Why LLMs Invent Academic Citations—and How to Stop Ghost References

Introduction

Large language models now assist with theses, grant proposals, and journal articles, often drafting sections and reference lists.

Across 13 state-of-the-art models, hallucinated citation rates range from 14.23% to 94.93%—far too high to trust AI-generated bibliographies [11]. Fake references are now appearing in AI/ML and security venues, ACL conferences, and NeurIPS 2025 papers [5][11][12].

This article explains why LLMs fabricate citations, how ghost references enter citation indices and metrics, why retrieval alone is insufficient, and what a realistic architecture for citation-safe AI use requires.

---

1. The Ghost Citation Crisis: Scope and Evidence

Ghost references—citations to non-existent papers—have become a measurable systemic risk.

Key findings:

• A benchmark of 13 leading LLMs across 40 domains found hallucinated citation rates between 14.23% and 94.93% when asked to generate references [11].
• Independent audits of popular tools report 18–69% fabricated citations in typical use; some systems produce fake references more than half the time they attempt to cite scholarly work [2][11].

📊 Corpus-level contamination

Using the CiteVerifier framework, one study analyzed 2.2 million citations from 56,381 AI/ML and Security papers (2020–2025):

• 1.07% of papers contained invalid or fabricated citations.
• Such papers increased by 80.9% in 2025, coinciding with widespread LLM-assisted writing [11].

Top venues show similar issues:

• In >4,000 NeurIPS 2025 papers, at least 53 accepted papers contained hallucinated citations, including fabricated titles, authors, venues, and dead URLs [5].
• ACL conference analyses found incorrect arXiv IDs, broken links, and references to non-existent pages in otherwise solid work [12].

⚠️ Persistence and spread

Examples include:

• A non-existent paper accumulating over 40 citations in Google Scholar as authors repeatedly reused the same ghost reference [3][4].
• Editors receiving submissions citing articles “authored” by the editors themselves—papers that do not exist—indicating wholesale pasting of AI-generated references [3].

Mini-conclusion: Ghost citations are now a structural threat to scholarly reliability, already visible in leading venues and citation databases [11][12].

---

2. Why LLMs Invent Citations: Mechanics of Fabrication

LLMs are not bibliographic search engines; they are pattern-completion systems.

When prompted to “add references,” a model predicts the next most probable token based on training data saturated with citation-like strings—author-year patterns, venues, DOIs—without an indexed catalog of real papers [2][11]. It learns how references look, not whether any specific one exists [2].

💡 Pattern mastery without world anchoring

Consequences:

• Models generate plausible author combinations, titles, and venues.
• There is no native link from a generated reference to CrossRef, arXiv, PubMed, or publisher databases [2][11].

Two main failure modes follow:

• Ghost references: entirely fabricated but plausible works.
• Citation unfaithfulness: real papers cited for claims they do not support, often chosen for textual similarity rather than semantic relevance [1].

Asking models how “confident” they are in a citation does not help:

• They generate numbers that “sound right” given training patterns, biased toward high confidence [8][9].
• Re-running the same scoring prompt yields different values due to non-deterministic sampling, so there is no stable internal certainty [8].

⚠️ Fluent scholarly style without factual binding

Instruction tuning and RLHF optimize for helpful, fluent, decisive output. Models “write like scholars, cite like experts” [2], but:

• Nothing in the architecture enforces that references correspond to real works.
• Nothing guarantees that cited works actually support the associated claims [1][2][11].

Mini-conclusion: Citation fabrication is an emergent property of pattern-completion on scholarly text without binding to authoritative bibliographic databases [1][2].

---

3. How Fake Citations Cross Into the Scholarly Record

Ghost references would be manageable if they stayed in chat logs. The real damage occurs when they enter formal scholarly infrastructure.

Observed patterns:

• Instructors and editors find bogus citations in student papers that already appear in dozens of published articles, often with minor variations [3][4].
• Once a fake paper is cited in a publication, it gains derived legitimacy: others copy its references or trust Google Scholar’s representation without checking [1][3].

📊 Feedback loops in citation infrastructure

Citation indices like Google Scholar:

• Create citation records for references they cannot match to real documents, inferring stubs from bibliographies [1].
• Allow those stubs to accumulate further citations from human authors and LLM-assisted workflows, reinforcing the illusion of reality [1][4].

Examples include:

• A fabricated article on education governance listed as a highly cited paper in Google Scholar, despite never being written by the named authors [3].
• Student essays whose ghost references resolve to published articles that themselves cite the same non-existent studies [4].

NeurIPS 2025 analyses found:

• Hybrid citations blending elements from multiple real papers—authors from one, title motif from another, venue from a third—into a single unresolved reference [5].
• Invented authors, swapped venues, and dead URLs that still passed multi-reviewer peer review [5].

⚠️ Distorted metrics and claims

Because citation counts feed into promotion, funding, and journal rankings:

• Ghost and zombie citations distort impact indicators [3][11].
• Imaginary papers with many citations inflate the perceived rigor of work that leans on them.
• Polluted citations become training data for future AI systems.

Mini-conclusion: Once ghost citations enter journals, conferences, and indices, they fully participate in academic metrics, making them hard to detect and unwind [1][3][11].

---

4. Why RAG and Tools Help—but Do Not Fully Solve It

Retrieval-Augmented Generation (RAG) is often proposed as a fix: ground model outputs in retrieved documents so models can only cite what they see [1].

Empirical results:

• RAG reduces the number of claims a model marks as “cannot assess,” because retrieval supplies more evidence [6][7].
• In machine-generated news fact-checking, adding search results led to fewer abstentions and more decisive judgments [6][7].

💼 Grounded on what?

