Verification and failure

Writing is now the cheap part of a book. The economics chapter puts a full draft of a 500-page book at a few dollars of model time, and twenty drafts at under a hundred. The expensive part is knowing whether the draft is true.

This chapter is about checking. It has three sections. The first collects what has been measured: how often AI research tools invent sources, how often they cite real sources for things those sources don't say, and how good the automatic checkers are at catching either. The second goes through the public failures of the last two years, from a newspaper reading list to a book about truth. The third turns all of that into a design: a list of the ways a sentence can be wrong, the check that catches each one, a two-stage gate, a sampling plan for the humans, and an error budget for a book of 150,000 words.

The pipeline chapter describes where the fact gate sits among the agents, and the tools chapter surveys the software. I won't repeat either. This chapter is about the failure rates and the arithmetic.

Why checking is the bottleneck#

The asymmetry#

A model writes a sentence in a fraction of a second. Checking that sentence means finding the source it came from, opening it at the right page, reading enough around the passage to understand it, and deciding whether the sentence says what the page says. For a person that takes minutes. Drafting runs in parallel and gets cheaper every year. Checking needs the source in hand, and the cost scales with the number of claims, not the number of drafts.

The scale is easy to underestimate. A 150,000-word book at about 18 words per sentence has a little over 8,000 sentences. In a book like Greene's, most of those carry a fact: a date, a name, a quote, a sequence of events, a number. If a careful person spends two minutes on each one, that is about 270 hours, close to seven full working weeks, for one pass. The short post that started this report estimated 200 hours for a Greene book by counting stories instead of sentences. The two estimates land in the same place.

A bigger pipeline makes this worse, not better. If the agents can produce ten books in the time it used to take to produce one, the checking bill is ten times larger, and the checking is the part that still needs eyes.

Fluent errors survive editing#

The second problem is that the errors that matter don't look like errors. Steven Rosenbaum, whose book is discussed below, wrote afterwards in Fortune that the obvious mistakes, such as broken URLs, false DOI numbers and unsourced quotes, were caught during editing. The ones that got through were the ones that read cleanly. His book went through several rounds of editing and proofreading and still shipped with invented quotes.

This is what separates AI errors from the typos editors are trained to find. A model's mistake has the same grammar, register and confidence as its correct sentences. Nothing on the surface flags it. The only test is the source.

Humans make the same error#

None of this means the human process was clean. Greene's method has a check built into it: he reads the source himself, so the person who writes the sentence is the person who read the page. Even so, copying by hand introduces mistakes. Ryan Holiday, talking with Greene in Los Angeles, explained why he sometimes types passages instead of writing them on the card: "my handwriting is so bad I found that I've been introducing errors and then I have to go back to the text".

That is a transcription error in a verbatim quote, the same failure that sank Rosenbaum, produced by a person with a pen. The difference is volume and direction. Holiday knew he was a weak point and went back to the text. A model doesn't know which of its sentences are the weak ones, and it produces thousands of them.

What has been measured#

The studies below measure different things. Some count URLs, some count citations, some count statements, some count whole papers. They use different models from different years. I've kept their denominators visible, because the numbers can't be averaged into one "hallucination rate".

Sources that don't exist#

The oldest baseline. In September 2023, Walters and Wilder published a study in Scientific Reports in which they had ChatGPT write short literature reviews on 42 topics, then checked the 636 citations. 55% of the GPT-3.5 citations were fabricated, against 18% for GPT-4. Among the citations that did exist, 43% of GPT-3.5's and 24% of GPT-4's had substantive errors. A commentary on the paper reports that GPT-4 fabricated 70% of the book chapters it cited; I found that figure only in secondary summaries, so treat it as unconfirmed. It matters for this report anyway, because a Greene book cites books, not journal articles.

Deep research products in 2026. The most useful recent study is Rao, Wong and Callison-Burch, from the University of Pennsylvania, posted to arXiv on April 3, 2026. They collected the URLs cited by ten models and agents on DRBench (100 research queries in Chinese and English, 53,090 URLs) and by three models on ExpertQA (2,177 questions in 32 fields, 168,021 URLs). Their definitions are worth copying exactly:

• A URL is non-resolving if it returns an HTTP 4xx or 5xx error or fails to connect. They excluded 403 responses, which are often bot blocking.
• A non-resolving URL is hallucinated if the Wayback Machine has no snapshot of it at any time, which suggests it never existed.
• A non-resolving URL with a snapshot is stale: it existed and has since gone offline.

The authors call the hallucinated rates conservative lower bounds, since a fabricated URL can happen to resolve.

The headline is that 3 to 13% of cited URLs were hallucinated and 5 to 18% didn't resolve. Two patterns in the table matter for a book pipeline.

First, the deep research agents were worse than the plain search models. Pooled, the agents hallucinated 10.7% of their URLs against 4.8% for search-augmented models, and they cited far more URLs per query. More reading, more citing and more autonomy produced more invented sources, not fewer.

Second, the rate varies by field. On ExpertQA, non-resolving rates ran from 5.4% in business to 11.4% in theology. For Claude Sonnet 4.5 alone they ran from 4.0% in mathematics to 17.4% in healthcare and medicine. History wasn't broken out, so I can't say where a book about power and human nature would fall.

