LEMON: Equivariant Learning over Attention Maps for Zero-Shot Misbehavior Monitoring on New LLMs

# LEMON: Equivariant Learning over Attention Maps for Zero-Shot Misbehavior Monitoring on New LLMs
Source: [https://arxiv.org/html/2610.22723](https://arxiv.org/html/2610.22723)
###### Abstract

Large language models exhibit misbehaviors that hinder deployment in high\-stakes settings\. One approach to monitor such failures is to use an external LLM as a monitor, but this is prohibitively expensive\. A well\-known and efficient class of monitors can detect such failures from internal representations \(such as activation probes\), but are tied to the model they were trained on, requiring costly re\-annotation as new LLMs appear\. A natural way to avoid this repeated annotation cost is to develop internal\-representation based monitors that transfer zero\-shot across LLMs\. However, such transfer is challenging because internal representations are not naturally aligned across models; in particular, attention maps, known to contain signals of misbehavior, may differ in head function, ordering, and model depth\. In this work, we characterize those cross\-model attention mismatches as algebraic symmetries and use geometric deep learning principles to buildLEMON\(Language\-modelEquivariantMOnitoringNetwork\) an*online*graph neural network\-based monitor, whose predictions are invariant under these symmetries\.LEMONprocesses attention maps token\-by\-token, as they are produced and outputs a score after every token \(or every window ofWWtokens\) at negligible cost\. Across 16 LLMs and six datasets, in the zero\-shot cross\-model setting,LEMONoutperforms all baselines on both hallucination and jailbreak monitoring tasks, improving over the strongest by up to 14 ROC\-AUC points\.111Code will be released soon\.

Guy Bar\-ShalomMor GevaTechnionTel Aviv UniversityFabrizio Frasca\*Haggai Maron\*TechnionTechnion, NVIDIA
11footnotetext:Equal supervision\.Same signal, different coordinatesL×HL\\times HNNNNseen in trainingunseen intraining■\\blacksquarethe signal can sit at a differentL×HL\\times Hcoordinate in each LLM⇒\\Rightarrowmismatch group𝒲=𝒮H≀𝒞L\\mathcal\{W\}=\\mathcal\{S\}\_\{H\}\\wr\\mathcal\{C\}\_\{L\}Our architecture: LEMONevery node and edge carries oneL×HL\\times Hfibre𝒲\\mathcal\{W\}\-equivariant message passingOnline monitoring an unseen LLMτ\\tauy^n\\hat\{y\}\_\{n\}TheMoonorbitsMars…haltno labels from the unseen LLM;the error is flagged*while*generatingFigure 1:Our framework for zero\-shot monitoring of misbehavior across LLMs\.\(left\)The attention map𝐀∈\[0,1\]N×N×L×H\\mathbf\{A\}\\in\[0,1\]^\{N\\times N\\times L\\times H\}is a stack of attention maps indexed by \(layer, head\)\.\(middle\)LEMONoperates on a structured, attributed graph constructed from the attention maps and applies𝒲\\mathcal\{W\}\-equivariant message passing\.\(right\)LEMONcan flag misbehavior*during*generation\.## 1Introduction

Despite their impressive capabilities, LLMs are known to exhibit undesirable behaviors: they may memorize training data\([Carlini et al\., 2021](https://arxiv.org/html/2610.22723#bib.bib41);[Nasr et al\., 2023](https://arxiv.org/html/2610.22723#bib.bib57)\), hallucinate responses\([Pagnoni et al\., 2021](https://arxiv.org/html/2610.22723#bib.bib25);[Cao et al\., 2022](https://arxiv.org/html/2610.22723#bib.bib26);[Qiu et al\., 2023](https://arxiv.org/html/2610.22723#bib.bib24)\), fall prey to flawed reasoning\([Song et al\., 2026](https://arxiv.org/html/2610.22723#bib.bib58)\), and be jailbroken\([Wei et al\., 2023](https://arxiv.org/html/2610.22723#bib.bib59);[Zou et al\., 2023](https://arxiv.org/html/2610.22723#bib.bib13)\), i\.e\., persuaded to generate harmful or otherwise restricted content\. As LLMs find growing use in high\-stakes domains, developing*lightweight*,*online*222Throughout,*online monitoring*means producing a score after each token \(or each window ofWWtokens\) during generation\.monitors that flag potential misbehavior on\-the\-fly becomes increasingly important\.

Misbehaviors can be monitored with separate, capable LLMs acting as*judges*: they can process the provided prompt, along with the generated response to assess whether a specific misbehavior has occurred\([Manakul et al\., 2023](https://arxiv.org/html/2610.22723#bib.bib23);[Souly et al\., 2024](https://arxiv.org/html/2610.22723#bib.bib62);[Mazeika et al\., 2024](https://arxiv.org/html/2610.22723#bib.bib63)\)\. This approach is, however, fundamentally incompatible with online applications due to its prohibitive computational cost incurred by the additionally required LLM executions\. A complementary and more agile class of monitors leverage instead the internal signals of the target LLM itself\([Azaria and Mitchell, 2023](https://arxiv.org/html/2610.22723#bib.bib19);[Kramár et al\., 2026](https://arxiv.org/html/2610.22723#bib.bib90)\): data such as hidden representations, attention maps, output token log\-probabilities\. A pioneering example is that of probing classifiers\([Belinkov, 2022](https://arxiv.org/html/2610.22723#bib.bib30)\), which train logistic regression models over activations to detect, e\.g\., the presence of the high\-level concept of incorrectness\. More recent approaches have generalized this idea by learning from more holistic views of the model’s internal computation and developing tailored architectures to process them[Bar\-Shalom et al\. \(2025\)](https://arxiv.org/html/2610.22723#bib.bib14);[Frasca et al\. \(2026\)](https://arxiv.org/html/2610.22723#bib.bib28);[Samuel et al\. \(2026\)](https://arxiv.org/html/2610.22723#bib.bib83)\. With their low latency, these approaches are fundamentally more suitable to monitor the generation process on the fly\. The best performing methods in this class, however, typically require access to annotated training datasets to estimate their parameters\. This represents a limiting factor preventing their immediate application to newly released LLMs, as each requires curating new misbehavior datasets and monitor retraining\.

