{"id":"977b909e-1299-48ad-93e2-e47cec6fea6f","arxiv_id":"2509.10004","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"IRIS detects LLM hallucinations by training a lightweight probe on hidden states elicited during the model's own step-by-step verification, using the model's verbalized confidence as soft pseudolabels.","lead":"IRIS asks an LLM to verify a factual statement, then uses the LLM's hidden states and its self-reported confidence to train a small classifier that flags hallucinations without any human labels. It reports accuracy gains over unsupervised baselines on three benchmarks and works with as few as 32 unlabeled statements to train.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"MIND baseline is evaluated with a proxy model and out-of-domain training data, so the claimed advantage over existing internal-state methods is not established.","rationale":"The reader identified three issues, with the weakest assumption being the validity of verbalized confidence as pseudolabels. I disagree that this is the most load-bearing concern. The paper provides direct evidence that the verbalized confidence separates true and false statements (Figure 3), and the Appendix B adversarial-prompt results actually indicate that the probe does not solely rely on the verbalized confidence: even when the pseudolabel is pushed to zero, the hidden-state-based probe retains accuracy. That robustness undercuts the reader's concern about pseudolabel corruption. The MIND baseline issue, however, is concrete and directly threatens the comparison with the most relevant prior internal-state method. The paper acknowledges MIND's intended access pattern (using the generating LLM's internal states) but substitutes a proxy model and a different training distribution. For HELM, the original generating models are open-source, so the paper could have run MIND faithfully. The reported accuracy gaps are therefore not a clean test of the methods. This concern does not overturn the entire paper—IRIS still beats direct prompting and uncertainty baselines—but it makes the claim 'IRIS outperforms existing unsupervised hallucination detection methods' conditional on a fair, in-distribution MIND evaluation. The proposed test would settle whether the advantage is real or an artifact of the evaluation protocol.","tokens_in":14537,"tokens_out":14448,"duration_ms":172163,"concrete_test":"Reproduce MIND on the HELM dataset using its original specification: load each generating model (Falcon, GPT-J, LLaMA-7B/13B, OPT-7B), use that model's own internal states during its continuation generation as features, generate auto-labels via named-entity matching against the original Wikipedia next sentence, train MIND's probe on the resulting in-domain labeled data, and evaluate on the same HELM split. If MIND's accuracy reaches or approaches IRIS's 68.43%, or if the gap narrows substantially, the paper's claim of consistent superiority over existing internal-activation methods would be seriously weakened.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The central claim that IRIS outperforms prior unsupervised hallucination detectors relies in part on comparisons to internal-activation methods, especially MIND. In Section 3.2, MIND is adapted: 'MIND assumes access to the LLMs that were used to generate the statements and use their contextualized embeddings as the features for training the probe. To conform to the same setting as our method, we do not have such access, and instead make use of the proxy model.' This changes two load-bearing factors. First, MIND's features come from Llama-3.1-8B-Instruct rather than the actual generating models. For HELM, those generating models (Falcon, GPT-J, LLaMA, OPT) are open-source and accessible, so the original access pattern is feasible. Second, MIND's probe is trained on its own automatically labeled dataset generated from Wikipedia by the proxy model, then tested on the target validation sets. IRIS, by contrast, trains on the target dataset's unlabeled statements. Thus the large gaps (e.g., 90.38 vs. 52.36 on True-False, 68.43 vs. 54.10 on HELM) confound method quality with training-domain mismatch and unavailable internal states. The paper's conclusion that IRIS beats the closest internal-activation baseline is therefore not yet supported; the measured degradation may stem from the evaluation protocol rather than IRIS's design.