024). Reliable self-reflection requires invalidating ev- idence from the previous visual state and recomputing from the current image, not merely replacing one answer with an- other. VisualSwap shows that VLMs often fail to do so even when they claim to re-examine the image (Shi et al. 2026). Accordingly, recent methods encourage renewed visual at- tention (Jian et al. 2025; Yang et al. 2026). This diagnosis ∗ This work was conducted while Wenxiao Fan was an intern at JD.com. † Corresponding author. Figure 1: Textual shortcut during VLM self-reflection. Reusing this prior evidence path forms a textual shortcut that can steer the reflected answer without fresh recomputation from the current image. explains what is missing, but not what takes its place in the computation. We therefore ask: when a VLM fails to recom- pute, what does it reuse instead? We argue that prior reasoning can become an alternative computation path. A prior CoT does not merely record a final answer; it textualizes observations, numerical values, relations, and intermediate deductions grounded in the pre- vious image. After the image changes, this evidence-bearing path remains available in context. As illustrated in Fig. 1, the model can either reconstruct the relevant evidence from the current image or reuse a path already organized in text. We call the latter a textual shortcut. This reframes visual self-reflection as a competition between fresh visual recom- putation and stale textual reuse. We study this competition with a matched counterfac- tual framework (Fig. 2). Each question is paired with two structurally similar images that imply different answers. The model first produces a coherent, model-authored incorrect prior CoT R − from the counterfactual image I − , then re- arXiv:2608.01930v1 [cs.CV] 3 Aug 2026 flects under the current image I. Comparing direct and prior- conditioned paths measures the prior CoT’s influence, while controlled removals separate evidence-specific control from context reduction and final-answer anchoring. Experiments across 16 VLMs reveal two phenomena. First, evidence-bearing reasoning is the most robust cross- model carrier of prior control. Removing it shifts answer preference more than length-matched non-evidence removal or final-answer removal; the content-specific effect is pos- itive in all 16 models and grows as more stale evidence is removed. Disrupting evidence order also weakens prior con- trol, showing that organization modulates how readily the shortcut is reused during subsequent visual self-reflection. Second, producing the current answer does not imply that the shortcut has retired. Under matched support with- drawal, prior-conditioned recovered cases shift back toward the prior answer more strongly than history-free controls. Strong answer recurrence and premise reuse arise mainly when the stale shortcut remains active, whereas recovered cases primarily retain a weaker score-level pull. Answer cor- rection is therefore an insufficient certificate of evidence-state revision while prior reasoning remains accessible. This diagnosis motivates Fresh-State Attention Firewall (FSAF), a training-free intervention that prevents fresh com- putation from attending to the prior CoT. FSAF requires neither target-answer access nor an evidence parser. Across five Qwen VLMs, it raises visual update rate from 35.28% to 53.61% and reduces prior-answer rate from 39.22% to 3.67%. A prompt-only variant provides no reliable update gain, indicating that controlling access to stale reasoning, rather than merely asking the model to look again, drives the improvement observed across all models. Our contributions are threefold: • We identify evidence-bearing prior reasoning as a reusable textual shortcut that competes with current visual recomputation. Across 16 VLMs, its control is content- specific, graded with retained stale evidence, and modu- lated by evidence organization. • We show that answer correction does not guarantee short- cut retirement: recovered cases can retain residual prior dependence, while strong recurrence and premise reuse are concentrated where the stale shortcut remains active. • We introduce FSAF, a training-free intervention that iso- lates fresh computation from the prior CoT and improves visual updating across five Qwen VLMs. Related Work Visual Re-examination and Grounded Reflection. Con- trolled visual tests and perturbations reveal that a plausible answer or reflective statement does not guarantee sensitiv- ity to the current image (Shi et al. 2026; Sun et al. 2026; Guan et al. 2024). Longer multimodal reasoning can further weaken visual grounding (Xu et al. 2025). Accordingly, re- cent methods encourage visual re-attention through reflection training, attention-aware rewards, or explicit visual-token re- visiting (Jian et al. 2025; Chu et al. 2025; Yang et al. 2026; Cheng et al. 2025; Ji and Lu 2025; Tang, Yin, and Dur- rett 2026). Training-free alternatives counter language-prior dominance through visual contrastive decoding or targeted hidden-state intervention (Leng et al. 2024; Ji et al. 2026). Complementary work evaluates whether intermediate per- ception steps, rather than only final answers, remain visually faithful (Uppaal et al. 2026; Zhang et al. 2026). These stud- ies focus on restoring current-image use. VisualSwap studies a dynamic conflict after an image swap, whereas VI-Probe isolates a static perception–memory conflict; both motivate evaluating responsiveness to changed evidence rather than accuracy alone. We instead identify the prior textual state that competes with fresh visual recomputation. Self-Correction and Belief Revision. Self-correction meth- ods refine outputs through self-feedback, verbal reflection, or tool-grounded critique (Madaan et al. 2023; Shinn et al. 2023; Gou et al. 2024; Pan et al. 2024). However, intrinsic correction without reliable external feedback is often unsta- ble and can degrade reasoning (Huang et al. 2024; Kamoi et al. 2024; Zhang et al. 2025; He et al. 2025). Belief-revision studies further distinguish updating when premises change from maintaining a valid conclusion, while correction anal- yses expose a similar trade-off between critique and answer retention (Wilie et al. 2024; Zhang et al. 2024b; Yang et al. 2025). Together, these results suggest that successful re- vision depends on both detecting a conflict and replacing the premises that support the earlier conclusion. Our setting makes the changed evidence visual and asks whether answer correction actually retires the prior evidence path. Prior Reasoning as Persistent Context. CoT is not neces- sarily a faithful explanation of a model’s decision, although interventions on the trace show that it can still causally in- fluence the answer (Turpin et al. 2023; Lanham et al. 2023). Conversational history can also induce persistent generation tendencies (Simhi et al. 2026), while correction and trust vary with whether the same claim appears as the model’s own thought, a user message, or another role (Chen, Su, and Chiang 2026; Pan et al. 2026). Such role effects characterize source preference, but do not determine which parts of a prior reasoning trace carry task-specific control. We study a more specific multimodal form of persistence: evidence-bearing reasoning generated from an earlier image remains accessi- ble as a textual shortcut after the visual evidence changes. Controlled Evaluation of Prior-CoT Influence Overview. Prior work (Shi et al. 2026; Jian et al. 2025) shows that VLM self-reflection can fail to re-engage current visual evidence, but leaves open what controls the answer when fresh recomputation fails. We introduce a matched counterfactual framework to trace prior-CoT influence during and after self-reflection. As shown in Fig. 2, we hold the current task fixed and compare history-free direct inference with prior-conditioned reflection, both at the initial response and under matched continuations. This tests whether current visual evidence overrides a coherent but stale reasoning path. Problem Formulation. We pair a current taskT = (I,Q,y) with a matched counterfactualT − = (I − ,Q,y − ) that shares the question and answer space but changes the task-relevant visual evidence, so y − ̸= y. We instantiate this conflict with 800 human-checked VS-Bench pairs (Shi et al. 2026), drawn Figure 2: Controlled evaluation framework. A matched counterfactual image elicits a coherent, model-authored incorrect prior CoT (red). Under the current image, we compare direct inference (blue) with prior-conditioned reflection (purple), including their initial responses and evidence-preserving continuations (gray), using behavioral and answer-preference metrics. equally from MathVista-MINI, MathVerse-MINI, MathVi- sion, and MMMU-Pro (Lu et al. 2024; Zhang et al. 2024a; Wang et al. 2024; Yue et al. 2025). We run the evaluated modelM on I − : (R − , ˆy − ) =M(I − ,Q)(1) Eligibility requires ˆy − = y − and direct inference on I to return y. Thus, R − coherently supports y − under I − but conflicts with y under I, while both tasks remain solvable. Evaluation Protocol. For each eligible pair, the history-free direct inference path excludes the counterfactual prior: (R D , ˆy D ) =M(I,Q)(2) The prior-conditioned reflection path receives I, Q, R − , and a fixed reflection prefix P reflect : (R H , ˆy H ) =M(I,Q,R − ,P reflect )(3) Holding I and Q fixed, the contrast measures influence as- sociated with prior-conditioned history, including the fixed prefix, rather than base task difficulty. Evidence-Preserving Continuations. We also apply this contrast to two matched continuations (Fig. 2). The equiv- alent re-query task repeats Q to test whether the original answer path is reinstated; the derived computation task ap- plies a new operation to test whether a preceding premise transfers into a new computation. Both retain the current im- age and accumulated evidence, separating prior-associated persistence from generic follow-up instability. Behavioral Outcome Metrics. We assess free-generation behavior and teacher-forced answer preference. For free generation, Qwen3-VL-235B-A22B-Instruct independently judges whether each response M(S i ) matches the current ModelQ + R − , no I I + Q + R − VUR / PARVUR / PAR Qwen3-VL-8B (Thinking)0.6 / 53.322.6 / 7.0 Kimi-VL-A3B (Instruct)1.1 / 97.256.9 / 39.8 Gemma-4-31B (IT)1.1 / 92.788.0 / 4.4 Table 1: Prior CoT can control reflection without the cur- rent image. Results for all 16 VLMs appear in Tab. 10. target y i or counterfactual target y − i . Let J (r,a)∈0, 1 in- dicate a semantic match. Over N eligible pairs, we compute VUR(S) = 1 N N X i=1 J (M(S i ),y i ) PAR(S)= 1 N N X i=1 J M(S i ),y − i (4) Visual update rate (VUR) measures agreement with the current answer, whereas prior-answer rate (PAR) mea- sures agreement with the counterfactual answer. We distin- guish three interpretable outcomes: recovered (current only), active-stale (prior only), and Other (neither target). These la- bels describe observed outputs, not hidden states. The same judge establishes eligibility. Rates are reported in % and dif- ferences in percentage points (p). Answer-Preference Metrics. Free-generation outcomes can hide residual preference. We therefore score each candidate a = (a 1 ,...,a |a| ) by its mean token log-probability under teacher forcing: ℓ(a| S) = 1 |a| |a| X t=1 logp M (a t | S,a <t ).(5) Answer PreferenceFree-Generation Outcomes (p) ModelVariant∆m E−N ∆m E−C ∆m A−N ∆VUR E−C ∆PAR E−C Qwen2.5-VL-7B Instruct+2.019+1.948+0.064+46.12-67.05 Qwen3-VL-8B Instruct+2.699+2.617+0.237+42.27-72.95 Thinking +2.826+2.832+0.237+35.39-84.65 Qwen3-VL-32B Instruct+3.142+3.075+0.045+54.74-81.52 Thinking +2.995+3.004+0.159+54.47-82.11 Qwen3.5-4B–+1.548+1.612+0.057+45.49-70.82 Qwen3.5-9B–+1.345+1.372+0.033+47.11-65.29 Qwen3.5-27B–+1.600+1.535+0.050+58.80-72.66 Qwen3.6-27B–+1.635+1.591+0.053+53.53-71.00 InternVL2-8BInstruct+0.926+0.913+0.008+26.95-33.33 Gemma-4-12B Base+0.902+0.911+0.115+50.00-65.00 IT+2.221+2.067+0.025+26.64-28.38 Gemma-4-31B Base+1.017+0.996+0.061+49.26-66.18 IT+3.334+3.152-0.005+25.45-25.09 Kimi-VL-A3B Instruct+1.742+1.619-0.029+32.04-49.17 Thinking +3.145+2.913+0.078+51.91-66.12 Average+2.069+2.010+0.074+43.76-62.58 Table 2: Evidence-bearing content carries textual-shortcut control. N is the intact prior; E removes E − ; C is the length- matched non-evidence context control; and A removes A − . Margin columns report the indicated contrasts, while the two rightmost columns report E–C changes in VUR/PAR. Positive margin/VUR and negative PAR shifts favor the current answer. Following likelihood-based evaluations (Malladi et al. 2023; Ren et al. 2023; Li et al. 2024), we define m(S) = ℓ(y | S)− ℓ(y − | S).(6) Positive (negative) m(S) favors the current (prior) answer. This evaluated-model score is independent of the semantic judge and assumes no unique hidden representation. Evidence-Bearing Prior CoTs Form Shortcuts Having established the controlled prior-conditioned path, we now ask whether R − behaves as a reusable alternative to re- computing from the current imageI. Such a path should exert answer control on its own, depend specifically on evidence- bearing content rather than generic context or the final- answer span, and weaken when its evidential organization is disrupted. Prior CoT Is an Active Source of Answer Control. Before locating its carrier, we test whether R − can itself drive task- specific answers. We compare a prior-only condition (Q + R − , no I) with the matched image-present condition. Tab. 1 reports three representative model families. Without I, VUR remains 0.6%–3.5%, whereas PAR reaches 53.3%–97.2%, showing that R − can sustain prior-answer control. Restoring I shifts predictions toward the current answer, but recovery remains heterogeneous (VUR 22.6%–88.0%, PAR 4.4%– 53.9%). Thus, R − supplies a competing answer path, but not which content carries its control. Evidence-Bearing Content Carries Textual Shortcut Control. We therefore decomposeR − by textual role.E − ⊂ R − contains task-relevant observations, quantities, relations, 0255075100 Removed stale evidence E − (%) 0 25 50 75 100 Samples with m ( S α )>0 (%) Qwen2.5-VL-7B-I Qwen3-VL-8B-I Qwen3-VL-8B-T Qwen3-VL-32B-I Qwen3-VL-32B-T Qwen3.5-4B Qwen3.5-9B Qwen3.5-27B Qwen3.6-27B InternVL2-8B Kimi-VL-A3B-I Kimi-VL-A3B-T Gemma-4-12B Gemma-4-12B-it Gemma-4-31B Gemma-4-31B-it Figure 3: Evidence removal progressively weakens prior- answer control. The proportion of samples withm(S α ) > 0 increases monotonically at the model level in all 16 VLMs. and deductions supporting y − , as highlighted in Fig. 1; A − is the explicit final-answer span, with E − ∩A − =∅; the re- mainder is non-evidence context. We compare the intact prior (N), evidence removal (E), the length-matched non-evidence context control (C), and answer-span removal (A), holding the model, image, question and prompt fixed. For conditions X and Y , we report ∆m X−Y = m(S X )− m(S Y ), with analogous VUR and PAR contrasts. Tab. 2 shows that removing E − shifts the