Pith. sign in

REVIEW 3 major objections 39 references

Towards Synthesizing Normative Data for Cognitive Assessments Using Generative Multimodal Large Language Models

T0 review · 3 major / 0 minor · reviewed 2026-08-15 · deepseek-v4-flash

Pith's one-line read Multimodal LLMs can synthesize normative data for cognitive tests, this paper argues.

desk verdict The submitted full text is a different paper, so the abstract's claims about synthetic normative data are unverifiable from this submission. read the letter →

arxiv 2508.17675 v3 pith:R2WNIJ55 submitted 2025-08-25 cs.LG

classification cs.LG
keywords syntheticnormativedatacognitiveassessmentmultimodallargelanguagemodelspromptengineeringCookieTheftpicturedescriptiontextembeddingsBERTScoreLLM-as-a-judge
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that generative multimodal large language models can produce synthetic normative text for existing image-based cognitive assessments, removing a major bottleneck in test development. It argues that prompting strategy matters decisively: advanced prompts with contextual guidance yield synthetic responses that separate diagnostic groups and reflect demographic variation better than naive prompts. If the claim holds, new cognitive tests built on novel image stimuli could obtain provisional norms without expensive, slow human data collection, and existing tests could have their norms refreshed at low cost. The study is framed as a feasibility demonstration, supported by embedding-based group separability and several text-similarity metrics.

What carries the argument

The central mechanism is the contrast between two prompting strategies applied to image-to-text generation: naive prompts containing basic instructions and advanced prompts enriched with contextual guidance about the task and its expected response patterns. The argument is carried by embedding-based analysis: generated responses are mapped into a vector space, and the degree to which those vectors separate diagnostic groups and demographic subgroups serves as the operational proxy for normative quality. Supporting machinery includes BLEU, ROUGE, and BERTScore for text similarity and an LLM-as-a-judge setup for holistic quality assessment.

What would settle it

Collect real human Cookie Theft descriptions with known diagnoses and demographic labels, generate synthetic responses under the advanced prompting strategy, and compare diagnostic-group separation in embedding space against the human data. If the synthetic groups separate in directions that do not match human group differences, or if apparent demographic variation in synthetic responses is only surface wording, the central feasibility claim fails.

Watch

Extended reading notes

Core claim

Using GPT-4o and GPT-4o-mini on the Cookie Theft picture description task, the paper claims that the quality of synthetic normative data is driven less by model scale than by how the model is prompted. Advanced prompting, enriched with contextual guidance about the assessment and expected response patterns, produced synthetic responses that more clearly separated diagnostic groups and captured more demographic diversity than naive prompting. The paper also reports that BERTScore tracked contextual similarity better than BLEU for these creative, open-ended responses, and that an LLM-as-a-judge evaluation offered preliminary but promising validation. The overarching claim is that generative multimodal LLMs, guided by refined prompting, can feasibly generate robust synthetic normative data for existing cognitive tests, thereby laying groundwork for developing novel image-based cognitive assessments without the traditional limitations of norm collection.

Load-bearing premise

The whole result rests on assuming that measuring how similar generated responses are to each other in a mathematical embedding space tells us the same thing as measuring real patients' response patterns, so that when the generated responses of two diagnostic groups separate, that separation is clinically real.

Editorial extensions

If this is right

  • New image-based cognitive tests could generate provisional normative text within days instead of months, removing the recruitment bottleneck that currently limits test development.
  • Prompt design becomes a primary quality lever for synthetic norms, meaning careful contextual instructions matter at least as much as model choice.
  • BERTScore could serve as a dependable contextual-similarity metric for open-ended clinical language, while BLEU should not be trusted for creative outputs.
  • As generative models improve, normative data for existing tests could be regenerated and updated without repeating costly human collection.
  • A validation workflow for future tests would follow naturally: generate, embed, and check diagnostic-group separability before any clinical use.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A reader should test whether embedding separability in synthetic responses actually tracks clinically meaningful differences by comparing against real human response distributions, since separability in vector space is not the same as clinical validity.
  • Demographic variation in synthetic norms may reflect stereotypes present in training data rather than true population structure, so subgroup calibration would need explicit handling before practical deployment.
  • A direct extension would be to measure distributional distance between synthetic and human embeddings on the same stimulus; if they diverge, improved prompting alone would not close the gap.
  • The same generate-and-embed pipeline could be applied to other norm-scarce open-ended clinical tasks, such as verbal fluency descriptions or autobiographical recall, where the cost of human norm collection is similarly prohibitive.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 0 minor