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes IRIS, an unsupervised hallucination detection method. For each statement, IRIS prompts an LLM to verify correctness with chain-of-thought reasoning, extracts the last-token contextualized embedding of the verification response, and uses the model's verbalized confidence as a soft pseudolabel. A small MLP probe is trained on these embeddings with soft bootstrapping and a symmetric cross-entropy loss. The authors report that IRIS outperforms existing unsupervised methods on True-False, HaluEval2, and HELM datasets, including gains of 3.2%, 7.0%, and 10.2% over the best baselines, and that it remains effective with as few as 32 training statements.","tokens_in":14900,"tokens_out":3477,"duration_ms":43724,"significance":"If the central claims hold, IRIS would be a practically appealing unsupervised hallucination detector: it requires only one LLM query per statement, uses lightweight probe training, and appears to transfer across topics and models. The paper includes useful analyses of out-of-distribution transfer, model size, layer depth, and training-data size, and provides a public code repository. However, the headline comparison with the internal-activation baseline MIND is confounded by a modified access assumption, and Appendix B exposes an unresolved tension in how IRIS obtains supervision when verbalized confidence collapses. These issues bear directly on the paper's main claim of consistent superiority over prior unsupervised internal-state methods.","major_comments":[{"comment":"The comparison with MIND is not apples-to-apples. MIND is originally designed to use the generating model's contextualized embeddings; here it is evaluated with a proxy model (Llama-3.1-8B-Instruct) and a probe trained on a different automatically labeled dataset. For HELM, the original generating models are openly available, so the original access pattern is feasible. The large gaps (90.38 vs. 52.36 on True-False; 68.43 vs. 54.10 on HELM) therefore confound method quality with training-domain mismatch and unavailable internal states. The claim that IRIS beats the closest internal-activation baseline is not yet supported; please either rerun MIND with its intended access or explicitly label this as an adapted baseline and soften the corresponding conclusion.","section":"§3.2, Table 1"},{"comment":"There is an unresolved contradiction about the pseudolabel mechanism. Appendix B states that under adversarial prompts the verbalized confidence scores are 'all pushed to zero, rendering the pseudolabels ineffective for training the classifier probe,' yet IRIS still reports high accuracy. Since IRIS trains on these verbalized-confidence pseudolabels, all-zero labels would leave no supervisory signal except the classifier's own bootstrapped predictions. The paper does not explain how training proceeds in this regime, what the pseudolabel distribution actually is, or why the probe still separates true from false statements. This is load-bearing because the method's stated source of supervision collapses exactly in the setting used to demonstrate robustness. Please provide the pseudolabel distributions, the effective targets after bootstrapping, and an explanation of the mechanism, or remov","section":"§2.2 and Appendix B"},{"comment":"The central assumption that verbalized confidence is a valid proxy for statement truthfulness is asserted but not directly validated against ground truth. Figure 3 compares verbalized confidence with token-probability entropy on an unlabeled dataset, but no calibration metrics (e.g., reliability diagrams, ECE, correlation with correctness labels) are reported. Since all pseudolabels are derived from this confidence, evidence of calibration is needed. Please add calibration analyses across datasets and model sizes, and ideally ablate the noise level in pseudolabels to show the training objective is robust to realistic miscalibration.","section":"§2.2, Figure 3"}],"minor_comments":[{"comment":"The cross-entropy term is written as H(ŷ_i, t_i) = t_i log ŷ_i + (1 - t_i) log(1 - ŷ_i) without a minus sign. In standard notation, minimizing this expression would maximize log-likelihood; please clarify whether the loss is negated or whether the equation denotes negative log-likelihood.","section":"Eq. (1)"},{"comment":"The prompt templates are referenced as Figure 6, but the figure content is not included in the text provided. Please include the actual prompts so the method is fully reproducible.","section":"Appendix A"},{"comment":"The HELM model names 'LLB-7B', 'LLC-7B', and 'LLC-13B' are not defined. Please expand or explain these abbreviations.","section":"Section 3.1 / Table 1"},{"comment":"The normalization of the soft pseudolabel is described only verbally. Specify the exact mapping from verbalized confidence or entropy to ỹ_i ∈ [0,1], including how '0 indicates hallucination' is operationalized.","section":"Section 2.2"},{"comment":"No variance or significance measures are reported. Given the small training sizes (e.g., 32 statements) and stochastic MLP training, reporting means and standard deviations over multiple seeds would strengthen the empirical claims.","section":"Table 1"}],"recommendation":"major_revision","confidential_remarks":"The core idea is interesting and the empirical results are suggestive, but the current manuscript does not yet establish the stated advantage over internal-activation baselines because of the MIND evaluation protocol. The Appendix B pseudolabel-collapse issue is more serious: it suggests the method may work even when the stated source of supervision is absent, which the paper does not explain. Both issues are fixable with additional experiments and analysis. I do not see a reason to reject, but the revisions need to address the measurement validity of the pseudolabels and rerun or more carefully qualify the MIND comparison."