ArXiv: 2605.05185

🎯 Pitch

Standard multimodal search agent training struggles because a single tool failure poisons entire trajectories, but OpenSearch-VL salvages these failures with a fatal-aware RL algorithm that masks post-failure tokens while reinforcing the useful reasoning before things went wrong. Paired with a Wikipedia pipeline that sabotages shortcut retrieval strategies, this open-source recipe boosts average benchmark performance by over 10 points and rivals proprietary models.

1. Executive Summary

This paper introduces OpenSearch-VL, a fully open-source recipe for training frontier multimodal deep search agents that combines a Wikipedia-based data curation pipeline, a diverse tool environment spanning retrieval and visual enhancement, and a multi-turn fatal-aware GRPO training algorithm (masking post-failure tokens while preserving useful pre-failure reasoning through one-sided advantage clamping). Built on Qwen3-VL models and evaluated across seven multimodal knowledge-intensive benchmarks (SimpleVQA, VDR, MMSearch, LiveVQA, BrowseComp-VL, FVQA, InfoSeek), OpenSearch-VL delivers over 10-point average improvements—for example, lifting Qwen3-VL-30B-A3B from 47.8 to 61.6 average score—and achieves results comparable to proprietary commercial models on several tasks. The gains are driven by three synergistic components: source-anchor visual grounding that suppresses single-hop retrieval shortcuts (anchoring the visual entry point at the path source rather than the answer entity), fuzzy entity rewriting that forces genuine multi-hop reasoning (replacing entity names with relational descriptors verified for uniqueness), and the fatal-aware GRPO objective with one-sided advantage clamping that selectively reinforces viable prefixes from otherwise failed trajectories, establishing that agentic reinforcement learning can yield robust long-horizon search behavior with multimodal tool use even when cascading tool failures are common.

2. Context and Motivation

The Core Problem: We Cannot Reproduce Frontier Multimodal Search Agents

The fundamental problem this paper addresses is deceptively simple: frontier multimodal search agents exist, but no one outside a handful of well-funded commercial labs can build them. This is not a problem of algorithmic mystery—the community broadly understands the components needed (planning, tool use, retrieval, reinforcement learning)—but rather a problem of missing infrastructure: training data, synthesis pipelines, tool environments, and training recipes are predominantly proprietary.

The paper frames this as a reproducibility crisis specific to multimodal agentic search (Section 1):

"However, frontier multimodal search agents remain difficult to reproduce, as their training data, code are often proprietary or insufficiently disclosed (Huang et al., 2026; Seed, 2026; Singh et al., 2025; Team, 2026b). As a result, the community still lacks a fully open recipe for building, analyzing, and improving strong multimodal search agents."

This gap matters for several reasons that go beyond academic curiosity. First, scientific progress requires independent verification and iteration—when only commercial entities can reproduce results, the field cannot systematically test hypotheses about what drives agentic search performance. Second, the strongest systems remain inaccessible to most researchers and practitioners, creating a capability asymmetry that limits innovation outside large labs. Third, without open training data, it is impossible to study which data properties are essential for agentic search behavior (e.g., how important is multi-hop reasoning in training? What role does image quality variation play?).

The Data Bottleneck Is the Central Obstacle

Among the missing components, the paper identifies high-quality training data as the primary bottleneck (Section 1):

"Among these missing components, high-quality training data is a central bottleneck. The strongest frontier systems are still largely dominated by well-funded commercial corporations (Comanici et al., 2025; Team, 2025b), where the data sources, filtering criteria, expert demonstrations, and tool-use trajectories are typically kept private."

This bottleneck is particularly severe in multimodal settings. While text-only agent training has seen progress with open datasets (e.g., for web navigation or code generation), multimodal agentic search introduces qualitatively harder data requirements. Effective training data must capture:

  • Image-grounded understanding: The agent must learn to perceive visual content (reading text in images, identifying entities, assessing image quality) before deciding how to search.
  • Multi-hop retrieval: Questions that require chaining multiple searches across modalities—identifying a visual entity via image search, then using its name for a text search, then verifying facts across retrieved documents.
  • Evidence verification: The agent must learn when retrieved information is sufficient, conflicting, or requires cross-referencing.
  • Long-horizon tool use: Trajectories spanning 5–10+ tool invocations, with the agent deciding when to crop, enhance, search, or answer.

Prior data construction approaches for multimodal agents typically rely on prompting VLMs on single images to generate questions (Geng et al., 2025; Huang et al., 2026). The paper argues this yields shallow queries:

"Directly prompting a VLM on an image tends to yield shallow, perception-level queries that can be resolved in a single forward pass" (Section 3.1).

In other words, when a VLM sees an image and is asked to generate a question about it, the resulting questions can typically be answered by the same VLM without tools—defeating the purpose of training a search agent. The data teaches the model to "guess" rather than "verify."

Prior Approaches and Where They Fall Short

The paper situates itself relative to several lines of prior work, each with specific limitations:

Text-Only Search Agents (Search-R1). Jin et al. (2025) demonstrated that reinforcement learning can incentivize LLMs to autonomously query search engines during reasoning, establishing the core paradigm of agentic search with RL. However, Search-R1 operates in a text-only environment—it retrieves text documents using a text query, with no visual modality. Extending this to multimodal settings requires fundamentally different training data (image-grounded questions, visual tool trajectories) and a different reward structure (since purely textual retrieval cannot handle questions like "what brand is this logo?"). The paper inherits Search-R1's theoretical framework (retrieved-token masking, GRPO with interleaved retrieval) but must build the multimodal data pipeline from scratch.

Multimodal Deep Search Agents (Vision-DeepResearch, WebWatcher, MMSearch-R1). Several recent systems have tackled multimodal agentic search directly. Huang et al. (2026) introduced Vision-DeepResearch, using RL to train visual search agents with a verifier-based reward. Geng et al. (2025) built WebWatcher with a focus on deep research over live web content. Wu et al. (2025b) developed MMSearch-R1, extending the Search-R1 paradigm to multimodal retrieval.

However, the paper identifies three critical shortcomings in these approaches (Section 6):

1. The "search-only" assumption. Existing agents assume visual inputs are pristine—clear, well-lit, properly oriented photographs. The paper argues this is unrealistic:

"In practice, when agents encounter degraded or text-dense real-world images, the 'search-only' approach fails as retrieval cannot fix fundamentally broken visual evidence."

A blurred photo, a skewed document, or a low-resolution thumbnail cannot be "searched better"—it must be fixed. Without image enhancement tools (Sharpening, Super-Resolution, Perspective Correction), the agent is limited to whatever the raw pixels provide.

2. Passive perception models. Even when systems include tools, they typically treat visual perception as a fixed preprocessing step rather than an active, learnable policy (Section 6.2):

"While RAG frameworks like VisRAG (Yu et al., 2024) emphasize preserving visual structure, they treat the model as a passive observer that must 'make do' with whatever is retrieved."

The paper argues for active perception: the agent must learn to autonomously invoke enhancement tools when needed, rather than relying on a human-written preprocessing pipeline.

3. Training instability from tool failures. This is the most technically novel gap the paper identifies. In long-horizon tool-use trajectories, agents frequently encounter cascading failures—a malformed API call, a timeout, or a repeated error that invalidates the remainder of the trajectory. Prior work handles this poorly (Section 4.2, Appendix B):

  • Hard masking (Vision-DeepResearch): Discard the entire trajectory. This wastes valid pre-failure reasoning—imagine an agent that correctly identifies an entity and issues three valid search queries before a network timeout causes a crash. The entire useful prefix is thrown away.
  • Blind training (vanilla GRPO): Train on the full rollout. This injects noisy gradients from meaningless post-failure tokens (e.g., repeated error messages, hallucinated actions), destabilizing training.

The paper's explicit diagnosis (Section 4.2):

"Standard approaches either discard the entire trajectory (Huang et al., 2026) (wasting the valid early steps) or train on it blindly (injecting noise)."

4. Shortcut-prone training data. Prior data construction methods (Geng et al., 2025; Li et al., 2025b; Wu et al., 2025a) often create questions where a single retrieval step suffices—either because the answer entity is explicitly named in the question (enabling a direct text search) or because the visual anchor is the answer entity itself (enabling a reverse image lookup that directly returns the answer). The paper's running example (Appendix D.2) illustrates this: if the image shows the person whose citizenship date is being asked, a single ImageSearch call returns the answer. The model never learns multi-hop chaining. The paper positions its data pipeline as systematically eliminating these shortcuts.

How the Paper Positions Itself

The paper frames its contribution not as proposing new algorithms or architectures, but rather as providing the missing open infrastructure for a known but inaccessible paradigm. Its positioning is explicitly "open recipe" rather than "novel method" (Section 1):

"In this work, we introduce OpenSearch-VL, a fully open recipe for training frontier multimodal deep search agents with agentic RL."

This framing matters because it changes what counts as a contribution. The paper is not claiming to invent multi-hop search, RL for tool use, or visual enhancement—all exist in prior work. Instead, it claims to be the first to package these components into a reproducible, open-source pipeline with complete training data, tool definitions, and training code. The novelty lies in the integration and the specific design choices that make the pipeline work.

Within this recipe, the paper identifies three axes of contribution that directly counter the gaps above:

  1. Data curation that forces multi-hop behavior. The source-anchor visual grounding, fuzzy entity rewriting, and staged filtering (Section 3) are specifically designed to create questions where single-hop retrieval fails. The paper is not claiming these techniques are individually novel (fuzzy rewriting builds on Skywork-R1V4; Zhang et al., 2025), but rather that their systematic combination to eliminate shortcuts is novel and essential.

  2. A tool environment that enables active perception. Rather than assuming pristine inputs, the tool suite (Table 1) includes image enhancement tools (Sharpen, SuperResolution, PerspectiveCorrect) alongside retrieval tools. The paper argues this creates a more realistic and robust agent that learns to repair evidence before searching (Section 3.2: "think-with-image behavior"). This is positioned as a departure from retrieval-only multimodal agents.

  3. A training algorithm that handles cascading failures. The fatal-aware GRPO objective with one-sided advantage clamping (Section 4.2) is the paper's most technically novel contribution. It extends GRPO (Shao et al., 2024) and Search-R1 (Jin et al., 2025) to account for the reality of tool-call errors, selectively preserving gradients from viable prefixes while zeroing out harmful post-failure noise. The paper formalizes this as a dominance result (Appendix B.2): the approach strictly dominates hard-masking in gradient informativeness, recovering useful learning signal from partially successful trajectories.

The Practical Stakes

Beyond the technical gaps, the paper implicitly addresses a practical deployment challenge. Real-world visual inputs are frequently degraded: photographs taken in poor lighting, screenshots with low resolution, scanned documents with perspective distortion. A search agent that cannot handle these inputs is not deployable in production settings. The paper's emphasis on active perception—autonomously sharpening, upscaling, or rectifying images before searching—is motivated by this realism, not just academic completeness.

Furthermore, the paper's focus on fatal-error handling has direct practical implications. In any deployment using external APIs (search engines, OCR services), transient failures are inevitable—network timeouts, rate limiting, malformed responses. An agent that catastrophically degrades under these conditions is unreliable. By designing the training objective to be robust to partial failures—and even to learn from them—the paper addresses a practical robustness requirement that commercial systems must satisfy but that existing open agents largely ignore.

Summary of the Contribution Space

To situate the paper precisely: it is not the first multimodal search agent, not the first use of RL for search, and not the first tool-augmented VLM. It is, however, the first to provide:

  • A complete open pipeline (data → tools → code → models) that anyone can reproduce;
  • A data curation methodology that systematically eliminates shortcuts, validated through ablation (Table 3a);
  • A training objective that addresses the practical reality of cascading tool failures, with formal justification and empirical evidence (Table 3b, Figures 3–5);
  • A unified tool environment that treats visual enhancement and retrieval as equally learnable skills within an interleaved action space.

The paper's value proposition is that these four components, properly integrated, enable open models to achieve performance competitive with proprietary commercial systems—a claim it backs with results across seven benchmarks (Table 2).

3. Technical Approach

3.1 Reader Orientation

OpenSearch-VL is an end-to-end training recipe—not a single model or algorithm—that produces multimodal agents capable of answering visually-grounded questions by interleaving reasoning with tool calls (image enhancement, OCR, web search, image search) over multiple turns. It solves the problem of training robust search agents from open data by systematically constructing multi-hop training questions that cannot be shortcut with single retrievals, surrounding them with diverse visual perception and enhancement tools, and introducing a reinforcement learning objective that selectively learns from partially successful trajectories where cascading tool failures occur mid-rollout.

3.2 Big-Picture Architecture (Diagram in Words)

The OpenSearch-VL recipe has three independent but interlocking components, arranged in a pipeline:

  1. Data Curation Pipeline (Section 3): Takes Wikipedia's hyperlink graph as input and produces two datasets—36K expert-demonstration trajectories (SFT training) and 8K filtered VQA instances (RL prompts). The pipeline applies four techniques to force multi-hop reasoning: path sampling from Wikipedia, fuzzy entity rewriting, source-anchor visual grounding, and staged difficulty filtering. An additional 10% subset introduces image degradations (blur, low resolution, perspective skew) paired with enhancement tools to teach active perception.

  2. Tool Environment (Section 2, Table 1): A unified action space of seven tools spanning three categories—retrieval (TextSearch for web search with summarization, ImageSearch for reverse image/visual entity lookup), image enhancement (Sharpen, SuperResolution, PerspectiveCorrect), and attention & parsing (Crop for region isolation, OCR for layout-aware document parsing). The environment returns multimodal observations: text for retrieval and OCR results, images for visual tools.

  3. Training Pipeline (Section 4): Two sequential stages. First, supervised fine-tuning (SFT) on the 36K expert trajectories using standard autoregressive next-token prediction over policy-emitted tokens only (masking out environment observations). Second, multi-turn fatal-aware GRPO (reinforcement learning) where the agent explores against the real environment, receives a composite reward (format × accuracy × query quality), and gradients are restricted to viable trajectory prefixes using fatal-step detection and one-sided advantage clamping.

Information flows as: Wikipedia graph → path sampling → canonical QA → fuzzy rewriting → image grounding → quality filtering → expert trajectory synthesis (Claude Opus 4.6) → SFT → RL with environment interactions → deployed agent.

3.3 Roadmap for the Deep Dive

  • First, the data curation pipeline (Section 3): This is the foundation—everything else depends on having high-quality, tool-demanding training instances. I will walk through Wikipedia path sampling (which defines multi-hop question structure), fuzzy entity rewriting (which eliminates text-search shortcuts), source-anchor visual grounding (which eliminates image-search shortcuts), staged filtering (which removes tool-independent examples), and trajectory synthesis (which converts QA pairs into multi-turn demonstrations).

  • Second, the tool environment (Section 2, formalized in Sec. 4.2): Understanding what actions the agent can take is prerequisite to understanding the training objectives. I will detail each tool's input/output, its operational role in trajectories, and why the enhancement tools matter beyond the retrieval tools.

  • Third, supervised fine-tuning (Section 4.1): The standard baseline training stage that instills fundamental tool-use behaviors from expert demonstrations. I will explain the autoregressive factorization, the generation mask that excludes observations, and why SFT alone is insufficient.

  • Fourth, the reinforcement learning stage (Section 4.2): The most technically novel component. I will work through the composite reward design (why three components, why multiplicative format gate), fatal-step detection (the consecutive-error counter), fatal-aware token masking (extending the SFT mask to post-failure tokens), one-sided advantage clamping (the formal guarantee that valid prefixes are never penalized), and the final GRPO objective integrating all of these.

