LLM hallucination detection: methods compared

LLM hallucination detection is the task of scoring each answer a language model writes for claims that its source or the facts don't support. Teams use it to block bad answers, send risky ones to review, and track failure rates. This guide compares the seven method families in use: how each works, what it needs, what it costs, and where it falls short.

The short answer

A second model can judge the answer. An entailment model can check it against the source. You can sample several answers and measure how well they agree, or compute semantic entropy over their meanings. You can read the model's token probabilities, verify each claim against retrieved evidence, or read the model's internal activations with a trained probe.

Judges, entailment models, sampling and evidence checks work from text, so they run on any model, including closed APIs, and all but entailment models add whole model calls to every answer. Token probabilities, and probes on a model you serve, read the forward pass that writes the answer, so they add almost no cost and can flag an answer while it is being written.

Two kinds of hallucination

In retrieval-augmented generation (RAG), a hallucination is a claim that the retrieved source doesn't support or that contradicts it. RAGTruth labels these word by word in nearly 18,000 RAG answers (Niu et al., 2024). In open-domain generation, it is a false claim about the world. Farquhar et al. focus on confabulations, claims that are wrong and arbitrary, changing with details as irrelevant as the random seed (Farquhar et al., 2024).

Each method sees part of this. A source check can't catch a false claim the source never addresses, and an uncertainty measure can't catch a mistake the model makes the same way every time.

How each method works and where it falls short

LLM-as-a-judge

A second model, usually a large one, reads the prompt, the source and the answer, then returns a verdict. It needs no training data and no access to the model under test. You change what it checks by editing a prompt, and it explains its verdicts in plain language.

Zheng et al. (2023) found that on chat answers, strong judges such as GPT-4 agreed with human preferences over 80% of the time, the same level at which humans agree with each other. They also documented position, verbosity and self-enhancement biases. On RAG hallucination detection specifically, the RAGTruth authors fine-tuned Llama-2-13B on their labels and reached performance competitive with prompt-based detection using GPT-4.

The cost is a full generation on every answer, billed per token. In our benchmark on 1,498 RAGTruth answers, Claude Opus as judge took a median of 3.1 to 3.4 seconds per answer and cost $10.61 per 1,000 answers. At that price, teams usually judge a sample of their traffic.

NLI and fact-verification models

A natural language inference (NLI) model decides whether a premise entails a hypothesis. For hallucination detection, the source is the premise, each answer sentence is a hypothesis, and sentences the source doesn't entail get flagged.

NLI models are trained on sentence pairs, and sources are documents. SummaC closed that gap by scoring sentence pairs and aggregating them, reaching 74.4% balanced accuracy on a benchmark of six inconsistency datasets (Laban et al., 2022). AlignScore trains one alignment function on 4.7 million examples from seven tasks, and its 355M-parameter model matches or beats metrics built on ChatGPT and GPT-4 (Zha et al., 2023). MiniCheck trains on synthetic errors written with GPT-4, and its 770M-parameter model reaches GPT-4 accuracy on the LLM-AggreFact benchmark at what the authors put at 400 times lower cost (Tang et al., 2024).

These models are small and fast, and they run beside any model. They judge a claim only against the source you supply, so a claim the source doesn't cover is out of their reach, and they see text alone, with no view of what the generating model knew.

Self-consistency sampling: SelfCheckGPT

SelfCheckGPT samples extra answers to the same prompt and checks whether each sentence of the original answer agrees with them (Manakul et al., 2023). A fact the model knows tends to recur across samples, and a hallucinated one tends to vary. The paper scores agreement with BERTScore, question answering, n-grams, NLI or an LLM prompt, drawing 20 samples per passage. The prompt variant performed best and is computationally heavy, and the authors call the NLI variant a good trade-off between performance and computation.

It needs no weights and no external database. Its cost scales with the sample count, since each sample is a full generation. The evaluation used GPT-3 biographies of WikiBio people, an open-domain task. Like semantic entropy, it tracks the model's uncertainty, so a mistake the model repeats in every sample looks consistent.

