PaperlayerView exact revision on arXiv

Source-linked AI summary

HalluTracer: Hallucination Detection via Depth-Averaging Truth Signals

Zhihao Guo, Zonghan Wu, Huan Huo, DaYong Ye, Junwei Zhang, Weiran Yao, Zhiwei Liu, Qingsong Wen, Yilei Shao

arXiv:2608.16353v1cs.CLcs.AI

TL;DR

Hallucination detectors often use isolated components or limited depths, leaving aggregation of truthfulness evidence across the forward pass insufficiently characterized. HalluTracer aggregates pre-decoding signals from every layer and consistently outperforms matched white-box baselines across six models and five benchmarks.

  • Problem

    Existing detectors collapse truthfulness evidence to isolated components or limited depths, while systematic aggregation across all layers remains insufficiently characterized.

  • Method

    HalluTracer reads truthfulness signals at the answer-onset position from every Transformer layer and aggregates them with a depth-averaged statistic.

  • Results

    HalluTracer consistently outperforms matched pre-decoding white-box baselines across six language models and five hallucination benchmarks.

  • Takeaways & Limitations

    The findings recast hallucination detection from selecting a single layer to aggregating truthfulness evidence across depth.

  • Takeaways & Limitations

    Depth aggregation is supported under the Sparse Semantic Separation assumption, including sufficiently decorrelated adjacent probe readouts.

Abstract

from arXiv · show

Even well-aligned large language models confidently generate factually incorrect text, making hallucination a persistent reliability risk in high-stakes deployments. These models nonetheless carry linearly separable truthfulness signals in their internal representations. Existing white-box detectors, however, collapse this evidence to isolated components or a single depth, discarding discriminative information distributed across the full forward pass. We introduce HalluTracer, a detection framework that reads and aggregates truthfulness evidence across every layer of the forward pass before the model emits any answer token. A geometric analysis reveals that the per-layer signals are weakly correlated, so that simple depth averaging suppresses layer-specific noise and captures nearly all linearly accessible information. Across six open-source language models and five hallucination benchmarks, HalluTracer consistently outperforms matched white-box baselines, with gains ranging from one to fourteen points. Collectively, our work recasts hallucination detection from a layer-selection problem into a depth-aggregation problem governed by the geometric sparsity of the truthfulness signal.

1 Introduction

HalluTracer addresses the limited-depth view of truthfulness evidence by reading layer-wise signals at the answer-onset position and aggregating them before decoding. Its design is motivated by the view that truthfulness develops across depth, with weakly aligned readouts making depth averaging effective.

  • Motivation: Existing detectors often reduce internal truthfulness evidence to isolated components or a single depth, leaving distributed information underused.Contrast-Consistent Search requires paired statements and operates at a single depth, while other methods use a few attention heads or one hidden-state layer.
  • Method: HalluTracer extracts one truth logit per Transformer layer from the answer-onset representation, forming a trajectory that records factual commitment across depth.The framework then aggregates these layer-wise scores into a single pre-decoding risk signal.
  • Motivation: Truthfulness is treated as a progressively constructed quantity because feed-forward layers refine predictions hierarchically and residual connections compose representations across successive blocks.This motivates replacing layer-localized analysis with aggregation across the forward pass.
  • Contribution: HalluTracer’s geometry-guided analysis finds that truthfulness readouts are low-energy and weakly aligned across depth, explaining why simple depth averaging can capture nearly all accessible evidence.The paper derives a covariance-aware diagnostic for when depth averaging is effective.

2 Related Work

Prior hallucination detectors range from output-level consistency and uncertainty methods to white-box and internal-access approaches that inspect gradients, activations, or selected representations. Related work also shows that semantic information evolves across model depth, motivating detectors that exploit layer-wise and generation-time dynamics.

