External Observers May See More Clearly: Cross-Model Span-Level Hallucination Detection in LLMs

Forum topic · 小凯 · 2026-10-02

Summary

A deep-dive commentary on the paper "External Observers May See More Clearly" (arXiv:2610.02066) by Kingshuk Gupta and Davide Buscaldi, which tackles span-level hallucination detection in large language models. Unlike conventional detectors that only flag entire outputs, this work uses BIO tags (B-HALL, I-HALL, O) to pinpoint exactly where a hallucination begins and ends. The method extracts neuron activation scores from ten carefully selected layers of a generator model, then trains probes including MLP, BiLSTM, BiLSTM-CRF, BiLSTM-Attn-CRF, and BERT-CRF classifiers. The striking finding: an external observer model reading the generated text can detect hallucinations more accurately than the generator probing its own hidden states. A 2B-parameter Gemma 2 observing a 1.7B SmolLM2 achieved 0.63 B-HALL precision versus 0.54 for self-detection, and even a small model observing a 7B Mistral outperformed the larger model's self-inspection. The CRF decoding layer proves essential for amplifying weak external signals. The authors candidly note limitations: single dataset, single seed, only 57 test hallucination onsets, and models under 7B parameters. The commentary frames the result through the Chinese proverb that one cannot see Mount Lu's true face while standing inside the mountain: self-scrutiny has structural blind spots, and borrowing an external observer offers a practical path forward.

He Has No Mirror: External Observers May See You Better Than Yourself

A deep-dive commentary on "External Observers May See More Clearly" by Kingshuk Gupta (LIX, École Polytechnique / NTU Singapore) and Davide Buscaldi (LIX, École Polytechnique / LIPN, Sorbonne Paris Nord), published as arXiv:2610.02066 [cs.AI], submitted October 1, 2026.

This is the second piece in the "Rebuilding Trust" series — the first covered cryptographic verification of AI conclusions (the shield); this one covers locating lies (the eye).

The Problem: Detecting Hallucination Boundaries

In 2023, New York lawyer Steven Schwartz submitted a federal court filing citing six precedents — complete with case numbers, judges, and reasoning. All six were fabricated by a large language model. When he asked the chatbot whether the cases were real, it said yes. The episode raises a still-unsolved question: where exactly does a fabricated text go wrong? Lies are not smeared across an entire document; they occupy a bounded span embedded in true statements. Most detection tools can only plant a flag saying "hallucination here" — not where it starts or ends.

Localization is the prerequisite for repair. A medical model whose 300-word answer contains two wrong sentences, or an offline engineering assistant whose troubleshooting steps include one invented command, need surgical extraction of errors — not a blanket condemnation that renders the whole output useless. Coarse detection and no detection are often practically equivalent.

Two Existing Roads, Each Blocked

External retrieval (RAG, FActScore): verify each claim against search engines or knowledge bases. Slow due to per-claim lookups, and unusable in offline, privacy-critical, or air-gapped deployments.
Internal probes (Ghost in the Transformer, ICR probes, semantic entropy probes): read the model's hidden states. Fast and privacy-friendly, but existing probes do word-level binary classification or sentence-level scoring — they cannot delimit boundaries.

The paper's goal is therefore span-level hallucination detection: marking precisely which tokens are hallucinated.

Three-Colored Markers: BIO Tagging

Borrowing from named entity recognition, every generated token is labeled:

B-HALL: the first token of a hallucination (Begin)
I-HALL: continuing hallucination tokens (Inside)
O: factual tokens (Outside)

The key difficulty: the model never announces when it starts fabricating.

Step 1: Finding the Most Honest Layers

Building on Zhou et al. (2025) *Ghost in the Transformer* — which observed that anomalous behavior manifests as geometric shifts in specific layers — the authors compute, per layer, the cosine similarity between average feature vectors of normal and hallucinated text. Layers with the lowest similarity are most sensitive to semantic drift. The top five attention layers and top five MLP layers form ten "key layers."

Step 2: An MRI Scan Per Token (NAS)

For each generated token, raw activation vectors are extracted from the ten key layers and concatenated into a Neuron Activation Score (NAS) feature. Multi-layer concatenation captures distributed lie fingerprints — single layers provide testimony; ten layers provide a case file.

Step 3: A Ladder of Five Probes

1. MLP probe: a 5-layer feedforward network (1024 → 3 dims), judging each token in isolation. Its truncated 64-dim version doubles as a feature compressor. 2. BiLSTM: bidirectional memory, so each token's judgment sees context from both directions. 3. BiLSTM-CRF: adds a conditional random field enforcing a grammatical constraint — an I-HALL cannot appear without a preceding B-HALL. Viterbi decoding selects the best legal label sequence. 4. BiLSTM-Attn-CRF: adds 4-head self-attention with residual connections for long-range dependencies. 5. BERT-CRF: projects hidden states into BERT's embedding space, then uses bert-base-uncased plus CRF.

