CoChat
Sign Up
PreprintCited by 1Topic Modelingscientometrics and bibliometrics researchInformation Retrieval and Search Behavior

Evaluating and Guarding Citation Faithfulness in Agentic Scientific Synthesis

Open access
Goo, Taewan, Kim, Junsik, Han, Kyulhee, Jo, GwonYul, Kim, Jong-Soo, Kim, Tae-Hyung·2026·arXiv
DOI 10.48550/arxiv.2607.20527arXiv 2607.20527
Open this paper in CoChat — free accountOpen PDF

Abstract

Agentic LLM systems such as OpenScholar and PaperQA2 read the scientific literature and return cited answers, and both they and their benchmarks already check whether those citations hold, with a fixed attribution model or human graders. Neither audits the reliability of that check itself. We show it is not reliable, and that this matters. On identical agent outputs the measured unsupported-citation rate ranges from about 3% to about 18% depending only on the verifier's strictness, and although verifiers agree on which citations are supported, they disagree on which to flag (negative-specific agreement 0.27 to 0.30), so no single flag set is trustworthy and cross-paper comparison is invalid without a named verifier and protocol. We present a gold-anchored evaluation protocol and a deployable guard that make this behavior measurable and bounded. The protocol validates the verifier, measures re-attribution, and calibrates a guarantee against human gold rather than another model's verdict; the verifier is a swappable instrument chosen on cost (recall 0.94 on the supported class, held out), and re-attribution is a commodity step where a deterministic BM25 matches the best open generator. The guard adds a split-conformal layer placing a distribution-free, finite-sample bound on truly unsupported citations that slip past a chosen flagging rule, a guarantee on catch rate rather than conclusion correctness. The bound holds on held-out gold, and we identify and quantify the condition governing its transfer to deployment, calibration-negative difficulty, with a concrete recalibration recipe, left untested by prior conformal-factuality work. Validated across four open 27-35B models and three agentic pipelines on public benchmarks (SciFact, QASA, PubMedQA), with confidence intervals on every headline number, the protocol and guard ship as an open single-GPU kit.

AI snapshot

Written from the paper’s full text.

TL;DR

The paper shows that citation-faithfulness measurements for agentic scientific synthesis are verifier-dependent: on identical agent outputs the unsupported-citation rate ranges from about 3% to about 18% depending only on verifier strictness. It proposes a gold-anchored evaluation protocol and a split-conformal guard that places a distribution-free, finite-sample bound on truly unsupported citations that slip past a chosen flagging rule.

Key findings

  • On identical agent outputs, the measured unsupported-citation rate rises from about 3% under the high-recall verifier to roughly 14–18% under a strict NLI judge; verifiers agree strongly on supported citations (positive-specific agreement 0.90–0.96) but weakly on what to flag (negative-specific agreement 0.27–0.30), with 60–80% of citations flagged by one verifier called supported by another.
  • On SciFact gold (n = 208), the adopted AttrScore-3B verifier has supported-class recall 0.90 and specificity 0.54, re-validated on a disjoint held-out split at recall 0.94 (n = 802); DeBERTa-NLI has recall 0.25/specificity 0.97, and GPT-4o recall 0.46/specificity 0.92. ROC-AUC values overlap: AttrScore-3B 0.88 [0.84, 0.93], DeBERTa-NLI 0.90 [0.85, 0.94], GPT-4o 0.87 [0.82, 0.92].
  • Calibrated on QASA gold (n = 1375), the conformal flag rule’s achieved catch rate tracks declared targets 0.90/0.94/0.98; at calibration size 25 the finite-sample correction holds 0.92 at a 0.90 target while a naive empirical-quantile threshold under-covers at 0.85, with the gap closing by about 200. Transfer fails under calibration-negative difficulty: a threshold calibrated on easy QASA distractors to catch 90% catches only 37% of harder SciFact human-labeled negatives; recalibrating τ = 0.83 restores 90% catch at a ≈46% flag rate.
  • Re-attribution on QASA gold (n = 1375) is a commodity slot: BM25 recall@1 0.69 on CPU, verifier score 0.58, and open generators 0.51–0.76, all above the 3% random baseline. At a 90% guaranteed catch rate, pooled flag rate is about 2.5% for bare models, 3.3% for OpenScholar, and 6.1% for PaperQA2.

Methods

  • Design: a gold-anchored evaluation protocol with four stages—rate, verifier validation, split-conformal calibration, and re-attribution—plus a deployable guard pipeline of verify → re-attribute → flag. The verifier is treated as a swappable instrument, with AttrScore-3B adopted on cost because separation is comparable at matched catch rates.
  • Data: SciFact (n = 208 human-labeled claim-passage test pairs; disjoint n = 802 held-out for prompt selection/validation), QASA full test set (n = 1375) for re-attribution and conformal calibration, PubMedQA (n = 843) as a scope control, and ScholarQABench multi-paper tasks for deployment outputs from four open 27–35B models and three pipelines (bare, OpenScholar, PaperQA2). Agreement analysis uses 300 deployment citations; the conformal dial uses 250 citations per model×pipeline.
  • Analysis: per-class recall and specificity, Cohen’s κ with bootstrap 95% CIs, unsupported-citation rates, re-attribution recall@k with binomial/Wilson 95% CIs, and conformal catch rate against declared targets. Split-conformal calibration uses k = ⌈(n_cal + 1)(1 − α)⌉; seeds are fixed, and the kit runs on one 80GB GPU or CPU.