Summary. The manuscript (arXiv:2508.17675) is presented as a study of generating synthetic normative data for cognitive assessments using multimodal LLMs (GPT-4o and GPT-4o-mini), focusing on the Cookie Theft picture description task. The abstract reports qualitative findings about two prompting strategies, embedding-based separability of diagnostic groups, and standard text-generation metrics. However, the supplied full text is an unrelated security paper, 'Attacking LLMs and AI Agents: Advertisement Embedding Attacks Against Large Language Models' (arXiv:2508.17674v2), which describes prompt- and model-distribution attacks on LLMs. The full text contains no methods, datasets, experiments, or results supporting the abstract's claims.

Significance. If the claimed study were present in proper form, it would address a real bottleneck in cognitive assessment—the cost of collecting normative data—by proposing a generative-model-based proxy, and it would introduce a concrete evaluation methodology (embeddings plus standard metrics). The potential significance of that idea is real, but the submitted document does not allow any assessment of it: the evidence base is entirely absent. The manuscript therefore cannot be considered a contribution to the cognitive-assessment literature in its current form.

major comments (3)
  1. [Full text (entire document)] The body of the manuscript is a different paper: its running head reads 'arXiv:2508.17674v2 [cs.CR]' and it is titled 'Attacking LLMs and AI Agents: Advertisement Embedding Attacks Against Large Language Models.' None of the components named in the abstract—Cookie Theft, GPT-4o/GPT-4o-mini, naive versus advanced prompting, diagnostic-group separability in embedding space, BLEU/ROUGE/BERTScore, LLM-as-a-judge, or human normative samples—appears in the full text. The central claim of the abstract is therefore completely unsupported by the submitted document.
  2. [Abstract] The abstract's concluding statement that the study 'demonstrates' feasibility is not backed by any numeric result, sample size, effect size, error bar, or human validation in the abstract itself; the only evidence cited is qualitative ('more effectively distinguished,' 'higher realism and diversity'), which is insufficient to establish the claim.
  3. [Abstract (evaluation design)] Even taken on its own terms, the evaluation protocol described in the abstract has a self-referential component: the LLM-as-a-judge evaluator and the generator come from the same model family (GPT-4o), and the diagnostic-group separability is computed from embeddings of synthetic responses without comparison to an external clinical ground truth. Without the actual methods and validation details, these design risks cannot be resolved.

Circularity Check

0 steps flagged · score 0.0 of 10

No circular derivation found; the submitted full text is a different paper, so the abstract's claim is unsupported rather than circular.

full rationale

The abstract claims a study of GPT-4o and GPT-4o-mini generating synthetic normative responses for the Cookie Theft picture description task, evaluated with BLEU, ROUGE, BERTScore, embeddings, and LLM-as-a-judge. The full text supplied is a different manuscript: it is arXiv:2508.17674v2, titled 'Attacking LLMs and AI Agents: Advertisement Embedding Attacks Against Large Language Models,' and it contains no Cookie Theft data, no GPT-4o/GPT-4o-mini generation experiments, no BLEU/ROUGE/BERTScore results, no diagnostic-group separability analysis, and no prompting-strategy comparison. Because the manuscript body contains none of the claimed methods or results, there is no derivation chain to audit for circularity: there are no equations, no fitted parameters renamed as predictions, no load-bearing self-citations, and no ansatz smuggled in via citation. The mismatch is a serious integrity and completeness problem, and it means the abstract's central feasibility claim lacks evidentiary support in the submitted text, but unsupported is not the same as circular. Under the circularity rubric, which requires quoting a specific reduction such as an equation being identical to its input by construction or a fitted parameter being relabeled as a prediction, no such step can be exhibited here. The reader's concern about the same-model-family LLM-as-a-judge evaluation and embedding-based separation lacking external ground truth is a substantive validity concern, but it cannot be scored as circularity in this submission because the described evaluation is absent from the provided full text. Therefore the honest finding is no circularity, score 0.