answer- preference margin by 2.069 relative to N and by 2.010 relative to C, with a positive E-minus-C effect in all 16/16 models; C Model (Variant) Answer Preference Free Generation (p) ∆m D−N ∆m D−NE ∆VUR / ∆PAR Qwen2.5-VL-7B (I) +0.645 +0.641+13.15 / -15.94 Qwen3-VL-8B (I) +0.930 +0.741+4.10 / -6.41 Qwen3-VL-8B (T) +0.771 +0.444+1.92 / -11.94 Qwen3-VL-32B (I) +1.141 +0.808+13.27 / -15.88 Qwen3-VL-32B (T) +0.478 +0.446+3.68 / -5.79 Qwen3.5-4B+0.104 +0.099+2.59 / -3.45 Qwen3.5-9B+0.065 +0.076+3.72 / -3.72 Qwen3.5-27B+0.045 +0.044+3.01 / -3.01 Qwen3.6-27B+0.045 +0.032+1.87 / -3.75 InternVL2-8B (I) +0.182 +0.199+4.08 / -22.45 Gemma-4-12B (B) -0.049 +0.013-7.50 / +10.00 Gemma-4-12B (IT) +0.878 +0.686+17.11 / -9.65 Gemma-4-31B (B) +0.138 -0.016+6.78 / -7.63 Gemma-4-31B (IT) +1.378 +0.673+17.88 / -12.41 Kimi-VL-A3B (I) -0.138 -0.155+0.00 / +0.00 Kimi-VL-A3B (T) +0.565 +0.343+7.73 / -8.84 Average+0.449 +0.317+5.84 / -7.55 Table 3: Disrupting evidence-chain organization weak- ens textual-shortcut control. D/N/NE denote disrupted, intact, and non-evidence-reordered priors; I/T/B/IT denote Instruct/Thinking/Base/instruction-tuned. The last column reports D–N ∆VUR/∆PAR (p). alone shifts the margin by only 0.059. Removing A − instead yields a smaller model-equal shift of 0.074, with heteroge- neous model-level effects. The dependence is also graded: as evidence removal increases from 0% to 100%, the proportion of samples with m(S α ) > 0 increases monotonically at the model level in all 16 models (Fig. 3). Free generation exposes the same content specificity. Rel- ative to C, removing E − raises VUR by 43.76 p and lowers PAR by 62.58 p, with positive VUR effects in all 16/16 models; relative to N, the changes are +45.22 and −64.22 p. However, the Other rate also rises from 8.35% to 26.50% (Tab. 13), so weakening stale control does not by itself guar- antee recovery. Across both metrics, evidence-bearing con- tent is the robust cross-model carrier of textual-shortcut con- trol, whereas answer-span effects remain model-specific. Evidence Organization Modulates Shortcut Reuse. Con- tent dependence alone does not distinguish isolated textual cues from an organized reasoning path. In the coherent R − , visual facts and deductions form an ordered route from premise to answer. We reverse the evidence-bearing sen- tences and compare the resulting prior (D) with the intact prior (N) and a matched non-evidence reorder (NE). Disrupting evidence order weakens prior control. As shown in Tab. 3, it shifts the answer-preference margin by +0.449 relative to the intact prior, with positive effects in 14/16 models. Relative to reordering only non-evidence sen- tences, the disruption produces an additional +0.317 mar- gin shift, again with positive effects in 14/16 models. This matched comparison isolates sensitivity to the tested evi- dence ordering from generic sentence reordering. The weak- Free-generation prior-answer rate (%) Evidence condition Direct inference (D) Prior-conditioned recovered (H) Qwen3.5-27B Full support (F )1.010.6 Withdrawn (W )4.084.8 Extra Old Lift = +71.2 p InternVL2-8B Full support (F )2.013.3 Withdrawn (W )5.149.0 Extra Old Lift = +32.7 p Aggregate: all 16 VLMs Full support (F )1.349.81 Withdrawn (W )7.1769.01 Extra Old Lift = +53.38 p Table 4: Matched support withdrawal reveals prior- history dependence after answer recovery. Combining rows F/W with columns D/H gives the four states in Eq. 7. ening also appears in free generation: VUR increases by 5.84 p and PAR decreases by 7.55 p. From Prior Influence to Textual Shortcut. Together, these interventions narrow broad prior-context influence to an evidence-bearing path whose control scales with retained content and is sensitive to the tested ordering. We call this organized path a textual shortcut: a reusable route to an answer without re-deriving the relevant premises from the current image. We next ask whether correcting the answer retires this shortcut. Correctness Is Not Shortcut Retirement A correct response does not distinguish shortcut retirement from temporary override by current evidence. We separate these accounts by stress-testing recovered responses under matched support withdrawal, then restoring intact evidence to inspect subsequent computation. Matched Support Withdrawal Reveals Residual Depen- dence. If recovery indicates shortcut retirement, weakening current support should destabilize H no more than D. We test only recovered pairs: the prior-conditioned path (H) has produced y despite R − , and its matched direct path (D) also produces y without R − . For each path, we preserve the im- age and question, retain full current support (F) or remove its evidence-bearing spans (W), then continue generation and measure PAR. Because withdrawal may destabilize either path, D controls for this generic effect. Let S F H ,S W H de- note the full and withdrawn history contexts, with S F D ,S W D defined analogously. We measure the additional resurgence associated with prior-conditioned history by Extra Old Lift = PAR(S W H )− PAR(S F H ) − PAR(S W D )− PAR(S F D ) (7) A positive Extra Old Lift means that support withdrawal increases prior-answer resurgence more on H than on the matched direct control. Qwen3.5-27B71.2 Qwen3.6-27B68.9 Qwen3-VL-32B-Thinking68.1 Qwen3-VL-8B-Instruct67.2 Qwen3.5-4B65.2 Qwen3-VL-32B-Instruct64.7 Qwen3.5-9B64.3 Gemma-4-31B58.6 Gemma-4-12B50.0 Qwen3-VL-8B-Thinking49.2 Kimi-VL-A3B-Instruct47.1 Qwen2.5-VL-7B39.3 InternVL2-8B32.7 Gemma-4-12B-IT20.8 Gemma-4-31B-IT14.3 Kimi-VL-A3B-Thinking14.3 QwenGemma KimiInternVL Figure 4: Extra Old Lift is positive across all 16 VLMs under matched support withdrawal. Tab. 4 and Fig. 4 show a consistent interaction. In aggre- gate, PAR rises from 9.81% to 69.01% on H but only from 1.34% to 7.17% on D, yielding an Extra Old Lift of 53.38 p. The model-equal effect is 49.74 p, and all 16/16 models are positive. Thus, a correct reflected answer can coexist with detectable prior-history dependence, consistent with current support overriding rather than eliminating the shortcut. This stress test does not imply spontaneous relapse under intact support, which we test next. Residual Prior Influence Under Intact Support. Support withdrawal reveals susceptibility, but not its expression un- der intact evidence. We therefore retain I and the complete trajectory, append either an equivalent re-query or a derived computation to D and H, and stratify H by its initial out- come: recovered or active-stale. This design distinguishes answer recurrence from premise transfer across observed states. Tab. 5 reports H-minus-D effects. Negative ∆m fa- vors the prior; negative ∆VUR denotes fewer current-target generations, and positive ∆PAR more prior-target genera- tions. For derived computation, VUR and PAR refer to the current- and prior-derived targets. Equivalent re-query. We ask whether the prior answer recurs when Q is posed again under the same image; prompt vari- ants appear in App. D.1. For recovered outcomes, history shifts the candidate margin priorward by −0.547, but free- generation changes are modest: VUR decreases by 2.14 p and PAR increases by 0.98 p. The score shift therefore rarely crosses the generation boundary. For active-stale outcomes, the shift is much larger (∆m = −3.896): VUR decreases by 39.88 p and PAR increases by 35.05 p. Equivalent re- query thus reveals weak answer recurrence after recovery but strong recurrence while the shortcut remains active. Derived computation. We ask whether a stale premise trans- fers when a new operation is applied to the task-relevant quantity; construction details appear in App. D.2. For recov- ered outcomes, ∆m = −0.391 and current-derived genera- tion falls by 18.99 p, but prior-derived generation changes by only +0.07 p. History therefore disrupts the new com- putation without reliably substituting the prior premise. For active-stale outcomes, ∆m =−3.756, current-derived gen- eration falls by 65.19 p, and prior-derived generation rises by 45.28 p, showing that an active shortcut can transfer a stale premise into a new operation. The larger recovered VUR loss is consistent with derived computation requiring Continuation Initial outcome ∆m H−D ∆VUR / ∆PAR Qwen3-VL-8B (Instruct) Equivalent Re-query Recovered (70.05%)-0.707 -1.72 / +0.34 Active stale (25.36%)-7.759 -47.14 / +37.62 Derived Computation Recovered (71.85%)-0.562 -11.11 / +0.19 Active stale (23.95%)-7.279 -82.46 / +66.67 Kimi-VL-A3B (Instruct) Equivalent Re-query Recovered (28.18%)-0.904 -8.82 / +2.94 Active stale (66.30%)-1.854 -57.08 / +47.92 Derived Computation Recovered (30.48%)-0.320 -10.42 / +1.04 Active stale (63.81%)-2.192 -56.72 / +49.75 Aggregate: all 16 VLMs Equivalent Re-query Recovered (59.05%)-0.547 -2.14 / +0.98 Active stale (34.09%)-3.896 -39.88 / +35.05 Derived Computation Recovered (60.82%)-0.391 -18.99 / +0.07 Active stale (32.30%)-3.756 -65.19 / +45.28 Table 5: Prior influence depends on initial outcome and continuation. H–D denotes prior-conditioned minus direct. Negative ∆m favors the prior; ∆VUR/∆PAR (p) refer to current/prior targets for re-query and current-/prior-derived targets for derived computation. Parentheses show outcome shares; bold marks aggregate effects. premise selection plus a new operation, whereas re-query can reuse the current-consistent answer. Residual Influence Depends on State and Continuation. Together, the results show that answer correction does not certify shortcut retirement. Withdrawal exposes prior-history dependence after recovery, whereas intact-support effects are state- and continuation-dependent: recovered outcomes show weak recurrence or computational disruption without reliable stale-premise substitution, while active-stale outcomes show strong recurrence and premise transfer. Robustness Beyond the Controlled Construction. Tab. 6 tests whether the effect depends on prompt wording, reflection-prefix semantics, or counterfactual construction. Prompt wording. To test whether prior-CoT influence is an ar- tifact of fixed wording, we evaluate ten semantically matched reflection-prompt paraphrases. The first block of Tab. 6 re- ports the mean and standard deviation across the ten variants listed in App. E, Tab. 16. Across the four Qwen3-VL variants, the standard deviations are at most 3.1 p for VUR and 3.0 p for PAR, showing that the observed behavior is consistent across prompt phrasings. Reflection prefix. To isolate reflection-specific prefix seman- tics, we replace the reflection prefix with a neutral continua- tion while holding all other inputs and settings fixed; entries are ordered as reflection / neutral. VUR and PAR change by Metric Qwen3-VL-8BQwen3-VL-32B Instruct Thinking Instruct Thinking Prompt paraphrases (mean± std.) VUR (%)↑ 49.1± 2.8 16.3± 2.1 58.7± 2.6 32.2± 3.1 PAR (%)↓ 28.0± 2.4 55.8± 3.0 20.1± 2.2 46.8± 2.7 Prefix control (reflection / neutral) VUR (%)↑ 49.5 / 48.8 15.8 / 16.4 59.0 / 58.3 31.8 / 32.5 PAR (%)↓ 27.6 / 28.2 56.2 / 55.4 19.6 / 20.1 47.2 / 46.6 Naturally occurring errors (reflection / prompt-only) Correction Rate (%) ↑ 34.7 / 52.9 20.8 / 46.1 42.3 / 61.4 25.6 / 52.0 Table 6: Robustness to prompt wording, prefix semantics, and prior construction. at most 0.8 p, indicating that the effect is not induced by the reflective wording itself. Naturally occurring errors. To test dependence on counter- factual prior construction, we collect initial errors produced during standard inference on the original benchmarks and report reflection / prompt-only correction rates. Retaining the erroneous CoT reduces correction rates by 18.2–26.4 p relative to the matched prompt-only condition, showing that prior-CoT influence also appears without an image swap. Fresh-State Attention Firewall Motivation. Previous results identify R − as a reusable evidence-bearing shortcut and show that a corrected answer does not certify that its influence has been removed. We therefore restrict the accessibility of R − , rather than merely prompting the model to inspectI again. Fresh-State Attention Firewall (FSAF) is a training-free, single-pass intervention with two coupled components: a new user–assistant bound- ary that starts a fresh re-examination, and an attention mask that isolates this fresh suffix from R − during both prefill and generation. It retains the original conversation and requires neither target-answer access nor an evidence parser. Fresh re-query boundary. Given the prior-conditioned con- text containing R − , FSAF appends a fixed user re-query U f that asks the model to answer Q again using only the current image I. Let R F denote the following assistant response and F = U f ∪ R F the fresh suffix. The new boundary sepa- rates this re-examination from the previous assistant trace, but does not by itself isolate their computations: during pre- fill, tokens in U f can still attend to R − and carry its content into generation through their cached states. Suffix attention firewall. The firewall closes both this indi- rect route and direct access from the new response. At every language layer, FSAF augments the standard Transformer at- tention logits (Vaswani et al. 2017) with the following mask: M FSAF qk = −∞, q ∈F and k ∈ R − 0,otherwise (8) A (ℓ) q,: = softmax L (ℓ) q,: + M causal q,: + M FSAF q,: (9) whereL (ℓ) denotes the matrix of unmasked attention logits at layer ℓ. Applying the mask while prefilling U f prevents its ModelVUR (%)↑PAR (%)↓m↑ Qwen2.5- VL-7B (I) 23.60→ 42.32 (+18.73) 41.20→ 9.74 (-31.46) -1.75→ +1.52 (+3.26) Qwen3- VL-8B (I) 49.52→ 65.48 (+15.95) 27.62→ 5.95 (-21.67) -5.64→ +3.59 (+9.23) Qwen3- VL-8B (T) 15.84→ 35.80 (+19.96) 56.17→ 1.03 (-55.14) -6.01→ +1.37 (+7.38) Qwen3- VL-32B (I) 59.01→ 74.22 (+15.22) 19.57→ 1.55 (-18.01) -7.52→ +4.76 (+12.27) Qwen3- VL-32B (T) 31.80→ 53.77 (+21.97) 47.21→ 1.64 (-45.57) -5.62→ +4.03 (+9.65) Average 35.28→ 53.61 (+18.33) 39.22→ 3.67 (-35.56) -5.49→ +2.97 (+8.46) Table 7: FSAF improves visual updating while suppress- ing prior-answer retention. Each cell reports Baseline → FSAF, with the paired change in parentheses. cached states from absorbing R − ; keeping it active during autoregressive generation prevents tokens in R F from read- ing R − directly. All other causal edges remain unchanged, so the fresh suffix can still access I, Q, system tokens, U f , and earlier tokens in R F . The softmax renormalizes over these remaining keys: FSAF removes the stale textual path without deleting the transcript or prescribing a fixed increase in visual attention. The exact re-query, execution procedure, implementation, and design ablations are provided in App. F. Evaluation. To exclude failures caused by task-solving diffi- culty, we evaluate FSAF on VS-Bench model–sample pairs from five Qwen models for which each model correctly an- swers both the current and counterfactual images under di- rect inference. For each pair, we compare ordinary prior- conditioned reflection with FSAF under identical settings. Results. In Tab. 7, FSAF improves all three readouts for every evaluated model. Pooled across model–sample pairs, it raises VUR from 35.28% to 53.61%, reduces PAR from 39.22% to 3.67%, and shifts the answer-preference margin from−5.49 to +2.97. Together, these results show that FSAF consistently reduces stale prior-CoT influence across all eval- uated Qwen models. FSAF suppresses stale-answer control without guaranteeing current-answer recovery on every pair. Conclusion This work asks what VLMs reuse when self-reflection fails to recompute after visual evidence changes. Across 16 VLMs, controlled removal and reordering identify evidence-bearing prior reasoning as the most robust carrier of textual-shortcut control. A correct answer, however, does not certify shortcut retirement. Residual dependence can remain after recovery, whereas strong answer recurrence and stale-premise transfer are concentrated when the shortcut remains active. Guided by this diagnosis, FSAF blocks fresh computation from at- tending to the prior CoT and improves visual updating across five Qwen VLMs. Reliable VLM self-reflection therefore re- quires more than looking again: fresh visual recomputation must be protected from stale textual reuse. References Chen, K.