Temporal Multi-Signal Fusion for Token-Level Hallucination Detection

arXiv:2608.181152026-08-20

识别AI编造的内容,不能只看单个词,要看上下文的连续变化

现有的逐词幻觉检测方法各自独立给每个词打分,结果在模型自信地说错话时反而失灵。这篇论文把幻觉看作跨越多个词的一段连续区间,用融合了文本统计、自然语言推理(NLI)蕴含关系和语言模型意外度(surprisal)这33维特征的序列,交给一个双向门控循环单元(BiGRU)模型来判断。结果在RAGTruth基准上取得0.840的AUC,比逐词独立打分的基线高出11个百分点,其中44%的提升来自对词序(时间顺序)的建模。

METAL MEDIA 解读图

识别AI编造的内容,不能只看单个词,要看上下文的连续变化

01现有逐词幻觉检测器把每个词独立打分,恰恰在模型自信却说错的情况下失效。
02研究者为每个词提取33维特征,融合文本统计、自然语言推理(NLI)蕴含概率和语言模型意外度(surprisal),再交给能双向读取上下文的BiGRU序列模型。
03该方法不依赖生成模型内部信息,仅用生成文本和外部信号,在RAGTruth数据集上取得0.840的AUC,比独立打分的逻辑回归基线(0.730)高出11个百分点(10次随机种子实验,p=0.002)。
04对提升来源的拆解显示,词序(时间顺序)贡献44%,整体序列聚合贡献24%,模型非线性能力贡献32%。
05在训练时从未见过的语言模型生成的文本上测试,准确率下降不到4%;而将条件随机场(CRF)模型的打分方式换成前向-后向边缘概率后,AUC最多提升17.9个百分点。

这是 METAL MEDIA 制作的解读图，并非论文作者提供的原图。

他们做了什么

现有逐词幻觉检测器把每个词独立打分,恰恰在模型自信却说错的情况下失效。
研究者为每个词提取33维特征,融合文本统计、自然语言推理(NLI)蕴含概率和语言模型意外度(surprisal),再交给能双向读取上下文的BiGRU序列模型。
该方法不依赖生成模型内部信息,仅用生成文本和外部信号,在RAGTruth数据集上取得0.840的AUC,比独立打分的逻辑回归基线(0.730)高出11个百分点(10次随机种子实验,p=0.002)。
对提升来源的拆解显示,词序(时间顺序)贡献44%,整体序列聚合贡献24%,模型非线性能力贡献32%。
在训练时从未见过的语言模型生成的文本上测试,准确率下降不到4%;而将条件随机场(CRF)模型的打分方式换成前向-后向边缘概率后,AUC最多提升17.9个百分点。

Table 1: Positioning on RAGTruth. †Span F1. ‡10 seeds. §0.73 = the published Lookback Lens (LogReg) classifier; 0.838 = the same attention features under our BiGRU sequence model. Both use a Qwen3-14B proxy on the open-LLM subset; see §5.9 for the full fair comparison.
Method	Access	Metric	Score
ReDeEP	Activations	AUC	0.733
RagtStacking	Activations	AUC	0.836
Lookback Lens§	Attention	AUC	0.73 / 0.838
LettuceDetect	Black-box	Span F1†	0.589
RL4HS	Black-box	Span F1†	0.583
HaluGate	Black-box	Token F1	0.590
Ours (BiGRU)	Black-box	AUC‡	0.840±.007

Table 2: Per-token feature groups.
Group	Signals	Dim
Text	Surface, overlap, running statistics	20
NLI	Entailment scores + temporal derivatives	7
LM	Surprisal, rank + fallback handling	6
	Total	33

Table 3: Sequence labeling architectures. All models use h=64. CRF variants use forward-backward marginals for ranking (Section 5.10).
Model	Temporal scope	Params
LogReg	None (per-token)	34
MLP	None (per-token)	112K
1D-CNN	Local (kernel ≤7)	61K
BiGRU	Full sequence	121K
BiLSTM	Full sequence	121K
Transformer	Full sequence (attention)	106K
BiGRU-CRF	Full + transitions	121K
BiLSTM-CRF	Full + transitions	121K

Table 4: Research questions and corresponding experiments.
RQ	Experiments
RQ1: Temporal	Main ablation (Section 5.1),
dependencies	decomposition (5.3),
	directional ablation (5.4)
RQ2: Multi-signal	Signal ablation (Section 5.1),
fusion	pointwise baselines (5.5),
	Lookback comparison (5.9)
RQ3: General-	Cross-model (5.7),
ization	cross-dataset (5.8)