Encouragingly, evidence suggests that internal representations preserve a similar underlying structure across models, differing primarily in the coordinates used to encode it\. For example,\([Huh et al\., 2024](https://arxiv.org/html/2610.22723#bib.bib51);[Morcos et al\., 2018](https://arxiv.org/html/2610.22723#bib.bib69);[Moschella et al\., 2022](https://arxiv.org/html/2610.22723#bib.bib68)\)showed that the activation spaces of different models capture similar semantic information and can even be related through linear transformations\. Likewise,\([Ivanitskiy et al\., 2025](https://arxiv.org/html/2610.22723#bib.bib70);[Elhelo and Geva, 2025](https://arxiv.org/html/2610.22723#bib.bib82)\)found recurring patterns in attention maps across models, although, potentially, at distinct layer\-head locations\. These observations motivate the main question we tackle in this paper:“Can we develop a learnable monitor capturing shared, model\-agnostic, features from attention maps that are predictive for misbehaviors?”

In this paper, we first demonstrate, through a concrete example of hallucination detection \(see[Figure2](https://arxiv.org/html/2610.22723#S3.F2)\), that a well\-known attention\-based heuristic score\([Chuang et al\., 2024](https://arxiv.org/html/2610.22723#bib.bib18)\)shows essentially no correlation across corresponding layers and heads across different models\. We then show that these mismatches can be characterized by algebraic symmetries of multi\-head attention\. These correspond to transformations of the attention maps that change them while leaving the overall attention function unchanged\. We argue that these should, therefore, be treated equivalently by the processing architecture, i\.e\., that we should design an*invariant*monitor\. We formally characterize these symmetries, which intuitively correspond to*independently*permuting the attention heads within each layer of the model, while also accounting for shifts \(translations\) of the layers themselves333The resulting symmetry group is the wreath productSH≀CLS\_\{H\}\\wr C\_\{L\}, whereSHS\_\{H\}captures independent permutations of theHHheads within each of theLLlayers, andCLC\_\{L\}acts by cyclically permuting the layers\.\. Motivated by prior work\([Frasca et al\., 2026](https://arxiv.org/html/2610.22723#bib.bib28)\), we formulate training a misbehavior monitor as a learning problem over an attention\-induced directed graph, which we propose to endow with\(L×H\)\(L\\times H\)\-structured attention scores as node and edge features, subject to the symmetries highlighed above\. We hence developLEMON\(Language\-modelEquivariantMOnitoringNetwork\), a graph neural network architecture designed to be invariant to these symmetries, thereby explicitly agnostic to cross\-model mismatches and hence directly applicable to unseen LLMs in a zero\-shot fashion \(see[Figure1](https://arxiv.org/html/2610.22723#S0.F1)\)\.

LEMONis evaluated comprehensively on two monitoring tasks, hallucination and jailbreak detection, across 16 LLMs and six datasets\. In this zero\-shot setting,LEMONsubstantially outperforms baselines while remaining extremely lightweight: it introduces less than 8% total overhead relative to standard generation\. Moreover,LEMONoperates online, allowing to halt a response mid\-generation, so that a misbehavior can be detected before completion\. We formalize this setting of*selective generation*along with token\-level coverage and risk metrics, and show that it offers a useful trade\-off between abstaining from generation and reducing error rates\.

#### Contributions\.

\(1\) We characterize a class of algebraic symmetries in multi\-head attention that induce layer\-head mismatches across models\. \(2\) We introduceLEMON, a symmetry\-aware monitor that transfers zero\-shot to unseen LLMs\. \(3\)LEMONoperates online, enabling*selective generation*with less than 8% overhead\. \(4\) Across 16 LLMs and six datasets on hallucination and jailbreak detection,LEMONconsistently outperforms prior baselines\.