Limitations

  • The paper states that the unsupported-citation rate is relative to a verifier’s operating point, so its numbers and others in the literature are interpretable only with the verifier and protocol that produced them; truncating the cited passage to a fixed prefix inflates the apparent unsupported rate severalfold and must be avoided.
  • The paper states that the conformal bound is conditional on exchangeability between calibration and deployed outputs, and this condition is consequential: calibration negatives are easy in-paper distractors (verifier mean P(attributable) = 0.20), whereas genuinely mis-cited claims are harder (mean 0.50 on SciFact human-labeled unsupported claims), so a threshold calibrated to catch 90% of distractors catches only 37% of harder human-labeled negatives. The guaranteed catch rate must therefore be read as optimistic for real mis-citations, and deployment must recalibrate τ on target-domain negatives at a higher review budget; the QASA coverage is an in-distribution demonstration, not a transferable operating point.
  • The paper states that the audit isolates the generation step, holding retrieval fixed, so it does not capture errors each agent’s own retrieval would introduce; re-attribution helps only where an alternative supporting passage is present and is not guaranteed out of distribution, so the guard must not be a sole gate in safety-critical settings, where expert review of flagged sentences remains required. The text also makes evident that the evaluation is limited to citation support rather than conclusion correctness, as shown by near-zero agreement on PubMedQA (κ = 0.02, n = 843).

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

DataCite · 10.48550/arxiv.2607.20527

Cites

57 of 57 references verified0 citation errors · 0 not checkable

Statistics

Nothing to recompute.

Claims the paper makes

0 of 6 cited sources checked · 0 supported · 0 flagged

  • Findingown data

    The conformal bound holds on held-out gold.

    “The bound holds on held-out gold”
    • Also stated in: § Contributions. · plain
      “the bound holds empirically on held-out gold”
    • Also stated in: § 5.5 The conformal guarantee holds in-distribution · plain
      “the conformal flag rule's achieved catch rate tracks the declared target across the operating range on repeated held-out splits”
    Quote in the paperSubstantial claim
  • Findingown data

    On identical agent outputs, the measured unsupported-citation rate ranges from about 3% to about 18% depending only on the verifier's strictness.

    “On identical agent outputs the measured unsupported-citation rate ranges from about 3% to about 18% depending only on the verifier's strictness”
    Quote in the paperSubstantial claim
  • Findingnone given

    Re-attribution is a commodity step where a deterministic BM25 matches the best open generator.

    “re-attribution is a commodity step where a deterministic BM25 matches the best open generator”
    Quote in the paperNot a substantial claim
  • Findingown data

    On SciFact gold, the continuous-scored verifiers separate comparably: their ROC-AUC values overlap (AttrScore-3B 0.88 [0.84, 0.93], DeBERTa-NLI 0.90 [0.85, 0.94], GPT-4o 0.87 [0.82, 0.92]; bootstrap 95% CIs, SciFact n = 208).

    “On SciFact gold the continuous-scored verifiers separate comparably (Figure 2A): their ROC-AUC values overlap (AttrScore-3B 0.88 [0.84, 0.93], DeBERTa-NLI 0.90 [0.85, 0.94], GPT-4o 0.87 [0.82, 0.92]; bootstrap 95% CIs, SciFact 𝑛 = 208)”
    Quote in the paperSubstantial claim
  • Findingreasoning

    A threshold τ calibrated on the easy distractors to catch 90% of them catches only 37% of the harder human-labeled negatives (44% and 61% at the 94% and 98% targets).

    “A threshold 𝜏 calibrated on the easy distractors to catch 90% of them therefore catches only 37% of the harder human-labeled negatives (44% and 61% at the 94% and 98% targets; Supplementary S6).”
    Quote in the paperSubstantial claim
  • May combine two claims. 64
  • Classified as probably not a substantial claim. 18
  • The quote only partly states this claim. 1

  • May combine two claims.

    Findingnone given

    The protocol and guard run on one 80GB GPU or on CPU and are released under the MIT license.

    “The protocol and guard run on one 80GB GPU or on CPU and are released under the MIT license at https://github.com/GooTec/citation-guard”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    Genuinely mis-cited claims are harder, because the cited passage is on topic but does not support the specific claim; on SciFact's human-labeled unsupported claims the verifier scores them far higher (mean 0.50).