  • Output-Level and Internal-State Detection: Output-level methods such as SelfCheckGPT and Semantic Entropy score response consistency or uncertainty but require multiple samples and substantial decoding cost.These approaches are often applicable in black-box settings.
  • Output-Level and Internal-State Detection: HalluGuard uses gradient geometry over the full generated response, gaining a richer information budget while operating after answer emission.This contrasts with methods that inspect internal states before generation completes.
  • Output-Level and Internal-State Detection: Internal-access methods include unsupervised latent truth directions, targeted layer interventions, and classifiers applied to selected hidden states, attention heads, or terminal representations.These approaches are associated with Burns et al., Li et al., and follow-up work cited in the passage.
  • Cross-Layer Dynamics: Mechanistic interpretability finds that semantic properties are refined across depth, with feed-forward layers acting as key-value memories and the residual stream communicating across blocks.The logit lens and its learned variant further reveal how token predictions sharpen across layers.
  • Cross-Layer Dynamics: Hallucination methods exploit depth or generation-time dynamics, including DoLa’s contrast of layer-wise vocabulary logits during decoding.The passage presents this as part of a broader line of cross-layer hallucination-detection work.

3 Method

HalluTracer extracts truthfulness signals at the answer-onset position from every Transformer layer, forming a pre-generation logit trajectory. Its depth averaging is motivated by near-orthogonal probe directions and weak residual correlations, which suppress layer-specific noise while retaining dominant class signal.

  • Trajectory construction: At each layer, a supervised affine probe maps the answer-onset readout to a scalar truth logit, and stacking these logits forms a depth-wise trajectory.The answer-onset position is the final prompt token before answer generation, so the trajectory is available before any answer token is emitted.
  • Trajectory construction: The trajectory is a depth-wise trace of one inference graph’s latent internal state, rather than a sequence over generated tokens.Across the data distribution, trajectory-level discriminative power depends on class-conditional geometry, common-mode variance, and probe-direction structure.
  • Geometric motivation: Probe isotropy predicts near-orthogonal adjacent-layer coordinate frames, with residual cross-layer correlations decaying rapidly after removing each sample’s depth-averaged common mode.The framework treats probe isotropy as an empirical prediction of the perturbative quiet-subspace model, verified across all models in Table 2.
  • Detector design: Depth averaging captures the dominant shared level signal, while suppressing residual noise; centred increments instead produce shape statistics that function as high-pass filters.A single well-chosen layer already captures most of the shared signal, whereas averaging improves robustness by suppressing layer-specific residuals.
  • Detector design: The Fisher analysis supplies estimable diagnostics certifying when uniform averaging loses little relative to the population-optimal linear score, without universally prescribing uniform averaging.The diagnostics quantify whether shape coordinates are discriminative and whether the shape component contributes substantially to the signal.

4 Experimental Validation

HalluTracer is evaluated across five hallucination benchmarks and six language models, where it outperforms matched-budget white-box baselines. Structural and ablation analyses support sparse, weakly correlated layer signals and the sufficiency of depth-averaged means.

  • Datasets and Models: Evaluation spans five hallucination and factuality benchmarks across six models from the LLaMA and Qwen2.5 families.The benchmarks are TruthfulQA, TrueFalse, HaluEval2, HELM, and Agentic; models range from 7B to 72B parameters.
  • Baselines and Results: HalluTracer uniformly achieves the highest AUROC and AUPRC among matched-budget baselines, with AUROC gains ranging from one to fourteen points.The matched-budget baselines are Fact-Probe, ITI-Probe, and IRIS; HalluGuard is a post-generation cross-regime comparison with a richer information budget.
  • Sparse Signal Validation: Each probe direction captures less than 0.37% of covariance energy, while the Chen–Qin energy ratio remains below 9%, supporting genuine but low-energy class separation.The top-90% variance-subspace projection remains below 0.22 for five of six models.
  • Probe Isotropy Validation: Adjacent probe cosines fall in [0.05, 0.09], closely tracking the random-baseline prediction and supporting weak residual correlations underlying depth averaging.A formal t-test finds no significant deviation from the random baseline.
  • Mean Sufficiency: The trajectory mean matches full 5D diagnostics within |∆| < 0.5 pp, whereas removing it reduces AUROC by more than 19 pp across three datasets.Replacing the mean with the trajectory median causes a consistent but negligible loss of ≤0.2 pp.
  • Mechanistic Decomposition: The State group alone recovers full 13D AUROC to within 0.5 pp, while the Friction group is insufficient in isolation.The State group contains low-frequency trajectory anchors such as zone-level means and the endpoint difference.

