Actionable Hallucination Detection: Translating Latent Uncertainty into Agentic Critique

Large Language Models (LLMs) deployed as AI agents frequently exhibit user specification-grounding failures, executing hallucinated, undesired actions to force a resolution rather than expressing uncertainty. Unlike standard factual hallucinations, an action may be logical, but remains a hallucination if it was never explicitly or implicitly requested by the user. Existing detection methods fail to provide actionable, real-time correction as they either do not localize the hallucinations, or incur prohibitive inference latency.

The authors introduce the Latent Critic, "a lightweight low-rank adapter (LoRA) that operates concurrently with a frozen base LLM's generation to actively restructure the transformer's residual stream—amplifying latent grounding signals and translating them into localized, natural language feedback within a single sequence. The architecture preserves the base model's native agentic capabilities while enabling the LLM backbone to verbalize the exact localized hallucination (e.g., ungrounded: date) within the same generation sequence."

The detection module consists of a LoRA module executed concurrently with the frozen base agent via multi-adapter serving. Because the adapter's weights are initialized at zero, its initial forward pass mirrors the base model's exact hidden states. Upon completion of the tool call, a trigger token ([POS]) is appended, acting as a localized attention sink that signals the Critic to verbalize detection results. The training objective uses a masked diagnostic objective where the base tool-call generation is masked and the gradients are computed only on the [POS] token and the subsequent label.

The research focuses specifically on tool-calling as a testbed for isolating grounding errors and evaluating fine-grained uncertainty extraction. Three behavioral outcomes are evaluated: (1) Correct & Grounded (ok), (2) Wrong Tool (wrong tool), and (3) Ungrounded Parameters (ungrounded). The definition of hallucination focuses entirely on a lack of support in the user's conversational context rather than external ground truth.

Data generation uses a dynamic environment consisting of a base agent and a simulated user powered by Qwen3.5-122B, with a hidden Completed Specifications List (CSL)—a binary mask over the ground truth tool calls that tracks whether the required information for a parameter in the GT tool calls has been provided (1) or withheld (0). The pipeline achieves an 89% agreement rate with manual human evaluation. Training uses 5,000 scenarios, with 500 ID tasks and 200 OOD scenarios from ToolAlpaca for evaluation.

The Latent Critic demonstrates the strongest overall performance across all metrics. On Qwen3-4B, it achieves 0.966 AUROC in-distribution and 0.925 AUROC out-of-distribution, with ">80% exact parameter-match accuracy" for localization. Key findings include:

• Entropy baselines collapse: "Because models confidently fabricate plausible parameters to complete tasks, standard uncertainty-based sampling methods yield low entropy for these errors. Consequently, methods like Semantic Entropy collapse into a single cluster... failing to discriminate grounding entirely."

• External Judge limitations: While ranking well on Qwen (0.915 AUROC), it generates poorly (0.695 F1) due to calibration issues when forced to judge surface-level text.

• Deployment advantage: The Critic successfully catches 38.7% of Qwen's hallucinations at a strict 1% False Positive Rate (FPR), compared to 28.3% for the Judge and just 3.8% for the passive Probe.

• Cross-model replication: On Llama-xLAM-2-8B, the Critic achieves 0.926 AUROC ID and 0.649 OOD, with the advantage of restructuring over passive probing strongly replicat[ing] across both settings.

The paper provides four key mechanistic findings:

1. Confidence in predictions does not imply reliability: The probability density functions of grounded and ungrounded parameters exhibit a strong overlap, making simple logit-thresholding unreliable. However, the Latent Critic classifies the ungrounded trajectory with an average confidence of 95.38%.

2. Latent extraction is reactive, not prescient: The internal representation is reactive rather than predictive: the signal denoting a hallucination emerges within the hidden states the instant the model formulates the flawed parameter. Confidence spikes to 95.24% at the exact sequence step where the ungrounded parameter key is generated.

3. Rank-invariant restructuring: Training a linear probe on the Latent Critic's adapted hidden states achieved 0.944 ID and 0.915 OOD AUROC versus 0.782/0.616 for frozen base states, providing strong evidence that the masked objective explicitly restructures the representation into a shift-stable linear geometry. This transformation is rank-invariant—even highly bottlenecked adapters (e.g., r = 4) successfully separate the latent space.

4. Causal verification via activation patching: Cross-trajectory activation patching shows that "patching early syntactic layers (0–20) yields negligible changes (<5% probability), while patching mid-to-late layers results in a sharp probability inversion peaking at Layer 32, providing strong causal evidence that the hallucination signal is a geometric feature formed in the later layers."

