> TL;DR: Existing hallucination detection only checks whether the final answer is correct. But in industrial multi-agent settings, hallucinations propagate, cascade, and amplify at every step of the Thought-Action-Observation loop. This IBM/Columbia study treats the trajectory itself as the audit unit, finds procedural hallucinations account for 38.5% of failures, and shows a simple "clarity signal" predicts hallucination with AUC=0.908 — beating every supervised classifier.
Why a "correct answer" does not mean "no hallucination"
Existing LLM hallucination benchmarks (TruthfulQA, MIRAGE, HaluEval) all do the same thing: give the model a question, check whether the final output is factually correct. This works for static QA but fails completely in industrial multi-agent workflows.
Consider a data-center operations scenario:
- Agent 1 (IoT): reads sensor data, detects a temperature anomaly
- Agent 2 (FSMR): state modeling, infers possible faults
- Agent 3 (TSFM): time-series forecasting of future trends
- Agent 4 (WO): generates a work order to notify maintenance
- \(M\): LLM-driven agent modules (here K=4: IoT, FSMR, TSFM, WO)
- \(C\): orchestrator (ReAct or Plan-and-Execute)
- \(T_{tool}\): tool set (sensor APIs, forecasting endpoints, work-order system)
- Action monitoring: efficiently catches procedural (47.5% occur in Actions) but misses many factual ones
- Response validation: catches factual (40.3% in Responses) but misses procedural
- Thought-chain verification: catches referential (44.0% in Thoughts)
- Scope: uniformly distributed — requires explicit role-boundary awareness
- Paper: arXiv:2605.24219v2, "Beyond Final Answers: Auditing Trajectory-Level Hallucinations in Multi-Agent Industrial Workflows"
- Authors: Harshada Badave, Santosh Borse, Shuxin Lin, Dhaval Patel (IBM); Andrea Gomez, Harshitha Narahari, Sara Carter, Vishwa Bhatt, Aishani Rachakonda (Columbia University)
- Base framework: AssetOpsBench [8]
- Related work: MIRAGE [4,12], TruthfulQA [6], ToolBeHonest [13], AgentBench [7], WebArena [14], Traject-Bench [5], GEPA [1]
- Submission target: NeurIPS Datasets and Benchmarks track
The final answer — "work order generated" — may be entirely correct. But along the way, TSFM may have cited temperature values IoT never reported, FSMR may have skipped a required validation step, and WO may have embedded unconfirmed data. The answer is right; the trajectory is rotten.
Core insight of the paper: in agentic contexts, hallucination is not factual fabrication in a single response, but structured deviation from evidence that propagates through sequential, tool-mediated trajectories, often causing cascading operational failures.
The Trajel framework: four components
1. Trajectory structure modeling (formalizing composite AI systems)
The paper formalizes a multi-agent system as:
Each step is \(s_t = (a_t, \tau_t, \alpha_t, \omega_t)\), where \(\tau_t\) is the Thought, \(\alpha_t\) the Action, \(\omega_t\) the Observation. A trajectory is the ordered sequence of steps.
Key insight: every step can in principle access all prior evidence, so it may reference, mis-reference, or fabricate upstream content. TSFM hard-depends on IoT, but the orchestrator may choose a wrong order — wrong orchestrator ordering is itself a hallucination source.
2. A five-type taxonomy of trajectory-level hallucinations
The paper's central contribution — hallucinations defined as structural predicates over the Thought-Action-Observation trace:
| Type | Symbol | Definition | Context needed | Difficulty | |:---|:---|:---|:---|:---| | Factual | \(h_F\) | assertion contradicts step ground-truth data | single step | ⭐ easiest | | Referential | \(h_R\) | cites entities or results absent from prior steps | trajectory history | ⭐⭐⭐ hard | | Logical | \(h_L\) | reasoning does not follow from premises, even if premises are correct | reasoning chain | ⭐⭐⭐⭐⭐ hardest | | Procedural | \(h_P\) | skips, reorders, or invents workflow-mandated steps | workflow spec | ⭐⭐⭐ medium | | Scope | \(h_S\) | agent acts or claims beyond its remit | agent role definition | ⭐⭐⭐ medium |
Multi-agent specificity: scope hallucination — content may be correct but comes from the wrong agent. E.g., TSFM directly generating work orders (WO's job), or IoT doing forecasts (TSFM's job).
Key number: 48.7% of hallucinated trajectories exhibit multiple types. Single-label formulations mischaracterize a large share of real failures.
3. The Trajel dataset
| Statistic | Value | |:---|:---| | Total annotated trajectories | 225 | | Model configurations | 6 (anonymized) | | Industrial tasks | 42 (AssetOpsBench) | | Annotating institutions | 2 (IBM + Columbia, blind review) | | Human-identified hallucination rate | 68.3% (153/224) | | LLM-judge identification rate | 79.1% (178/225) | | Single-type hallucinations | 79 (51.3%) | | Multi-type hallucinations | 75 (48.7%) |
Two-tier annotation: LLM-as-a-Judge first pass → dual-institution human expert review. Human–LLM agreement: Cohen's κ = 0.456 (moderate), but near chance on referential (κ=0.176) and logical (κ=0.211) types — precisely because those types are the most subtle and demand human judgment.