3.4 Detailed, Sentence-Based Technical Breakdown

This is primarily a systems + data engineering paper whose core idea is that frontier multimodal search agents can be reproduced with open components if three things are done right: (1) training data is constructed to force genuine multi-hop tool use by systematically eliminating shortcuts, (2) the tool environment includes active perception primitives alongside retrieval, and (3) the RL objective accounts for cascading tool failures by selectively preserving gradients from viable trajectory prefixes.

3.4.1 Wikipedia Path Sampling: Constructing Multi-Hop Question Templates

The data curation pipeline begins with Wikipedia modeled as a directed graph $G = (V, E)$ where nodes are articles and edges are in-article hyperlinks. From this graph, the paper samples constrained random walks to produce question templates with explicit functional roles for each node along the path.

Path sampling procedure:

A walk of length $h \in \{2, 3, 4\}$ starts from a seed node $v_0$ and produces a path:

P=(v0→ρ1v1→ρ2⋯→ρhvh)P = \left(v_0 \xrightarrow{\rho_1} v_1 \xrightarrow{\rho_2} \cdots \xrightarrow{\rho_h} v_h\right)

where $v_0$ is the anchor node (visual entry point—later replaced by an image), $v_1, \ldots, v_{h-1}$ are bridge nodes (intermediate entities whose names will be fuzzified), $v_h$ is the answer node (source of the target attribute), and each $\rho_j$ is the relation induced by the hyperlink's anchor text connecting $v_{j-1}$ to $v_j$.

What it computes: A structured multi-hop chain of entities connected by explicit relations, where each node has a designated functional role in the eventual question. For the running example (Appendix D.2): Australia_Zoo (anchor) → Steve_Irwin (bridge, relation: "managed by") → Terri_Irwin (answer, relation: "spouse of"). The seed is Australia_Zoo, the bridge is Steve_Irwin, the answer source is Terri_Irwin, and the relations are "managed by" and "spouse of."

Why this form: Multi-hop reasoning requires the agent to traverse intermediate entities—identifying Australia_Zoo from the image, learning it was managed by Steve_Irwin, and then discovering Steve_Irwin's spouse to reach Terri_Irwin. If any node's identity were directly available (e.g., if the question named Terri_Irwin explicitly), the agent could skip all intermediate reasoning with a single text search. The path structure enforces that each hop requires non-trivial inference.

Constraints on sampling (Appendix D.1): To ensure paths produce viable questions, the walk applies several filters:

  • Hub avoidance: Nodes with in-degree exceeding $\tau_{\text{hub}} = 10,000$ are skipped (rejecting ~0.03% of articles: continent, country, and century-level pages like United_States, Queensland, 21st_century). For these hubs, the uniqueness invariant (required in the rewriting stage) is routinely violated because thousands of entities satisfy relations like "located in Queensland."
  • Namespace filtering: Disambiguation pages (titles containing "(disambiguation)"), list pages (List of, Outline of, Index of, Timeline of), and non-article namespaces (Template:, Category:, File:, User:, Help:, Portal:, Wikipedia:) are excluded.
  • Redirect resolution: Each outgoing link is dereferenced to its target article, with the exclusion rules applied to the dereferenced target (not the surface link).
  • Cycle avoidance: The walk cannot revisit nodes already in the path.

Seed selection: Seeds are drawn by stratified sampling across five coarse domains—Person, Building/Place, Location (non-hub), Organism, and Artifact—to balance visual groundability. A node is eligible as seed only if it (i) exposes an infobox, (ii) links to at least one Wikimedia Commons image of resolution ≥ 512 × 512, and (iii) has in-degree in [50, $\tau_{\text{hub}}$], ensuring the seed is neither a dead end nor a hub.

Path length distribution: Sampled as $h \sim \text{Categorical}(\{2, 3, 4\}; (0.4, 0.4, 0.2))$. Shorter paths (40% each for length 2 and 3) are favored because walks longer than 4 hops rarely survive the uniqueness and non-leakage checks of the rewriting stage (Section 3.1, Eq. 6) without heavy resampling.

Resampling protocol: A walk rooted at a fixed seed is retried up to 10 times if it (i) hits a hub or filtered namespace, (ii) fails to produce a descriptor for any bridge that survives the uniqueness evaluator, or (iii) terminates at an answer node whose infobox contains no attribute meeting the six-token length bound. Seeds exhausting all attempts are dropped.

Canonical question generation: From the answer node $v_h$, a short, unambiguous answer $a$ is extracted (e.g., "20 November 2009" from Terri_Irwin's citizenship date). GPT-4o is prompted to synthesize a canonical question $q_t$ that verbalizes the full path $P$ and references $v_h$ only through the queried attribute. This canonical question contains all entity names in plain text—it is a manipulable template, not a training target. For the running example: $q_t$ = "On what date did Terri Irwin, the wife of Steve Irwin—the man who took over management of Australia Zoo in 1991—become an Australian citizen?"

The canonical question $q_t$ is deliberately too easy: an agent could answer it by directly searching "Terri Irwin Australian citizenship date" without any visual reasoning. The subsequent rewriting and grounding stages transform it into a genuinely tool-demanding instance.

3.4.2 Fuzzy Entity Rewriting: Eliminating Text-Search Shortcuts

Preserving entity names in the question enables the agent to short-circuit the multi-hop chain with a single text retrieval. The paper therefore progressively rewrites entity names in $q_t$ into relational or attribute-based descriptors, producing a fuzzy counterpart $q_f$ while preserving the answer $a$.

Rewriting procedure (iterative, farthest-to-nearest): Starting from the farthest bridge $v_{h-1}$ and moving toward $v_0$, each entity name is replaced by a descriptor drawn from the entity's Wikipedia context. For $v_1 = \text{Steve\_Irwin}$, GPT-4o proposes candidates such as "the man who took over management of [the zoo] in 1991" or "the wildlife documentary host killed by a stingray in 2006." An LLM uniqueness evaluator verifies that the substitution still resolves to the intended entity conditional on the partially rewritten question.

Acceptance criteria (Eq. 6): A rewrite is accepted only when three invariants hold simultaneously:

(i) a(qf)=a(qt)(ii) ∣R(qf)∣=1(iii) (⋃j=0haliases(vj))∩qf=∅\text{(i) } a(q_f) = a(q_t) \quad \text{(ii) } |\mathcal{R}(q_f)| = 1 \quad \text{(iii) } \left(\bigcup_{j=0}^{h} \text{aliases}(v_j)\right) \cap q_f = \emptyset

where $a(\cdot)$ denotes the answer under the question (must be invariant—the rewritten question must still uniquely determine the same answer), $\mathcal{R}(q_f)$ is the set of entities compatible with $q_f$ under the evaluator's world knowledge (must be exactly one—the descriptor must uniquely identify the intended entity), and the third condition requires that no surface form or alias of any node along the path appears in $q_f$ (non-leakage—the agent cannot recover the entity name from the question text itself).

What these conditions compute: They jointly guarantee that (i) the rewritten question is answer-equivalent to the original, (ii) the rewriting did not introduce ambiguity where multiple entities could satisfy the descriptor, and (iii) the rewriting actually hid the entity—no name, alias, or variant survives in the question text. For the running example: "the man who took over management of Australia Zoo in 1991" passes the uniqueness check (Steve Irwin is uniquely identified), while "the son of the founders of Australia Zoo" fails because Bob and Lyn Irwin had three children.

Why this form: Each condition addresses a specific failure mode. Condition (i) prevents the rewriting from changing the correct answer (e.g., substituting a descriptor that points to Steve Irwin's son Robert instead of Steve). Condition (ii) prevents the rewriting from making the question unanswerable or ambiguous—if "the wildlife documentary host" resolved to both Steve Irwin and David Attenborough, the agent could not determine which one to follow. Condition (iii) prevents the rewriting from being trivially reversible—if "Steve Irwin" is replaced by "the husband of Terri Irwin" but "Terri Irwin" appears elsewhere in the question, the agent can still recover the original name. The iterative farthest-to-nearest order ensures each new descriptor is verified in the context of previously rewritten parts.

Answer obfuscation interleaving: The paper interleaves entity rewriting with occasional answer obfuscation (Huang et al., 2026) to avoid collapsing onto a stereotyped relational template. This means occasionally replacing the answer attribute description with a fuzzy version, forcing the agent to infer what is being asked in addition to who is involved.

3.4.3 Source-Anchor Visual Grounding: Eliminating Image-Search Shortcuts

Once the textual question $q_f$ is ready, the pipeline converts it into a multimodal VQA instance by grounding the anchor entity $v_0$ in a representative image $I$ and replacing its mention with a visual referring expression.

Image retrieval and selection: For the anchor $v_0$, candidate images are retrieved from Wikimedia Commons or the Wikipedia infobox. Candidates are filtered by CLIP cosine similarity to a short textual description of $v_0$ (e.g., "Australia Zoo entrance"). The top-ranked image (similarity exceeding a 0.28 threshold) is selected as $I$.

Visual referring expression substitution: The anchor mention in $q_f$ is replaced with a visual referring expression such as "the person in the image" or "the zoo in the image." The final question $q$ becomes: "On what date did the wife of the man who took over management of the zoo in the image in 1991 become an Australian citizen?" paired with the image $I$ of Australia Zoo.

Why source-anchor grounding (not answer-anchor grounding): This is the single most critical design choice in the data pipeline. Prior QA-to-VQA conversions (Geng et al., 2025; Zhang et al., 2025) typically ground the image on or near the answer entity—the image shows Terri_Irwin, and the question asks about her citizenship date. In that setting, a single ImageSearch call on the given image would return Terri_Irwin's Wikipedia page, collapsing the entire multi-hop chain into one step. By anchoring $v_0$ at the source of the path $P$ (the visual entry point farthest from the answer), the paper forces the agent to: (1) identify the visual anchor from the image, (2) traverse the intermediate textual relations, and (3) reach the answer through reasoning—none of which can be shortcut by retriving on the answer entity because the answer entity is never visually shown.

Quality control gates: Each candidate triple $(I, q, a)$ passes automatic checks for:

  • Masking: $q$ contains no entity name or alias from any node on the path (the visual anchor is replaced by a referring expression, and all bridge/answer names were fuzzified or removed).
  • Uniqueness: A GPT-4o judge given only $q$ (without $I$) returns exactly one consistent answer—the question is well-posed.
  • Visual relevance: The selected image $I$ has CLIP similarity exceeding a 0.28 threshold to the anchor description, ensuring the image is actually recognizable and useful.
  • Non-triviality: Handled jointly with staged filtering (Section 3.2)—the instance must require tools to solve.

Instances passing these checks form the Wikipedia-derived portion of the VQA pool.

3.4.4 Staged Filtering and Enhancement: Retaining Only Tool-Demanding Instances

Before synthesizing expert trajectories, the VQA pool is consolidated with three open-source multimodal corpora—LiveVQA (live entities), FVQA (commonsense fact lookup), and WebQA (open-web multi-hop reasoning)—to broaden domain coverage. The merged pool then undergoes two-stage difficulty filtering using a frozen Qwen3-VL-32B model as the filter.

Filter A (Tool-Free Model): The model attempts to answer each question without any tools (pure parametric knowledge and visual perception). Any instance where the model produces a correct answer is discarded—these questions are too easy and do not require search behavior. The rationale: if a frozen VLM can answer from its own knowledge, training an agent on this instance teaches it to rely on parametric knowledge rather than to search, defeating the purpose.

Filter B (One-Call ImageSearch): The model is given access to a single ImageSearch call and attempts to answer. Any instance solved correctly with this single retrieval is discarded—these are questions that appear multi-hop but collapse to a one-hop visual lookup. This catches cases where the image still contains sufficient information for a direct reverse-image search to reveal the answer entity, despite the source-anchor grounding.

What passes through both filters: Only instances where the answer cannot be recovered either from parametric knowledge or from a single retrieval. These are genuinely tool-demanding: the agent must chain multiple operations (identify visual anchor → text search for bridge relations → verify across documents → synthesize answer). The paper's claim is that prior data pipelines fail to apply such strict filtering, producing training data where a substantial fraction of instances are shortcut-solvable, which teaches the agent to attempt shortcuts rather than execute full search chains.

Enhancement subset (10%): To expose the agent to realistic visual imperfections, 10% of the filtered VQA pool is randomly selected for degradation. Controlled degradations are applied:

  • Blur: Gaussian blur applied to the image.
  • Downsampling: Resolution reduced to simulate low-quality thumbnails.
  • Perspective distortion: Skew applied to simulate off-angle photographs.

Each degraded instance is paired with the corresponding enhancement tool in $\mathcal{T}_v$: Sharpen for blur, SuperResolution for low resolution, PerspectiveCorrect for skew. The key design insight: the question is unchanged—the agent receives the same VQA instance but with a degraded image, and the expert trajectory (synthesized in the next stage) will include enhancement tool calls before retrieval.

Why this matters: This subset diversifies the training distribution to include image restoration as a necessary precursor to search. The paper calls this inducing "think-with-image" behavior: "when the input image is unreliable, the policy learns to repair the visual evidence before initiating retrieval" (Section 3.2). Without this subset, the agent would only encounter pristine images during training and would not learn to autonomously invoke Sharpen, SuperResolution, or PerspectiveCorrect when encountering degraded inputs at test time. This is the mechanism by which "active perception" (Section 6.2) is operationalized in training.

3.4.5 Multi-Turn Trajectory Synthesis: From VQA Instances to Expert Demonstrations

For each instance $(I, q, a)$ surviving the filters, the paper synthesizes expert trajectories by rolling out Claude Opus 4.6 (a proprietary frontier model) against the real tool environment $\mathcal{E}$, following the ReAct think-then-act convention.

Rollout procedure: Claude Opus 4.6 is prompted with the agent system prompt (Appendix E, Figure 7) and free to invoke any tool in $\mathcal{T}$. For each instance, $K = 5$ independent rollouts are drawn. Each rollout is formatted as a multi-turn trajectory $\tau$ (Eq. 2) interleaving reasoning traces ( thinking blocks), tool invocations (<tool_call> blocks), and environment observations (text or images, depending on the tool). The rollout terminates when the model emits a final <response> block.

Rejection sampling cascade: The raw rollouts undergo two-stage filtering:

Stage 1 (Answer correctness): Any trajectory whose final answer disagrees with the ground truth $a$ is discarded. Correctness is adjudicated by GPT-4o under an LLM-as-Judge protocol (the same judge used for the accuracy reward $r_{\text{acc}}$ in RL training). This ensures all SFT trajectories end with correct answers—the model only sees successful demonstrations during supervised learning.

Stage 2 (Process quality): Surviving trajectories are vetted by a GPT-5.4 process-level judge on four dimensions: (i) semantic relevance of tool calls to the question, (ii) logical consistency between reasoning traces and observations, (iii) absence of ineffective repetition (no loops or redundant calls), and (iv) cross-modal complementarity (appropriate use of both image and text tools). This is the same rubric used for the query-quality reward $r_{\text{query}}$ in RL training (Sec. 4.2).

Output statistics: Applying both stages yields 36,592 high-quality expert trajectories, with an average of 6.3 tool-invocation turns per trajectory. These constitute the SFT corpus SearchVL-SFT-36k.

Why Claude Opus 4.6 as expert: The paper needs trajectories that demonstrate correct, efficient tool use—not just correct answers. This requires an expert model that is substantially more capable than the base Qwen3-VL models being trained, so that the SFT trajectories represent a "target behavior" that the base model can learn to approximate. Claude Opus 4.6, as a frontier proprietary model with strong tool-use capabilities, serves this role. The two-stage rejection ensures that only trajectories that are both correct and well-structured survive, preventing the base model from learning suboptimal patterns (e.g., correct answers reached through inefficient or redundant tool use).

