Phantom References: Hallucinated Citations That Survive Peer Review at Top-Tier Conferences
Source: arXiv:2607.00738 · Published 2026-07-01 · By Mark Russinovich, Ram Shankar Siva Kumar, Ahmed Salem
TL;DR
This paper investigates the occurrence and persistence of hallucinated citations—fabricated or author-mismatched references—in peer-reviewed conference proceedings from top-tier venues in AI and security, including ICLR, ICML, NeurIPS, and USENIX Security. The authors define hallucinated citations conservatively, excluding common bibliographic drift such as venue or year changes, focusing instead on identity-level failures where cited works either do not exist or have substantially different author lists. They develop RefChecker, an automated pipeline that cross-validates citations against multiple scholarly databases and uses an LLM-driven deep web search to resolve suspicious references. Applying RefChecker to nearly 50,000 accepted camera-ready papers and over 2.6 million references from 2021–2026 reveals that although hallucination rates per reference are below 1%, many papers contain multiple hallucinated citations, with roughly 1 in 20 NeurIPS and USENIX Security papers in 2025 carrying at least two such faulty references. Moreover, a heavier tail of papers with 5+ hallucinations has emerged post-ChatGPT release, including even award-winning papers. The study highlights that peer review does not reliably catch these citation errors, yet citation-level auditing at conference scale is feasible and inexpensive, costing roughly $0.04 per paper in one scan. RefChecker is open sourced to enable ongoing reproducible verification prior to publication.
Key findings
- Reference-level hallucinated citation rates remain below 1% across venues and years (e.g., 0.55% at NeurIPS 2025 for academic-paper-like references).
- Paper-level prevalence is much higher: approximately 26.2% of NeurIPS 2025 papers and 34.9% of USENIX Security 2025 papers contain at least one likely hallucinated citation.
- Roughly 5.1% of NeurIPS 2025 papers and 4.8% of USENIX Security 2025 papers contain at least two likely hallucinated academic-paper-like references.
- A long tail exists where some papers have 5 or more hallucinated references; e.g., NeurIPS 2025 had 30 such papers, USENIX Security had 2% of affected papers exceed five hallucinations.
- Post-ChatGPT release, a noticeable increase in hallucination rates and high-count tails is observed across multiple venues, including ICLR 2026.
- Hallucinated citations appear even in award-winning papers, indicating peer review does not reliably catch citation fabrication or author mismatches.
- Conference-scale auditing with RefChecker costs roughly $0.04 per paper, making scalable verification practical ahead of publication.
- Most affected papers have a single hallucinated citation (65-87% depending on venue), but multi-error papers contribute disproportionately to the problem.
Threat model
The adversary is any author or automated system producing scientific manuscripts who might unknowingly or deliberately insert fabricated or misattributed citations that evade peer review. This adversary has access to common bibliographic databases but may exploit limitations in verification to place plausible-looking but false references. The model assumes peer reviewers do not systematically verify each citation, and the surveillance system (RefChecker) cannot read behind the final labeled metadata beyond what is found in public bibliographic sources and controlled web search. The adversary cannot forge bona fide database records or override external verification sources.
Methodology — deep read
The authors build a conservative and auditable framework to detect hallucinated citations defined as identity-level failures — either references with no matching scholarly work or substantial author-list mismatches. They exclude ordinary bibliographic drifts such as minor venue/year changes or publication-status updates.
The underlying data corpus includes 48,095 accepted, camera-ready papers from ICLR, ICML, NeurIPS, and USENIX Security spanning years 2021 to mid-2026, with over 2.6 million extracted references. Papers were collected from official conference proceedings and OpenReview to ensure authoritative versions.
RefChecker operates as an automated pipeline ingesting paper PDFs, extracting bibliographies using LLM-assisted parsing (Gemini 3.1 Flash Lite) or GROBID as fallback, and normalizing metadata fields like titles, authors, years, venues, DOIs, arXiv IDs, and URLs. Each normalized reference is validated against multiple bibliographic databases: Semantic Scholar, OpenAlex, CrossRef, DBLP, and ACL Anthology, with identifiers and URLs cross-checked for consistency.
References that do not verify or meet thresholds for author overlap (defaulting to 60% match for papers with 3+ authors), or have conflicting identifiers, are escalated to a second verification step where an LLM performs targeted web search constrained to find an authoritative source page for the cited work. The pipeline then cross-references discovered metadata for confirmation. Only references failing this thorough re-verification are classified as likely hallucinated.
Final statuses classify references as verified, error, warning, suggestion, unverified, or hallucinated. The study focuses on likely hallucinated references with positive hallucination verdicts post-reverification. Non-hallucination discrepancies like minor name variants or venue/year differences are logged but excluded.
Evaluation metrics included per-reference and per-paper hallucination rates. Papers with at least one or two hallucinated references were quantified along with the distribution of failure counts per paper (incl. papers with 5+ hallucinations). Analysis also tracked temporal trends relative to ChatGPT release. The tool's output vocabulary and taxonomy of errors are detailed in Table 1.