    “Genuinely mis-cited claims are harder, because the cited passage is on topic but does not support the specific claim; on SciFact's human-labeled unsupported claims the verifier scores them far higher (mean 0.50).”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingreasoning

    The reported unsupported-citation rate depends on the verifier, and the verifiers do not agree.

    “We begin from an uncomfortable observation: the reported unsupported-citation rate depends on the verifier, and the verifiers do not agree.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    The calibration negatives are QASA in-paper distractors, which are easy: the verifier scores them low (mean P(attributable) = 0.20).

    “Our calibration negatives are QASA inpaper distractors, which are easy: the verifier scores them low (mean 𝑃 (attributable) = 0.20).”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    AttrScore-3B, adopted as the verifier, has high recall on the supported class (0.90 on SciFact, 0.94 on a disjoint held-out split, n = 802).

    “the verifier is a swappable instrument chosen on cost (recall 0.94 on the supported class, held out)”
    • Also stated in: § 5.2 The verifier, a swappable instrument chosen on cost · plain
      “Its native operating point is high recall on the supported class (0.90 on SciFact, Table 2; 0.94 on a disjoint held-out split, n = 802)”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    At a calibration size of 25, a naive empirical-quantile threshold under-covers (0.85 at a 0.90 target) while the conformal rule holds (0.92); the gap closes by a calibration size of about 200.

    “at a calibration size of 25 a naive empirical-quantile threshold under-covers (0.85 at a 0.90 target) while the conformal rule holds (0.92); the gap closes by a calibration size of about 200”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    Although verifiers agree on which citations are supported, they disagree on which to flag, with negative-specific agreement 0.27 to 0.30.

    “although verifiers agree on which citations are supported, they disagree on which to flag (negative-specific agreement 0.27 to 0.30)”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingnone given

    On real deployed outputs, most genuinely flagged claims are unsupported by any provided passage, so there is no better source to move them to.

    “On real deployed outputs the picture is soberer still: most genuinely flagged claims are unsupported by any provided passage, so there is no better source to move them to.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    On QASA gold (n = 1375), every reasonable ranker crushes the 3% random baseline and they form a clear order: BM25 recall@1 0.69 on CPU, the verifier's own attribution score 0.58, and open generators 0.51 (Qwen3.6) to 0.74-0.76 (Gemma-4) on GPU.

    “On QASA gold (𝑛 = 1375; Table 4, Figure 5) every reasonable ranker crushes the 3% random baseline and they form a clear order: a deterministic lexical BM25 reaches recall@1 0.69 on CPU, the verifier's own attribution score reaches 0.58, and the open generators asked to re-attribute their own citations range from 0.51 (Qwen3.6) to 0.74-0.76(Gemma-4) on GPU.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    The dev ranking by κ does not carry to held-out; the paper selects on recall (the safety axis), not κ.

    “The dev ranking by 𝜅 does not carry to held-out; we select on recall (the safety axis), not 𝜅.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    On the half of items whose answer shares vocabulary with the gold passage, BM25 and Gemma are tied (0.88 each); the generator's edge appears only on the low-overlap tail (0.31 versus 0.53 at the lowest-overlap quartile).

    “on the half of items whose answer shares vocabulary with the gold passage, BM25 and Gemma are tied (0.88 each); the generator's edge appears only on the low-overlap tail (0.31 versus 0.53 at the lowest-overlap quartile)”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    QASA in-paper distractors score low (mean 0.20, median 0.17); SciFact human-labeled unsupported claim-evidence pairs score far higher (mean 0.50, median 0.53), a 0.30 gap in mean verifier score.

    “The distractors score low (mean 0.20, median 0.17); the human-labeled negatives score far higher (mean 0.50, median 0.53), a 0.30 gap in mean verifier score.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    On 300 cited sentences from the deployed pipelines, three gold-validated verifiers agree strongly on which citations are supported (positive-specific agreement 0.90-0.96) but agree on which to flag as unsupported only weakly (negative-specific agreement 0.27-0.30).

    “On 300 cited sentences from the deployed pipelines, three gold-validated verifiers spanning the recall-specificity range (AttrScore-3B, DeBERTa-NLI, and the GPT-4o judge; the two binary-only judges, RAGAS and OpenScholar post-hoc, are omitted from this pairwise analysis) agree strongly on which citations are supported (positive-specific agreement 0.90-0.96)but agree on which to flag as unsupported”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    Re-attribution validated against gold (QASA, n = 1375, recall@1, 100% coverage) shows a deterministic lexical BM25 on CPU (0.69) matches the verifier score (0.58) and is reliable, while open generators run locally on GPU vary from 0.51 (Qwen) to 0.76 (Gemma); all crush the 3% random baseline.

    “Re-attribution validated against gold (QASA, 𝑛 = 1375, recall@1, 100% coverage).Recovering the supporting passage is a swappable commodity slot: a deterministic lexical BM25 on CPU (0.69) matches the verifier score (0.58) and is reliable, while the open generators run locally on GPU vary from 0.51 (Qwen) to 0.76 (Gemma).All crush the 3% random baseline.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    The finite-sample correction matters when gold is scarce: at calibration size 25, a naive empirical-quantile threshold under-covers the nominal target while the conformal finite-sample-corrected rule maintains it, and the gap closes by a calibration size of about 200.

