PaperlayerView exact revision on arXiv

Source-linked AI summary

Phantom Merge: When Your Large Language Model Agents Pick One but Tell You About Another

Wangshu Zhu, Qianwen Guo, Yushun Dong

arXiv:2610.16141v1cs.AIcs.CL

TL;DR

Multi-entity agents can attribute claims to a committed entity without evidence from that entity, and task success alone may not reveal this grounding error. The paper formalizes Phantom Merge and combines internal risk estimation with evidence-constrained correction. PM appears across all 16 evaluated backbone-domain combinations, including task-correct trajectories, while AGR-slot outperforms the evaluated detection baselines on held-out Shopping claims.

  • Problem

    Existing agent evaluations and factuality methods do not explicitly verify that each claim’s supporting evidence belongs to its referenced entity, despite this being necessary for entity-specific grounding.

    Source: §1 · p. 1

  • Method

    The paper formalizes claim-level Phantom Merge and combines AGR’s representational and Jacobian-based functional readouts with FAC’s fixed-anchor claim auditing and evidence-grounded revision or removal.

    Source: §1 · p. 2, §2 · p. 2, §3.3 · p. 4

  • Results

    PM occurs in all 16 evaluated backbone-domain combinations, and 29.6–55.6% of task-correct trajectories in the PM-enriched Shopping cohort exhibit PM; AGR-slot achieves 96.2% AUROC and 97.3% AUPRC on held-out Shopping claims.

    Source: §5.1 · p. 5, §5.2 · p. 6

  • Takeaways & Limitations

    Task correctness can coexist with incorrectly attributed claims, so it cannot fully capture whether final responses are grounded in the committed entity.

    Source: §5.1 · p. 6

    FAC applies to completed trajectories with recoverable entity commitments and observed entity-specific evidence, and does not correct erroneous initial entity selection or earlier tool actions.

    Source: I LIMITATIONS · p. 23

Abstract

from arXiv · show

LLM agents increasingly operate over multiple entities, where reliable response generation requires not only retrieving relevant evidence but also preserving its association with the correct entity. We identify Phantom Merge (PM), an entity-evidence binding failure in which an agent attributes unsupported claims to its committed entity, potentially even when the task is completed correctly. We formalize PM at the claim level and characterize its prevalence and error subtypes across four agent domains and four backbone families. To address this problem, we propose a two-stage framework for claim-level risk estimation and correction. First, Anchor-Grounded Risk (AGR) combines a representational readout of the agent's pre-emission hidden state with Jacobian-based functional information, providing complementary slot-level and anchor-value risk scores. Second, Fixed-Anchor Correction (FAC) audits flagged claims and selectively revises them using observed anchor evidence or removes them when no supported replacement is available. On the held-out Shopping detection cohort, AGR-slot achieves an AUROC of 96.2% and an average precision of 97.3%, outperforming the evaluated detection baselines. In the end-to-end Shopping mitigation evaluation, FAC reduces trajectory-level PM from 51.4% to 6.2%, with an output-to-original claim ratio of 80.7%. These results demonstrate the prevalence of entity-specific grounding failures and the effectiveness of combining internal risk estimation with evidence-constrained claim correction. Our code is publicly available at https://github.com/LabRAI/PhantomMerge.

1 INTRODUCTION

Reliable multi-entity agents must bind each claim to evidence for the entity it describes, yet an agent can attribute another entity’s evidence to its committed entity. The paper frames this as Phantom Merge and proposes risk estimation and fixed-anchor correction to address it.

1 INTRODUCTION

  • Phantom Merge is an entity–evidence binding failure where a claim attributed to the committed entity lacks support from that entity’s observations.It differs from generic hallucination because the claim may be supported elsewhere in the trajectory.Source: §1 · p. 1
  • Existing evaluations and factuality methods do not explicitly verify that each final-answer claim’s supporting evidence belongs to its referenced entity.Correction methods also generally do not constrain revisions to evidence for the entity already selected by the agent.Source: §1 · pp. 1–2
  • The proposed two-stage framework combines Anchor-Grounded Risk for claim-level diagnosis with Fixed-Anchor Correction for evidence-grounded revision or removal.FAC preserves the committed entity and unaffected claims; high-risk claims are revised when a supported replacement is recoverable and removed otherwise.Source: §1 · p. 2
  • The paper formalizes and characterizes PM across agent domains and backbones, introduces AGR and FAC, and evaluates detection and correction across multiple domains.The reported contributions include testing Shopping detection on claims with non-overlapping quote templates.Source: §1 · p. 2

2 PROBLEM DEFINITION

The paper defines Phantom Merge at the claim level by whether an anchor-attributed claim lacks anchor-specific support and meets one of three source or contradiction conditions. Pure hallucinations are excluded from PM.