5 Conclusion

HalluTracer replaces layer selection with depth aggregation for pre-decoding hallucination detection, using depth-averaged truthfulness signals to suppress layer-specific noise. It consistently outperforms matched pre-decoding baselines across six LLMs and five benchmarks, while requiring generation-time monitors for hallucinations introduced during decoding.

  • Contribution: HalluTracer replaces layer selection with depth aggregation in a pre-decoding hallucination detector.Its depth-averaged mean uses per-layer truthfulness probes that are low-energy and nearly orthogonal.
  • Geometric insight: 2–4% SNR is the evaluated-regime improvement that population-optimal linear reweighting would add over HalluTracer’s parameter-free statistic.A covariance-aware Fisher identity certifies that the additional gain is limited.
  • Results and extensions: Across six LLMs and five benchmarks, HalluTracer consistently outperforms matched pre-decoding baselines, with the largest gains on challenging tasks.Because it reads propensity signals at answer onset, it should be paired with generation-time monitors for hallucinations introduced during decoding; proposed extensions include streaming trajectory monitors and training-time objectives for factual trajectory stability.

A Implementation Details · A.1 Probe Training and Head Selection · A.2 Baseline Implementation Details

The implementation defines HalluTracer’s scalar trajectory-mean feature, trains layer-wise probes with standardized activations, selects one head per layer, and evaluates baselines under matched cross-validation procedures. Capacity and generalization are addressed through the scalar bottleneck and cross-domain evaluation.

  • A Implementation Details: HalluTracer uses the trajectory mean ¯L as its single scalar detector feature, while four trajectory-shape statistics serve only as ablation controls.Source-level diagnostics provide a 13-dimensional mechanistic-verification vector, and the full-trajectory baseline retains raw per-layer logits, first differences, and summary statistics.
  • A Implementation Details: The downstream classifier is a two-parameter affine map over ¯L, whereas the full pipeline trains m layer-wise probes with dh + 1 parameters each.The scalar trajectory mean forms an information bottleneck, and the study complements this capacity argument with evaluation across 18 topically disjoint sub-datasets.
  • A.1 Probe Training and Head Selection: At each layer–head coordinate, ℓ1-regularized logistic regression separates balanced factual and hallucinated latent states after strict training-partition standardization.The probes operate on answer-onset activations hl,k at the final prompt-token position in an m-layer, K-head autoregressive Transformer.
  • A.1 Probe Training and Head Selection: Each layer contributes one selected head, chosen by training-set AUROC for separating factual and hallucinated activation populations.The resulting positively rescaled parametrization preserves head-selection AUROC and fixes the observable’s geometric scale.
  • A.1 Probe Training and Head Selection: Per-head AUROC is near-constant across heads, with CV < 0.08, and full residual-stream probes produce equivalent results.Thus, selecting one head per layer is an engineering convenience rather than a theoretical necessity, consistent with the signal sparsity hypothesis.
  • A.2 Baseline Implementation Details: All baselines use stratified 5-fold cross-validation, group-disjoint splits, three random seeds, and per-fold Youden’s J thresholding on the training partition.ITI-Probe trains liblinear logistic regression with C = 1.0 at every standardized layer–head coordinate, selects the globally best head by training-set AUROC, and ensembles three bootstrap probes.

B Readout Position Ablation

The ablation tests whether aggregating representations across multiple prompt positions improves on the primary answer-onset readout. Table 4 compares Last-1 with broader pooling strategies across three benchmarks.

  • Readout position: The primary readout uses the final prompt token immediately preceding generation at every layer.This answer-onset position is denoted t⋆ and forms the Last-1 condition.
  • Readout position: Table 4 compares Last-1 against mean pooling over the final 4, 8, or 16 prompt tokens.These alternatives test whether broader spatial aggregation over the prompt recovers additional discriminative signal.
  • Evaluation: The ablation is averaged across HaluEval2, TrueFalse, and HELM, with drops reported in percentage points relative to Last-1.Additional comparison categories include mean or max pooling over all valid tokens and content-word-only pooling.