-Y.; Su, F.-Y.; and Chiang, J.-H. 2026. The Self- Correction Illusion: LLMs Correct Others but Not Them- selves. arXiv:2606.05976. Cheng, K.; YanTao, L.; Xu, F.; Zhang, J.; Zhou, H.; and Liu, Y. 2025. Vision-Language Models Can Self-Improve Rea- soning via Reflection. In Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), 8876–8892. Association for Com- putational Linguistics. Chu, X.; Chen, X.; Wang, G.; Tan, Z.; Huang, K.; Lv, W.; Mo, T.; and Li, W. 2025. Qwen Look Again: Guiding Vision- Language Reasoning Models to Re-attention Visual Informa- tion. arXiv:2505.23558. Gou, Z.; Shao, Z.; Gong, Y.; Shen, Y.; Yang, Y.; Duan, N.; and Chen, W. 2024. CRITIC: Large Language Models Can Self-Correct with Tool-Interactive Critiquing. In The Twelfth International Conference on Learning Representations. Guan, T.; Liu, F.; Wu, X.; Xian, R.; Li, Z.; Liu, X.; Wang, X.; Chen, L.; Huang, F.; Yacoob, Y.; Manocha, D.; and Zhou, T. 2024. HallusionBench: An Advanced Diagnostic Suite for Entangled Language Hallucination and Visual Illu- sion in Large Vision-Language Models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 14375–14385. He, J.; Lin, H.; Wang, Q.; Fung, Y. R.; and Ji, H. 2025. Self- Correction is More than Refinement: A Learning Framework for Visual and Language Reasoning Tasks. In Findings of the Association for Computational Linguistics: ACL 2025, 6405–6421. Association for Computational Linguistics. Huang, J.; Chen, X.; Mishra, S.; Zheng, H. S.; Yu, A. W.; Song, X.; and Zhou, D. 2024. Large Language Models Can- not Self-Correct Reasoning Yet. In The Twelfth International Conference on Learning Representations. OpenReview.net. Ji, J.; Liu, Q.; Yang, W.; and He, Z. 2026. CausalLens: Sensitivity-Guided Multi-Head Causal Intervention for Hal- lucination Mitigation in Large Vision-Language Models. In Proceedings of the IEEE/CVF Conference on Computer Vi- sion and Pattern Recognition, 4199–4209. Ji, J.; and Lu, X. 2025. ReFLAIR: Enhancing Multimodal Reasoning via Structured Reflection and Reward-Guided Learning. In Findings of the Association for Computational Linguistics: EMNLP 2025, 25401–25413. Association for Computational Linguistics. Jian, P.; Wu, J.; Sun, W.; Wang, C.; Ren, S.; and Zhang, J. 2025. Look Again, Think Slowly: Enhancing Visual Reflec- tion in Vision-Language Models. In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Pro- cessing, 9251–9270. Suzhou, China: Association for Com- putational Linguistics. Kamoi, R.; Zhang, Y.; Zhang, N.; Han, J.; and Zhang, R. 2024. When Can LLMs Actually Correct Their Own Mis- takes? A Critical Survey of Self-Correction of LLMs. Trans- actions of the Association for Computational Linguistics, 12: 1417–1440. Lanham, T.; Chen, A.; Radhakrishnan, A.; Steiner, B.; Deni- son, C.; Hernandez, D.; Li, D.; Durmus, E.; Hubinger, E.; Kernion, J.; Lukosiute, K.; Nguyen, K.; Cheng, N.; Joseph, N.; Schiefer, N.; Rausch, O.; Larson, R.; McCandlish, S.; Kundu, S.; Kadavath, S.; Yang, S.; Henighan, T.; Maxwell, T.; Telleen-Lawton, T.; Hume, T.; Hatfield-Dodds, Z.; Kaplan, J.; Brauner, J.; Bowman, S. R.; and Perez, E. 2023. Mea- suring Faithfulness in Chain-of-Thought Reasoning. CoRR, abs/2307.13702. Leng, S.; Zhang, H.; Chen, G.; Li, X.; Lu, S.; Miao, C.; and Bing, L. 2024. Mitigating Object Hallucinations in Large Vision-Language Models through Visual Contrastive De- coding. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 13872–13882. Li, W.; Li, L.; Xiang, T.; Liu, X.; Deng, W.; and Garcia, N. 2024. Can Multiple-choice Questions Really Be Useful in Detecting the Abilities of LLMs? In Proceedings of the 2024 Joint International Conference on Computational Lin- guistics, Language Resources and Evaluation, 2819–2834. Lu, P.; Bansal, H.; Xia, T.; Liu, J.; Li, C.; Hajishirzi, H.; Cheng, H.; Chang, K.-W.; Galley, M.; and Gao, J. 2024. MathVista: Evaluating Mathematical Reasoning of Founda- tion Models in Visual Contexts. In The Twelfth International Conference on Learning Representations. Madaan, A.; Tandon, N.; Gupta, P.; Hallinan, S.; Gao, L.; Wiegreffe, S.; Alon, U.; Dziri, N.; Prabhumoye, S.; Yang, Y.; Gupta, S.; Majumder, B. P.; Hermann, K.; Welleck, S.; Yazdanbakhsh, A.; and Clark, P. 2023. Self-Refine: Itera- tive Refinement with Self-Feedback. In Advances in Neural Information Processing Systems, volume 36. Malladi, S.; Gao, T.; Nichani, E.; Damian, A.; Lee, J. D.; Chen, D.; and Arora, S. 2023. Fine-Tuning Language Models with Just Forward Passes. In Advances in Neural Information Processing Systems, volume 36. Pan, L.; Saxon, M.; Xu, W.; Nathani, D.; Wang, X.; and Wang, W. Y. 2024. Automatically Correcting Large Lan- guage Models: Surveying the Landscape of Diverse Auto- mated Correction Strategies. Transactions of the Association for Computational Linguistics, 12: 484–506. Pan, X.; Fan, J.; Xiong, Z.; Hahami, E.; Overwiening, J.; and Xie, Z. 2026. User-Assistant Bias in LLMs. In Findings of the Association for Computational Linguistics: ACL 2026, 9218–9241. Association for Computational Linguistics. Ren, J.; Zhao, Y.; Vu, T.; Liu, P. J.; and Lakshminarayanan, B. 2023. Self-Evaluation Improves Selective Generation in Large Language Models. In Antorán, J.; Blaas, A.; Buchanan, K.; Feng, F.; Fortuin, V.; Ghalebikesabi, S.; Kriegler, A.; Mason, I.; Rohde, D.; Ruiz, F. J. R.; Uelwer, T.; Xie, Y.; and Yang, R., eds., Proceedings on "I Can’t Believe It’s Not Better: Failure Modes in the Age of Foundation Models" at NeurIPS 2023 Workshops, 16 December 2023, New Orleans, Louisiana, USA, volume 239 of Proceedings of Machine Learning Research, 49–64. PMLR. Shi, C.; Yang, C.; Wu, Y.; Jin, L.; Shui, B.; Berg-Kirkpatrick, T.; and Ma, X. 2026. Are VLMs Seeing or Just Saying? Uncovering the Illusion of Visual Re-examination. Accepted as an oral presentation at ICML 2026, arXiv:2605.15864. Shinn, N.; Cassano, F.; Gopinath, A.; Narasimhan, K.; and Yao, S. 2023. Reflexion: Language Agents with Verbal Re- inforcement Learning. In Advances in Neural Information Processing Systems, volume 36. Simhi, A.; Barez, F.; Tutek, M.; Belinkov, Y.; and Cohen, S. B. 2026. Old Habits Die Hard: How Conversational His- tory Geometrically Traps LLMs. arXiv:2603.03308. Sun, X.; Li, M.; Yuan, K.; Sun, M. W.; Endo, M.; Wu, S.; Li, C.; Zhang, Y.; Wang, Z.; and Yeung-Levy, S. 2026. Do VLMs Perceive or Recall? Probing Visual Perception vs. Memory with Classic Visual Illusions. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 25861–25870. Tang, L.; Yin, F.; and Durrett, G. 2026. Visually Grounded Self-Reflection for Vision-Language Models via Reinforce- ment Learning. arXiv:2607.02490. Turpin, M.; Michael, J.; Perez, E.; and Bowman, S. R. 2023. Language Models Don’t Always Say What They Think: Un- faithful Explanations in Chain-of-Thought Prompting. In Advances in Neural Information Processing Systems, vol- ume 36. Uppaal, R.; Htut, P. M.; Bai, M.; Pappas, N.; Qi, Z.; and Swamy, S. 2026. Journey Before Destination: On the im- portance of Visual Faithfulness in Slow Thinking. In Pro- ceedings of the 19th Conference of the European Chapter of the Association for Computational Linguistics (Volume 1: Long Papers), 4147–4168. Association for Computational Linguistics. Vaswani, A.; Shazeer, N.; Parmar, N.; Uszkoreit, J.; Jones, L.; Gomez, A. N.; Kaiser, L.; and Polosukhin, I. 2017. Atten- tion is All you Need. In Guyon, I.; von Luxburg, U.; Bengio, S.; Wallach, H. M.; Fergus, R.; Vishwanathan, S. V. N.; and Garnett, R., eds., Advances in Neural Information Process- ing Systems 30: Annual Conference on Neural Information Processing Systems 2017, December 4-9, 2017, Long Beach, CA, USA, 5998–6008. Wang, K.; Pan, J.; Shi, W.; Lu, Z.; Ren, H.; Zhou, A.; Zhan, M.; and Li, H. 2024. Measuring Multimodal Mathemati- cal Reasoning with MATH-Vision Dataset. In Advances in Neural Information Processing Systems, volume 37, 95095– 95169. Wilie, B.; Cahyawijaya, S.; Ishii, E.; He, J.; and Fung, P. 2024. Belief Revision: The Adaptability of Large Language Mod- els Reasoning. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, 10480– 10496. Miami, Florida, USA: Association for Computational Linguistics. Xu, Z.; Liu, C.; Wei, Q.; Wu, J.; Zou, J. Y.; Wang, X.; Zhou, Y.; and Liu, S. 2025. More Thinking, Less Seeing? Assessing Amplified Hallucination in Multimodal Reasoning Models. In Advances in Neural Information Processing Systems, vol- ume 38. Yang, S.; Niu, Y.; Liu, Y.; Ye, Y.; Lin, B.; and Yuan, L. 2026. Look-Back: Implicit Visual Re-focusing in MLLM Reasoning. Proceedings of the AAAI Conference on Artificial Intelligence, 40(14): 11694–11702. Yang, Z.; Zhang, Y.; Wang, Y.; Xu, Z.; Lin, J.; and Sui, Z. 2025. Confidence v.s. Critique: A Decomposition of Self- Correction Capability for LLMs. In Proceedings of the 63rd Annual Meeting of the Association for Computational Lin- guistics (Volume 1: Long Papers), 3998–4014. Association for Computational Linguistics. Yue, X.; Zheng, T.; Ni, Y.; Wang, Y.; Zhang, K.; Tong, S.; Sun, Y.; Yu, B.; Zhang, G.; Sun, H.; Su, Y.; Chen, W.; and Neubig, G. 2025. MMMU-Pro: A More Robust Multi- discipline Multimodal Understanding Benchmark. In Pro- ceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), 15134– 15186. Association for Computational Linguistics. Zhang, Q.; Wang, D.; Qian, H.; Li, Y.; Zhang, T.; Huang, M.; Xu, K.; Li, H.; Yan, L.; and Qiu, H. 2025. Understanding the Dark Side of LLMs’ Intrinsic Self-Correction. In Che, W.; Nabende, J.; Shutova, E.; and Pilehvar, M. T., eds., Pro- ceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), 27066– 27101. Vienna, Austria: Association for Computational Lin- guistics. ISBN 979-8-89176-251-0. Zhang, R.; Jiang, D.; Zhang, Y.; Lin, H.; Guo, Z.; Qiu, P.; Zhou, A.; Lu, P.; Chang, K.; Qiao, Y.; Gao, P.; and Li, H. 2024a. MATHVERSE: Does Your Multi-modal LLM Truly See the Diagrams in Visual Math Problems? In Leonardis, A.; Ricci, E.; Roth, S.; Russakovsky, O.; Sattler, T.; and Varol, G., eds., Computer Vision - ECCV 2024 - 18th European Conference, Milan, Italy, September 29-October 4, 2024, Proceedings, Part VIII, volume 15066 of Lecture Notes in Computer Science, 169–186. Springer. Zhang, W.; Shen, Y.; Wu, L.; Peng, Q.; Wang, J.; Zhuang, Y.; and Lu, W. 2024b. Self-Contrast: Better Reflection Through Inconsistent Solving Perspectives. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), 3602–3622. Associa- tion for Computational Linguistics. Zhang, Y.; Ma, O.; Liu, T.; Zhou, G.; and Chen, Y. 2026. See It, Say It, Sorted: An Iterative Training-Free Framework for Visually-Grounded Multimodal Reasoning in LVLMs. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 11933–11942. Appendix Overview. • Appendix A documents the evaluated checkpoints, infer- ence backends, semantic judge, answer-preference score, paired estimands, and a compact claim–evidence index. • Appendix B specifies the prompt and conversation con- struction for direct inference, prior-conditioned reflection, textual interventions, continuation probes, and FSAF. • Appendix C follows the diagnosis in the main paper: it reports the full prior-CoT influence results, analyzes model-variant and scale effects, specifies the operational evidence-span decomposition, tests sensitivity to prior- CoT length, and provides additional content analyses and a cross-table protocol map. • Appendix D details the evidence-preserving continuation protocols and the neutral-history control used to distin- guish stale evidence reuse from generic extra-turn effects. • Appendix E tests robustness to reflection-prompt word- ing, prefix semantics, and naturally occurring model er- rors. • Appendix F gives the exact FSAF execution proce- dure, implementation scope, design ablations, state- conditioned transitions, and evaluation audit. • Appendix G summarizes the construction, composition, and quality controls of VS-Bench, and clarifies how its image-pair notation maps to our controlled framework. • Appendix H reports cohort construction, per-model eli- gible counts, and coverage audits. • Appendix I provides representative case studies for the diagnostic interventions and evidence-preserving contin- uations. AI Use Disclosure. Generative AI tools were used to assist with language editing, code debugging, and figure drafting. The authors reviewed and verified all AI-assisted outputs and take full responsibility for the content of this manuscript. A Implementation and Evaluation Setup A.1 Evaluated Checkpoints Tab. 8 gives the exact public checkpoint identifiers used in the 16-model diagnosis. The Type column describes the eval- uated checkpoint or decoding mode, rather than inferring a training recipe from the model name. Qwen3.5 and Qwen3.6 provide unified post-trained checkpoints; we evaluated their non-thinking mode. For Gemma 4, the suffix-it denotes the instruction-tuned checkpoint, while the checkpoint without that suffix is the base variant. A.2 Inference Backends and Hardware We use vLLM for standard Qwen2.5-VL/Qwen3-VL infer- ence and Transformers for the remaining model families and probes that require direct control of rendered prefixes or candidate logits. The semantic judge is served through an OpenAI-compatible vLLM endpoint, while FSAF uses Transformers eager-attention hooks (Appendix F.2). Model inference and probing were run on a server with two Intel Xeon 6767P CPUs, 800 GiB of system memory, and eight NVIDIA B200 GPUs (180 GB each), under CentOS Linux 7 with Linux kernel 6.6.0. The 235B semantic judge was served on four B200 GPUs with tensor parallelism of 4. The software environment used CUDA 12.8, PyTorch 2.10.0, vLLM 0.19.0, and model-family-specific Transformers envi- ronments ranging from version 4.49.0 to 5.13.0. Within every paired comparison, the model, image preprocessing, decod- ing configuration, and maximum generation length are held fixed; only the specified intervention changes. A.3 Generation and Chat-Template Controls Each checkpoint is rendered with its own processor and na- tive chat template. Images