The fix they tested. The same paper built urlhealth, an 83-line Python tool that classifies a URL as live, dead (stale), likely hallucinated or unknown, and gave it to models to check their own citations on 435 ExpertQA questions:

That is the source of the "6 to 79 times" figure in the short post. The paper adds a caution: the fix depends on the model using the tool well. In preliminary tests, gpt-5-nano called the tool and then failed to act on what it returned, leaving 7.5% of its links dead. A link checker only helps if something enforces its verdict.

The published literature. The fabrication has reached print. A Lancet study led by Maxim Topaz at Columbia, reported by STAT in May 2026, scanned more than 2 million papers and 97 million citations. It found about 4,000 fabricated citations in about 2,800 papers. The share of papers containing a fabricated reference went from 1 in 2,828 in 2023 to 1 in 458 in 2025, and to 1 in 277 in the first seven weeks of 2026. Topaz told STAT the study began after a chatbot he used to edit an editorial slipped in an erroneous citation. More than a third of the fabricated citations came from two large open-access publishers he declined to name. STAT also reported that Science runs an automated reference checker and found no fabricated citations in its published papers, while PLOS said its pilot tools produced many false positives.

Sources that exist but don't say it#

An invented source is the easy case, because a lookup kills it. The harder case is a real source cited for something it doesn't support.

DeepTRACE. This audit, by Salesforce AI Research and Microsoft Research, ran 303 queries (168 debate questions from ProCon.org and 135 expertise questions) through nine public systems and scored each answer on eight measures, including unsupported statements and citation accuracy. The abstract reports citation accuracy ranging from 40 to 80% across deep research configurations.

The paper's text gives Gemini's citation accuracy as 40.3%, which conflicts with the 50.3% in its own table. That is where the bottom of the "40 to 80%" range comes from. I'd quote the range, not either Gemini figure.

The judging was done by an LLM (GPT-5 by default), and the authors validated it against people: their factual-support judgments correlated with manual labels at 0.62 (Pearson) on 100 tasks, which they call moderate. They ran about 80,000 support evaluations. So even this audit is a machine checking a machine, with a moderate link to human judgment. The same is true of most numbers in this section.

Systems built to cite. The research systems designed around citations do better, and still miss often.

• AutoSurvey (NeurIPS 2024) writes literature surveys and then checks its citations. Its citation precision was 77.42% at 8,000 words and 77.41% at 64,000 words. Human-written surveys scored 87.50% and 77.78% on the same measure. So roughly one AutoSurvey citation in four or five doesn't support its claim, and at 64,000 words the human surveys weren't much better.
• STORM (NAACL 2024) reached citation recall of 84.83% and precision of 85.18%, judged by Mistral-7B.
• PaperQA2 (FutureHouse, 2024) ran a Wikipedia-style article writer called WikiCrow and compared 375 statements with Wikipedia. WikiCrow's cited-but-unsupported rate was 13.5% against 24.9% for Wikipedia. Its precision was 86.1% against 71.2%, and 3.5% of its statements were uncited against 13.6% for Wikipedia. Each article cost about $4.48.
• WikiChat (Stanford) is a chatbot rather than a writer, but its pipeline is the relevant one: draft, split the draft into claims, check each claim against retrieved evidence, drop what fails. It reported 97.3% factual accuracy in simulated conversations and 97.9% with real users on recent topics.

The WikiCrow comparison is worth a moment. A quarter of Wikipedia's cited statements, on the paper's sample, weren't supported by the cited source. That doesn't mean Wikipedia is wrong a quarter of the time; the fact may be true and the footnote sloppy. It does mean that "as good as human writers" is a low bar for citation support, and that the human baseline for a 150,000-word book is not zero.

The WikiChat number shows what a claim-by-claim filter does. It doesn't make the model better at facts. It removes what can't be supported, and the output gets shorter and safer.

Long-form factual precision#

Two older papers measure the share of individual facts in long text that hold up.

FActScore (Min et al., EMNLP 2023) splits a generated biography into atomic facts and checks each against Wikipedia. InstructGPT scored 42.5%, ChatGPT 58.3%, and PerplexityAI, which had a search engine, 71.5%. Three findings in the paper apply directly to a book:

• Precision drops for rarer subjects. For PerplexityAI it fell by a relative 50% at the atomic-fact level as entities got rarer. Greene likes obscure, out-of-print sources (the reading chapter covers this), which is exactly where models are weakest.
• Later facts in a generation were less accurate than earlier ones, across all models. Long outputs degrade.
• The automated estimator had an error under 2%, but that is at the level of the aggregate score, not individual facts. A plain retrieve-then-judge setup overestimated the score by up to 17%.

SAFE (Google DeepMind, 2024) has an LLM break text into facts, search Google for each, and judge support. On about 16,000 facts it agreed with crowdsourced annotators 72% of the time. On a random 100 of the disagreements, SAFE was right 76% of the time. It was more than 20 times cheaper than the annotators. The comparison was with crowdworkers, not professional fact-checkers, so "beats humans" here means "beats paid crowdworkers on a fact-by-fact task".