Table 5: Token-level AUC and F1 on RAGTruth test set. CRF models use softmax scoring; see Table 12 for forward-backward results.
Model	Text Only	All Signals
AUC	F1	AUC	F1
LogReg	0.702	0.133	0.730	0.141
1D-CNN	0.788	0.208	0.807	0.216
BiLSTM	0.826	0.227	0.843	0.247
BiGRU	0.832	0.232	0.845	0.242
Transformer	0.802	0.233	0.804	0.229
BiGRU-CRF	0.806	0.196	0.630	0.245
BiLSTM-CRF	0.603	0.188	0.781	0.164
Trans-CRF	0.668	0.235	0.691	0.227

Table 6: Mean ± std across 10 seeds (all signals). MLP is a capacity-matched token-independent baseline (112K parameters ≈ BiGRU’s 121K).
Model	AUC	F1	AP
LogReg	.730±.001	.141±.000	.093±.001
MLP	.765±.002	.176±.003	.127±.002
1D-CNN	.813±.002	.218±.004	.197±.005
BiLSTM	.835±.008	.242±.008	.270±.017
BiGRU	.840±.007	.257±.010	.282±.018
Transformer	.819±.008	.246±.009	.234±.012

Table 7: Controlled decomposition of BiGRU’s advantage over LogReg (10 seeds, all signals).
Model	Adds	AUC	Δ
LogReg	Per-token, linear	.730	–
MLP (112K)	Nonlinear capacity	.765	+3.5 (32%)
Shuffled BiGRU	Seq. aggregation	.791	+2.6 (24%)
BiGRU	Temporal order	.840	+4.9 (44%)

Table 8: Directional ablation (10 seeds, all signals).
Model	AUC	Avg Precision
ForwardGRU	.802±.008	.217±.014
BackwardGRU	.817±.005	.223±.015
BiGRU	.840±.007	.282±.018

Table 9: Individual features as standalone detectors.
Signal	Method class	AUC	AP
LM entropy	Token entropy	.551	.047
LM log-prob	Perplexity	.549	.046
NLI contradiction	NLI-based	.639	.087
NLI entailment drop	Entailment check	.641	.066
Context overlap	Lexical overlap	.597	.054
Running novelty	Novelty tracking	.616	.055
LogReg, all 33 features	.730	.103
BiGRU, all 33 features	.840	.282

Table 10: Cross-dataset transfer (mean ± std, 10 seeds, all signals).
Model	R → P	P → R
AUC	F1	AUC	F1
LogReg	.618	.712	.692	.161
BiGRU	.634	.709	.744	.185
Transformer	.624	.719	.703	.144

Table 11: Fair comparison on the open-LLM subset of RAGTruth (5 seeds). Combined = our 33-dim + Lookback features.
Features	Model	AUC	AP
Proxy: Qwen3-14B
Lookback only	BiGRU	.838±.015	.368
Combined (193-dim)	BiGRU	.866±.007	.425
No attention access
Ours only (33-dim)	BiGRU	.819±.013	.298

Table 12: CRF scoring: softmax vs. forward-backward (FB) marginals. Softmax values differ from Table 5 because CRF softmax scores are unstable across seeds (see text).
Model	Softmax	FB	Δ
BiGRU-CRF	0.666	0.845	+0.179
BiLSTM-CRF	0.785	0.807	+0.022
Trans-CRF	0.741	0.818	+0.077

Table 13: Complete list of 33 per-token features. The “Context” column indicates whether the feature encodes temporal information: point = depends only on the current token; cumul = cumulative statistic up to position t; window = sliding window average/max; delta = finite difference between adjacent positions; sent = sentence-level (projected to all tokens in the sentence).
#	Group	Feature	Context
1	Text	Word length (/20)	point
2	Text	Is numeric	point
3	Text	Is capitalized	point
4	Text	Absolute position t	point
5	Text	Relative position t/(T−1)	point
6	Text	Unigram overlap 𝟏[wt∈C]	point
7	Text	Bigram overlap	point
8	Text	Trigram overlap	point
9	Text	Entity indicator	point
10	Text	Cumulative overlap ratio	cumul
11	Text	Running novelty rate	cumul
12	Text	Consecutive novel count	cumul
13	Text	Windowed novelty (5 tok)	window
14	Text	Windowed novelty (10 tok)	window
15	Text	Windowed novelty (20 tok)	window
16	Text	Novelty velocity (1st diff)	delta
17	Text	Novelty accel. (2nd diff)	delta
18	Text	Sentence position index	point
19	Text	Sentence-relative position	point
20	Text	Running mean word length	cumul
21	NLI	P(contradiction∣C,s)	sent
22	NLI	P(entailment∣C,s)	sent
23	NLI	P(neutral∣C,s)	sent
24	NLI	Running mean contradiction	cumul
25	NLI	Contradiction delta	delta
26	NLI	Windowed max contr. (10 tok)	window
27	NLI	Entailment drop	sent
28	LM	Log-probability (sum subwords)	point
29	LM	Next-token entropy	point
30	LM	Mean subword rank (log)	point