The same work found a key downside:

• Irrelevant or low-quality retrieval increased incorrect assessments, as models overfit to whatever evidence they were given [6][7].
• If retrieval includes polluted bibliographies or secondary mentions of ghost references, RAG can amplify fabrication and misattribution [1][6].

Common RAG citation failure modes:

• Letting models “fill in” missing fields—guessing DOIs, venues, or years from partial snippets.
• Blending metadata from multiple documents into a synthetic reference [5][12].
• Citing real papers from retrieval results that do not actually support the claim (citation unfaithfulness) [1][11].

⚠️ Evidence layer, not guarantee

Even with RAG:

• Ghost references may be reduced but not eliminated.
• There is no automatic check that each citation both exists and semantically supports the argument [1][11].

Mini-conclusion: RAG is valuable infrastructure but must be paired with explicit verification and quality-controlled retrieval. Grounding alone does not prevent ghost or unfaithful citations [1][6][7].

---

5. Human and Institutional Failure Modes: The Verification Gap

LLM “hallucinations” explain only part of the problem. Ghost citations spread because human and institutional practices leave a large verification gap.

Survey data from 94 researchers [11]:

• 41.5% copy-paste BibTeX entries without checking.
• 44.4% take no action when encountering suspicious references.
• 76.7% of reviewers do not thoroughly check references.
• 80.0% never suspect fake citations might be present.

In such conditions, LLM-generated fabrications pass through by default.

💡 Overload and misaligned incentives

The ACL community notes that exponential submission growth and reviewer overload push peer review toward shallow checks [12]. NeurIPS papers with hallucinated citations each passed three or more reviewers, showing that even elite venues do not systematically scrutinize bibliographies [5].

A parallel from journalism:

• Ars Technica retracted an article after AI-generated quotes were presented as real statements by a named individual, violating core trust in quotation [10].
• Policies against unlabeled AI-generated content existed; enforcement at publication time failed [10].

Similar patterns in scholarship:

• Students submit AI-written assignments with overlapping sets of fabricated references.
• Editors receive papers citing fake work attributed to themselves, showing authors did not read or sanity-check their own lists [3][4].
• Publication incentives reward volume and citation counts over meticulous evidentiary integrity [3][11].

⚠️ Governance and workflow, not just models

Vague standards like “citations must be accurate” and weak enforcement allow ghost citations to cross the publication boundary [10][11][12].

Mini-conclusion: LLMs accelerate a long-standing tendency to skip citation verification. Addressing it requires changes to incentives, workflows, and governance, not only better models [10][11].

---

6. A Preventive Architecture for Citation-Safe LLM Use

Citation integrity must be treated as a systems-design problem. Effective defenses span tooling, workflows, and policy.

6.1 Separate generation from verification

Use LLMs for drafting, not for authorizing references. Route every citation through an automated verifier (e.g., CiteVerifier) that [11]:

• Resolves DOIs, arXiv IDs, and URLs.
• Confirms titles, authors, venues, and years against canonical records.
• Flags non-existent or mismatched references for human review.

📊 Design principle: the model proposes; independent systems verify.

6.2 Evidence-based confidence, not model introspection

Avoid asking models how sure they are. Instead, compute trust from:

• Exact or near-exact matches between citation metadata and source documents.
• Successful URL or DOI resolution.
• Cross-document consistency in how a paper is described [8][9].

This avoids relying on numerically expressed “confidence” that LLMs cannot reliably calibrate [8][9].

6.3 Constrained RAG and adversarial checking

For RAG-based literature tools:

• Restrict citations to items that actually appear in the retrieved corpus; forbid invented DOIs or venues [1][6].
• Log retrieval traces for each citation so reviewers can inspect supporting documents.
• Use a second-pass “adversarial” model with retrieval access to challenge citations from the first pass, flagging suspect items for humans [6][7].

💼 Use LLMs as both writers and critics

Models are often better at spotting inconsistencies given evidence than at generating ground-truth citations. Allocate capacity to critique as well as draft.

6.4 Governance, review, and education

Institutions should adopt explicit rules that:

• Treat unverified AI-generated references like fabricated quotes in journalism—prohibited unless clearly labeled and independently validated before publication [10].
• Update reviewer forms and editorial checklists to ask whether a sample of references was independently verified for existence and relevance [5][12].
• Train authors and students that AI tools are unreliable citation engines; ghost references are a known failure mode, and humans remain responsible [2][4].

⚠️ Default stance: AI-supplied citations are untrusted until proven otherwise.

Mini-conclusion: Robust citation safety combines constrained generation, independent verification, adversarial checking, and clear governance. No single layer suffices; together, they can prevent LLMs from poisoning citation ecosystems [10][11].

---

Conclusion: Design for Citation Safety Up Front

LLMs fabricate citations because they are optimized for plausible text, not verified bibliographies. Even elite models hallucinate 14.23–94.93% of citations when asked to generate references, and ghost citations already appear in NeurIPS, ACL, and other AI/ML venues [5][11][12].

RAG, browsing, and self-reported confidence cannot, by themselves, solve a problem rooted in both model behavior and human verification gaps [1][6][8][9]. Citation indices and overloaded peer review pipelines allow fabricated references to enter the scholarly record and accumulate illegitimate influence [1][11].

A resilient response treats every AI-generated citation as untrusted until proven otherwise. That means coupling retrieval with automated verifiers, using LLMs as adversarial fact-checkers, instrumenting workflows with audits, and updating editorial and educational policies so ghost citations are seen as a preventable systems failure, not an inevitable side effect of automation [2][4][10][11].

Any deployment of LLMs in scholarly or high-stakes settings should be designed for citation safety from the outset—before ghost references become embedded in the bodies of work institutions rely on.