Semantic entropy

Semantic entropy measures uncertainty over meanings. Kuhn et al. (2023) introduced it, and Farquhar et al. (2024) developed it for hallucination detection in Nature. You sample several answers (ten in the Nature paper), cluster them by bidirectional entailment, and compute entropy over the clusters. Rewordings of the same answer count as agreement, which plain token entropy misses. High entropy flags a likely confabulation.

The method is unsupervised and needs no task-specific data. A discrete variant uses only the sampled text, so it runs on black-box models. For paragraphs, the paper splits the text into factual claims and resamples answers to questions about each one.

Kossen et al. (2024) put its cost at a 5-to-10-fold increase in computation. Farquhar et al. state that it does not help when a model's outputs are systematically bad, for example when the model is consistently wrong after training on common misconceptions.

Token probability and uncertainty

Every token a model generates comes with a probability. Low token probability, high next-token entropy and low sequence likelihood all signal uncertainty, which tracks error. Reading them adds no compute and works token by token, so a system can act during generation. Varshney et al. (2023) used logit values to find low-confidence spans mid-generation, then validated and repaired them, cutting GPT-3.5's hallucinations on article generation from 47.5% to 14.5% on average.

Kadavath et al. (2022) showed that larger models are well calibrated on multiple-choice and true/false questions posed in the right format, and that models can estimate P(True), the probability that their own proposed answer is correct. Claim Conditioned Probability separates uncertainty about a claim's value from uncertainty about which claim to make and how to word it (Fadeeva et al., 2024).

The raw signal has known weaknesses. Azaria and Mitchell (2023) found that sentence probability depends on sentence length and word frequency as well as on truth. The GPT-4 Technical Report shows a well-calibrated pre-trained model whose calibration dropped after post-training. Closed systems may also withhold the probabilities, as the SelfCheckGPT authors note for ChatGPT.

Retrieval and citation-grounding checks

A typical pipeline splits an answer into atomic claims, retrieves evidence for each claim from a corpus or a search engine, and has a model decide whether the evidence supports it.

• FActScore reports the share of atomic facts a knowledge source supports. Its automated estimator has less than a 2% error rate, and ChatGPT's biographies scored only 58% (Min et al., 2023).
• SAFE has an LLM agent send Google searches for each fact. On about 16,000 facts it agreed with crowdsourced annotators 72% of the time and was more than 20 times cheaper than human annotators (Wei et al., 2024).
• ALCE measures whether an answer's citations support its sentences. On ELI5, even the best models lacked complete citation support 50% of the time (Gao et al., 2023).

Because the evidence comes from outside the model, these checks catch confident errors, and each verdict arrives with its evidence. The price is many model and search calls per answer. Obeso et al. (2025) describe SAFE and FActScore as multi-step pipelines whose cost and latency make them impractical for real-time monitoring during generation.

Internal-state probes

A probe is a small classifier, often linear, trained on a model's hidden activations to predict whether its output is wrong. It reads activations the model computes anyway, so it adds almost no compute and can score each token as it appears.

• SAPLMA. Azaria and Mitchell (2023) classified statements as true or false from hidden-layer activations with 71% to 83% accuracy on balanced sets, depending on the base model, and found the classifier more reliable than the model's own sentence probability.
• Grounded generation. CH-Wang et al. (2024) probed for hallucinated spans on three grounded generation tasks. In domain, the probes beat several contemporary baselines and surpassed an expert human annotator in response-level F1.
• Exact answer tokens. Orgad et al. (2025) found that truthfulness information concentrates in the exact answer tokens, and that a model can encode the correct answer while consistently generating a wrong one.
• Semantic Entropy Probes. Kossen et al. (2024) predict semantic entropy from the hidden states of one generation, with no sampling at test time and almost zero overhead. They train without accuracy labels.
• Real-time token-level probes. Obeso et al. (2025) flagged fabricated entities in long-form answers with probes that run in the same forward pass at negligible overhead. On Llama-3.3-70B, linear probes reached 0.87 AUC and LoRA probes 0.90, against 0.71 for semantic entropy adapted to long-form text. The probes halted generation to abstain when risk crossed a threshold, and probes trained on one model detected hallucinations in other models' outputs with AUC typically within 0.02 to 0.04 of same-model results.

