大模型
arxiv.org ·
当审计者伪造：LLM 检测植入文档污染中的批次规模退化与自信幻觉
该 arXiv 论文构建了含 150 篇学术论文、450 处三类植入污染（拼写损坏、语义反转、荒谬插入）的语料，评估 Google Gemini 3.0 Pro 在单文档、小批次、大批次三种提示规模下恢复 180 条答案键子集的能力。结果显示检测在小规模下已不可靠（单文档 50%、小批次 60%，该样本无法区分二者差异），大批次下骤降至 2.8%；失败模式并非弃权而是编造，模型会自信地报告文档中不存在的污染，如“telepathic squirrel”“quantum-powered toaster”。按污染类型，荒谬插入在已完成评估中恢复率 75%，语义反转与拼写损坏各仅 50%，即现实中更常见的合理型污染最易被漏检。作者结论是 LLM 文档审计的退化不是平滑的而是欺骗性的，并提出所需约束：限制批次大小、直接注入内容、对每条报告发现做机械式原文核验。
AI推荐理由 arXiv 论文（v2，2026-09-11 修订），实验设置明确：150 篇论文、450 处植入污染、180 条答案键子集、三种提示规模，报告单文档 50%、小批次 60%、大批次 2.8% 的恢复率，并指出大批次下模型不是弃权而是编造不存在的污染（如“telepathic squirrel”），且语义反转与拼写错误各仅 50%、荒谬插入 75%。这些具体数字与失败模式对 LLM 文档审计、Agent 可靠性评估有直接参考价值；局限是仅评估 Gemini 3.0 Pro 单一模型、样本规模有限，作者自述单文档与小批次差异在本样本内无法区分。
82
正文
Computer Science > Computation and Language
arXiv:2609.09696 (cs)
[Submitted on 9 Sep 2026 (v1), last revised 11 Sep 2026 (this version, v2)]
Title:When Auditors Fabricate: Batch-Size Degradation and Confident Hallucination in LLM Detection of Planted Document Contamination
Authors:Karan Parekh, Sanjana Pendyala Ravinder, Sana Mhapsekar, Medina Maloku
View a PDF of the paper titled When Auditors Fabricate: Batch-Size Degradation and Confident Hallucination in LLM Detection of Planted Document Contamination, by Karan Parekh and 3 other authors
View PDF
Abstract:Large language models are increasingly proposed as automated auditors of document quality, yet their reliability as detectors of planted errors is poorly characterised. We construct a contaminated corpus of 150 academic papers spanning supply chain management and medical research, injecting 450 known contaminants of three types: typographical corruption, semantic reversal, and absurd out-of-context insertion. We then evaluate Google Gemini 3.0 Pro's ability to recover a 180-contaminant answer-key subset across 60 documents under three prompting regimes of increasing scale: single document, small batch, and large batch. Detection is unreliable even at small scale and collapses entirely at large scale: 50% recovery on single documents and 60% on small batches, a difference this sample cannot resolve, against 2.8% on large batches. The failure mode at scale is not abstention but fabrication. Rather than reporting incomplete processing, the model produced confident findings including invented contaminants of its own, absurdities such as "telepathic squirrel" and "quantum-powered toaster" that mimic the style of the planted material but do not appear in any document. Detection also varies by contamination type: absurd insertions were recovered at 75% in completed evaluations, while semantic reversals and typographical corruptions were each recovered at only 50%. The corruptions most likely to occur in the wild, plausible ones, are the ones most often missed. We conclude that LLM document auditing degrades not gracefully but deceptively, and outline the harness such systems require: bounded batch sizes, direct content injection, and mechanical verification of every reported finding against source text.
Comments:
Subjects:
Computation and Language (cs.CL); Artificial Intelligence (cs.AI)
Cite as:
arXiv:2609.09696 [cs.CL]
(or
arXiv:2609.09696v2 [cs.CL] for this version)
https://doi.org/10.48550/arXiv.2609.09696
Focus to learn more
arXiv-issued DOI via DataCite
Submission history
From: Karan Parekh [view email]
[v1]
Wed, 9 Sep 2026 04:29:45 UTC (99 KB)
[v2]
Fri, 11 Sep 2026 08:35:23 UTC (100 KB)
Full-text links:
Access Paper:
View a PDF of the paper titled When Auditors Fabricate: Batch-Size Degradation and Confident Hallucination in LLM Detection of Planted Document Contamination, by Karan Parekh and 3 other authors
View PDF
view license
Current browse context:
cs.CL
new
|
recent
| 2026-09
Change to browse by:
cs
cs.AI
References & Citations
NASA ADS
Google Scholar
Semantic Scholar
export BibTeX citation
Loading...
BibTeX formatted citation
×
loading...
Data provided by:
Bookmark
Bibliographic Tools
Bibliographic and Citation Tools
Bibliographic Explorer Toggle
Bibliographic Explorer (What is the Explorer?)
Connected Papers Toggle
Connected Papers (What is Connected Papers?)
Litmaps Toggle
Litmaps (What is Litmaps?)
scite.ai Toggle
scite Smart Citations (What are Smart Citations?)
Code, Data, Media
Code, Data and Media Associated with this Article
alphaXiv Toggle
alphaXiv (What is alphaXiv?)
Links to Code Toggle
CatalyzeX Code Finder for Papers (What is CatalyzeX?)
DagsHub Toggle
DagsHub (What is DagsHub?)
GotitPub Toggle
Gotit.pub (What is GotitPub?)
Huggingface Toggle
Hugging Face (What is Huggingface?)
ScienceCast Toggle
ScienceCast (What is ScienceCast?)
Demos
Demos
Replicate Toggle
Replicate (What is Replicate?)
Spaces Toggle
Hugging Face Spaces (What is Spaces?)
Spaces Toggle
TXYZ.AI (What is TXYZ.AI?)
Related Papers
Recommenders and Search Tools
Link to Influence Flower
Influence Flower (What are Influence Flowers?)
Core recommender toggle
CORE Recommender (What is CORE?)
Author
Venue
Institution
Topic
About arXivLabs
arXivLabs: experimental projects with community collaborators
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Which authors of this paper are endorsers? |
Disable MathJax (What is MathJax?)