2 PROBLEM DEFINITION

  • A claim exhibits Phantom Merge when it lacks anchor-specific support and is supported by another entity, projects a user constraint onto the anchor, or fabricates a value contradicting observed anchor evidence.Cross-Entity Misattribution and Constraint-to-Anchor Projection may co-occur.Source: §2 · p. 2
  • Pure Hallucination is excluded from PM when a claim has no identifiable source and does not contradict an observed anchor value for its attribute slot.Source: §2 · p. 2

3 METHODOLOGY

The method pairs claim-level risk estimation with fixed-anchor correction: AGR combines representational and functional signals, while FAC uses committed-entity evidence to retain, revise, or remove claims.

3.1 OVERVIEW

  • The two-stage framework uses AGR to estimate claim-level risk and FAC to audit flagged claims and correct them with anchor-specific evidence.The functional targets support slot-level and anchor-value scoring configurations.Source: §3.1 · p. 2, Figure 1 · p. 3

3.2 ANCHOR-GROUNDED RISK ESTIMATION

  • AGR estimates claim-level Phantom Merge risk from the agent’s pre-emission hidden state using complementary representational and Jacobian-based functional readouts.The representational readout is a supervised linear probe; functional targets encode attribute slots or values observed for the committed anchor.Source: §3.2 · p. 3
  • AGR-slot combines probe-derived PM odds with slot-level probability mass in log space, requiring no additional weights for its fixed fusion.Slot mass modulates probe evidence rather than indicating PM by itself.Source: §3.2 · p. 4
  • AGR-value combines calibrated representational and anchor-value functional signals, with lower compatibility with the observed anchor value assigned higher functional risk.Its fusion is fitted on held-out data, and it falls back to the representational signal when an anchor-value target is unavailable.Source: §3.2 · p. 4

3.3 FIXED-ANCHOR CLAIM CORRECTION

  • FAC uses a claim-selection gate and functional audit to retain, revise, or remove risky claims, grounding revisions in values observed for the committed anchor.It preserves the committed anchor and completed interaction trajectory while applying corrections to final-answer claims.Source: §3.3 · pp. 4–5

4 EXPERIMENT SETTINGS

The evaluation spans four multi-entity agent domains, with detection and mitigation tested on a held-out Shopping cohort. It compares a range of detection and correction baselines and evaluates multiple PM, detection, and mitigation outcomes.

Benchmark

  • PM characterization covers ShoppingBench and the airline, telecom, and retail domains of τ 3-Bench; detection and mitigation use a held-out Shopping test set of 243 trajectories and 274 claims.The Shopping test set contains 156 PM and 118 correctly bound claims; the τ 3-Bench domains also serve as cross-domain evaluation sets.Source: §4 · p. 5

Baselines

  • Detection comparisons include text-based, classifier, self-checking, factuality, anchor-aware, and AGR-based methods; mitigation comparisons include deletion, RARR, CoVe, and FEVER-style baselines.Mitigation is assessed under both complete-intervention and shared-gate settings.Source: §4 · p. 5

Metrics

  • Evaluation reports trajectory-level prevalence and correctness, claim-level subtype composition, detection metrics, and mitigation outcomes including PM rate and claim retention.Qwen3-32B is the primary backbone; Gemma-4-31B, Llama-3.3-70B, and Mixtral-8x7B are additionally used for characterization, while Qwen3-8B performs deterministic claim rewriting.Source: §4 · p. 5

5 EXPERIMENTAL EVALUATIONS

Across four domains and four backbones, Phantom Merge (PM) appears in both task-correct and unsuccessful trajectories, with varying error subtypes. AGR detects claim-level PM, while FAC reduces it by revising claims when anchor-supported replacements are available and removing them otherwise.