The authors acknowledge limitations such as PDF extraction noise, incomplete database records, and potential LLM errors affecting precision/recall, framing results as audited estimates rather than exact counts. Confounding variables like undetected citation changes or author name variants were carefully excluded to maintain strictness.
No private or proprietary datasets were used; all data from publicly accessible camera-ready versions. RefChecker is open source with documented configuration enabling reproducibility. No frozen model weights are required as the verifier is a rule-based lookup pipeline augmented with LLM search calls. The study processes each paper end-to-end from extraction through multi-source verification to escalation and final labeling.
A concrete example: a paper with a reference citing authors A, B, C and title T is parsed into structured fields; normalized; cross-checked against Semantic Scholar and OpenAlex; author overlap drops below 60% with the closest match; no DOI or arXiv ID matches; the reference is escalated to LLM web search; LLM fails to find a dedicated source page confirming that citation; finally, the pipeline classifies the reference as likely hallucinated and associates that label with the paper for aggregation.
Technical innovations
- Definition of hallucinated citation based on identity-level failures (non-existent works or major author mismatches) excluding ordinary bibliographic drift.
- RefChecker pipeline that combines multi-source bibliographic validation with LLM-facilitated deep web search to resolve suspicious citations.
- Empirical large-scale audit of camera-ready accepted papers across multiple top-tier AI and security conferences spanning pre- and post-ChatGPT periods.
- Operational measurement of citation hallucination prevalence at both reference and paper levels, including high-count tails and cost-efficiency quantification.
Datasets
- ICLR accepted camera-ready papers — approx. 15,000+ papers from 2021–2026 — official OpenReview
- ICML accepted camera-ready papers — approx. 10,000+ papers from 2021–2025 — official conference proceedings
- NeurIPS accepted camera-ready papers — approx. 15,000+ papers from 2021–2025 — official conference proceedings
- USENIX Security accepted camera-ready papers — approx. 8,000+ papers from 2021–2025 — official conference proceedings
Baselines vs proposed
- GhostCite: 1.07% invalid citations rate on 56K papers vs RefChecker's stricter likely hallucinated ref rate below 1% across 48K papers
- Zhao et al. (2023): audit of 2.5M preprints with citation misattribution vs RefChecker's focus on camera-ready, peer-reviewed proceedings
- Pre- vs post-ChatGPT release comparison: Paper-level dual hallucinated citation rates nearly doubled at some venues (e.g., NeurIPS from ~3% to ~5%)
Limitations
- PDF bibliography extraction noise can introduce parsing errors affecting recall or precision of citation matches.
- Coverage and metadata inconsistencies in bibliographic databases (Semantic Scholar, OpenAlex etc.) can cause false positives or negatives.
- LLM search escalation steps depend on external model quality and web content availability; some hallucinations may evade detection.
- Hallucination definition excludes milder bibliographic discrepancies, thus rates are a lower bound on overall citation quality issues.
- Attributing hallucination to LLM usage is correlational, not causal; other factors may contribute to rising citation errors post-ChatGPT.
- No adversarial testing against deliberately obfuscated or maliciously fabricated citations was performed.
Open questions / follow-ons
- Can more fine-grained semantic verification of technical claims be automated to complement citation identity checks?
- How can peer-review workflows integrate scalable citation verification tools effectively without disrupting review speed?
- What are effective author-side tools or practices to prevent citation hallucination during manuscript drafting?
- How do citation hallucination patterns evolve as newer, more integrated LLMs with retrieval appear?
Why it matters for bot defense
Bot-defense and CAPTCHA engineers rarely focus directly on scholarly citation integrity, but this study is highly relevant for any automated system aiming to verify textual provenance or authorship claims in digitally submitted documents. For CAPTCHA practitioners, automated validation pipelines like RefChecker demonstrate the utility of multi-source metadata cross-checking combined with constrained LLM queries to detect hallucinated or fabricated references embedded in natural language text. Such verification frameworks could inspire enhanced mechanisms to detect bots or AI-generated content masquerading as authoritative by falsifying citations or provenance markers. Moreover, the paper's methodology highlights the importance of carefully scoped, auditable signals—like citation consistency—over subtle, subjective semantic content verification, which aligns with designing robust challenge-response tests that resist manipulation.
Practitioners working on machine learning–based document authenticity, spam detection, or AI-content provenance can leverage these findings to establish partial trust anchors in bibliographic metadata, develop scalable audit tools, and design interventions to mitigate hallucinated or falsified content that might otherwise evade human inspection.
Cite
@article{arxiv2607_00738,
title={ Phantom References: Hallucinated Citations That Survive Peer Review at Top-Tier Conferences },
author={ Mark Russinovich and Ram Shankar Siva Kumar and Ahmed Salem },
journal={arXiv preprint arXiv:2607.00738},
year={ 2026 },
url={https://arxiv.org/abs/2607.00738}
}