CiteGuard: Faithful Citation Attribution for LLMs via Retrieval-Augmented Validation

• LLMs can generate up to 78-90% fabricated citations (Asai et al., 2024) and misattribute findings to incorrect sources, illustrating a central concern about LLM hallucinations.Source: §1 · p. 1
• LLM-as-a-Judge may assume generation-time retrieved knowledge is available and does not cover broader grounding tasks such as cross-referencing sources or interpreting ambiguous claims.Source: §1 · p. 2
• 10 percentage points over CiteAgent (Press et al., 2024) under GPT-4o; with DeepSeek-R1, CiteGuard reaches 68.1% accuracy, approaching human performance at 69.2%.Source: §1 · p. 2
• CiteGuard adds retrieval of claim context and searches within paper contents to provide more faithful citation attribution.It can suggest multiple appropriate references.Source: §1 · p. 2
• The authors collect annotations of alternative citations and introduce CiteMulti to explore generalization across domains and long-paragraph scenarios.The contribution describes 50 new samples for CiteMulti.Source: §1 · pp. 2–3

2.1 Problem Formulation

• CiteGuard maps each excerpt to a reference, while human annotations can record multiple valid references unlike CiteME’s single-reference setup.Source: §2.1 · p. 3

2.2 Reference Retrieval

• CiteGuard combines citation-count/relevance search and paper selection with full-text search, snippet search, and source-excerpt context retrieval.Source: §2.2 · p. 3

2.3 Iterative Retrieval

• Each run can suggest one reference; later runs seek additional papers, with selected papers removed from subsequent searches.Source: §2.3 · p. 3

3.1 Benchmarking Citation Attribution for Computer Science Excerpts

• CiteME contains 130 computer-science excerpts, each with one missing citation for the agent to fill.Source: §3.1 · p. 4

3.2 Benchmarking Citation Attribution for Cross-Domain Excerpts

• CiteMulti adds 10 long computer-science paragraphs and 40 single-citation excerpts from biomedical, physics, and mathematics domains.Source: §3.2 · p. 4

3.3 Evaluation Strategies

• Evaluations use CiteAgent-matched hyperparameters and average five runs across closed- and open-source reasoning and non-reasoning models.Source: §3.3 · p. 4

3.4 Difficulty Level Labels

• Single-run correctness defines Easy (22 excerpts: all models correct), Medium (46: more than 3/5), Medium-Hard (39: at most 2/5), and Hard (23: none).Source: §3.4 · p. 4

3.5 Human Assessment

• Suggested alternatives were manually reviewed; at least two expert annotators judged whether they provided equivalent-or-stronger evidence, with 72.7% agreement.Source: §3.5 · p. 4, Table 4 · p. 5

4.1 CiteGuard Accurately Grounds Scientific Claims Through Enhanced Actions

• CiteGuard improves oracle-citation retrieval accuracy by 10% over CiteAgent on CiteME with GPT-4o; DeepSeek-R1 reaches 68.1% accuracy, near the 69.2% human result.In a five-run GPT-4o comparison, CiteGuard averages 45.1% ± 2.7% versus CiteAgent's 35.4% ± 2.3%.Source: §4.1 · p. 5
• CiteGuard’s added retrieval actions let it request more claim context and search paper contents, supporting more flexible citation search than CiteAgent’s read-dependent approach.search_text_snippet can retrieve matches from paper content beyond titles and abstracts and does not require PDF access.Source: §4.1 · pp. 5–6

4.2 CiteGuard Effectively Suggests Alternative Citations

• CiteGuard’s suggested alternative citations show substantial agreement with human evaluations across models, including proprietary and open-source models.The authors report that its suggestions can identify relevant alternative literature beyond the original reference.Source: §4.2 · p. 6

4.3 CiteGuard Can Generalize to Cross-Domain Citation Attribution

• CiteGuard shows potential to generalize citation grounding to cross-domain and long-paragraph scenarios, though its gain over CiteAgent is smaller on CiteMulti than on CiteME.The authors suggest domain-specific distribution shifts and citation-style differences may account for the smaller gain.Source: §4.3 · p. 6

5.1 Effectiveness of Multi-Run

• CiteGuard’s iterative runs consistently improve CiteME accuracy, with diminishing but meaningful gains as iterations increase.For some excerpts, the agent may refuse to suggest a paper after exceeding its action limit when filtered search results are irrelevant.Source: §5.1 · p. 6

5.2 Effectiveness of Each Action

• Enabling either ask_for_more_context or search_text_snippet improves accuracy over CiteAgent, and using both yields CiteGuard’s highest accuracy.search_text_snippet produces a larger individual gain, while the two actions complement each other.Source: §5.2 · p. 6

5.3 Retrieval vs Long-Context

• Replacing targeted retrieval with full-paper reading raises accuracy by 3.07% but uses 2× more tokens in the reported comparison.The choice between retrieval and long context depends on the available token budget.Source: §5.3 · p. 6

5.4 Tradeoffs of Human in the Loop

• In evaluation, ask_for_more_context returns the source-paper paragraph containing the excerpt; for researcher-provided writing excerpts, users would need to supply extra context manually when needed.Removing this action changes performance subtly (2%), and the action set can be adjusted for different use cases.Source: §5.4 · pp. 6–7

5.5 Reasoning vs Non-Reasoning Models

• Both DeepSeek-R1 and Kimi-K2 can produce citations judged correct by humans, despite arriving at different citations.The example contrasts a reasoning model that considers other actions with a non-reasoning model that expresses more confidence in its action.Source: §5.5 · p. 7, Figure 4 · p. 7