Assumptions & free parameters 0 free parameters · 2 assumptions · 0 invented entities

Abstract-only assessment: the two domain assumptions above are the main unproven inputs. No free parameters or invented entities are described.

assumptions (2)
  • domain assumption GPT-4o and GPT-4o-mini can produce picture-description text statistically similar to human normative responses.
    The entire feasibility claim depends on this representativeness.
  • domain assumption Embedding distances on generated text capture the diagnostic and demographic dimensions of interest.
    Used to support the claim that advanced prompts yield better group separation.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Towards Synthesizing Normative Data for Cognitive Assessments Using Generative Multimodal Large Language Models." pith.science (2026). https://pith.science/paper/R2WNIJ55

@misc{pith2026250817675,
  author       = {Pith},
  title        = {Pith review of: Towards Synthesizing Normative Data for Cognitive Assessments Using Generative Multimodal Large Language Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/R2WNIJ55}},
  note         = {Machine review of arXiv:2508.17675}
}
read the original abstract

Cognitive assessments require normative data as essential benchmarks for evaluating individual performance. Hence, developing new cognitive tests based on novel image stimuli is challenging due to the lack of readily available normative data. Traditional data collection methods are costly, time-consuming, and infrequently updated, limiting their practical utility. Recent advancements in generative multimodal large language models (MLLMs) offer a new approach to generate synthetic normative data from existing cognitive test images. We investigated the feasibility of using MLLMs, specifically GPT-4o and GPT-4o-mini, to synthesize normative textual responses for established image-based cognitive assessments, such as the "Cookie Theft" picture description task. Two distinct prompting strategies-naive prompts with basic instructions and advanced prompts enriched with contextual guidance-were evaluated. Responses were analyzed using embeddings to assess their capacity to distinguish diagnostic groups and demographic variations. Performance metrics included BLEU, ROUGE, BERTScore, and an LLM-as-a-judge evaluation. Advanced prompting strategies produced synthetic responses that more effectively distinguished between diagnostic groups and captured demographic diversity compared to naive prompts. Superior models generated responses exhibiting higher realism and diversity. BERTScore emerged as the most reliable metric for contextual similarity assessment, while BLEU was less effective for evaluating creative outputs. The LLM-as-a-judge approach provided promising preliminary validation results. Our study demonstrates that generative multimodal LLMs, guided by refined prompting methods, can feasibly generate robust synthetic normative data for existing cognitive tests, thereby laying the groundwork for developing novel image-based cognitive assessments without the traditional limitations.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

39 extracted references · 18 canonical work pages

  1. [1]

    Language models are few-shot learners,

    T. Brown, B. Mann, N. Ryder, M. Subbiah, J. D. Kaplan, P. Dhariwal, A. Neelakantan, P. Shyam, G. Sastry, A. Askellet al., “Language models are few-shot learners,”Advances in neural information processing systems, vol. 33, pp. 1877–1901, 2020

  2. [2]

    On the opportunities and risks of foundation models,

    R. Bommasani, D. A. Hudson, E. Adeli, R. Altman, S. Arora, S. von Arx, M. S. Bernstein, J. Bohg, A. Bosselut, E. Brunskillet al., “On the opportunities and risks of foundation models,”arXiv preprint arXiv:2108.07258, 2021

  3. [3]