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nThe thing to know about this paper is that it proposes a genuinely workable recipe: take the hidden state of an LLM while it verbally verifies a statement, train a small probe on those embeddings using the model's own verbalized confidence as a soft pseudolabel. No human labels, one LLM call per statement, degrades gracefully with as few as 32 training examples. That's a useful combination, and it shows consistent gains over direct prompting, CCS, and the uncertainty baselines on all three datasets. The OOD transfer and training-data-size analyses are honest and informative.\n\nThe soft spots are real but not fatal. The MIND baseline is the main one. The paper adapts MIND to use a proxy model's embeddings rather than the generating model's, and trains MIND's probe on a different automatically labeled dataset. For HELM, the original generating models are open source, so the intended access pattern is feasible. As reported, the large gap between IRIS and MIND could come from domain mismatch and feature source, not from method quality. That comparison needs redoing or strong caveating.\n\nSecond, Appendix B. Under adversarial prompts, the paper states that verbalized confidence collapses to zero, making pseudolabels ineffective—yet IRIS still reports high accuracy. The explanation given, that hidden states contain useful information, doesn't account for how the probe is trained when the pseudolabels are all zero. Either the training uses a different signal or the robustness claim is not about the full pipeline. This needs a mechanistic answer.\n\nMinor: no error bars or significance tests on the main tables. For headline improvements of 3.2/7.0/10.2 percent, that's a nuisance.\n\nThe premise that verbalized confidence is a valid proxy for truthfulness is stated more than argued (Section 2.2). But the overall pattern—including transfer across topics and models—suggests the method is capturing something real.\n\nWho is this for? Researchers working on practical, low-cost hallucination detection. It deserves a serious referee. My recommendation: send it to peer review with the MIND experiment redone or clearly caveated, and the Appendix B mechanism explained.","headline":"IRIS is a genuinely new recipe for unsupervised hallucination detection—verification-response embeddings with verbalized-confidence pseudolabels—and it mostly works, but the MIND comparison and the degenerate-pseudolabel robustness result need strengthening before the claims fully land.","tokens_in":15314,"tokens_out":2539,"would_cite":true,"duration_ms":27295,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"IRIS detects LLM hallucinations without labeled data by training a lightweight probe on the model's own verification reasoning, using its verbalized confidence as a soft truth label.","keywords":["hallucination detection","unsupervised learning","internal representations","verbalized confidence","soft pseudolabel","chain-of-thought reasoning","probe training","factuality"],"falsifier":"Take a set of factual statements about a topic the LLM has never seen (for example, invented entities with plausible-sounding attributes), where the truth labels are known. If IRIS still reports above-chance accuracy, it would be exploiting a superficial pattern rather than genuine knowledge; if accuracy is at chance, the method's dependence on the model's internal knowledge is confirmed.","tokens_in":14483,"feed_emoji":"🕵️","tokens_out":4735,"duration_ms":44430,"temperature":0.7,"pith_summary":"IRIS is an attempt to show that an LLM's internal states, recorded while it reasons about whether a claim is true, carry enough truth-related signal to power a hallucination detector without any human labels. The method asks the model to verify a statement step by step, takes the last hidden state of that reasoning, and uses the model's verbalized confidence as a soft label for correctness. A compact probe is trained on these embeddings and outperforms earlier unsupervised methods on three benchmarks, with gains of 3.2%, 7.0%, and 10.2% over the best baselines. It needs only a single query per statement and works with as few as 32 training examples, making real-time, open-source detection plausible.","feed_headline":"Probe reads LLM reasoning to flag false claims