When the Right Answer Is No Answer: Teaching AI to Refuse Messy Math

A scanned exam paper is not a polite input.

It arrives bent, shadowed, annotated, folded, half-covered by a student’s handwriting, and occasionally photographed at an angle chosen by someone apparently in active conflict with geometry. For a human teacher, this is annoying. For a document AI system, it is more than annoying. It creates a dangerous fork in the road: extract what is visible, or admit that the question cannot be recovered.

Most document AI benchmarks reward the first path. They ask whether the model can read, parse, segment, and format. MathDoc, a new benchmark for structured extraction from noisy high-school mathematics exam papers, puts pressure on the second path: can a multimodal model recognize when the correct output is refusal?¹

That sounds like a small addition. It is not. In production document workflows, the costly failure is often not a blank field. A blank field can be routed to review. The costly failure is a confident reconstruction of something that was never actually visible.

This is the mechanism worth understanding: current multimodal models can be impressively good at extracting recognizable mathematical questions, while still being poorly calibrated at the boundary where the input stops being complete. In other words, they can read the document and still fail the document.

MathDoc turns “messy paper” into a refusal benchmark

MathDoc is built from authentic Chinese high-school mathematics exam images, not clean synthetic pages or neatly scanned textbook layouts. The authors begin with roughly 30,000 raw exam images and curate 460 challenging images with multi-column layouts, dense text-figure interleaving, handwriting, corrections, stains, wrinkles, folds, and incomplete question regions. From these images, they construct a benchmark of 3,609 questions.

The distribution matters because this is not just a formula-recognition dataset wearing a new jacket. The benchmark contains 2,169 multiple-choice questions, 758 fill-in-the-blank questions, and 682 solving questions. It also includes questions with figures and a substantial subset explicitly marked as unrecognizable: 381 choice, 134 fill, and 158 solve questions. The paper reports average question lengths from about 110 to 195 characters, with formulas making up roughly 44% to 50% of the text.

That last detail is not decorative. Mathematical exam extraction is hard because a question is a unit, not a bag of OCR tokens. A usable extraction must preserve the stem, options, formulas, reading order, diagrams, and sometimes visible handwritten answer marks. A missing superscript, a cropped vertex label, or a confused option boundary can change the meaning of the problem. The model is not merely asked to “read text.” It is asked to reconstruct a structured assessment object.

The authors annotate the dataset through a three-stage process: Qwen3-VL-Plus provides initial structured Markdown and figure crops; domain experts correct text, image crops, and refusal labels; peers and senior experts cross-check ambiguous cases. The refusal labels are especially important. They define cases where critical information is occluded or physically truncated, and therefore the expected output is not a best-effort transcription. It is a rejection token such as [Unrecognizable].

This changes the benchmark from a pure extraction test into a reliability test.

The key failure is forced transcription

The paper defines the task as document-level structured extraction. Given an exam-paper image, the model should output a structured set of problems. Each question requires three linked capabilities:

The refusal part is where the paper becomes useful beyond education. The authors formalize completeness as a binary condition: if the question is complete, extract it; if the visual information is incomplete, output rejection. The operational idea is simple. A system should not silently transform bad input into fake structure.

The evaluation pipeline reflects this. For recognizable questions, the benchmark measures stem accuracy using normalized Levenshtein similarity and evaluates figure extraction using a multimodal model as a semantic judge. For unrecognizable questions, it evaluates refusal as a binary classification problem using precision, recall, and F1.

That split is the point. A document AI system can have high extraction accuracy on valid questions and still be unsafe if it misses most invalid ones. High OCR quality is not the same as completeness awareness. This is where many procurement demos quietly cheat, usually without intending to. They show clean pages, report parsing accuracy, and call it “document understanding.” Fine. Then the real world walks in with a wrinkled invoice, a shadowed ID card, a damaged claim form, or in this case, a math question hidden under a fold.

The model does not always say, “I can’t read this.”

Sometimes it completes the story. Very helpful, in the way a confident intern with no source file is helpful.

The main results show a precision-recall mismatch, not simple incompetence

The benchmark evaluates both closed-source and open-source systems, including Gemini-2.5-Pro, GPT-4o, Doubao-Seed-1.6-vision, Qwen3-VL variants, GLM-4.6V, InternS1, DeepSeek-OCR, MinerU2.5, and PaddleOCR-VL.

