AI hallucinated citations: how we trace every report sentence to a quote

Why AI hallucinated citations keep reaching clients

The night before an investment committee, an analyst pastes a deep research summary into the memo: a growth rate and three tidy citations. By morning a partner has clicked all three and found AI hallucinated citations.

The first page never mentions the growth rate. The second link is dead. The third is a press release, and the summary’s “four sources agree” is that release reprinted on four sites. Nobody can show where any sentence came from, because nothing checked the model’s references.

When this reaches a client, the firm pays. In 2025 Deloitte Australia agreed to partly refund the A$440,000 fee for a government report with apparent AI-generated errors, including a fabricated court quote and references to papers that do not exist.

These failures come in three shapes:

• Invented references: the source does not exist.
• Real source, wrong claim: the page exists, but a number, unit or sign changed in summarizing.
• Echoes counted as agreement: one syndicated article looks like many confirmations.

Why prompts, link checkers and self-review are not enough

The common fixes check the wrong thing. Telling a model “do not make up sources” can lower the rate but guarantees nothing: the citation is still text the model writes.

Link checkers only confirm that a URL resolves. Self-review helps, but a model that misread a figure once will often approve the same misreading. Counting links rewards syndication: one story reprinted ten times looks like ten confirmations.

A citation the model typed is a claim, not evidence.

We built a deep research product for analysts who must audit what they send. It is an early release, so read what follows as design and tested behavior, not field results.

The quote rule: no verbatim quote, no claim

A quote is the receipt for a claim. The extraction model must return each claim with a verbatim excerpt, and code checks that it appears in the fetched text. Passing claims go into an evidence ledger, one list of every claim with its quotes and locations down to the PDF page. The rest are discarded.

For technical readers: the quote must be 16 to 2,000 characters and an exact substring of the page once whitespace is normalized. Long pages are read in 12,000-character sections with a 250-character overlap, so short quotes near a boundary survive.

Bounded, polite collection

Before any search runs, the analyst edits and approves a plan of up to eight perspectives. Public sources rate-limit and fail, so every later step is capped:

• At most four searches and four page reads run at once, with a per-host gap (900 ms by default, 7 seconds for court-record and code APIs).
• Only transient failures retry, three attempts at most within 75 seconds; a requested wait over 30 seconds stops the read.
• A circuit breaker works like a fuse: three failures in a row pause a search source for the run, and the report says so.
• The loop stops after two rounds with no new claims or independent voices.

How to verify sources in an AI-generated report: map, check, verify

The writer model does not write citations. It returns statements, each listing the claim IDs it relies on. It still chooses those IDs: code guarantees they exist and carry verified quotes, and the verifier judges whether the quotes support the sentence.

A finding in the finished report looks like this (format simplified, wording illustrative):

• Statement: “The regulator opened a formal review in March 2025.” [2, 5]
• Evidence: claim 7; 2 independent voices; primary source found; 0 contradictions; confidence 71% (heuristic).
• Quotes: Source 2, page 3: “…opened a formal review on 3 March 2025…” Source 5: “…the review, announced in March 2025…”

That is what the partner in the opening needed: one click from sentence to quote.

The numeric preflight is the gate we would insist on in any AI due diligence report. Every figure in a statement must appear, normalized, in its mapped quotes. It runs before the verifier, so an invented figure fails even if both model passes approve it.

In the engine’s own tests, the quote gives revenue as “$1,250.00 million”, a change of “−12.5%”, a dose of “5 mg” and cash of “($7.00)”. Five draft sentences:

• “Revenue was $1250 million” passes. Commas and trailing zeros are formatting.
• “Revenue was $12500 million” fails. That figure is invented.
• “Change was 12.5%” fails. The minus sign was dropped.
• “The dose was 5 g” fails. The unit changed.
• “Cash was $7” fails. Accounting parentheses mean negative, so the sign flipped.

Figures calculated from quoted numbers, such as a growth rate, fail too. That costs some sentences, but a figure found in no source is exactly what a client checks. The opening memo’s growth rate would have failed here.

The report header counts the proposed statements the checks rejected and the claims that lacked a usable quote, so readers see what was thrown away.

Repetition is not corroboration: count independent voices

Twenty reprints are one source, so we collapse copies with SimHash: a fingerprint of a page’s wording that changes only a little when the text changes a little. Pages whose 64-bit fingerprints, built from four-word sequences, differ in 10 bits or fewer form one group. Unrelated pages differ in about 32.

Each group is one voice. In the engine’s unit tests, a syndicated copy with an added “Syndicated from” line still lands in the original’s voice. Code enforces minimum conditions on the review model’s verdicts:

• Supported needs at least two independent voices and no recorded contradiction.
• Refuted must cite a claim already recorded as contradicting it. A bare verdict is ignored.
• Everything else stays unresolved or unreviewed. The writer is told not to present it as settled, and the verifier is told to reject statements that do.

That is our answer to how many independent sources are needed to corroborate a claim: at least two voices that did not copy each other. Two is the minimum; high-stakes findings still need a primary record.

For technical readers: the raw score is 1 − ∏(1 − 0.55 × quality) across voices, with URL priors of 1.0 for government, court and DOI sources and 0.65 for unclassified pages, then adjusted for verdicts and contradictions.

What the gates buy, and what we would harden next

The main gain is auditability. Every sentence opens to its claims, every claim to its quotes, and every quote to a location in a page, PDF or archive capture. A disputed finding becomes a quick lookup.

Expect shorter, more cautious reports, because anything the gates cannot tie to a quote is dropped. Real limits remain:

• A real quote does not prove the sentence. It can still be misread, and the verifier catches only some of that.
• The numeric gate is narrow. Numbers in words, locale formats and unusual units are not fully covered.
• Same-model review is weak. By default the verifier is the writer’s model in a second pass. Another model is configurable, but judges have their own error rates, as we found in AI translation review.
• SimHash and URL priors are crude. Two outlets paraphrasing one press release can still look independent, and a government domain can host a weak document.

Next we would harden checks that a quote truly supports its sentence, and detection of rewritten press releases. Independent human grading and live cloud-model runs are still open.

A checklist for any AI research agent or due diligence report

Whether you buy a tool or build your own AI research agent, test it against this list.

If your AI research reaches client deliverables, we can build or audit that pipeline with you. Book a free 30-minute discovery call with a report you are unsure about, and we will trace a few of its sentences together. See also our applied AI work.