REVIEW 4 major objections 4 minor 2 cited by
Cross-Layer Attention Probing for Fine-Grained Hallucination Detection
T0 review · 4 major / 4 minor · reviewed 2026-08-05 · deepseek-v4-flash
Pith's one-line read Cross-layer attention over the LLM residual stream detects hallucinations better than single-layer probes and uncertainty scores, and its fine-grained signal lets a model retry or abstain instead of emitting a wrong answer.
desk verdict CLAP's cross-layer attention is a real step forward for activation probing, but the paper's central 'fine-grained detection' claim is not actually measured by the pooled AUC it reports. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
Cross-Layer Attention Probing (CLAP). Because the residual stream keeps every layer's output in the same embedding space, CLAP treats the activation vectors at each layer at the EOS token as tokens in a sequence ordered along the stream. A learnable projection downsizes each vector, a CLS (summary) token is prepended, and one or two transformer-encoder layers apply self-attention across layer positions; the CLS embedding feeds a linear head trained with binary cross-entropy. The attention weights let the probe weight layers differently per input, turning 'which layer carries the hallucination signal' into a learned, prompt-dependent question instead of a fixed single-layer choice.
What would settle it
Run the identical CLAP architecture on activations from the EOS token only versus activations from every generated token of the same responses, with the same labels and splits, and compare AUC on high-temperature sampled responses: if the all-token input wins, the EOS-only assumption from Section 3 is the binding limit, not cross-layer attention. A complementary check: repeat the published protocol on a 13B-or-larger model, since the reported evidence covers only 2B–8B models and the claim that CLAP is model-agnostic stands or falls there.
Extended reading notes
Core claim
Central claim: a hallucination's signature lives across LLM layers, not in one layer, and learned attention extracts it. CLAP takes each layer's activation at the end-of-response (EOS) token, orders them along the residual stream, down-projects, prepends a CLS (summary) token, and runs a transformer encoder whose CLS embedding feeds a classifier. Attention varies per input, so CLAP learns which layers matter for which prompt. Reported: higher AUC than single-layer probes and predictive entropy; per-sample fine-grained detection among sampled responses; better out-of-distribution transfer. With alternate decoding, CLAP replaces only flagged responses and abstains when both are flagged—raising
Load-bearing premise
The detector reads activations only at the last token (EOS) of the response and must judge the whole response from that one position; if hallucination signals are spread across generated tokens, the probe's input is incomplete no matter how well the attention module works.
Editorial extensions
If this is right
- Detect-then-mitigate beats always-on mitigation: on average, routing only flagged greedy responses through an alternate decoding and abstaining when the alternate is also flagged raises the non-hallucination rate from 42.1% (default) or 49.1% (always alternate) to 65.7%, while cutting abstentions from 51.5% to 27.0%.
- Sampled-space supervision pays off: labelling each high-temperature sample per prompt and batching samples prompt-wise lifts sampled-response AUC sharply (Llama-7B: 74.3 with greedy-only training to 89.9 with sampled training), so the probe can tell which of several answers to one prompt is hallucinated.
- Out-of-distribution guard: across twenty train-test domain pairs, CLAP beats last-layer and majority-vote probe selection for every model tested and beats semantic entropy probes by 15–45% AUC, so a detector trained in one domain can guard another.
- Cheap to run: projecting activations to 128 dimensions keeps detection performance, and the probe adds only a small trainable network, which the authors read as evidence that the method can scale to larger LLMs.
Reading between the lines
- Reader inference: CLAP reads only the EOS position. If hallucination signatures appear mid-generation, an all-token variant of the same cross-layer attention would likely detect them—a direct, testable extension the paper leaves open.
- Reader inference: the probe's learned attention weights can double as an interpretability map—ranking layers by attention for hallucinated versus correct answers may reveal where factual knowledge lives per task, connecting to knowledge-localization work.
- Reader inference: sampled-space labels are nearly free once reference answers exist (each sample is compared to ground truth), so the fine-grained training recipe transfers cheaply to any LLM with QA references; the harder case is domains without references, where an unsupervised variant would be required.
- Reader inference: the out-of-distribution results suggest the cross-layer pattern encodes something more general than dataset artifacts, raising a testable question the authors did not run: does a probe trained on one LLM transfer to a different LLM of another size?