## 2Related Work

#### Misbehaviors in LLMs and their monitoring\.

We broadly define misbehaviors as undesirable model outputs or actions deviating from intended operation\. They can take many forms, including hallucinations\([Yang et al\., 2025](https://arxiv.org/html/2610.22723#bib.bib2);[Bang et al\., 2025](https://arxiv.org/html/2610.22723#bib.bib12)\), jailbreaks and harmful assistance\([Bai et al\., 2022](https://arxiv.org/html/2610.22723#bib.bib3);[Yao et al\., 2024](https://arxiv.org/html/2610.22723#bib.bib8)\), reward hacking[Gao et al\. \(2023\)](https://arxiv.org/html/2610.22723#bib.bib1), sycophancy\([Sharma et al\., 2024](https://arxiv.org/html/2610.22723#bib.bib4);[Wang et al\., 2024](https://arxiv.org/html/2610.22723#bib.bib5)\), and reasoning shortcuts\([Yuan et al\., 2024](https://arxiv.org/html/2610.22723#bib.bib6);[Marconato et al\., 2024](https://arxiv.org/html/2610.22723#bib.bib7);[Panas et al\., 2025](https://arxiv.org/html/2610.22723#bib.bib10)\)\. While our approach is applicable to a broad range of model misbehaviors, in this work, we focus on hallucinations and jailbreak\-related behaviors, with an emphasis on hallucinations\.*Hallucinations*broadly refer to outputs unfaithful to the input context, prior reasoning, or external facts\([Liu et al\., 2022](https://arxiv.org/html/2610.22723#bib.bib22);[Huang et al\., 2023](https://arxiv.org/html/2610.22723#bib.bib31);[Ji et al\., 2023](https://arxiv.org/html/2610.22723#bib.bib21);[Rawte et al\., 2023](https://arxiv.org/html/2610.22723#bib.bib32)\)\. Recent work has explored learning\-based approaches that use model internals to monitor generation errors, drawing on signals such as hidden activations, attention maps, and output probabilities,\([Bar\-Shalom et al\., 2025](https://arxiv.org/html/2610.22723#bib.bib14);[Bar\-Shalom et al\., 2026](https://arxiv.org/html/2610.22723#bib.bib27);[Chuang et al\., 2024](https://arxiv.org/html/2610.22723#bib.bib18);[Azaria and Mitchell, 2023](https://arxiv.org/html/2610.22723#bib.bib19)\)\. A complementary line of work avoids model internals: response\-consistency methods\([Manakul et al\., 2023](https://arxiv.org/html/2610.22723#bib.bib23);[Kadavath et al\., 2022](https://arxiv.org/html/2610.22723#bib.bib36);[Farquhar et al\., 2024](https://arxiv.org/html/2610.22723#bib.bib9);[Kuhn et al\., 2023](https://arxiv.org/html/2610.22723#bib.bib33)\)sample several generations per query, and LLM\-as\-a\-judge monitors\([Zheng et al\., 2023](https://arxiv.org/html/2610.22723#bib.bib60);[Liu et al\., 2023](https://arxiv.org/html/2610.22723#bib.bib61);[Korbak et al\., 2025](https://arxiv.org/html/2610.22723#bib.bib11)\)score the \(query, response\) pair with a separate model\. Both therefore require one or more additional LLM inference passes, which is prohibitive for online monitoring\. A cheaper family uses the target model’s output distribution, using token probabilities as an uncertainty signal\([Guerreiro et al\., 2022](https://arxiv.org/html/2610.22723#bib.bib39);[Varshney et al\., 2023](https://arxiv.org/html/2610.22723#bib.bib37);[Huang et al\., 2023](https://arxiv.org/html/2610.22723#bib.bib40)\)\.

#### Equivariant Neural Networks\.

Invariance and equivariance principles guide the design of neural architectures for structured data by encoding known symmetries, such as rotations, translations\([Kondor and Trivedi, 2018](https://arxiv.org/html/2610.22723#bib.bib91);[Esteves et al\., 2018](https://arxiv.org/html/2610.22723#bib.bib88);[Esteves et al\., 2019](https://arxiv.org/html/2610.22723#bib.bib89);[Cohen and Welling, 2016](https://arxiv.org/html/2610.22723#bib.bib35);[Thomas et al\., 2018](https://arxiv.org/html/2610.22723#bib.bib44)\), and permutations\([Zaheer et al\., 2017](https://arxiv.org/html/2610.22723#bib.bib45);[Maron et al\., 2018](https://arxiv.org/html/2610.22723#bib.bib34)\), so that models do not need to relearn them from data\. A canonical example is*Graph Neural Networks*\(GNNs\)\([Gilmer et al\., 2017](https://arxiv.org/html/2610.22723#bib.bib20)\), with*Message Passing Neural Networks*\(MPNNs\) as a particular instantiation that aggregates neighboring information in a permutation\-equivariant manner\.

#### Cross\-model representation universality\.

A growing body of evidence suggests that independently trained neural networks converge on similar internal representations\. Prior work has focused mostly on*activations*: model stitching\([Bansal et al\., 2021](https://arxiv.org/html/2610.22723#bib.bib50)\), representation\-similarity measures\([Kornblith et al\., 2019](https://arxiv.org/html/2610.22723#bib.bib74)\), the platonic representation hypothesis\([Huh et al\., 2024](https://arxiv.org/html/2610.22723#bib.bib51)\), and neurons that recur across LLM seeds and families\([Gurnee et al\., 2024](https://arxiv.org/html/2610.22723#bib.bib52)\)\. For*attention*, studies have found head*roles*that recur across models, e\.g\., induction and retrieval heads\([Olsson et al\., 2022](https://arxiv.org/html/2610.22723#bib.bib53);[Wu et al\., 2025](https://arxiv.org/html/2610.22723#bib.bib54);[Elhelo and Geva, 2025](https://arxiv.org/html/2610.22723#bib.bib82)\)In both cases, the model appear to be converging toward similar computation, despite expressed in different coordinates\. To the best of our knowledge, we are the first to move beyond hand\-crafted procedures for recovering those coordinates, and instead learn a permutation\-equivariant function that extracts the relevant signal for monitoring any unseen LLM zero\-shot\.

## 3Extracting Universal Attention Representations

While attention computation\([Vaswani et al\., 2017](https://arxiv.org/html/2610.22723#bib.bib38)\)is widely used across LLMs, layer–head indices are not comparable across models: functionally similar heads may appear at different coordinates\.