C Readout Mechanism Ablation … E Complete Feature Definitions

The ablations show that HalluTracer’s trajectory-mean detection is largely invariant to readout and head selection because within-layer heads provide redundant views of a low-dimensional truthfulness signal. The theoretical scope distinguishes exact Fisher-based identities from empirically supported stochastic approximations, while the feature-definition section catalogs trajectory and source-level diagnostics.

  • C Readout Mechanism Ablation: Residual-stream and per-head readouts yield statistically equivalent Mean (1D) AUROC on HaluEval2 and TrueFalse, while residual-stream probes gain approximately 2 percentage points on HELM.The results attribute the readout robustness to trajectory geometry rather than to a particular readout mechanism.
  • C.1 Head Signal Uniformity: Per-head probe AUROC varies little within layers (CV < 0.08), while the layer-best head changes at nearly every layer (switch rate ≥96%).No head is layer-best more than 3/m times.
  • C.1 Head Signal Uniformity: A single head per layer (Top-1) matches Top-5, and Random-1 remains within 0.5 percentage points of Top-1 across all conditions.The random-head result indicates that head identity has negligible impact on downstream detection performance.
  • C.1 Head Signal Uniformity: Within-layer probe scores are highly correlated (mean Pearson correlation ≥0.65) and have low effective rank (≤18% of H), indicating redundant rather than complementary readouts.The corresponding near-degeneracy explains the negligible gain from ensembling multiple heads.
  • D Theoretical Scope and Approximation Hierarchy: The framework’s exact results include the W/K decomposition and the covariance-aware Fisher gap decomposition for arbitrary positive-definite within-class covariance Στ.The Fisher diagnostics θ, χ, and t are directly estimable from trajectory data.
  • D Theoretical Scope and Approximation Hierarchy: Probe isotropy and SNR dominance are first-order stochastic claims supported empirically, whereas decorrelation—not literal independence—underlies the approximation hierarchy.The independent-residual analysis is presented only as intuition; empirical near-optimality relies on the exact Fisher identity and estimated diagnostics.
  • E Complete Feature Definitions: The complete feature definitions enumerate trajectory diagnostics, including the detector scalar ¯L and four ablation controls, alongside source-level diagnostics from the W/K decomposition.These source-level diagnostics support mechanistic verification.

E.1 Trajectory Diagnostic Definitions … F SNR Dominance: Proof and Empirical Verification

The paper defines trajectory-shape diagnostics and source-level feature groups while showing that the full-depth mean preserves nearly all discriminative information. A high-dimensional full-trajectory representation serves as an empirical ceiling for evaluating these compressed statistics.

  • E.1 Trajectory Diagnostic Definitions: The deployed detector uses the full-depth mean, while recognition and output zones are reserved for trajectory-shape controls and source-level ablations.The recognition zone and output zone are fixed by Eq. (15).
  • E.1 Trajectory Diagnostic Definitions: The trajectory diagnostics comprise an OLS global gradient, output-minus-recognition zone shift, total variation, and range.These summarize trend, coarse zone contrast, oscillatory roughness, and trajectory amplitude.
  • E.1 Trajectory Diagnostic Definitions: |∆| < 0.5 pp: the mean alone matches the full 5D configuration, whereas removing it collapses AUROC by >19 pp.The four shape controls therefore test whether higher-order trajectory structure adds discriminative information.
  • E.2 Source Feature Formalisation: The source-level ablations use fixed recognition-zone and output-zone windows as reproducible feature-engineering index sets.The recognition zone spans ⌊m/3⌋≤l < ⌊3m/4⌋, and the output zone spans ⌊3m/4⌋≤l ≤m−1.
  • E.2 Source Feature Formalisation: The 13 source diagnostics cover state anchors, kinematic decomposition, friction coefficients, and output-zone state.They include trajectory means and endpoints, drift and diffusion statistics, energy ratios, friction, conditioning, and terminal probe states.
  • E.2 Source Feature Formalisation: Near-identical performance to the full representation: systematic group ablation retained all four source-feature categories for mechanistic interpretability.The retained categories are state anchors, kinematic decomposition, friction coefficients, and output-zone state.
  • E.3 Full Trajectory Baseline: 2m + 5 dimensions: the full trajectory baseline concatenates raw logits, first differences, and six summary statistics.It is model-dependent and preserves raw per-layer information without compression, yielding examples such as 69D for 32-layer models and 61D for 28-layer models.

