Hallucination Detection in LLM-Generated Text — Deep Dive

Why this exists. Hallucination is the #1 reason LLMs fail in production, and “how would you detect / measure / mitigate hallucinations?” is one of the most common applied-scientist interview questions in 2025. This deep dive is a comprehensive, interview-grade reference: definitions, taxonomies, why models hallucinate, every detection method (reference-based, reference-free, internal-states-based), benchmarks, mitigation, and full system-design treatment.

1. What is a hallucination, precisely?

The word “hallucination” gets used loosely. Interview-grade definition:

A hallucination is content generated by an LLM that is unsupported by, or contradicted by, the relevant ground truth.

Two qualifiers matter:

• “Relevant ground truth” = the source we’re evaluating against. For RAG, it’s the retrieved passages. For factual QA, it’s world knowledge. For summarization, it’s the source document.
• “Unsupported” vs “contradicted” matter separately. An unsupported fact may be true; a contradicted one is definitely wrong. Most production detectors check “is this grounded in the source?” rather than “is this true in the world?”.

This subtle distinction is a frontier-lab interview probe. Be ready for: “Is a true-but-unsupported claim a hallucination?” Strong answer: depends on the application — for RAG-grounded QA, yes (faithfulness criterion); for general QA, no (factuality criterion).

Saying it out loud. A hallucination is when the model says something the evidence doesn’t back up. The part people miss is that “the evidence” isn’t fixed — in RAG it’s the retrieved passages, in open QA it’s world knowledge, in summarization it’s the source document. So the same sentence can be a hallucination in one product and perfectly fine in another. And I’d separate two flavors: contradicted means the source says the opposite, unsupported means the source just doesn’t mention it. Unsupported claims are the nastier failure mode, because they’re often true, which makes reviewers wave them through.

2. Taxonomy

Hallucinations are not one thing. Senior candidates know the categories.

2.1 By target

Saying it out loud. When someone asks “what kinds of hallucinations are there,” I don’t say “factual errors” and stop — I name the buckets, because each one needs a different detector. Factual means wrong about the world. Faithfulness means it contradicts the document you gave it. Then there’s logical self-contradiction, invented citations, and just plain ignoring the instructions. The reason this matters practically: a citation checker catches invented references and does nothing for arithmetic, so if you can’t name the bucket you can’t pick the tool.

2.2 Intrinsic vs extrinsic (Maynez et al. 2020)

For grounded generation (summarization, RAG):

• Intrinsic hallucination: contradicts the source. Source: “Sales rose 10%.” Summary: “Sales fell 10%.”
• Extrinsic hallucination: not contradicted by the source but not supported either. Source: “Sales rose 10%.” Summary: “Sales rose 10% due to a new marketing campaign.” (The “due to…” is unsupported.)

Extrinsic is more dangerous because it’s harder to detect — the source doesn’t contradict it, you have to verify against external knowledge.

Saying it out loud. Intrinsic means the model contradicted the source; extrinsic means it added something the source never said. Think of a witness summarizing a document: intrinsic is “the report said sales fell” when they rose, extrinsic is “sales rose because of the new campaign” when the report never mentioned a campaign. Extrinsic is the harder one, and that’s the point worth making — you can catch intrinsic with a single entailment check against the source, but for extrinsic the source is silent, so nothing contradicts it and you need external knowledge to adjudicate. That’s Maynez et al. 2020, and it’s still the vocabulary everyone uses for summarization and RAG.

2.3 By severity (production framing)

• Critical: medical, legal, financial — could cause real harm.
• Significant: factually wrong but bounded impact (e.g., wrong year for a historical event).
• Cosmetic: stylistic or marginal (e.g., “this paper showed X” when paper actually showed X but with caveats).

Production systems weight detection by severity. A 0.5% medical hallucination rate is unacceptable; a 0.5% cosmetic-error rate may be fine.

Saying it out loud. Not all hallucinations cost the same, so I’d never report one global rate. A wrong drug dosage and a slightly overstated paper summary are both “hallucinations” and one of them ends careers. In practice I’d bucket them critical, significant, cosmetic, and set a separate threshold per bucket — half a percent is fine for cosmetic errors and completely unacceptable in a medical context. Saying that out loud is usually what signals you’ve actually shipped something rather than read about it.

2.4 Reasoning hallucinations (frontier topic)

A separate category that’s increasingly important with reasoning models (o1, R1):

• Step-level errors: a single reasoning step is wrong even if the final answer is right.
• Final-answer errors: chain-of-thought looks plausible, final answer wrong.
• Reasoning over hallucinated premises: the model invents a “fact” early and reasons consistently from it.

Detection differs: process-level (PRM) catches step errors; outcome-level catches only the final answer.

Saying it out loud. With reasoning models there’s a category people forget: the chain of thought can be wrong even when the final answer is right, and it can look flawless while the answer is wrong. The worst version is when the model invents a fact in step two and then reasons perfectly from it — everything downstream is internally consistent and completely false. The tradeoff to name is process versus outcome supervision: outcome checking is cheap and only tells you about the last line, process reward models catch step-level errors but need per-step annotation, which is why PRM800K cost so much to build.

3. Why LLMs hallucinate

You’ll be asked. Have a structured answer.

3.1 Statistical reasons

Next-token prediction objective doesn’t penalize confidence about wrongness. During pretraining, the model learns to produce plausible continuations. “Plausible” ≠ “true.” If a confident-sounding wrong continuation has higher probability than “I don’t know,” the model will produce it.

Coverage gaps in training data. The model has read “Einstein won the Nobel Prize” but the reason (photoelectric effect, not relativity) is mentioned much less. The model hallucinates the more salient association.

Long-tail facts are forgotten or misremembered. Pretraining has billions of tokens but a power-law distribution of facts. Rare entities and events are barely represented; the model fills in “best guess” patterns.

Saying it out loud. At bottom the model is trained to predict the next token, and the next token that’s most plausible is not always the one that’s true. If a confident-sounding wrong continuation has higher probability than “I don’t know,” you get the confident wrong continuation — there’s nothing in the loss that punishes that. Add the long tail: facts follow a power law, so rare entities barely appear in pretraining and the model pattern-matches instead of recalling. That’s why hallucination rate spikes on obscure entities while the model looks great on famous ones.

3.2 Architectural reasons

Tokenization quirks. Numbers, names, and code can be tokenized inconsistently. A specific phone number or DOI may be tokenized differently each time the model sees it; the model can’t memorize it cleanly.

Position bias / lost in the middle. In long context, attention concentrates on early and recent tokens. Mid-context information gets used less reliably → model “fills in” rather than reading.

Greedy / low-temperature decoding doesn’t help. The model commits to the highest-probability token at each step even when alternatives are nearly tied.

Saying it out loud. Two architectural things bite you. First, tokenization: long numbers, DOIs, and rare names get split inconsistently, so the model never gets a clean single handle to memorize — that’s a big part of why it garbles phone numbers and citation years. Second, lost in the middle: attention concentrates near the start and the end of a long context, so a fact buried at 60% depth gets used less reliably and the model fills the gap from its prior. The practical failure mode to name is that stuffing more context into the prompt can make grounding worse, not better.

3.3 Training-objective reasons

RLHF can increase hallucinations (counterintuitive — interviewers love this). The reward model is trained on human preferences. Humans prefer confident-sounding, fluent, complete answers. So RLHF rewards the model for producing confident answers — whether or not they’re correct. The model learns to never say “I don’t know” because uncertainty is unrewarded.

This is a major reason post-RLHF models (GPT-4, Claude, etc.) are more confident-but-not-more-correct than their SFT predecessors. Calibration worsens with RLHF in many cases.

Mitigation: explicit “I don’t know” reward signal; refusal training on hard questions; calibration after RLHF.

Saying it out loud. Here’s the counterintuitive one interviewers love: RLHF can make hallucination worse. The reward model is trained on human preferences, and humans reliably prefer answers that are fluent, complete, and confident — so the model gets rewarded for sounding sure, not for being right, and it learns that “I don’t know” never wins. The consequence is a calibration regression: post-RLHF models are more confident without being more correct, which is exactly why token-level probability becomes a weaker hallucination signal after alignment. The fix is an explicit reward for well-placed refusal, plus recalibration after RLHF.

3.4 Sampling reasons

Temperature, top-p. Higher temperature / wider nucleus = more diversity but more hallucination risk. Lower = more conservative but more repetitive and may miss correct-but-low-probability tokens.

Stochastic generation gives different answers across runs. Used by detection methods (self-consistency).

Saying it out loud. Some of it is just dice. Higher temperature and wider top-p mean you’re sampling from further out in the tail, and the tail contains more wrong tokens — so creativity and factuality trade off directly against each other. Turning temperature down helps but doesn’t solve it, because a confidently wrong token is the highest probability token. The useful flip side: that same randomness is what self-consistency methods exploit, since a shaky fact changes across samples and a solid one doesn’t.

3.5 Reasoning failures

Compounding errors in long chains. Chain-of-thought multiplies error rates: probability of correct full chain = product of correctness at each step. Long reasoning is fragile.

Reward hacking on verifiable rewards (frontier issue): models learn to game the verifier. E.g., math models that produce reasoning that looks correct but uses non-rigorous shortcuts.

Saying it out loud. Long chains of thought are fragile because the errors multiply. If each step is 97% reliable and you take twenty steps, you’re down around 55% on the whole chain — the arithmetic is brutal and it’s why long reasoning helps on some tasks and falls apart on others. The frontier version of this is reward hacking: when you train against a verifier, models learn to produce reasoning that satisfies the checker rather than reasoning that’s actually valid. Name that tradeoff — more reasoning tokens buys accuracy up to a point and then starts buying you plausible-looking nonsense.

