To verify LLM citations, check each one in five steps. Confirm the cited source exists and is the work it claims to be. Split the answer into single claims. Match each claim to a specific passage. Test whether that passage supports the claim. Then test whether the model used the passage at all, because a correct citation can be attached after an answer is written.
Cited answers fail often. In a 2023 human audit of four generative search engines, 51.5% of generated sentences were fully supported by their citations, and 74.5% of citations supported the sentence they were attached to [6]. A preregistered 2024 study found that three commercial legal research tools each hallucinated 17% to 33% of the time [11]. A public database lists 2,266 decisions by courts and tribunals, as of 5 November 2026, that found or implied a party relied on hallucinated content [29].
How often LLM citations fail
The studies measured different things on systems of their time, so the rates do not compare one for one.
| Study | What was checked | Result | Systems from |
|---|---|---|---|
| Liu, Zhang and Liang [6] | 1,450 queries to four generative search engines | 51.5% of sentences fully supported, 74.5% of citations supportive | Early 2023 |
| Walters and Wilder [9] | 636 references in generated literature reviews | 55% fabricated from an older model version, 18% from a newer one | 2023 |
| Gao et al., ALCE [7] | Long answers on the ELI5 dataset | Best models lacked complete citation support about half the time | 2023 |
| Magesh et al. [11] | 202 legal research queries | 17% to 33% of responses hallucinated, by tool | 2024 |
| Wu et al., SourceCheckup [10] | 800 medical questions, 58,000 statement and source pairs | 50% to 90% of responses not fully supported | 2024 |
| Tow Center [31] | 1,600 requests to eight generative search tools to identify the news article an excerpt came from (headline, publisher, date and URL) | More than 60% answered incorrectly | Early 2025 |
| Venkit et al., DeepTRACE [26] | Deep research configurations | Citation accuracy of 40% to 80% | 2025 |
A May 2026 preprint auditing 111 million references in 2.5 million papers estimated at least 146,932 hallucinated citations in 2025 [27].
Fake case citations: what courts have done
| Case and court | Finding | Result |
|---|---|---|
| Mata v. Avianca, S.D.N.Y., 2023 | Non-existent opinions with fake quotes and citations [1] | $5,000 penalty, jointly and severally [1] |
| Ayinde and Al-Haroun, High Court of England and Wales, 2025 | 18 of 45 citations in one matter did not exist [2] | Lawyers must check AI research against authoritative sources [2] |
| Noland v. Land of the Free, California Court of Appeal, 2025 | 21 of 23 quotations fabricated [3] | $10,000 sanction, opinion served on the State Bar [3] |
The Mata court found "nothing inherently improper" in using a reliable AI tool, and said existing rules give attorneys "a gatekeeping role" [1]. The database's categories overlap: fabricated (1,856), false quotes (602), misrepresented (960) and outdated advice (38) sum to more than its 2,266 decisions [29].
How to verify LLM citations, step by step
| Step | Question | Method in the research |
|---|---|---|
| 1. Existence | Is the source real, and is it the work named? | Resolve the identifier, then compare title, authors or court with the citation |
| 2. Claims | What exactly does the answer assert? | Split sentences into short, self-contained claims |
| 3. Passage | Which passage stands behind each claim? | Match each claim to a short passage the system retrieved |
| 4. Support | Does the passage support the claim? | Label each pair supported, lacking support or contradicted |
| 5. Faithfulness | Did the model use that passage? | Remove the passage and measure how the answer changes |
Sources: [5, 6, 9, 13, 14, 19, 22, 23].
Step 1: check the source exists as named
A citation can look real and point somewhere else. In Mata v. Avianca, a fabricated decision carried a docket number associated with a different real case, and its Federal Reporter citation belonged to J.D. v Azar [1]. A 2026 study of 100 fabricated references in papers accepted at NeurIPS 2025 calls this identifier hijacking: a valid identifier leads to a real paper whose metadata does not match the citation [28].