F.1 Proof of Proposition 3.5 … F.6 Depth Subsampling Ablation

The appendices prove that depth averaging is near-optimal under level-dominant trajectory geometry, with covariance-aware diagnostics and experiments showing negligible oracle gains. Ablations further find that the mean outperforms or matches nonlinear location estimators and that most depth benefits arrive within roughly 8–16 layers.

  • F.1 Proof of Proposition 3.5: For model depths m ≥28, the simplified slope-to-mean SNR formula overestimates the exact ratio by below 0.13%, making it conservative for the trajectory-mean conclusion.The empirical overestimation is below 0.07%.
  • F.1 Proof of Proposition 3.5: The trajectory mean dominates centered zero-sum filters in the level-dominant regime, γρshape ≪1.The bound covers all zero-sum linear combinations, including slope and zone contrast.
  • F.2 Proof of Theorem 3.6: When θ ≪1 and χ ≪1, the Fisher ratio reduces to 1 + O(χ2 + θ), establishing near-optimality of uniform averaging.The covariance-aware identity separates covariance-normalized shape energy from level-shape coupling.
  • F.3 Empirical Verification: |ηplugin −1| < 0.01 across all 18 model×dataset conditions, confirming that covariance-aware theory explains observed slope-vs-mean behavior.The verification spans 6 models from 7B–72B parameters and 3 dataset families.
  • F.3 Empirical Verification: RFisher ∈[1.021, 1.039] across three models, so the best linear aggregation improves over the trajectory mean by at most 2–4% in SNR.This certification uses the exact covariance-aware identity rather than an isotropic-residual approximation.
  • F.4 Cost-Benefit Tradeoff of Fisher-Optimal Aggregation: The Fisher-optimal score gains at most 2–4% in SNR but requires calibration data, O(Nm2) covariance estimation, O(m2) space, and O(m3) factorization.Its weights are distribution-specific, whereas the uniform mean transfers without recalibration and remains O(m).
  • F.5 Location Estimator Ablation: Mean vs. Median: The mean outperforms the median by 0.1 to 0.3 pp AUROC across all nine conditions, while the 10%-trimmed mean provides no additional benefit.The theoretical median efficiency under Gaussian layer noise is ARE = 2/π ≈0.637.
  • F.6 Depth Subsampling Ablation: AUROC increases strictly with meff in all nine conditions, but more than 80% of the single-layer-to-full-depth improvement arrives by meff = 8 and performance saturates within ∼0.5 pp by meff ≈12–16.The pattern matches σɛ/√meff variance reduction and an empirically ∼8-layer decorrelation length.

G Low-Dimensional Path-Statistics Approximation … H.6 Quantitative Bound on Probe Quasi-Independence

The paper reduces trajectory-level hallucination detection to a small set of macroscopic path statistics and develops a geometric account of sparse, weakly aligned truthfulness signals across layers. Empirical and theoretical analyses support additive increment decomposition, probe quasi-independence, and robust cross-model signal separation, while identifying limits of exact information preservation and diagnostic-channel independence.