#### Motivating example\.

To make this coordinate mismatch concrete, we considerLookbackLens\(LB\)\([Chuang et al\., 2024](https://arxiv.org/html/2610.22723#bib.bib18)\), a per\-token, per\-head feature derived from attention scores for detecting hallucinations in LLMs\. This setting allows us to test whether functionally similar signals occupy consistent coordinates across models\. The basic idea behind the example is simple:LBtakes on low values at specific layers and heads for tokens that are likely to hallucinate\. However, we show that the particular layers and heads exhibiting this hallucination\-associated pattern differ substantially across models\. Here, we highlight only the key insights, deferring the full details of the example to[AppendixA](https://arxiv.org/html/2610.22723#A1)and further background onLBto[AppendixB](https://arxiv.org/html/2610.22723#A2)\. We use the RagTruth data\-to\-text benchmark\([Niu et al\., 2024](https://arxiv.org/html/2610.22723#bib.bib55)\), and the two LLMs,Llama\-2\-7B\([Touvron et al\., 2023](https://arxiv.org/html/2610.22723#bib.bib16)\)andMistral\-7B\([Jiang et al\., 2023a](https://arxiv.org/html/2610.22723#bib.bib15)\), both of which have the same number of layers and heads –3232\. The two heatmaps in[Figure2](https://arxiv.org/html/2610.22723#S3.F2)\(left\) show this feature over each model’s32×3232\\times 32\(layer×\\timeshead\) grid: both exhibit a pronounced hallucination\-associated signal, but at*different*coordinates\. For example, at layer3030, head1313\(the highlighted cell\), the feature is near\-maximal in Llama\-2\-7B yet vanishes in Mistral\-7B\. The scatter plot in[Figure2](https://arxiv.org/html/2610.22723#S3.F2)\(right\) makes this precise: each point pairs the two models’ feature values at one*matched*\(ℓ,h\)\(\\ell,h\)coordinate\. If heads and layers played the same roles in both models, the points would concentrate along the diagonal; instead they are essentially uncorrelated \(Pearsonr=0\.04r=0\.04across all32×3232\\times 32cells\), with the highlighted cell landing in the bottom\-right corner \(★\\bigstar\)\. Although we present this insight using a single token for clarity,[AppendixA](https://arxiv.org/html/2610.22723#A1)shows that the same phenomenon holds across all hallucinated tokens\.

![Refer to caption](https://arxiv.org/html/2610.22723v1/figures/head_permutation_motivation.png)Figure 2:Motivating example: Head and layer roles vary across LLMs\.The same hallucinated token produces distinct32×3232\\times 32head patterns, with matched\(ℓ,h\)\(\\ell,h\)values uncorrelated \(r=0\.04r=0\.04\)\.
#### Aligning heads is not enough\.

A natural fix to this mismatch is to*undo*it by relabeling each LLM’s layer–head coordinates into a shared canonical indexing, thereby matching heads across models, and then training a standard classifier on the aligned features\. We develop such an alignment procedure \([AppendixE](https://arxiv.org/html/2610.22723#A5)\), but show experimentally \([Section4](https://arxiv.org/html/2610.22723#S4)\) that it is suboptimal compared to an architecture that is inherently invariant to these mismatches, which is the main focus of this work\. We conclude this section with the central research question of this work:

*Are the attention signatures of misbehavior shared across LLMs up to a relabeling of heads and layers? And can a monitor learn to read it in an unseen LLM?*

### 3\.1Preliminaries and Setup

Given a misbehavior identification task of interest, e\.g\., hallucination, we assume access to labeled data collected from𝒦\\mathcal\{K\}LLMs, indexed byk∈\{1,…,𝒦\}k\\in\\\{1,\\ldots,\\mathcal\{K\}\\\}\. Each example consists of a querypqp\_\{q\}, optionally accompanied by contextual informationpcp\_\{c\}, and a responserrgenerated by the model\. Each example is associated with a binary labelyy, which may be defined either at the token level or at the whole sentence level\. The complete dataset is given by,⋃k=1𝒦\{\(pq\(i,k\),pc\(i,k\),r\(i,k\),y\(i,k\)\)\}i=1Mk\\bigcup\_\{k=1\}^\{\\mathcal\{K\}\}\\left\\\{\\left\(p\_\{q\}^\{\(i,k\)\},p\_\{c\}^\{\(i,k\)\},r^\{\(i,k\)\},y^\{\(i,k\)\}\\right\)\\right\\\}\_\{i=1\}^\{M\_\{k\}\}, where the superscript\(i,k\)\(i,k\)denotes theii\-th example associated with thekk\-th LLM, andMkM\_\{k\}denotes the number of labeled examples available for modelℒk\\mathcal\{L\}\_\{k\}\. We use the LLM’s*attention*as its internal signal, representing each example by the attention map𝐀∈\[0,1\]N×N×Lℒ×Hℒ\\mathbf\{A\}\\in\[0,1\]^\{N\\times N\\times L\_\{\\mathcal\{L\}\}\\times H\_\{\\mathcal\{L\}\}\}, whereNNis the number of the considered tokens in the sentence, andLℒL\_\{\\mathcal\{L\}\}andHℒH\_\{\\mathcal\{L\}\}are the numbers of layers and heads in LLMℒ\\mathcal\{L\}\. Thus, the training dataset𝒟\\mathcal\{D\}is given by:𝒟=⋃k=1𝒦\{\(𝐀\(i,k\),y\(i,k\)\)\}i=1Mk,\\mathcal\{D\}=\\bigcup\_\{k=1\}^\{\\mathcal\{K\}\}\\left\\\{\\bigl\(\\mathbf\{A\}^\{\(i,k\)\},\\,y^\{\(i,k\)\}\\bigr\)\\right\\\}\_\{i=1\}^\{M\_\{k\}\},where𝐀\(i,k\)\\mathbf\{A\}^\{\(i,k\)\}is the attention map for theii\-th example from LLMℒk\\mathcal\{L\}\_\{k\}\. Our goal is to develop an architecture that learns to extract model\-invariant attentional signals from𝒟\\mathcal\{D\}, enabling*zero\-shot*transfer to a previously unseen LLM for which no task\-specific labeled data are available\.

### 3\.2Cross\-Model Attention Symmetries and Equivariant Layers

In what follows, we formalize cross\-model mismatches in attention maps as*symmetries*and characterize them as group actions\. We then introduceLEMONa network invariant to these symmetries\.

