Source-linked AI summary
When Auditors Fabricate: Batch-Size Degradation and Confident Hallucination in LLM Detection of Planted Document Contamination
Karan Parekh, Sanjana Pendyala Ravinder, Sana Mhapsekar, Medina Maloku
TL;DR
LLM document auditors may be unreliable when detecting planted errors, especially as workload increases. The paper constructs a contaminated academic corpus and evaluates Gemini 3.0 Pro across workload regimes, finding that large-batch detection collapses into confident fabrication. It concludes that auditing requires bounded batches, direct content injection, and mechanical verification.
Problem
The study addresses limited evidence about whether LLMs safely detect planted document errors when used as quality gates.
Method
The paper plants 450 contaminants in 150 academic papers and evaluates Gemini 3.0 Pro on a 180-contaminant answer-key subset across three batch-size regimes.
Results
Detection collapses at large batch size, with the model producing confident fabricated findings while recovering only 4 of 144 planted contaminants.
Takeaways & Limitations
Reliable LLM auditing requires bounded batch sizes, direct content injection, and mechanical verification of every reported finding against source text.
Takeaways & Limitations
The evaluation used one Gemini 3.0 Pro run per regime, covered 180 of 450 contaminants, and may not transfer to current models.
Abstract
from arXiv · showhide
Large language models are increasingly proposed as automated auditors of document quality, yet their reliability as detectors of planted errors is poorly characterised. We construct a contaminated corpus of 150 academic papers spanning supply chain management and medical research, injecting 450 known contaminants of three types: typographical corruption, semantic reversal, and absurd out-of-context insertion. We then evaluate Google Gemini 3.0 Pro's ability to recover a 180-contaminant answer-key subset across 60 documents under three prompting regimes of increasing scale: single document, small batch, and large batch. Detection holds at small scale and then collapses: 50% recovery on single documents, 60% on small batches, and 2.8% on large batches. The failure mode at scale is not abstention but fabrication. Rather than reporting incomplete processing, the model produced confident findings including invented contaminants of its own, absurdities such as "telepathic squirrel" and "quantum-powered toaster" that mimic the style of the planted material but do not appear in any document. Detection also varies by contamination type: absurd insertions were recovered at 75% in completed evaluations, while semantic reversals and typographical corruptions were each recovered at only 50%. The corruptions most likely to occur in the wild, plausible ones, are the ones most often missed. We conclude that LLM document auditing degrades not gracefully but deceptively, and outline the harness such systems require: bounded batch sizes, direct content injection, and mechanical verification of every reported finding against source text.
1. Introduction
The paper examines whether LLM auditors safely abstain when overloaded or instead fabricate findings. It frames this risk in deployments where model output itself serves as a quality signal.
- Under load, the model generates fluent fabricated audit findings, including invented contaminants styled after the expected material.
- LLM auditing reverses the usual hallucination concern: fabricated findings can corrupt the quality-control process itself.
- The study tests this assumption by planting known contaminants in real academic documents and measuring reported findings as workload increases.
- The paper defines contamination as deliberately planted document defects, distinct from training-data or benchmark leakage.
- The evaluation covers surface typos, semantic reversals, and absurd insertions across 150 academic PDFs containing 450 contaminants.
2. Corpus and Contamination Method
The corpus comprises academic papers from supply chain management and medical and pharmaceutical sciences, with three deliberately planted contamination types per document. Each contaminant was logged against its source text to create an answer key.
- The source corpus contains 150 published academic papers spanning supply chain management and medical and pharmaceutical sciences.
- Each document received three contaminants: one typo, one semantic reversal, and one absurd out-of-context insertion.
- Typographical corruption changes the surface form of a real word, as in “efficency” or “buisness.”
- Semantic corruption reverses a directional claim, such as changing “improvements” to “deteriorations.”
- Every contaminant was recorded with document location and original-versus-replacement text, forming a complete answer key.
- The corpus was exposed through a reference-accessible knowledge base rather than inline document content.
3. Evaluation Protocol
Google Gemini 3.0 Pro was evaluated under single-document, small-batch, and large-batch regimes. Responses were scored against the answer key and additionally rated for audit quality.