  • G Low-Dimensional Path-Statistics Approximation: Under a Gaussian increment model, the trajectory log-likelihood ratio reduces exactly to an affine function of cumulative increment, endpoint drift, and path roughness statistics.The trajectory mean captures the level component, while endpoint drift and volatility arise from the centered increment model.
  • H.1 Exact Additive Decomposition of Trajectory Increments: The exact increment identity ΔL_l = W_l + K_l separates intrinsic displacement from readout change, including probe-frame rotation and head switching, for all Euclidean observation spaces.W_l evaluates a frozen probe across adjacent layers, whereas K_l absorbs readout changes and head-switch contributions.
  • H.2 Empirical Refutation of Covariance Asymmetry: Both classes have comparable covariance geometry: effective-rank ratios are approximately 0.24, total-variance ratio is approximately 1.05, and cos^2(v_l, f) < 0.01.These findings empirically refute isotropic hallucinated covariance and indicate that classical Fisher discrimination fails in this regime.
  • H.3 Formal Derivation: Sparse Coordinate Distributions: Truthfulness is modeled as a sparse, low-energy directional signal embedded within a dominant orthogonal nuisance subspace, with probe energy below 0.37% across six models versus a 0.78% random baseline.Increment covariance exhibits comparable sparsity, which is an additional empirical regularity rather than a consequence of activation sparsity alone.
  • H.4 Analytical Properties of the Increment Components: Across models, the median κ_Δ,l remains below 1.5 and the 95th percentile below 3.9, while factual directional variance exceeds hallucinated variance in at least 90% of midlayers.The variance asymmetry is an unexploited second-order cue, and smooth probe evolution can make W_l and K_l empirically correlated despite their distinct geometric directions.
  • H.5 Cross-Model Empirical Validation: 0.51–0.67 is the cross-model range for increment-level Cohen’s d, while probe signal ratios exceed 1.0 and decoupling norms range from 0.47 to 0.61.Probe-free analyses find raw mean-shift norms of 0.07–0.32, corrected energy ratios of 3.5%–8.7%, and significant mean separation across virtually all intermediate layers.

H.7 Statistical Verification of Probe Isotropy

The paper experimentally verifies the isotropy assumption underlying Proposition H.7 using fixed-head probes and three complementary statistical tests across four models. Results support ambient-dimensional isotropy, gap independence, and stronger-than-conservative pairwise independence for depth aggregation.

  • Methodology: Fixed-head probes place all per-layer direction vectors in a common activation subspace, making their inner products geometrically comparable.A single attention head is selected, and each layer’s ℓ1-regularised logistic-regression coefficient is mapped back to raw activation space.
  • Test 2: Gap Independence: No model shows significant gap trends (ptrend ≥0.086) or across-gap mean differences (pANOVA ≥0.304) for gaps k = 1, . . . , 9.These results support the absence of memory effects between layers under the gap-independence test.
  • Test 3: Permutation Test: p ≥0.059: Across all four models, real probe inner products are statistically indistinguishable from random vectors on the ambient sphere S_dh−1.The permutation test compares real adjacent inner products with 10,000 random-vector sets on ambient- and effective-rank spheres.
  • Implications for Depth Aggregation: 4.3 improvement: For Qwen2.5-7B, reff/dh ≈0.23 implies pairwise independence is 4.3 times stronger than the reff-based prediction.For other models, the reff-based prediction remains a conservative upper bound on adjacent-probe correlation, while the ambient-dimension model is tighter and most clearly supported by Qwen2.5-7B.
  • Permutation-Test Results: The ambient-sphere null is not rejected at α = 0.05 for any model, while the stable-rank null is rejected only for Qwen2.5-7B (p = 0.036).The table-level results support the isotropy property required by Proposition H.7.

I Exact Parametrisation of Readout Mismatches · J Discussion: Scope, Limitations, and Theoretical Grounding

The exact decomposition of K_l separates probe, metric, head-switch, and bias effects, showing that probe-frame drift carries most discriminative information while other terms contribute label-weak nuisance variance. Empirically, the reconstruction is exact to machine precision, and probe drift explains 93% of the chance-corrected AUC gap on average.