𝐀ℓ,1​𝐕ℓ,1\\mathbf\{A\}^\{\\ell,1\}\\mathbf\{V\}^\{\\ell,1\}N×d2N\\times\\tfrac\{d\}\{2\}𝐀ℓ,2​𝐕ℓ,2\\mathbf\{A\}^\{\\ell,2\}\\mathbf\{V\}^\{\\ell,2\}N×d2N\\times\\tfrac\{d\}\{2\}𝐏ℓB\\mathbf\{P\}^\{\\mathrm\{B\}\}\_\{\\ell\}×\\times𝐖O,ℓ,1\\mathbf\{W\}^\{O,\\ell,1\}d2×d\\tfrac\{d\}\{2\}\\times d𝐖O,ℓ,2\\mathbf\{W\}^\{O,\\ell,2\}d2×d\\tfrac\{d\}\{2\}\\times d𝐖O,ℓ\\mathbf\{W\}^\{O,\\ell\}\(𝐏ℓB\)⊤\(\{\\mathbf\{P\}^\{\\mathrm\{B\}\}\_\{\\ell\}\}\)^\{\\\!\\top\}

Figure 3:MHA symmetries\.#### Attention head\-permutation symmetries\.

In a standard*Multi\-Head Attention*\(MHA\) block at layerℓ\\ell, each headh∈\{1,…,H\}h\\in\\\{1,\\ldots,H\\\}produces an attention map𝐀ℓ,h∈ℝN×N\\mathbf\{A\}^\{\\ell,h\}\\in\\mathbb\{R\}^\{N\\times N\}and value projections𝐕ℓ,h∈ℝN×d/H\\mathbf\{V\}^\{\\ell,h\}\\in\\mathbb\{R\}^\{N\\times d/H\}, and the concatenated head outputs are mixed by an output projection𝐖O,ℓ∈ℝd×d\\mathbf\{W\}^\{O,\\ell\}\\in\\mathbb\{R\}^\{d\\times d\}\. For any head permutationσℓ∈𝒮H\\sigma\_\{\\ell\}\\in\\mathcal\{S\}\_\{H\}with the corresponding block\-permutation matrix𝐏ℓB≔𝐏σℓ⊗𝐈d/H\\mathbf\{P\}^\{\\mathrm\{B\}\}\_\{\\ell\}\\coloneqq\\mathbf\{P\}\_\{\\sigma\_\{\\ell\}\}\\otimes\\mathbf\{I\}\_\{d/H\}, inserting𝐏ℓB​𝐏ℓB⊤=𝐈\\mathbf\{P\}^\{\\mathrm\{B\}\}\_\{\\ell\}\{\\mathbf\{P\}^\{\\mathrm\{B\}\}\_\{\\ell\}\}^\{\\\!\\top\}=\\mathbf\{I\}into the MHA output444Grouped \(multi\-query\) attention shares query/key/value projections among subsets of heads; permutations must then act within each sharing group\. The extension is straightforward\.gives,

MHAℓ⁡\(𝐗ℓ\)\\displaystyle\\operatorname\{MHA\}^\{\\ell\}\(\\mathbf\{X\}^\{\\ell\}\)=\[𝐀ℓ,1​𝐕ℓ,1​‖⋯‖​𝐀ℓ,H​𝐕ℓ,H\]​𝐏ℓB​𝐏ℓB⊤​𝐖O,ℓ\\displaystyle=\\bigl\[\\mathbf\{A\}^\{\\ell,1\}\\mathbf\{V\}^\{\\ell,1\}\\,\\\|\\,\\cdots\\,\\\|\\,\\mathbf\{A\}^\{\\ell,H\}\\mathbf\{V\}^\{\\ell,H\}\\bigr\]\\,\\mathbf\{P\}^\{\\mathrm\{B\}\}\_\{\\ell\}\\,\{\\mathbf\{P\}^\{\\mathrm\{B\}\}\_\{\\ell\}\}^\{\\\!\\top\}\\mathbf\{W\}^\{O,\\ell\}=\[𝐀ℓ,σℓ​\(1\)​𝐕ℓ,σℓ​\(1\)​‖⋯‖​𝐀ℓ,σℓ​\(H\)​𝐕ℓ,σℓ​\(H\)\]​𝐏ℓB⊤​𝐖O,ℓ,\\displaystyle=\\bigl\[\\mathbf\{A\}^\{\\ell,\\sigma\_\{\\ell\}\(1\)\}\\mathbf\{V\}^\{\\ell,\\sigma\_\{\\ell\}\(1\)\}\\,\\\|\\,\\cdots\\,\\\|\\,\\mathbf\{A\}^\{\\ell,\\sigma\_\{\\ell\}\(H\)\}\\mathbf\{V\}^\{\\ell,\\sigma\_\{\\ell\}\(H\)\}\\bigr\]\\,\{\\mathbf\{P\}^\{\\mathrm\{B\}\}\_\{\\ell\}\}^\{\\\!\\top\}\\mathbf\{W\}^\{O,\\ell\},\(1\)where𝐗ℓ∈ℝN×d\\mathbf\{X\}^\{\\ell\}\\in\\mathbb\{R\}^\{N\\times d\}are the layer\-ℓ\\elltoken representations\. Hence the relabeling𝐀ℓ,h↦𝐀ℓ,σℓ​\(h\)\\mathbf\{A\}^\{\\ell,h\}\\mapsto\\mathbf\{A\}^\{\\ell,\\sigma\_\{\\ell\}\(h\)\},𝐕ℓ,h↦𝐕ℓ,σℓ​\(h\)\\mathbf\{V\}^\{\\ell,h\}\\mapsto\\mathbf\{V\}^\{\\ell,\\sigma\_\{\\ell\}\(h\)\},𝐖O,ℓ↦𝐏ℓB⊤​𝐖O,ℓ\\mathbf\{W\}^\{O,\\ell\}\\mapsto\{\\mathbf\{P\}^\{\\mathrm\{B\}\}\_\{\\ell\}\}^\{\\\!\\top\}\\mathbf\{W\}^\{O,\\ell\}leaves the function computed by the block unchanged – with a possibly*different*permutation at every layer, as indicated by the subscriptℓ\\ell\.[Figure3](https://arxiv.org/html/2610.22723#S3.F3)illustrates the caseH=2H=2, where𝐖O,ℓ,h\\mathbf\{W\}^\{O,\\ell,h\}denotes thehh\-th head block of𝐖O,ℓ\\mathbf\{W\}^\{O,\\ell\}\.

