REVIEW 3 major objections 5 minor 1 cited by
The HalluRAG Dataset: Detecting Closed-Domain Hallucinations in RAG Applications Using an LLM's Internal States
T0 review · 3 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash
Pith's one-line read This paper introduces HalluRAG and claims small MLPs trained on a single layer's internal states detect closed-domain RAG hallucinations with up to about 75% accuracy, and that answerable and unanswerable prompts are encoded differently.
desk verdict A useful IAV result and a well-built recency-controlled dataset, but the headline accuracies rest on an unspecified split unit that could allow sentence-level leakage. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The machinery is a controlled dataset plus a white-box classifier. HalluRAG is built from English Wikipedia sentences whose reference timestamps postdate February 22, 2024; each sentence becomes an answerable RAG prompt (relevant chunk retrieved) and an unanswerable twin (unrelated chunk retrieved), spanning three prompt templates, three chunk sizes, and one, three, or five chunks. Sentences from LLaMA-2-7B-Chat and Mistral-7B-Instruct-v0.1 are labeled hallucinated versus non-hallucinated by an auto-annotator using four Boolean checks—conflicting, grounded, has_factual_information, and no_clear_answer—with a truth table keyed to answerability, validated against 274 human labels at an F1 of 96.05%. The signal comes from internal states extracted at the last token: contextualized embedding vectors, the model's hidden states, and intermediate activation values, the activations inside the decoder MLP blocks, taken from the middle and last decoder layers. The classifier is a four-layer MLP with ReLU and sigmoid, trained with early stopping and evaluated as ten independent runs.
What would settle it
A decisive test is a contamination probe: take HalluRAG's answerable prompts, remove the retrieved context, and ask the same LLM directly at temperature 0; if the model answers a substantial share correctly from parametric knowledge, those items were not truly unseen, and the classifiers' accuracies should be re-measured on the clean subset. A second decisive probe is to strip "I don't know" and apology phrases from unanswerable test sentences; if the near-100% unanswerable accuracy collapses, the classifier is reading refusal style rather than a grounding signal.
Extended reading notes
Core claim
On its own terms, the paper's central discovery is that closed-domain hallucinations—answers that are ungrounded because the relevant facts emerged after the model's training cutoff—leave a readable trace in the model's internal states. A binary MLP fed a single vector from the last token, whether a contextualized embedding vector (CEV) or an intermediate activation value (IAV) from a decoder block's MLP, classifies hallucinated versus grounded sentences at test accuracies of roughly 60% to 75% across LLaMA-2-7B-Chat and Mistral-7B-Instruct-v0.1, with the highest accuracies on int4-quantized checkpoints. Separating answerable from unanswerable prompts raises LLaMA-2-7B accuracies to above 75% for answerable and above 80% (up to 90%+ in some quantizations) for unanswerable, while Mistral-7B reaches near-100% on unanswerable prompts. The paper interprets the answerability split as evidence that the two situations are encoded differently, not that the task has become trivial, since answerable classification remains moderately hard.
Load-bearing premise
The load-bearing premise is that reference dates after February 22, 2024 guarantee the LLMs never saw those Wikipedia facts during training; if any post-cutoff content leaked in through web crawls, page history, or paraphrases, the dataset stops being closed-domain and the contrast with parametric-knowledge hallucinations is undermined.
Editorial extensions
If this is right
- Hallucination detection in RAG can be done at sentence level without an external reference, using only the internal states recorded while the answer is generated.
- Intermediate MLP activations carry roughly the same hallucination signal as the more commonly used contextualized embeddings, so future detectors need not restrict themselves to final hidden states.
- Separate classifiers for answerable and unanswerable prompts outperform a single classifier, suggesting that production RAG systems should route sentences by prompt answerability before detection.
- Because HalluRAG-trained classifiers transfer poorly to RAGTruth and vice versa, robust hallucination detection will require larger, more diverse annotated corpora rather than just one dataset.
- Prompt template choice measurably changes hallucination rate, from roughly 16% to 32–40% for LLaMA-2-7B depending on template, so prompt design is itself a hallucination-reduction lever.
Reading between the lines
- The paper leaves implicit that the answerability distinction could be used as a routing step: a small classifier could first decide whether the retrieved chunk answers the question, then apply a specialized hallucination detector tuned to that regime.
- The near-100% unanswerable results may partly reflect surface markers such as "I don't know" or apology phrasing; a natural extension would ablate those templates to measure how much of the signal is truly about grounding.