How good are the checkers?#

Every gate in this chapter leans on an automatic judge somewhere. So the question that matters most is how often that judge is wrong.

LLM-AggreFact is a leaderboard that asks one question across 11 datasets: does this document support this claim? I fetched the leaderboard on November 11, 2026. The top of the "Average" column, which the benchmark's paper defines as balanced accuracy:

Two things stand out. Small specialist models sit within a few points of frontier LLMs, so the checker can be cheap. And nothing is near 90. On hard, mixed benchmarks, the best support checker in the world is wrong on about one pair in five. A gate built on any of them flags. It doesn't prove.

"Verify with Caution." Ameya Godbole and Robin Jia (2025) re-ran five state-of-the-art factuality metrics on 11 datasets covering summarization, retrieval-augmented generation and question answering. They found that the metrics disagree with each other, often misjudge which system is better, and are biased against two kinds of output: heavily paraphrased text, and text supported by distant parts of the source. Their advice is to validate any metric by hand in your own domain before trusting it.

Those two biases shape the design later in this chapter. A pipeline that paraphrases a source heavily, or that pulls one sentence from facts on pages 40 and 212 of the same book, will get false alarms from its checker, and the alarms will hide the real errors. A pipeline that keeps a short verbatim quote right next to each sentence gives the checker the easiest possible case.

What the numbers add up to#

They don't add up to a single rate, and I'd be suspicious of anyone who gives one. What they do support:

• A model asked to research and cite, without a deterministic check, will produce some sources that don't exist. Measured rates run from about 3% of URLs for the better 2025 search models to 55% of citations for GPT-3.5 in 2023.
• A larger share of real citations won't support the sentence they're attached to. The best systems measured are at 12.5% (GPT-5 Deep Research) to about 23% (AutoSurvey) unsupported; the worst are far higher.
• A cheap link check removes most dead and invented URLs, as long as something enforces it.
• The automatic support checkers are about 75 to 80% accurate on hard benchmarks. They're useful filters and bad judges.
• Human writing has errors too. Wikipedia's cited-but-unsupported rate was 24.9% on WikiCrow's sample, and human surveys had 77.78% citation precision at 64,000 words.

What went wrong in public#

The measured rates are abstractions. The incidents show what the failures look like when they reach readers, and which check would have stopped each one.

A book about truth#

The Future of Truth: How AI Reshapes Reality by Steven Rosenbaum came out from Matt Holt/BenBella in May 2026. Kirkus summarized the New York Times report of May 19: the Times found several quotes in the book that were misattributed or made up. Kara Swisher told the paper that the quote attributed to her was not hers. Rosenbaum told the Times he had used ChatGPT and Claude "during the research, writing, and editing process," that this "does not excuse these errors," and that he took full responsibility.

Wired had published an excerpt from the book and retracted it. I could not reach Wired's own notice. Secondary coverage, which I could read, says the retraction was about doubt over how much of the prose was AI-written, under Wired's rule that published work can't be written with AI, and that an AI detector flagged the text. Detectors have high error rates (more on that below), so I'd take the detector score as a reason Wired asked questions, not as a finding.

Rosenbaum's own account in Fortune, published October 6, 2026, gives the details a pipeline designer needs:

• He used AI to organize research, summarize documents and refine language. He says the AI also "fixed" some quotes it judged could be improved.
• A Times media reporter first flagged a quote attributed to an anonymous DARPA researcher, then found the fabricated Swisher quote. Events were cancelled and a podcast was pulled.
• Two human fact-checkers then went through the manuscript and found 26 quotes that didn't hold up. Each was traced to a primary source and then corrected, paraphrased or removed.
• A revised edition with an author's note and a new chapter on hallucinations was scheduled for October 6.

The failure has a precise shape. The sources existed. The people existed. The words were wrong, or attached to the wrong person. A model that "improves" a quote has produced a misattributed quote, and no link checker or reference resolver will notice, because every pointer still resolves. Only a character-by-character match against the source text catches it.

A reading list of books that don't exist#

On May 18, 2025, a syndicated summer insert called "Heat Index" ran in the Chicago Sun-Times and The Philadelphia Inquirer. Its summer reading list had 15 books. Only five were real. The other ten were plausible titles attached to real, famous authors, such as a novel by Isabel Allende called Tidewater Dreams that she never wrote. The freelancer who wrote the section for King Features, a Hearst subsidiary, said he had used AI and hadn't checked: "It's on me 100 percent." King Features fired him. The Sun-Times said the list wasn't made or approved by its newsroom, and both papers removed the insert from their digital editions.

This is the simplest failure on the list and the cheapest to catch. Each title could have been checked against a library catalogue in under a second. It also shows the syndication problem: two newspapers printed it, which might look like two outlets vouching for the list, but there was one source and one writer.