h=1h\\\!=\\\!1h=2h\\\!=\\\!2h=3h\\\!=\\\!3ℓ=1\\ell\\\!=\\\!1ℓ=2\\ell\\\!=\\\!2ℓ=3\\ell\\\!=\\\!3𝐀n1,n21,1\\mathbf\{A\}\_\{n\_\{1\},n\_\{2\}\}^\{1,1\}𝐀n1,n21,2\\mathbf\{A\}\_\{n\_\{1\},n\_\{2\}\}^\{1,2\}𝐀n1,n21,3\\mathbf\{A\}\_\{n\_\{1\},n\_\{2\}\}^\{1,3\}𝐀n1,n22,1\\mathbf\{A\}\_\{n\_\{1\},n\_\{2\}\}^\{2,1\}𝐀n1,n22,2\\mathbf\{A\}\_\{n\_\{1\},n\_\{2\}\}^\{2,2\}𝐀n1,n22,3\\mathbf\{A\}\_\{n\_\{1\},n\_\{2\}\}^\{2,3\}𝐀n1,n23,1\\mathbf\{A\}\_\{n\_\{1\},n\_\{2\}\}^\{3,1\}𝐀n1,n23,2\\mathbf\{A\}\_\{n\_\{1\},n\_\{2\}\}^\{3,2\}𝐀n1,n23,3\\mathbf\{A\}\_\{n\_\{1\},n\_\{2\}\}^\{3,3\}𝐀\\mathbf\{A\}g=\(π,σ→\)g=\(\\pi,\\vec\{\\sigma\}\)π=\(1 2 3\)\\pi\\\!=\\\!\(1\\;2\\;3\)h=1h\\\!=\\\!1h=2h\\\!=\\\!2h=3h\\\!=\\\!3ℓ=3\\ell\\\!=\\\!3ℓ=1\\ell\\\!=\\\!1ℓ=2\\ell\\\!=\\\!2𝐀n1,n23,2\\mathbf\{A\}\_\{n\_\{1\},n\_\{2\}\}^\{3,2\}𝐀n1,n23,1\\mathbf\{A\}\_\{n\_\{1\},n\_\{2\}\}^\{3,1\}𝐀n1,n23,3\\mathbf\{A\}\_\{n\_\{1\},n\_\{2\}\}^\{3,3\}𝐀n1,n21,3\\mathbf\{A\}\_\{n\_\{1\},n\_\{2\}\}^\{1,3\}𝐀n1,n21,2\\mathbf\{A\}\_\{n\_\{1\},n\_\{2\}\}^\{1,2\}𝐀n1,n21,1\\mathbf\{A\}\_\{n\_\{1\},n\_\{2\}\}^\{1,1\}𝐀n1,n22,1\\mathbf\{A\}\_\{n\_\{1\},n\_\{2\}\}^\{2,1\}𝐀n1,n22,2\\mathbf\{A\}\_\{n\_\{1\},n\_\{2\}\}^\{2,2\}𝐀n1,n22,3\\mathbf\{A\}\_\{n\_\{1\},n\_\{2\}\}^\{2,3\}w⋅𝐀n1,n2w\\cdot\\mathbf\{A\}\_\{n\_\{1\},n\_\{2\}\}σ1=\(1 3\)\\sigma\_\{1\}\\\!=\\\!\(1\\;3\)σ3=\(1 2\)\\sigma\_\{3\}\\\!=\\\!\(1\\;2\)σ2=id\\sigma\_\{2\}\\\!=\\\!\\mathrm\{id\}

Figure 4:Action of𝒲=𝒮H≀𝒞L\\mathcal\{W\}=\\mathcal\{S\}\_\{H\}\\wr\\mathcal\{C\}\_\{L\}on𝐀\\mathbf\{A\}forL=H=3L\{=\}H\{=\}3: rows are reordered byπ\\pi; heads within each row byσℓ\\sigma\_\{\\ell\}\.
#### Joint layer–head symmetries\.