    Sparks of artificial general intelligence: Early experiments with gpt-4,

    S. Bubeck, V . Chandrasekaran, R. Eldan, J. Gehrke, E. Horvitz, E. Kamar, P. Lee, Y . T. Lee, Y . Li, S. Lundberget al., “Sparks of artificial general intelligence: Early experiments with gpt-4,”arXiv preprint arXiv:2303.12712, 2023

  4. [4]

    Llama: Open and efficient foundation language models,

    H. Touvron, T. Lavril, G. Izacard, X. Martinet, M.-A. Lachaux, T. Lacroix, B. Rozière, N. Goyal, E. Hambro, F. Azharet al., “Llama: Open and efficient foundation language models,”arXiv preprint arXiv:2302.13971, 2023

  5. [5]

    Soull- mate: An application enhancing diverse mental health support with adaptive llms, prompt engineering, and rag techniques,

    Q. Guo, J. Tang, W. Sun, H. Tang, Y . Shang, and W. Wang, “Soull- mate: An application enhancing diverse mental health support with adaptive llms, prompt engineering, and rag techniques,”arXiv preprint arXiv:2410.16322, 2024

  6. [6]

    Soullmate: An adaptive llm-driven system for advanced mental health support and assessment, based on a systematic application survey,

    Q. Guo, J. Tang, W. Sun, H. Tang, Y . Shang, and W. Wang, “Soullmate: An adaptive llm-driven system for advanced mental health support and assessment, based on a systematic application survey,”arXiv preprint arXiv:2410.11859, 2024

  7. [7]

    A layered multi-expert framework for long-context mental health assessments,

    J. Tang, Q. Guo, W. Sun, and Y . Shang, “A layered multi-expert framework for long-context mental health assessments,”arXiv preprint arXiv:2501.13951, 2025

  8. [8]

    Advancing mental health pre-screening: A new custom gpt for psychological distress assessment,

    J. Tang and Y . Shang, “Advancing mental health pre-screening: A new custom gpt for psychological distress assessment,” in2024 IEEE 6th International Conference on Cognitive Machine Intelligence (CogMI). IEEE, 2024, pp. 162–171

Show all 39 references
  1. [9]

    Chatdoctor: A medical chat model fine-tuned on a large language model meta-ai (llama) using medical domain knowledge,

    Y . Li, Z. Li, K. Zhang, R. Dan, S. Jiang, and Y . Zhang, “Chatdoctor: A medical chat model fine-tuned on a large language model meta-ai (llama) using medical domain knowledge,”Cureus, vol. 15, no. 6, p. e40895, 2023

  2. [10]

    Llm online spatial-temporal signal reconstruction under noise,

    Y . Yan, D. Qin, and E. E. Kuruoglu, “Llm online spatial-temporal signal reconstruction under noise,”arXiv preprint arXiv:2411.15764, 2024

  3. [11]

    Explaining and harnessing adversarial examples,

    I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,”arXiv preprint arXiv:1412.6572, 2014

  4. [12]

    Badnets: Identifying vulnera- bilities in the machine learning model supply chain,

    T. Gu, B. Dolan-Gavitt, and S. Garg, “Badnets: Identifying vulnera- bilities in the machine learning model supply chain,”arXiv preprint arXiv:1708.06733, 2017

  5. [13]

    Membership inference attacks against machine learning models,

    R. Shokri, M. Stronati, C. Song, and V . Shmatikov, “Membership inference attacks against machine learning models,” in2017 IEEE symposium on security and privacy (SP). IEEE, 2017, pp. 3–18

  6. [14]

    Stealing machine learning models via prediction APIs,

    F. Tramèr, F. Zhang, A. Juels, M. K. Reiter, and T. Ristenpart, “Stealing machine learning models via prediction APIs,” in25th USENIX Security Symposium (USENIX Security 16). Austin, TX: USENIX Association, 2016, pp. 601–618

  7. [15]