A government report with invented studies#

The Make America Healthy Again report, released by a presidential commission on May 22, 2025, cited more than 500 sources. A week later, reporters Emily Kennard and Margaret Manto of NOTUS (the story was republished by Undark) found that seven of them did not appear to exist. Among them:

• A JAMA Pediatrics study on anxiety attributed to the epidemiologist Katherine Keyes, who said she hadn't written it.
• Two studies on direct-to-consumer drug advertising that didn't appear in the listed journals' tables of contents. One listed author's university said he never wrote such an article.
• A study on asthma overprescribing whose listed first author denied writing it.

The reporters also found real studies cited for things they didn't say. A review of therapy against medication was cited for a conclusion its statistician said it didn't address. A study on antipsychotics was cited for an 800% rise, while the paper reported an eight-fold increase over a different period. A screen-time study was attributed to Pediatrics and described as being about children, when it had studied college students.

The Washington Post (in a piece by Lauren Weber and Caitlin Gilbert, republished by the Anchorage Daily News) counted 522 footnotes, found that at least 37 appeared more than once, and found at least 21 dead links among the citations that had them. Some URLs contained the string "oaicite", which the Post described as a marker of OpenAI use. The White House press secretary called the problems "formatting issues". HHS replaced the fabricated citations within 24 hours of the NOTUS story, swapping five for different references and two for real studies by the same authors.

The MAHA report is useful because it has almost every failure type in one document: nonexistent sources, misattributed authorship, real sources misread, a number distorted in both size and time period, duplicated citations that inflate the apparent evidence, and dead links. I'll come back to it in the taxonomy.

A freelancer who doesn't exist#

In August 2025, Press Gazette reported that a freelance byline, "Margaux Blanchard", had placed at least seven articles in at least six publications since April. Press Gazette could find no record of a journalist by that name. The story unravelled when Jacob Furedi, editor of Dispatch, received a pitch about "Gravemont", a decommissioned mining town in Colorado. He couldn't find it, because it doesn't exist. The published pieces quoted people, such as an officiant named "Jessica Hu" in Wired's piece about couples marrying in Minecraft and Roblox, for whom no record could be found.

Wired removed its article with a note saying it "does not meet our editorial standards" and later wrote, "Unfortunately one got through." Business Insider removed two essays. Index on Censorship took down a piece it said "appears to have been written by AI". Cone Magazine and Naked Politics removed theirs.

Here the fabricated source is a person, and the existence check is harder. A book has a catalogue entry and a paper has a DOI. A private individual quoted in a feature story has nothing to look up. The only defence is the one Furedi used: ask for evidence and notice when none comes.

Hallucinated citations at a top AI conference#

GPTZero, which sells AI detection and citation checking, scanned 4,841 of the 5,290 papers accepted at NeurIPS 2025 and reported at least 100 hallucinated citations, each confirmed by a person. Its own report gives the number of affected papers as both "over 51" and 53, and Fortune's coverage says at least 53. Earlier, GPTZero had found 50 in ICLR 2026 submissions, and ICLR hired it to screen future submissions. GPTZero sells this service, so these are a vendor's numbers about a problem it profits from, and its methodology hasn't been audited independently.

The examples in the report are useful anyway because they show what fabricated references look like in the wild: real titles with invented or reshuffled authors, placeholder names such as "Firstname Lastname", arXiv IDs ending in "XXXX", DOIs that point to unrelated papers, and real papers cited to venues that never published them. Most of them are near misses, not pure inventions. A check that only asks "does a paper with roughly this title exist?" passes many of them. The check has to compare title, authors, year and venue together.

The NeurIPS board's response is also worth noting. It said that even if 1.1% of papers have one or more incorrect references, the content of those papers isn't necessarily invalid. That is true, and it's the same argument a book publisher might make. For a nonfiction book it misses the point: the citation is the reader's only way to check the claim.

Courts#

Damien Charlotin, a legal researcher, keeps a database of court decisions in which a judge found, explicitly or implicitly, that a party relied on hallucinated content. It excludes mere allegations. The research for this report found about 712 cases in December 2025 and about 1,624 by June 18, 2026. When I checked on November 11, 2026, the page listed 2,289, last updated November 10.

The breakdown says something about who gets caught and how. By party, 1,314 cases involved litigants representing themselves and 910 involved lawyers, with 34 judges and 18 experts. By type, 1,874 involved fabricated material, 970 misrepresented sources, 606 false quotes and 38 outdated advice (a case can have several). The United States accounts for 1,552 cases.

Courts are the one setting where a hostile reader checks every citation for free: the other side. That is why the count is so high. It isn't that lawyers hallucinate more than authors. Their errors meet a reader whose job is to find them. A book has no opposing counsel, which is why it needs its own.

Fake books on Amazon#

The incidents above are errors that slipped into otherwise real work. The Amazon cases are what happens when nothing is checked at all, because checking was never the goal. When Kara Swisher's Burn Book came out in 2024, NPR reported that AI-generated biographies of her appeared alongside it, "dozens and dozens" in her words, with similar covers. Five fake books appeared under the name of the publishing writer Jane Friedman. "Summaries" of new books appeared within days of publication. Amazon told NPR: "We have more recently begun limiting the publication of summaries and workbooks." Amazon also limits self-publishers to three new titles a day and asks them to disclose AI-generated content to Amazon, though not to readers.

