Ten Is Not a Hundred

The problem

If you review it (and you are not an LLM), you see the problem in a second, and you don’t need a finance degree. The bank has a review pipeline for exactly this. It uses rules and an LLM judge. The judge breaks the answer into statements and asks itself whether each one follows from the context. It measures meaning. And in the space where meaning lives, “the total is 1,000 dollars” and “the total is 10,000 dollars” are almost the same sentence.

I spent a week measuring how the standard hallucination tools available today handle this problem. Then I spent a second week on the question underneath that one: whether any of them work at the operating point a production system actually runs at.

The short version of the second week is that the answer is no. Not the trained detectors, not the LLM judge, not the entailment models, and not the thing I built either. I will show you the whole grid, including the cells where I lose.

Hands on

I used RAGTruth [1], a public corpus of real RAG answers, and built a simple set: one hundred long, grounded responses (responses that match what the source document says), and for each one a copy with exactly the same answer but one number changed to a value that appears nowhere in the source document. A digit swapped, added or removed — 1,000 where the document says 10,000 or 35 where it says 53. The same error as above, two hundred times. I built this set myself, and later in this post I describe a method whose whole point is checking numbers.

I used five families of detectors, each one with a different approach.

| Ragas-style LLM judge [2][3][4] | The statement-decomposition pattern behind most “faithfulness” scores today |
| Embedding similarity with a frozen sentence encoder, aggregated by the mean | BERTScore’s recipe pointed at the retrieved context [5] |
| An entailment model | A DeBERTa cross-encoder trained on natural language inference [6] |
| LettuceDetect [7] | A span detector fine-tuned on thousands of labelled hallucinations, and the published state of the art at this size |
| MiniCheck [8][9] | The strongest small trained fact-checker I know of |

The results were close to unanimous.

Four of five detectors did not see the problem. Only MinCheck showed a modest signal.

Why do they miss it? Because all them are answering a different question.

Embedding methods average the error away

Existing methods mainly compress the answer into a vector and measure its distance to the context. A sixty-word answer wrong in one digit produces a vector almost identical to the correct answer’s. If we measure for, example, cosine similarity, we get a value around 0.99. But the answer from the model is wrong. The error dissolves the way a drop of ink dissolves in a pool.

Sentence encoders are trained with an objective that collapses paraphrase (two ways of saying the same thing must land in the same place). That objective is what makes retrieval work, and magnitude is the first thing it discards.

Encoders organise text by vocabulary, topic and structure. Never by truth.

The LLM judge has a different failure. The model doing the checking has the same blind spot as the model that made the mistake: it reads for plausibility. “The total is 1,000 dollars” is a perfectly plausible sentence about an invoice. Nothing in the prompt forces it to compare digits.

The trained detector fails because its training distribution decides what it can see. It learned the hallucinations its annotators labelled, and single-digit numeric substitutions are rare in those labels. We will come back to this one, measured.

The oldest idea in computing

The fix for the problem we are discussing could be the oldest idea in computing. When we manually check an answer against a document, we do not summarise both and compare summaries. We take each piece of the answer and look for it. “The invoice” — there. “A total” — there. “1,000” is not in the document. The document says 10,000.

The comparison happens at the resolution of the error. Word against word, so the wrong token is never averaged with its neighbours. And we are using two different tests for two kinds of content. For words, “where is this?” is a question about meaning. For numbers it is arithmetic: 1,000 either equals a value in the document or it does not. We don’t evaluate the similarity of the numbers. 1,010 is no more acceptable than 10,000: both are wrong.

Token-similarity metrics aggregate by the mean, and the mean is precisely where single-token errors go to die. So the answer-level figure here is the floor: the weakest anchor, or the mean of the few weakest.

I packaged this as a small open-source library, groundlens. No training, no labels, no API call — one forward pass of a frozen encoder you already have, plus a regular expression. About seventy milliseconds per answer on a CPU.

Five arenas

I ran everything on five sets: the wrong-number set above, RAGTruth QA (the span detector’s home benchmark), HaluEval QA, and the finance [10] and medical [11] subsets of HaluBench, which none of the compared methods was trained on.

Read the table across the diagonal. Every method wins where its own construction points and loses everywhere else. In other words, most hallucination detectors are built from specific corpora, so when you check them with this set, the results are excellent. The span detector wins its home benchmark. MiniCheck wins the paraphrase set. The LLM judge wins the medical set because the errors are wrong conclusions rather than wrong facts (and an LLM gets it right). My proposed method wins the set I built out of wrong numbers.

Figure 2 explains that there is no universal hallucination detector. There are specialists, and there is at least one error class, FinanceBench, where the correct answers are values computed from the documents rather than stated in them, where no detector works.