5.6 CiteGuard vs Paper Finders

• CiteGuard matches or may surpass AI2 Paper Finder in accuracy; its top-1 accuracy with DeepSeek-R1 exceeds Paper Finder’s top-10 accuracy by 5.4 percentage points.The comparison uses CiteGuard’s top-k results from k separate noniterative runs.Source: §5.6 · pp. 7–8, Table 10 · p. 7

5.7 Cost Analysis

• DeepSeek-R1 averages approximately $0.005 per citation, compared with $0.12 per citation for GPT-4o.The authors characterize CiteGuard’s inference costs as relatively modest and its improvements as not requiring disproportionate cost.Source: §5.7 · p. 8, Table 11 · p. 8

5.8 Alternative Retrieval Pipeline

• CiteGuard can be adapted to alternative retrieval systems, though performance differs with backend capabilities and coverage.The ArXiv backend disabled actions that depended on API features unavailable there.Source: §5.8 · p. 8, Table 12 · p. 8

6.1 Retrieval-Augmented Generation and LLMs for Scientific Research

• Retrieval-augmented generation combines parametric and non-parametric memory and has been explored for mitigating LLM hallucinations and supporting scientific research.The passage discusses RAG-aware fine-tuned models for literature summaries as one such application.Source: §6.1 · p. 8

6.2 Citation Suggestion

• Earlier citation recommendation approaches used information retrieval or neural networks, while LLM-agent workflows can access real-time paper databases.CiteGuard builds on CiteAgent’s retrieval-based citation recommendation setting to provide citation attribution and surface alternative valid references.Source: §6.2 · pp. 8–9

6.3 LLM-as-a-Judge

• LLM-as-a-Judge scales evaluation but can exhibit bias or prompt sensitivity and may require citation snippets unavailable in some settings.This work explores adding retrieval-augmented generation to extend evaluation when relevant snippets are not directly available.Source: §6.3 · p. 9

7 Conclusion and Future Directions

• CiteGuard approaches human performance in retrieving correct citations, while human annotators judge its suggested alternatives relevant.The authors also report promising generalization across domains.Source: §7 · p. 9
• The authors envision CiteGuard as a component of future scientific-writing and review pipelines to mitigate hallucinated citations and promote more trustworthy scholarly literature.They describe faithful attribution as important to scientific communication and accurate contextualization of new findings.Source: §7 · p. 9

Limitations

• CiteGuard’s performance is limited by Semantic Scholar’s database coverage and API retrieval pipeline, and its performance on models under 1B parameters remains unevaluated.The authors identify alternative literature databases and retrieval pipelines, and evaluation on smaller open-source models, as future directions.Source: Limitations · p. 9

Ethical considerations

• The framework uses Semantic Scholar’s API, no private or sensitive data, and voluntary anonymous annotators, while acknowledging unresolved LLM-related geographic and linguistic biases.Future work includes better representation of under-cited or non-English sources.Source: Ethical considerations · p. 9

A.1 Prompts

• The appendix presents CiteGuard’s system prompt and examples for its newly added actions.The prompt materials are shown in Figures 5–8.Source: §A.1 · p. 12

B Examples of CiteGuard Short Trajectories

• Short successful trajectories did not reveal direct ground-truth citation recall; agents instead formed generic queries from technical entities in the excerpt and context.The authors manually selected short trajectories as possible contamination cases and checked whether search terms came directly from the provided text.Source: B Examples of CiteGuard Short… · p. 12

C Difficulty Level Labels

• Difficulty examples range from convolutional-network corruption citations to adversarial filtering, optical flow, and RCA, illustrating Easy through Hard labels.The examples include Medium and Medium-Hard cases as well as Easy and Hard.Source: C Difficulty Level Labels · p. 12

D Human Assessment On CiteGuard Alternative Citations

• The authors’ manual analysis describes these behaviors as typically absent from traditional citation retrieval systems.The analysis refers to Table 2 and Figures 11 and 16.Source: D Human Assessment On CiteGuard… · p. 12
• CiteGuard identifies previous-year work by the same author and suggests peer or related work alongside best-match citations.The paper characterizes these as backward and lateral reasoning, respectively.Source: D Human Assessment On CiteGuard… · p. 12

E LLM-As-A-Judge Failure

• The appendix supplies an OpenScholar judge prompt and illustrates a judge error caused by missing terminology nuances.The failure example is shown in Figure 13.Source: E LLM-As-A-Judge Failure · p. 12

F LLM Generation Failure

• An LLM-generated example omits alternative citations, while CiteGuard can suggest meaningful alternatives; the appendix also gives an example where alternatives are inappropriate.The examples are referenced in Figures 14, 11, and 16.Source: F LLM Generation Failure · p. 13, §G.1 · p. 13

G.2 Retrieval vs Long-Context

• For CiteGuard with GPT-4o, using “read” instead of “find_in_text” can require up to 4x as many tokens because multiple full papers enter context.The comparison is illustrated in Figure 15.Source: §G.2 · p. 13

H Human Annotators

• Human annotators were graduate-level computer science students, and they assessed suggested citations for relevance and sufficiency.Instructions asked them to select suitable citations or choose “None of the above”; an example uses a request for more excerpt context.Source: H Human Annotators · pp. 13–14

I Use of AI Assistants

• The manuscript’s writing used Grammarly, with content critically reviewed and revised by human authors.Source: I Use of AI Assistants · p. 14