These books are the subject of the dark machine chapter. For this chapter they mark the bottom of the scale. A pipeline with no fact gate doesn't produce a book with a few bad citations. It produces something that looks like a book.

What the institutions did#

Two responses are relevant to anyone planning to publish AI-assisted nonfiction.

The Authors Guild launched a "Human Authored" certification for members in January 2025 and, on March 2, 2026, opened it to all US authors at $10 a title for non-members, with a public database and licensing for publishers. The text has to be written by a person. Using AI for research, brainstorming, outlining, a table of contents or an index doesn't disqualify a book; generating the text does. The research files for this report note that the Guild relies on self-certification and doesn't treat AI detectors as reliable. A book written by the pipeline in this report could not carry the mark. A book where a person writes from AI-built cards might.

The Associated Press published generative AI standards on August 16, 2023. They treat AI output as "unvetted source material", to be checked against AP sourcing standards like anything else, and they bar staff from using it to create publishable content. Generative AI may not add or remove elements from photos, video or audio. The research files note a later update allowing some uses such as summaries and transcription; I didn't read that update directly.

The AP's phrase is the right frame for the whole pipeline. An AI-written sentence is a tip from an unvetted source. It becomes a fact when someone checks it against something that isn't the model.

What the incidents have in common#

Every one of these is a provenance failure: a quote, book, study, person or place that didn't come from where it claimed. None is a style failure. And none needed an AI detector to catch. The checks that would have caught them are lookups and string comparisons, the cheapest checks there are.

A taxonomy of failures#

To design a gate you need a list of the ways a sentence can be wrong, specific enough that each item maps to a test. These are the eight I'd use for a Greene-style book. They're ordered roughly from easiest to hardest to catch.

1. Nonexistent source#

The cited book, paper, article, case or person doesn't exist. Examples: Tidewater Dreams, the Keyes study, Gravemont, the NeurIPS placeholder authors.

This is what most people mean by hallucination and it's the easiest to catch, because it fails a lookup. In this report's pipeline it should be close to impossible, since cards are made from documents the pipeline has actually ingested. It comes back the moment an agent is allowed to cite from memory, or a drafter writes "as one historian put it" without a card.

2. Misattributed quote#

The source exists but the words aren't in it, or the words are real but belong to someone else. Examples: the Swisher quote, the 26 quotes in Rosenbaum's manuscript, the "false quotes" category in the court database.

This includes the case Rosenbaum described, where the model "improves" a real quote. The meaning may survive. The quote is still false, because quotation marks promise the exact words.

3. Real source, wrong place#

The source exists and says something like the claim, but not on the cited page, or in a different edition, or in a different chapter. Walters and Wilder's "substantive errors" in real citations (43% for GPT-3.5, 24% for GPT-4) are mostly of this family: wrong year, wrong volume, wrong pages. In a book, the common version is page drift between editions or between the PDF page index and the printed page number. The tools chapter notes that no existing tool keeps the printed page number of a scanned book.

The claim may be true, so readers don't notice. But the next person who checks can't find it, and a page reference that fails a check undermines every other page reference in the book.

4. Paraphrase drift#

The source supports a weaker, narrower or differently framed claim than the sentence makes. Examples: the MAHA screen-time study described as being about children when it studied college students; the therapy review cited for a conclusion it didn't reach.

In Greene's genre the drift tends to run in one direction: toward drama. A rumour becomes a fact, "some accounts say" disappears, a correlation becomes a motive. The story template in the chapter on building a chapter rewards exactly this sharpening, so the drafter has a built-in incentive to drift.

5. Distant support#

The sentence is supported, but only by combining passages far apart in the source, or across several sources. Each piece checks out on its own, and the combination may or may not.

Godbole and Jia found that factuality metrics are biased against this case: they mark correct sentences as unsupported when the support is spread out. So distant support causes two problems. Some of these sentences are wrong, because the synthesis is the model's. And the correct ones generate false alarms that train the human reviewers to click "fine".

6. Number and unit errors#

The number is wrong, or its unit, or its base, or its time period. Examples: the MAHA "800% rise" for an eight-fold increase over a different period. The arithmetic matters here: an eight-fold increase is a 700% rise, so even the conversion was off, and the period was wrong as well.

Numbers deserve their own category because the entailment checkers are weak on them. A model judging "does this passage support this sentence?" can see that both talk about a large increase in prescriptions and say yes. Numbers are also the easiest thing to check mechanically, if the check is written.

7. Stale facts#

The claim was true when the source was written and isn't now, or the link pointed to a page that has since changed or vanished. Rao and colleagues' "stale" URLs (existed once, offline now) are one form. The court database's "outdated advice" category is another. In a history book the common version is "the oldest", "the largest", "still standing", "the record" and "today", and figures such as sales or populations that change.

Greene's material is mostly about dead people, so staleness matters less than for a book on technology. It does matter for his framing sentences about the present, and for any URL in the notes.

8. Syndicated duplicates counted as independent#

Two or more sources that look independent but trace back to one origin. Examples: the Sun-Times and the Inquirer printing one syndicated list; the 37 MAHA footnotes that appeared more than once; two biographies that both repeat the same anecdote from one memoir.