5.1 PREVALENCE AND CHARACTERISTICS OF PHANTOM MERGE

  • PM occurs in all 16 evaluated backbone-domain combinations, ranging from 0.4% for Gemma on Retail to 54.1% for Qwen on Telecom.In the PM-enriched Shopping cohort, 29.6–55.6% of task-correct trajectories still exhibit PM across the four backbones.Source: §5.1 · p. 5
  • Subtype composition varies by domain and backbone: Shopping is dominated by Constraint-to-Anchor Projection (63.3–96.4%), while Telecom and Airline show sharply different backbone-specific profiles.Extreme subtype shares should be read alongside PM prevalence and the number of observed PM claims; Gemma’s 100% Anchor-Slot Fabrication on Retail accompanies only 0.4% PM prevalence.Source: §5.1 · p. 6, Table 1 · p. 6

5.2 DETECTION EFFECTIVENESS AND READOUT ANALYSIS

  • 96.2% AUROC and 97.3% AUPRC: AGR-slot leads evaluated detection baselines on the held-out Shopping cohort.Against DeBERTa-NLI, AGR-slot improves AUROC by 13.3 percentage points and AUPRC by 7.9 points.Source: §5.2 · p. 6, Table 2 · p. 7
  • AGR-slot combines complementary readouts: standalone representational and functional signals reach 88.8% and 89.4% AUROC, while their slot-level combination reaches 96.2%.AGR-value also performs competitively; the gains indicate that similar standalone accuracy can conceal complementary predictive information.Source: §5.2 · p. 7
  • Shopping’s 93 non-overlapping-template test claims yield 95.0% AUROC for AGR-slot, versus 88.2% for the representational readout and 75.6% for TF-IDF.At approximately 91.7% recall, AGR-slot achieves 90.5% precision, compared with 77.3% for the representational readout and 77.7% for AGR-value; Figure 2 shows PM claims generally receiving higher scores.Source: Figure 2 · p. 6, §5.2 · p. 7
  • Across Telecom, Airline, and Retail, the representational readout achieves AUROCs of 0.94, 0.83, and 0.87, respectively, and is more consistently discriminative than the standalone functional readout.AGR-value closely matches the representational readout across these three domains; AGR-slot performs strongest on Shopping.Source: §5.2 · p. 7, Figure 3 · p. 7

5.3 MITIGATION EFFECTIVENESS AND CLAIM PRESERVATION

  • FAC reduces PM while retaining correctly bound claims, but revision is less effective than deletion on Telecom when suitable replacements cannot be recovered.On Shopping, FAC, FAD, and RARR reach the same 5.3% residual PM rate under a shared gate, while FAC preserves 59.3% of original output claims versus 35.8% for FAD and 37.0% for RARR.Source: §5.3 · pp. 8–9, Figure 4 · p. 8
  • With downstream routing fixed, AGR-value and AGR-slot yield PM-free trajectory rates of 96% and 95%, with correctly bound claim retention of 62% and 63%, respectively.The representational readout retains 73% of correctly bound claims at a 91% PM-free trajectory rate.Source: Figure 6 · p. 8, §5.3 · p. 9

6 RELATED WORK

Related work studies agent task performance, factuality verification and correction, and entity binding in model representations. This paper connects those areas through claim-level grounding to a committed entity in multi-entity agent trajectories.

6 RELATED WORK

  • Agent benchmarks assess task completion, interaction correctness, and tool use, while this study examines whether final-response claims remain grounded in observations tied to the already selected entity.Related entity-binding work focuses on whether agent actions target intended entities.Source: §6 · p. 9
  • Factuality methods verify claims against evidence and may correct unsupported content, but multi-entity trajectories also require identifying the committed entity and enforcing its evidence boundary.The paper studies anchor-specific verification and correction while preserving the agent’s original entity commitment.Source: §6 · p. 9
  • Entity-binding and representation studies examine associations, tracking, and latent states; this work combines internal readouts with evidence-grounded intervention over completed multi-entity trajectories.It connects representation analysis to claim-generation risk and correction.Source: §6 · p. 9

7 CONCLUSION

The paper formalizes Phantom Merge and presents AGR for claim-level detection and FAC for evidence-grounded correction. Its evaluations span four domains and four backbone families, with benchmark construction and annotation procedures described for the evaluated cohorts.

