LLM hallucination detection: first, find the lower bound

The Bottom Line First: There Is No Universal Probe, but There May Be a Stable Guardrail

A preregistered experiment on hallucination detection for large language models recently published its first-round results in the machine learning community. The study covered 10 models, 2 task types, and 20 model–task deployment combinations. Its goal was ambitious: without waiting for a model to generate an answer, determine whether the subsequent response might be fabricated by examining only the single forward pass in which the model selects its first token.

The experiment did not find a “hallucination detective” that dominated across every model and task. Instead, among the 18 combinations in which detection was effective, 12 different signals emerged as the best performer. Change the model or task, and the winner may change as well.

However, the researchers reported a finding that may be more relevant to engineering teams: although there is no universally best signal, there may be a universal floor that works across models. In other words, the same fixed combination of internal signals may not be the strongest in every case, but it may still provide a minimum level of risk discrimination when applied to new models that were not involved in calibration.

That is less sensational than “finding a universal hallucination detector,” but it is closer to the realities of production environments.

Detection Happens Before the Model Speaks

Existing hallucination detection methods generally fall into three categories:

1. Inspecting answer content: having another model review the response, or comparing it against search results, knowledge bases, and cited materials;
2. Repeated sampling: asking the model to answer multiple times and estimating uncertainty from consistency across the responses;
3. Reading the model’s internal state: searching hidden layers, attention, logits, or residual streams for signs that “the model is not actually confident.”

The first two approaches are relatively easy to implement, but they are not cheap. External verification requires additional retrieval or model calls, while repeated sampling directly increases inference costs and latency. More importantly, both approaches must wait until the model has generated at least part of its response before they can work.

This experiment chose the third approach and pushed the timing to the extreme: the judgment is completed as soon as the model selects its first token, before the user sees any output. The entire detection process relies on a single forward pass. The model’s parameters remain frozen, and the model under evaluation is not modified through fine-tuning.

If this approach can be reproduced reliably, its best use would not be post hoc “fact-checking,” but pre-screening within the inference pipeline: high-risk requests could be routed to retrieval-augmented generation, tool use, or a stronger model, while low-risk requests could proceed directly to generation. For high-concurrency systems, this kind of routing is more practical than subjecting every answer to an expensive model-based review.

29 Signals in Four Categories

The researchers fitted 29 internal signals across four categories:

| Signal family | Focus | Intuitive interpretation | | --- | --- | --- | | Attention shape | The shape and concentration of the attention distribution | Is the model consistently focusing on evidence, or “feeling around” everywhere? | | Residual motion | Changes in the residual stream across layers | Are the model’s internal representations fluctuating dramatically during reasoning? | | Readout geometry | The geometric relationship between hidden representations and the output readout space | Is the current internal state firmly aligned with a particular answer direction? | | Confidence | The model’s own probability and confidence information | How certain does the model appear to be about the next token? |

“Geometry” here does not simply mean reading the probability of the top token. Instead, it examines the relative relationships among hidden representations, output directions, and trajectories across layers. It can be compared to navigation: confidence only tells you which direction the vehicle is currently facing, while geometric signals attempt to determine whether the vehicle’s position, the direction of the road, and its turning trajectory are all consistent with one another.

The experiment also included an “honest selector” that could choose an internal signal for different models and tasks, but the selection rules and success thresholds were preregistered before the data was generated. The authors say this process was preregistered twice to reduce the opportunity to change metrics, cherry-pick thresholds, or redefine evaluation criteria after seeing the results.

Preregistration matters. Hallucination detection involves large numbers of layers, attention heads, and statistics. Without rules fixed in advance, it is easy to select a result that “looks exceptionally accurate” from hundreds or thousands of candidate combinations. It may simply have gotten lucky on the current sample.

However, preregistration does not automatically make the results trustworthy. Dataset size, label quality, task coverage, and effect size still determine how far the conclusions can be generalized.

Geometric Detection Cleared the Threshold; Confidence Added No Benefit

The preregistered success criterion for the first-round experiment was that the geometric-signal detector should work in at least 17 of the 20 model–task combinations. The final result was 18/20, exceeding the preset threshold.

The researchers then added the model’s own confidence to the geometric detector in hopes of expanding its effective coverage. The result remained 18/20:

• The number of successful combinations did not increase;
• The same two combinations still failed;
• Confidence did not rescue either failure case.

The experiment therefore rejected the stricter hypothesis that “adding confidence would increase coverage to at least 19 combinations.” The authors concluded that, in this experiment, model confidence and geometric signals carried highly overlapping information, and that adding confidence contributed no additional detection capability.

This result is noteworthy because many online systems still treat average token probability, generation probability, or entropy as a direct measure of factual reliability. The problem is that language models can be extremely confident in incorrect answers. They are predicting whether “this sequence of text resembles a plausible answer,” not directly determining whether “this claim is true.”

However, 18/20 should not be interpreted as “geometric signals achieved 90% accuracy.” This figure counts the number of deployment combinations that passed the preset criteria; it is not equivalent to sample-level accuracy, recall, or AUROC. Without reviewing the effect size, confidence intervals, class distribution, and threshold settings for each task in full, presenting 18/20 as production-ready accuracy would be misleading.

Twelve Winners Suggest That a “Universal Metric” Essentially Does Not Exist

More interestingly, 12 different signals were the top performer across the 18 effective combinations.

This means that different models do not represent hallucination risk internally in a uniform way. Even two models with similar architectures may project uncertainty onto different layers, attention shapes, or readout directions because of differences in training data, alignment methods, system prompts, and task formats.

This offers developers a clear warning:

Do not assume that a “magic layer” discovered in one model and one question-answering dataset will transfer across an entire model portfolio.