3.6 The honest summary

LLMs hallucinate because:

1. The training objective rewards plausibility, not truth.
2. The world has long-tail facts the model doesn’t fully memorize.
3. RLHF rewards confident outputs.
4. Sampling is stochastic.
5. Long chains compound errors.

Mitigation isn’t “make the model not hallucinate” — it’s “detect and correct when it does.” That’s why detection is the focus.

Saying it out loud. If someone asks the one-liner: models hallucinate because the objective rewards plausibility rather than truth, the world has a long tail they never memorized, RLHF rewards confidence, sampling is random, and long chains compound errors. The honest conclusion is the part that scores — you’re not going to train hallucination to zero, so the engineering goal is to detect and contain it, not eliminate it. That’s why every serious production answer is about a detection cascade and a refusal policy, not about a magic prompt.

4. Detection methods — the full taxonomy

There are three families. A senior interview answer covers all three.

Saying it out loud. There are exactly three families and I’d name all three before diving into any one. Reference-based means you have something to check against — a gold answer, a source document, a database — and it’s cheap but only works when ground truth exists. Reference-free means no ground truth, so you make the model betray itself by sampling it several times or asking it to verify its own claims; that costs you five to ten times the inference. Internal-states-based means you read the model’s activations, which is nearly free at inference but needs white-box access and labeled training data for the probe. The tradeoff line is: cost, ground-truth availability, and model access — pick two.

5. Reference-based detection (when ground truth exists)

The easiest case: you have a reference (gold answer, source document, knowledge base) to compare against.

5.1 String overlap metrics

• BLEU, ROUGE, METEOR: n-gram overlap. Not designed for hallucination — high overlap doesn’t guarantee correctness; low overlap doesn’t guarantee error.
• Exact match (EM) and F1 (token-level): used for QA where answers are short.

Why they’re weak: They confuse paraphrasing with hallucination. A paraphrased correct answer scores low; a wrong answer that copies words from the question scores high.

Use as baselines, not as hallucination detectors.

Saying it out loud. BLEU and ROUGE are not hallucination detectors and I’d say so directly. They count n-gram overlap, so a perfectly correct paraphrase scores low and a wrong answer that parrots words from the question scores high — the metric can’t tell the difference between rewording and lying. They’re fine as cheap regression baselines when you already have a gold answer and want to notice if something broke. The failure mode to name: high ROUGE with a flipped negation, where one word changes the meaning and the score barely moves.

5.2 NLI-based detection

In plain language. This method borrows a tool from an older NLP task: given two sentences, does the first one prove the second? You feed the source document in as the “premise,” each sentence the model wrote in as the “hypothesis,” and a small entailment model votes supported or not. Everything below is just plumbing around that one call.

Frame each generated sentence as a hypothesis; the source/reference is the premise. Use a Natural Language Inference model to check entailment:

For each sentence S in the generated output:
    For each premise P in the source:
        if NLI(P, S) == "entailment":
            S is supported.
            break
    else:
        S is unsupported (potential hallucination).

Models commonly used:

• RoBERTa-large-MNLI (Williams et al.): off-the-shelf NLI model.
• DeBERTa-v3 fine-tuned on MNLI/ANLI: stronger.
• Specialized: SummaC (Laban et al. 2022), FactCC (Kryscinski et al. 2020) — trained specifically on summarization-faithfulness data.

Strengths: solid baseline, widely understood, no LLM-judge cost.

Weaknesses:

• NLI models can be brittle on long premises.
• Numeric reasoning poorly handled by NLI (“$30 million” vs “$30 billion” — sometimes scored as entailment).
• Doesn’t catch extrinsic hallucinations (statement is consistent with source but added information).

Saying it out loud. The idea is simple: treat the source as the premise, treat each sentence the model wrote as the hypothesis, and ask an entailment model “does this follow?” If nothing in the source entails the sentence, flag it. It’s the workhorse baseline because a DeBERTa-sized NLI model is milliseconds and pennies compared to an LLM judge. The failure mode I’d volunteer: NLI models are bad at numbers — swap million for billion and plenty of them still say entailment — so you bolt a numeric consistency check on top rather than trusting entailment alone.

5.3 QA-based detection (FEQA, QAGS, QuestEval)

Generate questions from the candidate text, answer them using the source, and check if the answers match.

For each fact F in the candidate:
    Q = generate_question(F)
    A_candidate = extract_answer_from(F)
    A_source = qa_model(Q, source)
    if A_candidate != A_source:
        F is a potential hallucination

Strengths: catches subtle factual errors better than NLI; numeric and entity consistency tested directly.

Weaknesses: depends on QA model quality and question generation quality; multi-hop questions can fool it.

Saying it out loud. Instead of asking “does the source imply this,” you turn the claim into a question, answer that question from the source, and check whether the two answers match. It’s like quizzing someone on their own summary using the original document as the answer key. It beats entailment on exactly the thing entailment is worst at — specific entities and numbers — because now you’re comparing “30 million” to “30 billion” as strings rather than hoping a classifier notices. The cost is that you’ve stacked two more models, a question generator and a QA model, and multi-hop claims slip through because no single generated question covers them.

5.4 Citation verification

For RAG / agentic outputs that cite sources:

1. For each cited claim, retrieve the cited passage.
2. Use NLI / LLM-judge to verify the passage actually supports the claim.

Citation faithfulness is a key sub-metric. Modern systems (GPT-4o, Claude, Perplexity) cite sources, but ~30-40% of citations don’t actually support the claim attached. Detection here is critical.

Saying it out loud. If the system cites sources, the cheapest high-value check is: pull up the passage it cited and ask whether that passage actually says the thing. People assume a citation is self-validating, and it really isn’t — on vanilla frontier RAG output, somewhere around a quarter to a third of citations don’t support the claim they’re attached to. That gap is one of the best numbers to have on hand, because it reframes citations from a trust signal into a verifiable artifact. Production systems target 95% or better citation faithfulness, and getting there is mostly reranking plus per-claim entailment, not a better model.

5.5 Knowledge graph triple matching

For factual claims about entities:

1. Extract (subject, relation, object) triples from the candidate.
2. Look up triples in a knowledge graph (Wikidata, internal KG).
3. Mismatch → hallucination.

Used in production for entity-rich domains (biomedical, legal).

Saying it out loud. For entity-heavy domains you can skip natural language entirely: pull subject-relation-object triples out of the response and look them up in a knowledge graph. If the model says a drug treats a condition and your ontology disagrees, that’s a hard, auditable failure with no LLM judgment involved. It’s precise and it’s fast, which is why biomedical and legal deployments use it. The limit is coverage — the knowledge graph is incomplete, so a missing triple means “unknown,” not “false,” and if you treat those as failures your false-positive rate explodes.

5.6 Code execution

For code generation:

• Run the generated code with test cases.
• Failure to execute or wrong output → hallucination.
• Static analysis: does the imported function actually exist? Correct signature?

This is the cleanest verification path — truly verifiable. The reason verifiable-reward RL works on code.

Saying it out loud. Code is the one place where verification is basically solved: run it. Either the tests pass or they don’t, either the imported function exists or it doesn’t — there’s no judge model in the loop and no disagreement about what “supported” means. That’s exactly why reinforcement learning with verifiable rewards works so well on code and math and hasn’t transferred cleanly to essays. The tradeoff worth naming: passing tests proves the code runs, not that it does the right thing, so test coverage becomes your real ceiling on detection quality.

6. Reference-free detection (no ground truth)

The harder case: production deployments often don’t have ground truth. Five major techniques.

6.1 Self-consistency (SelfCheckGPT — Manakul et al. 2023)

Idea: if the model is confident in a fact, it’ll produce the same fact across multiple stochastic generations. Hallucinations vary because they’re sampled from the model’s “confused” probability distribution.

1. Generate the original response with temperature 0 (or low).
2. Generate K=5 additional responses with temperature ~1.0 (high diversity).
3. For each sentence/claim S in the original:
    Compute consistency score: how many of the K samples support S?
    Low consistency → likely hallucination.

Consistency scoring options:

• NLI-based: NLI(sample_k, original_sentence) for each k; aggregate.
• QA-based: ask same question to each sample; see if answers agree.
• N-gram overlap: simple but noisy.
• LLM-judge: ask another LLM to compare for consistency.

Strengths: no ground truth needed; works across domains; intuitive.

Weaknesses: multiplies inference cost by K; if the model is confidently wrong (memorized misinformation), all samples will agree — false negative.

Production note: SelfCheckGPT became the default reference-free baseline. Many production systems use a cheaper variant: K=3 with NLI scoring.

Saying it out loud. The trick is to ask the same question five times at high temperature and see whether the model tells you the same story. Real knowledge is stable — the model says “photoelectric effect” every time. A made-up fact is sampled fresh from a fuzzy distribution, so you get a different year or a different name on each run, and that variance is your signal. It’s the standard reference-free baseline because it needs zero ground truth and zero model internals. Two costs to name: you’re paying five to six times the inference, and it’s blind to confident wrongness — if the model memorized the misinformation, all five samples agree and you get a clean bill of health on a false claim.

6.2 Token-level uncertainty signals

In plain language. During generation the model already tells you how sure it was about each word — that’s the log-probability. This section is about squeezing a hallucination signal out of numbers you get for free, and about why that signal is weaker than it looks.

The model’s own probabilities at generation time reveal uncertainty.

• Mean token log-prob: average over generated tokens. Low → model was uncertain.
• Min token log-prob: weakest token in the chain. A single very-low-prob token can flag a hallucinated entity.
• Token entropy: full distribution entropy at each step.
• Perplexity (geometric mean of token probs).

Strengths: free (you already have logits during generation); fast.

Weaknesses:

• Calibration is unreliable post-RLHF (the model is more confident on hallucinated entities than on rare-but-true ones).
• Some hallucinations are high-probability (model is confidently wrong).
• Doesn’t localize the hallucination cleanly.

In practice: use as a feature in a learned classifier, not as a standalone signal.