Counting Needles in Rice: The Data

Three white-box datasets with extreme class imbalance:

| Dataset | Model probed | Scale | B-HALL share | |---------|-------------|-------|--------------| | PsiloQA (custom generation) | SmolLM2 (1.7B) | 10,985 tokens | 2.4% | | PsiloQA (original) | TinyLlama (1.1B) | 32,017 tokens | 2.2% | | RAGTruth QA subset | Mistral-7B-Instruct | 11,914 tokens | 0.48% |

With hallucination onsets at 0.48–2.4% of tokens, accuracy is meaningless (labeling everything O yields 98%+). Evaluation hinges on precision and threshold-free PR-AUC.

Mirror Scorecard: Self-Detection

SmolLM2: BERT-CRF achieved the best B-HALL precision (0.54) and onset PR-AUC of 0.362 vs. a 0.024 random baseline — a 15x improvement. AUROC reached 0.895. Adding CRF lifted B-HALL precision from 0.29 to 0.42.
TinyLlama: BERT-CRF and BiLSTM-Attn-CRF tied at 0.41 B-HALL precision; I-HALL F1 hit 0.80 (continuations are easier to catch than onsets).
Mistral-7B: BERT-CRF collapsed (precision 0.25, F1 0.11) — a reminder that with sparse positive samples, larger models overfit. Choosing a probe is like choosing a scale: you don't weigh a pill on a truck scale.

The Twist: The Observer Sees More Clearly

The paper's central inversion: instead of the generator reading its own hidden states, an observer model reads the generated text itself and records its own hidden states. Fabrications are smooth to the generator — grown from its own logic — but they are foreign objects to a clean reader, producing faint, independent ripples in its activations.

Observers: Qwen (1.5B), Gemma 2 (2B), Gemma 4 (E2B). Observed generators: SmolLM2 (1.7B) and Mistral (7B).

Gemma 2 (2B) observing SmolLM2 (1.7B): BERT-CRF B-HALL precision reached 0.63 — beating self-detection's 0.54. PR-AUC was 0.471, above the Ogasa baseline of 0.407.
SmolLM2 (1.7B) observing Mistral (7B): BiLSTM-Attn-CRF PR-AUC of 0.242 externally vs. 0.221 self-detection; BiLSTM-CRF: 0.227 vs. 0.172. A small model watching a big model is more sensitive to the big model's lies than the big model itself (random baseline: 0.005).

The explanation mirrors human intuition: a liar may sincerely believe his own words; the generator's truth and falsehood are same-source and entangled — it is chasing its own shadow. The observer faces hallucination as pure external noise. Notably, this external advantage holds only with CRF decoding — weaker, diffuse external signals need CRF's sequence-level constraint to aggregate ripples into a conviction.

Honest Limitations

The authors dismantle half their own fireworks:

Single observer–generator pair, single dataset, single random seed (42), no multi-seed averaging.
Only 57 hallucination onsets in the test set — enough to raise eyebrows, not to fully convince.
The external advantage is CRF-specific, not consistent across architectures.
All models under 7B parameters; frontier and closed-box models untested; the method requires white-box access.
GPU-memory-intensive; currently offline, post-hoc analysis only.
A robustness check found that randomly chosen five layers performed comparably (PR-AUC 0.380 vs. 0.330) — useful signals are diffused across all layers; the whole building tells the truth.

Seeing the Mountain from Outside

Self-scrutiny has structural blind spots: the generator is hallucination's accomplice, hunting its own shadow. When self-examination must fail, the answer is not a better mirror but a borrowed one — and observation can be cheaper than the observed, since a 2B observer suffices for a 7B generator. This also inverts supervision's assumed hierarchy: a small model is not the large model's student but its mirror; a monitor's value depends on perspective difference, not capability.

Caveats remain: 57 single-seed samples support a direction, not a universal law. Open questions include cross-dataset generalization, minimum capability gaps between observer and observed, and white-box substitutes (distilled or peer models) for closed frontier models.

As the Song poet Su Shi wrote of Mount Lu: "It's not the true face of Mount Lu I cannot see, but that I stand within the mountain itself." He has no mirror — but from today we know mirrors can be lent to each other.

References

Kingshuk Gupta, Davide Buscaldi. *External Observers May See More Clearly: Cross-Model Span-Level Hallucination Detection in Large Language Models via Hidden State Probing.* arXiv:2610.02066 [cs.AI], 2026-10-01.
Related work mentioned: Zhou et al. (2025) Ghost in the Transformer; ICR Probe; Semantic Entropy Probes; RAG; FActScore; Ogasa baseline.