    “Table S4 shows why the finite-sample correction matters when gold is scarce: at a calibration size of 25, a naive empirical-quantile threshold under-covers the nominal target, while the conformal (finite-sample corrected) rule maintains it.The gap closes by a calibration size of about 200.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingown data

    The per-model review budget at a 90% guaranteed catch rate stays single-digit at the bare floor for every open model and rises with pipeline agency; no single model drives the pooled rate.

    “Per-model review budget: flag rate (%) at a 90% guaranteed catch rate, by generator and pipeline (QASA-calibrated 𝜏).The budget stays single-digit at the bare floor for every open model and rises with pipeline agency; no single model drives the pooled rate.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingown data

    On SciFact, at any common catch rate on unsupported citations the three verifiers separate comparably in AUC and review cost, so a strict frontier judge buys no advantage and the cheap local AttrScore-3B is adopted on cost.

    “Matched catch-rate frontier on SciFact: at any common catch rate on unsupported citations the three verifiers separate comparably (AUC and review cost overlap), so a strict frontier judge buys no advantage and the cheap local AttrScore-3B is adopted on cost.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    On the high-overlap half BM25 and Gemma-4-26B are tied (0.886 each); the generator's advantage appears only on the low-overlap half (0.64 versus 0.49) and is largest on the lowest-overlap quartile (0.53 versus 0.30), exactly the items where support must be read for entailment rather than matched by words.

    “On the high-overlap half the two are tied (0.886 each); the generator's advantage appears only on the low-overlap half (0.64 versus 0.49) and is largest on the lowest-overlap quartile (0.53 versus 0.30), exactly the items where support must be read for entailment rather than matched by words.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    On QASA gold (n = 1375, 100% coverage), re-attribution recall@k shows open generators are most accurate but vary by model, a deterministic lexical BM25 on CPU is close and reliable, and all crush chance.

    “Re-attribution recall@𝑘 on QASA gold (𝑛 = 1375, 100% coverage).The open generators (run locally on GPU) are most accurate but vary by model; a deterministic lexical BM25 on CPU is close and reliable; all crush chance.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    On 300 deployment citations, the supported class is highly prevalent (AttrScore 0.957, DeBERTa 0.823, GPT-4o 0.933), so Cohen's κ is depressed by the base-rate paradox even when observed agreement is high.

    “On 300 deployment citations, the supported class is highly prevalent (AttrScore 0.957, DeBERTa 0.823, GPT-4o 0.933), so Cohen's 𝜅 is depressed by the base-rate paradox even when observed agreement is high.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    On held-out data, OURS keeps the highest recall (0.942), the safety axis, while CANON attains a higher κ (0.567) at lower recall (0.869).

    “Table S2 shows that OURS keeps the highest recall on held-out (0.942), the safety axis, while CANON attains a higher 𝜅 (0.567) at lower recall (0.869).”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    The diagnostic that matters is negative-specific agreement, the agreement on which citations to flag: it is only 0.27-0.30, whereas positive-specific agreement is 0.90-0.96 and AC1 is 0.78-0.91.

    “The diagnostic that matters is negative-specific agreement, the agreement on which citations to flag: it is only 0.27-0.30,whereas positive-specific agreement (on what is supported) is 0.90-0.96and AC1 is 0.78-0.91.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    Restoring a 90% catch on the hard negatives requires τ = 0.83 and a ≈ 46% flag rate.

    “Restoring a 90% catch on the hard negatives requires 𝜏 = 0.83 and a ≈ 46% flag”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    Every ranker far exceeds the 3% random baseline; open generators run locally on GPU are most accurate but vary by model (0.51 to 0.76), a deterministic lexical BM25 on CPU is close and reliable (0.69), and the verifier's own attribution score is a weaker ranker (0.58).

    “Table S5 reports recall@𝑘 with Wilson 95% CIs.Every ranker far exceeds the 3% random baseline.The open generators, run locally on GPU and asked to re-attribute their own citations, are the most accurate but vary by model (0.51 to 0.76); a deterministic lexical BM25 on CPU is close and reliable (0.69); the verifier's own attribution score is a weaker ranker (0.58).”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Interpretationown data

    At large calibration sizes the naive empirical-quantile and conformal rules coincide, so the value of conformal here is distribution-free validity, not a numerical gain.

    “At large calibration sizes the two coincide, so the value of conformal here is distribution-free validity, not a numerical gain.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Premisecitation

    A growing body of work reports that AI citations are frequently unsupported and that even a factually correct citation may not faithfully reflect the passage the model actually used.

