Across two ImageEval 2026 tracks, our best results came from analyzing the evaluation machinery rather than from a stronger model, yielding 1st place on hallucination detection (Task 1b, Modern Standard Arabic) and 4th on CRAI-Bench (Task 2). On CRAI-Bench, which asks systems to predict human cultural-accuracy scores for AI-generated images of Qatari scenes, a blind frequency prior that never looks at an image reaches dev Spearman 0.6878, above the organizers’ GPT-4-as-judge baseline of 0.625; adding two vision judges, with blend weights tuned against the global ranking metric rather than by scene-level cross-validation, reaches 0.7806 on the blind test. The weighting correction alone is worth +0.0296 test Spearman, because scene-level cross-validation is structurally blind to the within-cell ranking that judges contribute. On Task 1b, reframing "label three statements true/false" as "select the one grounded statement" makes invalid labelings structurally impossible and reaches 0.964 combined accuracy on the blind test, against an official baseline of 0.508. A matched-model ablation shows most of that headline gap is the underlying judge, but the constraint still adds +0.026 combined accuracy and eliminates the 4.0% of items that otherwise receive structurally invalid labelings; meanwhile upgrading to a stronger judge is worth nothing measurable and a three-model vote scored lower.

We describe our systems for all four ArGuard 2026 subtasks: binary and fine-grained Arabic hateful-meme detection (A1/A2) and binary and granular harmful-prompt detection (B1/B2). Our systems are deliberately conventional (a LoRA-tuned Qwen3-VL-8B for memes, a nine-encoder ensemble for prompts) because our central finding is that most of the achievable headroom lay not in the model but in decode-time calibration: per-class thresholds refit under structural constraints, rank-based decoding against known or published class priors, and threshold transport under distribution shift. On subtask A2, our submissions rose from 0.248 to 0.419 macro-F1; roughly 0.15 of that gain came from decode-time changes against under 0.03 from model-side interventions, and a fixed-model ablation on the ensemble’s char-ngram member attributes +0.070 to the decode stack alone. On B1, recalibrating a single threshold recovered +0.16 macro-F1 after we detected that the blind test was rebalanced to approximately 49% unsafe against an 80% unsafe training prior. Our final systems ranked 1st on subtask A2 (macro-F1 0.4194; 0.3913 without per-class scoring feedback), 3rd on A1 (0.7889), 3rd on B2 (0.7695), and 7th on B1 (0.7552). We additionally report a benchmark audit conducted during participation: a sequential-id label leak in the Task B development release (macro-F1 1.000 from ids alone), identified before the test release, left unexploited, and absent from the re-indexed test files; latent taxonomy structure that contradicts the task description; and a quantified gap between development and test distributions.