- Because provenance by timestamp is only a proxy, a contamination probe—asking the model the HalluRAG questions with no retrieved context and checking how often it already knows the answer—would directly test the closed-domain assumption and could be added to the dataset release.
- If int4 quantization consistently improves detection, compressed models may be the practical deployment target for internal-state hallucination monitors, though the paper does not explain why quantization helps.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper introduces HalluRAG, a dataset for sentence-level closed-domain hallucination detection in RAG settings, where 'closed-domain' is operationalized through recency: only Wikipedia sentences with references dated after February 22, 2024 are used, under the assumption that this information was not in the training data of LLaMA-2 and Mistral models. For each RAG prompt, the authors generated answers from several LLM configurations, extracted contextualized embedding vectors (CEVs) and intermediate activation values (IAVs) from middle and last decoder blocks, and labeled each sentence as hallucinated or not using a GPT-4o chain-of-thought prompt with a four-boolean truth table. The labeler is validated against 274 human judgments (F1 96.05%). MLP classifiers trained on the internal states achieve test accuracies up to about 75% overall, with int4 quantizations performing best; separate classifiers for answerable and unanswerable prompts improve accuracy, reaching near 100% for Mistral-7B on unanswerable prompts. Cross-dataset evaluation against RAGTruth shows poor generalization, which the authors report as a limitation. The central claims are that IAVs are as effective as CEVs for hallucination detection and that answerable and unanswerable prompts are encoded differently in internal states.
Significance. If the methodology is sound, HalluRAG would be a useful resource: it provides a recency-based operationalization of closed-domain hallucinations, publicly releases data and code, validates the automatic labeler against human judgments, and reports results averaged over ten training runs. The comparison of IAVs with CEVs is a legitimate and understudied question, and the honest reporting of poor cross-dataset generalization is a strength. However, the significance of the headline accuracies depends on whether the reported numbers reflect genuine generalization or leakage from the data-splitting procedure. The paper's own Discussion acknowledges limited diversity and close wording between GPT-4o-generated questions and Wikipedia answers, which tempers the practical claims. With a clarified and leakage-free evaluation, the dataset and findings would be a modest but solid contribution to white-box hallucination detection.
major comments (3)
- [§4.2, Tables 1 and 3] The paper never states whether train/validation/test splits are performed at the sentence level or at the prompt/response level. Because HalluRAG stores internal states per generated sentence and each RAG prompt yields a multi-sentence response, a sentence-level random split can place sentences from the same response in both training and test sets. In that case the MLP can memorize prompt-level cues—the question, the context snippet, the answerability, and the surrounding generated text—rather than learning a general sentence-level hallucination signal. This would inflate the test accuracies in Table 1 and the near-perfect unanswerable accuracies in Table 3. The held-out parameter experiment in Table 11 does not resolve the issue, since it withholds configuration values but still permits the same prompt's sentences to straddle the split. Please specify the split unit explicitly and, if the current experiments use sentence-level splits, re-run the evaluation with prompt-level splits and report both sets of numbers.
- [§4.1, step 1] The recency criterion is load-bearing: the paper defines closed-domain hallucinations as hallucinations about information the LLM 'could not have seen during training,' and this definition is used to contrast HalluRAG with datasets like RAGTruth. The only evidence that the post-February-22-2024 Wikipedia sentences are absent from training data is the reference timestamps. Training corpora are not limited to Wikipedia snapshots available at the reference dates; post-cutoff content can enter through later web crawls, page histories, or indirect paraphrase in other sources. Please provide a contamination check beyond timestamps—for example, perplexity or memorization probes on the candidate sentences, or a manual audit of a sample against known training corpora—and state explicitly which training-data cutoffs are assumed for LLaMA-2 and Mistral-7B. Without such a check, the central contrast between closed-domain and parametric-knowledge hallucinations is not fully established.
- [§5.3 and Table 11] The claim that answerable and unanswerable prompts are encoded differently is supported by showing that separate classifiers yield higher accuracies than a single classifier. However, this experimental design does not isolate an encoding difference from task difficulty or from the fact that the answerable and unanswerable partitions have different label distributions and different surface forms. As the authors themselves note in §5.3, for unanswerable prompts the classifier may mainly detect whether the model produced an 'I don't know' response, and Table 11 shows that training on answerable questions alone leads to near-chance accuracy on the full test set. A stronger test would be to train a single classifier with answerability as an explicit input feature, or to compare probing results on matched internal states from answerable and unanswerable prompts while controlling for response length and lexical content. As it stands, the 'encoded differently' claim is an interpretation rather than a demonstrated property of the internal states.
minor comments (5)
- [§6, Discussion] The phrase 'after a specified cut-off data' should read 'cut-off date'.