unsupervised","feed_subtitle":"A lightweight probe trained on the model's own verbalized confidence beats unsupervised baselines by up to 10 points.","key_machinery":"The load-bearing component is the verification-response embedding: the last-token, last-layer hidden state of the LLM's chain-of-thought evaluation of the statement, paired with a soft pseudolabel equal to the model's verbalized confidence (normalized so 1 means true). The probe is a three-layer MLP (256,128,64) with ReLU and sigmoid, trained with soft bootstrapping—mixing the pseudolabel with its own current prediction—and a symmetric cross-entropy loss that resists fitting to noisy targets.","core_discovery":"The paper's central claim is that scrutiny of the model's own verification process—not the statement alone—yields internal representations that track factual correctness. IRIS prompts an LLM to evaluate a statement step by step, records the contextualized embeddings of its response, and treats the model's verbalized confidence as a soft pseudolabel for truth. A small MLP trained on these features with bootstrapped, noise-resistant targets generalizes across topics and datasets, beating direct prompting, multi-sample uncertainty estimates, and earlier internal-state probes in the unsupervised setting.","pith_inferences":["The robustness to adversarial prompts reported in the appendix hints that the hidden states, not the verbalized confidence, do most of the work; a decisive test would be training with deliberately reversed pseudolabels and checking whether accuracy collapses.","Because the pseudolabel slot accepts any uncertainty metric, IRIS can be seen as a general bridge between uncertainty estimation and internal-state probing, so replacing verbalized confidence with a better-calibrated score could extend the method to models that do not produce reliable self-reports.","The method opens a practical path to per-user or per-domain hallucination detectors: a few unlabeled statements, even self-generated by the target model, suffice to train a personalized probe without human annotation.","Passage-level hallucination detection, which the paper leaves for future work, could be built by decomposing a long answer into atomic claims and running IRIS on each."],"forward_implications":["IRIS requires only one LLM call per statement, enabling real-time hallucination detection with low computational overhead.","Detection accuracy degrades gracefully out of distribution (about 3.1% average drop), so a probe trained in one domain remains useful in another.","With as few as 32 training statements—even ones the model generates itself—IRIS maintains competitive accuracy, removing the need for large curated datasets.","Features from verification reasoning outperform features from the statement itself, confirming that reasoning traces are richer sources of truth signal.","Using SAR as an alternative pseudolabel shows the framework can absorb stronger uncertainty estimates, suggesting further gains as uncertainty metrics improve."],"fun_headline_variants":["Probe LLM reasoning to spot hallucinations without labels","Unsupervised detector reads LLM's own verification steps","Internal reasoning states detect LLM lies without labeled data","LLM's own confidence during fact-checking flags falsehoods","Using model's verification embeddings to catch hallucinations"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The load-bearing premise is that an LLM's stated confidence in its own verification is a trustworthy proxy for factual correctness, so that these soft pseudolabels genuinely point the probe toward truth-related features.","fun_headline_variants_meta":{"raw":{"variants":["Probe LLM reasoning to spot hallucinations without labels","Unsupervised detector reads LLM's own verification steps","Internal reasoning states detect LLM lies without labeled data","LLM's own confidence during fact-checking flags falsehoods","Using model's verification embeddings to catch hallucinations"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000226,"raw_usage":{"total_tokens":1261,"prompt_tokens":654,"completion_tokens":607,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":398,"completion_tokens_details":{"reasoning_tokens":529}},"tokens_in":398,"tokens_out":607,"duration_ms":6624,"temperature":1.0,"reasoning_tokens":529,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-04T18:19:10.015919+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a set of factual statements about a topic the LLM has never seen (for example, invented entities with plausible-sounding attributes), where the truth labels are known. If IRIS still reports above-chance accuracy, it would be exploiting a superficial pattern rather than genuine knowledge; if accuracy is at chance, the method's dependence on the model's internal knowledge is confirmed.","supporting_citations":[],"review_version":1}