Saying it out loud. The cheapest possible signal is the model’s own confidence: average the log-probabilities across the answer, or look at the single least-confident token, which often lands right on the hallucinated name or number. It’s free, because you get the logits during generation anyway. But I wouldn’t ship it alone, and here’s why: after RLHF the calibration is broken — the model is often more confident on a fabricated entity than on a rare true one — so low probability catches some hallucinations and high probability doesn’t clear anything. Use it as one feature in a learned classifier, not as a standalone gate.

6.3 Semantic entropy (Farquhar et al. 2024 — Nature)

In plain language. “Entropy” here just means how spread out the model’s answers are. The insight is that you should measure the spread over meanings, not over wordings — two different sentences that say the same thing shouldn’t count as disagreement. Everything below is how to cluster answers by meaning and then measure the spread.

A major 2024 advance. The key insight: token-level uncertainty is misleading because different token sequences can mean the same thing. The model can be split between “Paris is the capital of France” and “The capital of France is Paris” — high token-level entropy but zero meaning entropy. Conversely, the model can be split between “Einstein” and “Newton” with low token-level entropy (the names are short) but high meaning entropy.

Algorithm:

1. Sample K=10 responses for the same prompt.
2. Cluster them by semantic equivalence using NLI (bidirectional entailment).
3. Compute entropy over clusters (not over tokens).
   semantic_entropy = -sum(p_cluster * log(p_cluster))
4. High semantic entropy → model is uncertain about meaning → likely hallucination.

Why it works: meaning-level entropy correlates with truth far better than token-level entropy. The Nature paper showed semantic entropy is the strongest reference-free hallucination predictor across many domains.

Cost: K samples + K-1 NLI calls for clustering. Comparable to SelfCheckGPT.

This is the must-know 2024 method. Mention it by name in interviews.

Saying it out loud. The problem with plain token entropy is that the model can be totally certain about the answer and still phrase it five different ways — high entropy, zero actual uncertainty. Semantic entropy fixes that by sampling ten answers, grouping them by meaning using bidirectional entailment, and measuring entropy over the groups instead of over the words. So “Paris is the capital” and “the capital is Paris” collapse into one bucket, while “Einstein” versus “Newton” stay two buckets even though both are one short token. Farquhar et al. put it in Nature in 2024 and it’s the strongest general-purpose reference-free predictor we have — cost is roughly ten generations plus the pairwise NLI clustering, so it belongs at the expensive end of a cascade, not on every request.

6.4 LLM-as-judge with chain-of-verification (CoVe — Dhuliawala et al. 2023)

Idea: the model itself can detect its own hallucinations if prompted correctly.

1. Generate a draft response.
2. Generate verification questions: "What facts in this response need checking?"
3. For each question, ask the model independently (without the draft as context).
4. Compare draft answers to fresh answers; flag inconsistencies.
5. Generate final response that incorporates corrections.

Strengths: requires only the model itself; can both detect and correct in one pass.

Weaknesses: ~5× the cost of single generation; depends on the model’s self-judge ability (frontier models are okay at this, smaller models are unreliable).

Used in production for high-stakes responses where compute budget allows.

Saying it out loud. Chain-of-Verification is basically making the model fact-check itself with amnesia. It writes a draft, then generates verification questions about the claims in that draft, then answers each question in a fresh context where it can’t see the draft — so it can’t just agree with itself — and finally rewrites, fixing whatever came back inconsistent. The independence step is the whole trick; without it the model rubber-stamps its own errors. It’s around five LLM calls per query and it depends on the base model being a decent judge, which frontier models are and small models really aren’t.

6.5 Verifier models

Train a separate classifier to predict “is this output a hallucination?” given the prompt + response.

• Inputs: (prompt, response, optional retrieved context).
• Outputs: binary (hallucination or not) or per-sentence scores.
• Training data: human-labeled hallucination examples (HaluEval, FactScore).

Production examples:

• Vectara HHEM (Hughes Hallucination Evaluation Model): widely used, public.
• Honest LLM judge (Lin et al. 2024): smaller LLM trained specifically as hallucination detector.
• NLI-based commercial offerings: Patronus AI, Galileo, etc.

Strengths: fast at inference (single classifier pass); can be domain-specialized.

Weaknesses: needs labeled training data; quality depends on annotation; out-of-distribution test prompts may fool the verifier.

Saying it out loud. Instead of clever sampling, just train a classifier: feed it the prompt, the response, and the retrieved context, and have it output a hallucination score. Vectara’s HHEM is the well-known public one, and there’s a commercial tier — Patronus, Galileo, and friends. The appeal is production economics: it’s one small forward pass, so it’s cheap enough to run on every request, and you can specialize it to your domain. The failure mode is distribution shift — the verifier is only as good as its labels, and on prompts unlike its training data it fails quietly, which is worse than failing loudly.

6.6 Ensemble disagreement

Run multiple LLMs (or one LLM with different prompts/temperatures) on the same query; check agreement.

Strengths: simple; catches systematic biases of any single model.

Weaknesses: expensive; correlated errors (if all models share training data biases, they all hallucinate similarly).

Saying it out loud. Ask several different models the same question and see if they agree — disagreement is a decent proxy for “this is shaky.” It’s a step up from sampling one model repeatedly, because different models have different training data and different blind spots. The catch, and this is the thing to name, is correlated errors: today’s frontier models are trained on overlapping web-scale corpora, so they tend to share the same misconceptions and confidently agree on the same wrong answer. Plus you’re paying N times inference across N vendors, which is usually the reason it stays a research tool.

7. Internal-states-based detection (frontier methods)

Use the LLM’s own hidden states or attention patterns to predict hallucinations. Faster than reference-free methods at inference (single forward pass), and surprisingly effective.

7.1 Truth probes (Burns et al. 2022 / “Discovering Latent Knowledge”)

In plain language. A “probe” is a tiny classifier trained on the model’s internal activations rather than its words. The claim being tested here is that somewhere inside the network there’s a direction that separates statements the model treats as true from ones it treats as false — even when its output says otherwise.

Idea: LLMs internally “know” when they’re uncertain — there’s a direction in activation space that distinguishes truthful from untruthful claims.

Algorithm:

1. Collect a dataset of (statement, label∈{true, false}) pairs.
2. For each statement, run through the LLM and collect activations at a chosen layer.
3. Train a linear probe (logistic regression) to predict the truth label from activations.
4. At inference: extract activations from the model’s response, apply the probe.

Findings: linear probes on middle layers (e.g., layer 16 of a 32-layer model) often achieve 80-90% accuracy on truth classification — the model internally represents truth even when it generates a falsehood.

Strengths: very cheap at inference (one extra dot product); no extra LLM calls.

Weaknesses: requires labeled training data; probe transfers imperfectly across domains; needs activation access (white-box).

Saying it out loud. It turns out the model often internally knows it’s making something up, even while it confidently writes it down. You take a pile of true and false statements, grab the hidden state at some middle layer, and fit a logistic regression to separate them — that’s the whole method. On labeled benchmarks these linear probes land around 80 to 90% accuracy, which is remarkable for one dot product. Two constraints to name: you need white-box activation access, so it’s off the table for an API vendor, and the probe transfers poorly across domains — train it on trivia and it degrades on clinical text.

7.2 INSIDE / activation-based hallucination scores

In plain language. Same idea as truth probes, different statistics. Instead of one linear direction, these methods look at how spread out or how correlated the internal representations are across several sampled responses, and turn that into a score.

Several papers (INSIDE, EigenScore, SAPLMA — 2023-2024) use functions of internal activations:

• EigenScore: spread of representations across multiple samples (sampled responses’ activations).
• SAPLMA: train a small MLP on activations to predict factuality.
• INSIDE: focuses on covariance between hidden states and decoded tokens.

All exploit the observation that the model’s internal “uncertainty” is a stronger signal than its output probability distribution (which RLHF corrupts).

Saying it out loud. This is a family of methods — EigenScore, SAPLMA, INSIDE — all built on the same observation: the model’s internal representation carries more honest uncertainty than its output probabilities do. EigenScore samples several responses and measures how spread out their internal representations are; SAPLMA trains a small MLP on activations instead of a linear probe. The reason they beat logit-based signals is precisely the RLHF calibration problem — alignment training reshapes the output distribution toward confidence but doesn’t scrub the uncertainty out of the middle layers. They’re cheap at inference and they all require white-box access plus labeled data, which is the recurring tradeoff for this whole family.

7.3 Attention pattern analysis

Hallucinated content correlates with attention-pattern abnormalities:

• Attention heads that usually focus on retrieved context spread their attention more uniformly when hallucinating.
• Specific “factuality heads” identified in some models.

Used for diagnosis more than production detection.

Saying it out loud. When a model is grounding an answer in retrieved text, certain attention heads lock onto that context; when it’s making something up, that attention smears out across the sequence. So diffuse attention over the retrieved passages is a hallucination tell. Some papers go further and identify specific “factuality heads.” I’d frame this honestly as a diagnostic rather than a production detector — it’s model-specific, it doesn’t survive a version upgrade, and the effect sizes are small compared to just running an entailment check.

7.4 Activation steering (mitigation, related)

Beyond detection: at generation time, add a “truthful” direction to the residual stream (the difference between truthful and untruthful internal representations). This pushes the model’s distribution toward truthful outputs. Used in Anthropic, OpenAI, and academic work on alignment.

Saying it out loud. If there’s a direction in activation space that encodes truthfulness, you don’t have to stop at reading it — you can add it back in during generation and nudge the model toward honest outputs. Same math as the probe, used as an intervention instead of a measurement. It’s elegant and it does move the needle on TruthfulQA-style benchmarks. The tradeoff is dosage: push the steering vector too hard and you degrade fluency and general capability, so you’re trading truthfulness against everything else the model does, with no principled way to pick the coefficient.