    “A growing body of work checks that contract automatically and reports that AI citations are frequently unsupported [14,48], and that even a factually correct citation may not faithfully reflect the passage the model actually used [46].”
    Quote in the paperSubstantial claim0 of 3 sources checked
    • cites [14]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [48]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [46]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Classified as probably not a substantial claim. May combine two claims.

    Interpretationnone given

    Any verifier is an automated judge that emits a continuous score separating supported from unsupported claims, and different verifiers make different errors, so the verifier must be validated against gold before it is trusted.

    “Any verifier is an automated judge that emits a continuous score 𝑠 (𝑐, 𝑝) separating supported from unsupported claims, and different verifiers make different errors, so the verifier must be validated against gold before we trust anything it reports.”
    Quote in the paperSubstantial claim

  • Classified as probably not a substantial claim. May combine two claims.

    Interpretationown data

    Even a single-digit unsupported rate matters at synthesis scale, where one survey can carry hundreds of cited sentences; the value is a bounded, declared review budget over many citations.

    “Even a single-digit unsupported rate matters at synthesis scale, where one survey can carry hundreds of cited sentences; the value is not a large defect rate but a bounded, declared review budget over many citations.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Interpretationnone given

    The conformal bound is distribution-free only under exchangeability between calibration and deployment negatives, and that assumption is consequential.

    “The bound is distribution-free only under exchangeability between calibration and deployment negatives, and that assumption is consequential.”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: Exchangeability holds between calibration and deployment negatives (or outputs).

  • May combine two claims. The quote only partly states this claim.

    Interpretationown data

    Much of the increase in unsupported rate under stricter verifiers is extra false rejection, because strict verifiers have low recall on genuinely supported claims (e.g., DeBERTa recall 0.25/specificity 0.97; GPT-4o recall 0.46).

    “Much of that climb is not extra unfaithfulness but extra false rejection: the strict verifiers have low recall on genuinely supported claims (0.25 on gold), so their high rates partly count supported citations.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Interpretationown data

    The rates are pooled over the four open models and three pipelines and stay single-digit at the lenient end while climbing with verifier strictness, so the effect is a property of the verifier, not of any one generator.

    “The rates are pooled over the four open models and three pipelines and stay single-digit at the lenient end while climbing with verifier strictness, so the effect is a property of the verifier, not of any one generator.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Study design and conductown data

    The protocol and guard are validated across four open 27-35B models and three agentic pipelines on public benchmarks (SciFact, QASA, PubMedQA), with confidence intervals on every headline number.

    “Validated across four open 27-35B models and three agentic pipelines on public benchmarks (SciFact, QASA, PubMedQA), with confidence intervals on every headline number”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Interpretationreasoning

    G1: The reported unsupported-citation rate is verifier-dependent, so a single number does not compare across studies.

    “(G1) The reported unsupported-citation rate is verifier-dependent, so a single number does not compare across studies.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Interpretationown data

    Given comparable separation, the verifier is a swappable instrument and the deciding factor is cost; AttrScore-3B is adopted because it runs locally on one GPU.

    “Given comparable separation, the verifier is a swappable instrument and the deciding factor is cost: we adopt AttrScore-3B because it runs locally on one GPU.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Interpretationreasoning

    Split-conformal calibration on gold converts an imperfect, moderate-agreement verifier into a finite-sample bound on unflagged-unsupported citations at a chosen tolerance, a guarantee on catch rate rather than conclusion correctness.

    “The guard adds a split-conformal layer placing a distribution-free, finite-sample bound on truly unsupported citations that slip past a chosen flagging rule, a guarantee on catch rate rather than conclusion correctness.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Interpretationreasoning

    The operational rule is that the calibration set must resemble the deployment negatives; the QASA coverage is an in-distribution demonstration.

    “The operational rule is therefore that the calibration set must resemble the deployment negatives; the QASA coverage above is an in-distribution demonstration”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: Calibration data resemble deployed outputs (calibration negatives resemble deployment negatives).

  • May combine two claims.

    Interpretationown data

    No single flag set is trustworthy and cross-paper comparison is invalid without a named verifier and protocol.

    “so no single flag set is trustworthy and cross-paper comparison is invalid without a named verifier and protocol”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Interpretationown data

    G2: Verifiers agree on what is supported but disagree on what to flag, so no single deployment flag set can be trusted.

    “(G2) Verifiers agree on what is supported but disagree on what to flag, so no single deployment flag set can be trusted.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Interpretationown data

    In the hardest regime the verifier's separation, not the conformal layer, becomes the binding constraint, where stronger verifiers or human review are warranted.

    “rate, i.e. the verifier's separation, not the conformal layer, becomes the binding constraint in the hardest regime, where stronger verifiers or human review are warranted.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Interpretationown data

    A lexical ranker cannot tell support from contradiction: on SciFact an answer and a refuting passage share almost identical vocabulary (Jaccard 0.064 versus 0.055), so BM25 would surface a contradicting passage as readily as a supporting one, whereas the verifier separates them (mean P(attributable) 0.83 versus 0.50).