The check has two parts. Resolve the identifier first. Free Law Project's citation lookup API, offered "as a guardrail to help prevent hallucinated citations", reports whether a citation was found, was valid but not found, or matched more than one decision [5]. Then compare what comes back with what the citation says. Walters and Wilder counted a reference as real only when its title and authors matched or nearly matched an actual work, and browsed the journal issue before ruling a work fabricated [9]. Our note on testing document extraction accuracy covers scoring what a system pulls from each document, field by field.
Quotations count too. Each quoted string has to appear in the source, and in Noland v. Land of the Free most did not [3].
Asking the tool that produced a citation is no check. In Mata, the chatbot replied that its authorities were "real" [1].
Step 2: split the answer into single claims
One sentence often carries several facts. FActScore counted 4.4 pieces of information per sentence in one model family's output, and 40% of those sentences mixed supported and unsupported information [13].
Splitting has its own tests. The extracted claims should follow from the original text, together cover what it asserts and each read correctly on its own [15]. SAFE revises each fact to be self-contained, so "It opened in the 20th century" becomes "The Eiffel Tower opened in the 20th century" [14].
Step 3: match each claim to a passage
The test comes from the attribution literature. Would a generic reader affirm that, according to the cited source, the claim holds [6, 8]? A true claim absent from the cited passage fails, since truth is a separate question [6, 8].
Keep passages short. The natural language inference (NLI) models used in automatic checks struggle with long inputs [17]. Human judges in the TREC 2024 retrieval-augmented generation (RAG) track read passages of typically 500 to 1,000 characters [20]. In a retrieval system, the cited passage should also be one the system actually retrieved [22].
Step 4: test whether the passage supports the claim
Use three labels. The passage supports the claim, lacks enough information to support it, or contradicts it [19]. Partial support has no standard treatment. ALCE's NLI check cannot detect it, while TREC judges label it separately [7, 20].
Automated judges scale the check, and they lean lenient. In the TREC 2024 track, an LLM judge and human assessors gave the same three-level label 56% of the time when the humans judged from scratch, and the judge was more likely to give the higher label [20]. Judges also often treat contradicted claims as supported and miss numerical differences [19]. The judge should differ from the model that wrote the answer, since LLM evaluators in one study scored their own outputs above others' that humans rated equal [24].
Measuring RAG citation accuracy
Citation recall is the share of claims fully supported by their citations. Citation precision is the share of citations that support their claim [6]. Our guide to agent evaluation metrics covers what to state when reporting rates.
Step 5: test citation faithfulness
A citation can be correct and still not show where the answer came from. Wallat and colleagues call it post-rationalization when a model cites sources to fit what it already believed [22]. They appended short statements to documents given to one retrieval-tuned model. When the statement reappeared in the answer, it cited 12% of altered random documents, 57% of altered relevant documents it had left uncited and 55% of those it had cited for another reason [22]. The test covered one model on one dataset.
Some designs attach evidence after the text exists, as RARR does [21]. On ALCE, answers written without retrieval and cited afterward scored well on correctness and much worse on citation quality [7].
The direct test is ablation. ContextCite scores each passage by how much removing it lowers the model's probability of producing the same response [23]. It needs those probabilities from the model. A team without model access can ask the provider how citations are attached [7, 22].
What happens to a claim that fails
A failed claim is revised against the evidence or removed. RARR detects disagreement between text and evidence, then edits the text [21]. Chain-of-Verification answers each verification question independently, so other responses do not bias the answers [25]. A second model pass does not replace reading. In Noland, counsel ran the briefs "through other AI platforms to check for errors" and did not read them before filing [3]. NIST's generative AI profile lists reviewing and verifying "sources and citations in GAI system outputs" before deployment and in ongoing monitoring [4].
Rillor builds agentic systems with an audit step that compares every citation in an agent's findings with the logged evidence. A claim without matching evidence goes back for rework or is removed.
Read the full report
The full report adds the definitions and agreement figures behind each check, the limits of automated judges and all 31 sources.