7.5 Code snippets — major detectors (whiteboardable in 5-10 min each)

You’ll be asked to implement these. Below are minimal idiomatic versions.

Saying it out loud. The thing that separates candidates in a whiteboard round isn’t the code, it’s the narration — say what you’re doing while you type it. For every one of these I’d open with one sentence of intent (“I’m sampling K responses so I can measure disagreement”), then write it, then close with the cost (“this is roughly six times single-generation inference”). Interviewers grade whether you know what’s expensive and what’s free. Silence while typing reads as uncertainty even when the code is perfect.

SelfCheckGPT (NLI variant)

def selfcheck_nli(question, original, llm, nli, K=5, T=1.0):
    """
    For each sentence in `original`, sample K alternative responses;
    score each sentence by mean NLI-entailment from the samples.
    Returns: list of (sentence, support_fraction). Low fraction → likely hallucination.
    """
    samples = [llm(question, temperature=T) for _ in range(K)]   # K diverse responses
    sentences = split_into_sentences(original)
    scores = []
    for sent in sentences:
        ent_count = sum(
            1 for s in samples
            if nli(premise=s, hypothesis=sent) == "entailment"
        )
        scores.append((sent, ent_count / K))
    return scores

Production cost: K × (LLM generation) + |sentences| × K × (NLI call). Typically 5-6× single generation.

Saying it out loud. While coding this I’d narrate: “Sample K responses at temperature one, split the original into sentences, and for each sentence count how many samples entail it.” The support fraction is the score — a sentence supported by five out of five is solid, one out of five is almost certainly invented. Then I’d state the cost unprompted: K generations plus sentences-times-K NLI calls, so about five to six times a single generation. And I’d flag the blind spot before they ask — if the model is confidently wrong, all K samples agree and this scores it clean.

Semantic entropy (Farquhar et al. 2024)

def semantic_entropy(question, llm, nli, K=10, T=1.0):
    """
    1) Sample K responses.
    2) Cluster by bidirectional NLI entailment (semantic equivalence).
    3) Entropy over cluster sizes.
    Returns: scalar entropy. High → uncertain about meaning → likely hallucination.
    """
    samples = [llm(question, temperature=T) for _ in range(K)]

    # Cluster by bidirectional NLI entailment
    clusters = []                                                # list of lists of sample indices
    for i, s in enumerate(samples):
        placed = False
        for c in clusters:
            rep = samples[c[0]]
            # bidirectional entailment = "same meaning"
            if (nli(rep, s) == "entailment" and
                nli(s, rep) == "entailment"):
                c.append(i)
                placed = True
                break
        if not placed:
            clusters.append([i])

    # Entropy over cluster probabilities
    sizes = np.array([len(c) for c in clusters], dtype=float)
    p = sizes / sizes.sum()
    return float(-np.sum(p * np.log(p + 1e-12)))

What to say while coding: “K samples, pairwise bidirectional-NLI clustering, entropy over cluster sizes. Captures meaning-level uncertainty — different token sequences with the same meaning don’t add to the entropy.”

Saying it out loud. Narrate it as three moves: sample K responses, cluster them by bidirectional entailment so that same-meaning answers merge, then take entropy over cluster sizes. The clustering is the interesting line — I’d say out loud that entailment has to hold in both directions, because one-directional entailment is implication, not equivalence. One cluster with all ten samples means entropy zero and the model is sure; ten singleton clusters means maximum entropy and you should not ship that answer. Cost is K generations plus roughly K-squared NLI comparisons in the naive version, which is why K is ten and not a hundred.

NLI-based faithfulness check (RAG)

def faithfulness_score(claims, context, nli):
    """
    For each atomic claim in the response, check if `context` entails it.
    Returns: fraction supported.
    """
    supported = 0
    for claim in claims:
        # Sliding window over context to handle long passages
        for chunk in chunks_of(context, max_tokens=512, overlap=64):
            if nli(premise=chunk, hypothesis=claim) == "entailment":
                supported += 1
                break
    return supported / len(claims)

def extract_claims(response, llm):
    """LLM-prompted decomposition into atomic factual claims."""
    return llm(f"List the atomic factual claims in this text, one per line:\n{response}").split("\n")

Standard RAGAS faithfulness pipeline.

Saying it out loud. This is RAGAS faithfulness in fifteen lines: break the answer into atomic claims, and for each claim scan the context in overlapping windows looking for one chunk that entails it. Faithfulness is just the fraction of claims that found support. Two things I’d say while writing it: the windows overlap because a claim can straddle a chunk boundary, and claim extraction quality dominates the whole metric — if the decomposer emits vague claims like “the company performed well,” everything entails them and your score is meaninglessly high.

Token-level uncertainty (cheap baseline)

def token_uncertainty(prompt, response, llm_with_logits):
    """Mean and min log-prob across the response tokens."""
    logprobs = llm_with_logits(prompt, response)        # [L] per-token log-probs of the response under the model
    return {
        "mean_logprob": float(np.mean(logprobs)),
        "min_logprob":  float(np.min(logprobs)),
        "perplexity":   float(np.exp(-np.mean(logprobs))),
    }

Cheap (you already get logits during generation). Often used as a feature in a learned classifier alongside other signals.

Saying it out loud. Three numbers out of the logits you already have: mean log-prob, min log-prob, and perplexity. I’d point at min log-prob and say that’s usually the most informative one, because the hallucinated proper noun or year tends to be the single weakest token in an otherwise confident sentence. It costs nothing, which is why it belongs in stage one of any cascade. And I’d immediately caveat that post-RLHF calibration is unreliable, so this is a feature feeding a classifier, not a decision boundary on its own.

Chain-of-Verification (CoVe)

def chain_of_verification(question, llm):
    """
    Draft → verification questions → fresh answers → reconcile → final.
    """
    # Step 1: baseline draft
    draft = llm(f"Answer the question:\n{question}")

    # Step 2: generate verification questions
    qs = llm(
        f"List independent verification questions for the facts in this draft:\n{draft}"
    ).split("\n")

    # Step 3: answer each verification question independently (no draft as context)
    fresh = {q: llm(f"Answer concisely: {q}") for q in qs if q.strip()}

    # Step 4: revise the draft using the fresh answers
    final = llm(
        f"Original question: {question}\n"
        f"Initial draft: {draft}\n"
        f"Verification answers: {fresh}\n"
        f"Produce a final answer that corrects any inconsistencies and "
        f"acknowledges uncertainty where the verification doesn't support the draft."
    )
    return final

Cost: ~5 LLM calls per query. Best for high-stakes long-form generation.

Saying it out loud. Four calls, and I’d name each as I write it: draft, generate verification questions, answer each one without the draft in context, then reconcile. The comment about not passing the draft is the line to say aloud, because that independence is the entire mechanism — hand the model its own draft and it will agree with itself. The final prompt matters too: it has to tell the model to acknowledge uncertainty, not just to patch contradictions, otherwise it papers over the gap. Around five calls per query, so this is a high-stakes-only tool.

Truth probe (linear probe on activations)

def train_truth_probe(model, statements_with_labels, layer=16):
    """
    statements_with_labels: list of (text, label∈{0,1}) where 1=true, 0=false.
    Returns: a logistic-regression probe on activations from `layer`.
    """
    X, y = [], []
    for text, label in statements_with_labels:
        # Forward pass; collect hidden states at chosen layer at the final token
        h = model.forward_hidden(text, layer=layer)[-1]      # [d]
        X.append(h.numpy())
        y.append(label)
    X = np.stack(X); y = np.array(y)
    from sklearn.linear_model import LogisticRegression
    return LogisticRegression(max_iter=1000).fit(X, y)

def score_truth(probe, model, text, layer=16):
    """Apply the probe to a new statement; returns p(true)."""
    h = model.forward_hidden(text, layer=layer)[-1]
    return float(probe.predict_proba(h.numpy().reshape(1, -1))[0, 1])

Cost at inference: one forward pass + one dot product. Very cheap once trained. Often achieves 80-90% truth-classification on benchmarks.

Saying it out loud. Forward-pass a labeled set of true and false statements, grab the hidden state at the last token of some middle layer, fit logistic regression. That’s it — the whole method is twelve lines and sklearn. While coding I’d justify the layer choice: middle layers work best because early ones are still surface-level and late ones have collapsed onto next-token prediction. Inference cost is one dot product on top of a forward pass you were doing anyway, and it lands around 80 to 90% on benchmarks — the catch is you need white-box access and a labeled dataset in your domain.

Citation faithfulness check (per-claim)

def verify_citations(response, citations, nli):
    """
    response: str with inline citations like "[1]", "[2]".
    citations: dict[citation_id → cited_passage].
    Returns: list of (citation_id, claim_around_citation, supported∈bool).
    """
    out = []
    for cite_id in re.findall(r"\[(\d+)\]", response):
        # Sentence containing the citation = the claim being attributed
        claim = sentence_containing_citation(response, cite_id)
        passage = citations[cite_id]
        supported = nli(premise=passage, hypothesis=claim) == "entailment"
        out.append((cite_id, claim, supported))
    return out

Frontier RAG metric: citation faithfulness = fraction of citations that actually support their claim.

Saying it out loud. Regex out the citation markers, grab the sentence each marker sits in, pull the cited passage, and run one entailment check per pair. The metric is the fraction of citations whose passage actually supports the sentence attached to them. What I’d say while writing it: the fiddly part isn’t the NLI call, it’s deciding what the claim is — sentence-level is the cheap approximation, and it over-attributes when one sentence carries three facts and only one of them came from that source. Frontier RAG sits around 70 to 85% here; production targets are 95%+.