    “Crucially, a lexical ranker cannot tell support from contradiction: on SciFact an answer and a refuting passage share almost identical vocabulary (Jaccard 0.064 versus 0.055), so BM25 would surface a contradicting passage as readily as a supporting one, whereas the verifier separates them (mean 𝑃 (attributable) 0.83 versus 0.50; Supplementary S4).”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Interpretationown data

    The most accurate ranker is a generator, not BM25 and not the verifier; but generator quality is model-dependent, and the advantage over BM25 is concentrated where it is least needed.

    “The most accurate ranker is therefore a generator, not BM25 and not the verifier; but generator quality is model-dependent, and the advantage over BM25 is concentrated where it is least needed.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Interpretationown data

    The conformal bound is conditional on exchangeability between calibration and deployed outputs, and this condition is consequential: a threshold calibrated to catch 90% of easy distractors catches only 37% of harder human-labeled negatives.

    “The conformal bound is conditional on exchangeability between calibration and deployed outputs, and this condition is consequential, not cosmetic: our calibration negatives are easy in-paper distractors (verifier mean 𝑃 (attributable) = 0.20), whereas genuinely mis-cited claims are harder (mean 0.50 on SciFact's human-labeled unsupported claims), so a threshold calibrated to catch 90% of the”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: Exchangeability holds between calibration and deployment negatives (or outputs).

  • May combine two claims.

    Study design and conductreasoning

    The discrete verifier score can tie; breaking ties conservatively by treating s_new ≤ τ at equality preserves the ≥ 1 - α bound.

    “The discrete verifier score can tie; we break ties conservatively (treating 𝑠 new ≤ 𝜏 at equality), which preserves the ≥ 1 -𝛼 bound.”
    Quote in the paperSubstantial claim

  • Classified as probably not a substantial claim.

    Study design and conductown data

    Main-text numbers for the adopted verifier use the held-out values.

    “Main-text numbers for the adopted verifier use the held-out values.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Study design and conductnone given

    The shipped reproduce/ kit is a cross-domain demonstration on a public BioASQ slice (n = 200), not the headline.

    “The shipped reproduce/ kit is a cross-domain demonstration on a public BioASQ slice (𝑛 = 200), not the headline.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationown data

    A faithfulness number reported without its operating point is not a fact a reader can use; a benchmark leaderboard of citation faithfulness is meaningful only relative to a named, gold-validated verifier and protocol.

    “The same agent outputs look several times worse under a strict verifier than a lenient one, so a faithfulness number reported without its operating point is not a fact a reader can use.”
    • Also stated in: § 6 Discussion · plain
      “a benchmark leaderboard of citation faithfulness is meaningful only relative to a named, gold-validated verifier and protocol”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Study design and conductreasoning

    The study verifies each claim against the full cited passage with a sliding-window protocol so that support located anywhere counts; truncating the passage to a fixed prefix inflates the apparent unsupported rate severalfold and must be avoided.

    “We verify each claim against the full cited passage with a sliding-window protocol so that support located anywhere counts; truncating the passage to a fixed prefix, a tempting shortcut, inflates the apparent unsupported rate severalfold and must be avoided.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Study design and conductnone given

    The verifier and guard run on one 80GB GPU or on CPU; the full kit reproduces in about two hours.

    “Compute.The verifier and guard run on one 80GB GPU or on CPU; the full kit reproduces in about two hours.”
    Quote in the paperNot a substantial claim

  • Classified as probably not a substantial claim. May combine two claims.

    Interpretationreasoning

    Re-attribution helps only where an alternative supporting passage is present and is not guaranteed out of distribution, so the guard must not be a sole gate in safety-critical settings, where expert review of flagged sentences remains required.

    “Re-attribution helps only where an alternative supporting passage is present and is not guaranteed out of distribution, so the guard must not be a sole gate in safety-critical settings, where expert review of flagged sentences remains required.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Study design and conductnone given

    Main-text artifacts are regenerated by the experiment scripts from the frozen score files under results/: the verifier frontier and matched-catch AUC (SciFact), the per-model unsupported rate (deployment outputs × five verifiers), the conformal coverage and recall-cost dial, the coverage-transfer analysis (S6), and re-attribution recall@k (QASA n = 1375).

    “The main-text artifacts are regenerated by the experiment scripts from the frozen score files under results/: the verifier frontier and matched-catch AUC (SciFact), the per-model unsupported rate (deployment outputs × five verifiers), the conformal coverage and recall-cost dial, the coverage-transfer analysis (S6), and re-attribution recall@𝑘 (QASA 𝑛 = 1375).”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationreasoning

    The SciFact refuted pairs are a deliberately hard near-upper-bound proxy in which the evidence is topically central but contradicts the claim; real deployment negatives range between these and the easy distractors, so the achieved catch in practice lies between the two columns.

