D-Score: Detecting LLM Hallucinations by Counting Singular Values of Hidden-State Matrices

A 2026 arXiv paper from the University of Bologna — D-Score: A Spectral Hidden-State Signal for Hallucination Detection in Large Language Models — proposes a fourth approach to hallucination detection: instead of re-querying the model, using a judge model, or checking a knowledge base, it simply counts how many singular directions of the hidden-state activation matrix are still "alive". One forward pass, no external verifier, no multi-sample consistency checks, no retrieval.

The problem

Ask an LLM to explain photosynthesis or quantum tunneling, and it answers fluently and correctly. Ask it about "Turing's 1923 Cambridge sandwich recipe" and it answers just as fluently — but it's entirely fabricated (Turing was born in 1912, so he was 11 years old in 1923). From the output text alone, all three answers look equally confident and fluent. Existing detection methods (multiple inference passes, external judge models, retrieval-augmented verification) are expensive or limited.

Core intuition

When a model states something it actually knows, its representation follows a single dominant direction. But when it fabricates content conflicting with its internal knowledge, two representations coexist: the fabricated content being output, and an internal "wait, that's wrong" signal. These competing encodings spread the activation matrix across more singular directions — like more lightbulbs turning on in the brain.

The statistic, formalized

For a hidden activation matrix \(H\):

1. Compute the SVD, giving singular values \(\sigma_1 \geq \sigma_2 \geq \dots \geq \sigma_r\) 2. Choose a tolerance \(\tau > 0\) 3. D-Score = the number of singular values satisfying \(\sigma_i \geq \sigma_1 \cdot (1 - \tau)\)

One forward pass, one SVD, count, done. A lightweight probabilistic argument (Appendix A) explains why conflict-driven dual encoding spreads representations across more singular directions.

Experimental results

Evaluated on FAVA-Annotation and RAGTruth against Logit Entropy, Window Entropy, and Hidden Score baselines.

FAVA-Annotation (Llama-3-8B)

| Method | AUROC | Accuracy | TPR@5%FPR | F1 | |--------|-------|----------|-----------|-----| | Logit Entropy | 52.29 | 55.69 | 1.80 | 57.31 | | Hidden Score | 58.22 | 59.28 | 10.18 | 66.99 | | D-Score | 63.93 | 63.17 | 13.77 | 69.67 |

RAGTruth

| Model | Method | AUROC | |-------|--------|-------| | Llama-3-8B | Hidden Score | 54.95 | | Llama-3-8B | D-Score | 61.53 | | Vicuna-7B | Hidden Score | 51.93 | | Vicuna-7B | D-Score | 60.20 |

On Vicuna-7B, Hidden Score is near random while D-Score stays at 60.20 — the signal is not model-family specific. Notably, the gap between D-Score and Hidden Score widens on stronger models (9.88 AUROC on Llama-3-8B): stronger models internally "know" they are fabricating, and D-Score picks up that internal-conflict signal.

Why this matters: changing the layer of analysis

Prior hallucination detection searched for evidence at the output level (entropy, sampling consistency, retrieval comparison). D-Score shifts to the representation level: hallucination is already present in the hidden layers before the fabricated token is generated. It also connects to an "evaluation blind spot" phenomenon — output-level signals are easy to measure and thus repeatedly optimized, while the truly informative hidden-layer signal was long ignored.

Honest limitations

• Absolute performance is modest: AUROC 63.93 works as one signal among several, not as the sole detector in production
• Layer selection matters: different layers perform very differently; a calibration set is needed (the paper uses around layer 20 of Llama-3-8B)
• Tolerance hyperparameter τ is required, though the paper shows robustness to its choice (Appendix C)
• Only detects "the model knows better" hallucinations: if the model's internal knowledge is itself wrong or absent, D-Score cannot detect the fabrication. An ablation (Section 4.3) shows the advantage shrinks substantially when self-identified hallucinations are removed

Broader takeaway

D-Score suggests that mid-to-late layers encode "what the model actually believes" — consistent with other mechanistic-interpretability findings probing similar layers. Beyond hallucination detection, it hints at a general interface for reading model internal states, with singular value counting being the simplest possible reader.

> Paper: arXiv:2607.24586 > Code: no open-source repository mentioned in the paper