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper proposes Cross-Layer Attention Probing (CLAP), a supervised activation-probing method for hallucination detection. CLAP takes the LLM activations at the EOS token across all layers, projects them to a low dimension, and applies a small transformer encoder with a CLS token and a linear classifier. It is evaluated on five LLMs and three tasks (NQ, TQA, StrategyQA). Two training variants are considered: CLAP-g (greedy responses only) and CLAP-s (greedy plus high-temperature sampled responses). The authors claim improved detection over uncertainty and single-layer probing baselines, fine-grained detection among sampled responses to the same prompt, a detect-then-mitigate pipeline that reduces hallucination rates, and improved out-of-distribution generalization.
Significance. If the claims hold, CLAP is a practical and inexpensive open-box detector: it uses all layers with only ~15K parameters (for a 2B LLM) and is evaluated across multiple model families and tasks. The paper includes useful ablations (projection dimension, encoder depth, batching strategy, comparisons to attention pooling), a refusal-rate analysis, and an out-of-distribution transfer study. These are strengths. However, the central 'fine-grained detection' claim is currently supported only by pooled AUC, which does not actually measure discrimination among responses to the same prompt; this is a load-bearing gap. The abstract also overstates the uniformity of the improvements.
major comments (4)
- [§3.2, Tables 9 and 10] The fine-grained detection claim is defined as the ability to disambiguate hallucinated and non-hallucinated responses among different samples for the same prompt. However, Table 9 reports a single pooled AUC computed over all sampled test responses, without conditioning on the prompt identity. Because prompts differ strongly in how often they elicit hallucinations (Table 6: e.g., Llama-7B sampled hallucination rates are 76.9% for TQA vs 93.6% for NQ), a detector can achieve high pooled AUC by ranking responses according to prompt-level difficulty instead of response-level hallucination. The large sensitivity to train-time batching in Table 10 reinforces this concern: for Llama-7B TQA sampled responses, LP goes from 74.0 (random batching) to 90.0 AUC (prompt-wise batching), and CLAP from 81.3 to 91.2. Please report per-prompt AUC averaged over prompts, or same-prompt pairwise accuracy, a
- [Abstract and Table 1] The abstract states that CLAP improves hallucination detection compared to baselines 'on both greedy decoded responses as well as responses sampled at higher temperatures.' This is stronger than the results support. On greedy test responses, CLAP-g is lower than AH-g for Gemma-2B (72.7 vs 73.5) and lower than PE for Llama3.1-Instruct-8B (68.1 vs 69.7). On sampled test responses, CLAP-g is much lower than NLP-g for Llama-7B (74.3 vs 77.5). The uniform-improvement claim should be qualified to CLAP-s on sampled responses and 'best or second-best' with per-model exceptions on greedy responses.
- [§5, Table 3] The out-of-distribution claim that CLAP 'maintains high reliability' is overstated. In Table 3, CLAP is worse than the best baseline in several cases: Vicuna-7B has -1.8% gain over MC, and Llama3.1-Instruct-8B has -1.6% over MA and -2.2% over MC. The average gains over last-layer and MA are modest (0.9-6.3 and -1.6-3.6, respectively), and the OOD evaluation is only for greedy responses. Please qualify the conclusion or provide per-pair results and significance tests.
- [§3, Notations] The method probes activations only at the EOS token of the response. The paper's fine-grained detection claim is about judging an entire sampled response, yet the input representation consists solely of the last-token residual stream. If hallucination signatures are distributed across generated tokens, the EOS-only input is incomplete regardless of how well the attention module works. Please add an ablation that pools or concatenates token-level activations (e.g., mean-pooling over the last k tokens) or otherwise justify why the EOS token is sufficient for the sampled-response setting.
minor comments (4)
- [§3.3, Table 2] The mitigation result should be framed as an abstention/coverage trade-off. CLAP-II's average %NH among non-abstained responses is 65.7%, slightly below Def+Abs's 67.6%, while abstention drops from 51.5% to 27.0%. The phrase 'consistently maintaining high non-hallucination rate' is acceptable only if this trade-off is made explicit.
- [§4.2] Typo: 'Lamma3.1-Instruct-8B' should be 'Llama3.1-Instruct-8B'.