- [Throughout] The abbreviation 'IA Vs' is inconsistently spaced; please use a consistent form such as 'IAVs' or 'IA Vs' throughout.
- [Table 2] The table caption uses 'H-H-R' and 'R-R-H' without defining the acronyms in the caption; please spell them out (e.g., 'trained and validated on HalluRAG, tested on RAGTruth').
- [§3, Related Work] RAGTruth is mentioned in the Related Work section but is not described in enough detail for readers to understand its annotation scheme, model coverage, or why it is a suitable cross-dataset test; please add a brief description and citation context.
- [§4.2] The text says that the MLP structure follows MIND and SAPLMA, but the input size and hidden dimensions are only given as a sequence (input_size—256—128—64—1); please state the actual input dimension per internal state type, since it is needed to reproduce the architecture.
Circularity Check
No circular derivation: the classifier targets are externally labeled, the features are independent internal states, and the central claims are empirical; the only self-citation is incidental.
full rationale
The derivation chain is not circular. HalluRAG's labels are produced by GPT-4o under a four-boolean chain-of-thought protocol and are benchmarked against 274 human-labeled sentences (F1 96.05%, accuracy 97.81%), so the classification targets are not constructed from the classifier's input features. The MLP features are internal states of LLaMA-2/Mistral-7B taken at generation time; no parameter is fitted to the test labels and then renamed as a prediction. The headline claims are empirical comparisons: IAVs are compared with CEVs on held-out test accuracies, and the answerable/unanswerable separation is supported by training separate classifiers; the paper itself concedes that the near-perfect unanswerable results largely reduce to detecting "I don't know" responses, which is an acknowledged limitation rather than a circular step. The only overlapping-author citation is Kahl et al. (2024), used in the introduction as an example of RAG tutoring systems ('tutoring systems in which context, as well as answers, are enhanced by infusing background knowledge from trusted sources (Levonian et al., 2023; Kahl et al., 2024)'); it is not load-bearing. Two correctness risks fall outside circularity: the recency assumption (Section 4.1) has no contamination check, and Section 4.2 does not state whether the train/test split is at prompt or sentence level, so the headline accuracies in Tables 1 and 3 could be inflated by sentence-level leakage. These concerns affect validity, not circularity of the derivation.
Assumptions & free parameters
free parameters (1)
- Wikipedia cutoff date =
2024-02-22
assumptions (4)
- domain assumption Wikipedia content whose references postdate February 22, 2024 was absent from the training data of LLaMA-2, Mistral-7B, and their chat versions.
- domain assumption Wikipedia timestamps (access, archive, and reference dates) accurately indicate when the information became publicly available.
- domain assumption GPT-4o's four-boolean labeling provides a valid ground truth for hallucination.
- domain assumption The last token's internal states from a decoder block summarize the semantic content of the generated sentence.
Cite this review
Pith. "Pith review of The HalluRAG Dataset: Detecting Closed-Domain Hallucinations in RAG Applications Using an LLM's Internal States." pith.science (2026). https://pith.science/paper/VJVMC6R5
@misc{pith2026241217056,
author = {Pith},
title = {Pith review of: The HalluRAG Dataset: Detecting Closed-Domain Hallucinations in RAG Applications Using an LLM's Internal States},
year = {2026},
howpublished = {\url{https://pith.science/paper/VJVMC6R5}},
note = {Machine review of arXiv:2412.17056}
}
read the original abstract
Detecting hallucinations in large language models (LLMs) is critical for enhancing their reliability and trustworthiness. Most research focuses on hallucinations as deviations from information seen during training. However, the opaque nature of an LLM's parametric knowledge complicates the understanding of why generated texts appear ungrounded: The LLM might not have picked up the necessary knowledge from large and often inaccessible datasets, or the information might have been changed or contradicted during further training. Our focus is on hallucinations involving information not used in training, which we determine by using recency to ensure the information emerged after a cut-off date. This study investigates these hallucinations by detecting them at sentence level using different internal states of various LLMs. We present HalluRAG, a dataset designed to train classifiers on these hallucinations. Depending on the model and quantization, MLPs trained on HalluRAG detect hallucinations with test accuracies ranging up to 75 %, with Mistral-7B-Instruct-v0.1 achieving the highest test accuracies. Our results show that IAVs detect hallucinations as effectively as CEVs and reveal that answerable and unanswerable prompts are encoded differently as separate classifiers for these categories improved accuracy. However, HalluRAG showed some limited generalizability, advocating for more diversity in datasets on hallucinations.