Stacking MHA blocks over depthsℓ∈\{1,…,L\}\\ell\\in\\\{1,\\ldots,L\\\}yields attention maps\{𝐀ℓ,h\}\\\{\\mathbf\{A\}^\{\\ell,h\}\\\}\. Unlike heads, layers admit no exact interchange identity — they are sequentially composed, so their order matters — yet their*absolute*indices carry no fixed meaning across models of different depths\. Following\([Bar\-Shalom et al\., 2025](https://arxiv.org/html/2610.22723#bib.bib14);[Kasten et al\., 2024](https://arxiv.org/html/2610.22723#bib.bib86)\), we model layer relabelings by𝒞L\\mathcal\{C\}\_\{L\}: a modeling prior, not an exact symmetry, that removes dependence on absolute layer indices across depths\. Since the head permutations might be different across the different layers, we encode the joint symmetry as the wreath product𝒲=𝒮H≀𝒞L\\mathcal\{W\}=\\mathcal\{S\}\_\{H\}\\wr\\mathcal\{C\}\_\{L\}– exactly the group whose elementsw=\(σℓ,πℓ\)w=\(\\sigma\_\{\\ell\},\\pi\_\{\\ell\}\)pair a cyclic layer relabelingπℓ\\pi\_\{\\ell\}with an*independent*head permutationσℓ∈𝒮H\\sigma\_\{\\ell\}\\in\\mathcal\{S\}\_\{H\}at every depth\. The action, illustrated in[Figure4](https://arxiv.org/html/2610.22723#S3.F4), is

∀w∈𝒲,\(w⋅𝐀\)n1,n2l,h=𝐀n1,n2πℓ​\(l\),σπℓ​\(l\)−1​\(h\)\.\\displaystyle\\forall w\\in\\mathcal\{W\},\\quad\(w\\cdot\\mathbf\{A\}\)^\{l,h\}\_\{n\_\{1\},n\_\{2\}\}=\\mathbf\{A\}^\{\\pi\_\{\\ell\}\(l\),\\,\\sigma\_\{\\pi\_\{\\ell\}\(l\)\}^\{\-1\}\(h\)\}\_\{n\_\{1\},\\,n\_\{2\}\}\.\(2\)
1122334411223344n2n\_\{2\}n1n\_\{1\}𝐀\\mathbf\{A\}τ∈𝒞N\\tau\\in\\mathcal\{C\}\_\{N\}\(approx\.\)τ∈𝒞N\\tau\\in\\mathcal\{C\}\_\{N\}h=1h\\\!=\\\!1h=2h\\\!=\\\!2h=3h\\\!=\\\!3ℓ=1\\ell\\\!=\\\!1ℓ=2\\ell\\\!=\\\!2ℓ=3\\ell\\\!=\\\!3𝐀2,31,1\\mathbf\{A\}^\{1,1\}\_\{2,3\}𝐀2,31,2\\mathbf\{A\}^\{1,2\}\_\{2,3\}𝐀2,31,3\\mathbf\{A\}^\{1,3\}\_\{2,3\}𝐀2,32,1\\mathbf\{A\}^\{2,1\}\_\{2,3\}𝐀2,32,2\\mathbf\{A\}^\{2,2\}\_\{2,3\}𝐀2,32,3\\mathbf\{A\}^\{2,3\}\_\{2,3\}𝐀2,33,1\\mathbf\{A\}^\{3,1\}\_\{2,3\}𝐀2,33,2\\mathbf\{A\}^\{3,2\}\_\{2,3\}𝐀2,33,3\\mathbf\{A\}^\{3,3\}\_\{2,3\}𝐀2,3\\mathbf\{A\}\_\{2,3\}\(π,σ→\)∈𝒮H≀𝒞L\(\\pi,\\vec\{\\sigma\}\)\\in\\mathcal\{S\}\_\{H\}\\wr\\mathcal\{C\}\_\{L\}

Figure 5:𝐀\\mathbf\{A\}symmetries\.
#### Tokens\.

Token order is meaningful, so the token axes admit no exact symmetry\. Still, the absolute indices\(n1,n2\)\(n\_\{1\},n\_\{2\}\)carry no shared meaning across tokenizers and sequence lengths, so we treat translation along the token axes as an*approximate*symmetry, modeled by the cyclic group𝒞N\\mathcal\{C\}\_\{N\}acting on both axes by the same shift\.[Figure5](https://arxiv.org/html/2610.22723#S3.F5)visualizes the full symmetries of the attention map𝐀\\mathbf\{A\}\.

In the next section, we use the symmetry analysis above to guide the design ofLEMON, combining components suited to the data and its symmetries without necessarily enforcing exact invariance throughout\. This is analogous to Vision Transformers with positional encodings outperforming CNNs despite breaking translation symmetry\.

### 3\.3From attention maps to Graphs with Structured Features

#### Overview\.

The attention map𝐀\\mathbf\{A\}admits a natural graph representation, with tokens as ordered nodes and attention scores defining node and edge attributes\. Motivated byCHARM\([Frasca et al\., 2026](https://arxiv.org/html/2610.22723#bib.bib28)\), we cast the task as learning on this attributed directed graph\. Our formulation differs from\([Frasca et al\., 2026](https://arxiv.org/html/2610.22723#bib.bib28)\)in two key ways: \(i\) node and edge attributes retain their structuredL×HL\\times Hattention slices, which transform under the layer–head symmetry𝒲\\mathcal\{W\}developed in[Section3\.2](https://arxiv.org/html/2610.22723#S3.SS2), and \(ii\) the graph is sequential, preserving token order\. We then introduceLEMON, a message\-passing\-based architecture whose updates respect𝒲\\mathcal\{W\}and that operates online, producing scores token by token as the response is generated\.