Why SFT alone is insufficient: The SFT stage (Section 4.1) trains the model to imitate these 36,592 demonstrations. However, the model is bounded by the coverage of the demonstration distribution—it cannot discover strategies that the expert did not use, and it may not generalize well to questions whose structure differs from the training distribution. This motivates the RL stage (Section 4.2), where the model explores against the environment and receives reward-based feedback to discover more effective strategies.

3.4.6 Supervised Fine-Tuning Objective

The SFT stage trains the base Qwen3-VL model on the 36,592 expert trajectories using standard next-token prediction, with two important modifications: (1) the loss is computed only over policy-emitted tokens (reasoning traces and tool calls), masking out environment observations; and (2) the autoregressive factorization explicitly separates reasoning from action.

Trajectory structure: Each step $l$ in a trajectory produces a history $h_l$ (Eq. 1) containing the accumulated images $\mathcal{I}_l$, the question $q$, and all previous actions and observations. The policy emits an action $a_l = [z_l, c_l]$ where $z_l$ is a reasoning trace and $c_l$ is either a tool invocation (for $l < L$) or a final response (for $l = L$).

Autoregressive factorization (Eq. 7): The step-level action probability decomposes as:

Pθ(al∣hl)=Pθ(zl∣hl) Pθ(cl∣hl,zl)P_\theta(a_l \mid h_l) = P_\theta(z_l \mid h_l) \, P_\theta(c_l \mid h_l, z_l)

where $P_\theta(z_l \mid h_l)$ is the probability of the reasoning trace given the history, and $P_\theta(c_l \mid h_l, z_l)$ is the probability of the tool call (or final response) given both the history and the just-generated reasoning.

What this factorization represents: The model first "thinks" (generates a reasoning trace about what it has observed and what it should do next), then "acts" (generates a tool call or answer conditioned on that thinking). The factorization is standard autoregressive—the thinking tokens and acting tokens are concatenated in sequence—but writing it explicitly as a product emphasizes that the SFT loss jointly supervises both the reasoning quality and the action correctness.

SFT objective (Eq. 8): Summing over all $N$ trajectories, each with $L_i$ steps:

max⁡θ∑i=1N∑l=1Li[log⁡Pθ(zl(i)∣hl(i))+log⁡Pθ(cl(i)∣hl(i),zl(i))]\max_\theta \sum_{i=1}^{N} \sum_{l=1}^{L_i} \left[ \log P_\theta(z_l^{(i)} \mid h_l^{(i)}) + \log P_\theta(c_l^{(i)} \mid h_l^{(i)}, z_l^{(i)}) \right]

where $z_l^{(i)}$ and $c_l^{(i)}$ are the expert's reasoning trace and action at step $l$ of trajectory $i$, and $h_l^{(i)}$ is the history up to that step.

What it computes: The standard maximum-likelihood objective for autoregressive sequence models, restricted to the tokens the policy itself emits. For each trajectory and each step, it pushes up the log-probability of the expert's reasoning trace and the expert's subsequent action given that reasoning. Environment observations enter only as conditioning context—they appear in $h_l^{(i)}$ but are not part of the loss computation.

Generation mask $\mathcal{M}_{\text{gen}}$: The loss is restricted to policy-generated tokens via an indicator $\mathcal{M}_{\text{gen}}(y_t) \in \{0, 1\}$ where $\mathcal{M}_{\text{gen}}(y_t) = 1$ if token $y_t$ is part of a generated action $a_l = [z_l, c_l]$, and $\mathcal{M}_{\text{gen}}(y_t) = 0$ if $y_t$ belongs to an observation span $o_l$. Text observations from retrieval tools (TextSearch, ImageSearch, OCR) are characteristically noisy and structurally divergent from the policy's generative distribution—including them in the loss destabilizes training by forcing the model to predict exogenous tokens over which it has no control.

Why this masking: This is the "retrieved-token masking" strategy from Search-R1 (Jin et al., 2025), adapted to multimodal observations. The mask ensures gradients flow only through tokens the policy has agency over. Image-valued observations (from visual tools like Crop, Sharpen, etc.) bypass the token-level loss entirely since they are injected directly into the visual backbone.

3.4.7 Multi-Turn Fatal-Aware GRPO: Composite Reward Design

The RL stage extends GRPO (Group Relative Policy Optimization; Shao et al., 2024) to the multimodal, multi-turn, tool-interleaved setting. I will break this down into four components: the composite reward, the fatal detection mechanism, the token masking, and the one-sided advantage clamping.

Composite reward (Eq. 9):

r(τ)=rfmt(τ)⋅[α racc(τ)+(1−α) rquery(τ)]r(\tau) = r_{\text{fmt}}(\tau) \cdot \left[ \alpha \, r_{\text{acc}}(\tau) + (1 - \alpha) \, r_{\text{query}}(\tau) \right]

where $\alpha = 0.8$, $r_{\text{fmt}} \in [0, 1]$ is a format reward, $r_{\text{acc}} \in \{0, 1\}$ is a binary accuracy reward, and $r_{\text{query}} \in [0, 1]$ is a continuous process-level query-quality reward.

What it computes: A trajectory-level scalar that multiplicatively combines structural validity (format) with a weighted sum of outcome quality (accuracy) and process quality (query formulation). The 0.8 weight on accuracy means the reward is primarily driven by whether the agent got the right answer, with a 0.2 weight on whether its search queries were sensible even if the answer was wrong.

Why this multiplicative format gate: $r_{\text{fmt}}$ acts as a multiplicative gate. If any step in the trajectory has a structural violation—a malformed tool call, a missing reasoning block, a tool-execution error—the format reward is zero for that step, and the per-step averaging in $r_{\text{fmt}}$ (see below) drives the overall format reward toward zero. Multiplied into the bracket, this zeroes out the entire reward regardless of accuracy or query quality. This is a hard constraint: structurally invalid trajectories receive zero reward, forcing the model to maintain proper formatting. An additive formulation $r = \beta r_{\text{fmt}} + \alpha r_{\text{acc}} + (1-\alpha) r_{\text{query}}$ would allow the model to trade formatting for accuracy—it might learn to skip reasoning blocks if doing so somehow improved accuracy. The multiplicative gate prevents this.

Format reward $r_{\text{fmt}}$ (per-step average):

rfmt(τ)=1L+1∑l=0Lrfmt(l)r_{\text{fmt}}(\tau) = \frac{1}{L+1} \sum_{l=0}^{L} r_{\text{fmt}}^{(l)}

where $r_{\text{fmt}}^{(l)} = 1$ if step $l$ contains exactly one thinking block immediately followed by either a <tool_call> block (for $l < L$) or a <response> block (for $l = L$), with no structural violations or tool-execution errors. $r_{\text{fmt}}^{(l)} = 0$ otherwise.

What it computes: The fraction of steps that are structurally well-formed according to the ReAct convention. A trajectory where every step follows the think → act pattern gets $r_{\text{fmt}} = 1$; one with a single malformed step among 10 gets $r_{\text{fmt}} = 0.9$. Tool-execution errors (malformed API arguments, invalid JSON) count as structural violations and zero out the step.

Accuracy reward $r_{\text{acc}}$ (binary): A GPT-4o judge under an LLM-as-Judge protocol compares the agent's final <response> to the ground-truth annotation, assigning $r_{\text{acc}} = 1$ for semantic equivalence and 0 otherwise. For trajectories truncated by the fatal-state condition before emitting a terminal response, $r_{\text{acc}} = 0$ deterministically—not as an evaluative judgment but because correctness is undefined in the absence of an answer.

Query-quality reward $r_{\text{query}}$ (continuous): A GPT-5.4 judge scores the cumulative sequence of search queries on a $[0, 1]$ scale across four dimensions: (i) semantic relevance of queries to the initial prompt, (ii) logical progression and iterative refinement across turns, (iii) signal-to-noise ratio within retrieved payloads, and (iv) cross-modal complementarity of image and text retrieval tools. For fatal trajectories, the judge evaluates only the valid pre-fatal prefix (steps $l < f_i$), crediting early-stage reasoning despite subsequent collapse.

Why $r_{\text{query}}$ at all: Long-horizon tool-use tasks face a sparse reward problem. The binary accuracy reward $r_{\text{acc}}$ provides no signal for trajectories that fail to reach the correct answer, which includes most trajectories early in training. The query-quality reward provides dense feedback: even if the final answer is wrong, the model receives credit for issuing sensible, progressively refined queries. This is particularly important for fatal trajectories, where the agent may have done everything right up to the point of a tool failure—$r_{\text{query}}$ ensures those early correct behaviors are reinforced.

Why 0.8/0.2 weighting: The paper does not justify this specific value, but the design principle is clear: accuracy must dominate (since the ultimate goal is correct answers), but query quality must provide sufficient gradient signal during early training to prevent the model from collapsing to trivial strategies. An 0.8/0.2 split means the reward for a fully correct trajectory is 1.0 (assuming $r_{\text{fmt}} = 1$), while a trajectory with perfect queries but wrong answer gets at most 0.2—enough to provide a learning signal but not enough to make wrong answers competitive with correct ones.

3.4.8 Fatal-Aware Token Masking: Detecting and Handling Cascading Failures

The core technical challenge in multi-turn RL is that tool-execution errors cascade: an early malformed call yields an error observation, which the model conditions on to produce another malformed call, and so on. Training on post-failure tokens injects noise; discarding the entire trajectory wastes the valid prefix. The paper's solution has two parts.

Fatal step detection (Eqs. 19–20 in Appendix B.1): An error counter $n_{\text{err}}^{(l)}$ is maintained over the trajectory:

nerr(l)={nerr(l−1)+1if step l triggers a tool-execution error,0otherwise.n_{\text{err}}^{(l)} = \begin{cases} n_{\text{err}}^{(l-1)} + 1 & \text{if step } l \text{ triggers a tool-execution error}, \\ 0 & \text{otherwise}. \end{cases}

The fatal step index $f_i$ for trajectory $\tau_i$ is defined as:

fi=min⁡{l:nerr(l)=K}f_i = \min\left\{l : n_{\text{err}}^{(l)} = K\right\}

with $K = 3$ in the implementation. If the threshold is never reached, $f_i = L_i + 1$ (the trajectory is non-fatal).

What it computes: The earliest step where $K = 3$ consecutive tool-execution errors have occurred. The counter resets on any successful step—isolated transient errors (common in realistic web environments: timeouts, rate limits, malformed responses) do not trigger fatality. Only a sustained cascade of three consecutive failures signals that the trajectory has entered an irrecoverable state. The choice of $K = 3$ is conservative: it gives the autoregressive policy two opportunities to self-correct after the first error ($n_{\text{err}} = 1, 2$) before declaring fatality.

Why consecutive errors (not total errors): An agent might encounter 5 errors spread across a 15-step trajectory (some recovered, some not) and still produce a correct answer. Counting total errors would penalize such trajectories. Only consecutive, unrecovered errors indicate collapse into incoherence.

Fatal-aware token mask (Eq. 10): The generation mask $\mathcal{M}_{\text{gen}}$ from SFT is extended to additionally zero out all tokens after the fatal step:

M(yi,t)=Mgen(yi,t)⋅1[s(t)<fi]\mathcal{M}(y_{i,t}) = \mathcal{M}_{\text{gen}}(y_{i,t}) \cdot \mathbb{1}\left[s(t) < f_i\right]

where $s(t)$ maps token index $t$ to its step index $l$, and $\mathbb{1}[\cdot]$ is the indicator function.

What it computes: A per-token mask that is 1 only for tokens that are both (i) policy-generated (not environment observations) and (ii) part of the valid prefix before the fatal onset. All tokens after the third consecutive error are zeroed out, regardless of whether they are reasoning traces, tool calls, or final responses. This means the model receives no gradient signal from tokens produced after the trajectory has collapsed—but crucially, it still receives gradients on the valid prefix tokens.

Why this form: The mask cleanly separates "useful learning signal" (valid prefix) from "noise" (post-failure tokens). The alternative of hard-masking (setting all fatal-trajectory tokens to 0, including the prefix) discards the valid prefix entirely. The alternative of no masking (training on everything) injects noisy gradients from the post-failure incoherence. The fatal-aware mask is the minimal extension that preserves the prefix while eliminating the noise.

Process rewards restricted to valid prefix: The format reward $r_{\text{fmt}}$ and query-quality reward $r_{\text{query}}$ are computed exclusively over the valid prefix $l < f_i$. This ensures the model is not penalized for structural collapse that occurs after the trajectory is already doomed—the format score reflects only the steps where the agent had a chance to act coherently.

3.4.9 One-Sided Advantage Clamping: Preserving Viable Prefixes Without Penalizing Them

The fatal-aware mask prevents the model from learning from post-failure tokens, but there remains a subtler problem: GRPO's group-relative advantage normalization can penalize the valid prefix of a fatal trajectory if its composite reward falls below the group mean.

Group normalization (Eqs. 21–22 in Appendix B.2): For a group of $G$ rollouts from the same prompt, compute the empirical mean $\mu_G$ and standard deviation $\sigma_G$ of the composite rewards:

r~i=r(τi)−μGσG+δ\tilde{r}_i = \frac{r(\tau_i) - \mu_G}{\sigma_G + \delta}

where $\delta > 0$ is a small constant for numerical stability, and $\mu_G, \sigma_G$ are computed over all $G$ trajectories—including fatal ones. This ensures fatal trajectories actively shape the group baseline.

What it computes: A standardized score for each trajectory within its group. A trajectory whose reward equals the group mean gets $\tilde{r}_i = 0$; above-mean trajectories get positive scores; below-mean trajectories get negative scores. GRPO then uses $\tilde{r}_i$ as the advantage estimate $\hat{A}_i$, and negative advantages push the policy gradient to reduce the probability of the actions in that trajectory.

The problem with fatal trajectories: Consider a group where most non-fatal trajectories succeed (high reward) and a few fatal trajectories have low rewards (they failed due to a tool error after a valid prefix). The fatal trajectories' standardized scores $\tilde{r}_i$ will be negative, and standard GRPO would penalize all tokens in those trajectories—including the valid prefix tokens that represent correct reasoning followed by unlucky tool failures. This is perverse: the model is punished for the early steps that were actually good, just because the trajectory later collapsed.

One-sided advantage clamping (Eq. 11): The paper modifies the advantage assignment for fatal trajectories only:

A^i={r~iif fi=Li+1 (non-fatal),max⁡(r~i,0)if fi≤Li (fatal).\hat{A}_i = \begin{cases} \tilde{r}_i & \text{if } f_i = L_i + 1 \text{ (non-fatal)}, \\ \max(\tilde{r}_i, 0) & \text{if } f_i \leq L_i \text{ (fatal)}. \end{cases}

What it computes: For non-fatal trajectories, the standard GRPO advantage is used unchanged. For fatal trajectories, the advantage is clamped to be non-negative—if $\tilde{r}_i < 0$, it is set to 0; if $\tilde{r}_i \geq 0$, it is left unchanged.

Why this form (the formal dominance guarantee): Appendix B.2 proves Proposition 1: the one-sided clamping strictly dominates hard-masking in gradient informativeness. For any fatal trajectory $\tau_i$:

  1. If $\tilde{r}_i < 0$: The clamped advantage $\hat{A}_i = 0$ produces zero gradient on all tokens (both prefix and post-failure), same as hard-masking. The model neither reinforces nor penalizes the valid prefix when the trajectory's overall reward is below the group mean.

  2. If $\tilde{r}_i \geq 0$: The clamped advantage $\hat{A}_i = \tilde{r}_i$ produces positive gradient on the valid prefix tokens (since the fatal-aware mask already zeroes out post-failure tokens). The model reinforces the early reasoning that led to an above-average reward, even though the trajectory ultimately failed. Hard-masking would produce zero gradient in this case—wasting a positive learning signal.