- Google Gemini 3.0 Pro was prompted to identify contaminants under three workload regimes.
- The single-document regime evaluated 6 contaminants across one supply chain and one medical document.
- The small-batch regime evaluated 30 contaminants across batches of 7 supply chain documents and 3 medical documents.
- The large-batch regime evaluated 144 contaminants across 48 documents arranged in six batches of 8.
- Responses were matched programmatically against the answer key, with manual adjudication of page and contamination-type mismatches.
- Each contaminant-level response received Likert ratings for usefulness, accuracy, clarity, completeness, and overall satisfaction.
4. Results
Detection deteriorated with larger workloads and became confident fabrication rather than simple omission. Detection also favored conspicuous absurd insertions over plausible typos and semantic reversals.
- 4.1 Detection collapses with batch size: 15/21 (71.4%) supply chain contaminants and 3/9 (33.3%) medical contaminants were recovered in small batches, indicating domain and document effects.
- 4.1 Detection collapses with batch size: In large batches, four of six batches recovered zero contaminants, and no batch recovered more than two of twenty-four.
- 4.2 The failure mode at scale is confident fabrication: The invented contaminants imitated the absurdist genre of the planted items, suggesting generation toward the expected answer style rather than the documents.
- 4.2 The failure mode at scale is confident fabrication: Clarity and coherence scored highest across 180 observations, while accuracy and trustworthiness scored lowest.
- 4.2 The failure mode at scale is confident fabrication: A partial recovery reported “disco dance” for planted “volcano dance,” matching location and genre but not content.
- 4.3 Detection asymmetry by contamination type: Completed evaluations recovered 9/12 (75%) absurd insertions, 6/12 (50%) typos, and 6/12 (50%) semantic reversals.
- 4.3 Detection asymmetry by contamination type: Independent work found 64% recovery of expert-inserted inconsistencies by its strongest model, with every tested model missing roughly half.
5. Discussion and Deployment Implications
The paper proposes a deployment harness that bounds batch size, injects document content directly, mechanically verifies findings, and designs for loud failure.
- Deployment safeguards: Bound batches aggressively because detection was serviceable at 1 to 10 documents but collapsed at 48.The recommendation applies regardless of nominal context capacity.
- Deployment safeguards: Inject document text directly rather than relying on references, which triggered fabrication under the evaluated setup.Direct content removes conditions under which generation followed expectation rather than evidence.
- Deployment safeguards: Mechanically string-check every reported finding against its source before acceptance.Exact matching is inexpensive because each finding claims that a specific string appears in a specific document.
- Deployment safeguards: Design the system for loud failure rather than allowing fabricated audit output to pass as successful processing.The passage introduces this fourth safeguard but is truncated before giving its full implementation.
6. Limitations
The evaluation is limited to one model with one scored run per regime and does not test prompt or temperature variation; its results may not transfer to current models.
- Evaluation scope: The study uses a single model, Gemini 3.0 Pro on the free tier, with one scored run per evaluation regime.No prompt-variation or temperature sweep was performed.
- Evaluation scope: The answer key covers 180 of 450 planted contaminants, while contaminant density remains fixed at three per document, one per type.The remaining planted contaminants were not evaluated.
- Generalisation: Results may not transfer to current models because they reflect model access at evaluation time.The protocol itself is model-agnostic and inexpensive to repeat.
7. Conclusion
The conclusion is that unsupervised LLM auditing is not trustworthy: larger batches produce confident fabricated findings, while plausible corruptions are missed most often.
- Conclusion: Detection collapses with batch size, and the collapse appears as confident output rather than surfaced failure.The conclusion frames this as a trust problem for unsupervised auditing.
- Conclusion: The model invents findings in the genre it expects, including fabricated contaminants that resemble the planted material.This makes fluent audit output unsafe to accept without verification.
- Conclusion: The most plausible corruptions are the least detected, despite being the kinds of errors most likely to occur in practice.The supplied conclusion states the detection asymmetry but does not quantify it here.
- Conclusion: Planted-contamination evaluation is presented as a cheap, repeatable way to measure whether an LLM auditor can be trusted.The paper treats this evaluation as the specification for the harness auditing systems should run inside.