Why a Fabricated Citation Needs Its Own Retrieval Step

The question that started this

This piece exists because of a question an engineer put to me, and it is the sharpest version of the problem I have heard anyone state.

The setup was a familiar one: an extraction system that reached roughly 90% accuracy — encouraging, but not operationally reliable. The reason it was not reliable is the part worth keeping. If the reviewer still has to read everything to find the errors, you have moved the burden, not removed it. My answer was that the fix cannot live in a single confidence threshold, and that every claim has to be decomposed to an atomic unit and judged against outside evidence rather than the model's own memory.

The follow-up went straight to the hardest part of the design. Paraphrasing it:

A plausible fake source is worse than a plausible fake number, because it launders the confidence — you verified it, so it must be right. How do you build the check for that specifically? A citation not tracing to a real reference sounds like it needs its own retrieval step, separate from the fact-check itself.

That instinct is correct, and it is worth more than a comment reply. A citation check does need its own retrieval step. The reason is structural, it is measurable in the peer-reviewed literature, and most validation stacks I have seen do not implement it — because they treat citation checking as a sub-task of fact checking rather than as a second, differently-aimed retrieval.

Correctness and citation quality are two different measurements

The cleanest evidence that these are separate problems comes from how the field decided to measure them. ALCE — the first benchmark for automatic evaluation of LLM citations — scores generated text along three dimensions: fluency, correctness, and citation quality (Gao et al., 2023). Correctness and citation quality are not nested. They are orthogonal axes, because a system can produce a true statement attached to a source that does not support it, and it can produce a well-supported statement that happens to be false.

Citation quality itself decomposes further, and this is the part worth internalising. ALCE measures citation recall — whether the statement is entirely supported by the passages it cites — and citation precision — whether any cited passage is irrelevant, meaning it cannot support the statement and removing it would not change whether the remaining citations do (Gao et al., 2023). Recall catches under-citation. Precision catches decoration: sources hung on a sentence to make it look sourced.

The headline result is the one to sit with. On the ELI5 dataset, even the best systems evaluated lack complete citation support 50% of the time (Gao et al., 2023). Not wrong half the time — unsupported by their own citations half the time. If your pipeline only asks "is this claim true?", that entire failure surface is invisible to you.

Three ways a citation fails, and only one of them looks like a lie

Once you accept that attribution is its own variable, the failure modes separate cleanly. They need different detection, and they are not equally visible.

Failure 1 — the reference does not exist. The model invents a paper, an author pairing, a volume number. This is the one everybody pictures, and it is common enough to be a baseline behaviour rather than an edge case: in a peer-reviewed audit of generated bibliographies, 55% of GPT-3.5 citations and 18% of GPT-4 citations were outright fabricated (Walters & Wilder, 2023). In a clinical literature test, a chatbot produced 35 references of which only two were real (McGowan et al., 2023).

Failure 2 — the reference exists, but the pointer is wrong. This is the quieter one and the more dangerous one. In the same audit, among the citations that were real, 43% (GPT-3.5) and 24% (GPT-4) still carried substantive errors in volume, pages, or year (Walters & Wilder, 2023). The source resolves. The link works. The claim attached to it is not the claim it makes. Every check that verifies citation form passes this cleanly.

Failure 3 — the reference exists and said it once. The document was revised, the regulation moved from proposed to final, the page you quoted was rewritten. Your quote was accurate on the day it was captured and is false today. Status is not static: a regulation travels proposed → final → in force → amended → repealed, and a citation that does not carry a version is a citation that will eventually be wrong Sagentix 16-Point Quality Gate, 2026.

Note what these three have in common: none of them is detectable by asking whether the underlying claim is true. In failure 2 especially, the fact is frequently correct. That is exactly the laundering mechanism described above — the verification step certifies the claim, and the certification transfers, undeserved, to the attribution.

The second retrieval: what the citation check actually has to do

Here is the architecture, stated as a design rather than an implementation.

The fact-check runs a retrieval over evidence: take an atomic claim, go find what the world says about it, judge the claim against what came back. This is the well-mapped path — decompose long text into atomic facts and score the share supported by a reliable knowledge source (Min et al., 2023); or have an agent break a response into individual facts and reason over search results per fact, which agrees with human annotators 72% of the time and wins 76% of the cases where they disagree (Wei et al., 2024).