Figures
Forward citations
Cited by 1 Pith paper
-
Loki's Dance of Illusions: A Comprehensive Survey of Hallucination in Large Language Models
A survey of LLM hallucination research that formalizes hallucination types and argues, via incompleteness and undecidability arguments, that hallucinations cannot be fully eliminated.
Reference graph
Works this paper leans on
-
[1]
Do language models know when they're hallucinating references?, 2024
Ayush Agrawal, Mirac Suzgun, Lester Mackey, and Adam Tauman Kalai. Do language models know when they're hallucinating references?, 2024
work page 2024
-
[2]
The internal state of an llm knows when it's lying, 2023
Amos Azaria and Tom Mitchell. The internal state of an llm knows when it's lying, 2023
work page 2023
-
[3]
Inside: Llms' internal states retain the power of hallucination detection, 2024
Chao Chen, Kai Liu, Ze Chen, Yi Gu, Yue Wu, Mingyuan Tao, Zhihang Fu, and Jieping Ye. Inside: Llms' internal states retain the power of hallucination detection, 2024
2024
-
[4]
Xinyue Fang, Zhen Huang, Zhiliang Tian, Minghui Fang, Ziyi Pan, Quntian Fang, Zhihua Wen, Hengyue Pan, and Dongsheng Li. Zero-resource hallucination detection for text generation via graph-based contextual knowledge triples modeling, 2024. URL https://arxiv.org/abs/2409.11283
work page Pith review arXiv 2024
-
[5]
Chainpoll: A high efficacy method for llm hallucination detection, 2023
Robert Friel and Atindriyo Sanyal. Chainpoll: A high efficacy method for llm hallucination detection, 2023. URL https://arxiv.org/abs/2310.18344
arXiv 2023
-
[6]
Xiangkun Hu, Dongyu Ru, Lin Qiu, Qipeng Guo, Tianhang Zhang, Yang Xu, Yun Luo, Pengfei Liu, Yue Zhang, and Zheng Zhang. Refchecker: Reference-based fine-grained hallucination checker and benchmark for large language models. arXiv preprint arXiv:2405.14486, 2024
arXiv 2024
-
[7]
Albert Q. Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, L \'e lio Renard Lavaud, Marie-Anne Lachaux, Pierre Stock, Teven Le Scao, Thibaut Lavril, Thomas Wang, Timoth \'e e Lacroix, and William El Sayed. Mistral 7b, 2023
work page 2023
-
[8]
Language models (mostly) know what they know, 2022
Saurav Kadavath, Tom Conerly, Amanda Askell, Tom Henighan, Dawn Drain, Ethan Perez, Nicholas Schiefer, Zac Hatfield-Dodds, Nova DasSarma, Eli Tran-Johnson, Scott Johnston, Sheer El-Showk, Andy Jones, Nelson Elhage, Tristan Hume, Anna Chen, Yuntao Bai, Sam Bowman, Stanislav Fort, Deep Ganguli, Danny Hernandez, Josh Jacobson, Jackson Kernion, Shauna Kravec,...
2022
Show all 26 references
-
[9]
Evaluating the impact of advanced llm techniques on ai-lecture tutors for a robotics course
Sebastian Kahl, Felix L \"o ffler, Martin Maciol, Fabian Ridder, Marius Schmitz, Jennifer Spanagel, Jens Wienkamp, Christopher Burgahn, and Malte Schilling. Evaluating the impact of advanced llm techniques on ai-lecture tutors for a robotics course. arXiv preprint arXiv:2408.0...
2024 arXiv
-
[10]
Retrieval-augmented generation to improve math question-answering: Trade-offs between groundedness and human preference
Zachary Levonian, Chenglu Li, Wangda Zhu, Anoushka Gade, Owen Henkel, Millie-Ellen Postle, and Wanli Xing. Retrieval-augmented generation to improve math question-answering: Trade-offs between groundedness and human preference. arXiv preprint arXiv:2310.03184, 2023
-
[11]
u ttler, Mike Lewis, Wen tau Yih, Tim Rockt \
Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich K \"u ttler, Mike Lewis, Wen tau Yih, Tim Rockt \"a schel, Sebastian Riedel, and Douwe Kiela. Retrieval-augmented generation for knowledge-intensive nlp tasks, 2021
2021
-
[12]
Entity-based knowledge conflicts in question answering, 2022
Shayne Longpre, Kartik Perisetla, Anthony Chen, Nikhil Ramesh, Chris DuBois, and Sameer Singh. Entity-based knowledge conflicts in question answering, 2022
2022
-
[13]
Potsawee Manakul, Adian Liusie, and Mark J. F. Gales. Selfcheckgpt: Zero-resource black-box hallucination detection for generative large language models, 2023
2023
-
[14]
On faithfulness and factuality in abstractive summarization, 2020
Joshua Maynez, Shashi Narayan, Bernd Bohnet, and Ryan McDonald. On faithfulness and factuality in abstractive summarization, 2020
2020
-
[15]
OpenAI, Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, Red Avila, Igor Babuschkin, Suchir Balaji, Valerie Balcom, Paul Baltescu, Haiming Bao, Mohammad Bavarian, Jeff ...
