Do You Need a Frontier Model as a Citation Verifier? Benchmarking Rubric LLMs for Deep-Research Source Attribution
Source: arXiv:2607.08700 · Published 2026-07-09 · By Ethan Leung, Elias Lumer, Corey Feld, Austin Huber, Vamse Kumar Subbiah, Kevin Paul
TL;DR
This paper investigates the question of how capable and biased large language model (LLM) judges must be to reliably evaluate citation quality in deep-research systems, where factual claims are supported by cited sources. The authors construct a novel adversarial long-form benchmark, the Deep-Research Citation Benchmark, containing 624 attribution-citation pairs with human-reviewed gold labels assessing two rubric criteria: source relevance and factual support. Eight off-the-shelf LLM judges from three model families (Anthropic, Google, and OpenAI) are evaluated on 1,248 rubric decisions. Surprisingly, cheaper models perform competitively—GPT-5-mini attains the highest F1 score (0.908) on source relevance at a fraction of the cost of frontier models, while factual support scoring shows no statistically significant difference across judges. However, despite similar scalar F1, judges differ markedly in directional bias metrics like pass-rate drift and false positive/negative rates, which are critical because an RL training loop would reinforce such biases. Overall, the study shows that careful calibration of these judge biases is more important than simply choosing the most expensive or largest LLM for citation verification as a reward model.
Key findings
- GPT-5-mini achieves the highest source relevance pass-class F1 score of 0.908 (κ=0.636) while being among the lowest-cost judges (log-cost 0.33).
- On factual support, all eight judges have overlapping 95% confidence intervals for F1, with no statistically distinguishable leader; Claude Opus 4.6 led with F1=0.750 (κ=0.701) but difference is within noise.
- Link accessibility passes at 98.4%, source relevance at 79.3%, but factual support is only 18.4%, indicating deliberate difficulty in factual verification.
- Judges exhibit substantial directional bias differences: all under-reward source relevance (predicted pass rates 42.9% to 72.0% vs 79.3% gold rate), and false negative rates on factual support range from 18.3% to 47.0%.
- Pass-class F1 can obscure these directional biases which directly affect downstream RL training signals.
- Multi-judge disagreement subset (378 cases) shows accuracy drops and ranks shift substantially, highlighting difficulty of ambiguous citations and reward noise risk.
- Judge cost per decision varies 49× but cost does not correlate with accuracy or calibration quality.
- Cheaper judges like Gemini 3.1 Flash Lite achieve competitive average class-balanced F1 scores (~0.771), comparable to some much more expensive models.
Threat model
The adversary is an internal system or agent producing search-augmented text with cited sources, where adversarial claims intentionally include factual errors, misleading or irrelevant citations to test judge ability. Judges can only access the extracted attribution-citation pairs and textual sources, with no oracle knowledge. They cannot manipulate or obfuscate their scores but may be imperfect or biased. The threat is that flawed judge calibration leads to reward hacking or mislearning in downstream RL training loops.
Methodology — deep read
The authors build on prior work to create the Deep-Research Citation Benchmark, a single long-form report covering 25 diverse topic domains to avoid domain-knowledge bias. The report contains 624 attribution-citation pairs. Approximately 60% of claims were adversarially edited using 19 adversarial strategies to intentionally induce errors like factual inaccuracies or irrelevant citations. A two-stage evaluation pipeline is used: first, an AST-based parser extracts attribution-citation pairs from markdown outputs. Second, each pair is assessed for rubric criteria via judgment by LLMs and automated checks. The rubric consists of three criteria: link accessibility (deterministic HTTP check), source relevance, and factual support (both LLM-judged).
Gold labels for source relevance and factual support were created by a council of 6 LLM judges (including GPT-5-mini, Claude Opus 4.5 and 4.6, Gemini 2.5 Pro, and Gemini 3 Pro). Each judge scored independently, followed by a human reviewer validating unanimous decisions and adjudicating all disagreement cases (378 hard cases). This yielded 1,248 human-reviewed rubric decisions.
For evaluation, 8 off-the-shelf LLM judges from Anthropic, Google, and OpenAI (Table 1) were applied to all 624 pairs and both judged dimensions, producing 1,248 scored decisions. Outputs were binarized at 0.5 threshold. Metrics computed per dimension included pass-class F1, Cohen's κ, pass-rate drift (judge vs gold pass rate), false positive rate (FPR), and false negative rate (FNR).
Cost estimates for each model were derived from published API prices as of June 2026, normalized logarithmically to the cheapest judge GPT-OSS-120B. No fine-tuning was performed on judges—only off-the-shelf APIs used.