Real-world aggregation services often integrate GPT, Claude, Gemini, and multiple open-source models at the same time. If a detector must identify the optimal probe separately for every model and every task, maintenance costs will quickly balloon. Every model update may require recalibration because hidden-layer structures, tokenizers, or even alignment strategies may have changed.

That is why the most valuable part of this study is not the 12 winners, but the leave-one-model-out validation that followed.

What Exactly Is a “Universal Floor”?

The researchers used a test resembling leave-one-model-out validation: in each round, they calibrated on nine models and held the tenth model out entirely for testing. In the next round, a different model was excluded. Throughout the process, they used the same fixed combination of signals rather than selecting the best metric specifically for the test model.

This is the essence of the “universal floor”:

• It does not promise optimal performance on every model;
• It does not require access to labels from the target model for advance tuning;
• It requires only that stable, non-random detection capability be retained when applied to a model that was not involved in calibration.

A universal floor is more like a seat belt than autonomous driving. It cannot tell you where every accident will occur, but if it can consistently reduce risk across different vehicle models, it is worth adopting as default infrastructure.

It is important to emphasize that “universal” currently applies only to the models, tasks, and evaluation protocol covered by this experiment. It is not a universal theorem in the mathematical sense. Ten models are not enough to represent every architecture, and two task types cannot cover complex scenarios such as long-form writing, code generation, multi-turn agents, visual question answering, medical decision-making, and real-time retrieval.

A more accurate formulation of the conclusion would therefore be: the experiment found candidate evidence for a universal floor; it did not prove that hallucination detection is governed by an eternal, immutable underlying law.

How to Integrate It: More Like a Router Than a Judge

If the code and data can be reproduced in subsequent work, the most suitable place for this type of detector would be in a model gateway or inference server, rather than as a standalone system that outputs a “true/false” label.

A conceptual integration flow might look like this:

def guarded_generation(model, prompt, detector, threshold):
    # Run the forward pass corresponding to the first token
    # and retain the internal state
    state = model.forward(
        prompt,
        output_hidden_states=True,
        output_attentions=True
    )

    # Extract features from attention, residual trajectories,
    # readout geometry, and other internal signals
    features = extract_internal_signals(state)
    risk = detector.predict(features)

    if risk >= threshold:
        return route_to_grounded_pipeline(
            prompt,
            retrieval=True,
            require_citations=True,
            allow_abstention=True
        )

    return model.continue_generation(state)

This is only an architectural illustration, not reproduction code for the original experiment. A real-world deployment would need to address at least four issues.

1. Closed-Source APIs Do Not Expose Internal States

This approach requires hidden-layer, attention, or readout-space information. Standard closed-source model APIs typically expose only text output and, at most, limited log probabilities. They do not provide access to the full residual stream or internal geometry.

For now, the most practical targets are therefore self-hosted models, instrumentable inference engines, or model providers that may eventually be willing to expose safety telemetry interfaces. For purely black-box APIs, content verification, external retrieval, and repeated sampling remain irreplaceable.

2. One Forward Pass Does Not Mean Zero Cost

The first token must be computed anyway, so this approach does not require generating the answer a second time. However, storing hidden states and attention matrices from multiple layers increases GPU memory usage, data-transfer overhead, and feature-computation costs. For long contexts, full attention tensors are particularly expensive.

A production implementation would need to compress the 29 research signals into a small number of metrics that can be computed as streaming statistics, rather than retaining every intermediate tensor on the GPU for extended periods.

3. First-Token Signals May Not Capture Failures Later in Generation

A model may be headed in the right direction at the first token but gradually drift off course in a long response. It may also begin with a cautious preamble and only later start fabricating details. Code-generation and agent tasks are further affected by tool responses, appended context, and changing state across multiple turns.

A more reasonable implementation might combine “first-token pre-screening with rechecks at critical points,” such as recalculating low-cost risk metrics before citing facts, executing tools, or producing the final conclusion.

4. Hallucination Labels Themselves Are Noisy

Factual errors in open-domain question answering, unsupported elaboration in summarization, nonexistent APIs in code, and fictional content in creative writing cannot be handled with a single label. More fine-grained controlled experiments are needed to determine whether the detector is identifying factual errors, extrapolation beyond the task, or uncertainty caused by out-of-distribution inputs.

Worth Watching, but Do Not Rush to Declare Hallucinations “Solved”

One of the best aspects of this experiment is that it deliberately limits its own claims. It does not claim to have found a single neuron, layer, or confidence metric that works for every model. It also uses preregistered thresholds to clearly document a falsified hypothesis: adding model confidence did not increase coverage from 18 to 19 combinations.

That is far healthier than presenting only successful cases.

Its limitations are equally clear: the first-round results disclosed so far cover only 10 models and 2 task types; confidence did not fix the two failed combinations; the best signal depends heavily on the model and task; and approaches based on internal states are still difficult to apply directly to mainstream closed-source APIs. The authors are not a laboratory team and have openly invited the community to find counterexamples, suggesting that this is more like a research report awaiting independent reproduction than a peer-reviewed conclusion.

As of August 4, 2026, we would prefer to view it as a promising engineering direction: rather than expecting a single metric to replace retrieval, citations, and fact-checking, use internal representations to perform low-cost risk routing before the model begins to speak.

The absence of a universal hallucination detector does not mean internal signals are useless. What truly matters may not be catching every error, but maintaining a verifiable minimum standard even as models and tasks continue to change.

References

• Reddit: No universal hallucination detector, but a universal floor: The researchers’ public overview of the preregistered experiment, covering 10 models, 20 deployment combinations, 29 internal signals, and the first-round results, along with an invitation for the community to reproduce the study and search for counterexamples.