An AI Citation Checker's Recall Hit 99% Once It Could Search the Web. Its False-Alarm Rate Tripled to 43%.

53. That's how many NeurIPS 2025 papers GPTZero found still carrying hallucinated citations — after peer review missed them. The fix the field is racing to ship is an AI citation verifier, and a new benchmark just tested one: give it live web search, and detection jumps from 78.1% to 99.0% on the exact same underlying model. Its false-positive rate triples in the same upgrade, from 12.7% to 43.1% — and the benchmark's own authors conclude that false-positive rate, not detection rate, is what decides whether a citation verifier is safe to actually deploy.

53 papers, one NeurIPS cycle, and no shared way to measure the fix

Drafting literature reviews and citation lists is now a routine thing to hand an LLM — and GPTZero's audit of NeurIPS 2025's accepted papers found 53 with fabricated or mismatched citations that made it past peer review anyway. HALLMARK(arXiv 2607.18360), from Patrik Reizinger and Wieland Brendel, submitted July 20, opens with that number as the reason a wave of citation verifiers — rule-based checkers, zero-shot LLM judges, tool-augmented agents — has started shipping. Its complaint about that wave: no shared benchmark existed to compare them, and none gave a detailed diagnosis of how or why a given verifier fails.

What HALLMARK actually tests

The benchmark is 2,526 real BibTeX entries spanning 14 distinct hallucination types — invented papers, mismatched titles and venues, wrong years, fabricated author lists, and more — across three difficulty tiers, with six diagnostic sub-tests per entry and a contamination-resistant held-out split so a verifier can't simply have memorized the answer key. Against it, the paper evaluates four classes of verifier: a DOI-lookup baseline (does the identifier resolve to anything at all), frontier LLMs judging zero-shot with no tool access, tool-augmented agents given live web search and access to CrossRef, OpenAlex, and arXiv, and the authors' own co-designed rule-based verifier, bibtex-updater, included as a calibration reference rather than a product pitch.

The upgrade that looks like progress

Read as a ladder from least to most capable, the numbers look like a clean success story at first: detection rate climbs steadily from a DOI-lookup baseline's 26.8%, through zero-shot frontier models in the 47.6%–91.1% range, up to 96.7%–99.0% once an agent gets live web search and reference-database lookup. Read the false-positive column next to it, and the ladder stops looking like progress. DeepSeek-V3.2's zero-shot 91.1% detection rate comes with a 70.2% false-positive rate — it flags seven in ten genuine citations as suspect while catching real hallucinations. GPT-5.1's agentic configuration reaches 96.7% detection at a 47.8% false-positive rate. Neither number describes a tool a working scientist could actually use without spending more time second-guessing the checker than checking the citations themselves.

Same model, twice: what web search costs Claude Sonnet 4.6

The cleanest version of the story holds the base model constant and only changes tool access. Claude Sonnet 4.6 zero-shot detects 78.1% of hallucinated citations at a 12.7% false-positive rate — a genuinely usable balance, flagging roughly one real citation in eight for a human to double-check. Give the identical model access to bibtex-updater as a tool, and detection rises to 99.0% — a 20.9-point recall gain — but the false-positive rate rises to 43.1%, a 3.4x jump. That comparison isn't across different labs' models with different training data and different alignment choices; it's the same weights, the same base capability, with one variable changed. The tool access is the entire explanation for the false-positive spike.

# the shape of HALLMARK's own conclusion — not the paper's literal implementation
def is_deployable(verifier, false_positive_budget=0.15):
    return verifier.false_positive_rate <= false_positive_budget  # not verifier.detection_rate

# Claude Sonnet 4.6, same weights, one variable changed:
# zero-shot        -> DR 0.781, FPR 0.127   deployable under a 15% false-positive budget
# + bibtex-updater -> DR 0.990, FPR 0.431   not deployable under any realistic budget

Why this matters more for an agent than for a person

The stakes are sharper for a research agent than for a single human author. A scientist drafting one paper checks their own bibliography once, at the end, with their own judgment in the loop. An autonomous research agent that runs literature review as a subroutine — unattended, inside a longer discovery pipeline, dozens of times a day — has no equivalent moment unless the verifier itself supplies it. That is the same gap this blog covered from the safety and provenance side yesterday: less human oversight puts more weight on whatever automated check is standing in for it. HALLMARK measures the identical gap from the citation side, and its answer is uncomfortable — the obvious upgrade, giving the checker the same web access a researcher would use, is the one upgrade that breaks the checker's own reliability.

The other quirk: verifiers don't know what they don't know

HALLMARK also splits results by publication date, and a second failure mode shows up that has nothing to do with fabrication detection at all. On 2024–2025 papers — recent enough to sit near or past several models' training cutoffs — 8 of 12 tested LLMs degrade sharply, with false-positive rates between 59% and 89%, essentially flagging most genuine recent citations as hallucinated simply because the model has no memory of the paper existing. Two more degrade moderately. Only the two latest-cutoff models hold their false-positive rate steady on this split — Claude Sonnet 4.6 at 12% and Claude Opus 4.7 at 7%. "Unfamiliar" and "fabricated" are not the same judgment, and most of the verifiers tested can't tell them apart.

Why false-positive rate, not recall, is the metric that matters

A spam filter that catches 99% of spam but also buries half of your real mail is worse than one that catches 85% of spam and almost none of your real mail — not because the math says so, but because you stop trusting the first filter and start ignoring its folder altogether, which puts you back to reading everything unfiltered. A citation verifier with a false-positive rate above 40% has the same problem in a research pipeline: it flags roughly two of every five real citations as suspect, which means a scientist either burns real time re-checking nearly half their bibliography by hand, or — the more likely outcome under any real deadline — starts waving the flags through unread, silently reintroducing the exact fabricated-citation risk the tool was bought to close. HALLMARK's own framing makes this explicit: recall is the number vendors put in a release note, but false-positive rate is the number that determines whether anyone keeps the tool turned on six months later.

What this means for reproducible, local-first science

HALLMARK doesn't test MegaBrain BioScience, and none of its numbers transfer directly to any specific product — the paper is about citation verifiers as a category, not about us. But the generalizable lesson lands squarely on the same ground this blog keeps returning to: a verification layer is only as useful as its own calibration, and calibration means reporting false-positive rate as a first-class number next to recall, not a footnote under a headline detection score. An Independent Reviewer that flags results the way HALLMARK's agentic configurations flag citations — catching almost everything at the cost of a researcher no longer trusting almost half of what it flags — isn't a stronger check. It's a check nobody keeps turned on.