occupy the same conversation position in matched conditions, and the paired images have identical resolution (Appendix G). We do not rewrite model- specific special tokens into a shared literal string. Instead, Appendix B uses abstract role markers to expose the common conversation structure. For stochastic decoding runs, all con- ditions within a matched model–sample comparison share the same decoding hyperparameters. FSAF and its ordinary- reflection baseline use a maximum of 256 generated tokens; the final semantic judge uses temperature zero and a strict JSON schema. A.4 Recorded Provenance and Determinism Every result row is keyed by model, source dataset, and sam- ple ID. Intervention outputs additionally record the condition name and the targets y and y − . Coverage audits check ex- pected task IDs, duplicates, missing records, finite scores, and complete matched condition sets. When a manipulation is randomized, the seed is derived from the sample identity and is shared by the relevant matched conditions. Aggre- gate rates are always recomputed from the retained row-level records rather than copied from console logs. A.5 Semantic-Judge Protocol We use Qwen3-VL-235B-A22B-Instruct as a text- only semantic judge. The judge receives the dataset name, target answer or target pair, and the evaluated generation; it does not receive an image. Its instruction accepts semanti- cally equivalent strings, equivalent numeric forms (including percentages and decimals when unambiguous), and multiple- choice letters that identify the same option. For a two- target task, it independently returns Booleanmatches_new and matches_old; for a single-target task, it returns correct. Requests use batch size one, temperature zero, and a strict JSON schema that forbids rationales, extracted text, task IDs, or extra fields. Invalid responses are retried and are not silently converted to negative labels. Because the two decisions are independent, VUR and PAR are not forced to sum to one. Rule-based matching is retained only for inexpensive design screens explicitly identified as such. A.6 Rare Dual-Match Outcomes Independent target judgments allow a response to match both y and y − , for example when it mentions or contrasts both candidates. We label this outcome Both. It contributes to CheckpointTypeHugging Face repository Qwen/Qwen2.5-VL-7B-InstructInstructhttps://huggingface.co/Qwen/Qwen2.5-VL-7B-Instruct Qwen/Qwen3-VL-8B-InstructInstructhttps://huggingface.co/Qwen/Qwen3-VL-8B-Instruct Qwen/Qwen3-VL-8B-ThinkingThinkinghttps://huggingface.co/Qwen/Qwen3-VL-8B-Thinking Qwen/Qwen3-VL-32B-InstructInstructhttps://huggingface.co/Qwen/Qwen3-VL-32B-Instruct Qwen/Qwen3-VL-32B-ThinkingThinkinghttps://huggingface.co/Qwen/Qwen3-VL-32B-Thinking Qwen/Qwen3.5-4BUnified (NT)https://huggingface.co/Qwen/Qwen3.5-4B Qwen/Qwen3.5-9BUnified (NT)https://huggingface.co/Qwen/Qwen3.5-9B Qwen/Qwen3.5-27BUnified (NT)https://huggingface.co/Qwen/Qwen3.5-27B Qwen/Qwen3.6-27BUnified (NT)https://huggingface.co/Qwen/Qwen3.6-27B OpenGVLab/InternVL2-8BInstructhttps://huggingface.co/OpenGVLab/InternVL2-8B google/gemma-4-12BBasehttps://huggingface.co/google/gemma-4-12B google/gemma-4-12B-itInstructhttps://huggingface.co/google/gemma-4-12B-it google/gemma-4-31BBasehttps://huggingface.co/google/gemma-4-31B google/gemma-4-31B-itInstructhttps://huggingface.co/google/gemma-4-31B-it moonshotai/Kimi-VL-A3B-InstructInstructhttps://huggingface.co/moonshotai/Kimi-VL-A3B-Instruct moonshotai/Kimi-VL-A3B-Thinking-2506Thinkinghttps://huggingface.co/moonshotai/Kimi-VL-A3B-Thinking-2506 Table 8: Exact model checkpoints used in the 16-model diagnosis. Each URL resolves to the corresponding public Hugging Face repository. NT denotes non-thinking decoding for a unified post-trained checkpoint. both VUR and PAR and is therefore retained in all aggregate statistics. However, it is rare in the reported free-generation analyses: its model-equal share is 0.60%–1.47% across the evidence-content conditions in Tab. 13, and only 10/1,800 ordinary-reflection outputs (0.56%) fall into this category in the FSAF evaluation (Tab. 18). We therefore do not interpret Both as a separate outcome state in the main text, while retaining its complete counts in the appendix. A.7 Answer-Preference Scoring Details Answer preference is measured by teacher forcing the canon- ical current and prior candidates under the same rendered prefix. When both targets have valid multiple-choice letters, both candidates are represented by letters; otherwise both use answer values. Thus, a pair never compares an option letter on one side with a long answer string on the other. We score a candidate sequence by the mean log-probability of its candidate tokens, s(a| c) = 1 |a| |a| X t=1 logp(a t | c,a <t ), and report m(c) = s(y | c)− s(y − | c). Mean rather than summed log-probability reduces the mechanical length ad- vantage of shorter candidates. The two-way normalized read- out ep(y | c) = exps(y | c) exps(y | c) + exps(y − | c) is a relative preference between the two fixed candidates, not a calibrated probability over all possible answers. For the FSAF evaluation, every condition appends the candidate-neutral scaffold Final answer:. If an earlier thinking trace leaves an open <think> block, it is closed before appending the shared scaffold. Candidate strings, to- kenization rules, and scoring positions are identical across ordinary reflection, re-query-only, and FSAF. A.8 Why Paired Effects Are Primary Our primary estimand is the within-model, within-sample change between matched conditions. Models differ sharply in baseline calibration, output style, and eligible-cohort com- position, so a raw average across models can mix the inter- vention effect with between-model differences. Pairing re- moves each model–sample baseline and asks the narrower question required by the experiments: what changes when only the history, evidence span, continuation, or attention access changes? Cross-model averages are therefore descrip- tive summaries of the paired effects, not substitutes for them. A.9 Claim–Evidence Index Tab. 9 provides a compact lookup from each scientific ques- tion to its matched comparison, readout, and detailed proto- col. B Prompt and Conversation Construction The notation below follows the abstract, model-independent rendering used to compare different chat templates. [User Start], [User End], [Response Start], and [Response End] denote role boundaries inserted by each model’s native processor; they are not literal strings passed to every checkpoint. I − and I are the prior and cur- rent images, R − is the prior response, R is the reflected response, and Q ′ is a controlled continuation question. B.1 Direct Inference (1) Prior-image direct inference. The model receives I − and Q, producing R − in one assistant turn. • Input: [User Start] I − Q [User End] • Output: [Response Start] R − [Response End] QuestionPrimary comparisonPrimary readoutDetailed location Does prior CoT affect reflection? Prior-conditioned vs. direct/current con- trols VUR, PAR, answer-preference marginAppendices C.1 and B.3 Which prior content carries the effect? Intact vs. evidence-deleted, answer-only, and matched controls Paired change in semantic outcomes and mar- gin Appendix C.3 and Tab. 3 Does stale control persist after re- covery? History-conditioned vs. direct-new and neutral-history continuations Current/prior preference and semantic branch outcomes Appendices D–D.3 Can current support suppress a stale state? Matched support present vs. withdrawn Prior-answer resurgence within the recovered cohort Tab. 4 and Appendix B Does stale visual content trans- fer? History-conditionedvs.direct- new/neutral-history derived questions Derived-answer preference and semantic ac- curacy Appendix D.2 Does FSAF block prior-CoT ac- cess and improve immediate up- dating? FSAF vs. ordinary reflection on identical model–sample pairs Paired immediate VUR, PAR, and answer preference Appendices F.2–F.5 Which rows enter each analysis? Directly solvable pair → experiment- specific filters Eligible and complete-pair countsAppendix H Table 9: Index from the paper’s main claims to protocols, metrics, and appendix details. (2) Current-image direct inference. The same construction replacesI − withI, yielding the direct-current responseR dir . • Input: [User Start] I Q [User End] • Output: [Response Start] R dir [Response End] These two runs define eligibility; they are not counted as reflection successes. B.2 Prior-Conditioned Reflection (3) Standard reflection. We retain the current image and question, prefill the assistant with the complete prior response followed by the fixed cue Wait, let me check the figure again to make sure I haven’t made a mistake. and ask the model to continue the same assistant turn. • Input: [User Start] I Q [User End] [Response Start] R − [Reflection Cue] • Output: [Response Start] R − [Reflection Cue] R [Response End] The prior text is therefore part of the cached assistant prefix, while the image changes from I − to I. B.3 Prior-Carrier and Evidence-Content Interventions (4) Carrier ablations. All conditions retain I, Q, and the same reflection cue. Only the assistant prefix C changes: full prior: C= R − ; reasoning only: C=R − without its final answer; answer only: My previous answer was y − ; answer masked: the reasoning plus My initial answer is [omitted]. The random-answer control replaces y − with a non-target answer, and the new-turn control preserves R − as a com- pleted historical assistant message rather than a same-turn prefill. Their shared schema is: [User Start] I Q [User End] [Response Start] C [Reflection Cue] R [Response End]. (5) Evidence-content interventions. Sentence-level inter- ventions replace C with an intact, deleted, masked, substi- tuted, or organization-controlled version of the prior reason- ing. The image, question, cue, targets, decoding settings, and sample identity remain fixed. Evidence-deletion controls are matched either by removed-sentence count or approximate removed-token length; generic-memory controls preserve a prior-context carrier without retaining answer-relevant vi- sual content. Exact evidence-span rules are given in Ap- pendix C.3. B.4 Matched Support-Withdrawal Test (6) Current support present vs. withdrawn. Within sam- ples whose ordinary reflection reaches the current answer, the support-present condition retains the complete current- evidence state. The matched withdrawal condition deletes all current evidence-bearing spans while retaining the model, sample, current image, question, stale history, answer scaf- fold, and target candidates. We apply two complementary readouts to every matched context: teacher-forced candidate scoring measures answer preference, while a separate con- tinuation is evaluated by the semantic judge to obtain the free-generation PAR reported in Tab. 4. The D/H paths and F/W conditions retain the same model–sample identity, so the generated outcomes are matched rather than unrelated samples. The recovered label is assigned from the source ordinary-reflection output before the F/W contexts are recon- structed. Tab. 4 then evaluates newly generated continuations from those contexts; hence the full-support H continuation can match y − even though its source state previously pro- duced y. Because VUR and PAR are judged independently, PAR also includes any continuation matching both targets. This construction isolates whether the recovered state re- mains stable when its current textual support is removed; it does not remove the current image. B.5 Evidence-Preserving Continuations (7) Future re-query. After constructing a source state, we close that turn and append one of two user questions: Equivalent re-query: “For the current image, an- swer the same question again. Use the current image as the visual evidence.” Concise re-query: “For the current image, give only the final answer to the question below.” The original question Q follows either instruction. The re- sulting conversation is: [Source-State Conversation] [User Start] I Q ′ [User End] [Response Start] R ′ [Response End]. For derived questions, Q ′ requests a new computation from an answer-critical visual premise rather than simply asking for y again. The source-state construction and target deriva- tion are held fixed across direct-new, history-conditioned, and neutral-history conditions. B.6 Neutral-History Control (8) Content-neutral history. The control preserves a multi- turn history but removes its concrete visual premises. Its first user message states: Earlier there was a related context, but it should not provide visual evidence for the current image. The historical assistant content is replaced by the repeated neutral sentence I considered an earlier context, but its visual details are not evidence for the current image. up to the capped number of prior sentences. The conversa- tion then contains the direct-current I,Q exchange before Q ′ is appended. This retains extra roles and history structure without retaining the specific stale evidence-bearing content. B.7 FSAF Conversation (9) Fresh-state re-query with attention firewall. Ordinary reflection first produces the stale assistant prefix. FSAF then creates a fresh user turn: Answer the same question using only the current image. Be concise and end with the final-answer format requested by the question. and a fresh assistant suffix. During both prefill and generation of this suffix, the firewall blocks attention from fresh-suffix queries to the identified stale assistant span: [Stale-State Conversation] [User Start] [FSAF Re-query] [User End] [Response Start] R FSAF [Response End]. The current image remains available through the current con- versation; only access to the stale textual span is masked. Ap- pendix F.2 specifies the layerwise mask and verified model scope. C Diagnosing Textual Shortcuts This section complements the main-text diagnosis. We first report the complete cross-model prior-influence control, an- alyze model-variant and scale effects, then document how evidence-bearing spans are identified and intervened on, and finally provide additional free-generation results and a cross- table protocol map. C.1 Full Prior-CoT Influence Across 16 VLMs Tab. 10 reports the complete semantic-judge results for the control summarized in Tab. 1. Prior-only PAR is the rate of generating the prior answer when Q and R − are retained but the current image is withheld. Image-present VUR is the rate of generating the current answer after restoring I un- der the matched new-turn setting. In both columns, R − is preserved as a completed historical assistant response and a fresh user turn re-asks Q; the two columns differ only in whether that turn includes I. This new-turn control is dis- tinct from the same-assistant-turn prefix used for standard reflection earlier in Appendix B and for the N/C/E evidence- content interventions in Tab. 13. Their absolute VUR val- ues therefore estimate different conversational carriers and are not expected to coincide. This distinction also accounts