What determines $\tilde{r}_i \geq 0$ for fatal trajectories: A fatal trajectory can still have a non-negative standardized score if its valid prefix produced high-quality queries (scored by $r_{\text{query}}$) and its format was clean ($r_{\text{fmt}}$ high). For a higher-difficulty prompt where many non-fatal trajectories also fail (yielding a low group mean $\mu_G$), several fatal trajectories might have rewards above the mean—their prefixes are being compared against other failing trajectories, not against successful ones. For lower-difficulty prompts where most non-fatal trajectories succeed (high $\mu_G$), all fatal trajectories will fall below the mean and be clamped to zero—their prefixes are safely ignored rather than penalized.

Empirical distribution (Figure 5, Appendix B.2): Over 10,000 groups (47,978 fatal rollouts total), 91.8% of fatal rollouts have $\tilde{r}_i < 0$ and are clamped to zero. The remaining 8.2% have $\tilde{r}_i \geq 0$ (mean $\tilde{r}^+ = 0.57$) and are preserved—their scores overlap with the positive mode of the non-fatal reference distribution. This confirms that (i) most fatal trajectories are safely zeroed out, and (ii) the preserved minority sits in the same score regime as competitive non-fatal behaviors, not an ad-hoc heuristic.

Bias of group statistics (Appendix B.2, Eq. 25): Because clamping introduces a non-negative bias $b_G = \frac{1}{G}\sum_{i \in \mathcal{F}} \max(0, -\tilde{r}_i) \geq 0$ (where $\mathcal{F}$ indexes fatal trajectories), the expected advantage over the group is no longer zero. The paper argues this is benign because (i) the bias is concentrated on high-quality prefixes (the 8.2% tail that actually gets preserved), and (ii) the within-group ordering of non-fatal trajectories—which is the actual signal GRPO exploits—remains intact since clamping only shifts the fatal subset upward.

3.4.10 Final GRPO Objective: Integrating All Components

The full training objective combines the fatal-aware mask, the clamped advantage, the standard GRPO clipped surrogate, and a KL penalty against a reference policy.

GRPO objective (Eq. 12):

J(θ)=E(I0,q)∼D,{τi}i=1G∼πθold(⋅∣I0,q;E)[1G∑i=1G1∑tMi,t∑t=1∣τi∣Mi,tmin⁡(ρi,t(θ)A^i,  clip1−ϵ1+ϵ(ρi,t(θ))A^i)]\mathcal{J}(\theta) = \mathbb{E}_{(I_0, q) \sim \mathcal{D}, \{\tau_i\}_{i=1}^G \sim \pi_{\theta_{\text{old}}}(\cdot \mid I_0, q; \mathcal{E})} \left[ \frac{1}{G} \sum_{i=1}^{G} \frac{1}{\sum_t \mathcal{M}_{i,t}} \sum_{t=1}^{|\tau_i|} \mathcal{M}_{i,t} \min\left( \rho_{i,t}(\theta) \hat{A}_i,\; \text{clip}_{1-\epsilon}^{1+\epsilon}(\rho_{i,t}(\theta)) \hat{A}_i \right) \right]

where $\mathcal{M}_{i,t} \equiv \mathcal{M}(y_{i,t})$ is the fatal-aware mask from Eq. 10, $\hat{A}_i$ is the clamped advantage from Eq. 11, and $\rho_{i,t}(\theta)$ is the token-level importance ratio:

ρi,t(θ)=πθ(yi,t∣I0,q,yi,<t;E)πθold(yi,t∣I0,q,yi,<t;E)\rho_{i,t}(\theta) = \frac{\pi_\theta(y_{i,t} \mid I_0, q, y_{i,<t}; \mathcal{E})}{\pi_{\theta_{\text{old}}}(y_{i,t} \mid I_0, q, y_{i,<t}; \mathcal{E})}

along with the standard KL penalty $\beta D_{\text{KL}}[\pi_\theta \| \pi_{\text{ref}}]$ omitted from the display for clarity.

What it computes: For each group of $G$ trajectories sampled from the same prompt, the objective computes a per-token policy gradient. Each token receives a gradient proportional to $\hat{A}_i$ (how much better or worse this trajectory was than the group average), modulated by the importance ratio $\rho_{i,t}$ (how much the current policy has changed relative to the old policy), and clipped by the standard PPO clip $\epsilon$ to prevent destructively large updates. The mask $\mathcal{M}_{i,t}$ zeroes out gradients for (i) environment observations and (ii) post-fatal tokens. The normalization $1 / \sum_t \mathcal{M}_{i,t}$ averages over the number of unmasked tokens, preventing trajectories with more unmasked tokens from dominating the gradient.

Why this form (comparison to Search-R1; Jin et al., 2025): Three modifications relative to Search-R1's GRPO:

  1. Environment generalization: The expectation is over the multimodal environment $\mathcal{E}$ rather than a text-only retriever $\mathcal{R}$. The $\otimes \mathcal{E}$ notation in the sampling distribution indicates strict interleaving of policy emissions and environment responses (Eq. 2), with both text and image observations.

  2. Mask extension: $\mathcal{M}_{\text{gen}}$ (masking only environment observations) is extended to $\mathcal{M}$ (also masking post-fatal tokens). This is the fatal-aware masking from Eq. 10.

  3. Advantage computation: The standard GRPO group-normalized advantage $\tilde{r}_i$ is replaced by the one-sided clamped advantage $\hat{A}_i$ from Eq. 11, computed from the composite reward rather than a single scalar reward.

Training dynamics evidence (Figure 3): The training curves show that fatal-aware GRPO sustains longer tool-use trajectories (higher average number of turns) and achieves higher batch accuracy than both vanilla GRPO and the hard-masking baseline. The interpretation: by preserving gradient signal on viable prefixes, the policy is encouraged to explore longer trajectories (it is not punished for attempting challenging rollouts that might fail) and to persist through transient errors (it learns that recovery is possible, rather than learning to prematurely terminate).

3.4.11 Summary of Design Choices and Their Justifications

  • Wikipedia path sampling with functional roles (anchor, bridge, answer): Ensures multi-hop structure where each node plays a specific part in the reasoning chain, enabling targeted rewriting and grounding.

  • Fuzzy rewriting in farthest-to-nearest order with three strict invariants: Answer invariance prevents semantic drift, uniqueness prevents ambiguity, non-leakage prevents trivial reversibility. The order ensures each new descriptor is verified in context.

  • Source-anchor visual grounding (not answer-anchor): The single most important anti-shortcut measure—by placing the image at the farthest point from the answer entity, no single retrieval can collapse the chain.

  • Two-stage difficulty filtering with frozen Qwen3-VL-32B: Removes instances solvable without tools (Filter A) or with a single retrieval (Filter B), ensuring the training data genuinely demands tool use.

  • 10% enhancement subset: Introduces image degradation paired with enhancement tools, operationalizing "active perception" in training data rather than relying on the model to discover enhancement tools during RL exploration.

  • Composite reward with multiplicative format gate: $r_{\text{fmt}}$ as a hard structural constraint (zeros out reward for any formatting violation), $r_{\text{acc}}$ as the primary signal (0.8 weight), $r_{\text{query}}$ as dense feedback for trajectories that fail to reach the correct answer (0.2 weight).

  • Three-consecutive-error fatal detection ($K = 3$): Conservative threshold that allows recovery from isolated transient errors (common in web APIs) but declares fatality after sustained collapse.

  • One-sided advantage clamping with formal dominance guarantee: Replaces hard-masking (wastes valid prefixes with above-mean reward) and blind training (injects noise from post-failure tokens) with a principled middle ground—zero out negative advantages on fatal trajectories (safe), preserve positive advantages on viable prefixes (informative).

  • GPT-4o judge for accuracy and GPT-5.4 judge for query quality: Both are proprietary, but necessary for reward computation in RL training. The paper acknowledges this as a limitation (Section 7: "costly, version-dependent") and suggests future work on open process reward models.

4. Key Insights and Innovations

Innovation 1: Difficulty-Conditioned Compute-Optimal Test-Time Scaling

The paper's most fundamental contribution is not any single method but rather the meta-strategy of adaptively allocating test-time compute based on prompt difficulty. Prior work treated test-time compute as a uniform knob: turn it up (more samples, more search) and performance improves. This paper demonstrates that the relationship between compute and performance is qualitatively different depending on problem difficulty, and that ignoring this heterogeneity leaves enormous efficiency on the table.

What makes this genuinely novel—rather than an obvious observation—is that the difficulty-dependent behavior is often counterintuitive. Beam search, the strongest optimizer, actually hurts performance on easy problems at high budgets due to verifier over-optimization (Figure 3, right), while it helps substantially on medium-difficulty problems. Similarly, sequential revisions dominate on easy problems but a balanced sequential-parallel ratio is optimal on hard ones (Figure 7, right). These are not monotonic relationships where "more powerful = better." The compute-optimal policy exploits these non-monotonicities to achieve 4× better efficiency than best-of-N (Figures 4 and 8), which is a significant practical gain.

This contribution is best understood as an inference-time analog of the Chinchilla scaling laws for pretraining. Just as Hoffmann et al. (2022) showed that the optimal allocation of pretraining compute between model size and data quantity varies with total budget, this paper shows that the optimal allocation of test-time compute between search strategies varies with problem difficulty. The conceptual parallel is direct, but the underlying mechanism is entirely different—pretraining scaling laws optimize over continuous variables (parameters, tokens), while this paper optimizes over a discrete, combinatorial space of strategy hyperparameters conditioned on a difficulty estimate.

A subtle but important point: the predicted (non-oracle) difficulty bins perform nearly as well as oracle bins (the curves largely overlap in Figures 4 and 8). This is what makes the contribution practical rather than merely analytical. If the gains required ground-truth labels to estimate difficulty, the approach would be circular. The fact that the PRM's own score distribution serves as a sufficient proxy means the system is deployable without access to answers.

Innovation 2: The Proposal Distribution and Verifier as Complementary, Independent Scaling Axes

The unifying framework in Section 2—decomposing all test-time compute methods into modifications to the proposal distribution (what the model generates) versus the verifier (how outputs are selected)—is not itself technically novel. It echoes the proposer-scorer decomposition familiar from MCMC and reinforcement learning. What is novel is the paper's empirical demonstration that these two axes have complementary, difficulty-dependent strengths and that combining them yields gains neither achieves alone.

Concretely: revisions (proposal modification) are most effective on easy problems where the model's initial output is roughly correct and just needs refinement—a local search in answer space. Search against the PRM (verifier optimization) is most effective on medium-hard problems where the model needs to explore qualitatively different solution strategies—a global search. Prior work studied these mechanisms in isolation, often reaching pessimistic conclusions (e.g., "LLMs cannot self-correct reasoning" from Huang et al., 2023). This paper's framework reconciles those findings: self-correction does work, but only on the right difficulty tier. Search does help, but only with the right algorithm at the right budget. The conflicting prior results were an artifact of testing different methods on different (implicitly difficulty-biased) problem distributions.

This insight is more than taxonomic. It implies that future systems should not choose between revisions and search but should deploy both, switching between them per-prompt. The paper doesn't fully realize this vision (Section 8 acknowledges that PRM tree-search was not combined with revisions), but the framework provides the intellectual scaffolding for doing so.

Innovation 3: Empirical Evidence That Test-Time Compute Can Substitute for Pretraining—With Sharp Boundaries

The FLOPs-matched comparison in Section 7 is, to the authors' knowledge, the first to demonstrate in a realistic setting (no ground-truth access at inference) that a smaller model with additional test-time compute can outperform a ~14× larger model on problems within its capability range. This is significant not as a method but as an empirical finding with direct implications for how compute budgets should be allocated in production systems.

What distinguishes this from prior work on training-inference tradeoffs (Jones, 2021; Villalobos and Atkinson, 2023) is the specificity of the finding. The paper doesn't claim a universal substitution—it precisely characterizes where the substitution works (easy-to-medium problems, low R regimes) and where it fails (hard problems, high R regimes). The failure case is equally informative: on the hardest problems (bin 5), test-time compute provides essentially zero benefit regardless of budget, meaning that some capabilities can only be acquired through pretraining, not recovered at inference time. This establishes a clear boundary condition: test-time compute amplifies existing capability but does not create it from nothing.

The dependence on R = D_inference / D_pretrain adds practical nuance that prior analyses missed. For self-improvement pipelines where R ≪ 1, the case for test-time compute is strong. For high-throughput production deployments where R ≫ 1, the case weakens because the per-query inference cost of the larger model dominates the budget anyway. This is an incremental but practically important refinement of the training-inference tradeoff picture.

Innovation 4: Verifier Over-Optimization as a First-Class Phenomenon in Test-Time Scaling

While reward hacking / over-optimization is well-documented in the RLHF literature, this paper provides some of the first clear evidence that the same phenomenon governs test-time search scaling and is the primary bottleneck preventing unbounded improvements from additional compute. The evidence is concrete: beam search degrades easy-problem performance at high budgets (Figure 3, right); lookahead search—the most powerful optimizer—paradoxically performs worst overall (Figure 3, left); and qualitative examples in Appendix M show search producing degenerate outputs (repetitive low-information steps, overly short solutions) that score highly under the PRM.

This finding is significant because it shifts the narrative around test-time compute from "more is better" to "more is better only up to the verifier's reliability frontier." It explains why prior work found negative results for sophisticated search methods: those studies likely pushed past the over-optimization threshold. It also implies that improving verifier robustness is the key bottleneck for further scaling test-time compute, not improving search algorithms. The paper's compute-optimal policy can be understood partly as a way to stay below the over-optimization threshold per difficulty level—using weaker optimization (best-of-N) where the verifier is reliable (easy problems) and stronger optimization (beam search) only where the verifier signal has more room to provide genuine guidance (medium problems).

5. Experimental Analysis

Evaluation Methodology

  • Dataset. The paper evaluates on seven multimodal knowledge-intensive benchmarks: SimpleVQA (Cheng et al., 2025), VDR (Zeng et al., 2026), MMSearch (Jiang et al.), LiveVQA (Fu et al., 2025), BrowseComp-VL (Geng et al., 2025), FVQA (Wang et al., 2017), and InfoSeek (Chen et al., 2023). Together they cover visual entity recognition, web evidence retrieval, multi-hop reasoning, and long-tail QA. The paper does not specify the exact size of each benchmark test set, but Table 2 reports aggregate Pass@1 scores across all seven. The VDR-Bench evaluation protocol (Zeng et al., 2026) is adopted for answer grading across all benchmarks to ensure fair comparison across heterogeneous answer styles.

  • Base model(s). OpenSearch-VL is built on three Qwen3-VL variants (Bai et al., 2025): Qwen3-VL-8B-Instruct (8B dense), Qwen3-VL-30B-A3B-Instruct (MoE with ~30B total, ~3B active), and Qwen3-VL-32B-Instruct (32B dense). These span the 8B-to-32B range and represent capable open-source multimodal models with strong visual perception. The paper uses these models both as the starting point for training and as direct-reasoning baselines (answering from parametric knowledge without tools).

  • Metrics. The primary metric throughout is Pass@1 accuracy (%) on each benchmark—the fraction of test instances where the model's final <response> matches the ground-truth answer. Correctness is adjudicated by a GPT-4o judge under an LLM-as-Judge protocol that verifies semantic equivalence between the model's output and the reference answer. The judge prompt (Figure 10, Appendix E) matches the protocol released by Vision-DeepResearch (Huang et al., 2026) to maintain comparability. For experiments involving RL training dynamics (Figure 3), the paper also reports batch-level accuracy (the fraction of rollouts within a training batch that achieve correct answers) and average number of turns per rollout.