4. Three detection paradigms
| Paradigm | Input | Model | Captures | Best types | AUC | |:---|:---|:---|:---|:---|:---| | Subtask-level BERT | single step | fine-tuned BERT | local cues (lexical anomalies, thought–observation contradictions) | factual | 0.613 | | Trajectory-level NLI | history premise + current hypothesis | natural language inference | trajectory-wide consistency | referential, logical | 0.689 | | Long-context Longformer | full serialized trajectory | Longformer | global structure | procedural, scope | 0.599 |
These are complementary lenses, not competitors: subtask-level gives efficiency and interpretability, NLI gives pairwise consistency checks, and Longformer captures global structure at higher compute cost.
Results: five most striking findings
1. Procedural hallucinations account for 38.5% of all failures
Procedural hallucination (\(h_P\)) — skipping required steps, reordering dependencies, inventing nonexistent workflow nodes — is the type industrial settings most need to guard against. It is invisible to final-answer verification: the work order gets generated, but the intermediate process is a mess.
2. LLM-as-a-Judge fails at the *type* level
The LLM judge does well at the binary level (F1=0.855), but type-level detection exposes systematic deficits:
| Type | LLM-judge F1 | Verdict | |:---|:---|:---| | Procedural | 0.784 | ✅ good | | Factual | 0.719 | ✅ OK | | Scope | 0.719 | ✅ OK | | Logical | 0.258 | ❌ very poor | | Referential | 0.222 | ❌ very poor |
The binary-evaluation trap: 141 trajectories would count as "correctly detected" at the binary level, but type matching is only 58.2%. The judge "knows there is a hallucination" but "doesn't know what kind."
3. Every supervised model loses to the zero-shot LLM judge
| Model | F1 | AUC | |:---|:---|:---| | Zero-shot LLM judge | 0.855 | — | | BERT (subtask) | 0.590 | 0.613 | | NLI (trajectory-level) | 0.563 | 0.689 | | Longformer (long-context) | 0.533 | 0.599 |
Supervised training on 225 trajectories cannot match the general reasoning of a large prompted model. This implies: (1) the dataset needs major expansion; (2) hybrid architectures (LLM-derived features + discriminative classifiers) may be the optimal path.
4. The "clarity & justification" signal hits AUC = 0.908 — the strongest single predictor
The most surprising result. Five execution-quality signals (from AssetOpsBench evaluation dimensions):
| Signal | Hallucination rate when present | When absent | Pearson r | AUC | |:---|:---|:---|:---|:---| | Task Completion (TC) | 2.3% | 90.0% | −0.786 | 0.853 | | Data Retrieval Accuracy (DRA) | 43.0% | 89.6% | −0.502 | 0.771 | | Result Verification (RV) | 6.4% | 91.0% | −0.784 | 0.863 | | Agent Sequence Correct (ASC) | 43.7% | 86.6% | −0.453 | 0.738 | | Clarity & Justification (CJ) | 9.1% | 94.3% | −0.833 | 0.908 |
CJ alone outperforms all supervised classifiers (AUC 0.908 vs NLI's 0.689). The deeper lesson: the clarity of an agent's reasoning is itself the strongest predictor of hallucination. When the agent argues clearly, hallucination rate is 9.1%; when reasoning is vague, it soars to 94.3%.
5. A candidate "kill switch": when CJ and RV are both missing, hallucination rate is 97.1%
Proposed deployment: when both "clarity & justification" and "result verification" signals are absent, hallucination is near-certain (97.1%). This can serve as a real-time termination condition in the orchestrator — no complex classifier needed, just two boolean checks.
Hallucination type × step component interactions (guardrail design)
| Type | Thought | Action | Observation | Response | Share | |:---|:---|:---|:---|:---|:---| | Factual | 18 | 24 | 4 | 31 | 40.3% | | Referential | 11 | 10 | 0 | 4 | — | | Logical | 7 | 12 | 5 | 3 | — | | Procedural | 26 | 57 | 5 | 32 | 47.5% | | Scope | 18 | 22 | 2 | 21 | — |
Design implications:
Meaning: a single guardrail layer is not enough. Industrial deployment needs multi-layer guardrails (Action + Response + Thought + role boundaries), each catching a different type.
Industrial deployment: from post-hoc classification to real-time runtime monitoring
The paper's core practical recommendation:
> Shift from "post-hoc verification" to lightweight runtime monitors embedded in the orchestration loop.
Concrete path: 1. Embed execution-quality signals: five binary checks (TC, DRA, RV, ASC, CJ) inside the agent loop 2. Candidate termination condition: CJ ∧ RV missing → 97.1% hallucination rate → trigger pause / human review 3. Layered guardrails: Action monitoring (procedural) + Response validation (factual) + Thought-chain checks (referential) + role boundaries (scope) 4. Multi-label detection: with 48.7% co-occurring types, single-label classifiers miss nearly half of failures
Limitations and future work
| Limitation | Impact | |:---|:---| | Scale | 225 trajectories, single industrial domain (AssetOpsBench) | | Fixed orchestrator | six models share one orchestrator; alternative architectures untested | | Annotation consistency | overall κ=0.456 (moderate); referential and logical κ≤0.211 | | Non-exhaustive taxonomy | five types not claimed exhaustive; new types may emerge under adversarial conditions |
Future directions: 1. Improved annotation protocols: require annotators to trace each referential claim to a specific prior step 2. Hybrid architectures: LLM-derived features + discriminative classifiers, with token-level uncertainty 3. Direct measurement of inter-agent disagreement, rather than via execution-signal proxies 4. Domain extension: healthcare, finance, open-ended web environments