for the apparent discrepancy for Qwen3-VL-8B-Instruct: the standard-reflection VUR in Tab. 6 is 49.1% averaged over prompt paraphrases and 49.5% with the fixed reflection pre- fix, whereas the image-present new-turn VUR here is 44.9%. In the former, the model continues an unfinished assistant prefix under the current-image context; in the latter, R − is presented as a completed historical answer before Q is asked again. The direction of this difference is consistent with the Qwen2.5-VL-7B rule-based FSAF design screen in Appendix F.3: a fresh re-query boundary alone does not iso- late new computation from R − , because the re-query tokens can still absorb stale information during prefill and carry it into generation through their cached states. In that auxiliary screen, re-query only provides no reliable VUR gain while increasing PAR, whereas full FSAF couples the fresh bound- ary with a prefill- and generation-time attention firewall. The lower new-turn VUR is therefore compatible with role sepa- ration alone failing to retire the textual shortcut, rather than evidence of a repeated-measurement mismatch. This inter- pretation is descriptive, not a causal estimate, because the robustness and full-control summaries also use their respec- tive experiment-specific eligibility cohorts. Prior-only PAR is high for all 16 models, whereas image-present VUR varies substantially, showing that the prior CoT provides strong an- swer control even though current visual evidence remains behaviorally effective. C.2 Thinking versus Instruct Models and Scale VisualSwap reports that Thinking variants suffer larger base– probe accuracy degradation than their Instruct counterparts ModelVariant Prior-only PAR (%) Image-present VUR (%) Qwen2.5-VL-7B Instruct74.848.4 Qwen3-VL-8B Instruct70.844.9 Thinking53.322.6 Qwen3-VL-32B Instruct82.960.0 Thinking56.631.8 Qwen3.5-4B–98.782.0 Qwen3.5-9B–99.286.8 Qwen3.5-27B–97.888.0 Qwen3.6-27B–97.885.5 InternVL2-8BInstruct87.938.3 Gemma-4-12B Base95.075.0 IT91.379.9 Gemma-4-31B Base97.177.9 IT92.788.0 Kimi-VL-A3B Instruct97.256.9 Thinking96.752.5 Table 10: Prior-CoT influence and visual availability across all 16 VLMs. Rates are percentages over the eligi- ble cohort for each model and are evaluated by the semantic judge. and that increasing model size does not mitigate this degrada- tion (Shi et al. 2026). We revisit both observations using our intervention-based readouts. The comparisons below are de- scriptive: variants and scales use their own eligible cohorts, and our VUR/PAR readouts are not numerically equivalent to VisualSwap’s base–probe accuracy gap. ModelVariant Prior-only PAR (%) Image-present VUR (%)∆m E−C ∆VUR / ∆PAR E–C (p) Qwen3-VL-8B Instruct70.844.9 +2.617 +42.27/− 72.95 Thinking53.322.6 +2.832 +35.39/− 84.65 Qwen3-VL-32B Instruct82.960.0 +3.075 +54.74/− 81.52 Thinking56.631.8 +3.004 +54.47/− 82.11 Kimi-VL-A3B Instruct97.256.9 +1.619 +32.04/− 49.17 Thinking96.752.5 +2.913 +51.91/− 66.12 Table 11: Matched-family comparison of Instruct and Thinking variants. Prior-only PAR and image-present VUR are absolute semantic-judge rates. E–C removes evidence- bearing spans rather than length-matched non-evidence con- text; positive margin/VUR and negative PAR changes indi- cate weaker prior-answer control. Thinking versus Instruct. Thinking yields lower image- present VUR in all three same-family, same-checkpoint com- parisons: by 22.3 p at Qwen3-VL-8B, 28.2 p at Qwen3- VL-32B, and 4.4 p for Kimi-VL-A3B. The pair-equal aver- age is 35.6% for Thinking versus 53.9% for Instruct, agreeing directionally with VisualSwap’s finding that Thinking vari- ants are more vulnerable during continuous re-examination. However, Thinking does not exhibit higher prior-only PAR: it is lower in all three pairs. The mode gap is therefore more specific than a universally stronger standalone preference for the prior answer; it appears when the current image must compete with the retained reasoning trajectory. The intervention results refine this comparison. Evidence removal shiftsm toward the current answer for every variant, with pair-equal ∆m E−C of 2.916 for Thinking and 2.437 for Instruct. It also produces a larger PAR reduction for Thinking in all three pairs, whereas the corresponding VUR gain is mixed across families. Thus, evidence-bearing prior content is the shared intervention carrier in both modes, but releasing its prior-answer control does not always translate into correct recovery. Family / VariantSize Prior-only PAR (%) Image-present VUR (%)∆m E−C Qwen3-VL / Instruct 8B70.844.92.617 32B82.960.03.075 Qwen3-VL / Thinking 8B53.322.62.832 32B56.631.83.004 Qwen3.5 4B98.782.01.612 9B99.286.81.372 27B97.888.01.535 Gemma-4 / Base 12B95.075.00.911 31B97.177.90.996 Gemma-4 / IT 12B91.379.92.067 31B92.788.03.152 Table 12: Descriptive within-family scale trends. Rows within each block follow increasing nominal checkpoint size. Cohorts are separately eligible at each checkpoint, so these trends are not paired sample-level scaling estimates. Scale. Image-present VUR increases with nominal size in all five comparable within-family sequences in Tab. 12. This differs from a literal replication of VisualSwap’s degradation trend, but it does not show shortcut retirement. Prior-only PAR increases in four of the five sequences and remains near saturation for Qwen3.5, while ∆m E−C does not decrease monotonically with size. Larger checkpoints can therefore recover the current answer more often while retaining an equally strong or stronger evidence-bearing prior path. In particular, Qwen3-VL-32B-Thinking remains far below its Instruct counterpart in VUR (31.8% versus 60.0%). FSAF further separates vulnerability from immutable vi- sual ability. On the independently eligible FSAF cohort in Tab. 7, it raises VUR more for Thinking than Instruct at both Qwen3-VL scales (+19.96 versus +15.95 p at 8B and +21.97 versus +15.22 p at 32B), while reducing PAR to 1.03%–1.64% for the Thinking variants. The remaining post- FSAF VUR gap shows that blocking prior-CoT access does not erase every mode difference, but the large matched im- provement identifies stale textual accessibility as a substan- tial and scale-persistent component of the Thinking-model failure. C.3 Operational Identification of Evidence-Bearing Spans We identify E − automatically using fixed, outcome- independent rules. Before classification, we remove the ex- plicit final-answer suffix using deterministic patterns for expressions such as “final answer,” “the answer is,” and ; when none matches and the response contains more than two sentences, the implementation removes the final sentence. This preprocessing keeps the explicit answer span A − separate from the reasoning spans considered for E − . We then split the remaining prior CoT at sentence-final periods, question marks, exclamation marks, and line breaks. A sentence is marked as evidence-bearing if it satisfies at least one of the following four rules: 1. it contains a number, , , or one of =,<,> ,±, and degree symbols; 2. it contains an explicit option or answer reference involving a letter from A to J; 3. it contains a term from the fixed visual lexicon: image, figure, graph, diagram, line, point, circle, triangle, angle, axis, x-axis, y-axis, table, chart, shape, red, blue, green, left, right, above, below, intersect, parallel, perpendicu- lar, slope, curve, bar, row, column, object, shown, visible; or 4. it contains a term from the fixed mathematical/reasoning lexicon: equals, equal, therefore, thus, hence, because, since, so, calculate, compute, sum, difference, ratio, area, perimeter, length, radius, diameter, probability, fraction, degree, option, choice, answer, value. For the dose-response intervention in Fig. 3, identified sen- tences are ranked by the number of numerical or symbolic cues, twice the number of option cues, and the number of matched visual and mathematical terms; ties are resolved by sentence length. At removal fractionα, we delete the highest- ranked⌈α|E − |⌉ sentences. The length-matched control ran- domly orders non-evidence sentences using a fixed sample seed and removes sentences until their token count reaches that of the removed evidence. These rules deliberately pro- vide a reproducible, high-recall operational decomposition; they do not claim that the selected sentences are unique human-annotated causal spans. C.4 Free-Generation Outcomes after Evidence Removal Tab. 13 reports the complete model-equal outcome distri- bution underlying the free-generation results in Tab. 2. The intact prior (N) retains R − , the matched context control (C) deletes a length-matched amount of non-evidence context, and evidence removal (E) deletes all spans in E − . All three are generated by continuing the same assistant turn after the edited prefix and fixed reflection cue. Thus, intact N is not the image-present new-turn condition in Tab. 10; the ap- propriate evidence-content comparison is the matched E–C contrast reported in Tab. 2, not a cross-table comparison of their absolute VUR values. Relative to the intact prior, evidence removal increases VUR by 45.22 p and decreases PAR by 64.22 p. The released prior-answer control does not always become the current answer: Other increases from 8.35% to 26.50%, a change of 18.16 p, with a positive change in 14/16 models. Thus, removing E − suppresses prior-consistent generation but does not guarantee recovery of the current answer. ConditionVUR (%) PAR (%) Both (%) Other (%) Intact prior (N)14.3278.771.448.35 Matched context control (C) 15.7877.141.478.55 Evidence removal (E)59.5414.550.6026.50 Table 13: Free-generation outcome distribution under evidence-content interventions. Entries are model-equal percentages over 4,159 paired model–sample instances from 16 VLMs. VUR and PAR are judged independently; Both denotes outputs matching both targets, and Other denotes outputs matching neither target. Q1Q2Q3Q4 Within-model prior-CoT length quartile 10 20 30 40 50 60 Prior-conditioned PAR (%) Length slope: +11.85 p/SD p=0.0011 (a) Q1Q2Q3Q4 Within-model prior-CoT length quartile 0.0 0.5 1.0 1.5 2.0 2.5 3.0 Δ answer-preference margin (b) E-CE-ND-N Q1Q2Q3Q4 Within-model prior-CoT length quartile 20 30 40 50 60 70 80 Evidence-removal effect (p) (c) ΔVUR PAR reduction Q1Q2Q3Q4 Within-model prior-CoT length quartile 0 5 10 15 20 Order-disruption effect (p) (d) ΔVUR PAR reduction Figure 5: Prior-CoT length predicts vulnerability but does not explain the core intervention effects. (a) Model-equal PAR under image-present prior-conditioned reflection. (b) Answer-preference effects for evidence removal versus a length-matched non-evidence control (E–C), evidence re- moval versus the intact prior (E–N), and evidence-order dis- ruption versus the intact prior (D–N). (c,d) Corresponding VUR increases and PAR reductions. Error bars and bands are 95% hierarchical-bootstrap CIs. Prior-CoT Length Sensitivity. We test whether prior-CoT length can explain the observed vulnerability. Length is mea- sured on the prior reasoning span R − after removing its explicit final-answer suffix. Within each model, we divide the 4,159 eligible model–sample instances into character- length quartiles, preventing naturally longer traces from being treated as a between-model effect. Under image- present prior-conditioned reflection, model-equal PAR in- creases from 31.07% in the shortest quartile to 45.87% in the longest. After controlling for model and dataset fixed ef- fects, a one-standard-deviation increase in log(1 + length) is associated with an 11.85 p increase in PAR (p = 0.0011). Longer prior CoTs are therefore associated with greater prior- answer retention. This association does not account for the content and or- ganization effects. Across all four within-model length quar- tiles, evidence removal remains stronger than length-matched non-evidence removal and the intact prior, while evidence- order disruption continues to weaken prior control (Fig. 5). The corresponding answer-preference, VUR, and PAR ef- fects retain their reported directions, and none of the seven core intervention readouts has a significant character-length slope after the fixed-effect adjustment (all p > 0.05). This analysis is an observational stratification and adjustment, rather than a same-sample intervention on prior-CoT length, and therefore does not establish that length has no causal role. C.5 Protocol Map for Reported Results Tabs. 1–18 use several deliberately different carriers and turn structures. Tab. 14 makes these settings explicit so that ab- solute rates are compared only within a matched protocol. D Shortcut Persistence and Continuation Controls This section details the two evidence-preserving continua- tion branches used to test whether shortcut influence sur- vives answer correction or extends to later computation. Both branches begin from the matched direct and prior- conditioned paths in Eqs. (2)–(3) and preserve the current image and preceding path-specific context. Tab. 5 displays the two initial outcomes central to the state- conditioned analysis rather than an exhaustive partition. For equivalent re-query, the 4,159 eligible pairs comprise 2,456 recovered (59.05%), 1,418 active-stale (34.09%), and 285 Other (6.85%) cases. For derived computation, the 2,384 numeric-eligible pairs comprise 1,450 recovered (60.82%), 770 active-stale (32.30%), and 164 Other (6.88%) cases. The analyzed source-state partitions contain no Both cases. Other is omitted from the main table because the two named strata provide the interpretable current-only and prior-only conditioning states; it is not folded into either reported effect. D.1 Equivalent Re-Query The equivalent re-query is the first gray continuation branch in Fig. 2. We append a new user turn that repeats Q. We use two semantically matched variants. The first explicitly in- structs the model to use the current image as visual evidence before answeringQ again; the second requests only a concise final answer to Q. Candidate scoring compares support for y and y − using m(S) in Eq. (6), while free generation is evaluated with VUR and PAR in Eq. (4). Neither variant re- moves preceding support or inserts y − into the new prompt. An auxiliary neutral-history control preserves the extra turn and context structure without including the evidence-bearing content of R − . D.2 Derived Computation For tasks in which the current and prior quantities can be parsed as distinct numerical values, we replace the repeated question with one of three transformations: doubling the quantity, adding one, or testing it against a threshold cho- sen to distinguish the current- and prior-derived outcomes. The transformed current and prior values serve as the paired candidates for scoring and as the targets for judging free generation under the same metric definitions. No support is removed and y − is not reintroduced in the follow-up prompt. D.3 Neutral-History Control To distinguish the effect of stale evidence from generic effects of an additional dialogue turn or longer context, we introduce a neutral-history