When Auditors Fabricate: Batch-Size Degradation and Confident Hallucination in LLM Detection of Planted Document Contamination

• URL: http://arxiv.org/abs/2609.09696v2
• Date: Fri, 11 Sep 2026 08:35:23 GMT
• Title: When Auditors Fabricate: Batch-Size Degradation and Confident Hallucination in LLM Detection of Planted Document Contamination
• Abstract summary: We construct a contaminated corpus of 150 academic papers spanning supply chain management and medical research.<n>We inject 450 known contaminants of three types: typographical corruption, semantic reversal, and absurd out-of-context insertion.<n>We evaluate Google Gemini 3.0 Pro's ability to recover a 180-contaminant answer-key subset across 60 documents.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Large language models are increasingly proposed as automated auditors of document quality, yet their reliability as detectors of planted errors is poorly characterised. We construct a contaminated corpus of 150 academic papers spanning supply chain management and medical research, injecting 450 known contaminants of three types: typographical corruption, semantic reversal, and absurd out-of-context insertion. We then evaluate Google Gemini 3.0 Pro's ability to recover a 180-contaminant answer-key subset across 60 documents under three prompting regimes of increasing scale: single document, small batch, and large batch. Detection is unreliable even at small scale and collapses entirely at large scale: 50% recovery on single documents and 60% on small batches, a difference this sample cannot resolve, against 2.8% on large batches. The failure mode at scale is not abstention but fabrication. Rather than reporting incomplete processing, the model produced confident findings including invented contaminants of its own, absurdities such as "telepathic squirrel" and "quantum-powered toaster" that mimic the style of the planted material but do not appear in any document. Detection also varies by contamination type: absurd insertions were recovered at 75% in completed evaluations, while semantic reversals and typographical corruptions were each recovered at only 50%. The corruptions most likely to occur in the wild, plausible ones, are the ones most often missed. We conclude that LLM document auditing degrades not gracefully but deceptively, and outline the harness such systems require: bounded batch sizes, direct content injection, and mechanical verification of every reported finding against source text.