Attention carries signal too. Lookback Lens, a linear classifier on how much attention goes to the provided context against newly generated tokens, matched detectors built on full hidden states or on a text entailment model (Chuang et al., 2024).

Probes need activations, so they run on open-weight models you serve. For closed models, Obeso et al. describe passing the finished answer through a separate monitoring model at some added cost. Most probes also need labels from the task they watch: CH-Wang et al. found poor transfer from one task to another, and Orgad et al. found error detectors generalize only between tasks that need similar skills.

Comparison table

Method	What it reads	Extra model calls per answer	Works on closed API models	Can act before the user sees the answer	Typical latency
LLM-as-a-judge	Prompt, source and answer text	One call to a large model	Yes	Only by holding the answer for the full judge call	Seconds: 3.1 to 3.4 s median for Claude Opus in our RAGTruth benchmark
NLI and fact-verification models	Source and answer text	Passes of a small model (355M parameters for AlignScore, 770M for MiniCheck)	Yes	Yes, by holding the finished answer for the check	Low
Self-consistency (SelfCheckGPT)	The answer and extra sampled answers	One generation per sample, plus comparisons (20 samples in the paper)	Yes	Only after the extra samples finish	Several full generations
Semantic entropy	Sampled answers, clustered by meaning	5 to 10 generations, plus entailment checks	Yes, with the discrete variant	Only after the extra samples finish	5 to 10 times the compute of one generation (Kossen et al.)
Token probability	The model's own token probabilities	None	Only where the API returns log-probabilities	Yes, during generation	None added
Retrieval and citation checks	Answer claims and retrieved evidence	Several per claim: extraction, search and verification	Yes	Only by holding the answer for the full pipeline	Long: several sequential model and search calls
Internal-state probes	Hidden activations	None inside the serving model; one reader pass for closed models	Yes, through a reader model that re-reads the answer	Yes, token by token inside the serving model; a reader checks the finished answer	Negligible inside the serving model (Obeso et al.); 33 ms median for Latent's reader on the same machine

Where Latent fits

Latent puts internal-state probes into production. It reads a language model's internal activations with probes, small linear classifiers fit on labeled answers, and scores every answer for hallucination risk at runtime.

On open-weight models served by vLLM, Latent reads the serving model itself as it writes, so a risky answer can be caught before it reaches the user. For models behind an API, Latent's reader model, Llama 3.1 8B, re-reads the finished prompt and answer, and Latent scores the reader's activations. This is the cross-model route Obeso et al. describe.

Our measured numbers:

• Speed. On 1,498 RAGTruth answers, with every checker given the source, Claude Opus as judge took a median of 3.1 to 3.4 s to check one answer (95th percentile 6.1 s). Latent's reader took 150 to 170 ms over a network (95th percentile under 250 ms) and 33 ms on the same machine (95th percentile 40 ms).
• Cost per 1,000 answers. Claude Opus as judge costs $10.61 at its September 2026 list price. Latent's reader on one A100 you run costs $0.02. Inside your own vLLM model, Latent adds no extra cost.
• Detection. Flagging 10% of other models' RAG answers on the RAGTruth held-out set (3,498 answers with human span labels), 96% of Latent's flags are real failures. Calibrated on 10,000 human-labeled RAG answers, the probe finds 2.7× as many real failures as random review at the same 10% budget.
• Serving overhead inside vLLM. None measurable: 14.56 requests per second with Latent and 14.66 without, on an A100 40 GB serving Llama 3.1 8B.

Probes and judges work well together. When Latent picks the riskiest 10% of answers for Opus to judge, precision is 0.927 at $1.06 per 1,000 answers. When Opus judges everything, precision is 0.818 at $10.61 per 1,000.

Choosing a method for production

Three questions settle most of the choice. Can you read the model's activations? Do you have a source to check against? Must a bad answer be stopped before the user sees it?

• You serve an open-weight model. Probe the serving model. The probe sees every token at almost no cost and can stop an answer mid-generation.
• You call a closed API. Run a reader model with probes or an NLI model on every answer, and a judge on a sample.
• You run RAG. Check against the source with fact-verification models, a judge given the source, or probes calibrated on RAG labels.
• You need evidence for an audit. FActScore-style and SAFE-style pipelines return the evidence behind each verdict.