2024
-
[16]
Language models are unsupervised multitask learners
Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, Ilya Sutskever, et al. Language models are unsupervised multitask learners. OpenAI blog, 1 0 (8): 0 9, 2019
2019
-
[17]
Retrieval augmentation reduces hallucination in conversation
Kurt Shuster, Spencer Poff, Moya Chen, Douwe Kiela, and Jason Weston. Retrieval augmentation reduces hallucination in conversation. In Marie-Francine Moens, Xuanjing Huang, Lucia Specia, and Scott Wen-tau Yih, editors, Findings of the Association for Computational Linguistics:...
2021 doi
-
[18]
Roformer: Enhanced transformer with rotary position embedding, 2023
Jianlin Su, Yu Lu, Shengfeng Pan, Ahmed Murtadha, Bo Wen, and Yunfeng Liu. Roformer: Enhanced transformer with rotary position embedding, 2023
2023
-
[19]
Unsupervised real-time hallucination detection based on the internal states of large language models, 2024
Weihang Su, Changyue Wang, Qingyao Ai, Yiran HU, Zhijing Wu, Yujia Zhou, and Yiqun Liu. Unsupervised real-time hallucination detection based on the internal states of large language models, 2024
2024
-
[20]
Nomiracl: Knowing when you don't know for robust multilingual retrieval-augmented generation, 2024
Nandan Thakur, Luiz Bonifacio, Xinyu Zhang, Odunayo Ogundepo, Ehsan Kamalloo, David Alfonso-Hermelo, Xiaoguang Li, Qun Liu, Boxing Chen, Mehdi Rezagholizadeh, and Jimmy Lin. Nomiracl: Knowing when you don't know for robust multilingual retrieval-augmented generation, 2024
2024
-
[21]
Llama 2: Open foundation and fine-tuned chat models, 2023
Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, Dan Bikel, Lukas Blecher, Cristian Canton Ferrer, Moya Chen, Guillem Cucurull, David Esiobu, Jude Fernandes, Jeremy Fu, W...
2023
-
[22]
Chain-of-thought prompting elicits reasoning in large language models, 2023
Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Brian Ichter, Fei Xia, Ed Chi, Quoc Le, and Denny Zhou. Chain-of-thought prompting elicits reasoning in large language models, 2023
2023
-
[23]
Ragtruth: A hallucination corpus for developing trustworthy retrieval-augmented language models, 2023
Yuanhao Wu, Juno Zhu, Siliang Xu, Kashun Shum, Cheng Niu, Randy Zhong, Juntong Song, and Tong Zhang. Ragtruth: A hallucination corpus for developing trustworthy retrieval-augmented language models, 2023
2023
-
[24]
Retrieval-augmented generation with knowledge graphs for customer service question answering
Zhentao Xu, Mark Jerome Cruz, Matthew Guevara, Tie Wang, Manasi Deshpande, Xiaofeng Wang, and Zheng Li. Retrieval-augmented generation with knowledge graphs for customer service question answering. In Proceedings of the 47th International ACM SIGIR Conference on Research and D...
2024
-
[25]
Root mean square layer normalization, 2019
Biao Zhang and Rico Sennrich. Root mean square layer normalization, 2019
2019
-
[26]
Siren's song in the ai ocean: A survey on hallucination in large language models, 2023
Yue Zhang, Yafu Li, Leyang Cui, Deng Cai, Lemao Liu, Tingchen Fu, Xinting Huang, Enbo Zhao, Yu Zhang, Yulong Chen, Longyue Wang, Anh Tuan Luu, Wei Bi, Freda Shi, and Shuming Shi. Siren's song in the ai ocean: A survey on hallucination in large language models, 2023
2023
Reviewed August 11, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.