    “The SciFact refuted pairs are a deliberately hard (near-upper-bound) proxy, in which the evidence is topically central but contradicts the claim; real deployment negatives range between these and the easy distractors, so the achieved catch in practice lies between the two columns.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Study design and conductown data

    The SciFact n = 208 set is the development set on which the AttrScore prompt was selected, so absolute AttrScore numbers there are optimistic.

    “Table S1.Per-verifier gold metrics on SciFact (𝑛 = 208).This is the development set on which the AttrScore prompt was selected; absolute AttrScore numbers here are therefore optimistic (see Table S2).”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationreasoning

    The guaranteed catch rate must be read as optimistic for real mis-citations; a deployment must recalibrate τ on target-domain negatives, which restores the guarantee at a higher review budget, and the QASA coverage is an in-distribution demonstration, not a transferable operating point.

    “The guaranteed catch rate must therefore be read as optimistic for real mis-citations, and a deployment must recalibrate 𝜏 on target-domain negatives, which restores the guarantee at a higher review budget; the QASA coverage we report is an in-distribution demonstration of the method, not a transferable operating point.”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: Calibration data resemble deployed outputs (calibration negatives resemble deployment negatives).

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Study design and conductown data

    The coverage is marginal over the calibration draw; on an individual split it can fall below target, the standard conformal caveat.

    “This coverage is marginal over the calibration draw; on an individual split it can fall below target, the standard conformal caveat.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationown data

    The verifiers encode genuinely different flag thresholds, so there is no single deployment flag set to trust.

    “The verifiers thus encode genuinely different flag thresholds: there is no single deployment flag set to trust.”
    Quote in the paperSubstantial claim

  • Classified as probably not a substantial claim. May combine two claims.

    Study design and conductnone given

    All rankers are evaluated on the full QASA test set (n = 1375, 100% coverage), with the same gold definition, recall@k, and query, differing only in the ranker.

    “All rankers are evaluated on the full QASA test set (𝑛 = 1375, 100% coverage), with the same gold definition, recall@𝑘, and query, differing only in the ranker.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Study design and conductnone given

    Code, configs, prompts, seeds, and the figure-generation script are released under the MIT license at the given GitHub URL, tagged release v0.2.0 (commit b907985).

    “Code, configs, prompts, seeds, and the figure-generation script are released under the MIT license at https://github.com/ GooTec/citation-guard, tagged release v0.2.0 (commit b907985, the hash-anchored citable snapshot for this paper); a Zenodo DOI will be minted from this tag for the camera-ready.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based). May combine two claims.

    Premisereasoning

    BM25 ranks by word overlap, so its accuracy should track the lexical similarity between the answer and the gold passage.

    “BM25 ranks by word overlap, so its accuracy should track the lexical similarity between the answer and the gold passage.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Premisenone given

    The conformal bound is distribution-free only under exchangeability between the calibration and deployment negative distributions.

    “The conformal bound is distribution-free only under exchangeability between the calibration and deployment negative distributions.”
    Quote in the paperNot a substantial claim
    • The authors state this as an assumption: The calibration and deployment negative distributions are exchangeable.

  • Probably not a substantial claim: may not pass S2 (checkable). May combine two claims.

    Interpretationreasoning

    Re-attribution is a commodity and the guard's load-bearing value is flagging with a guarantee, not repair.

    “either way re-attribution is a commodity and the guard's load-bearing value is flagging with a guarantee, not repair.”
    Quote in the paperNot a substantial claim

  • Classified as probably not a substantial claim. May combine two claims.

    Interpretationreasoning

    The high-recall operating point is adopted deliberately because for a citation guard, discarding a genuine citation is costlier than an extra review.

    “We adopt the high-recall operating point deliberately: for a citation guard, discarding a genuine citation is costlier than an extra review.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Interpretationreasoning

    Both decisions are made by the external verifier on gold-validated scores, not by the generator that produced the citation.

    “Both decisions are made by the external verifier on gold-validated scores, not by the generator that produced the citation.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Study design and conductnone given

    Each headline number traces to a named result file; the QASA calibration entry point is included.

    “Each headline number traces to a named result file; the QASA calibration entry point is included.”
    Quote in the paperNot a substantial claim

  • Classified as probably not a substantial claim. May combine two claims.

    Study design and conductnone given

    Calibration uses split-conformal with finite-sample quantile k = ceil((n_cal + 1)(1 - α)); calibration/test splits and all random seeds are fixed (seed 0) and recorded.

    “Calibration.Split-conformal with finite-sample quantile 𝑘 = ⌈(𝑛 cal + 1)(1 -𝛼)⌉; calibration/test splits and all random seeds are fixed (seed 0) and recorded.”
    Quote in the paperSubstantial claim

  • Classified as probably not a substantial claim. May combine two claims.

    Interpretationreasoning

    For a practitioner, the guard changes the operating posture: an operator declares the residual risk they will tolerate and receives a written promise, conditional on the calibration negatives resembling deployment and optimistic otherwise, on how many unsupported citations can survive review, with the review budget that promise costs.