This failure doesn't make a single sentence false. It makes the book overstate its confidence. "Several accounts agree" is a claim about independence, and a model reading three biographies that all cite the same 19th-century memoir will happily count three. In history this is the normal case, not an edge case: many famous anecdotes rest on one source.

Which check catches which failure#

There are five kinds of check. They differ in cost, in what they can see, and in how they fail.

• Existence lookup. Resolve the source against an outside registry: ISBN through Open Library or a library catalogue, DOI through Crossref, papers through OpenAlex or Semantic Scholar, URLs through an HTTP request plus the Wayback Machine. Deterministic and nearly free. It fails open on near misses unless title, authors, year and venue are matched together.
• Verbatim match. Compare the quoted words with the source text, character for character after normalizing whitespace, quote marks and Unicode, with a fuzzy fallback for OCR noise. Deterministic and cheap. It only works if the source text is in the pipeline.
• Page anchor. Confirm that the matched passage sits on the cited page of the cited edition. Deterministic, but needs a page map from the scan (printed page numbers, not PDF indices).
• Entailment model. A model such as MiniCheck, or an LLM judge, reads the card's passage and the sentence and estimates whether one supports the other. Cheap per call and about 75 to 80% accurate on hard benchmarks. Biased against paraphrase and distant support.
• Human. A person reads the sentence and the source page. The most accurate check and by far the most expensive. Also the only one that can catch a nonexistent private person, or a framing that is technically supported and still misleading.

The pattern is simple. The deterministic checks handle the first three failures and part of the sixth, completely and cheaply. Everything from paraphrase drift on is a judgment, and the automatic judges are weakest exactly where the stakes are highest. So the design should push as many sentences as possible into the deterministic column, and spend the human time on the rest.

The two-stage fact gate#

The pipeline chapter puts a fact checker among the critics and requires every factual sentence to carry a [card:ID]. Here is how that checker should work inside, and what it hands to people.

A card, as the pipeline chapter defines it, holds an exact quote, the source ID, the edition, the printed page and the agent's gloss. The gate assumes the source text and a page map are stored alongside.

Stage A: deterministic#

Stage A runs on every sentence and every card, takes seconds for a whole book, and never guesses. Each test passes or fails.

1. Every factual sentence has a card. A sentence with a date, a proper name, a number or a quotation mark and no [card:ID] fails. This is the job of the UnsourcedStory rule in the Greene Vale style, extended. Framing sentences with no facts in them are exempt, and the drafter has to mark them as such.
2. Every card ID resolves. The ID exists in the card store.
3. Every source exists. Each source behind a card has resolved once against an outside registry: ISBN, DOI, catalogue record or archived URL. For books, match title, author and year together. This runs when the source is ingested and again at publication.
4. Every URL is live or archived. Run the notes through a link checker such as lychee, and classify failures the way Rao and colleagues did: live, stale (archived), likely hallucinated (no archive at all). Live passes. Stale gets an archive link. Likely hallucinated fails.
5. The card's quote is in the source. Normalize Unicode, whitespace, curly quotes and hyphenation, then look for an exact match in the source text. If there's no exact match, allow a fuzzy match (the research dossier suggests a rapidfuzz score of at least 95) and send it to a person if it only passes fuzzily. OCR is noisy, and a fuzzy pass usually means a scanning error, but sometimes means an edited quote.
6. The quote is on the cited page. The matched span falls inside the page range the card claims, using printed page numbers for that edition.
7. Quoted words in the sentence match the card. Any text inside quotation marks in the draft must appear verbatim in the card's quote. This is the test that would have caught Rosenbaum's 26 quotes. No fuzzy fallback here: the source may be noisy, but the book's own quotes must be exact.
8. Numbers in the sentence appear in the card. Extract every number, date and unit from the sentence and look for it in the card, after normalizing ("eight-fold" to 8x, "1,400" to 1400, "the 1530s" to a range). A number in the sentence that isn't in the card fails unless it's marked as the author's own calculation, in which case the calculation goes in the notes and gets checked.
9. Independence is declared. When a sentence relies on more than one card for corroboration ("several accounts", "most historians"), the gate checks the cards' sources for shared origin: text overlap between the quotes, the same cited primary source, or the same author. If they share an origin, the claim of independence fails.

Stage A should fail closed. A sentence that fails any test goes back to the drafter with the reason, and the drafter fixes it or cuts it. The rule from the short post applies: if the chain breaks, the sentence goes.

Stage B: semantic#

Stage B runs only on sentences that pass stage A, and asks the question stage A can't: does the card actually support the sentence?