Putting it all together — production cascade

def detect_hallucination(query, response, context=None, llm=None, nli=None,
                         logits=None, fast_threshold=0.3, escalate_threshold=0.6):
    """
    Cascade: cheap signals first; escalate to expensive ones if uncertain.
    Returns: dict with overall confidence and per-stage scores.
    """
    scores = {}

    # Stage 1 (cheap): token-level signal if logits available
    if logits is not None:
        scores["token_unc"] = token_uncertainty(query, response, logits)

    # Stage 2 (medium): NLI vs context for RAG
    if context is not None:
        claims = extract_claims(response, llm)
        scores["faithfulness"] = faithfulness_score(claims, context, nli)
        # Confident clean → return
        if scores["faithfulness"] > 0.95:
            return {"verdict": "pass", "scores": scores}
        if scores["faithfulness"] < fast_threshold:
            return {"verdict": "fail", "scores": scores}

    # Stage 3 (expensive): semantic entropy
    scores["sem_entropy"] = semantic_entropy(query, llm, nli, K=10)
    if scores["sem_entropy"] > escalate_threshold:
        return {"verdict": "escalate_to_human", "scores": scores}

    return {"verdict": "pass", "scores": scores}

This is the canonical production design. Tune thresholds per domain.

Saying it out loud. This is the answer to “design me a hallucination detector,” so I’d walk it top to bottom: cheap signals on every request, medium-cost entailment when there’s retrieved context, and the expensive semantic-entropy path only for the cases still ambiguous after that. Note the two early exits — very high faithfulness returns pass immediately and very low returns fail immediately, so the expensive stage only sees the murky middle, which in practice is maybe 10 to 20% of traffic. That’s what makes the economics work: your average cost is close to the cheap stage while your accuracy is close to the expensive one. The thresholds are per-domain and they’re a business decision, not a modeling one.

8. RAG-specific hallucination detection

When the model has retrieved context, faithfulness to that context is the primary check. Different from general factuality.

8.1 Faithfulness vs factuality (the key distinction)

• Faithfulness: response is supported by retrieved context. (Even if the context is wrong, a faithful response is one that doesn’t add unsupported claims.)
• Factuality: response is true in the real world.

Frontier-lab interview probe: “Can a faithful response be wrong?” Yes — if retrieved context is wrong, faithful response inherits the error. Faithfulness is the ML problem; factuality is the data problem.

Saying it out loud. Faithful means “supported by the documents I retrieved.” Factual means “true in the real world.” Those come apart the moment your retrieval pulls up something outdated or wrong — the model quotes it accurately, the answer is perfectly faithful, and it’s also perfectly wrong. I’d frame it as: faithfulness is the ML problem, factuality is the data problem, and your RAG pipeline can only ever own the first one. That’s also why production monitoring tracks faithfulness — it’s computable from your own logs, whereas factuality needs a human or an external knowledge base.

8.2 RAGAS metrics

In plain language. RAGAS is a framework that scores a RAG pipeline on four axes without needing gold answers for most of them. Two of the metrics grade the generator and two grade the retriever — that split is the useful thing to remember.

The standard framework (Es et al. 2023) has four metrics:

In production: faithfulness is the most-monitored. Context precision/recall are diagnostics.

Saying it out loud. RAGAS gives you four numbers and the useful way to hold them is: two grade the generator, two grade the retriever. Faithfulness and answer relevance are about the answer — is it grounded in what was retrieved, and does it actually address the question. Context precision and context recall are about retrieval — did you pull junk, and did you miss something you needed. Debugging depends on reading them together: low faithfulness with good context means the generator is confabulating, but low faithfulness with bad context means fix the retriever first. In production, faithfulness is the one you alert on; the context metrics are diagnostics because recall needs a gold answer to compute.

8.3 Citation correctness

Modern RAG systems should cite. Citation correctness has two parts:

1. Citation existence: does the cited source exist?
2. Citation faithfulness: does the cited source support the specific claim?

(2) is harder. Implementation: for each (claim, citation) pair, retrieve the cited passage, run NLI to verify entailment.

Empirical: GPT-4 / Claude RAG outputs have ~70-85% citation faithfulness. Production-grade systems target ≥95%.

Saying it out loud. There are two separate questions hiding inside “is the citation right.” Does the source exist at all — that’s a lookup, easy. And does that source actually support this specific claim — that’s an entailment problem, and it’s where the real failure lives. Everyone builds the first check and stops. The number that lands: frontier models’ RAG output runs roughly 70 to 85% citation faithfulness out of the box, while a production bar is 95% or better, and closing that gap is per-claim verification, not a bigger model.

8.4 Attribution evaluation (Rashkin et al. 2023, AIS)

In plain language. AIS is the careful, human-annotation version of “did the source really say that.” Its contribution is splitting the judgment into two questions asked in order, which is what makes annotators agree with each other.

A more rigorous framework: Attributable to Identified Sources (AIS). For each claim:

• Is the claim interpretable? (Concrete, verifiable.)
• Is it attributable to the cited source? (Source supports it.)

Used as the gold standard for evaluating RAG outputs at frontier labs.

Saying it out loud. AIS — Attributable to Identified Sources — is the rigorous framing, and its contribution is asking two questions in order instead of one. First, is the claim even interpretable on its own, meaning concrete enough that you could check it? Then, and only then, is it supported by the cited source? That ordering matters because vague claims are what wreck annotator agreement — nobody can agree on whether “the outlook is positive” is attributable. It’s the gold standard for evaluating RAG output, and the cost is that it’s human annotation, so it’s an offline audit, not a runtime check.

9. Benchmarks and datasets

You’ll be asked which datasets / benchmarks measure hallucination. Have these ready:

Saying it out loud. When someone asks which benchmark to use, the answer depends on what you’re measuring, and I’d say that first. For world-knowledge factuality it’s TruthfulQA and SimpleQA — TruthfulQA specifically tests whether the model repeats popular misconceptions, SimpleQA is short-answer and adversarial and frontier models still land in the 30 to 60% range, which is a nice humbling number. For RAG faithfulness it’s RAGTruth and FACTS Grounding. For code, execution is the benchmark. The trap to avoid is quoting a general factuality score as evidence about your grounded system — they measure different contracts.

9.1 General factuality

• TruthfulQA (Lin et al. 2021): 817 questions designed to elicit common misconceptions (“How do you cause an avalanche?”). Evaluates whether models repeat false-but-popular beliefs.
• SimpleQA (OpenAI, 2024): 4,326 short-answer factuality questions, designed to be answerable but adversarial. Most LLMs score 30-60% accuracy.
• HaluEval (Li et al. 2023): 35K hallucinated-vs-correct examples for QA, dialogue, summarization.
• FactScore (Min et al. 2023): per-fact factuality scoring for long-form generation.
• FActScore-Bio: biographies — evaluates fine-grained factuality in long generation.

9.2 RAG / faithfulness

• FEVER (Thorne et al. 2018): claim verification against Wikipedia.
• WICE: Wikipedia citation entailment.
• RAGTruth (Niu et al. 2024): ~18K hallucinated-vs-faithful RAG outputs across QA / summarization / data2text.
• HHEM benchmark (Vectara): hallucination detection evaluation.
• FACTS Grounding (Google DeepMind, 2024): a benchmark and leaderboard specifically for grounding/faithfulness evaluation.

9.3 Reasoning / math hallucination

• MATH-Verifier: process-level errors in chain-of-thought.
• PRM800K (Lightman et al. 2023): step-level annotations for math reasoning.

9.4 Code

• HumanEval, MBPP, SWE-Bench: execution-based; “hallucination” = code doesn’t pass tests.

9.5 Multilingual / multimodal

• MULTIHAL, VLM-Hallucination-Bench: hallucinations beyond English text.

10. Mitigation strategies (the production playbook)

Detection is half the story. Here’s what frontier labs deploy.

10.1 Retrieval grounding

Most effective single intervention. Constrain the model to ground its output in retrieved context.

• Prompt: “Answer ONLY using information from the context below. If the answer isn’t in the context, say ‘I don’t know’.”
• Combined with citation requirement: forces explicit attribution.
• Reduces hallucination rate by ~50-80% empirically.

Saying it out loud. If you can only do one thing, do this: give the model the documents and tell it to answer only from them, and to say it doesn’t know otherwise. Empirically that’s a 50 to 80% cut in hallucination rate, which nothing else in the toolkit comes close to. Requiring inline citations helps further, because it forces the model to point at a specific span rather than gesture at the context. The tradeoff to name is that you’ve converted a generation problem into a retrieval problem — now bad retrieval is your bottleneck, and a faithful answer to a wrong document is still wrong.

10.2 Refusal training

Train the model to say “I don’t know” when uncertain. RLHF with explicit reward for refusing hard questions.

• Drawback: too aggressive refusal hurts UX; tuning is hard.
• Modern approach: calibrated refusal — the model refuses only when its calibrated confidence is below threshold.

Saying it out loud. Teach the model to say “I don’t know,” because by default RLHF taught it never to. The obvious way is to reward refusal on questions it can’t answer, and the obvious problem is overshoot — a model that refuses your reasonable question is, from a user’s perspective, broken, and refusal rate is one of the metrics that quietly tanks product satisfaction. So the modern framing is calibrated refusal: refuse when the model’s calibrated confidence is below a threshold, rather than training a blanket reflex. That turns a training problem into a threshold you can actually tune per domain.

10.3 Constitutional / honesty principles

Prompt the model with explicit honesty constraints:

• “Acknowledge uncertainty when present.”
• “Don’t fabricate citations.”
• “If asked about events after [cutoff], note your knowledge limits.”

Augmented with constitutional-AI-style critique-and-revise loops.

Saying it out loud. You can get real mileage out of just writing the rules down: acknowledge uncertainty, never fabricate a citation, flag anything past your knowledge cutoff. Constitutional AI takes that further with a critique-and-revise loop, where the model checks its own draft against the principles and rewrites. It’s cheap and it stacks with everything else. The honest limitation: principles shape style far more than they shape knowledge — a model that doesn’t know the answer will now hedge beautifully while still being wrong, so this reduces confident wrongness, not wrongness.