    Weight poisoning attacks on pre-trained models,

    K. Kurita, P. Michel, and G. Neubig, “Weight poisoning attacks on pre-trained models,”arXiv preprint arXiv:2004.06660, 2020

  8. [16]

    Huynh and J

    D. Huynh and J. Hardouin. (2023, Jul) Poisongpt: How we hid a lobotomized llm on hugging face to spread fake news. Accessed 15 Jul 2025

  9. [17]

    Poisonprompt: Backdoor attack on prompt- based large language models,

    H. Yao, J. Lou, and Z. Qin, “Poisonprompt: Backdoor attack on prompt- based large language models,” inICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 2024, pp. 7745–7749

  10. [18]

    Sleeper agents: Training deceptive llms that persist through safety training,

    E. Hubinger, C. Denison, J. Mu, M. Lambert, M. Tong, M. MacDiarmid, T. Lanham, D. M. Ziegler, T. Maxwell, N. Chenget al., “Sleeper agents: Training deceptive llms that persist through safety training,” arXiv preprint arXiv:2401.05566, 2024

  11. [19]

    Membership inference attacks on machine learning: a survey,

    H. Hu, Z. Salcic, L. Sun, G. Dobbie, P. S. Yu, and X. Zhang, “Membership inference attacks on machine learning: a survey,”ACM Computing Surveys, vol. 54, no. 11s, pp. 1–37, 2022

  12. [20]

    A survey on membership inference attacks and defenses in machine learning,

    J. Niu, P. Liu, X. Zhu, K. Shen, Y . Wang, H. Chi, Y . Shen, X. Jiang, J. Ma, and Y . Zhang, “A survey on membership inference attacks and defenses in machine learning,”Journal of Information and Intelligence, vol. 2, no. 5, pp. 404–454, 2024

  13. [21]

    I know what you trained last summer: A survey on stealing machine learning models and defences,

    D. Oliynyk, R. Mayer, and A. Rauber, “I know what you trained last summer: A survey on stealing machine learning models and defences,” ACM Computing Surveys, vol. 55, no. 14s, pp. 1–41, 2023

  14. [22]

    Sok: All you need to know about on-device ml model extraction-the gap between research and practice,

    T. Nayan, Q. Guo, M. Al Duniawi, M. Botacin, S. Uluagac, and R. Sun, “Sok: All you need to know about on-device ml model extraction-the gap between research and practice,” in33rd USENIX Security Symposium (USENIX Security 24). USENIX Association, 2024, pp. 5233–5250

  15. [23]

    Intriguing properties of neural networks,

    C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus, “Intriguing properties of neural networks,”arXiv preprint arXiv:1312.6199, 2013

  16. [24]

    Robust physical-world attacks on deep learning visual classification,

    K. Eykholt, I. Evtimov, E. Fernandes, B. Li, A. Rahmati, C. Xiao, A. Prakash, T. Kohno, and D. Song, “Robust physical-world attacks on deep learning visual classification,”Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 1625–1634, 2018

  17. [25]

    Darts: Deceiving autonomous cars with toxic signs,

    C. Sitawarin, A. N. Bhagoji, A. Mosenia, M. Chiang, and P. Mittal, “Darts: Deceiving autonomous cars with toxic signs,”arXiv preprint arXiv:1802.06430, 2018

  18. [26]

    Trojaning attack on neural networks,

    Y . Liu, S. Ma, Y . Aafer, W.-C. Lee, J. Zhai, W. Wang, and X. Zhang, “Trojaning attack on neural networks,” inProceedings of the 2018 Network and Distributed System Security Symposium, 2018

  19. [27]

    Targeted backdoor attacks on deep learning systems using data poisoning,

    X. Chen, C. Liu, B. Li, K. Lu, and D. Song, “Targeted backdoor attacks on deep learning systems using data poisoning,”arXiv preprint arXiv:1712.05526, 2017

  20. [28]