Table 14: Token AUC by sequence length quartile. The BiGRU–LogReg gap grows from +8.1 (Q1) to +12.2 (Q4) as longer sequences provide more temporal context.
Quartile	Mean Len.	LogReg	BiGRU	Δ
Q1 (short)	62	0.781	0.863	+0.081
Q2	103	0.726	0.814	+0.087
Q3	135	0.708	0.824	+0.116
Q4 (long)	203	0.730	0.851	+0.122

Table 15: Onset detection metrics (all signals, tolerance k=3). 1D-CNN achieves the best F1 due to high recall; BiGRU has the best precision.
Model	Prec@3	Rec@3	F1@3	Early
LogReg	.100	.517	.155	.423
1D-CNN	.147	.520	.208	.412
BiGRU	.171	.298	.196	.279

Table 16: BiGRU hyperparameter sweep (mean ± std AUC, 10 seeds). Performance plateaus at h=64 and degrades for h≥128.
h	Layers	AUC	Params
32	1	.837±.005	15K
32	2	.842±.004	34K
32	3	.840±.007	53K
64	1	.841±.004	46K
64	2	.839±.005	121K
64	3	.843±.005	195K
128	1	.836±.006	158K
128	2	.832±.009	455K
128	3	.830±.011	751K
256	1	.831±.014	579K
256	2	.816±.006	1.8M
256	3	.826±.011	2.9M

Table 17: Training recipe ablation on BiGRU; the first row (BCE + constant) is the baseline. No recipe significantly outperforms it, suggesting the AUC ceiling is determined by the features rather than the optimization.
Recipe	AUC	F1	P	R
BCE + constant	.839±.005	.254	.158	.654
BCE + plateau	.837±.006	.249	.154	.661
BCE + cosine	.840±.006	.248	.154	.661
Focal + constant	.840±.006	.248	.152	.670
Focal + plateau	.839±.007	.249	.153	.663
Focal + cosine	.839±.007	.242	.148	.675

Table 18: Training recipe ablation on Transformer Pre-LN (10 seeds each).
Recipe	AUC	F1
BCE + constant	.805±.008	.204
BCE + plateau	.803±.011	.203
BCE + cosine	.796±.008	.198
Focal + constant	.799±.008	.209
Focal + plateau	.801±.010	.206
Focal + cosine	.797±.009	.201

Table 19: Full Lookback Lens comparison (open-LLM subset, 5 seeds).
Features	Model	AUC	F1	AP
TinyLlama-1.1B proxy
Lookback	LogReg	.699	.194	.173
Lookback	BiGRU	.822	.355	.344
Combined	BiGRU	.853	.355	.401
Qwen3-14B proxy
Lookback	LogReg	.726	.204	.187
Lookback	BiGRU	.838	.384	.368
Combined	BiGRU	.866	.391	.425
Ours only	BiGRU	.819	.297	.298

Table 20: Architecture comparison with cosine schedule (literature recipes, 5–10 seeds). BiGRU, Mamba, and BiGRU+Attention converge to ∼0.84.
Architecture	AUC	F1	Params	Seeds
BiGRU	.840±.007	.257	121K	10
BiGRU+Attention	.840±.005	.251	113K	10
Mamba	.838±.006	.244	203K	9
BiLSTM	.835±.008	.242	121K	10
BixLSTM	.827±.006	.233	125K	10
DilatedCNN	.826±.006	.244	61K	10
Transformer	.796±.008	.204	106K	10

Table 21: Same architectures with ReduceLROnPlateau + early stopping (max 50 epochs, patience 10, 5 seeds). Plateau scheduling raises the ceiling from 0.840 to 0.845 and eliminates most architecture differences.
Architecture	AUC	Δ	Best Ep	Params
BiLSTM	.845±.003	+.010	17	121K
Mamba	.844±.005	+.006	20	203K
BiGRU+Attn	.844±.002	+.004	12	113K
BiGRU	.843±.003	+.003	8	121K
BixLSTM	.843±.004	+.016	19	125K
DilatedCNN	.833±.002	+.007	13	61K
Transformer	.827±.002	+.031	46	106K

Table 22: Probing comparison: hidden states from the generating model vs. our 33-dim black-box features. Each generator is evaluated only on its own outputs. Hidden states are extracted from 4 evenly spaced layers (dim=16,384).
	LLaMA-2-7B	Mistral-7B
Method	AUC	F1	AUC	F1
Linear probe on HS	.543	.118	.574	.142
BiGRU on HS	.637	.195	.631	.201
BiGRU on 33-dim (ours)	.770	.245	.833	.355
BiGRU on 33-dim + HS	.748	.215	.793	.282