- [Appendix A.2] The exclusion of Llama3.1-Instruct-8B on NQ (hallucination rate >95%) is only reported in the appendix. It should be stated in the main text next to Table 1 so the reader knows why that entry is missing.
- [Appendix B.2] The batching ablation (Table 10) shows very large AUC swings on sampled test responses (e.g., Llama-7B TQA: 81.3 random vs 91.2 prompt-wise for CLAP). This is important for interpreting the main results and should be referenced in Section 3.2, not only in the appendix.
Circularity Check
No significant circularity; CLAP is an empirical supervised method evaluated against independent gold labels.
full rationale
The paper makes no derivation that reduces to its inputs. CLAP is a supervised classifier trained on LLM activations with hallucination/non-hallucination labels obtained from external gold answers (rouge-1 cut-off or exact YES/NO matching), and its detection performance is measured on held-out test responses using AUC against those same external labels. Hyperparameters (encoder layers, projection dimension, learning rate) are selected on held-out validation sets. The mitigation pipeline uses CLAP's own classifications only to decide whether to abstain or generate an alternate response, but the reported outcome metric (% non-hallucinated among non-abstained responses) is computed with independent gold labels, so there is no fitted-input-renamed-as-prediction. The paper cites prior work for the EOS-token probing choice and for the residual-stream motivation, but these are external citations, not self-citations, and they do not carry the central claim. The concern that pooled AUC may not fully support the fine-grained claim is a question of evaluation validity, not circularity. No self-citation chain, uniqueness argument, or definitional equation forces the reported results. Accordingly, the circularity score is 0.
Assumptions & free parameters
free parameters (7)
- Projection dimension d_model =
128
- Number of encoder layers n_enc =
1 or 2, selected on validation
- Learning rate =
Selected from [0.5, 0.05, 0.005, 0.0005, 0.00005] per dataset and method
- Classification threshold for mitigation =
Macro-F1-optimal on in-distribution validation
- ROUGE-1 label cutoff =
0.3
- Sampling temperature and top_p =
1.0 and 0.95
- Number of sampled responses K =
10 for TQA/NQ, 8 for STR
assumptions (4)
- domain assumption Hallucination labels derived from ROUGE-1 threshold against gold answers are valid.
- domain assumption EOS-token activations are sufficient to classify the whole response.
- domain assumption Layer outputs are comparable across the residual stream and can be treated as a token sequence.
- domain assumption High-temperature sampled responses provide transferable fine-grained supervision.
Cite this review
Pith. "Pith review of Cross-Layer Attention Probing for Fine-Grained Hallucination Detection." pith.science (2026). https://pith.science/paper/4OWUK3TE
@misc{pith2026250909700,
author = {Pith},
title = {Pith review of: Cross-Layer Attention Probing for Fine-Grained Hallucination Detection},
year = {2026},
howpublished = {\url{https://pith.science/paper/4OWUK3TE}},
note = {Machine review of arXiv:2509.09700}
}
read the original abstract
With the large-scale adoption of Large Language Models (LLMs) in various applications, there is a growing reliability concern due to their tendency to generate inaccurate text, i.e. hallucinations. In this work, we propose Cross-Layer Attention Probing (CLAP), a novel activation probing technique for hallucination detection, which processes the LLM activations across the entire residual stream as a joint sequence. Our empirical evaluations using five LLMs and three tasks show that CLAP improves hallucination detection compared to baselines on both greedy decoded responses as well as responses sampled at higher temperatures, thus enabling fine-grained detection, i.e. the ability to disambiguate hallucinations and non-hallucinations among different sampled responses to a given prompt. This allows us to propose a detect-then-mitigate strategy using CLAP to reduce hallucinations and improve LLM reliability compared to direct mitigation approaches. Finally, we show that CLAP maintains high reliability even when applied out-of-distribution.
Figures
Figures from the paper (1 more)
Forward citations
Cited by 2 Pith papers
-
Do Hallucination Neurons Generalize? Evidence from Cross-Domain Transfer in LLMs
Hallucination neurons in LLMs are domain-specific, with cross-domain classifiers dropping from AUROC 0.783 within-domain to 0.563 across domains.
-
Steering the Verifiability of Multimodal AI Hallucinations
Researchers create a human-labeled dataset of obvious and elusive multimodal hallucinations and use learned activation-space probes to control their verifiability in MLLMs.
