HALLMARK: How to Diagnose LLM Citation Verifiers and When to Deploy Them
A benchmark for citation-hallucination detection: 2,526 annotated references across 14 hallucination types and three difficulty tiers, scored against 19 baseline variants. My part was the model sweep and the diagnosis of where it breaks.
Overview
Why a benchmark The NeurIPS 2025 incident — 53 papers found to contain fabricated citations that had passed peer review — exposed a gap: there was no standard way to measure how well a tool detects a hallucinated reference. HALLMARK is that measurement. 2,526 annotated entries, 14 hallucination types across three difficulty tiers, six sub-tests per entry (DOI resolution, title matching, author consistency, venue verification, field completeness, cross-database agreement), and 19 baseline variants from a DOI-only check to agentic LLMs with tool use. Cascade runs beyond the default model The headline result is a two-stage cascade: a database lookup first, then an LLM that diagnoses whatever the database could not resolve. Run on one model family that result is an anecdote, so I ran the cascade on GPT-5.1 and GPT-5.4 alongside the Claude Sonnet configuration, across the dev, test and stress splits. Per-type detection rates (Figure 1) are what the comparison is for: the aggregate numbers sit close together while the failures do not, and the types where a model collapses differ by model. Where the task stops working I ran the verification task down the Qwen3 parameter range — 4B, 8B, 14B, 32B — to find where citation verification stops being viable rather than assuming a frontier model is required. The question is a deployment one: a screening tool that has to run over every reference in every submission cannot afford the top of the cost curve. GEPA prompt optimization Rather than hand-tuning the zero-shot verification prompt, I optimised it with GEPA, using a small model as the task LM and a larger one for reflection, scored on a stratified 50-entry training sample with a disjoint 200-entry validation set. The metric is deliberately blunt — the label is right or it is not, and an UNCERTAIN verdict scores zero — because a verifier that hedges is a verifier a human still has to check. Multi-defect analysis Real fabricated references usually have several things wrong at once: a real DOI, a wrong title, invented authors. The scorer only compares labels, so a tool gets full credit for catching any one defect. I measured how much of the benchmark is multi-defect and what the metrics actually reward there, because that gap between "flagged it" and "understood it" is the difference between a screening tool and a diagnosis.
- Built with
- Python, GEPA, OpenRouter
- Outcome
- ICLR 2027, under review
- Where
- ELLIS Institute Tübingen