  • Baselines. The paper evaluates against three categories of baselines, with all comparisons reported in Table 2:

    Direct Reasoning (no tools): GPT-4o (Team, 2024), GPT-5 (OpenAI, 2025), Gemini-2.5-Flash and Gemini-2.5-Pro (Comanici et al., 2025), Claude-4-Sonnet (Team, 2025b), Claude-3.7-Sonnet (Team, 2025a), and the three Qwen3-VL base models (Bai et al., 2025). These answer from parametric knowledge and visual perception alone.

    RAG Workflow: GPT-4o, GPT-5, Claude-3.7-Sonnet, and Qwen3-VL-8B. External retrieval results are provided in-context, but reasoning remains single-pass (no iterative tool use).

    Agentic Workflow: DeepMMSearch-R1-7B (Narayan et al., 2025a), Visual-ARFT-7B (Liu et al., 2025), MMSearch-R1-7B (Wu et al., 2025b), DeepEyes-v2-7B (Hong et al., 2025), WebWatcher-7B and WebWatcher-32B (Geng et al., 2025), SenseNova-MARS-8B (Chng et al., 2025), and the Qwen3-VL base models with agentic tool access. These baselines interleave reasoning with tool calls autonomously, comparable to OpenSearch-VL's deployment mode.

  • Generation budget / compute accounting. For RL training, each prompt samples G = 8 trajectories for the 8B model and G = 16 for the 30B-A3B model (Table 5). The fatal-aware GRPO objective (Eq. 12) normalizes gradients per-trajectory by the number of unmasked tokens ($\sum_t \mathcal{M}_{i,t}$) to prevent trajectories with more valid tokens from dominating. The paper does not report inference-time compute budgets for evaluation—at test time, the agent runs until it emits a terminal <response> or encounters a fatal error cascade, with no explicit limit on the number of tool calls (although tool-execution errors can trigger truncation via the fatal detection logic, $K = 3$ consecutive errors).

  • Cross-validation / statistical protocol. No cross-validation or statistical significance testing is reported for the main benchmark results (Table 2). The paper acknowledges this in the Limitations section: "Exact numerical reproducibility is challenged by the reliance on these externally hosted APIs (e.g., Serper, PaddleX OCR) and the prohibitive cost of reporting multi-seed error bars for large-scale evaluations." Ablation results (Table 3) similarly lack confidence intervals. The RL training curves (Figure 3) show per-step batch accuracy over 200 optimization steps for the 8B model, providing a sense of training variance but no formal statistical characterization.

Main Quantitative Results

Overall Benchmark Performance (Table 2)

OpenSearch-VL achieves substantial improvements over prior open models and approaches proprietary commercial performance on several benchmarks. The headline results:

At 8B scale: OpenSearch-VL-8B achieves an average score of 56.6 across seven benchmarks, surpassing the previous strongest open 8B agent, SenseNova-MARS-8B, by 3.9 points (56.6 vs. 52.7). It substantially outperforms both the Qwen3-VL-8B agentic baseline (+14.6 points: 56.6 vs. 42.0) and the best RAG baseline (Qwen3-VL-8B RAG at 40.7). The gains are largest on SimpleVQA (71.6 vs. 52.0 baseline, +19.6), FVQA (71.5 vs. 58.7, +12.8), and InfoSeek (70.2 vs. 50.3, +19.9).

At 30B-A3B scale: OpenSearch-VL-30B-A3B reaches 61.6 average, improving over its Qwen3-VL-30B-A3B agentic baseline by 13.8 points (61.6 vs. 47.8). Standout gains include MMSearch (+24.5: 68.7 vs. 44.2), VDR (+13.3: 33.5 vs. 20.2), and InfoSeek (+16.2: 72.4 vs. 56.2). This configuration approaches or exceeds several proprietary direct-reasoning models—for instance, outperforming GPT-5 direct (45.1 average) and Claude-3.7-Sonnet RAG (37.6).

At 32B scale: OpenSearch-VL-32B achieves the best overall average of 63.7, outperforming the Qwen3-VL-32B agentic baseline by 15.7 points (63.7 vs. 48.0). It surpasses Gemini-2.5-Pro direct reasoning (63.7 vs. 46.0 average), GPT-5 RAG workflow (63.7 vs. 53.6), and the WebWatcher-32B agentic baseline on overlapping benchmarks (76.2 vs. 59.0 on SimpleVQA; 72.3 vs. 55.3 on MMSearch).

Comparison to proprietary models: OpenSearch-VL-32B achieves results competitive with proprietary commercial models on several specific benchmarks: it outperforms GPT-5 direct on SimpleVQA (76.2 vs. 61.6), FVQA (74.7 vs. 54.4), and InfoSeek (74.8 vs. 61.7). On VDR, it reaches 33.8—substantially below proprietary multimodal direct-reasoning baselines (Gemini-2.5-Pro at 8.0 for direct, GPT-5 RAG at 22.3) but among the strongest for fully open agentic systems.

Scaling trends: Across all three scales, OpenSearch-VL shows monotonic improvements: 56.6 → 61.6 → 63.7 average as model size increases from 8B to 30B-A3B to 32B. The gains are particularly pronounced on search-heavy benchmarks (VDR, MMSearch, InfoSeek) where the base Qwen3-VL models perform poorly but the agentic workflow provides large boosts, and smaller on visually grounded benchmarks where the base models already have reasonable performance (LiveVQA moves from 50.6 to 59.6 at 8B; BrowseComp-VL from 27.9 to 37.6).

Data Pipeline Ablation (Table 3a)

Table 3a reports SFT-only results (no RL) on a subset of three benchmarks—SimpleVQA, InfoSeek, FVQA—with the Qwen3-VL-8B base model. The full pipeline achieves 64.6 average across these three benchmarks. Removing individual pipeline stages produces large degradations:

  • Without source-anchor grounding (anchoring images on the answer entity instead of the path source): drops to 53.1 average, a loss of −11.5 points. SimpleVQA drops from 66.1 to 53.6 (−12.5), FVQA from 65.3 to 51.2 (−14.1). This confirms that anchoring the image on the path source rather than the answer entity is the single most impactful anti-shortcut measure—without it, the agent can collapse multi-hop chains to a single ImageSearch call.

  • Without fuzzy entity rewriting (preserving entity names in questions): drops to 54.3 average, a loss of −10.3 points. SimpleVQA: 66.1 → 51.7 (−14.4); InfoSeek: 62.4 → 56.4 (−6.0). This validates that entity name obfuscation forces genuine reasoning rather than shortcut text search.

  • Without staged filtering (no Filter A or B to remove tool-independent examples): drops to 56.4 average, a loss of −8.2 points. This confirms that many candidate QA instances are solvable without tools or with a single retrieval, and training on them degrades the agent's learned search behavior.

  • Without the enhancement subset (no image degradation + restoration trajectories): drops to 63.3 average, a loss of −1.3 points. This is the smallest loss, suggesting that image-restoration trajectories primarily improve robustness (handling degraded inputs at test time) rather than driving the core multi-hop search capability.

Key insight: The relative magnitudes (source-anchor grounding > fuzzy rewriting > staged filtering > enhancement subset) align with the paper's central hypothesis: the most critical requirement for training effective search agents is systematically eliminating shortcuts that allow single-step retrieval, with visual robustness providing incremental gains on top of that foundation.

RL Training Ablation (Table 3b)

Table 3b isolates the effect of different RL training recipes starting from the same Qwen3-VL-8B SFT initialization, evaluated on SimpleVQA, InfoSeek, and FVQA:

  • SFT only: 64.6 average. This is the performance after supervised fine-tuning on the 36K expert trajectories, before any RL. The model imitates expert behavior but cannot explore beyond the demonstration distribution.

  • + Vanilla GRPO (Search-R1-style; Jin et al., 2025): improves to 67.6 average (+3.0 over SFT). Online exploration with standard GRPO provides meaningful gains, confirming that RL helps the model discover strategies beyond imitation.

  • + GRPO with Hard Masking (Vision-DeepResearch-style; Huang et al., 2026): 67.7 average (+0.1 over vanilla GRPO). This essentially matches vanilla GRPO—discarding fatal trajectories entirely provides no benefit over training on them blindly. This is a notable negative result: the simplest approach for handling tool failures (throw away failed rollouts) is equivalent to doing nothing special, because it wastes the same amount of information (valid prefixes) that blind training corrupts with noise.

  • + GRPO with Fatal Masking only (masking post-failure tokens but using standard unclamped advantages): 69.1 average (+1.5 over vanilla GRPO). Preserving valid prefixes while masking post-failure noise provides a clear gain, confirming that the valid prefix contains useful learning signal that vanilla GRPO fails to exploit (because post-failure noise contaminates the gradient estimates).

  • + Fatal Masking + One-Sided Clamping (the full OpenSearch-VL recipe): 71.8 average (+4.2 over vanilla GRPO; +2.7 over fatal masking alone). This is the largest single gain, demonstrating that one-sided advantage clamping is essential on top of masking—without clamping, the valid prefixes of fatal trajectories still receive negative gradients when their reward falls below the group mean, which suppresses the very exploration behavior the training should encourage. The per-benchmark gains are pronounced: SimpleVQA 71.6 (+2.8 over vanilla), InfoSeek 72.4 (+5.9), FVQA 71.5 (+4.1). InfoSeek shows the largest gain, consistent with its requirement for multi-hop evidence gathering where partial trajectories are especially informative.

Key insight: The progression SFT → vanilla GRPO → fatal masking → fatal masking + clamping shows that each component of the RL recipe adds meaningful improvement, with the combination of masking and clamping providing gains beyond either alone (67.6 → 69.1 → 71.8). The hard-masking baseline's failure to improve over vanilla GRPO (67.6 → 67.7) empirically validates the paper's claim that discarding fatal trajectories wastes useful learning signal.

RL Training Dynamics (Figure 3)

Figure 3 tracks training dynamics over 200 RL optimization steps for the 8B model, comparing vanilla GRPO, hard-masking GRPO, and fatal-aware GRPO on two metrics:

  • Average number of turns per rollout (left panel): Fatal-aware GRPO sustains a higher and more stable number of turns throughout training, reaching approximately 10–12 turns by step 200. Vanilla GRPO and hard-masking GRPO both show lower turn counts (approximately 6–8 at convergence) and more volatility. The interpretation: fatal-aware GRPO does not penalize long trajectories that eventually fail, so the policy is encouraged to explore longer rollouts; vanilla GRPO, by contrast, penalizes the entire trajectory when a long rollout ends in failure, creating a bias toward shorter, safer trajectories.

  • Batch-level accuracy (right panel): Fatal-aware GRPO achieves higher accuracy throughout training, with the gap widening over time. By step 200, fatal-aware GRPO reaches approximately 0.75–0.80 batch accuracy, compared to approximately 0.60 for vanilla GRPO and 0.55–0.60 for hard-masking. The accuracy curves for fatal-aware GRPO also show a clearer upward trend, suggesting more effective learning rather than plateauing.

Key insight: The training dynamics provide mechanistic evidence for why the fatal-aware recipe works—not just that it works. The sustained higher turn count shows the policy is learning to persist through transient errors rather than prematurely terminating. The higher batch accuracy shows that this persistence translates to more successful rollouts, not just longer ones.

Group-Level Behavior of One-Sided Clamping (Figures 4 and 5)

Figures 4 and 5 provide empirical validation of the one-sided clamping mechanism, showing when and how often fatal trajectories receive preserved advantages:

Figure 4 (illustrative groups): Two representative rollout groups of G = 16 trajectories each:

  • Higher-difficulty prompt (left): The group mean $\bar{r}$ is low (~0.10). Several fatal trajectories (brick red bars) have rewards above this mean, and their $\tilde{r}_i > 0$ survives clamping ($\hat{A}_i = \tilde{r}_i > 0$). The cartoon shows that for one preserved fatal trajectory, gradients flow only through the viable prefix tokens (up to the fatal onset $f_i$), with the post-failure suffix hard-masked. The prefix is reinforced because its partial reasoning beat the group average, even though the overall trajectory failed.
  • Lower-difficulty prompt (right): The group mean $\bar{r}$ is high (~0.90). All fatal trajectories have rewards far below this mean, so $\tilde{r}_i < 0$ for all of them, and clamping sets $\hat{A}_i = 0$. The cartoon shows the clamp degenerating to hard-masking—the prefix receives zero gradient, neither reinforced nor penalized.

Figure 5 (aggregate distribution over 10,000 groups): The histogram of pre-clamp standardized scores $\tilde{r}_i$ for all fatal rollouts reveals:

  • 91.8% of fatal rollouts fall on the negative side (mean $\tilde{r}^- = -0.68$) and are clamped to zero by $\hat{A}_i = \max(\tilde{r}_i, 0)$.
  • 8.2% of fatal rollouts are preserved (mean $\tilde{r}^+ = +0.57$), and their pre-clamp score distribution overlaps with the positive mode of the non-fatal reference density (blue line).
  • The preservation is therefore driven by the same group-normalized score that GRPO already computes—not an ad-hoc heuristic—and the preserved fatal prefixes sit in the same score regime as stronger non-fatal behaviors.

Key insight: These figures jointly validate the paper's claim that one-sided clamping is not uniformly inflating low-quality trajectories, but rather selectively preserving a small fraction (8.2%) of fatal rollouts whose valid prefixes are empirically competitive with non-fatal trajectories. The vast majority of fatal rollouts are safely clamped to zero, avoiding the noise injection that blind training would cause.

Ablation Studies and Robustness Checks

  • Source-anchor visual grounding removal (Table 3a): Removing source-anchor grounding drops average accuracy from 64.6 to 53.1 (−11.5 points), the largest single ablation loss. This confirms that anchoring images on the path source rather than the answer entity is essential for preventing ImageSearch shortcuts. The loss is particularly severe on FVQA (−14.1) and SimpleVQA (−12.5), which rely heavily on visual entity identification.

  • Fuzzy entity rewriting removal (Table 3a): Removing fuzzy rewriting drops average accuracy from 64.6 to 54.3 (−10.3). The loss is largest on SimpleVQA (−14.4), suggesting that text-search shortcuts are especially prevalent for entity-identification questions. InfoSeek shows a smaller loss (−6.0), potentially because its long-tail QA nature inherently requires more than a single text search even when entity names are present.

  • Staged filtering removal (Table 3a): Training without Filter A (tool-free solvability check) and Filter B (single ImageSearch solvability check) drops accuracy from 64.6 to 56.4 (−8.2). This validates that a substantial fraction of candidate QA instances are indeed shortcut-solvable, and including them in training teaches the agent to attempt shortcuts rather than execute full search chains. The loss is relatively uniform across benchmarks (−8.5, −7.2, −9.0), suggesting shortcut vulnerability is a dataset-wide problem rather than benchmark-specific.

  • Enhancement subset removal (Table 3a): Removing the 10% degraded-image subset drops accuracy from 64.6 to 63.3 (−1.3), the smallest ablation loss. This confirms the paper's claim that image enhancement trajectories primarily improve robustness rather than driving core search capability. However, the ablation is tested only on Benchmarks where image quality may be relatively high (SimpleVQA, InfoSeek, FVQA)—the loss might be larger on benchmarks with intentionally degraded or real-world-capture images, which the paper does not separately evaluate.

  • Hard-masking vs. fatal-aware GRPO (Table 3b): Replacing the fatal-aware masking and clamping with hard-masking (discard all fatal trajectories entirely) yields 67.7 average, essentially identical to vanilla GRPO's 67.6. This is a crucial negative result: hard-masking provides no benefit over training blindly because the information loss from discarded valid prefixes is roughly balanced by the noise reduction from removing post-failure tokens. It means that simply filtering out failed rollouts—the most obvious baseline for handling tool failures—does not work, and the more nuanced fatal-aware approach is necessary.