7 CONCLUSION

  • Phantom Merge is an entity–evidence binding failure that can occur in task-correct trajectories; AGR combines representational and Jacobian-based functional readouts, and FAC revises or removes flagged claims using anchor evidence.The conclusion reports effective detection and substantial reductions in binding errors while retaining response content.Source: §7 · p. 9

A BENCHMARK CONSTRUCTION AND ANNOTATION

  • The primary Shopping characterization cohort contains 2,000 trajectories selected to emphasize multi-entity scenarios, while each of three τ 3-Bench domain cohorts contains 1,000 sampled trajectories.The held-out Shopping detection set contains 274 claims from 243 trajectories, including 156 PM and 118 correctly bound claims.Source: A BENCHMARK CONSTRUCTION AND ANNOTATION · p. 17
  • Shopping annotations identify the committed anchor and compare anchor-attributed claims with instructions, anchor evidence, and observations from other entities.All 274 held-out detection claims received additional manual review; the test set evaluates PM against correctly bound claims, without a separate PH negative class.Source: A BENCHMARK CONSTRUCTION AND ANNOTATION · p. 17
  • Human quality control audited 50 trajectories per evaluated model–domain cohort of LLM-assisted annotations, with additional review for cohorts showing unusually high PM prevalence.After reconciliation, no disagreements remained in the final PM labels of inspected samples; this is not a preadjudication agreement statistic.Source: A BENCHMARK CONSTRUCTION AND ANNOTATION · p. 17

B AGR IMPLEMENTATION AND READOUT ABLATION

The Shopping readout comparison uses a shared held-out cohort, where AGR-slot outperforms the individual readouts. AGR-value’s anchor-value score is available for only a subset of test claims, with a representational fallback for the rest.

Data partitions

  • The 1,244-claim Shopping dataset is split into 772 training, 198 development, and 274 test instances, with the 970 non-test claims divided among probe fitting, calibration, and fusion fitting.The test set remains unchanged, and parameters and selected thresholds are fixed during test evaluation.Source: B AGR IMPLEMENTATION AND READOUT… · p. 17

Anchor-value availability

  • 48 of 274 test claims have an available AGR-value anchor-value functional score; the other 226 use the calibrated representational branch.All 274 claims contribute to the reported AGR-value metrics.Source: B AGR IMPLEMENTATION AND READOUT… · p. 17

Readout comparison

  • AGR-slot improves AUROC by 7.4 percentage points over the representational readout and 6.8 points over the standalone Jacobian score.AGR-value provides a smaller improvement; the fused configurations differ in both functional target and fusion rule, so the comparison does not isolate either design choice.Source: B AGR IMPLEMENTATION AND READOUT… · p. 18, Table B.2 · p. 18

C DETECTION BASELINES AND COMPLETE RESULTS

On the held-out Shopping cohort, AGR-slot has the strongest reported internal-readout ranking scores, and it maintains an advantage on claims without training-template overlap. The section also reports recall-matched and threshold-selected operating points, alongside implementation and comparison protocols.

C DETECTION BASELINES AND COMPLETE RESULTS

  • 0.9618 AUROC and 0.9730 AP are the AGR-slot scores, exceeding the standalone Jacobian and AGR-value scores on the same 274 test claims.The paired DeLong comparison between AGR-slot and AGR-value yields p = 4.83 × 10^-16; the test does not additionally model within-trajectory dependence.Source: C DETECTION BASELINES AND COMPLETE… · pp. 18–19, Table C.1 · p. 18
  • At approximately 91.7% recall, AGR-slot reaches 90.5% precision, versus 77.3% for the representational readout, 77.7% for AGR-value, and 64.7% for the standalone Jacobian score.These are descriptive test operating points obtained by matching recall; the representational precision differs from its fixed-threshold value.Source: C DETECTION BASELINES AND COMPLETE… · p. 19

C.1 DETECTION BY QUOTE-TEMPLATE OVERLAP

  • 0.950 AUROC on non-overlapping quote-template claims is reported for AGR-slot, compared with 0.882 for the representational readout and 0.756 for TF-IDF.This exploratory analysis uses the specified fingerprint protocol and does not measure all lexical or semantic similarities.Source: §C.1 · p. 19, Table C.2 · p. 19