The citation check runs a retrieval over something else entirely: the reference graph of the document itself. Its index is not the web. It is the bibliography. And it asks three questions in order.

First, does the citation resolve? Every in-text citation must join to a reference entry, and every reference entry must resolve to a retrievable document. This is a graph problem before it is a semantic one — no language understanding required, which is exactly why it should run deterministically and block on failure. It also has to run in both directions. An in-text citation with no reference entry is a candidate fabrication. A reference entry that nothing cites is decoration — the citation-precision failure, dressing rather than evidence.

Second, does the retrieved document support this specific claim? This is the step that cannot be shortcut, and the step most stacks skip. It requires fetching the text of the cited document — not searching the web for the topic and finding something adjacent that agrees. Adjacent agreement is how a wrong claim survives: the search returns neighbouring facts, the claim looks corroborated, and the actual cited source was never opened. The comparison is a diff between the claim and the fetched text, with a verdict per claim, not per document.

Third, is this the version I am quoting? A live fetch and an archived capture of the same URL will disagree when a source has been revised. That disagreement is the signal. If a quote matches only the archived version, the citation is superseded — still honest, no longer true, and it must be re-anchored or dated rather than presented in the present tense.

Only the third question overlaps at all with the fact-check. The first two run on an index the fact-check never touches.

The failure nobody instruments: proving the retrieval worked

This is the operational detail I would give anyone building this, because it is the one that quietly inverts your results.

Your citation checker concludes things are absent. "The source does not contain this." "No reference matches." Absence is a legitimate finding — and it is also exactly what a failed fetch looks like.

Several authoritative primary sources return HTTP 403 to scripted clients while serving normally to a browser. Others return a 200 with a few hundred characters of bot wall. Both cases hand your checker an empty document, and an empty document trivially "does not contain" your claim. The check reports a clean absence. The claim gets flagged, or worse, a negative claim — "the regulator does not address X" — gets confirmed by a page you never actually read.

The guard is simple and non-negotiable: prove the retrieval succeeded before you are permitted to conclude anything is missing. Fetch with a real browser user-agent. Require a canary — some other string you know is on that page — before accepting the document as read. Treat a thin response as an unproven fetch, not an empty source. And report unproven, never absent, when the canary fails.

Negative claims deserve their own tier of scrutiny generally. "X does not require Y", "no published guidance covers Z", "the standard is silent on W" — these are the highest-risk class, because they are refuted by a single heading you did not scan, and because they cannot be confirmed by finding something. They can only be confirmed by exhaustively failing to find it, which is precisely the operation a broken fetch fakes perfectly.

What it costs when this ships

The consequences are no longer hypothetical or confined to research benchmarks. A public database maintained by legal researcher Damien Charlotin tracks court decisions in which a tribunal found that a party relied on AI-hallucinated content — typically fake citations. As of 3 August 2026 it records 1,822 identified cases, and the maintainer describes it as a work in progress rather than a complete census (Charlotin, 2026).

That is the professional-liability shape of the problem, in the one domain where every citation is checked adversarially by an opponent who is paid to check it. Most industries do not have that adversary. In consulting, the check happens in a board meeting, once, in public — or it does not happen at all, which is worse, because the wrong number then compounds into the next three decisions.

The underlying model behaviour is stable across domains. Asked direct, verifiable questions about randomly selected federal court cases, leading models hallucinated between 58% (GPT-4) and 88% (Llama 2) of the time (Dahl et al., 2024). Applying atomic decomposition to ChatGPT's long-form biography generation put factual precision at 58% — roughly four in ten confident assertions unsupported by a reliable knowledge source (Min et al., 2023). These are not the numbers of a system you can spot-check.

How this runs in practice

At Sagentix, no deliverable ships on the generative layer's word. Claims are decomposed to atomic units and traced to source in a fixed precedence order, and the resulting verdicts are four, not two: confirmed, partial, contradicted, or can't-tell. Contradicted is hard-blocked — it never reaches a page. Can't-tell is labelled for a human, never quietly dropped, because silent deletion is how a coverage gap becomes an unknown unknown. The reference-graph join described above runs as its own blocking stage: an in-text citation that resolves to no reference entry stops delivery, and it resolves by exact identity against a single entry rather than by resemblance across the bibliography. External numbers clear two independent sources before they ship, and anything irreversible is staged for a person rather than auto-sent Sagentix 16-Point Quality Gate, 2026.