10.4 Chain-of-Verification (CoVe)

§6.4 above. Effective but expensive (~5×). Used selectively for high-stakes outputs.

10.5 Conservative decoding

• Temperature 0 or low.
• Top-p narrow.
• Deterministic for factual queries; stochastic for creative ones.

Saying it out loud. Drop the temperature for anything factual and save the sampling for anything creative — that’s basically the rule, and routing by query type is a genuinely cheap win. But I’d be clear that it’s a partial fix, because it only removes hallucinations that came from the tail of the distribution. The ones that came from the model being confidently wrong are the highest probability tokens, so temperature zero delivers them faster and more consistently. Variance reduction, not error correction.

10.6 Calibration

Post-hoc calibration of token-level probabilities so they actually mean what they say. Platt scaling on a held-out set; updates the model’s stated confidences. Doesn’t reduce hallucinations but makes them flaggable.

Saying it out loud. Calibration doesn’t stop the model hallucinating — it makes the hallucinations flaggable, which is a different and underrated thing. You fit something simple like Platt scaling or temperature scaling on a held-out set so that when the system says 80% it’s right about 80% of the time. Once that holds you can set an honest abstention threshold instead of a made-up one. The number to quote is ECE, expected calibration error, and the thing to name is that RLHF is what broke calibration in the first place, so this step is usually undoing damage from alignment.

10.7 Tool use / verifiable execution

For computable claims (math, code, data lookups): outsource to a tool. The tool either succeeds or fails. Hallucination rate ≈ 0 for the tool-handled portion.

Saying it out loud. For anything computable, don’t ask the model — make it call something. Arithmetic goes to a calculator, data questions go to SQL, code goes to an interpreter. Hallucination rate on the tool-handled portion is essentially zero because the tool either returns an answer or errors out. That’s why tool use is the highest-leverage mitigation for quantitative products. The failure mode just moves upstream: the model can still call the wrong tool or pass it the wrong arguments, so you’ve traded fact hallucination for parameter hallucination, which at least is loggable and testable.

10.8 Honest-trained models

Models specifically RLHF’d or fine-tuned for honesty: Anthropic Claude (constitutional AI), OpenAI o1 / GPT-4 with deliberative alignment.

Empirical claims: o1 reportedly hallucinates less because the long reasoning chain catches its own errors. Mileage varies.

(Note, added later: this claim dates from the 2024 o1 release and was largely vendor-reported. Subsequent evidence is mixed — extended reasoning also gives the model more room to invent a premise early and then defend it consistently. Treat “reasoning models hallucinate less” as a prior to verify per task, not an established result.)

Saying it out loud. Some models are explicitly trained for honesty — Claude through constitutional AI, OpenAI’s reasoning models through deliberative alignment — and the reasoning ones plausibly hallucinate less because a long chain of thought gives the model a chance to catch itself. I’d say that with a hedge, though, because the evidence is mixed and vendor-reported: longer reasoning also gives more opportunities to invent a premise and then defend it. Treat “the model is honest now” as a prior you still verify, not as a reason to skip the detector.

10.9 Rejection sampling

Generate K candidates; verify each with a hallucination detector; return the highest-scoring or refuse if all fail. Best-of-N for factuality.

Saying it out loud. Generate N answers, score each with your detector, and ship the best one — or refuse if none of them clear the bar. It’s best-of-N, just with factuality as the ranking signal instead of a preference reward. It works because you only need one good sample out of N, and the detector only needs to rank, which is easier than being absolutely calibrated. The cost is linear in N on both generation and scoring, and the failure mode is detector overfitting — optimize hard enough against your own scorer and you start selecting for answers that fool it.

11. Production system design — how to deploy hallucination detection

The interview question: “Design a hallucination-detection system for a production LLM application.”

11.1 Where in the pipeline?

user query
  │
  ▼
[generate response]
  │
  ▼
[hallucination detector]
  ├─ confident clean → return
  ├─ borderline      → re-generate / verify / refuse
  └─ confident bad   → block + escalate
  │
  ▼
[post-hoc logging for monitoring]

Saying it out loud. The detector sits between generation and the user, and it has three exits, not two: clean goes straight through, borderline gets regenerated or verified more expensively, and confidently bad gets blocked and escalated. Having the middle branch is what people forget — a binary pass/fail gate either lets bad answers out or refuses far too much. Everything gets logged whether it passed or not, because that log is where next quarter’s training data comes from. The design constraint driving all of it is latency: the detector runs on the critical path, so its budget is whatever you can spend before the user notices.

11.2 The detector stack

Typically a cascade:

fast cheap detectors (token-level uncertainty, small classifier)
  │  if uncertain
  ▼
medium cost (NLI vs retrieved context, citation check)
  │  if still uncertain
  ▼
expensive (semantic entropy, LLM-as-judge, CoVe)
  │  if still uncertain
  ▼
human review (for high-stakes domains)

Latency budget determines how much you can afford. For chat: 100ms budget. For background research: 30s.

Saying it out loud. Never one detector — always a cascade from cheap to expensive, with each tier only seeing what the tier above couldn’t resolve. Token-level signals and a small classifier run on everything, entailment against the retrieved context runs on the uncertain ones, semantic entropy or an LLM judge runs on what’s still ambiguous, and humans see the residue in high-stakes domains. It’s the same shape as a spam pipeline or a fraud pipeline, and the reason is the same: you want average cost near the cheap tier and accuracy near the expensive one. Latency is what sets the depth — a chat product has maybe 100 milliseconds of headroom, a background research agent has 30 seconds, and those are completely different stacks.

11.3 RAG-specific detector

generated response
  │
  ▼
[claim extraction] — split response into atomic claims
  │
  ▼
[citation verification] — does each citation actually entail the claim?
  ├─ NLI model
  └─ optional LLM judge for borderline
  │
  ▼
[unsupported-claim detection] — claims without citations or with weak citations
  │
  ▼
[score per claim + aggregate]
  │
  ▼
[action: pass / regenerate / refuse]

Saying it out loud. For RAG the pipeline is concrete: split the answer into atomic claims, check each claim’s citation actually entails it, separately flag claims that carry no citation at all, aggregate to a score, then decide pass, regenerate, or refuse. The uncited-claim branch is the one people skip and it’s where extrinsic hallucination hides — a claim with no citation was never checked by anything. Escalating only borderline cases to an LLM judge keeps the cost sane. The aggregate is a design choice worth stating: mean support is forgiving, minimum support is strict, and for high-stakes you want the minimum.

11.4 Domain-specific layers

For high-stakes domains, add domain detectors:

• Medical: drug-name lookup against drug databases.
• Legal: citation verification against legal corpus.
• Finance: numerical consistency check (does the claimed % match the underlying data?).

Saying it out loud. Generic detectors get you most of the way and then you bolt on the checks only your domain can do. Medical: every drug name goes against a drug database. Legal: every citation goes against a legal corpus that actually exists. Finance: do the percentages in the prose reconcile with the numbers in the table? These are deterministic lookups, so they’re cheap, exact, and auditable — which matters enormously when the failure is regulatory rather than just embarrassing. The general lesson to state: the highest-precision detector in any product is usually a boring database join, not a model.

11.5 Online metrics

Track in production:

• Estimated hallucination rate (from sampled audits + verifier).
• Refusal rate (high refusal = over-cautious).
• User report rate (“this answer was wrong” buttons).
• Per-domain breakdown (medical hallucination ≠ general hallucination).

Saying it out loud. Four things on the dashboard: estimated hallucination rate from sampled audits, refusal rate, user-reported error rate, and all of it broken out per domain. Refusal rate is the one people forget, and it’s the guardrail on the guardrail — if hallucinations drop while refusals climb, you didn’t fix anything, you just made the product more annoying. The per-domain split matters because a global average hides exactly the segment you care about. And I’d be honest that the headline number is an estimate from a sample, not a measurement, because full labeling is unaffordable.

11.6 Feedback loop

User reports → labeled examples → retrain verifier model. The detection system improves over time as it learns from real failures.

Saying it out loud. The system should get better from being used: user reports become labeled examples, labeled examples retrain the verifier, and the verifier catches more next month. That flywheel is the difference between a detector that decays and one that compounds. The thing to name is the sampling bias — users report the failures that are obvious and annoying, not the subtle ones, so if you train purely on reports your verifier gets great at the easy cases and stays blind to the dangerous ones. You fix that by mixing in randomly sampled audited traffic alongside the reports.

12. Evaluation methodology — how to measure the detector itself

A subtle interview probe: “How do you know your hallucination detector works?”

12.1 Ground-truth annotation challenges

• Inter-annotator agreement on hallucination labels is often low. Different humans disagree on whether a claim is “supported.”
• Granularity matters: per-sentence, per-claim, per-response — the same response can have different scores at different granularities.
• Domain expertise needed: medical hallucinations require doctors to label.

Saying it out loud. The uncomfortable truth is that humans don’t agree on what counts as a hallucination, so your labels are noisy before any model touches them. Two annotators will genuinely split on whether a claim is “supported” or merely “consistent.” Granularity moves the number too — the same response scores differently per sentence, per atomic claim, or as a whole. And in specialized domains only a clinician or a lawyer can label, which caps your dataset size hard. Say it plainly: your detector’s measured ceiling is inter-annotator agreement, so report that agreement number alongside your accuracy.

12.2 Metrics for the detector

• Precision: of flagged hallucinations, what fraction are real? (High → few false alarms.)
• Recall: of actual hallucinations, what fraction did we catch?
• AUPRC: precision-recall curve. Standard for imbalanced detection.
• Per-severity: don’t average across critical and cosmetic; report separately.