1. Entailment score. Run each sentence against the text of its card through a support checker such as MiniCheck (the 770M version runs on a CPU; the 7B on a GPU), which returns a probability of support. The MiniCheck README says to check one sentence at a time, which is how the pipeline already writes.
2. A second opinion for the middle band. Sentences that score in the uncertain middle go to an LLM judge with the card, the surrounding paragraph and a short instruction: say whether the sentence is supported, partly supported (stronger or more specific than the card), or unsupported, and name the unsupported words. A span-level tool such as LettuceDetect can highlight which words aren't covered.
3. Thresholds. The research gives one published default, Google's Vertex grounding check, which uses a citation threshold of 0.6. I wouldn't copy any number. Calibrate instead, as Godbole and Jia advise: have a person label about 300 sentence-card pairs from the actual corpus, plot the checker's scores against the labels, and set two cut-offs. Above the upper one, pass. Below the lower one, fail back to the drafter. Between them, send to the LLM judge, and to a person if the judge doesn't say "supported". Set the upper cut-off so that, on the labelled set, almost no unsupported sentence scores above it, and accept that this sends many fine sentences to the middle band.
4. Distance flag. If a sentence cites cards from pages far apart, or from more than one source, mark it as a synthesis. The checker is biased against these, so they skip the automatic pass and go to the middle band whatever their score.

What goes to a person#

Stage A and B sort every sentence into one of three bins: passed, failed (back to the drafter), or flagged for a person. These go to a person always, regardless of score:

• Every direct quotation of a named person. There are only a few hundred in a book, and they're the failure that has embarrassed real authors.
• Every sentence with a number that came from a calculation.
• Every fuzzy quote match from stage A.
• Every synthesis flagged in stage B.
• Every middle-band sentence the LLM judge didn't clear.
• Every claim about a living person that could be read as damaging.

And then a random sample of the sentences that passed, which is the subject of the next section. Without that sample, nobody knows how often the gate passes something false.

The gate in outline#

LOW and HIGH come from the calibration set, not from this chapter.

Sampling plans for the human audit#

The gate passes most sentences without a person looking at them. The question is how many of those passes are wrong. You can't check them all, since that would bring back the 270 hours. You can check a random sample and put a bound on the rate.

The rule of three#

Suppose a person checks n passed sentences, chosen at random, against the source pages, and finds no errors. What can you say about the error rate p among all passed sentences?

If the true error rate is p, the chance of drawing n clean sentences in a row is (1 − p)ⁿ. Call a rate "ruled out" if it would produce a clean sample less than 5% of the time. The largest rate not ruled out solves

(1 − p)ⁿ = 0.05

Take logarithms: n × ln(1 − p) = ln(0.05) = −2.996. For small p, ln(1 − p) is very close to −p, so n × p ≈ 3, which gives

p ≈ 3 / n

That is the rule of three. If you check n items and find no errors, you can say with 95% confidence that the error rate is below 3/n.

Worked through for the bounds that matter:

For example, at p = 1%, ln(0.99) = −0.01005, and 2.996 / 0.01005 = 298.1, so 299 clean sentences are enough. The approximation is good to within a sentence or two at these rates.

When the sample isn't clean#

If the sample finds errors, the bound gets wider. The standard 95% upper limits for a count of rare events (from the Poisson distribution) are about 3.00 for zero errors, 4.74 for one, 6.30 for two and 7.75 for three. Divide by n for the rate.

The table shows why the sample size matters more than it looks. Finding one error in 300 doesn't mean the error rate is 0.33%. It means you can't rule out 1.6%.

The size of the book barely matters. These bounds assume the sample is a small fraction of the population, which it is: 600 out of several thousand passed sentences. Checking 600 sentences bounds the rate about as well for a book of 3,000 factual sentences as for one of 30,000.

What the sample has to be#

The arithmetic only holds if the sample is honest. Four rules:

• Random. Draw sentences with a seeded random number generator from the full list of passed sentences, after the gate has run. Not the first chapter, not the ones that look risky, not the ones the reviewer has time for.
• Against the source, not the card. The auditor opens the source page, not just the card. Otherwise the audit can't see a card that was itself wrong (a quote on the wrong page, an OCR error that the fuzzy match accepted).
• Blind to the score. The auditor doesn't see the checker's confidence, so they don't relax on high scores.
• Counted by type. Each error found gets a label from the taxonomy above, so the next version of the gate can target what got through.

Stratify by risk#

Not all sentences carry the same risk, and a single sample over the whole book wastes effort on easy cases. A better plan splits the passed sentences into strata and samples each:

If any stratum's sample comes back with more errors than its target allows, the gate for that stratum is broken. The response is to fix the gate (lower its threshold, add a test) and re-run it on the whole book, not to fix the sampled sentences and ship. The errors the sample found are evidence about the errors it didn't.

Per chapter or per book?#

A book-level bound says nothing about any one chapter. If one chapter was drafted from a badly scanned source, its error rate could be ten times the book's and still hide inside a clean book-level sample. Bounding every chapter at 1% would need about 300 sentences per chapter, roughly 3,600 for a twelve-chapter book, which is close to checking everything.

The compromise: sample 50 passed sentences from every chapter as a tripwire (if a chapter's 50 contains two or more errors, audit that chapter in full) and run the stratified book-level sample on top. Fifty clean sentences only bound a chapter at 6% (3/50). That's loose, but it's enough to catch a chapter that is badly broken, which is the failure the book-level sample can't see.

An error budget for a 150,000-word book#

An error budget turns all of this into a plan: how many errors the draft will have, how many each stage removes, how many reach the reader, and how many hours of human work it takes. The numbers below are my assumptions, built from the measured rates above. Change them and the arithmetic still works.