Most production stacks layer a fast scorer on every answer with a judge or a person on the riskiest slice. Measure any method on your own labeled answers: fix the share of traffic you can review, and count how many flags at that budget are real failures. The probe research above shows how much accuracy moves between tasks.

FAQ

What is the best way to detect LLM hallucinations?

On a model you serve, use internal-state probes. They read activations the model already computes, so they score every answer at negligible cost, and Obeso et al. found token-level probes beat semantic entropy on long-form answers. On a closed API, score every answer with a reader probe or a fact-verification model and send the riskiest slice to a judge.

Can you detect hallucinations without access to the model's weights?

Judges, NLI and fact-verification models, SelfCheckGPT, discrete semantic entropy and retrieval checks all work from text, so they need no weights. Probes work through a separate open model that re-reads the prompt and answer, and Obeso et al. found probes transfer across models with little loss in AUC.

How do you detect hallucinations in RAG?

Check the answer against the retrieved source with a fact-verification model such as AlignScore or MiniCheck, a judge given the source, or probes calibrated on RAG labels. RAGTruth is a public benchmark for the task, with nearly 18,000 RAG answers labeled at the word level.

Is LLM-as-a-judge reliable for hallucination detection?

Zheng et al. measured over 80% agreement between strong judges and human preferences on chat answers, along with position, verbosity and self-enhancement biases. A judge makes a sound reviewer for a sample of traffic. On every answer it is slow and expensive: 3.1 to 3.4 seconds and $10.61 per 1,000 answers for Claude Opus in our benchmark.

Can hallucinations be detected before the user sees the answer?

Internal-state probes and token probabilities read the generation as it happens, so they can stop a risky answer mid-stream, as Obeso et al. did by abstaining when a probe crossed a threshold. A fast check on a finished answer you hold, such as an NLI model or a reader probe, can also gate delivery.