  • I Exact Parametrisation of Readout Mismatches: K_l arises from evaluating the layer-(l+1) answer-onset representation under adjacent probe geometries and incorporates the selected-head switch.Each layer selects its own attention head, so the readout mismatch includes both probe-geometry and head-switch contributions.
  • I Exact Parametrisation of Readout Mismatches: Lemma I.1 gives an exact four-way decomposition of K_l into probe, metric, head, and bias components.The identity holds for every sample and every layer transition.
  • I Exact Parametrisation of Readout Mismatches: The four components represent basis rotation, standardisation-induced rescaling, selected-head switching, and decision-threshold shift, respectively.These terms isolate algebraically distinct mechanisms in the readout mismatch.
  • I Exact Parametrisation of Readout Mismatches: < 2 × 10−13 reconstruction error verifies the decomposition to machine precision across all evaluated conditions.The empirical validation evaluates the decomposition out-of-fold across three models and three benchmarks.
  • I Exact Parametrisation of Readout Mismatches: 93% of the chance-corrected AUC gap is recovered by probe drift on average, ranging from 86–105% across conditions.Probe drift therefore accounts for the large majority of the full K_l discriminative content.
  • I Exact Parametrisation of Readout Mismatches: 17% and 22% of the chance-corrected AUC gap are explained by the metric-drift and head-change terms, respectively, despite their larger marginal variances.Their standalone label alignment is substantially weaker than probe drift’s.
  • I Exact Parametrisation of Readout Mismatches: Cov(K_metric, K_head) < 0 across all conditions causes mutual cancellation, inflating individual variances while weakening net class-discriminative contribution.The anti-correlation explains why metric-drift and head-change terms can have large variance without strong label alignment.
  • I Exact Parametrisation of Readout Mismatches: The geometric model identifies probe-frame drift as the signal-carrying subspace, while standardisation and head-switch effects are predominantly label-weak nuisance variance.The W/K separation distinguishes layers constructing factual commitments from layers undergoing implementation-level readout-frame changes.

J.1 Scope of Pre-Decoding Detection · J.2 Probe Generalisation · J.3 Societal Impacts

HalluTracer operates before answer-token emission, targeting answer-onset factuality signals rather than hallucinations produced during generation. Its generalisation is supported by cross-domain evaluation and probe-free geometric verification, while its deployment benefits coexist with explicit scope and adversarial risks.

  • J.1 Scope of Pre-Decoding Detection: Pre-decoding detectors read internal states before any answer token, with the readout position determined solely by the prompt and no generated text observed.This regime is shared by ITI-Probe, Fact-Probe, and IRIS.
  • J.1 Scope of Pre-Decoding Detection: Generative hallucinations from snowballing, attention drift, or multi-step reasoning failures are outside the method’s detection scope because they require the generated token sequence.
  • J.1 Scope of Pre-Decoding Detection: Each evaluation analyzes one query–response pair at the answer-onset position, rather than factuality across multiturn dialogue.This matches prior representation-based detectors including ITI, FACT-Probe, and IRIS.
  • J.1 Scope of Pre-Decoding Detection: Entity-level errors, confident confabulation, and some multi-step-task failures are captured by answer-onset representations before emission.Confident confabulation is associated with a low-mean, high-volatility trajectory signature.
  • J.1 Scope of Pre-Decoding Detection: Pre-decoding detection enables real-time intervention without additional decoding or sampling and is compatible with speculative decoding and early-exit architectures.Comparisons with post-generation detectors such as HalluGuard involve different information budgets and regimes.
  • J.2 Probe Generalisation: Generalisation is assessed across 18 topically disjoint sub-datasets spanning HaluEval2 domains, TrueFalse entity categories, and HELM source-model distributions.Stable performance across these semantic shifts argues against topic-specific overfitting.
  • J.2 Probe Generalisation: Probe-free Chen–Qin two-sample tests and bias-corrected energy estimators agree with probe-derived measurements, supporting intrinsic class separation in activation geometry.The pipeline’s rank-1 probes and two-parameter terminal classifier also impose an effective information bottleneck.
  • J.3 Societal Impacts: The framework may improve reliability in safety-critical healthcare, legal, and financial deployments through latency-compatible intervention before unfaithful content reaches users.Risks include scope misunderstanding and adversarial evasion, so deployment should communicate coverage boundaries.
Loading 2608.16353v1…