The headline result is not that all models are bad. That would be too easy, and also false. Some models are strong extractors. In the solving-question table, Qwen3-VL-30B reaches stem accuracy of 0.8891 and visual similarity of 0.6267, the strongest extraction scores reported there. Gemini-2.5-Pro, meanwhile, has the strongest final score on solving questions, helped by much better refusal metrics.

The mechanism appears when we separate extraction from refusal.

The useful phrase from the paper is the “Low Recall, High Precision” pattern across most models, with Gemini as a partial exception. In plain terms: when these models refuse, the refusal is often correct; they just do not refuse often enough. This is much more interesting than a generic hallucination complaint.

Low refusal recall means the system is missing invalid cases. High refusal precision means the refusals it does make are not random panic. So the weakness is not that the model has no concept of illegibility. The weakness is that the refusal trigger is underactive.

That is a business-relevant distinction. If a model refuses too often, the cost is manual review volume. If it refuses too rarely, the cost is corrupted downstream data. These are different failure modes. One irritates operations. The other poisons decisions.

Choice questions expose why structure is harder than text

The paper also reports that models tend to perform better on solving questions than on multiple-choice questions. At first, that sounds backward. Solving questions are longer and often more complex. Multiple-choice questions look simpler.

The explanation is structural. Choice questions often compress stems, options, symbols, and answer marks into dense page regions. A small localization error can attach the wrong option to the wrong stem or miss a crucial printed choice. Solving questions, despite being longer, may offer richer linguistic context and more redundant clues. The model can lean on broader context to recover the structure.

This is a familiar lesson for anyone building document automation: difficulty is not proportional to text length. A short field can be harder than a paragraph if its meaning depends on location, alignment, checkmarks, table cells, or a neighboring diagram.

The paper’s comparison between end-to-end multimodal models and multi-stage document pipelines adds another operational clue. End-to-end MLLMs generally outperform pipeline systems such as MinerU and PaddleOCR-VL in the reported experiments. The authors attribute this partly to error cascading: if layout analysis fails early, downstream recognition inherits a damaged structure.

That does not mean every business should throw away pipelines and call one large multimodal model. It means pipeline design must respect where the irreversible decisions are made. A bad crop, a mistaken region boundary, or a lost diagram reference can be more damaging than a slightly noisy OCR token. The first error changes the object being read. The second merely makes the reading imperfect.

The refusal boundary moves with information loss

The most valuable part of the paper is not the leaderboard. It is the refusal mechanism analysis.

The authors construct a targeted experiment using 50 independent questions cropped from the original full-page images. They apply generative erasure to simulate different levels of missing information and define an information loss rate:

They then measure the refusal rate at each occlusion level:

This test is best understood as a sensitivity test, not the main benchmark. It asks: how much visual damage must happen before a model says no?

The results show a model-scale pattern. Using a 50% refusal rate as the threshold, Qwen3-VL-30B reaches that threshold at 20% information loss. GLM-4.6V-9B reaches it at 30%. Lighter models such as InternS1-8B and Qwen3-VL-8B keep attempting answers until around 40% information loss.

That does not prove that larger models are automatically safer. It suggests that larger models in this setup are more sensitive to missing visual integrity. They notice the wound earlier. Smaller models tolerate more damage before refusing, which may look useful in a demo because they keep producing output. The problem is that production systems do not need theatrical effort. They need valid data.

This is where refusal becomes an engineering control. A good document system needs a calibrated boundary between “extract” and “route to review.” MathDoc gives one way to measure whether that boundary exists.

Cropping helps because attention is not the same as judgment

The second targeted experiment tests a practical mitigation: isolate the problematic question region before asking the model to judge it.

The authors compare full-page mode against single-question mode on 110 unrecognized questions. In full-page mode, a model can answer, stay silent, or explicitly refuse. In single-question mode, the cropped unrecognizable question is provided directly, and the model either answers or refuses. The paper defines three metrics:

The figure reports a striking pattern. In full-page conditions, active refusal is low. The paper highlights an active refusal rate of only 1.82% for the smaller Qwen3 variant. The plotted values show high refusal failure rates: 47.3% for Qwen3-VL-30B, 73.6% for the smaller Qwen3 variant as labeled in the figure, 67.3% for InternS1-8B, and 70.0% for GLM-4.6V-9B. Cropping improves refusal behavior, with mitigation rates of 43.6%, 24.6%, 27.3%, and 26.4% respectively.

The mechanism is plausible: full-page context can distract the model or allow it to borrow surrounding cues and continue the transcription performance. Cropping forces the model to confront the local incompleteness. It removes the comforting illusion that the missing part might be inferable from the rest of the page.