path that preserves the extra turn and context structure but excludes the evidence-bearing content of R − . Tab. 15 reports free-generation match rates for the direct, neutral-history, and prior-conditioned paths, stratified by the initial reflection outcome. For equivalent re-query, neutral-history rates remain within 0.8 p of the direct path for current-answer matches and within 0.2 p for prior-answer matches in both initial- outcome strata. In contrast, among active-stale outcomes, prior-conditioned history decreases the current-answer rate from 56.77% to 16.89% and increases the prior-answer rate from 0.88% to 35.93%. The recurrence is therefore associ- ated with the stale evidence-bearing history rather than the presence of an additional turn alone. For derived computation, neutral history causes a smaller generic decrease in current-derived matches relative to the direct path (−5.93 p for recovered and −2.95 p for active-stale outcomes), but leaves prior-derived matches nearly unchanged (+0.47 and−0.26 p, respectively). Prior- conditioned history produces a much larger active-stale shift, decreasing current-derived matches by 65.19 p and increas- ing prior-derived matches by 45.28 p. For recovered out- comes, it decreases current-derived matches by 18.99 p while changing prior-derived matches by only +0.07 p. Thus, generic history can contribute modestly to computa- tion degradation, but it does not explain the strong premise transfer in the active-stale stratum; after recovery, the effect is better characterized as computation disruption than stable prior-premise substitution. E Robustness Checks and Naturally Occurring Errors E.1 Reflection-Prompt and Prefix Robustness To test whether prior-CoT influence is induced by a partic- ular reflection phrase, we follow the ten-paraphrase robust- ness setting of VisualSwap (Shi et al. 2026). Each variant conveys the same instruction to re-examine the current vi- sual input but uses a distinct lexical realization. The strings below are independently worded, protocol-matched realiza- tions of the same ten prompt intents rather than verbatim reproductions. For every eligible model–sample pair, only P reflect in Eq. (3) is replaced; the current image, question, prior CoT, assistant-turn structure, decoding configuration, and evaluator are held fixed. We evaluate the same paired co- hort under all ten variants and report the mean and standard deviation across prompts for VUR, PAR, and the answer- preference margin m. To separately test the semantics of the reflection prefix, we replace P reflect with the neutral assistant continuation “Let me continue the reasoning.” while holding all other inputs and settings fixed. E.2 Naturally Occurring Errors We additionally run standard inference on the original bench- mark images without an image swap and retain model– Table(s)CarrierTurn structureEvaluator 1, 10Completed historical R − Fresh user turn re-asks Q, with or without I235B semantic judge 2, 13Intact or edited same-turn R − prefix (N/C/E/A) Same assistant turn after the edited prefix and fixed cueModel token log-probabilities and 235B judge 3Intact or reordered evidence chain (N/D/NE) Same assistant turn after the controlled prefixModel token log-probabilities and 235B judge 4Reconstructed D/H contexts with current sup- port F/W Separate continuation from each matched context235B semantic judge 5, 15Direct, neutral-history, or prior-conditioned source state Fresh equivalent-re-query or derived-computation user turn Model token log-probabilities and 235B judge 6Paraphrased/neutral cue or naturally gener- ated erroneous CoT Same-turn reflection or matched prompt-only control235B semantic judge 7, 18Ordinary stale prefix or fresh suffix blocked from R − Same-turn baseline vs. fresh user–assistant FSAF boundary 235B judge and model token log- probabilities 11, 12Derived summaries of the preceding carrier conditions Mixed: new-turn absolute rates and same-turn E–C interven- tion Inherited from Tabs. 10 and 2 17RAQ, CRF, re-query-only, or full FSAFCondition-specific same-turn or fresh-boundary design screen Rule screen; 235B judge where marked Table 14: Protocol map for reported quantitative results. Eligibility rules and cohort counts are documented separately in Appendix H and are not repeated here. Descriptive/setup Tabs. 8, 9, 16, 19, 20, and 21 are omitted. Current match (%)Prior match (%) ContinuationInitial outcome Direct Neutral Prior-cond. (H)Direct Neutral Prior-cond. (H) Equivalent re-query Recovered54.8055.5652.67 0.570.751.55 Active stale56.7757.4816.89 0.881.0235.93 Derived computation Recovered72.9467.0153.95 4.645.114.71 Active stale76.0273.0710.82 8.838.5754.11 Table 15: Neutral-history control for evidence-preserving continuations. For derived computation, current and prior matches refer to the corresponding derived targets. sample pairs whose initial generated answer is incorrect. Eli- gibility depends only on this initial error and does not require the prompt-only condition to recover the correct answer. The ordinary-reflection condition retains the model-generated er- roneous CoT, whereas the matched prompt-only condition removes that CoT while preserving the image, question, re- flection instruction, decoding configuration, and evaluator. We report the percentage of responses corrected to the bench- mark target under each condition. F FSAF Implementation and Additional Analysis F.1 Exact Re-Query and Execution Procedure FSAF uses the same fixed user turn for every model and sample: Answer the same question using only the current image. Be concise and end with the final-answer format requested by the question. The intervention then proceeds as follows. First, the model generates the prior assistant CoT R − , while the serving run- time records its token interval [s − ,e − ). Second, the fixed re-query U f is appended as a new user turn. Third, the run- time constructs M FSAF in Eq. (8) directly from the recorded interval, without parsing the answer or locating individual evidence spans. Fourth, the mask is enabled in every lan- guage layer for both the prefill of U f and the generation of R F . Finally, the model produces one response using the same decoding settings and maximum generation length as the baseline. Thus, FSAF adds neither a second model call nor a candidate-answer extraction stage. F.2 Implementation and Deployment Scope Our implementation applies the additive mask through Trans- formers eager-attention hooks for Qwen2.5-VL and Qwen3- VL. The runtime identifies fresh-suffix queries by their posi- tions after e − and masks all keys in [s − ,e − ). The interven- tion covered all 28 language layers of Qwen2.5-VL-7B, all 36 layers of the Qwen3-VL-8B variants, and all 64 layers of the Qwen3-VL-32B variants. The current implementation uses batch size 1; a vLLM deployment requires the same additive mask to be integrated into its attention backend or a cus- tom operator. A fail-closed policy enables both the re-query and firewall only for the five verified model configurations. For an unknown model, both components are disabled and the caller’s ordinary reflection baseline is used. This avoids silently degrading to the re-query-only condition. ID Reflection prompt 1 Let me inspect the image more closely before accepting this conclusion. 2 I should revisit the figure and verify each step of my reasoning. 3 Let me examine the smallest visual details once more before answering. 4 I will check the visual input again to confirm that observation. 5 Let me reassess the complete figure and confirm that my reading is consistent. 6 I should focus again on the relevant local region and verify this point. 7 Let me carefully re-inspect the figure before relying on my first impres- sion. 8 I will take another look at the image in case I interpreted it incorrectly. 9 Let me verify the visual evidence again to rule out a perception error. 10 I should inspect the image once more and ensure the claimed detail is actually present. Table 16: Reflection-prompt variants for the robustness evaluation. Following VisualSwap, the variants preserve the intent of visual re-examination while varying its lexical ex- pression. F.3 Design Ablations We study why FSAF needs both a fresh user–assistant bound- ary and a firewall spanning prefill and generation. Tab. 17 reports the Qwen2.5-VL-7B design study. Re-answer query- ing (RAQ) masks only generated-token access to R − ; the re-query cue can therefore read R − during prefill and carry it forward in its cached states. Clean recheck framing (CRF) also cleans the cue, but continues within the same assis- tant turn. The re-query-only condition uses the exact FSAF wording without changing attention accessibility. ConditionEvaluatorvs. Ordinary Reflection (p) ∆VUR↑∆PAR↓ RAQ: generation-only mask 235B judge −2.62−35.21 CRF: same-turn cue cleaning Rule+0.75−16.85 Re-query onlyRule +3.00 [−2.25, +8.24] +19.48 [+11.99, +26.97] Full FSAFRule +23.97 [+17.60, +30.34] −14.61 [−20.98,−7.87] Full FSAF235B judge +18.73 [+12.36, +25.09] −31.46 [−37.83,−25.09] Table 17: FSAF design ablations on Qwen2.5-VL-7B. Val- ues are paired percentage-point differences relative to or- dinary reflection; brackets give 95% confidence intervals when reported. Rule-based rows are auxiliary design screens, whereas the final paper claim uses the 235B semantic judge. RAQ substantially reduces PAR but also decreases VUR, showing that removing a direct generation-time edge does not by itself preserve correct updating. The rule-based re-query- only screen yields no reliable VUR gain and increases PAR, while full FSAF improves VUR and reduces PAR under both the rule screen and the 235B judge. Because CRF and re- query-only were not evaluated with the final semantic judge in this package, we use them only to motivate the coupled design, rather than as standalone semantic-effect claims. Baseline outcome PairsVUR: Base→ FSAFPAR: Base→ FSAF Recovered 625 100.00→ 82.40 (−17.60)0.00→ 1.12 (+1.12) Active stale 6960.00→ 38.51 (+38.51) 100.00→ 6.47 (−93.53) Other4690.00→ 37.74 (+37.74)0.00→ 2.77 (+2.77) Both10 100.00→ 50.00 (−50.00) 100.00→ 10.00 (−90.00) Table 18: FSAF transitions conditioned on the ordinary- reflection outcome. Each metric cell reports baseline → FSAF, followed by the paired change in parentheses. Rates and changes are in percent and percentage points, respec- tively. F.4 State-Conditioned Transitions To identify which baseline outcomes contribute to the pooled effect in Tab. 7, we stratify each paired instance by the 235B judge label assigned to its ordinary-reflection output. Recov- ered denotes a baseline output matching only y, Active stale denotes one matching only y − , and Both and Other denote outputs matching both or neither target, respectively. We then measure the paired FSAF outcome within each fixed baseline stratum. The pooled improvement is concentrated in the Active stale and Other strata. For active-stale outputs, FSAF reduces PAR from 100.00% to 6.47% and raises VUR to 38.51%; among Other outputs, 37.74% become current-answer matches. FSAF preserves the current answer for 82.40% of recovered outputs, showing that the intervention does not perfectly pre- serve already successful reflections. At the pooled level, the Other share rises from 26.06% to 43.17%, so lower PAR does not imply that every released stale answer becomes the cur- rent answer. Because these strata are defined by the observed baseline output, the values describe state-conditioned transi- tions rather than causal differences between latent states. We do not interpret the Both stratum further because it contains only 10 pairs. F.5 Evaluation and Intervention Audit The final semantic evaluation contains 3,600/3,600 expected baseline/FSAF judge tasks and 1,800/1,800 paired model– sample instances across the five models, with no missing or duplicate task IDs. The answer-preference evaluation con- tains 5,400/5,400 finite scoring records across baseline, re-query-only, and FSAF, forming 1,800/1,800 complete three-condition model–sample triplets with no duplicates. All FSAF generations have at least 0.90 recorded coverage of the intended R − span, and every sample records modified attention edges during both prefill and generation. Baseline and FSAF use the same maximum generation length of 256 tokens. The rule evaluator and 235B judge disagree on at least one VUR/PAR label for 951/3,600 outputs (26.42%); consequently, the VUR/PAR columns in Tab. 7 use the 235B semantic judge, while its answer-preference columns use the evaluated models’ mean token log-probabilities. Rule-based results serve only as low-cost design screens. G VS-Bench Construction and Use Scope and Composition. VS-Bench (Shi et al. 2026) is designed to test visual re-examination rather than static visual question answering. It contains 800 image pairs, with 200 pairs drawn from each of MathVista-MINI, the Vision-Dominant subset of MathVerse-MINI, MathVision, and MMMU-Pro (Lu et al. 2024; Zhang et al. 2024a; Wang et al. 2024; Yue et al. 2025). These sources span charts, func- tion plots, geometry, competition mathematics, and expert- level multimodal questions, while retaining questions whose answers depend on visual evidence. Pair Construction. Each instance contains a shared question Q, a source benchmark imageI b , and a human-checked alter- native image I a . The construction follows three constraints: (i) Q remains valid for both images; (i) the images pre- serve high-level layout, style, composition, and context; and (i) an answer-critical visual detail changes, yielding distinct ground-truth answers A a ̸= A b . VisualSwap uses a human- in-the-loop image-editing process: annotators identify the answer-critical element, specify a targeted modification, and iteratively refine the edited image. The paired images are also kept at identical resolution so that the swap does not alter the visual-token count. SourcePairs CLIP↑ SSIM↑ LPIPS↓ MathVista-MINI 2000.950.880.12 MathVerse-MINI 2000.970.940.06 MathVision2000.950.860.17 MMMU-Pro2000.940.750.19 Overall8000.950.860.14 Table 19: VS-Bench composition and image-pair similar- ity. Higher CLIP similarity and SSIM, together with lower LPIPS, indicate that paired images remain visually similar despite their answer-determining differences. Values are re- ported by VisualSwap (Shi et al. 2026). Use in Our Framework. To match the notation in our con- trolled framework, we relabel the source benchmark image as the current image I = I b and the edited alternative as the counterfactual image I − = I a , with targets y = A b and y − = A a . This direction lets the evaluated model first produce R − on the coherent counterfactual task and then reflect under the current benchmark image. The full 800-pair benchmark defines the available task pool; each model’s ana- lyzed cohort is subsequently restricted to pairs that it answers correctly under direct inference on both I − and I. Thus, the controlled comparison targets prior-CoT influence rather than failures caused by an independently unsolved image. H Cohort