  • Fatal masking only vs. full recipe (Table 3b): Fatal masking alone (masking post-failure tokens but using standard GRPO advantages) improves to 69.1 (+1.5 over vanilla). Adding one-sided clamping further improves to 71.8 (+2.7 over masking alone). This demonstrates that masking and clamping address different problems: masking removes noise from post-failure tokens, while clamping prevents the valid prefix from being penalized when the group disadvantage is driven by post-failure collapse rather than poor early reasoning. The two mechanisms are complementary rather than redundant.

  • Oracle vs. predicted difficulty bins (not reported): The paper does not report an ablation comparing ground-truth difficulty labeling versus their model-based difficulty estimation on final benchmarks. The paper's approach to difficulty—if any difficulty-based allocation were used—is not described in the experimental section, which instead applies uniform strategies to all test instances.

  • Cross-modal complementarity assessment (Table 2): While not a formal ablation, comparing OpenSearch-VL's performance across benchmarks with different modality demands provides indirect evidence. Gains are largest on benchmarks requiring text+visual integration (InfoSeek +19.9, MMSearch +24.5 at 30B-A3B) and smaller on benchmarks answerable primarily from parametric knowledge (LiveVQA +5.4 at 30B-A3B). This is consistent with the agent's architecture emphasizing active search over static knowledge.

Critical Assessment

Claim 1: "OpenSearch-VL brings an average improvement of 13.8 points across 7 multimodal deep search benchmarks" (compared to Qwen3-VL-30B-A3B agentic baseline)

What the experiments demonstrate: Table 2 shows that OpenSearch-VL-30B-A3B achieves 61.6 average versus Qwen3-VL-30B-A3B agentic baseline at 47.8—a difference of 13.8 points. This is clean and directly measured.

Where the claim needs qualification: The 13.8-point figure represents the improvement over a specific baseline (the Qwen3-VL-30B-A3B base model with agentic tool access but no specialized SFT or RL). This is a fair baseline—it isolates the effect of the OpenSearch-VL recipe—but it is not the improvement over all prior open multimodal agents. The gap to the strongest prior open model at comparable scale varies: OpenSearch-VL-8B (56.6) exceeds SenseNova-MARS-8B (52.7) by 3.9 points, a meaningfully smaller margin. The 13.8-point headline figure should be understood as "improvement over the base model when applying our recipe," not "improvement over the state-of-the-art."

Missing comparison: The paper does not report a direct comparison where the Qwen3-VL-30B-A3B base model receives the same SFT data but a different (non-fatal-aware) RL recipe. This would isolate the contribution of the fatal-aware GRPO from the contribution of the high-quality SFT data. From Table 3b, we can infer that for 8B, SFT alone achieves 64.6 and the full recipe achieves 71.8 on the ablation subset—but the paper does not report the SFT-only performance of the 30B-A3B or 32B models on the full seven-benchmark suite. This makes it impossible to determine how much of the 13.8-point gain comes from data quality versus RL innovation.

Claim 2: The fatal-aware GRPO algorithm "preserves useful pre-failure reasoning through one-sided advantage clamping"

What the experiments demonstrate: Table 3b provides strong within-scale evidence: fatal masking + one-sided clamping (71.8) outperforms both fatal masking alone (69.1) and vanilla GRPO (67.6). Figure 4 illustrates the clamping mechanism on representative groups. Figure 5 shows that 8.2% of fatal rollouts are preserved, with their scores overlapping the non-fatal distribution. Figure 3 shows that fatal-aware GRPO sustains longer trajectories and higher batch accuracy during training.

Why this is strong evidence: The ablation is clean—same SFT initialization, same training data, same environment, varying only the RL recipe. The progression from vanilla GRPO → masking → masking+clamping shows monotonic improvement, and the hard-masking baseline's failure (67.7, identical to vanilla) validates the paper's diagnosis that naive approaches don't help. The mechanistic evidence (Figures 3–5) explains why the gains occur, not just that they occur.

Where the claim needs qualification: The evidence comes from a single model scale (8B) evaluated on three benchmarks. The paper does not report similar ablations for the 30B-A3B or 32B models, leaving open the possibility that the benefit of fatal-aware GRPO diminishes (or is dominated by other factors) at larger scales. Additionally, the ablation is measured after SFT training that already incorporates the full data pipeline—we cannot disentangle whether the fatal-aware RL gains are dependent on having high-quality SFT initialization (e.g., would fatal-aware GRPO still help if the SFT data were lower quality or if RL were run from a base model without SFT?).

Claim 3: The data curation pipeline systematically eliminates shortcuts and produces genuinely tool-demanding instances

What the experiments demonstrate: Table 3a shows that removing source-anchor grounding (−11.5), fuzzy rewriting (−10.3), or staged filtering (−8.2) each causes large degradations. This confirms that each component contributes to data quality in ways that measurably impact downstream agent performance.

Why this is strong but incomplete evidence: The ablations measure the final effect of removing each pipeline stage on model accuracy. They do not directly measure whether the removed instances were actually shortcut-solvable. For example, the claim "without source-anchor grounding, agents can solve questions with a single ImageSearch" is a claim about the data, not about the model. The paper does not report what fraction of instances pass each filter, what fraction are rejected at each stage, or how solvable the rejected instances are under different tool configurations. These statistics would directly validate the shortcut-elimination hypothesis. Instead, we must infer from the downstream accuracy drop that the removed instances were in fact valuable—which could also be explained by the ablations reducing data quantity rather than data quality (although the 10% enhancement subset's small impact argues against pure quantity effects).

Missing experiments: The paper does not report (1) the number of instances surviving each pipeline stage, (2) the pass@1 rate of a tool-equipped baseline on instances that pass versus fail each filter, or (3) an ablation where the total data quantity is held constant but pipeline stages are removed (replacing filtered instances with random unfiltered ones to maintain dataset size). Without these, the causal claim "filtering eliminates shortcuts" is supported indirectly by downstream performance rather than directly by data characterization.

Claim 4: OpenSearch-VL "achieves results comparable to proprietary commercial models on several tasks"

What the experiments demonstrate: Table 2 shows OpenSearch-VL-32B outperforming GPT-5 direct reasoning (63.7 vs. 45.1 average) and GPT-5 RAG (63.7 vs. 53.6). On individual benchmarks, OpenSearch-VL-32B exceeds proprietary direct reasoning models on SimpleVQA (76.2 vs. 61.6 for GPT-5), FVQA (74.7 vs. 54.4 for GPT-5), and InfoSeek (74.8 vs. 61.7 for GPT-5).

Where the claim is misleading: The comparison is asymmetric in tool access. OpenSearch-VL-32B gets an agentic workflow with seven tools (search, enhancement, OCR); GPT-5 and Gemini-2.5-Pro get either "direct reasoning" (no tools) or "RAG workflow" (pre-retrieved context in a single pass, no iterative tool use). The paper does not compare against proprietary models with equivalent agentic tool access—there is no "GPT-5 Agentic" baseline. The claim "comparable to proprietary commercial models" is true only for a specific, arguably weaker configuration of those commercial models.

What a fairer comparison would look like: Running GPT-5 or Claude Opus 4.6 with the same tool environment $\mathcal{E}$ and the same agent prompt as OpenSearch-VL, making the comparison about agentic capability rather than modality access. The paper uses Claude Opus 4.6 as the expert for SFT trajectory synthesis (Section 3.3), confirming that the proprietary model can use the tools effectively—but the paper never evaluates it on the benchmarks under comparable conditions. The absence of this baseline makes the "comparable to proprietary" claim rest on an asymmetric comparison.

Claim 5: The training recipe "scales effectively from 8B to 32B"

What the experiments demonstrate: OpenSearch-VL improves monotonically with model scale: 56.6 (8B) → 61.6 (30B-A3B) → 63.7 (32B). The gains over the corresponding Qwen3-VL agentic baselines also increase: +14.6 (8B), +13.8 (30B-A3B), +15.7 (32B).

Where the claim needs qualification: The 30B-A3B is a Mixture-of-Experts model with ~3B active parameters, making it not directly comparable to the dense 8B and 32B in terms of inference cost or parameter efficiency. Additionally, the RL training for the 30B-A3B used different hyperparameters than the 8B (Table 5): 16 samples per prompt vs. 8, different context parallelism, different total training epochs. This means the scaling claim confounds model architecture, model size, and training protocol—we cannot attribute the 61.6 → 63.7 improvement purely to "scaling" when the 30B-A3B and 32B differ in all three dimensions.

Missing point: The paper does not report the performance of the 30B-A3B or 32B models at SFT-only stage (before RL), making it impossible to separate the contribution of data quality from model scale. If the 32B SFT-only model already achieves, say, 58.0, then most of the scaling gain comes from better initialization rather than better RL.

General experimental weaknesses

Single benchmark suite, single modality. Although the paper evaluates on seven benchmarks, all are knowledge-intensive VQA tasks requiring factual retrieval. None test the agent's ability to handle other search scenarios (e.g., code generation with documentation lookup, multi-step procedural reasoning, dialogue-grounded search). The claimed "active perception" capability (visual enhancement before search) is demonstrated only indirectly through the enhancement subset ablation (−1.3 points), which is the weakest ablation result. The paper does not report a dedicated benchmark with degraded images to test whether the agent actually uses enhancement tools effectively at test time.

Small ablation benchmark set. The ablation studies (Table 3) are conducted on only three of the seven benchmarks (SimpleVQA, InfoSeek, FVQA). While these span different difficulty profiles, important benchmark-specific behaviors may be missed—particularly on VDR and MMSearch, which are the benchmarks most directly testing multi-hop search and where OpenSearch-VL shows the largest relative gains (Table 2). The ablation conclusions (e.g., "fuzzy rewriting matters most for SimpleVQA") may not generalize to other benchmarks without testing.

No analysis of tool usage patterns. The paper does not report statistics on which tools the trained agents actually invoke, how often, in what order, or how tool usage differs between SFT-only and fully RL-trained models. Without this behavioral analysis, we cannot verify that the agents are genuinely learning the "verify, don't guess" philosophy advertised in the system prompt (Figure 7). It is possible that the accuracy gains come from improved retrieval query formulation rather than from the claimed multimodal chaining behavior (crop → enhance → search → verify).

No latency or cost analysis. The RL training uses 64 H20 GPUs for 10 days (Section 5, implementation details). At inference, the agent can make an unbounded number of tool calls (until fatal cascade or terminal response). The paper reports no statistics on inference-time tool calls, latency, or API costs for the seven-benchmark evaluation. For a recipe claiming practical deployability, these are essential missing metrics—a 10-point accuracy gain that requires 15 tool calls and 30 seconds per query has very different practical implications than one requiring 3 calls and 5 seconds.

Evaluation judge variance. The paper uses GPT-4o as the judge for both benchmark evaluation and RL reward computation ($r_{\text{acc}}$), and GPT-5.4 for $r_{\text{query}}$. Proprietary judge models are known to exhibit version-dependent behavior and potential biases. The paper acknowledges this limitation (Section 7) but does not report judge agreement statistics, inter-annotator agreement with human evaluators, or sensitivity of results to judge model choice. The query-quality reward $r_{\text{query}}$ is particularly concerning—GPT-5.4 scoring on a continuous $[0,1]$ scale is not externally validated, and the paper provides no examples of high-scoring vs. low-scoring trajectories to calibrate reader expectations about what behaviors $r_{\text{query}}$ actually rewards.

6. Limitations and Trade-offs

6.1 Single Benchmark Domain and Model Family

The assumption or constraint. All seven evaluation benchmarks are knowledge-intensive visual question answering tasks—SimpleVQA, VDR, MMSearch, LiveVQA, BrowseComp-VL, FVQA, and InfoSeek—which collectively test factual retrieval over visual and textual evidence (Section 5). The training data pipeline sources questions from Wikipedia and three QnA-style open-source corpora (LiveVQA, FVQA, WebQA; Section 3.2), all of which share this factual retrieval structure. The paper does not evaluate on code generation with documentation lookup, multi-step procedural planning, dialogue-grounded search, or any domain where the "correct answer" is not a compact factual assertion. Furthermore, all experiments use Qwen3-VL variants (8B, 30B-A3B, 32B) as the base model (Section 5). The paper acknowledges this implicitly by focusing on "knowledge-intensive" benchmarks but never claims broader applicability or tests on other model architectures (e.g., LLaVA, InternVL, proprietary backbones).

The consequence. A practitioner deploying OpenSearch-VL for non-VQA search tasks—code debugging with StackOverflow search, travel planning with itinerary construction, medical literature review with evidence synthesis—cannot estimate expected performance from the reported results. The recipe may transfer well (the fatal-aware GRPO objective and tool environment are domain-agnostic) or may fail (the data pipeline's entity-rewriting and path-sampling assumptions are specific to factoid QnA). Similarly, a practitioner using a non-Qwen base model—even a similarly capable one—has no evidence that the SFT+RL recipe transfers. Distribution shift between base model architectures could interact with the training pipeline in unknown ways: the SFT trajectories were synthesized by Claude Opus 4.6 against Qwen3-VL-aware tool schemas, and the staged filtering uses frozen Qwen3-VL-32B as the difficulty filter. A different base model might produce SFT trajectories that diverge more from Claude's demonstrations, or pass/fail the filtering stage differently.

What evidence exists in the paper. None. The paper does not include any experiments on non-VQA benchmarks, any ablation varying the base model family, or any analysis of whether the data pipeline's assumptions (entity-centric paths, answer-attribute extraction) hold for non-factoid domains. The consistent improvements across all seven benchmarks (Table 2) suggest the recipe is robust within VQA, but this is precisely the domain the pipeline was designed for—the training data and evaluation data are drawn from the same distribution family. This is circular validation rather than generalization evidence.

Mitigation status. Not addressed. The paper does not claim generalization beyond the evaluated benchmarks and does not discuss domain transfer as a limitation.

6.2 Ground-Truth Dependence Throughout the Pipeline Makes the "Open Recipe" Partially Circular

The assumption or constraint. Despite positioning itself as a fully open, reproducible recipe, three critical stages of the pipeline require ground-truth answers or oracle access that is unavailable in a genuine open-domain deployment:

  1. VQA construction (Section 3.1): The wiki path sampling pipeline extracts a "short, unambiguous answer a" from the answer node v_h. This requires knowing which Wikipedia infobox attribute is the target—a form of ground-truth labeling. The fuzzy rewriting acceptance criteria (Eq. 6) require that a(q_f) = a(q_t)—the rewritten question must preserve the exact answer. This answer-invariance check requires knowing the ground-truth answer a.

  2. Staged filtering (Section 3.2): Filter A discards instances where a frozen Qwen3-VL-32B produces the correct answer without tools. Filter B discards instances where the model produces the correct answer with a single ImageSearch call. Both filters require knowing which answer is correct to adjudicate pass/fail.

  3. Expert trajectory synthesis (Section 3.3): The first rejection stage discards Claude Opus 4.6 rollouts whose final answer disagrees with the ground truth a. The second stage uses a GPT-5.4 process-level judge that scores query quality—a reward signal that also requires ground truth for the accuracy component and leverages a proprietary frontier model.

  4. RL training (Section 4.2): The composite reward (Eq. 9) requires r_acc—a GPT-4o judge comparing the agent's final response to the ground-truth answer. The query-quality reward r_query uses GPT-5.4 and its evaluation rubric presupposes access to the ground truth (the judge prompt in Figure 11 includes [Ground Truth Answer] as input).