    “For a practitioner the guard changes the operating posture: rather than trust a verifier's verdicts at face value, an operator declares the residual risk they will tolerate and receives a written promise, conditional on the calibration negatives resembling deployment and optimistic otherwise, on how many unsupported citations can survive review, with the review budget that promise costs.”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: Calibration data resemble deployed outputs (calibration negatives resemble deployment negatives).

  • May combine two claims.

    Interpretationreasoning

    Anchoring measurement on human gold and wrapping an imperfect verifier in a distribution-free conformal guarantee yields an evaluation protocol and a deployable guard that hold despite that disagreement, released as an open single-GPU kit.

    “Anchoring measurement on human gold and wrapping an imperfect verifier in a distribution-free conformal guarantee yields an evaluation protocol and a deployable guard that hold despite that disagreement, released as an open single-GPU kit.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Interpretationreasoning

    The split-conformal method remains valid; what it requires is a calibration set drawn from the deployment negative distribution.

    “The split-conformal method remains valid; what it requires is a calibration set drawn from the deployment negative distribution.”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: The calibration and deployment negative distributions are exchangeable.
67 of 67

  • The authors state this as an assumption.

    Exchangeability holds between calibration and deployment negatives (or outputs).

    “The bound is distribution-free only under exchangeability between calibration and deployment negatives, and that assumption is consequential.”
    “The conformal bound is conditional on exchangeability between calibration and deployed outputs, and this condition is consequential, not cosmetic”

  • The authors state this as an assumption.

    Calibration data resemble deployed outputs (calibration negatives resemble deployment negatives).

    “The operational rule is therefore that the calibration set must resemble the deployment negatives”
    “The promise isolates a single checkable assumption, that calibration data resemble deployed outputs”

  • The authors state this as an assumption.

    The calibration and deployment negative distributions are exchangeable.

    “the only assumption is exchangeability between calibration and deployment.”

  • The authors state this as an assumption.

    No prior conformal-factuality work quantifies the calibration-negative-difficulty condition.

    “We are not aware of prior conformal-factuality work that quantifies this calibration-negative-difficulty condition, which we regard as part of the contribution.”
4 of 4

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

Each contradiction between two passages listed here was confirmed by an independent check.

  • SciFact prompt-selection and held-out splits are reversed

    Major

    The gold-data description says the 802-pair split was used for prompt selection, but the supplement says prompt selection used the 208-pair development set and the 802-pair split was held out for re-validation. This changes which reported verifier results are held-out measurements.

  • BM25 is described as matching a significantly better generator

    Minor

    The abstract says BM25 matches the best open generator, whereas the supplement reports a statistically significant overall advantage for that generator. Their reported recall@1 values are approximately 0.69 and 0.76, respectively.

  • A 9.5% flag rate is impossible for a 250-citation cell

    Minor

    With 250 citations, a cell's flag rate changes in increments of 0.4 percentage points. The reported 9.5% would require 23.75 flagged citations; 23 and 24 flags yield 9.2% and 9.6%, respectively.

  • BM25 recall@1 differs between supplementary tables

    Minor

    Both tables report BM25 recall@1 on the full 1,375-item QASA set, but Table S5 gives 0.686 and Table S6 gives 0.690. The difference exceeds rounding at the reported three-decimal precision.

4 of 4

Cites

Flagged first, then by citations

Research works printed but not linked: 2

  1. Yoonjoo Lee, Kyungjae Lee, Sunghyun Park, Dasol Hwang, Jaehyeon Kim, Hong-in Lee, and Moontae Lee. 2023. QASA: Advanced Question Answering on Scientific Articles. In International Conference on Machine Learning (ICML) (PMLR, Vol. 202).
  2. Shishir G. Patil et al. 2025. The Berkeley Function Calling Leaderboard (BFCL): From Tool Use to Agentic Evaluation. In Proceedings of ICML.

Cited by

Sorted by citations

Authors
Goo, T., Kim, J., Han, K., Jo, G., Kim, J.-S., & Kim, T.-H.
ORCID
Venue
arXiv
Publisher
arXiv
Published
2026
ISSN
2331-8422 (ISSN-L)
DOI
10.48550/arxiv.2607.20527
arXiv
2607.20527
OpenAlex
W7170513749
Cited by
0
References
50
Type
posted content
Open access
Licence
arxiv.org/licenses/nonexclusive-distrib/1.0/
Locations
  • arXiv (Cornell University) (submittedVersion)
  • arXiv (Cornell University)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Topic Modeling
  • Social Sciences › Decision Sciences › Statistics, Probability and Uncertainty › scientometrics and bibliometrics research
  • Physical Sciences › Computer Science › Information Systems › Information Retrieval and Search Behavior
Keywords
agentic LLMs, citation verification, split conformal prediction, non-asymptotic bounds, calibration

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Claims read by deepseek-v4.1-flash under definition version 3 (extract-v3) on 2026-10-23.

Classified by jev-1.13-20260917 (gold-guideline-v0.2) on 2026-10-23.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review