The analysis included overall scores, confidence intervals via bootstrap resampling (2,000 iterations), and an ablation on the multi-judge disagreement subset. The authors emphasize bias metrics beyond accuracy to expose directional imbalances in reward signals. They also analyze failures by adversarial edit type.
No code release or public dataset is mentioned. The benchmark is proprietary but builds on the publicly described Onweller et al. citation evaluation pipeline. The human-adjudicated gold labels provide a high-quality reference for LLM judge calibration.
An example end-to-end: The pipeline extracts an adversarial claim about Taylor series cited to openstax.org, judges source relevance (passes, since topic is covered), judges factual support (fails, claim is a finite whereas source states infinite sum), and outputs {relevance:1, fact_check:0} to benchmark judges.
Technical innovations
- Construction of an adversarial, multi-domain, long-form citation benchmark with human-reviewed gold labels distinguishing source relevance and factual support criteria.
- Comprehensive benchmarking of multiple off-the-shelf LLM judges from different providers on a citation-attribution rubric task without fine-tuning.
- Introduction and detailed measurement of directional bias metrics (pass-rate drift, FPR, FNR) to analyze reward signal asymmetries invisible to scalar F1.
- Demonstration that cheaper LLM judges can achieve comparable accuracy on structured citation rubrics, challenging the assumption that frontier-scale models are required for reliable citation verification.
- Human adjudication used to resolve judge disagreement cases, highlighting high reward noise and unreliability on ambiguous citations.
Datasets
- Deep-Research Citation Benchmark — 624 attribution-citation pairs (1,248 rubric decisions) — proprietary constructed dataset with adversarial edits and human-reviewed labels
Baselines vs proposed
- GPT-5-mini: source relevance F1 = 0.908 vs Claude Sonnet 4.6: 0.700
- Claude Opus 4.6: factual support F1 = 0.750 vs GPT-OSS-120B: 0.649
- Gemini 3.1 Flash Lite (second-cheapest): average class-balanced F1 ~0.771 vs Claude Opus 4.6 (highest cost): ~0.811
- Pass rates: GPT-5.4-mini passes 49.2% of citations vs Claude Sonnet 4.6 passes 28.4%, showing large bias differences.
Limitations
- Benchmark is constructed from a single adversarial long-form document covering diverse topics but may not reflect full real-world citation corpus diversity.
- Human adjudication is costly and complex, leaving uncertain how scalable the approach is for continuous dataset updates.
- Judges are evaluated only via off-the-shelf APIs without task-specific fine-tuning; fine-tuned or specialized judges may perform differently.
- Analysis does not fully explore the effects of prompt engineering or batching strategies on judge performance and cost.
- No cross-domain or temporal distribution shift tests to assess judge robustness beyond the benchmark.
- The study focuses on citation verification as a reward model proxy but does not empirically analyze downstream reinforcement learning loop outcomes.
Open questions / follow-ons
- How do prompt design and prompt caching strategies affect judge accuracy and cost tradeoffs in citation rubric evaluation?
- Can ensemble or multi-judge systems reduce reward noise and bias to yield more robust downstream training signals?
- How do different retrieval strategies and corpus updates influence the reliability of LLM citation judges?
- What are the effects of fine-tuning LLM judges specifically on citation verification rubrics compared to off-the-shelf models?
Why it matters for bot defense
For bot-defense and CAPTCHA practitioners developing systems that rely on automatic verification or trust signals from LLMs, this paper highlights the importance of understanding judge calibration beyond simple accuracy metrics. It shows that cheaper LLMs can be competitive citation verifiers under a rubric framework, but varying directional biases remain critical because they directly influence what downstream reinforcement learning or decision-making models will reinforce. In designing LLM-based verification or reward models, bias metrics such as false positive and negative rates should be closely monitored to prevent inadvertent over- or under-rewarding of certain classes of inputs. This suggests practitioners should thoroughly evaluate judge bias profiles in addition to accuracy, and consider calibration or adjudication practices before deploying LLM judges as automated verification or reward sources. Also, the multi-judge disagreement analysis reveals that no single judge is perfectly reliable on ambiguous cases, underscoring the value of human oversight or ensemble approaches in high-stakes scenarios. Overall, the paper encourages a nuanced, rubric-focused approach to designing and integrating LLM-based verifiers for source attribution or factuality checking in bot-defense pipelines.
Cite
@article{arxiv2607_08700,
title={ Do You Need a Frontier Model as a Citation Verifier? Benchmarking Rubric LLMs for Deep-Research Source Attribution },
author={ Ethan Leung and Elias Lumer and Corey Feld and Austin Huber and Vamse Kumar Subbiah and Kevin Paul },
journal={arXiv preprint arXiv:2607.08700},
year={ 2026 },
url={https://arxiv.org/abs/2607.08700}
}