Construction, Sample Counts, and Coverage H.1 Eligibility and Sample Flow The available pool contains 800 paired tasks per model. A model–sample pair enters the corrected diagnosis cohort only when the model’s direct responses to both I − and I seman- tically match their respective targets under the 235B judge. Stage or analysisPairs Additional filter Available task pool16× 800 None Corrected 16-model diagnosis4,159 Directly correct on both images Matched support withdrawal2,456 Recovered under ordi- nary reflection FSAF semantic evaluation1,800 Five verified Qwen con- figurations FSAF judge tasks3,600 Baseline and FSAF out- put per pair FSAF preference records5,400 Baseline, re-query-only, and FSAF per pair Table 20: Sample flow for the principal analysis cohorts. Counts are model–sample pairs, not unique benchmark ques- tions. This model-specific filter prevents an unsolved source or current task from being misclassified as resistance to, or per- sistence of, a prior state. Eligibility is therefore defined at the model–sample level rather than once for the benchmark. The unified 16-model diagnosis contains 4,159 eligible model–sample pairs. Subsequent analyses retain this identity key and apply only the filter required by their estimand. For example, the matched support-withdrawal test selects the 2,456 instances that first recover the current answer under ordinary reflection. The FSAF evaluation uses the original rule-extracted el- igibility snapshot frozen for the intervention runs. It re- quires an answer-changing pair for which direct inference is correct on both images. In the model order of Tab. 7, its counts are 267/420/486/322/305, totaling 1,800, rather than a 360-per-model subsample. It is not a post-hoc fil- ter of the 1,943 five-Qwen pairs in Tab. 21; those counts (258/414/469/422/380) come from the corrected 235B semantic-judge eligibility snapshot used by the 16-model diagnosis. Because the evaluator and membership differ, all FSAF effects remain within the fixed 1,800-pair cohort. The generated baseline and FSAF outputs are still evaluated by the 235B semantic judge, as detailed in Appendix F.5. H.2 Eligible Counts by Model Tab. 21 reports the corrected semantic-judge eligibility count for every checkpoint. These counts explain why unweighted cross-model raw rates can be misleading and motivate the paired estimand in Appendix A.8. They are not performance scores: a model can have a smaller eligible cohort for many reasons, including failure on either direct-image task. H.3 Completeness and Coverage Checks Before aggregation, each analysis verifies unique task IDs and the presence of every condition required for a matched comparison. The FSAF semantic package contains 3,600/3,600 expected judge tasks and 1,800/1,800 complete baseline/FSAF pairs. Its answer-preference package contains 5,400/5,400 finite records and 1,800/1,800 complete three- condition triplets, with no duplicate task IDs. All FSAF rows ModelEligible pairs Qwen2.5-VL-7B-Instruct258 Qwen3-VL-8B-Instruct414 Qwen3-VL-8B-Thinking469 Qwen3-VL-32B-Instruct422 Qwen3-VL-32B-Thinking380 InternVL2-8B141 Gemma-4-12B60 Gemma-4-12B-it229 Gemma-4-31B136 Gemma-4-31B-it275 Qwen3.5-4B233 Qwen3.5-9B242 Qwen3.5-27B267 Qwen3.6-27B269 Kimi-VL-A3B-Instruct181 Kimi-VL-A3B-Thinking-2506183 Total4,159 Table 21: Corrected eligible model–sample pairs in the 16- model diagnosis. Eligibility requires semantic correctness under direct inference on both paired images. record at least 0.90 coverage of the intended stale span and nonzero modified attention edges in both prefill and genera- tion. Experiment-specific subsets are reported with their own denominator; missing conditions are never imputed. I Representative Case Studies Figs. 6–16 visualize one frozen, representative model– sample pair for each principal diagnostic or continuation experiment. Following the presentation style of VisualSwap (Shi et al. 2026), each figure reads from the prior observation (I − ,Q,R − ), through the current image I, to the condition- specific intervention and observed response. Red denotes the prior state and green denotes the current state. For candidate scoring, the displayed margin is logp(y | C)−logp(y − | C), so positive values favor the current answer; generation la- bels are assigned separately by the semantic judge. Long questions or prior responses are excerpted with ellipses only for display; the experiment uses the complete strings. These cases illustrate the protocol and observed behaviors rather than serving as frequency estimates. I.1 Diagnosing Prior-State Control The first group traces prior-state control from the ba- sic visual-recheck failure to its carrier, evidence content, strength, and organization. Within each controlled contrast, the current image and query are fixed while the retained or edited prior response changes. Reading Figs. 6–13 in se- quence therefore shows which parts of R − sustain the prior- answer path and which interventions reopen current-image recomputation. I.2 Testing Shortcut Retirement and Future Transfer The remaining cases ask whether prior-state influence has actually been retired or can reappear in a later computa- tion. They compare direct-current, history-conditioned, and neutral-history paths under matched support withdrawal, an identical future re-query, and a derived task. Candidate mar- gins and free-generation labels remain separate readouts, al- lowing Figs. 14–16 to expose both shifts in answer preference and changes in the generated answer. Qwen2.5-VL-7B-Instruct | MathVista_MINI #522 1 Prior observation direct answer on the edited image Prior imageIQueryQ Move the ruler to measure the length of the line to the nearest centimeter. The line is about (_) centimeters long. prior answer: 4current target: 7 retain the prior reasoning 2 Prior reasoningR generated from the prior image The line in the image extends from the 0 cm mark to just past the 4 cm mark. Since we are asked to measure to the nearest centimeter, we round to the nearest whole number. The line is closer to the 4 cm mark than to the 5 cm mark. Therefore, the length of the line is about 4 centimeters long. final: 4 Reflection cueP reflect Wait, let me check the figure again to make sure I haven't made a mistake. replace the prior image with the current image 3 Visual recheck and reflected continuation same conversation, current image inserted Current imageI image-grounded answer: 7 Reflected responseR The line indeed ends just past the 4 cm mark, so the correct answer is indeed 4 centimeters. stale prior answer retained: 4 Figure 6: A prior CoT can override changed visual evidence. Top: Qwen2.5-VL-7B-Instruct answers y − = 4 from the prior image I − and records the supporting response R − . Middle: the image is replaced by the current image I, whose target is y = 7, while the prior response remains in the conversation. Bottom: after the reflection cue, the model repeats the prior answer instead of recomputing from the changed ruler. This representative failure illustrates the competition between fresh visual recomputation and stale textual reuse described in the main paper. gemma-4-12B | MMMU_Pro_10c_COT #392 1 Prior observation counterfactual image and shared query Prior imageIQueryQ An outbreak of gastritis occurred on a cruise ship. The data in the following table were obtained shortly after the outbreak, from a questionnaire completed by everyone on board the ship. What is the relative risk of developing gastritis from herring consumption? <image 1> Choices: (A) 8,0 (B) 2,5 (C) 2,3 (D) 4,0 (E) 3,5 (F) 3,0 (G) 1,5 (H) 0,5 (I) 2,0 (J) 1,0 Answer with the option letter at the end. prior answer: (F) 3,0current target: (I) 2,0 replace the image; retain or edit the prior response 2 Current evidence and prior state shared context before the tested intervention Current imageIPrior responseR The relative risk of developing gastritis from herring consumption can be calculated using the formula: Relative Risk = (Risk in exposed group) / (Risk in unexposed group) In this case, the risk in the exposed group (people who ate herring) is the number of sick people who ate herring divided by the total number of people who ate herring. The ... [middle omitted] ... Risk in exposed group = 300 / (300 + 700) = 0.3 Risk in unexposed group = 100 / (100 + 900) = 0.1 Relative Risk = 0.3 / 0.1 = 3.0 Therefore, the relative risk of developing gastritis from herring consumption is 3.0. The correct answer is (F) 3.0. final: (F) 3,0 apply the condition-specific input and measure the response 3 Visual availability and re-entry framing Intervention / experimental inputObserved readout New turn; current image withheld Output: The relative risk of developing gastritis from herring ... Question: An outbreak of gastritis occurred on aanswer: (F) 3,0 label=stale New turn; current image restored Output: The relative risk of developing gastritis from herring ... completed by everyone on board the ship. Whatanswer: (I) 2,0 label=update Current-evidence re-entry prompt Output: The relative risk of developing gastritis from herring ... is 2.0. The correct answer is (I) 2.0.answer: (I) 2,0 label=update Prior evidence explicitly labeled Output: The relative risk of developing gastritis from herring ... is 2.0. The correct answer is (I) 2.0.answer: (I) 2,0 label=update Figure 7: Current visual evidence can reopen recomputation. Top and middle: Gemma-4-12B first derives the prior relative risk y − = 3.0, after which the current table changes the target to y = 2.0. Bottom: a fresh turn without the current image remains stale, whereas restoring I, explicitly requesting current-evidence re-entry, or labeling the carried evidence as prior all yield the current answer. The contrast illustrates the main-paper finding that R − can sustain a competing answer path when I is absent, while restoring and foregrounding current visual evidence can shift the model back toward recomputation. Kimi-VL-A3B-Instruct | MathVision #46 1 Prior observation counterfactual image and shared query Prior imageIQueryQ What do you see if you look at the tower, which is made up of two building blocks, exactly from above? Choices: (A) A (B) B (C) C (D) D (E) E Provide the final answer at the end. prior answer: (C) Ccurrent target: (A) A replace the image; retain or edit the prior response 2 Current evidence and prior state shared context before the tested intervention Current imageIPrior responseR To determine what the tower looks like from above, we need to consider the top view of the two stacked building blocks. 1. The image shows a tower made up of two rectangular blocks stacked on top of each other. 2. When viewed from above, the top block will cover the entire area of the bottom block. 3. Therefore, the top view will be a ... [middle omitted] ... A right triangle: This does not match the rectangular shape of the top view. - (E) A rectangle: This matches the rectangular shape of the top view. Since the top view of the tower is a single rectangle, the correct answer is (C). Answer: (C) final: (C) C apply the condition-specific input and measure the response 3 Old-state carrier ablation Intervention / experimental inputObserved readout Full prior context Output: The answer is (C)answer: (C) C label=stale Prior reasoning only Output: The figure shows a tower made up of two rectangular blocks ... is indeed (C). Revised Answer: The answer is C.answer: (C) C label=stale Prior answer only Output: The tower is made up of two building blocks: a cylinder and a ... is (A) A. Revised Answer: The answer is A.answer: (A) A label=update Random-answer control Output: The tower is made up of a cylinder and a cone. If we look at ... The rectangle is a rectangle, and the squareanswer: (A) A label=update Figure 8: Reasoning, not the answer token alone, carries prior-state control. The current geometry image I is fixed across all four conditions. Kimi-VL-A3B-Instruct remains stale when given either the full prior response or its reasoning body alone, but updates when only the prior answer or a random answer control is carried forward. In this representative contrast, task-relevant reasoning in R − , rather than the answer token by itself, provides the reusable route to the prior answer. Qwen3-VL-32B-Instruct | MMMU_Pro_10c_COT #1203 1 Prior observation counterfactual image and shared query Prior imageIQueryQ Consider a three-factor APT model. The factors and associated risk premiums are . Calculate expected rates of return on the following stock: A stock with average exposure to each factor (i.e., with b = 1 for each). The risk-free interest rate is 7%. Options: A. 5% B. 14% C. 12.5% D. 13% E. 11% F. 15.5% G. 10% H. 16% I. 9% J. 7% Answer the following multiple-choice question. The last line of your response should be of the following format:... prior answer: (H) 16%current target: (D) 13% replace the image; retain or edit the prior response 2 Current evidence and prior state shared context before the tested intervention Current imageIPrior responseR We are given a three-factor APT (Arbitrage Pricing Theory) model with the following risk premiums: - Change in GNP: +5% - Change in energy prices: –1% - Change in long-term interest rates: +5% The stock has average exposure to each factor, meaning the factor sensitivities (betas) are: - β = 1 (for GNP) - β = 1 (for energy prices) - β = 1 ... [middle omitted] ... Premium + β × Risk Premium Substitute the values: > E(R) = 7% + (1 × 5%) + (1 × –1%) + (1 × 5%) > E(R) = 7% + 5% – 1% + 5% > E(R) = 7% + 9% = 16% So, the expected rate of return is 16%. Looking at the options, that corresponds to: H. 16% Answer: H final: (H) 16% apply the condition-specific input and measure the response 3 Old evidence specificity Intervention / experimental inputObserved readout Full prior reasoning margin=-0.929 Remove all stale evidence margin=+1.722 Length-matched random removal margin=-1.209 Count-matched random removal margin=-1.209 Figure 9: Evidence-bearing content carries textual-shortcut control. Qwen3-VL-32B-Instruct initially favors the prior answer when the full prior response is retained. Removing all answer-supporting evidence switches the candidate margin to the current answer, whereas removing a length-matched or count-matched random span does not. This matched case illustrates the content- specific effect reported in the main paper: weakening the stale evidence route, rather than merely shortening the prefix, reduces prior-answer control. Qwen3-VL-8B-Instruct | MathVerse_MINI #3079 1 Prior observation counterfactual image and shared query Prior imageIQueryQ The graph shows Bart's speed while he is competing in a walking race. Which situation corresponds to the graph? Choices: A:Bart increases his speed for the first half of the race and then slows in the second half B:Bart starts off by increasing his pace gradually and then maintains a constant speed C:Bart starts off at a constant speed and then increases his speed at a steady rate D:Bart increases his speed at a constant rate throughout the entire race prior answer: (B) Bart starts...current target: (A) Bart increases... replace the image; retain or edit the prior response 2 Current evidence and prior state shared context before the tested intervention Current imageIPrior responseR Let's analyze the graph step by step. The graph is a speed vs. time plot. The x-axis represents time, and the y-axis represents speed. 