Reference graph
Works this paper leans on
- [1]
- [2]
- [3]
- [4]
-
[5]
K. Li, O. Patel, F. Viégas, H. Pfister, M. Wattenberg, Inference-time intervention: Eliciting truthful answers from a language model, in: Thirty-seventh Conference on Neural Information Processing Systems, 2023. URL: https://openreview.net/forum?id=aLLuYpn83y
work page 2023
-
[6]
Q. Huang, X. wen Dong, P. Zhang, B. Wang, C. He, J. Wang, D. Lin, W. Zhang, N. H. Yu, Opera: Alleviating hallucination in multi-modal large language models via over-trust penalty and retrospection-allocation, ArXiv abs/2311.17911 (2023). URL: https://api.semanticscholar.org/ CorpusID:265498818
arXiv 2023
-
[7]
T. Schuster, A. Fisch, J. Gupta, M. Dehghani, D. Bahri, V. Tran, Y. Tay, D. Metzler, Confident adaptive language modeling, Advances in Neural Information Processing Systems 35 (2022) 17456–17472
work page 2022
-
[8]
M. Geva, A. Caciularu, K. Wang, Y. Goldberg, Transformer feed-forward layers build predictions by promoting concepts in the vocabulary space, in: Y. Goldberg, Z. Kozareva, Y. Zhang (Eds.), Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing, Association for Computational Linguistics, Abu Dhabi, United Arab Emirates, 2022...
Show all 30 references
-
[9]
Karbasi, O
A. Karbasi, O. Montasser, J. Sous, G. Velegkas, (im)possibility of automated hallucination detection in large language models, 2025. URL: https://arxiv.org/abs/2504.17004. arXiv:2504.17004
2025 arXiv
-
[10]
Manakul, A
P. Manakul, A. Liusie, M. J. F. Gales, Selfcheckgpt: Zero-resource black-box hallucination detection for generative large language models, 2023. arXiv:2303.08896
2023 arXiv
-
[11]
Mündler, J
N. Mündler, J. He, S. Jenko, M. Vechev, Self-contradictory hallucinations of large language models: Evaluation, detection and mitigation, arXiv preprint arXiv:2305.15852 (2023)
2023 arXiv
-
[12]
Dhuliawala, M
S. Dhuliawala, M. Komeili, J. Xu, R. Raileanu, X. Li, A. Celikyilmaz, J. Weston, Chain-of-verification reduces hallucination in large language models, arXiv preprint arXiv:2309.11495 (2023)
2023 arXiv
-
[13]
L. Kuhn, Y. Gal, S. Farquhar, Semantic uncertainty: Linguistic invariances for uncertainty estima- tion in natural language generation, ArXiv abs/2302.09664 (2023). URL: https://api.semanticscholar. org/CorpusID:257039062
2023 arXiv
-
[14]
J. Duan, H. Cheng, S. Wang, A. Zavalny, C. Wang, R. Xu, B. Kailkhura, K. Xu, Shifting attention to rel- evance: Towards the uncertainty estimation of large language models, 2023. arXiv:2307.01379
2023 arXiv
-
[15]
X. Du, C. Xiao, Y. Li, Haloscope: Harnessing unlabeled LLM generations for hallucination detection, in: The Thirty-eighth Annual Conference on Neural Information Processing Systems, 2024. URL: https://openreview.net/forum?id=nfK0ZXFFSn
2024
-
[16]
Chuang, L
Y.-S. Chuang, L. Qiu, C.-Y. Hsieh, R. Krishna, Y. Kim, J. Glass, Lookback lens: Detecting and mitigating contextual hallucinations in large language models using only attention maps, 2024. URL: https://arxiv.org/abs/2407.07071. arXiv:2407.07071
2024 arXiv
-
[17]
Yuksekgonul, V
M. Yuksekgonul, V. Chandrasekaran, E. Jones, S. Gunasekar, R. Naik, H. Palangi, E. Kamar, B. Nushi, Attention satisfies: A constraint-satisfaction lens on factual errors of language models, in: The Twelfth International Conference on Learning Representations, 2024. URL: https:...