References

1. Cheng Niu, Yuanhao Wu, Juno Zhu, Siliang Xu, Kashun Shum, Randy Zhong, Juntong Song, Tong Zhang. "RAGTruth: A Hallucination Corpus for Developing Trustworthy Retrieval-Augmented Language Models." ACL 2024. https://arxiv.org/abs/2401.00396
2. Sebastian Farquhar, Jannik Kossen, Lorenz Kuhn, Yarin Gal. "Detecting hallucinations in large language models using semantic entropy." Nature 630, 625-630, 2024. https://doi.org/10.1038/s41586-024-07421-0
3. Lianmin Zheng, Wei-Lin Chiang, Ying Sheng, Siyuan Zhuang, Zhanghao Wu, Yonghao Zhuang, Zi Lin, Zhuohan Li, Dacheng Li, Eric P. Xing, Hao Zhang, Joseph E. Gonzalez, Ion Stoica. "Judging LLM-as-a-Judge with MT-Bench and Chatbot Arena." NeurIPS 2023 Datasets and Benchmarks Track. https://arxiv.org/abs/2306.05685
4. Philippe Laban, Tobias Schnabel, Paul N. Bennett, Marti A. Hearst. "SummaC: Re-Visiting NLI-based Models for Inconsistency Detection in Summarization." Transactions of the Association for Computational Linguistics 10, 2022. https://arxiv.org/abs/2111.09525
5. Yuheng Zha, Yichi Yang, Ruichen Li, Zhiting Hu. "AlignScore: Evaluating Factual Consistency with a Unified Alignment Function." ACL 2023. https://arxiv.org/abs/2305.16739
6. Liyan Tang, Philippe Laban, Greg Durrett. "MiniCheck: Efficient Fact-Checking of LLMs on Grounding Documents." EMNLP 2024. https://arxiv.org/abs/2404.10774
7. Potsawee Manakul, Adian Liusie, Mark J. F. Gales. "SelfCheckGPT: Zero-Resource Black-Box Hallucination Detection for Generative Large Language Models." EMNLP 2023. https://arxiv.org/abs/2303.08896
8. Lorenz Kuhn, Yarin Gal, Sebastian Farquhar. "Semantic Uncertainty: Linguistic Invariances for Uncertainty Estimation in Natural Language Generation." ICLR 2023. https://arxiv.org/abs/2302.09664
9. Jannik Kossen, Jiatong Han, Muhammed Razzak, Lisa Schut, Shreshth Malik, Yarin Gal. "Semantic Entropy Probes: Robust and Cheap Hallucination Detection in LLMs." arXiv, 2024. https://arxiv.org/abs/2406.15927
10. Neeraj Varshney, Wenlin Yao, Hongming Zhang, Jianshu Chen, Dong Yu. "A Stitch in Time Saves Nine: Detecting and Mitigating Hallucinations of LLMs by Validating Low-Confidence Generation." arXiv, 2023. https://arxiv.org/abs/2307.03987
11. Saurav Kadavath, Tom Conerly, Amanda Askell, Tom Henighan, Dawn Drain, Ethan Perez, Nicholas Schiefer, Zac Hatfield-Dodds, Nova DasSarma, Eli Tran-Johnson, and 26 other authors. "Language Models (Mostly) Know What They Know." arXiv, 2022. https://arxiv.org/abs/2207.05221
12. Ekaterina Fadeeva, Aleksandr Rubashevskii, Artem Shelmanov, Sergey Petrakov, Haonan Li, Hamdy Mubarak, Evgenii Tsymbalov, Gleb Kuzmin, Alexander Panchenko, Timothy Baldwin, Preslav Nakov, Maxim Panov. "Fact-Checking the Output of Large Language Models via Token-Level Uncertainty Quantification." Findings of ACL 2024. https://arxiv.org/abs/2403.04696
13. Amos Azaria, Tom Mitchell. "The Internal State of an LLM Knows When It's Lying." Findings of EMNLP 2023. https://arxiv.org/abs/2304.13734
14. OpenAI. "GPT-4 Technical Report." arXiv, 2023. https://arxiv.org/abs/2303.08774
15. Sewon Min, Kalpesh Krishna, Xinxi Lyu, Mike Lewis, Wen-tau Yih, Pang Wei Koh, Mohit Iyyer, Luke Zettlemoyer, Hannaneh Hajishirzi. "FActScore: Fine-grained Atomic Evaluation of Factual Precision in Long Form Text Generation." EMNLP 2023. https://arxiv.org/abs/2305.14251
16. Jerry Wei, Chengrun Yang, Xinying Song, Yifeng Lu, Nathan Hu, Jie Huang, Dustin Tran, Daiyi Peng, Ruibo Liu, Da Huang, Cosmo Du, Quoc V. Le. "Long-form factuality in large language models." NeurIPS 2024. https://arxiv.org/abs/2403.18802
17. Tianyu Gao, Howard Yen, Jiatong Yu, Danqi Chen. "Enabling Large Language Models to Generate Text with Citations." EMNLP 2023. https://arxiv.org/abs/2305.14627
18. Oscar Obeso, Andy Arditi, Javier Ferrando, Joshua Freeman, Cameron Holmes, Neel Nanda. "Real-Time Detection of Hallucinated Entities in Long-Form Generation." arXiv, 2025. https://arxiv.org/abs/2509.03531
19. Sky CH-Wang, Benjamin Van Durme, Jason Eisner, Chris Kedzie. "Do Androids Know They're Only Dreaming of Electric Sheep?" Findings of ACL 2024. https://arxiv.org/abs/2312.17249
20. Hadas Orgad, Michael Toker, Zorik Gekhman, Roi Reichart, Idan Szpektor, Hadas Kotek, Yonatan Belinkov. "LLMs Know More Than They Show: On the Intrinsic Representation of LLM Hallucinations." ICLR 2025. https://arxiv.org/abs/2410.02707
21. Yung-Sung Chuang, Linlu Qiu, Cheng-Yu Hsieh, Ranjay Krishna, Yoon Kim, James Glass. "Lookback Lens: Detecting and Mitigating Contextual Hallucinations in Large Language Models Using Only Attention Maps." EMNLP 2024. https://arxiv.org/abs/2407.07071