The value we need in production

All the experiments above uses AUROC as ranking metric. AUROC can be explained simply: given a good answer and a bad one, how often does the detector rank the bad one worse?

In production we do not run on rankings. We run on an operating point such us “catch at least 95% of the bad answers.” We need to quantify the risk. So the number that decides whether a deployed pipeline is usable is how many correct answers get flagged when we demand that recall.

Across the full grid the best false-positive rate at 95% recall is 0.65. Higher values are a risk. A detector flagging at random sits at 0.95, so 0.65 is better than nothing, but not enought to let you sleep.

Take a system where 15% of answers contain a defect. At 95% recall and a 0.65 false-positive rate you flag 69.5% of all traffic. Roughly one flag in five is a real defect, so four of five reviews are wasted — and you still miss one defect in twenty. Against simply reviewing everything, you have bought a 30% reduction in review volume for a 5% miss rate.

The most surprising point in the plot is the trained span detector. Best AUROC in the comparison, 0.817 on RAGTruth. At 95% recall it flags 99% of correct answers. The Ragas-style judge sits at 1.00 on all five datasets.

A ranking metric can look respectable while the operating point is unusable. We report the first and deploy against the second

Delete the evidence and see what survives

A grounding detector is supposed to compare an answer to its sources. So run the control: give it the answer with the evidence deleted entirely, and see how much performance is left.

| with evidence | with evidence deleted | |
| RAGTruth QA — its own training distribution | 0.817 | 0.635 |
| FinanceBench (out of distribution) [10] | 0.551 | 0.415 |
| PubMedQA (out of distribution) [11] | 0.525 | 0.480 |

On its home benchmark, LettuceDetect keeps 0.635 AUROC with no evidence at all: 43% of its above chance performance needs no grounding whatsoever. It has learned the stylistic fingerprint of whatever generated that corpus’s hallucinations: length, specificity, phrasing. That is a real feature, and an entirely local one. Out of distribution it does not just fade, it inverts. On FinanceBench the answer-only prior scores 0.415 (below random).

The lesson to learn is that without this control you cannot tell a detector that reads the evidence from one that has memorised what a hallucination sounds like in your test set. Right context, shuffled context, no context, just one extra run.

I argued something close to this in a paper last year [12]. Benchmark hallucinations are usually produced by prompting an LLM to write them, and that leaves a trace a detector can learn instead of the hallucination. I built a 212-pair human-confabulated set to measure the gap and found detection falling from 88–97% to 69–78%. What I did not do was run the cheapest possible version of the test. Here it is.

Conclusions

We should stop shipping verdicts. Nothing we have measured in this post earns one, and a verdict is a claim that carries an error rate every table above says you cannot afford. Ship marks instead. Not “this answer is wrong,” which nobody can say, but “these three words are the ones your sources least support, and here is the closest thing in the source to each.”

A threshold tells you an answer is bad, and when it is wrong it costs you. A list of words only tells you where to look, and when it is wrong it costs you a glance. One check takes five minutes and gets skipped. The other takes thirty seconds and gets done.

Contact

You can contact me at [email protected] for any comment, suggestion, constructive criticism, or just a chat. At the end of the post you will find more information of the open-source library with the approach explained in this post (Figure 1).

References

[1] Niu, C., Wu, Y., Zhu, J., Xu, S., Shum, K., Zhong, R., … & Zhang, T. (2024, August). Ragtruth: A hallucination corpus for developing trustworthy retrieval-augmented language models. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) (pp. 10862-10878).

[2] Es, S., James, J., Anke, L. E., & Schockaert, S. (2024, March). Ragas: Automated evaluation of retrieval augmented generation. In Proceedings of the 18th conference of the european chapter of the association for computational linguistics: system demonstrations (pp. 150-158).

[8] Tang, L., Laban, P., & Durrett, G. (2024, November). Minicheck: Efficient fact-checking of llms on grounding documents. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing (pp. 8818-8847).

[10] https://github.com/patronus-ai/financebench

[11] https://pubmedqa.github.io/

[10] Marín, J. (2025). Semantic grounding index: Geometric bounds on context engagement in RAG systems. arXiv preprint arXiv:2512.13771.

[12] Marín, J. (2026). A Geometric Taxonomy of Hallucinations in LLMs. arXiv preprint arXiv:2602.13224.

Groundlens

That is what groundlens does, with no threshold, on purpose: pip install "groundlens[encoder]". Read everything above at the size it was measured. The wrong-number column is mine, and the filter deciding what enters it is the same test the numeric channel later uses to decide, so **it is an engineering diagnostic rather than evidence about the world. **