Related papers

• Four Ledgers, Not One Score: Responsible Communication of LLM-Judge Calibration in Biomedical ML [0.39287497907611874]
  We formalize four distinct ledgers: planted perturbations, independent detector outputs, source-linked human dispositions, and human-added discoveries.<n>This single-workflow forensic case is an existence proof of a failure mode, not an estimate of its prevalence.
  arXiv  Detail & Related papers  (2026-09-14T04:27:58Z)
• Watermarks Without Verification: AI Text Watermarking After the EU AI Act [49.51124343181601]
  Article 50 of the EU AI Act requires generative AI providers to mark the content their systems produce and ensure it can be detected as AI-generated.<n>Anthropic disclosed that every Claude model released after that date embeds a watermark based on SynthID-Text in all generated text, enabled by default with no user opt-out.<n>We argue that neither the objections nor the assurances can currently be verified and that this unverifiability, rather than watermarking itself, is the substantive governance failure.
  arXiv  Detail & Related papers  (2026-09-09T01:56:17Z)
• In RAG We Trust? Measuring Robustness of Retrieval-Augmented Generation Under Document Poisoning [0.0]
  We study how much a small quantized model, Llama 3.1 8B, degrades when a fraction of its retrieved context is poisoned.<n> Accuracy falls from 77.9% on clean context to 43.5% when all three passages are corrupted.
  arXiv  Detail & Related papers  (2026-09-08T08:31:57Z)
• VeriPhy: Agentic Physical Reasoning for World Model Evaluation and Refinement [57.86962208273888]
  We present an auditable physical-verification system in which a text-only planner compiles the prompt into typed physical obligations.<n>Each action returns a provenance-carrying evidence record whose payload, when usable, is either a typed measurement or an explicitly tagged learned state.<n>We anchor evaluation in a 1,500-clip corpus of human-annotated flaw records that localize real generation failures in prompt reference, space, and time.
  arXiv  Detail & Related papers  (2026-09-02T20:36:45Z)
• Who is the Agent to Blame? Localizing Faithfulness and Citation Mistakes in Agentic Deep Research [75.8770212601511]
  Deep research (DR) systems produce long-form cited reports by orchestrating multiple agents that search and synthesize information from the web.<n> Citations are the primary mechanism for evaluating the faithfulness of these reports, yet current DR systems exhibit poor citation recall.<n>We propose an evaluation method that pinpoints which agent introduced each error by locally testing agent invocations for faithfulness and verifiability relative to their own inputs.
  arXiv  Detail & Related papers  (2026-08-25T09:34:18Z)
• Plato-Bio: verification-first biological novelty screening with temporal rediscovery and structural benchmarks [0.0]
  We developed Plato-Bio, a biology-routed extension of the open Plato/Denario architecture.<n>Plato-Bio couples explicit workflow states with provenance records, citation checks, claim-to-evidence links, scoped file writes, and publication gates.<n>On the current clean revision, the full Python suite completed with 931 passes, six skips, and no failures or errors.
  arXiv  Detail & Related papers  (2026-07-27T03:55:39Z)
• Fantastic Adaptive Taxonomies and How to Use Them [100.20614173157708]
  AdaMAST converts execution traces into a compact, evidence-grounded failure taxonomy.<n>No code is hand-authored, no trace human-annotated.<n>In agent-system search, taxonomy-coded diagnoses of failed candidates outperform free-form.
  arXiv  Detail & Related papers  (2026-07-17T17:41:16Z)
• MedHal-Loc: Are "Explainable-by-Architecture" Medical Hallucination Detectors Faithful Localizers? A Localization Benchmark [3.738942365298833]
  We introduce MedHal-Loc, a benchmark and metric for localization faithfulness.<n>We find that NLI-per-clause, consistency-per-sentence, and the dedicated span detector FAVA all localize well above chance.
  arXiv  Detail & Related papers  (2026-06-19T15:11:37Z)
• Deterministic Integrity Gates for LLM-Assisted Clinical Manuscript Preparation: An Auditable Biomedical Informatics Architecture [0.3823356975862005]
  We describe an architecture pairing generation with verification, resting on three principles.<n>This determinism-where-possible split, organized as an integrity-gate taxonomy, is the core contribution.<n> MedSci Skills is an open-source toolkit of 43 skills with a 21-detector deterministic tier, evaluated on three public-dataset pipelines.
  arXiv  Detail & Related papers  (2026-06-08T13:51:04Z)
• FIKA-Bench: From Fine-grained Recognition to Fine-Grained Knowledge Acquisition [54.31138496553705]
  Fine-grained recognition in everyday life is often not a closed-book classification problem.<n>Existing benchmarks primarily evaluate visually recognition, leaving this active external knowledge acquisition ability underexplored.<n>We study fine-grained knowledge acquisition, where a system must seek, verify, and use external evidence to answer open-ended fine-grained recognition questions.
  arXiv  Detail & Related papers  (2026-05-13T08:49:51Z)
• The Semantic Illusion: Certified Limits of Embedding-Based Hallucination Detection in RAG Systems [0.0]
  We apply hallucination prediction to RAG detection, transforming scores into decision sets with finite-sample coverage guarantees.<n>We analyze this failure through the lens of distributional tails, showing that while NLI models achieve acceptable AUC (0.81), the "hardest" hallucinations are semantically indistinguishable from faithful responses.
  arXiv  Detail & Related papers  (2025-12-17T04:22:28Z)
• Collapse of Dense Retrievers: Short, Early, and Literal Biases Outranking Factual Evidence [56.09494651178128]
  Retrieval models are commonly used in Information Retrieval (IR) applications, such as Retrieval-Augmented Generation (RAG)<n>We quantify the impact of biases, such as a preference for shorter documents, on retrievers like Dragon+ and Contriever.<n>We uncover major vulnerabilities, showing retrievers favor shorter documents, early positions, repeated entities, and literal matches, all while ignoring the answer's presence!
  arXiv  Detail & Related papers  (2025-03-06T23:23:13Z)
• Fast(er) Reconstruction of Shredded Text Documents via Self-Supervised Deep Asymmetric Metric Learning [62.34197797857823]
  A central problem in automatic reconstruction of shredded documents is the pairwise compatibility evaluation of the shreds. This work proposes a scalable deep learning approach for measuring pairwise compatibility in which the number of inferences scales linearly. Our method has accuracy comparable to the state-of-the-art with a speed-up of about 22 times for a test instance with 505 shreds.
  arXiv  Detail & Related papers  (2020-03-23T03:22:06Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.