The Latent Critic was integrated into a closed-loop ReAct environment comparing Generic Intervention (blocking without feedback) versus Specific Intervention (blocking with localized verbalization like ungrounded: [PARAM]).

Key results include:

• Specific feedback improves parameter F1: On ID tasks, the Specific Intervention achieves the highest precision (69.8%) while successfully guiding the agent to recover its recall (54.4%), yielding a peak parameter F1 score of 61.2%.

• Reduced false blocks: Specific feedback concurrently improves Trajectory Success to 22.1% while reducing false blocks by more than 3× (down to 2.9%) compared to generic feedback.

• Improved recovery rates: The Latent Critic boosts the successful recovery rate to 37.0% (ID) and 29.3% (OOD), representing relative improvements of 54.8% and 46.5%, respectively compared to generic feedback.

• Negligible latency: "The Critic itself operates with negligible overhead, adding <10 ms per executed tool call in our vLLM deployment environment (and 58 ms in a standalone HuggingFace setup)."

The authors acknowledge several limitations: training the Critic relies on programmatic labels derived from a simulated environment, and our evaluation sets were verified by a single human annotator. Additionally, "the reliance on the base model's internal state means that not only is downstream self-correction upper-bounded by the frozen model's capabilities, but the internal detection signal itself weakens under severe distribution shift when the base agent's generation quality collapses. The performance advantage of internal access over external judges under shift is also model-dependent."

The paper concludes that "a masked diagnostic objective restructures latent representations of grounding to improve real-time detection and localization suggests a promising training principle to render internal uncertainty mechanically accessible across transformer architectures through PEFT. The Latent Critic bridges the gap between mechanistic interpretability and AI agent safety" by actively restructuring the transformer's residual stream to expose specification-grounding failures in real time.

Improvements to AI Systems:

1. Real-time hallucination localization during tool calls: Integrate a lightweight LoRA adapter (Latent Critic) that runs concurrently with the frozen base LLM, appending a [POS] trigger token after each tool call to verbalize exact ungrounded parameters (e.g., ungrounded: date) within the same generation sequence—enabling immediate, actionable correction without separate inference passes.

2. Latent-space grounding restructuring via masked diagnostic objective: Train the adapter using a masked loss that only backpropagates through the [POS] token and subsequent label, forcing the residual stream to form a linear, shift-stable geometric separation between grounded and ungrounded trajectories—making internal uncertainty mechanically accessible even with rank-4 bottlenecks.

3. Reactive hallucination detection at the moment of parameter generation: Exploit the finding that hallucination signals emerge in mid-to-late transformer layers (peaking at Layer 32) exactly when the flawed parameter key is generated, allowing the system to flag errors at the precise token step rather than post-hoc.

4. Closed-loop self-correction with specific verbal feedback: Replace generic blocking with localized feedback (e.g., ungrounded: [PARAM]) that guides the agent to recover missing information, achieving 37.0% successful recovery (54.8% relative improvement) while reducing false blocks by 3×—enabling agents to autonomously re-request or infer correct parameters.

5. Calibrated detection under confident fabrication: Overcome entropy collapse by using the Critic's internal representation (95.38% average confidence on ungrounded trajectories) instead of sampling-based uncertainty, which fails because models confidently fabricate plausible parameters—allowing detection even when the model's logits show high confidence.

6. Deployment-efficient multi-adapter serving: Operate the Critic with <10 ms added latency per tool call in vLLM, enabling real-time guardrails in production agent systems without sacrificing the base model's native agentic capabilities.

What the improved AI system can do:

• Execute tool calls while simultaneously detecting and verbalizing any parameter that lacks grounding in the user's conversational context, in real-time.

• Self-correct by receiving localized feedback (e.g., ungrounded: date) and re-attempting the tool call with properly inferred or requested parameters, improving trajectory success to 22.1% (from 8.3% with generic blocking).

• Maintain high detection performance out-of-distribution (0.925 AUROC on Qwen3-4B) even when the base model's generation quality degrades, though with model-dependent robustness.

• Operate as a drop-in safety layer for existing frozen LLM agents, requiring only a small trainable adapter and no changes to the base model's weights or inference pipeline.

• Provide interpretable, human-readable critiques of grounding failures, bridging mechanistic interpretability and agent safety for auditability and debugging.