The paper is transparent about using these signals—they are described in detail—but the cumulative effect is that OpenSearch-VL requires ground-truth answers at every stage from data construction through training. This is not a limitation of the trained agent at deployment (the agent itself does not need ground truth to answer questions), but it is a limitation of the recipe's reproducibility on new domains: applying OpenSearch-VL to a new domain requires constructing a labeled QnA dataset with verified answers, which is the expensive step the pipeline was designed to automate.

The consequence. The paper claims to provide a recipe that "lowers the reproducibility barrier" (Section 7), but reproducing it on anything other than the existing Wikipedia-derived benchmarks requires exactly the kind of ground-truth labeling the data pipeline was meant to circumvent. The Wikipedia path sampling and fuzzy rewriting are automated, but the validation that the automated pipeline worked—checking answer invariance, checking that filters rejected only truly shortcut-solvable instances, checking that expert trajectories are correct—requires ground-truth answers. A practitioner attempting to apply OpenSearch-VL to, say, medical image search would need a labeled dataset of (image, question, answer) triples to replicate even the data construction stage, let alone the RL training.

What evidence exists in the paper. The paper does not directly measure the cost or quality of the ground-truth signals used. It does not report what fraction of candidate VQA instances fail the answer-invariance check in fuzzy rewriting, what fraction of expert trajectories are rejected in the two-stage cascade, or what the inter-annotator agreement is between the GPT-4o judge and human evaluators. It also does not report an ablation where ground-truth-dependent signals are replaced with weaker proxies (e.g., using the base model's own confidence as a pseudo-label for filtering). The ablation on staged filtering (Table 3a, −8.2 points) shows that filtering matters, but does not isolate whether the filtering criterion (accuracy against ground truth) could be replaced with a noisier but cheaper signal.

Mitigation status. The paper does not address this as a limitation. It acknowledges the cost of proprietary judges in the Limitations section:

"our composite reward (Eq. 9) relies on proprietary GPT-4o judges, which are costly, version-dependent, and currently score only textual queries while ignoring intermediate visual operations"

but this framing treats the issue as a cost/API-dependency problem rather than a deeper circularity: the ground-truth answers needed to compute those rewards are the very thing the agent is being trained to find. For the existing benchmarks, this is fine—the test sets have answers. But for extending the recipe to new domains, this means the "open recipe" must be bootstrapped with labeled data, which is precisely the annotation burden the automated pipeline was designed to avoid.

6.3 Proprietary, Unstable, and Unvalidated Reward Signals

The assumption or constraint. The RL training stage (Section 4.2) relies on two proprietary black-box models as judges:

  • Accuracy reward r_acc: A GPT-4o judge (Figure 8, Appendix E) compares the agent's final <response> to the ground-truth answer and assigns a binary {0, 1} verdict for semantic equivalence.
  • Query-quality reward r_query: A GPT-5.4 judge (Figure 11, Appendix E) scores the cumulative sequence of search queries on a continuous [0, 1] scale across four dimensions (semantic relevance, logical progression, signal-to-noise ratio, cross-modal complementarity).

These judge models are proprietary, externally hosted, version-dependent, and subject to change without notice. GPT-5.4 in particular represents the most capable model from a specific commercial lab at the time of writing. The paper acknowledges this partially:

"our composite reward (Eq. 9) relies on proprietary GPT-4o judges, which are costly, version-dependent, and currently score only textual queries while ignoring intermediate visual operations (e.g., Crop); replacing these with open process reward models covering the full visual action space T_v remains a natural next step." (Section 7, Limitations and Future Work)

However, the acknowledgment treats this as a cost/interoperability issue rather than a methodological one. The deeper problem is that we do not know what behavior r_query actually rewards, because GPT-5.4's scoring function is a black box. The paper provides the judge prompt (Figure 11) but this is a description of the intended behavior, not a validation of the actual behavior. The judge's internal reasoning is unknown, its calibration is unmeasured, and its consistency across semantically equivalent trajectories is untested.

The consequence. Three failure modes arise:

  1. Non-reproducibility due to model versioning. A future researcher attempting to replicate OpenSearch-VL's RL training will access a different version of GPT-4o or GPT-5.4 (or neither, if the product is deprecated). The learned policy will differ in unknown ways because the reward function has changed beneath the training process. The paper's claim to provide a "fully open recipe" is undermined by dependence on closed, mutable reward signals.

  2. Unknown reward hacking surface. The query-quality reward r_query scores trajectory prefixes on a continuous scale using a model (GPT-5.4) that itself may exhibit biases—favoring verbose queries over concise ones, penalizing non-English queries, preferring certain query templates. Since the judge is a black box, the RL policy can learn to exploit these biases (producing query patterns that score highly under GPT-5.4 but are not actually effective for retrieval) without the authors being able to detect this from the aggregate accuracy metrics. The fatal-aware GRPO mechanism (Section 4.2) is designed to handle tool-execution errors, but it assumes the reward signal is well-calibrated—if r_query over-rewards a particular query style, one-sided clamping may selectively preserve fatal trajectories exhibiting that style even when it is not genuinely useful.

  3. No validation of r_query as a proxy for actual search quality. The paper does not report any correlation between r_query scores and downstream retrieval effectiveness (e.g., does a higher r_query correspond to more relevant documents returned by TextSearch?), nor any human evaluation of whether trajectories with high r_query scores are qualitatively better than those with low scores. The 0.2 weight on r_query in the composite reward (Eq. 9) means the judge's output directly influences the policy gradient—if the judge is systematically biased, the policy learns the bias.

What evidence exists in the paper. None that directly validates the judge signals. The paper does show that the overall recipe works (Table 2), but this validates the entire pipeline—including SFT on Claude trajectories, the composite reward, and the fatal-aware GRPO—not the r_query signal specifically. It is possible that the accuracy reward r_acc (which has a clear ground-truth anchor) is doing all the work and r_query is adding noise rather than signal. The ablation in Table 3b compares different RL recipes but always with the same composite reward; there is no ablation where r_query is removed (only r_acc used) or replaced with a simpler heuristic (e.g., number of unique queries, length of trajectory). Without such an ablation, we cannot determine whether the 0.2 weight on a proprietary black-box process reward is actually contributing to the 4.2-point gain over vanilla GRPO (Table 3b) or could be replaced with a cheaper signal.

Mitigation status. The paper suggests future work on "open process reward models covering the full visual action space T_v" (Section 7) as a replacement for proprietary judges. This is a direction, not a solution—no such model currently exists, and the paper provides no recipe for training one. The limitation is acknowledged but not addressed within the paper's scope.

6.4 The Hardest Instances Show Minimal Improvement and the Agent Has No Metacognitive "I Don't Know" Capability

The assumption or constraint. The data curation pipeline (Section 3) is designed to produce questions that are solvable through multi-hop search—the staged filtering (Filters A and B) explicitly removes instances that cannot be solved with tools, and the two-stage rejection sampling for expert trajectories (Section 3.3) only accepts rollouts that reach the correct answer. This means the SFT data contains only solvable trajectories. The RL training similarly uses composite rewards whose maximum value (1.0) is achievable only when r_acc = 1—the agent is never rewarded for recognizing that a question is unanswerable given available evidence.

The paper does not test the agent on questions that are genuinely unanswerable—where the answer is not present on the web, where the visual evidence is insufficient, or where contradictory information exists. The seven benchmarks are constructed with verified ground-truth answers, meaning every question is answerable by design. The agent's behavior when faced with an unanswerable question is not characterized.

The consequence. In deployment, users may ask questions that cannot be resolved through available tools: the relevant web pages may not exist, the image may show an unrecognizable entity, or multiple sources may conflict. A well-calibrated search agent should recognize this and respond with a qualified "I cannot determine the answer because..." rather than fabricating a plausible-sounding answer from insufficient evidence. OpenSearch-VL is trained exclusively on solvable problems—the SFT trajectories always end with a correct answer, and the RL reward always pushes toward r_acc = 1. This creates an implicit pressure to always produce an answer, even when the evidence is insufficient. The fatal-aware GRPO mechanism (Section 4.2) may partially mitigate this for trajectories that encounter tool failures (since fatal trajectories receive r_acc = 0), but only for the specific failure mode of cascading tool errors—not for the case where all tools work correctly but the answer simply cannot be found in the retrieved evidence.

The paper provides no evidence that OpenSearch-VL can distinguish between "I found the answer" and "I searched exhaustively and the answer is not in the available sources." The case study (Figure 9, Appendix G) shows the agent arriving at a correct answer through tool chaining, but does not show a negative example where the agent appropriately declines to answer. The absence of such examples is not itself evidence of a problem, but the training regime (100% solvable SFT data, reward function that only gives r_acc = 1 for correct answers) structurally discourages answer refusal.

What evidence exists in the paper. None. The paper does not report:

  • The rate at which the trained agent produces incorrect answers versus declining to answer.
  • The agent's calibration (does its confidence correlate with correctness?).
  • Performance on deliberately unanswerable questions (a standard test for search agents, e.g., questions about fictional entities that resemble real ones).
  • Whether the agent ever emits a response indicating uncertainty or inability to answer.

The benchmarks used (Table 2) report Pass@1 accuracy, which implicitly treats non-answers as incorrect—but the paper does not distinguish between "agent gave wrong answer with high confidence" and "agent gave no answer" (the latter would only occur for fatal trajectories, which trigger r_acc = 0 but may still produce a response before the fatal cascade).

Mitigation status. Not addressed. The paper does not discuss answer calibration, abstention, or unanswerable question handling as design goals or limitations.

6.5 Unbounded Inference-Time Cost Is Not Accounted for in Performance Claims

The assumption or constraint. At inference time, OpenSearch-VL runs in an agentic loop: it emits reasoning traces, invokes tools, receives observations, and continues until it emits a terminal <response> or encounters a fatal cascade of K = 3 consecutive tool-execution errors (Section 4.2, Appendix B.1). There is no explicit limit on the number of tool calls the agent can make, no budget constraint enforced during evaluation, and no reported statistics on inference-time resource consumption. The training objective (SFT in Section 4.1, RL in Section 4.2) does not include any term penalizing trajectory length, number of tool calls, API costs, or wall-clock latency.

The SFT trajectories have an average of 6.3 tool-invocation turns (Section 3.3), and the RL training dynamics (Figure 3, left panel) show fatal-aware GRPO sustaining 10-12 turns on average during training. But the paper does not report how many turns the trained agents use during the benchmark evaluations in Table 2—it is possible that OpenSearch-VL achieves its accuracy gains by using substantially more tool calls than the baselines.

The consequence. The headline accuracy numbers in Table 2 are not cost-normalized. A reader comparing OpenSearch-VL-32B (63.7 average) to Qwen3-VL-32B agentic baseline (48.0 average) cannot determine whether the +15.7 point improvement comes with a 2×, 5×, or 10× increase in inference-time compute. Each tool call incurs multiple costs that compound:

  • API costs: TextSearch involves a Serper API call + JINA Reader fetch + Qwen3-32B summarization (three external services). ImageSearch uses the Polaris Lens API. OCR uses a remote PaddleX service. A single trajectory with 10 tool calls might involve 20-30 external API invocations.
  • Latency: Each API call adds network round-trip time. The SuperResolution tool runs a deep-learning model (EDSR) locally but still requires GPU inference. Sequential tool calls (the agent must wait for each observation before generating the next action) mean latency scales roughly linearly with the number of turns.
  • Monetary cost: The paper does not report costs for any of the external APIs, and since some (Serper, PaddleX) are commercial services with usage-based pricing, the per-query cost is unknown.

For the benchmark baselines, the comparison is asymmetric in tool access: "Direct Reasoning" models use zero tool calls and zero API costs. "RAG Workflow" models use a single retrieval pass. The agentic baselines (MMSearch-R1, WebWatcher, etc.) use tools, but the paper does not report their inference costs either, making it impossible to do a cost-normalized comparison. The paper implicitly claims OpenSearch-VL is better because it has higher accuracy—but if it achieves that accuracy by spending 3× more on API calls than the next-best baseline, the practical value proposition is ambiguous.

What evidence exists in the paper. The training curves (Figure 3, left) report average turns per rollout during RL training (8B model: ~10-12 turns for fatal-aware GRPO vs. ~6-8 for baselines). This is the closest the paper comes to quantifying inference cost, but it is from the training phase (where the model is exploring) and for a single model size. The paper does not report:

  • Average, median, or distribution of tool calls per query during evaluation on the seven benchmarks.
  • Average wall-clock time per query.
  • API cost per query (or even a qualitative estimate of cost).
  • Any comparison of cost-normalized accuracy (e.g., accuracy per 100 API calls, or accuracy at fixed latency budget).

The system prompt (Figure 7, Appendix E) does not instruct the agent to be concise or to minimize tool calls—the philosophy is "Verify, Don't Guess," which naturally pushes toward more evidence gathering.

Mitigation status. Not addressed. The paper does not discuss inference cost as a limitation, does not report cost metrics, and does not propose mechanisms for cost-aware inference (e.g., a budget-conscious stopping condition, a learned policy for deciding when enough evidence has been gathered). The fatal-detection logic (K = 3 consecutive errors; Appendix B.1) provides a safety valve for error cascades but not for the case where the agent makes many successful but unnecessary tool calls.

6.6 The "Active Perception" Claim Is Weakly Supported and the Enhancement Tools May Be Underutilized

The assumption or constraint. The paper positions the visual enhancement tool suite (Sharpen, SuperResolution, PerspectiveCorrect) as a key differentiator from retrieval-only multimodal search agents (Section 1, Section 6.2):

"A blurred photo, a skewed document, or a low-resolution thumbnail cannot be 'searched better'—it must be fixed. Without image enhancement tools, the agent is limited to whatever the raw pixels provide."

The data pipeline (Section 3.2) includes a 10% enhancement subset where images are deliberately degraded and paired with enhancement tools, designed to induce "think-with-image behavior." The system prompt (Figure 7, Appendix E) explicitly instructs the agent to use enhancement tools: "small text → crop; blurry → sharpen; tilted → perspective_correct."

The consequence. Despite this emphasis in the motivation, the empirical evidence for active perception is the weakest of all the contributions. The ablation removing the enhancement subset (Table 3a) causes only a −1.3 point average drop (64.6 → 63.3), the smallest ablation loss by a substantial margin (the next smallest is staged filtering at −8.2 points). This suggests that enhancement trajectories contribute very little to downstream performance on the evaluated benchmarks. This could mean:

  1. The evaluated benchmarks contain mostly high-quality images. SimpleVQA, FVQA, InfoSeek, and the other benchmarks may not systematically include the degraded images (blurred, skewed, low-resolution) that would require enhancement tools. If test images are generally clear, the model never needs to invoke Sharpen or PerspectiveCorrect, and the 10% enhancement subset only helps with robustness to rare edge cases—hence the small ablation loss.

  2. The model does not actually learn to use enhancement tools effectively. The SFT trajectories are synthesized by Claude Opus 4.6, which may or may not use enhancement tools appropriately. The RL training provides no direct reward for using enhancement tools—r_query scores text queries, not visual operations. The accuracy reward r_acc only cares about the final answer, not about whether the agent correctly sharpened an image before OCR. If enhancement tool use does not affect the final answer on the training data (because most training images are clear), the model may learn to skip them.

  3. The enhancement tools are low-quality or poorly integrated. The paper describes Sharpen as a "deterministic deblurring operator implemented via OpenCV Unsharp Masking" and SuperResolution as using "EDSR architecture via OpenCV's dnn_superres module" with a graceful degradation fallback (Appendix F). These are basic implementations—not state-of-the-art. If they produce marginal quality improvements, the agent may learn that invoking them does not meaningfully change downstream OCR or search results.