Saying it out loud. It’s a detection problem on a rare, imbalanced class, so accuracy is meaningless — if 3% of responses hallucinate, a detector that always says “clean” is 97% accurate. Report precision, recall, and AUPRC, not ROC-AUC, because with heavy imbalance ROC curves look flattering. Precision is your false-alarm cost, recall is what you actually let through. And break it out by severity rather than averaging — a detector with 95% recall that misses the critical cases is worse than one at 80% that catches them all.

12.3 Cost-aware evaluation

In plain language. This section says: don’t pick your alerting threshold by maximizing accuracy, pick it by minimizing money. The formula below just assigns a different price tag to a miss and to a false alarm, then finds the cutoff with the lowest total bill.

In production, false alarms (legit response flagged as hallucinated) are costly: trigger expensive re-generation or wrong refusals. Optimize cost-weighted F-beta:

$${\tau }^{\ast }=\arg \underset{\tau }{\min }[c_{\mathrm{FN}}\cdot \mathrm{FN}(\tau )+c_{\mathrm{FP}}\cdot \mathrm{FP}(\tau )]$$

Often very different from accuracy-optimal threshold.

Saying it out loud. The threshold isn’t a modeling decision, it’s an economics one. A missed hallucination costs you whatever the wrong answer costs; a false alarm costs you a regeneration, or worse, a refusal on a perfectly good answer. So you attach a price to each and pick the cutoff that minimizes the total — that’s all the formula says. The result is often far from the accuracy-optimal point, and in consumer chat the surprising direction is that false positives are usually the more expensive error, because over-refusal drives people away permanently while a rare wrong fact does not.

12.4 Calibration of the detector

In plain language. Your detector outputs a number between 0 and 1. Calibration asks whether that number means anything — when it says 0.8, is it right 80% of the time? A reliability diagram plots claimed confidence against actual accuracy; ECE summarizes the gap in one number.

The detector outputs a confidence score. Is it calibrated?

• Reliability diagram of detector confidence vs realized error rate.
• ECE (expected calibration error).

A well-calibrated detector enables risk-based decisions: “if confidence < 0.8, refuse; else return.”

Saying it out loud. A detector that outputs 0.8 should be right 80% of the time, and if it isn’t, every threshold you set on top of it is arbitrary. You check this with a reliability diagram — bin by predicted confidence, plot against realized accuracy, and see how far off the diagonal you land — and you summarize it as expected calibration error. Why it matters operationally: calibration is what lets you do risk-based routing, like “below 0.8 we escalate to a human.” Without it you’re tuning a magic number by feel and it’ll drift the moment the traffic distribution changes.

13. Common interview gotchas

14. The 12 most-asked hallucination interview questions

(Summary; full grilling in the dedicated grill below.)

1. Define hallucination precisely. Content unsupported by relevant ground truth. Distinguish factual / faithfulness / source / logical / self-contradictory.
2. Why do LLMs hallucinate? 5 reasons: training objective, coverage gaps, RLHF, sampling, compounding errors.
3. Walk me through reference-based detection methods. String overlap, NLI, QA-based, citation verification, KG matching, code execution.
4. Walk me through reference-free methods. Self-consistency (SelfCheckGPT), token-level uncertainty, semantic entropy, LLM-as-judge, verifier models.
5. Walk me through internal-states-based detection. Truth probes, EigenScore, SAPLMA, attention patterns, activation steering.
6. What’s semantic entropy? Sample K → cluster by meaning → entropy over clusters.
7. What’s CoVe? Chain-of-Verification — generate, verify, correct, emit.
8. How would you measure faithfulness in a RAG system? RAGAS faithfulness: claim extraction → NLI vs context.
9. Why does RLHF sometimes increase hallucinations? Rewards confident outputs; humans prefer them; model learns to never say “I don’t know.”
10. Production design: detect hallucinations in real-time chat. Cascade: fast token-level → NLI vs context → semantic entropy / LLM-judge → human review.
11. How do you evaluate a hallucination detector? Precision, recall, AUPRC; calibration; cost-weighted thresholds; per-severity.
12. What’s the difference between faithfulness and factuality? Faithful = supported by source. Factual = true in the real world. Faithful response can be factually wrong if source is wrong.

15. Interview grill — 50 questions

Drill these. Aim for 35+/50 cold.

A. Definitions

1. Define hallucination. Content unsupported by, or contradicted by, the relevant ground truth.

2. Five hallucination types? Factual, faithfulness, logical, source/citation, self-contradictory.

3. Intrinsic vs extrinsic? Intrinsic = contradicts source. Extrinsic = unsupported by source. Extrinsic is harder to detect.

4. Faithfulness vs factuality? Faithfulness = supported by retrieved source. Factuality = true in the real world. A faithful response inherits errors from a wrong source.

5. Why is “true but unsupported” still a hallucination in RAG? RAG’s contract is “ground in retrieved context.” Adding unsupported information violates that contract even if true.

Saying it out loud. If they open with definitions, the win is being crisp in one breath and then adding the qualifier. Hallucination is content the relevant ground truth doesn’t support — and “relevant ground truth” changes per product, which is the whole subtlety. Intrinsic contradicts the source, extrinsic just isn’t in it; faithful means grounded in what you retrieved, factual means true in the world. The one that separates people is “true but unsupported”: in RAG that’s still a violation, because the contract was to answer from the context, not from memory.

B. Causes

6. Why does next-token prediction lead to hallucinations? It rewards plausibility, not truth. Confident-sounding wrong continuations beat “I don’t know.”

7. Why does RLHF often increase hallucinations? Reward model trained on human preferences; humans prefer confident answers; model learns to never say “I don’t know.”

8. How does long-context degrade factuality? Lost-in-the-middle. Attention concentrates on edges; mid-context information used unreliably; model “fills in” instead of attending.

9. Why are citations especially likely to be hallucinated? Pretraining sees citations as a textual pattern; model learned form (Author et al., year) but not truth-binding. When asked to cite, produces well-formed but invented references.

10. Why does sampling temperature affect hallucination rate? Higher temperature = wider exploration = more chances to sample low-probability (often wrong) tokens.

Saying it out loud. Causes come in five: the objective rewards plausibility over truth, the long tail was never memorized, RLHF rewards sounding confident, sampling is stochastic, and long chains compound errors. The RLHF one is the answer that earns points, so I’d lead with it — humans rate confident answers higher, the reward model learns that, and the model stops ever saying “I don’t know.” Citations get their own explanation: pretraining taught the model the shape of a reference, author-year-title, without binding it to anything real, so it generates well-formed fiction. And long context makes it worse, not better, because of lost-in-the-middle.

C. Reference-based detection

11. NLI-based detection — how? Each generated sentence as hypothesis; source as premise; check entailment.

12. Common NLI models? RoBERTa-MNLI, DeBERTa-v3, SummaC, FactCC.

13. QA-based detection? Generate questions from candidate; answer with source; check candidate’s answers match.

14. When does string overlap (BLEU/ROUGE) fail for hallucination detection? Paraphrasing. High overlap doesn’t guarantee correctness; low overlap doesn’t guarantee error.

15. Citation verification flow? For each (claim, citation) pair: retrieve cited passage; check NLI entailment; flag unsupported.

Saying it out loud. With ground truth in hand, my ladder is entailment first, then QA-based, then domain lookups. NLI means treating the source as premise and each generated sentence as hypothesis and asking whether it follows — RoBERTa-MNLI or DeBERTa off the shelf, SummaC or FactCC if you want summarization-specific. QA-based turns the claim into a question and answers it from the source, which is stronger on entities and numbers precisely where NLI is weak. I’d close by ruling out BLEU and ROUGE explicitly: they can’t tell a paraphrase from a contradiction, so they’re regression baselines, not detectors.

D. Reference-free detection

16. SelfCheckGPT idea? Generate K=5 responses with different temperature. Check consistency of each claim across samples. Inconsistent = hallucination.

17. SelfCheckGPT cost? ~5-6× single generation. K samples + K-1 NLI/judge calls.

18. Token-level uncertainty signals? Mean log-prob, min log-prob, entropy, perplexity.

19. Why is token-level uncertainty unreliable post-RLHF? RLHF makes the model more confident on hallucinated outputs; calibration breaks.

20. What’s semantic entropy (Farquhar et al. 2024)? Sample K responses; cluster by NLI-based bidirectional entailment; entropy over clusters.

21. Why does semantic entropy beat token entropy? Different tokens can mean the same; semantic clustering captures meaning equivalence.

22. Cite Farquhar et al. — what venue? Nature 2024.

23. What’s Chain-of-Verification (CoVe)? Draft → verification questions → answer independently → fix inconsistencies → final.

24. CoVe cost? ~5× single generation.

25. Verifier model approach? Train classifier on (prompt, response) → hallucination label. Vectara HHEM, Patronus AI, Galileo are examples.

Saying it out loud. No ground truth means you have to make the model give itself away. SelfCheckGPT samples five responses and checks whether each claim survives across them — about five to six times the cost, and blind to confident wrongness. Token log-probs are free but unreliable after RLHF. Semantic entropy is the one to name by paper: Farquhar et al., Nature 2024 — sample ten, cluster by bidirectional entailment, take entropy over clusters, so rewordings don’t count as disagreement. And Chain-of-Verification, roughly five calls, has the model answer verification questions without seeing its own draft. If I only get one sentence: semantic entropy is the strongest reference-free signal we have.

E. Internal-states-based

26. What’s a truth probe? Linear probe on internal activations trained to predict true vs false. Often achieves 80-90% accuracy at middle layers.

27. Why do truth probes work even when output is wrong? The model “internally knows” — uncertainty is encoded in activations even when softmax produces a confident wrong token.

28. EigenScore? Spread of representations across multiple sampled responses. High spread → uncertain → hallucinatory.

29. SAPLMA? Train a small MLP on activations to predict factuality.

30. Activation steering for mitigation? Add a “truthful” direction (difference between truthful and untruthful representations) to the residual stream during generation.