The book#

Errors in the draft#

How wrong is a first draft written from cards? The measured rates are for systems that research and write in one go, which is harder than writing from pre-made verbatim cards, so they're a pessimistic starting point.

• Unsupported sentences. The best measured systems leave 12.5% (GPT-5 Deep Research in DeepTRACE) to 13.5% (WikiCrow) of statements unsupported; AutoSurvey's precision implies about 23%. Writing from cards should do better. I'll assume 5 to 15%: 250 to 750 of the 5,000 factual sentences.
• Bad references. Applying the 3 to 13% hallucinated-URL rate to 1,000 references gives 30 to 130, if the drafter is allowed to cite from memory. With cards built only from ingested sources, it should be close to zero, and stage A enforces that.
• Misquotes. No study measures how often a model alters a quote it was given verbatim. Rosenbaum's manuscript had 26 bad quotes that two human fact-checkers found. I'll assume 2 to 10% of the 400 quotes: 8 to 40.

What each stage removes#

Run the pessimistic end through. Of 750 unsupported sentences, say a third (250) are the kinds stage A catches outright: no card, number not in card, quote mismatch. Of the remaining 500, the synthesis sentences and middle-band scores go to people. Say 300 reach a person and 285 are caught. The other 200 get an entailment score. With a 25% miss rate, 50 of those pass.

So the pessimistic draft reaches the audit with about 65 errors left (50 missed by the checker, 15 missed by people), in about 4,000 passed or human-cleared sentences: roughly 1.6%. The optimistic end (250 unsupported to start) gives about 20, roughly 0.5%.

The target#

What should the target be? A 150,000-word book is about 500 printed pages. One error in ten pages would be 50 errors, about 1% of factual sentences. One in twenty pages would be 25, about 0.5%. For comparison, the human baselines measured above are much worse than either: Wikipedia's 24.9% cited-but-unsupported rate and the 77.78% citation precision of human surveys. Those measure citation support, not truth, but they show that 1% is a demanding target, not a lax one.

I'd set the budget at no more than 25 residual errors, 0.5% of factual sentences, with 95% confidence, and zero misquotes. The zero for quotes is achievable because stage A's verbatim test is exact and every quote also goes to a person.

To claim 0.5% with 95% confidence, the main stratum needs about 600 clean sampled sentences. On the pessimistic draft, the audit sample would find about ten errors in 600 (1.6%) and fail. That is the point of the audit: it tells you the gate's thresholds are too loose, and you tighten them and re-run. On the optimistic draft, the sample would usually find zero to three errors, and you'd pass at zero and might pass at one (0.8% bound, above target, so strictly a fail).

The hours#

The minutes per item are my estimates, assuming the source page opens next to the sentence with one click. If the auditor has to find the book and the page, multiply by three or four.

This is the uncomfortable result. The total is about the same as the 200 hours the short post estimated for checking by hand. The gate doesn't remove the human hours. It moves them: away from looking up every sentence, toward the sentences most likely to be wrong, and toward a sample that measures what's left. The output is different even when the hours aren't. Checking by hand gives a book whose error rate nobody knows. The gate plus the audit gives a book with a stated bound.

And if the audit fails and the gate has to be re-run, the second audit costs another 75 hours or so. Budget for at least one failure.

Where the budget is most fragile#

Three assumptions carry most of the weight.

• The stage B miss rate. The 20 to 30% comes from benchmark accuracy on mixed datasets, not from sentences written against verbatim cards. It could be much better on this task, or worse on 17th-century prose. The calibration set is what replaces this guess with a measurement.
• The draft's unsupported rate. No study has measured a model writing long narrative history from page-anchored verbatim cards. The 5 to 15% is a guess between "much better than deep research" and "no better".
• The auditor's accuracy. I assumed people catch 95% of what they're shown. Rosenbaum's book had five editorial rounds and still needed two more fact-checkers to find 26 bad quotes. Tired reviewers who see mostly correct sentences start agreeing with them. Keep the review sessions short and mix in a few planted errors to measure the reviewers too.

What this chapter can't settle#

• No benchmark matches the task. Every number above comes from web research, summarization, surveys or biographies against Wikipedia. Nobody has measured citation accuracy for a book-length narrative drafted from scanned, page-anchored print sources. The first real run of this pipeline would be the first measurement.
• The checkers were mostly judged by other models. DeepTRACE's judge correlated with people at 0.62. SAFE was compared with crowdworkers. FActScore's estimator is accurate for aggregates, not for single facts. The leaderboard accuracies are the most solid numbers here, and they top out below 80.
• AI detectors don't help. None of the incidents above was caught by a detector of AI-written text, and the Authors Guild and Wikipedia's AI cleanup project both describe the detectors as unreliable. Provenance checks found every one of them. The dark machine chapter discusses detection from the other side.
• Truth isn't support. Everything in this chapter checks whether a sentence matches its source. If the source is wrong, the gate passes the error with a perfect score. Greene's sources include legends, court gossip and memoirs written to settle scores. Deciding which of those to trust is the historian's judgment, and no gate in this chapter makes it.

Sources#