2024
-
[18]
Ferrando, O
J. Ferrando, O. B. Obeso, S. Rajamanoharan, N. Nanda, Do i know this entity? knowledge awareness and hallucinations in language models, in: The Thirteenth International Conference on Learning Representations, 2025. URL: https://openreview.net/forum?id=WCRQFlji2q
2025
-
[19]
W. Shi, X. Han, M. Lewis, Y. Tsvetkov, L. Zettlemoyer, S. W. tau Yih, Trusting your evidence: Hallucinate less with context-aware decoding, 2023. arXiv:2305.14739
2023 arXiv
-
[20]
Lee, M.-W
K. Lee, M.-W. Chang, K. Toutanova, Latent retrieval for weakly supervised open domain question answering, in: Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics, Association for Computational Linguistics, Florence, Italy, 2019, pp. 6086–609...
2019 doi
-
[21]
Joshi, E
M. Joshi, E. Choi, D. Weld, L. Zettlemoyer, triviaqa: A Large Scale Distantly Supervised Challenge Dataset for Reading Comprehension, arXiv e-prints (2017) arXiv:1705.03551.arXiv:1705.03551
2017 arXiv
-
[22]
M. Geva, D. Khashabi, E. Segal, T. Khot, D. Roth, J. Berant, Did Aristotle Use a Laptop? A Question Answering Benchmark with Implicit Reasoning Strategies, Transactions of the Association for Computational Linguistics (TACL) (2021)
2021
-
[23]
Touvron, T
H. Touvron, T. Lavril, G. Izacard, X. Martinet, M.-A. Lachaux, T. Lacroix, B. Rozière, N. Goyal, E. Hambro, F. Azhar, A. Rodriguez, A. Joulin, E. Grave, G. Lample, Llama: Open and efficient foundation language models, 2023. URL: https://arxiv.org/abs/2302.13971. arXiv:2302.13971
2023 arXiv
-
[24]
Taori, I
R. Taori, I. Gulrajani, T. Zhang, Y. Dubois, X. Li, C. Guestrin, P. Liang, T. B. Hashimoto, Stanford alpaca: An instruction-following llama model, https://github.com/tatsu-lab/stanford_alpaca, 2023
2023
-
[25]
Chiang, Z
W.-L. Chiang, Z. Li, Z. Lin, Y. Sheng, Z. Wu, H. Zhang, L. Zheng, S. Zhuang, Y. Zhuang, J. E. Gonzalez, I. Stoica, E. P. Xing, Vicuna: An open-source chatbot impressing gpt-4 with 90%* chatgpt quality, 2023. URL: https://lmsys.org/blog/2023-03-30-vicuna/
2023
-
[26]
G. Team, T. Mesnard, C. Hardin, R. Dadashi, S. Bhupatiraju, et. al., Gemma: Open mod- els based on gemini research and technology, 2024. URL: https://arxiv.org/abs/2403.08295. arXiv:2403.08295
2024 arXiv
-
[27]
Grattafiori, A
A. Grattafiori, A. Dubey, A. Jauhri, A. Pandey, A. Kadian, et. al., The llama 3 herd of models, 2024. URL: https://arxiv.org/abs/2407.21783. arXiv:2407.21783
2024 arXiv
-
[28]
Vrandečić, M
D. Vrandečić, M. Krötzsch, Wikidata: a free collaborative knowledgebase, Commun. ACM 57 (2014) 78–85. URL: https://doi.org/10.1145/2629489. doi:10.1145/2629489
2014 doi
-
[29]
CH-Wang, B
S. CH-Wang, B. Van Durme, J. Eisner, C. Kedzie, Do androids know they’re only dreaming of electric sheep?, in: L.-W. Ku, A. Martins, V. Srikumar (Eds.), Findings of the Association for Computational Linguistics: ACL 2024, Association for Computational Linguistics, Bangkok, Tha...
2024 doi
-
[30]
I don’t know
C. Wang, S. Cheng, Q. Guo, Y. Yue, B. Ding, Z. Xu, Y. Wang, X. Hu, Z. Zhang, Y. Zhang, Evaluating open-QA evaluation, in: Thirty-seventh Conference on Neural Information Processing Systems Datasets and Benchmarks Track, 2023. URL: https://openreview.net/forum?id=UErNpveP6R. A....
2023
Reviewed August 5, 2026 · model on record in the stance chip above.
Discussion (0). Sign in to comment.