Table 23: Per-task AUC for five architectures (3 seeds, plateau+ES). QA is easiest across all architectures; Data2txt shows the largest temporal advantage.
Architecture	QA	Data2txt	Summary
Mamba	.890±.007	.827±.009	.766±.005
BiGRU	.885±.002	.833±.006	.758±.017
BiGRU+Attn	.885±.004	.830±.008	.770±.010
BixLSTM	.884±.003	.815±.017	.771±.013
DilatedCNN	.883±.005	.795±.009	.760±.008

为什么重要

幻觉一旦开始往往会在后续词语中持续蔓延,抓住这种连续性意味着该方法即使面对不公开内部信息的闭源模型也能使用。这对医疗、法律、金融等使用检索增强生成(RAG)系统的实际场景很关键,因为一条编造的信息可能被逐步放大传播。

本文术语

幻觉(hallucination) · AI语言模型生成的看似流畅但实际上不符合事实的内容
自然语言推理(NLI) · 判断两句话之间是蕴含、矛盾还是中立关系的技术
意外度(surprisal) · 衡量语言模型对某个词的出现感到多么意外的指标
双向门控循环单元(BiGRU) · 一种能同时从前往后和从后往前读取序列、捕捉上下文的神经网络
AUC · 衡量模型区分正确与错误能力的指标,数值越接近1越好
条件随机场(CRF) · 一种对相邻标签之间的依赖关系进行建模的结构化预测方法

无法转载的图表

Figure 2: Decomposition of BiGRU’s 11-point advantage over LogReg. Temporal order is the largest contributor (44%).
Figure 3: Feature dynamics aligned to hallucination span onset (1,136 spans). LM entropy spikes at onset; context overlap drops; NLI contradiction rises gradually; BiGRU probability accumulates monotonically.
Figure 4: AUC distribution across 10 seeds for key architectures. Temporal models (BiGRU, BiLSTM) consistently outperform non-temporal baselines (LogReg, MLP).
Figure 5: Token AUC across all architecture–signal combinations (single seed). Non-CRF temporal models (BiGRU, BiLSTM) consistently outperform baselines across all signal configurations.
Figure 6: Leave-one-out cross-model generalization (all signals, 10 seeds). GPT-4 is the hardest transfer target; LLaMA-2-70B is the easiest.
Figure 7: Waterfall decomposition of signal contributions to BiGRU’s AUC. NLI and LM features provide complementary gains beyond text features alone.
Figure 8: Precision-recall curves for all non-CRF architectures (all signals, seed 42). The low overall precision reflects RAGTruth’s 5.6% hallucination rate.
Figure 9: Per-task AUC comparison (all signals). The temporal advantage of BiGRU over LogReg is largest for Data2txt.
Figure 10: Token AUC by sequence length quartile. The BiGRU–LogReg gap grows from +8.1 (Q1) to +12.2 (Q4).
Figure 11: CRF scoring methods compared. Forward-backward marginals recover up to +17.9 AUC points over softmax scoring.
Figure 12: Natural counterfactual: same query, different LLMs, one hallucinating. NLI contradiction separates the two; LM entropy does not; BiGRU integrates both.
Figure 13: Bidirectional dataset transfer. Reverse transfer (PsiloQA to RAGTruth) outperforms forward despite fewer training examples.
Figure 14: Architecture comparison (cosine schedule). All temporal architectures with full-sequence scope converge to ∼0.84 AUC. With plateau scheduling (Table 21), the ceiling rises to 0.845.

在原文中查看图表 →

论文原文摘要（英文）

Token-level hallucination detectors score each token independently from a single signal, and fail exactly when the generating model is confidently wrong. This paper instead treats hallucination as a temporally extended span and detects it by sequence labeling: each token is scored from a 33-dimensional feature stream that fuses text statistics, Natural Language Inference (NLI) entailment, and language model surprisal, with no access to model internals. A Bidirectional Gated Recurrent Unit (BiGRU) over these features reaches an AUC of 0.840 on RAGTruth (10 seeds), an 11-point gain over an independent logistic-regression baseline (p = 0.002, Wilcoxon signed-rank). A controlled decomposition attributes most of the gain to temporal order rather than model capacity: evidence propagates from confident positions to ambiguous neighbors within a span. The same 0.845 ceiling recurs across recurrent, state-space (Mamba), and attention architectures, locating the bottleneck in the feature set rather than the model. Because it reads only the generated text and external signals, the detector works on closed-source models, and it keeps working on text produced by language models it never saw during training, losing under 4% AUC.

作者 · Igor Itkin

在 arXiv 阅读

Temporal Multi-Signal Fusion for Token-Level Hallucination Detection

识别AI编造的内容,不能只看单个词,要看上下文的连续变化

他们做了什么

为什么重要

本文术语

无法转载的图表

最新论文

METAL MEDIA 最新报道