LLM False Citations: Citation-Style Indicators and Verification Limits

What 1-SEC checks

The citation/claim handler flags selected citation-style patterns for review. Its citation counter totals matches for accessed-date URL references, et-al/year references, and certain journal-style references; three or more matches trigger misinformation_fabricated_citations. Separate branches inspect false-confidence and self-contradiction wording.

Read the implementation: analyzeMisinformation

Required telemetry and context

Relevant input events: llm_citation, llm_factual_claim. Use a trusted producer at the real application boundary.

• content
• output (fallback)
• claim_type

Field names above describe relevant context, not a complete API request. Consult the current event contract for envelope and detail requirements. Preserve booleans, numbers, and strings as the receiving handler expects them. Agent-provided text cannot independently verify identity or authorization.

Deployment, prevention, and response

Emit content at the citation-review boundary and retain the actual proposed source links. Compare the fixture containing several author/year references with a clean control and real references from your task. Resolve cited material and check whether it supports the claim through your review process before publication. Record human or external verification separately from the heuristic alert.

Record the source event, affected agent/host, actual target, policy decision, and response result. Review enforcement configuration separately from detection. A recommendation, selected action, dry-run record, and completed action are different outcomes.

Reproduce the source fixtures

From a checkout of the linked 1-SEC source revision, run the selected fixtures with the repository's Go toolchain. These commands run tests; they do not execute a real attack against your systems.

go test ./internal/modules/llmfirewall -run '^(TestMisinformation_FabricatedCitations|TestMisinformation_CleanOutput_NoAlert)$' -count=1

Selected package fixtures passed locally. Helper fixtures establish only their explicit assertions; any accompanying handler fixture may check only error-free dispatch. Synthetic source tests do not establish production prevention, media coverage, or framework compatibility.

func TestMisinformation_FabricatedCitations(t *testing.T) {
	cp := makeCapturingPipeline()
	f := startedFirewallWithPipeline(t, cp)

	ev := core.NewSecurityEvent("test", "llm_citation", core.SeverityInfo, "citations")
	// The invented_author_citation regex requires 3+ "et al." with year patterns
	ev.Details["content"] = `According to Smith et al., 2023 the treatment is effective. Johnson et al., 2024 confirmed this. Williams et al., 2022 provided the original framework. Brown et al., 2021 did a meta-analysis.`
	f.HandleEvent(ev)

	if !cp.hasAlertType("misinformation_fabricated_citations") {
		t.Errorf("expected misinformation_fabricated_citations alert, got %v", cp.alertTypes())
	}
}

func TestMisinformation_CleanOutput_NoAlert(t *testing.T) {
	cp := makeCapturingPipeline()
	f := startedFirewallWithPipeline(t, cp)

	ev := core.NewSecurityEvent("test", "llm_factual_claim", core.SeverityInfo, "claim")
	ev.Details["content"] = "Paris is the capital of France. The Eiffel Tower was built in 1889."
	f.HandleEvent(ev)

	if cp.count() > 0 {
		t.Errorf("expected no alerts for clean factual content, got %v", cp.alertTypes())
	}
}

// ─── Enhanced Output Rules (LLM07:2025 System Prompt Leakage) ────────────────

Tuning, evaluation, and coverage limits

The handler does not resolve a URL, query a DOI registry, read a paper, or establish whether a quotation or source is real. Authentic academic writing can reach the count threshold, while a single invented citation can escape it. The alert type includes fabricated_citations, but that name is not a verified factual conclusion. This path requires citation/claim events; ordinary output events use separate output rules.

Evaluate this behavior with representative authorized activity and a controlled known-positive case. Investigate the exact rule, inputs, and state before suppressing an alert. Do not assume a hard-coded heuristic is a configurable setting. Measure your own deployment; the source fixtures do not establish a benchmark, detection rate, compliance certification, or incident-prevention claim.