D DETECTION THRESHOLD SELECTION

  • At the Jacobian operating point, 120 PM claims are detected with no false positives among 118 correctly bound claims; the two AGR-slot thresholds trade precision against recall with similar F1.The observed 100% Jacobian precision is from this finite test cohort; the Df threshold has higher precision and the representational-development threshold higher recall.Source: D DETECTION THRESHOLD SELECTION · p. 20, Table D.2 · p. 20, Table D.1 · p. 20
  • At 0.05, the AGR-value probability-scale operating point yields 61.3% precision, 99.4% recall, and 75.8% F1.This operating point strongly favors recall; the common-threshold protocol also yields recall of 1.000 for TF-IDF, which predicts all 274 test claims as PM.Source: D DETECTION THRESHOLD SELECTION · pp. 19–20

E BASELINE IMPLEMENTATION AND ADAPTATION

  • The baseline implementations distinguish claim-level detection from mitigation, while complete-intervention and shared-gate correction use different intervention protocols.In Shopping FAC, the shared gate is the frozen representational probe at θ = 0.05; end-to-end rewriting uses Qwen3-8B and keeps the committed anchor fixed.Source: E BASELINE IMPLEMENTATION AND ADAPTATION · pp. 20–21, Table E.2 · p. 21

F COMPLETE MITIGATION RESULTS

FAC’s complete-intervention mitigation results vary substantially across the three τ 3-Bench domains, and the reported output-claim ratio measures output volume rather than retention of originally correct claims.

Metric interpretation

  • The output-to-original claim ratio measures output claim count, not retention of originally correctly bound claims, and can exceed one when interventions generate claims.Zero-event bootstrap intervals that collapse to [0, 0] do not establish zero population risk.Source: F COMPLETE MITIGATION RESULTS · p. 21

Complete-intervention results

  • FAC reduces residual PM from 20.1% to 1.1% on Airline and from 3.1% to 0.4% on Retail, but leaves 47.6% on Telecom versus 1.6% for FAD.FAC output-claim ratios are 0.79 on Airline and 0.75 on Retail; the relative value of revision and deletion varies by domain.Source: Table F.1 · p. 21, F COMPLETE MITIGATION RESULTS · p. 22
  • The complete-intervention RARR configuration has an output-claim ratio of 0.00 at reported precision across these domains, so its zero residual PM is paired with content loss.The initial PM rates are 52.4% for Telecom, 20.1% for Airline, and 3.1% for Retail.Source: Table F.1 · p. 21, F COMPLETE MITIGATION RESULTS · p. 22

G REWRITE-BACKEND ABLATION

The Shopping rewrite-backend ablation compares FAC with an adapted RARR backend under complete-intervention and shared-gate settings. The section also reports anchor-aware verification trade-offs and limits FAC to post-trajectory correction with recoverable anchor evidence.

G REWRITE-BACKEND ABLATION

  • Under complete intervention, FAC reduces trajectory-level PM from 51.4% to 6.2% with an output-claim ratio of 0.807; FAC+RARR yields 8.2% residual PM and a ratio of 0.926.Complete-intervention and shared-gate results are reported separately because they use different detection configurations.Source: G REWRITE-BACKEND ABLATION · p. 22, Table G.1 · p. 22
  • Under the shared gate, FAC has 5.3% residual PM and R = 0.593, compared with 9.1% and R = 0.926 for FAC+RARR.At the shared probe threshold, 187 of 274 claims are flagged; 57 enter the copy-rewrite branch and 125 the probe-only deletion branch, and all 57 rewritten claims were manually verified as anchor-supported.Source: G REWRITE-BACKEND ABLATION · pp. 22–23, Table G.2 · p. 22

H ANCHOR-AWARE VERIFICATION

  • Cite-or-drop LLM reaches 79% PM recall with 79% correctly bound claim retention, while the probe gate reaches 92% recall with 63% retention.These verification trade-offs are measured before FAC’s downstream audit and correction.Source: H ANCHOR-AWARE VERIFICATION · p. 23, Table H.1 · p. 23

I LIMITATIONS

  • FAC preserves the committed anchor and cannot correct erroneous initial entity selection or earlier tool actions; revision depends on recovering supporting anchor evidence.The analysis covers completed trajectories with recoverable commitments and observed entity-specific evidence; internal readouts predict risk rather than establish a causal mechanism.Source: I LIMITATIONS · p. 23

Related papers

Loading 2610.16141v1…