    The secret sharer: Evaluating and testing unintended memorization in neural networks,

    N. Carlini, C. Liu, Ú. Erlingsson, J. Kos, and D. Song, “The secret sharer: Evaluating and testing unintended memorization in neural networks,” in 28th USENIX security symposium (USENIX security 19), 2019, pp. 267– 284

  21. [29]

    Scalable extraction of training data from (production) language models,

    M. Nasr, N. Carlini, J. Hayase, M. Jagielski, A. F. Cooper, D. Ippolito, C. A. Choquette-Choo, E. Wallace, F. Tramèr, and K. Lee, “Scalable extraction of training data from (production) language models,”arXiv preprint arXiv:2311.17035, 2023

  22. [30]

    A survey on evaluation of large language models,

    Y . Chang, X. Wang, J. Wang, Y . Wu, L. Yang, K. Zhu, H. Chen, X. Yi, C. Wang, Y . Wanget al., “A survey on evaluation of large language models,”ACM transactions on intelligent systems and technology, vol. 15, no. 3, pp. 1–45, 2024

  23. [31]

    Universal and transferable adversarial attacks on aligned language models,

    A. Zou, Z. Wang, N. Carlini, M. Nasr, J. Z. Kolter, and M. Fredrikson, “Universal and transferable adversarial attacks on aligned language models,”arXiv preprint arXiv:2307.15043, 2023

  24. [32]

    Adversarial training for large neural language models,

    X. Liu, H. Cheng, P. He, W. Chen, Y . Wang, H. Poon, and J. Gao, “Adversarial training for large neural language models,”arXiv preprint arXiv:2004.08994, 2020

  25. [33]

    Jailbroken: How does llm safety training fail?

    A. Wei, N. Haghtalab, and J. Steinhardt, “Jailbroken: How does llm safety training fail?”Advances in Neural Information Processing Systems, vol. 36, pp. 80 079–80 110, 2023

  26. [34]

    Jailbreaking chatgpt via prompt engineering: An empirical study,

    Y . Liu, G. Deng, Z. Xu, Y . Li, Y . Zheng, Y . Zhang, L. Zhao, T. Zhang, K. Wang, and Y . Liu, “Jailbreaking chatgpt via prompt engineering: An empirical study,”arXiv preprint arXiv:2305.13860, 2023

  27. [35]

    Not what you’ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injection,

    K. Greshake, S. Abdelnabi, S. Mishra, C. Endres, T. Holz, and M. Fritz, “Not what you’ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injection,” inProceedings of the 16th ACM workshop on artificial intelligence and security, 2023, pp. 79–90

  28. [36]

    Online display ad- vertising markets: A literature review and future directions,

    H. Choi, C. F. Mela, S. R. Balseiro, and A. Leary, “Online display ad- vertising markets: A literature review and future directions,”Information systems research, vol. 31, no. 2, pp. 556–575, 2020

  29. [37]

    The dark alleys of madison avenue: Understanding malicious advertisements,

    A. Zarras, A. Kapravelos, G. Stringhini, T. Holz, C. Kruegel, and G. Vigna, “The dark alleys of madison avenue: Understanding malicious advertisements,” inProceedings of the 2014 Conference on Internet Measurement Conference, 2014, pp. 373–380

  30. [38]

    How to backdoor federated learning,

    E. Bagdasaryan, A. Veit, Y . Hua, D. Estrin, and V . Shmatikov, “How to backdoor federated learning,” inInternational Conference on Artificial Intelligence and Statistics. PMLR, 2019, pp. 2938–2948

  31. [39]

    Badnl: Backdoor attacks against nlp models with semantic- preserving improvements,

    X. Chen, A. Salem, D. Chen, M. Backes, S. Ma, Q. Shen, Z. Wu, and Y . Zhang, “Badnl: Backdoor attacks against nlp models with semantic- preserving improvements,” inProceedings of the 37th Annual Computer Security Applications Conference, 2021, pp. 554–569

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.