Saying it out loud. The headline claim is that the model often internally knows it’s wrong while its output says otherwise. A truth probe is just logistic regression on hidden states from a middle layer, trained on true and false statements, and it hits 80 to 90% on benchmarks for the price of one dot product. EigenScore measures how spread out the internal representations are across samples; SAPLMA swaps the linear probe for a small MLP. And you can run the same direction backwards as a mitigation — activation steering adds the truthful direction into the residual stream during generation. The constraint on all of it: white-box access plus labeled data, and probes transfer badly across domains.

F. RAG-specific

31. RAGAS faithfulness? Extract claims; for each, NLI/judge entailment vs retrieved context; fraction supported.

32. RAGAS context precision? Of retrieved chunks, what fraction are actually relevant to the question?

33. RAGAS context recall? Did the retrieval find all info needed for a gold answer?

34. Citation faithfulness vs citation existence? Existence: does the cited source exist? Faithfulness: does the source support the claim? Faithfulness is the harder problem.

35. Empirical citation faithfulness rate of frontier RAG? Around 70-85% for vanilla GPT-4/Claude. Production-grade systems target ≥95%.

Saying it out loud. For RAG the metric that matters is faithfulness, and RAGAS computes it by decomposing the answer into atomic claims and checking each against the retrieved context — the score is the fraction supported. Context precision and recall grade the retriever instead: was what you pulled relevant, and did you miss anything. On citations, separate existence from faithfulness — existence is a lookup, faithfulness is entailment, and only the second one is hard. The number to have ready: vanilla frontier RAG runs around 70 to 85% citation faithfulness, and a production bar is 95%.

G. Benchmarks

36. TruthfulQA? 817 questions designed to elicit common misconceptions.

37. SimpleQA? OpenAI 2024. 4326 short-answer factuality questions. Most LLMs score 30-60%.

38. HaluEval? 35K hallucinated-vs-correct examples for QA, dialogue, summarization.

39. FactScore? Per-fact factuality scoring for long-form generation.

40. RAGTruth? ~18K hallucinated vs faithful RAG outputs (Niu et al. 2024).

Saying it out loud. I’d name benchmarks with what they measure, not just the acronyms. TruthfulQA is 817 questions engineered to bait common misconceptions, so it measures whether the model parrots popular falsehoods. SimpleQA is OpenAI’s 2024 short-answer factuality set, about 4,300 questions, and frontier models land in the 30 to 60% range — a useful number for calibrating expectations in the room. HaluEval gives you 35K labeled hallucinated-versus-correct pairs for training a verifier, FactScore scores long-form generation fact by fact, and RAGTruth is the RAG-specific corpus at roughly 18K examples. The framing that scores: pick the benchmark whose contract matches your product, because a factuality score tells you nothing about a grounded system.

H. Production / system design

41. Hallucination-detection cascade? Fast cheap (token-level, classifier) → medium (NLI vs context) → expensive (semantic entropy, LLM-judge) → human review.

42. Faithfulness vs factuality monitoring in production? Faithfulness directly monitorable from logs; factuality requires human audits or external KB lookups.

43. Cost-weighted detector threshold? ${\tau }^{\ast }=\arg \min [c_{FN}\mathrm{FN}+c_{FP}\mathrm{FP}]$. False positives (legit response refused) often more costly than false negatives in chat UX.

44. Domain-specific layers (medical, legal, finance)? Plug in domain-specific verifiers — drug DB, citation DB, numerical consistency checks.

45. Detector feedback loop? User reports → labeled examples → retrain verifier. Improves with deployment.

Saying it out loud. The system-design answer is always a cascade: cheap signals on everything, entailment against context on the uncertain, semantic entropy or an LLM judge on what’s left, humans on the high-stakes residue. Then the operational points — you can monitor faithfulness continuously from your own logs, but factuality needs audits or an external knowledge base, so those are different cadences. Set the threshold by cost, not accuracy, and in chat products false positives usually cost more than false negatives because over-refusal loses users permanently. And close the loop: user reports become labels, labels retrain the verifier, mixed with randomly sampled traffic so you don’t only learn the obvious failures.

I. Mitigations

46. Most effective single mitigation? Retrieval grounding with citation requirement. Cuts hallucination rate ~50-80%.

47. Refusal training trade-off? Aggressive refusal hurts UX; calibrated refusal (refuse only below confidence threshold) is better.

48. Best-of-N for factuality? Generate K candidates; rank by hallucination detector; return top.

49. Tool use for hallucination prevention? Outsource computable claims (math, code, lookups) to tools. Tool either succeeds or fails — eliminates hallucination on tool-handled portion.

50. Why is conservative decoding (low temp) only a partial fix? Reduces variance but doesn’t fix the core problem: high-probability outputs can be confidently wrong.

Saying it out loud. Ranked by leverage: retrieval grounding with a citation requirement is far and away number one, roughly a 50 to 80% cut. Tool use is next for anything computable, because a calculator or a SQL query either works or errors — hallucination rate on that slice goes to about zero. Then best-of-N with a detector as the ranker, and calibrated refusal so the model declines only below a confidence threshold instead of reflexively. The one I’d caveat out loud is low temperature: it reduces variance but the confidently-wrong outputs are the highest-probability tokens, so conservative decoding delivers those faster rather than filtering them.

16. Quick-fire (single-line answers)

51. NLI model standard? RoBERTa-MNLI, DeBERTa-v3. 52. SelfCheckGPT K typical? 5. 53. Semantic entropy clustering? Bidirectional NLI entailment. 54. CoVe steps? Draft → verify-Qs → fresh-A → reconcile → final. 55. Token-level signal weakness? Calibration breaks post-RLHF. 56. Truth probe accuracy? 80-90% on labeled benchmarks. 57. RAGAS metric count? 4 (faithfulness, answer relevance, context P, context R). 58. Faithfulness vs factuality — easier to monitor? Faithfulness (just check vs context). 59. Most-cited hallucination benchmark? TruthfulQA. 60. Most effective mitigation? Retrieval grounding + citation.

17. The senior-level discussion

When the case is winding down, volunteer 1-2 of these unprompted:

• The RLHF-honesty paradox: alignment training increases confident wrongness; new techniques (constitutional AI, deliberative alignment, calibrated refusal) try to fix it.
• Semantic entropy as the modern reference-free baseline (cite Farquhar Nature 2024).
• Truth probes as an internal-states-based alternative — cheaper than reference-free, white-box.
• Faithfulness vs factuality distinction — most production systems can only measure faithfulness; factuality is a deeper data-quality problem.
• Citation faithfulness gap — even GPT-4 gets ~80%; this is the next frontier in RAG quality.
• Cascade architecture — never one detector; always a tier of cheap-to-expensive.
• Cost-weighted thresholds — false positives often more expensive than false negatives in chat UX.
• The fundamental limit — for confidently-memorized misinformation, no method works; data quality matters most.

Saying it out loud. At the end of a case, I’d volunteer one or two of these unprompted, because that’s what reads as senior. My go-to pair is the RLHF honesty paradox — alignment made models more confident without making them more correct, which is why post-RLHF log-probs are a weak signal — and the faithfulness-versus-factuality split, since most production systems can only ever measure the first and it’s worth being honest about that. If there’s room for a third, the fundamental limit: for confidently memorized misinformation, no detector in this document works, because every signal we have keys off uncertainty and there isn’t any. That’s a data-quality problem, and saying so out loud is what distinguishes someone who’s shipped this from someone who’s read about it.

18. Drill plan

• Master the taxonomy (§2): be able to name 5 hallucination types in 30 seconds.
• Master the 3 detection families (§4-7): be able to walk through each with one canonical method.
• Master semantic entropy: be able to describe the algorithm in 60 seconds.
• Master CoVe: same.
• Master RAG faithfulness measurement (§8): RAGAS pipeline.
• Drill the 50 grill questions; aim for 35+/50 cold.
• Practice the system-design answer (§11) in 5 minutes.

19. Further reading

Foundational papers:

• Maynez et al. (2020). On Faithfulness and Factuality in Abstractive Summarization — the intrinsic/extrinsic split.
• Lin et al. (2021). TruthfulQA: Measuring How Models Mimic Human Falsehoods.
• Manakul et al. (2023). SelfCheckGPT: Zero-Resource Black-Box Hallucination Detection.
• Farquhar, Kossen, et al. (2024). Detecting hallucinations in large language models using semantic entropy. Nature 630, 625-630. (The most cited modern paper.)
• Dhuliawala et al. (2023). Chain-of-Verification Reduces Hallucination in Large Language Models.

RAG-specific:

• Es et al. (2023). RAGAS: Automated Evaluation of Retrieval Augmented Generation.
• Rashkin et al. (2023). Measuring Attribution in Natural Language Generation Models (AIS framework).
• Niu et al. (2024). RAGTruth: A Hallucination Corpus for Developing Trustworthy Retrieval-Augmented Language Models.

Internal-states / probes:

• Burns et al. (2022). Discovering Latent Knowledge in Language Models Without Supervision (CCS).
• Azaria & Mitchell (2023). The Internal State of an LLM Knows When It’s Lying (SAPLMA).
• Chen et al. (2024). INSIDE: LLMs’ Internal States Retain the Power of Hallucination Detection.

Surveys:

• Ji et al. (2023). Survey of Hallucination in Natural Language Generation. — early but useful.
• Huang et al. (2023). A Survey on Hallucination in Large Language Models. — modern.

Production / industry:

• Vectara HHEM (Hughes Hallucination Evaluation Model) — public eval.
• FACTS Grounding (Google DeepMind, 2024) — leaderboard.
• Patronus AI, Galileo, Arize evaluation tooling — commercial.

If you internalize this document, hallucination detection stops being a buzzword and becomes a coherent algorithmic + engineering discipline.