1. The graph starts at the origin (0,0), meaning Bart starts from rest (speed = 0) at time = 0. 2. The first part of the graph is a straight line with a positive slope. This indicates that speed is increasing linearly with time. In other ... [middle omitted] ... not a constant speed. D: "Bart increases his speed at a constant rate throughout the entire race" — This is incorrect because the graph shows a change from increasing speed to constant speed, not constant acceleration throughout. Therefore, the correct answer is B. B final: (B) Bart starts... apply the condition-specific input and measure the response 3 Evidence-content candidate scoring Intervention / experimental inputObserved readout Full prior reasoning margin=-1.012 Remove 25% of stale evidence margin=+0.181 Remove 50% of stale evidence margin=+1.127 Remove 75% of stale evidence margin=+1.235 Remove all stale evidence margin=+1.312 Figure 10: Evidence removal progressively weakens prior-answer control. Qwen3-VL-8B-Instruct begins with a prior-favored margin under the full response R − . As 25%, 50%, 75%, and then all of the identified stale-evidence spans are removed, the margin progressively moves toward and then favors the current answer. The case visualizes the graded weakening of textual- shortcut control as the answer-supporting route in R − is withdrawn. Kimi-VL-A3B-Thinking-2506 | MMMU_Pro_10c_COT #1064 1 Prior observation counterfactual image and shared query Prior imageIQueryQ <image 1> Find the probability that x falls in the shaded area. Choices: (A) 1/10 (B) 8/10 (C) 5/10 (D) 3/10 (E) 1/2 (F) 9/10 (G) 4/10 (H) 7/10 (I) 6/10 (J) 2/10 Answer with the option letter at the end. prior answer: (C) 5/10current target: (D) 3/10 replace the image; retain or edit the prior response 2 Current evidence and prior state shared context before the tested intervention Current imageIPrior responseR Got it, let's see. The shaded area is between x=1 and x=6. To find the probability, we need the length of the shaded region divided by the total length. The total length from 0 to 10 is 10. The shaded length is from 1 to 6, so that's 6 - 1 = 5. So the probability is 5/10. Let me check the choices. Option C is 5/10. C final: (C) 5/10 apply the condition-specific input and measure the response 3 Evidence-content free generation Intervention / experimental inputObserved readout Full prior reasoning Output: C Canswer: (C) 5/10 label=old Length-matched random removal Output: Canswer: (C) 5/10 label=old Count-matched random removal Output: Canswer: (C) 5/10 label=old Remove all stale evidence Output: boxed(D) To determine the probability that x falls in the ... length of the favorable interval (shaded area)answer: (D) 3/10 label=new Substitute current-image evidence Output: D To find the probability that x falls in the shaded area, we ... from 0 to 10 . The length is 10 - 0 = 10 . 3answer: (D) 3/10 label=new Figure 11: Evidence-bearing content also controls free generation. With the current chart fixed, Kimi-VL-A3B-Thinking- 2506 repeats the prior answer under the full R − and after a length-matched random removal. Removing all stale evidence or replacing it with current-image evidence yields the current answer. This generated-output contrast supports the same main-paper conclusion as candidate scoring: evidence-bearing content is the robust carrier of the textual shortcut. Qwen3.5-9B | MathVision #2513 1 Prior observation counterfactual image and shared query Prior imageIQueryQ <image1> A bar graph shows the number of hamburgers sold by a fast food chain each season. However, the bar indicating the number sold during the winter is covered by a smudge. If exactly $ 25 \%$ of the chain's hamburgers are sold in the fall, how many million hamburgers are sold in the winter? prior answer: 4current target: 2.5 replace the image; retain or edit the prior response 2 Current evidence and prior state shared context before the tested intervention Current imageIPrior responseR We are told that exactly 25% of the chain’s hamburgers are sold in the fall. From the bar graph: - Spring: 4.5 million - Summer: 5.0 million - Fall: 4.5 million - Winter: ? (covered by smudge) Let’s denote the total number of hamburgers sold across all seasons as T. We’re told that Fall = 25% of T, and from the graph, Fall = 4.5 million. So: > 4.5 = 0.25 × T > T = 4.5 / 0.25 = 18 million Now, sum the known sales: Spring + Summer + Fall = 4.5 + 5.0 + 4.5 = 14.0 million Therefore, Winter sales = Total - Known = 18.0 - 14.0 = 4.0 million --- Final Answer: 4.0 final: 4 apply the condition-specific input and measure the response 3 Answer-location masking generation Intervention / experimental inputObserved readout Recovered path; full response Output: 2.5 But wait — the problem says “how many million hamburgers ... the top of the Fall bar) - Winter: coveredanswer: 2.5 label=new Mask final-answer span Output: 2.5answer: 2.5 label=new Mask all current-answer mentions Output: [MASKED_CURRENT_ANSWER]answer: [MASKED_CURRENT_ANSWER] label=other Figure 12: A recovered response can carry current-answer information beyond its final span. Qwen3.5-9B remains current- correct after the final answer span is masked, but no longer produces the current answer after all mentions of that answer within the recovered response are masked. For this case, recovery is therefore not stored only in the terminal answer string; answer-relevant information distributed through the current reasoning also matters. gemma-4-12B-it | MMMU_Pro_10c_COT #1618 1 Prior observation counterfactual image and shared query Prior imageIQueryQ A recent study found that the demand and supply schedules for Frisbees are as follows:<image 1> Frisbee manufacturers persuade the government that Frisbee production improves scientists' understanding of aerodynamics and thus is important for national security. A concerned Congress votes to impose a price floor $2 above the equilibrium price. What is the new market price? Choices: (A) 8 (B) 10 (C) 9 (D) 14 (E) 17 (F) 11 (G) 16 (H) 15 (I) 13 (J) 12 Answer with the option letter at the end. prior answer: (F) 11current target: (B) 10 replace the image; retain or edit the prior response 2 Current evidence and prior state shared context before the tested intervention Current imageIPrior responseR To find the new market price, we need to follow these steps: 1. Identify the Equilibrium Price: The equilibrium price is the price at which the Quantity Demanded equals the Quantity Supplied. Looking at the table: * At a price of $9, the Quantity Demanded is 7 million Frisbees and the Quantity Supplied is 7 million Frisbees. * Therefore, the ... [middle omitted] ... it is "binding," meaning the market price cannot fall below that level. * Since the equilibrium price is $9 and the floor is $11, the market price will be pushed up to the floor. * The new market price is $11. Comparing this to the given choices: ( final: (F) 11 apply the condition-specific input and measure the response 3 Controlled evidence organization Intervention / experimental inputObserved readout Natural evidence order margin=-2.373 Disrupt evidence order margin=-1.869 Non-evidence order control margin=-2.243 Coherent-connector control margin=-2.301 Conflicting connector margin=-2.331 Figure 13: Disrupting evidence-chain organization weakens textual-shortcut control. Gemma-4-12B-it favors the prior answer under the natural response. Disrupting the order of evidence-bearing sentences weakens this preference more than either disrupting non-evidence sentences or editing connective wording, although the case remains prior-favored. This controlled example mirrors the aggregate result that logical organization strengthens reuse of evidence-bearing content, while remaining a moderator rather than the shortcut’s sole cause. Qwen3-VL-8B-Thinking | MathVerse_MINI #1854 1 Prior observation counterfactual image and shared query Prior imageIQueryQ Consider the adjacent figure: Solve for the unknown w. prior answer: 30current target: 22 replace the image; retain or edit the prior response 2 Current evidence and prior state shared context before the tested intervention Current imageIPrior responseR Got it, let's see. The figure is a right triangle, right? There's a right angle marked, so that's 90 degrees. Then one of the angles is 60 degrees, so the third angle must be 30 degrees because the angles in a triangle add up to 180. The side opposite the 30-degree angle is 15, and we need to find the hypotenuse, which is labeled w. Wait, in a 30-60-90 triangle, the sides are ... [middle omitted] ... (optional) Using the cosine of the $ 60 $ angle: $$ (60 ) = adjacenthypotenuse = 15w $$ Since $ (60 ) = 0.5 $: $$ 0.5 = 15w w = 150.5 = 30 $$ Both methods confirm the value of $ w $. 30 final: 30 apply the condition-specific input and measure the response 3 Shortcut-retirement stress test Intervention / experimental inputObserved readout Candidate scoring | Direct-current path | Remove all current evidence new-vs-old=+2.766 Candidate scoring | Direct-current path | Keep current evidence intact new-vs-old=+4.187 Candidate scoring | History-conditioned reflection | Remove all current evidence new-vs-old=-4.952 Candidate scoring | History-conditioned reflection | Keep current evidence intact new-vs-old=+3.375 Free generation | Direct-current path | Remove all current evidence Output: 22answer: 22 label=new Free generation | History-conditioned reflection | Remove all current evidence Output: 30answer: 30 label=old Figure 14: Matched support withdrawal reveals prior-history dependence after answer recovery. Qwen3-VL-8B-Thinking has recovered the current answer before this test. When current supporting evidence is removed, the direct-current path remains current-favored, but the history-conditioned path relapses to a prior-favored candidate margin; both paths favor the current answer when that evidence remains intact. Candidate scoring and free generation are shown as separate readouts. The case illustrates why a correct reflected answer does not by itself certify shortcut retirement. InternVL2-8B | MathVista_MINI #832 1 Prior observation counterfactual image and shared query Prior imageIQueryQ What is the value of f(0)? Provide the final answer at the end. prior answer: 1current target: -2 replace the image; retain or edit the prior response 2 Current evidence and prior state shared context before the tested intervention Current imageIPrior responseR To find the value of f(0) , we need to substitute x = 0 into the function f(x) = x^3 + 3x^2 - 6x + 44 . Step-by-step calculation: 1. Substitute x = 0 into the function: f(0) = 0^3 + 3(0)^2 - 6(0) + 44 2. Simplify the expression inside the numerator: f(0) = 0 + 0 - 0 + 44 3. Combine the terms in the numerator: f(0) = 44 4. Simplify the fraction: f(0) = 1 Therefore, the value of f(0) is 1 . final: 1 apply the condition-specific input and measure the response 3 Equivalent future re-query Intervention / experimental inputObserved readout Candidate scoring | Direct-current path | Concise re-query future margin=+2.706 Candidate scoring | History-conditioned path | Concise re-query future margin=-5.714 Candidate scoring | Neutral-history control | Concise re-query future margin=+2.674 Free generation | Direct-current path | Concise re-query Output: -2 -2 -2 ... -2 -2 -2answer: -2 label=new Free generation | History-conditioned path | Concise re-query Output: 1 1 1 ... 1 1 1answer: 1 label=old Free generation | Neutral-history control | Concise re-query Output: -2 -2 -2 ... -2 -2 -2answer: -2 label=new Figure 15: An active textual shortcut recurs under equivalent re-query. After the image changes, InternVL2-8B receives the same concise future question under three histories. The direct-current and neutral-history paths favor the current answer, whereas the active stale-history path favors the prior answer in both candidate scoring and free generation. Holding the future query fixed illustrates the main-paper distinction: answer recurrence is strong while the shortcut remains active, and is not explained by a generic extra-turn effect. Qwen3-VL-32B-Thinking | MathVista_MINI #592 1 Prior observation counterfactual image and shared query Prior imageIQueryQ What is the global maximum of this function? prior answer: 3current target: 4 replace the image; retain or edit the prior response 2 Current evidence and prior state shared context before the tested intervention Current imageIPrior responseR Okay, let's see. The question is asking for the global maximum of the function shown in the graph. First, I need to remember what a global maximum is. A global maximum is the highest point that the function reaches over its entire domain. So, I need to look at the graph and find the highest y-value that the function attains. Looking at the graph, the y-axis is labeled, and the function is a ... [middle omitted] ... we analyze the highest point the graph reaches. The y-axis shows that the function's peaks align with the value 3 on the vertical scale. The graph does not exceed this value at any point, and the peaks are consistent across the domain. Thus, the global maximum is 3. Final answer: 3 final: 3 apply the condition-specific input and measure the response 3 Derived future transfer Intervention / experimental inputObserved readout Candidate scoring | Direct-current path | Derived task: double the answer derived margin=+4.062 Candidate scoring | History-conditioned path | Derived task: double the answer derived margin=-3.800 Candidate scoring | Neutral-history control | Derived task: double the answer derived margin=+3.699 Free generation | Direct-current path | Derived task: double the answer Output: Got it, let's see. First, the original problem asked for the ... max is 4, so twice is 8. Yep, that's it. 8answer: 8 label=new Free generation | History-conditioned path | Derived task: double the answer Output: Got it, let's see. First, the original question was about the ... is 3, so twice that is 6. Yep, that's correct. 6answer: 6 label=old Free generation | Neutral-history control | Derived task: double the answer Output: Got it, let's see. First, the original problem asked for the ... is 4, so twice that is 8. Yep, that's correct. 8answer: 8 label=new Figure 16: An active textual shortcut transfers a stale premise into a new computation. Qwen3-VL-32B-Thinking is asked to double the answer after the image change. The direct-current and neutral-history paths produce the current-derived target, whereas the active stale-history path produces the prior-derived target in both candidate scoring and free generation. The case illustrates the main-paper finding that active stale influence can propagate beyond answer repetition by supplying the premise for a derived operation.