What evidence exists in the paper. The −1.3 point ablation loss (Table 3a) is the only quantitative evidence. The paper does not report:

  • Tool usage statistics on benchmarks: What fraction of evaluation trajectories invoke Sharpen, SuperResolution, or PerspectiveCorrect? How do these fractions compare to Crop, OCR, TextSearch?
  • Image quality analysis of benchmarks: What fraction of test images are blurry, skewed, or low-resolution? If this fraction is small, the small ablation loss is expected and does not contradict the claim that enhancement tools matter for genuinely degraded inputs.
  • Controlled experiments with degraded test sets: A natural follow-up would be to take a subset of benchmark questions, deliberately degrade the images, and measure whether OpenSearch-VL (with enhancement tools) outperforms baselines without enhancement tools. The paper does not report this.
  • Ablation removing specific enhancement tools: Does removing only Sharpen cause a different loss than removing only PerspectiveCorrect? If one tool is used frequently and another is never used, this would reveal whether the enhancement suite is genuinely integrated or merely present in the action space.

The case study (Figure 9, Appendix G) shows the agent using Crop and ImageSearch and TextSearch but does not show any enhancement tool usage—the image appears clear enough to not require sharpening or perspective correction.

Mitigation status. Not addressed. The paper claims active perception as a contribution (Section 6.2: "the agent must not only search but also intervene—autonomously invoking tools like super-resolution or specialized OCR to remediate visual noise before attempting to reason over it") but the empirical validation is the weakest ablation in the paper. The 10% enhancement subset is a reasonable design choice for introducing enhancement behavior into training, but without evidence that the trained agent actually uses these tools at test time (and that this usage improves accuracy beyond what retrieval alone achieves), the claim remains aspirational rather than demonstrated.

7. Implications and Future Directions

How This Work Changes the Landscape

This paper shifts the paradigm for multimodal search agent research from proprietary capability demonstration to open, reproducible systems engineering. Before OpenSearch-VL, the strongest multimodal search agents were locked inside commercial labs—the training data, tool environments, and reward designs were black boxes. The field could observe that frontier agents existed (Huang et al., 2026; Singh et al., 2025; Team, 2026b) but could not study why they worked or iterate on their components. This paper provides the first complete open implementation: data pipeline, tool suite, SFT recipe, and RL objective, all described in sufficient detail for independent reproduction. The magnitude is not a theoretical breakthrough but an infrastructure contribution—it changes what experiments the community can run.

The paper's most important conceptual reframing is treating data curation as a shortcut-elimination problem. The finding that source-anchor visual grounding alone accounts for an 11.5-point accuracy loss when removed (Table 3a) establishes that prior data construction methods—which typically ground images on or near the answer entity—were inadvertently training agents to use single-hop image search rather than genuine multi-hop reasoning. This reframes the data quality problem from "generate diverse questions" to "systematically audit and eliminate shortcuts," a diagnostic mindset that applies far beyond this paper's specific Wikipedia pipeline. The staged filtering results (Filter A removing tool-free-solvable questions, Filter B removing single-ImageSearch-solvable questions; −8.2 points when removed) further reinforce this: many candidate questions that appear to require search actually do not, and including them in training is actively harmful because it teaches the agent to attempt shortcuts rather than execute search chains. This is a falsifiable claim that future data pipelines can (and should) test: measure what fraction of your training instances are shortcut-solvable, and ablating whether filtering them improves downstream performance.

The paper also resolves a tension that was implicit in prior work. Several systems (Vision-DeepResearch, WebWatcher, MMSearch-R1) demonstrated that RL could improve multimodal search agents, but the mechanisms were opaque—was the improvement coming from better query formulation, better evidence verification, or simply from the model learning to avoid tool-call errors? The fatal-aware GRPO ablation (Table 3b) disentangles these: vanilla GRPO provides a 3.0-point gain over SFT alone (67.6 vs. 64.6), fatal masking adds another 1.5 points (69.1 vs. 67.6), and one-sided clamping adds a further 2.7 points (71.8 vs. 69.1). This progression demonstrates that (i) exploration itself helps, (ii) removing post-failure noise helps even more, and (iii) preventing valid prefixes from being penalized provides the largest marginal gain. The hard-masking baseline's failure (67.7, essentially identical to vanilla GRPO's 67.6) is a diagnostic finding: the simplest approach to handling tool failures—discard the whole trajectory—recovers none of the benefit because the information loss from discarded prefixes balances the noise reduction. This tells future researchers that tool-failure handling is not an optional robustness detail but a first-order determinant of RL training effectiveness, and that the specific mechanism (masking + clamping) matters substantially.

The paper redirects research attention in several ways. More attractive: systematic shortcut auditing in training data, training objectives robust to partial trajectory failures, tool environments that include active perception primitives, and open-source judge models as replacements for proprietary reward signals. Less attractive: building agents that assume pristine visual inputs (the paper's argument that "a blurred photo cannot be searched better—it must be fixed" is empirically supported only by the small −1.3 point enhancement subset ablation, but the conceptual argument is strong enough that future work ignoring visual enhancement should justify why), and treating agentic RL as a black-box optimization problem without analyzing failure modes in the training dynamics (the paper's mechanistic analysis in Figures 3-5 sets a standard for explaining RL gains rather than just reporting them).

Follow-Up Research This Work Enables

Open process reward models for multimodal tool use. The paper's composite reward (Eq. 9) depends on GPT-4o for accuracy scoring and GPT-5.4 for query-quality scoring—both proprietary, version-dependent, and unscalable. The query-quality judge r_query scores only textual queries and ignores visual operations (Section 7 acknowledges this explicitly). A natural follow-up is training an open PRM that scores all actions in the visual action space T_v, including Crop, Sharpen, SuperResolution, and PerspectiveCorrect invocations. The training signal exists: the paper's 36K SFT trajectories contain expert demonstrations of correct visual tool use, and the RL training produces on-policy rollouts with the composite reward as supervision. A strong follow-up would (a) fine-tune Qwen3-VL-32B to predict the per-step format reward r_fmt^{(l)} and the trajectory-level composite reward r(τ), (b) evaluate whether RL training with this open PRM matches or exceeds the proprietary-judge variant, and (c) measure whether the open PRM generalizes to new tool environments or overfits to the specific tool suite in Table 1. A negative result—finding that open PRMs cannot match proprietary frontier judge quality—would be equally informative, establishing a capability ceiling that future work must address.

Cost-normalized agent evaluation with controlled tool budgets. The paper's benchmark results (Table 2) are accuracy-only: OpenSearch-VL-32B achieves 63.7 average, but we do not know at what inference cost. A critical follow-up would replicate the seven-benchmark evaluation with explicit tool-call budgets—measuring Pass@1 accuracy when the agent is limited to 4, 8, 16, or 32 total tool invocations, or when wall-clock time is capped at 10, 30, or 60 seconds. The comparison to direct-reasoning baselines (zero cost) and RAG baselines (one retrieval pass) would then be normalized: OpenSearch-VL vs. Qwen3-VL-32B direct at equal cost rather than equal capability ceiling. A strong experiment would also compare the cost-efficiency of OpenSearch-VL against an alternative where the SFT+RL recipe is applied without enhancement tools—if removing enhancement tools reduces cost by 20% while only reducing accuracy by 1.3 points (extrapolating from Table 3a), the cost-accuracy Pareto frontier might favor the simpler agent. This would directly test whether the "active perception" contribution is worth its inference-time overhead.

Difficulty-conditioned strategy allocation for multimodal search. OpenSearch-VL applies the same agentic policy to all questions, but the data pipeline (Section 3) demonstrates that questions vary enormously in difficulty—some are solvable without tools (Filter A), some require exactly one image search (Filter B), some require multi-hop chains, and some require visual enhancement as a precursor. A natural extension, directly inspired by the compute-optimal scaling framework from the prior sections' reference example, would train a difficulty estimator (a classifier that takes an (image, question) pair and predicts the minimum number of tool calls or the required tool categories needed to answer correctly) and then condition the agent's policy on this estimate—allocating fewer tool calls and simpler strategies to easy questions, and reserving full multi-hop chains for hard ones. The paper's staged filtering pipeline (which already classifies instances by solvability tier) provides the training labels. A strong follow-up would measure whether a difficulty-conditioned agent achieves the same average accuracy as the uniform agent with 30–50% fewer total tool calls, and whether the difficulty estimator transfers to out-of-distribution questions (e.g., from non-Wikipedia domains beyond the training distribution).

Stress-testing the fatal-aware mechanism under adversarial failure distributions. The paper's fatal detection relies on K = 3 consecutive tool-execution errors (Appendix B.1), and the one-sided clamping preserves 8.2% of fatal rollouts (Figure 5). These numbers come from training with the specific tool environment in Table 1, where error rates and patterns reflect the reliability of Serper, JINA, PaddleX, and Polaris Lens APIs. A strong stress-test would systematically vary the failure rate of specific tools—e.g., artificially degrading TextSearch to fail 20%, 50%, or 80% of the time—and measure whether (a) the optimal K shifts (should the fatal threshold increase when failures are more common, to avoid premature truncation?), (b) the fraction of preserved fatal rollouts changes, and (c) the one-sided clamping bias b_G (Appendix B.2, Eq. 25) grows to the point where it distorts group-relative advantage estimates. A negative result—finding that fatal-aware GRPO degrades to vanilla GRPO performance when tool failures exceed some threshold frequency—would establish a boundary condition for the method's applicability that is currently unknown.

Extending the shortcut-elimination framework to non-VQA domains. The data pipeline's core techniques—Wikipedia path sampling, fuzzy entity rewriting, source-anchor grounding, staged filtering—are specifically designed for factual VQA where answers are short and verifiable. Can the same shortcut-auditing philosophy be applied to code generation (where questions might be "What is the time complexity of the function in the screenshot?" with an image of obfuscated code), medical image reasoning (where the question is a diagnosis and the "shortcut" is the presence of a visible text label in the image), or procedural planning (where the question is "How do I assemble this furniture?" and the shortcut is a single instruction-manual search)? A strong follow-up would instantiate the pipeline in one non-VQA domain, measure (a) what fraction of candidate instances are shortcut-solvable under naive data construction, (b) what domain-specific rewrite rules are needed to eliminate those shortcuts, and (c) whether the 3–11 point ablation losses from Table 3a replicate or whether different shortcut types dominate. This would test whether the shortcut-elimination framework is a general principle or Wikipedia-specific.

Combining revisions with search—learning to self-correct within a trajectory. The paper's agent follows a linear tool-use trajectory: think, act, observe, repeat. It never explicitly revises a previous reasoning step or restarts a search chain from a different angle. The fatal-aware masking (Eq. 10) preserves valid prefixes but does not enable the agent to recognize that it made a reasoning error before the tool cascade and self-correct. A natural extension would be to construct SFT trajectories that include explicit revision steps—e.g., "I searched for [X] but found conflicting evidence; let me refine my query to [Y]"—and to design a reward component r_revise that encourages self-correction behavior. This would combine the revision model concept from the prior sections' reference example (fine-tuning the model to condition on its own previous incorrect outputs) with the multimodal tool environment of OpenSearch-VL. A strong experiment would measure whether an agent trained with revision-aware trajectories can recover from non-fatal errors (single tool failures that are not part of a K = 3 cascade) by reformulating its approach, and whether this improves accuracy on the hardest benchmark questions beyond what the current linear strategy achieves.

Practical Applications and Downstream Use Cases

Cost-efficient batch inference for knowledge-intensive VQA at scale. Organizations running large-scale multimodal search—e.g., fact-checking organizations verifying image-embedded claims, e-commerce platforms answering product-specific questions from user-uploaded photos, or research groups constructing knowledge bases from web-crawled image-text pairs—can adopt the OpenSearch-VL recipe directly. The 13.8-point average improvement over the Qwen3-VL-30B-A3B agentic baseline (61.6 vs. 47.8; Table 2) represents a substantial accuracy gain at comparable or lower cost than proprietary alternatives (since OpenSearch-VL uses open models with self-hosted inference). For a batch of 100K multimodal queries where each incorrect answer requires expensive human review (0.50–0.50–2.00 per review in typical annotation pipelines), a 14-point accuracy improvement saves 14,000 human reviews, translating to 7,000–7,000–28,000 in direct cost reduction. The open-source release (datasets, code, model checkpoints) means organizations can fine-tune on their own domain-specific data using the provided recipe without licensing fees or API rate limits.

On-device deployment of visual search assistants with smaller models. The 8B-scale OpenSearch-VL model (Table 2: 56.6 average) demonstrates that strong multimodal search capability is achievable at model sizes that can run on edge devices or consumer GPUs. A mobile application for plant identification, landmark recognition, or product search could run OpenSearch-VL-8B locally: the user takes a photo, the agent optionally sharpens or crops the image, performs a visual entity search, retrieves factual details via text search, and returns a verified answer—all with no cloud dependency and no data leaving the device. The fatal-aware error handling is particularly valuable here: on-device networks are unreliable, and the agent's ability to persist through transient API failures (conservative K = 3 consecutive-error threshold) means a brief connectivity loss during a TextSearch call does not derail the entire query. The enhancement tools (Sharpen, SuperResolution, PerspectiveCorrect) address the exact failure modes of smartphone photography—blurry close-ups, low-light noise, off-angle document captures—making the recipe directly applicable to mobile deployment without additional engineering.

Data generation for self-improving multimodal agents. The trajectory synthesis pipeline (Section 3.3) uses Claude Opus 4.6 as an expert to generate 36K SFT demonstrations, but this is expensive and API-dependent. A self-improvement loop becomes feasible with OpenSearch-VL: (1) use the trained OpenSearch-VL agent to generate trajectories on a large corpus of unlabeled (image, question) pairs; (2) apply the same two-stage rejection cascade (answer correctness via the composite reward judge, process quality via the query-quality judge) to filter for high-quality trajectories; (3) fine-tune the base model on these self-generated trajectories; (4) repeat. The paper's finding that SFT + RL provides a 7.2-point gain over SFT alone (71.8 vs. 64.6 on the ablation subset; Table 3b) provides a lower bound on what one iteration of self-improvement could achieve if the agent's own trajectories approach the quality of Claude's demonstrations. The availability of open model weights means the entire loop can run without proprietary infrastructure beyond the initial reward judges—and even those could be replaced with an open PRM (see the first follow-up direction above), making the loop fully open.

When to Prefer This Method

The paper does not explicitly frame OpenSearch-VL against named alternatives with a decision rule—it is positioned as an "open recipe" that reproduces capabilities previously locked in proprietary systems, rather than a method that should be chosen over something else in specific circumstances. The contribution is infrastructure (data, code, tools) rather than a novel algorithm that trades off against alternatives. The Table 2 comparison against direct reasoning, RAG workflow, and agentic workflow baselines demonstrates that for multimodal knowledge-intensive VQA, the agentic workflow trained with the OpenSearch-VL recipe consistently outperforms non-agentic approaches and prior open agentic systems, but this is a statement about the problem setting rather than a conditional preference.

A conditional tradeoff is implicit in the paper's architecture: OpenSearch-VL should be preferred over retrieval-only multimodal agents (like MMSearch-R1 or WebWatcher) when (a) visual inputs may be degraded (blurry, skewed, low-resolution) and the agent must repair them before searching, and (b) tool-execution failures are common enough that fatal-trajectory handling meaningfully affects training stability. The evidence for (a) is weak (the −1.3 point enhancement subset ablation; Table 3a), so this conditional is aspirational rather than empirically grounded. The evidence for (b) is strong (the 4.2-point gain from fatal-aware GRPO over vanilla GRPO; Table 3b), suggesting that OpenSearch-VL's RL recipe is preferable specifically when training in environments with unreliable tools—the exact setting the paper was designed for.