That identity requirement is not pedantry, and it is the detail most implementations get wrong. The tempting shortcut is to check that the author appears somewhere in the reference list and the year appears somewhere in the reference list, and call the citation resolved. Those are two independent lookups, so an invented citation to a Chen paper dated 2024 satisfies both the moment one entry contains that surname and a different entry contains that year. It reads as a citation check; it is a similarity score wearing the costume of one. Similarity is exactly the property a fabricated citation already has.

Which yields the one piece of advice I would give anyone building this: plant a fake citation and confirm the check fails before you trust it. A verification step you have never seen fail is not yet evidence of anything.

The economics matter here, because verification is where evidence discipline usually dies — it is expensive, so it gets sampled. Automating the per-claim judgement is what makes exhaustive checking affordable at all: the agent-based evaluator in the DeepMind work is more than 20 times cheaper than human annotators at the same task (Wei et al., 2024). That cost curve is the whole argument for building the second retrieval rather than hand-auditing a bibliography.

The platform runs 10 phases end-to-end on 727+ curated artifacts, delivering in 6–8 weeks at CA$4K–$50K, with Phase 1 under a money-back guarantee (subject to terms) Sagentix GTM Methodology, 2026.

Where this leaves you

Three paths, and only one of them involves hiring me.

Build the second retrieval yourself. You need less than you think for the first 80%: a deterministic join between in-text citations and reference entries, run in both directions, blocking on any orphan. That single check catches every citation that resolves to nothing, requires no model, and can ship in a day. Add the claim-versus-fetched-source diff next, and the canary guard with it — never one without the other.

Buy the check, keep your pipeline. Citation verification is separable from content generation by design. If your generation stack is working, instrument the output rather than rebuilding the producer. The interface is narrow: document in, per-claim verdicts out.

Bring in someone who has already built it. If the deliverables are going in front of a board, a regulator, or a lender — where a single laundered citation costs you the room — that is when the build-versus-buy math favours the stack that already exists.

Whichever you choose, the move is the same: stop treating the citation check as a step inside the fact check. Give it its own index, its own verdicts, and its own right to block. The defects that reach your reader are, by definition, the ones your existing check certified.

References

• Charlotin, D. (2026). AI hallucination cases [Database]. Retrieved 3 August 2026.
• Dahl, M., Magesh, V., Suzgun, M., & Ho, D. E. (2024). Large legal fictions: Profiling legal hallucinations in large language models. Journal of Legal Analysis, 16(1), 64–93.
• Gao, T., Yen, H., Yu, J., & Chen, D. (2023). Enabling large language models to generate text with citations. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing (pp. 6465–6488). Association for Computational Linguistics.
• McGowan, A., Gui, Y., Dobbs, M., Shuster, S., Cotter, M., Selloni, A., Goodman, M., Srivastava, A., Cecchi, G. A., & Corcoran, C. M. (2023). ChatGPT and Bard exhibit spontaneous citation fabrication during psychiatry literature search. Psychiatry Research, 326, 115334.
• Min, S., Krishna, K., Lyu, X., Lewis, M., Yih, W., Koh, P. W., Iyyer, M., Zettlemoyer, L., & Hajishirzi, H. (2023). FActScore: Fine-grained atomic evaluation of factual precision in long form text generation. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing (pp. 12076–12100). Association for Computational Linguistics.
• Sagentix Advisors Inc. (2026). GTM methodology — 10-phase delivery model. Sagentix Advisors Inc.
• Sagentix Advisors Inc. (2026). 16-point quality gate — anti-hallucination verification and evidence discipline. Sagentix Advisors Inc.
• Walters, W. H., & Wilder, E. I. (2023). Fabrication and errors in the bibliographic citations generated by ChatGPT. Scientific Reports, 13, 14045.
• Wei, J., Yang, C., Song, X., Lu, Y., Hu, N., Huang, J., Tran, D., Peng, D., Liu, R., Huang, D., Du, C., & Le, Q. V. (2024). Long-form factuality in large language models. arXiv.