For business systems, this is not a magic fix. It is a workflow hint. Before asking a model to extract everything from a page, it may be better to segment candidate units, run local legibility checks, and allow refusal at the unit level. Invoices, claims, contracts, exam papers, application forms, and KYC documents all share this property. The unit of trust is rarely the whole page. It is the field, table row, signature block, question, figure, or clause.

What the paper directly shows, and what business teams should infer

The safest way to use this paper is to separate direct evidence from operational inference.

This distinction matters because the paper is not a general theory of document automation. It is a carefully constructed benchmark in one difficult domain. But the failure mode is not domain-specific. Any workflow that converts damaged documents into structured data faces the same risk: a model may prefer completion over refusal.

The uncomfortable business truth is that extraction accuracy is easier to sell than refusal discipline. A dashboard with 90% extraction accuracy looks better than one with a large human-review queue. But a human-review queue is visible cost. Silent corruption is hidden cost. Hidden cost usually wins the political battle until it becomes a compliance incident, customer dispute, or embarrassing audit sample.

A better production pattern: extract, refuse, and route

The practical design lesson is not “use MathDoc for everything.” The lesson is to make refusal a first-class output.

A document AI pipeline influenced by this paper would look less like a single transcription call and more like a controlled workflow:

1. Page intake and coarse quality screening. Detect blur, skew, occlusion, shadows, missing edges, and document damage before extraction begins.

2. Unit segmentation. Split the page into meaningful objects: questions, fields, invoice lines, signature blocks, form sections, or diagram-text pairs.

3. Local legibility assessment. Judge each unit for completeness, not merely readability. A field can be visually sharp and still semantically incomplete if its left edge is cropped.

4. Structured extraction only for complete units. Extract text, formulas, coordinates, figures, and metadata only after passing the completeness gate.

5. Explicit refusal labels. Store refusal as structured data: reason, location, confidence, and suggested review type.

6. Human review routing. Route refused units to review instead of forcing the model to repair missing content with imagination. Imagination is cheaper than labor, yes. So is arson.

This workflow is not glamorous. Good. Production AI usually becomes useful at the point where glamour leaves the room.

The ROI pathway is also more disciplined than “AI replaces manual entry.” Better refusal can reduce rework, prevent downstream corrections, improve auditability, and make human review more targeted. The gain is not only faster extraction. It is cheaper diagnosis of when extraction should not happen.

The benchmark’s limits are practical, not fatal

MathDoc has clear boundaries.

First, the dataset is from Chinese high-school mathematics exams. The specific layout patterns, handwritten marks, formula density, and figure types will not match every document domain. A tax form, a bank statement, or a medical claim has different error distributions.

Second, the paper’s enhancement strategy is cropping, not a fundamental model architecture or training solution. The authors themselves note that they have not yet explored architecture design or pre-training objectives to suppress speculative completion more deeply. Cropping helps expose incompleteness; it does not prove that the model has developed a robust internal theory of missing information.

Third, part of the evaluation uses a multimodal model as a semantic judge for figure similarity. The appendix addresses this by explaining the constrained judging protocol, including semantic completeness checks rather than raw pixel overlap. That is reasonable for this task, but still not the same as absolute ground truth. For enterprise use, judge-based metrics should be supplemented with sampled human audits, especially where compliance or money is involved.

Finally, some figure labels in the refusal-enhancement experiment are not perfectly aligned with the main model naming in the tables. The main interpretation remains clear: full-page inputs often under-trigger active refusal, while cropped single-question inputs improve refusal behavior. But exact model-by-model comparison should be read with that small reporting wrinkle in mind.

None of these limitations weaken the central insight. They tell us where not to overclaim it.

The real benchmark is whether the system can stop

MathDoc is nominally a benchmark for mathematical document extraction. Its broader message is about operational humility.

The easy version of document AI says: give the model a page and ask for structured output. The harder version says: give the model a page, ask what is complete, ask what is damaged, extract only what survives, and preserve refusal as a valid result.

That harder version is less exciting in a demo. It is much more useful in a business.

When a model sees a folded exam question and produces a polished reconstruction, it is not being intelligent. It is being obedient to the wrong objective. MathDoc’s contribution is to make that obedience measurable. It reminds us that reliability is not only the ability to answer correctly. Sometimes reliability is the ability to leave a blank space and make the workflow deal with it.

For document AI, the right answer is not always a better answer.

Sometimes the right answer is no answer.

Cognaptus: Automate the Present, Incubate the Future.