When Auditors Fabricate: Batch-Size Degradation and Confident Hallucination in LLM Detection of Planted Document Contamination

2609.09696 ↗ · 2026-09-09 · cs.CL, cs.AI

Karan Parekh, Sanjana Pendyala Ravinder, Sana Mhapsekar, Medina Maloku

8 pages, 3 tables. Preprint also deposited at Zenodo, doi:10.5281/zenodo.21939088

The finding

Headline claim

An LLM auditor asked to detect planted document errors does not degrade gracefully under batch load: detection collapses from 50-60% at small scale to 2.8% at large scale, and the failure mode is confident fabrication of genre-consistent findings rather than abstention.

The test

450 contaminants (typos, semantic reversals, absurd insertions) planted in 150 real academic papers; Gemini 3.0 Pro (free tier) was asked to recover a 180-contaminant answer key across 60 documents under three prompting regimes (single document, small batch, large batch), scored programmatically against the key plus author-assigned Likert ratings.

Effect size & scope

Recovery was 3/6 (50%) single-document, 18/30 (60%) small batch, and 4/144 (2.8%) large batch, with four of six large batches recovering zero; by type, absurd insertions were caught at 75% but semantic reversals and typos only 50% in completed evaluations. Results hold only at tiny n: two single documents, two small batches, one run per regime, one model.

Limitations

Authors concede: single model, free tier, single scored run, no prompt or temperature variation, answer key covers only 180 of 450 contaminants, fixed density of three contaminants per document, author-assigned Likert ratings, and unresolved false positives in the single-document trial. Unstated: the collapse is confounded with the reference-based (rather than injected-content) deployment, so batch size and access mode are not separable; the sample per regime is far too small to distinguish batch effects from document or domain effects, which the authors' own numbers show.

Counterpoint

A skeptic would note this is a course-project-scale study: n of 2 documents in the single-doc regime, one run, no baselines, no other models, and the trigger for fabrication may be the RAG-style reference access rather than batch size, making the headline 'batch-size degradation' possibly a misattribution. Fabricated absurdities like 'quantum-powered toaster' are also exactly what a style-mimicking model would produce when the answer format is obvious, and a mechanical string-check would catch every fabricated finding, as the authors admit.

Economy implication

For AI economics in the next 12 to 24 months: little or nothing yet directly, but it is a concrete data point that LLM-as-quality-gate products cannot be trusted without verification infrastructure, which shifts some of the value of auditing deployments to harness and verification layers rather than the model itself.

Who this matters for

Technical Capability: Shows that nominal long-context capacity is irrelevant if the model fabricates instead of reporting incompleteness, and that mechanical verification against source text is a required harness component.

Labor & Knowledge Work: Anyone deploying LLMs as automated document auditors or quality gates should read fabricated, fluent audit findings as a live risk, since fluency carries no signal of correctness.

Regulatory & Legal: If firms use LLM auditors for compliance review, the demonstrated pattern of silent, confident fabrication supports requirements for human or mechanical verification loops in governed document-review workflows.

Bears on (advisory · papers never write evidence)

[1.3] Agentic reliability (multi-step completion without human correction) is improving materially, not just peak single-shot.

Abstract

Large language models are increasingly proposed as automated auditors of document quality, yet their reliability as detectors of planted errors is poorly characterised. We construct a contaminated corpus of 150 academic papers spanning supply chain management and medical research, injecting 450 known contaminants of three types: typographical corruption, semantic reversal, and absurd out-of-context insertion. We then evaluate Google Gemini 3.0 Pro's ability to recover a 180-contaminant answer-key subset across 60 documents under three prompting regimes of increasing scale: single document, small batch, and large batch. Detection holds at small scale and then collapses: 50% recovery on single documents, 60% on small batches, and 2.8% on large batches. The failure mode at scale is not abstention but fabrication. Rather than reporting incomplete processing, the model produced confident findings including invented contaminants of its own, absurdities such as "telepathic squirrel" and "quantum-powered toaster" that mimic the style of the planted material but do not appear in any document. Detection also varies by contamination type: absurd insertions were recovered at 75% in completed evaluations, while semantic reversals and typographical corruptions were each recovered at only 50%. The corruptions most likely to occur in the wild, plausible ones, are the ones most often missed. We conclude that LLM document auditing degrades not gracefully but deceptively, and outline the harness such systems require: bounded batch sizes, direct content injection, and mechanical verification of every reported finding against source text.