#### Attention graphs\.

Concretely, we view the attention𝐀∈ℝN×N×L×H\\mathbf\{A\}\\in\\mathbb\{R\}^\{N\\times N\\times L\\times H\}as an attributed directed graphG=\(V,E\)G=\(V,E\): each token positionnnis a nodevn∈Vv\_\{n\}\\in Vwith self\-attention attribute𝐀n,n∈\[0,1\]L×H\\mathbf\{A\}\_\{n,n\}\\in\[0,1\]^\{L\\times H\}\(scores across all layers and heads\); each directed edge\(n1,n2\)∈E\(n\_\{1\},n\_\{2\}\)\\in Ecarries cross\-attention attribute𝐀n1,n2∈\[0,1\]L×H\\mathbf\{A\}\_\{n\_\{1\},n\_\{2\}\}\\in\[0,1\]^\{L\\times H\}\(attention from tokenn1n\_\{1\}to tokenn2n\_\{2\}\)\.*Importantly, these node and edge attributes are structuredL×HL\\times Htensors rather than vectors\.*

#### OurLanguage\-modelEquivariantMOnitoringNetwork \(LEMON\) architecture\.

LEMONfollows the Message Passing Neural Network \(MPNN\) framework\([Gilmer et al\., 2017](https://arxiv.org/html/2610.22723#bib.bib20)\), with the key distinction that the*update function*is𝒲\\mathcal\{W\}\-equivariant\. We focus here on the core construction and defer preprocessing and further implementation details to[AppendixD](https://arxiv.org/html/2610.22723#A4)\. Let𝐡\(l\)∈ℝ\|V\|×L×H×d\\mathbf\{h\}^\{\(l\)\}\\in\\mathbb\{R\}^\{\|V\|\\times L\\times H\\times d\}denote node features at layerll,𝐞∈ℝ\|V\|×\|V\|×L×H×d\\mathbf\{e\}\\in\\mathbb\{R\}^\{\|V\|\\times\|V\|\\times L\\times H\\times d\}edge features, and𝒩⁡\(n\)\\mathcal\{N\}\(n\)the preceding\-token neighbors of nodenn\. Each edge feature𝐞n1,n2\\mathbf\{e\}\_\{n\_\{1\},n\_\{2\}\}is initialized by applying a shared linear map to the corresponding attention score𝐀n1,n2\\mathbf\{A\}\_\{n\_\{1\},n\_\{2\}\}independently across layers and heads\. For node features, we combine self\-attention scores with token probabilities, a model\-agnostic signal that is also comparable across models\. More specifically, we concatenate self\-attention scores with token probabilities555Response tokens use their model probability; prompt tokens use00\.and map the resulting features toℝd\\mathbb\{R\}^\{d\}with a shared linear layer\.

#### LEMON’s message passing\.

Our*Message\-Passing*\(MP\) component builds on GINE\([Hu et al\., 2019](https://arxiv.org/html/2610.22723#bib.bib64)\), with the key modification that its update function respects the group symmetry𝒲\\mathcal\{W\}derived in[Section3\.2](https://arxiv.org/html/2610.22723#S3.SS2)\. More specifically, at each layerll, an MPNN updates the node features according to,

𝐡n\(l\)=up𝒲\(l\)⁡\(\(1\+ϵ\(l\)\)​𝐡n\(l−1\)\+∑n′∈𝒩⁡\(n\)\(𝐡n′\(l−1\)\+𝐞n′,n\)\),n∈V\.\\mathbf\{h\}\_\{n\}^\{\(l\)\}=\\operatorname\{up\}\_\{\\mathcal\{W\}\}^\{\(l\)\}\\bigg\(\(1\+\\epsilon^\{\(l\)\}\)\\,\\mathbf\{h\}\_\{n\}^\{\(l\-1\)\}\+\\sum\_\{n^\{\\prime\}\\in\\mathcal\{N\}\(n\)\}\\big\(\\mathbf\{h\}\_\{n^\{\\prime\}\}^\{\(l\-1\)\}\+\\mathbf\{e\}\_\{n^\{\\prime\},n\}\\big\)\\bigg\),\\qquad n\\in V\.\(3\)where,*crucially*,up𝒲\(l\):ℝL×H×d→ℝL×H×d\\operatorname\{up\}\_\{\\mathcal\{W\}\}^\{\(l\)\}:\\mathbb\{R\}^\{L\\times H\\times d\}\\rightarrow\\mathbb\{R\}^\{L\\times H\\times d\}is an update function that*is𝒲\\mathcal\{W\}\-equivariant*\.

#### Constructing the update functionup𝒲\\operatorname\{up\}\_\{\\mathcal\{W\}\}\.

Building on the general characterization of*linear*𝒮H≀𝒞L\\mathcal\{S\}\_\{H\}\\wr\\mathcal\{C\}\_\{L\}\-equivariant layers\([Wang et al\., 2020](https://arxiv.org/html/2610.22723#bib.bib56)\), we extend their construction to nonlinear neural networks, yielding a more general class of𝒲\\mathcal\{W\}\-equivariant maps\. We definef𝒲:ℝL×H→ℝL×Hf\_\{\\mathcal\{W\}\}:\\mathbb\{R\}^\{L\\times H\}\\to\\mathbb\{R\}^\{L\\times H\}as follows:

f𝒲​\(𝐀n1,n2\)\\displaystyle f\_\{\\mathcal\{W\}\}\(\\mathbf\{A\}\_\{n\_\{1\},n\_\{2\}\}\)=f𝒞L​\(𝐀n1,n2​1→H\)​1→H⊤\+f𝒮Hsiamese​\(𝐀n1,n2\),\\displaystyle=f\_\{\\mathcal\{C\}\_\{L\}\}\(\\mathbf\{A\}\_\{n\_\{1\},n\_\{2\}\}\\vec\{1\}\_\{H\}\)\\vec\{1\}\_\{H\}^\{\\top\}\+f\_\{\\mathcal\{S\}\_\{H\}\}^\{\\text\{siamese\}\}\(\\mathbf\{A\}\_\{n\_\{1\},n\_\{2\}\}\),\(4\)wheref𝒮Hsiamese​\(𝐀n1,n2\)l\\displaystyle\\text\{where\}\\quad f\_\{\\mathcal\{S\}\_\{H\}\}^\{\\text\{siamese\}\}\(\\mathbf\{A\}\_\{n\_\{1\},n\_\{2\}\}\)^\{l\}≔f𝒮H​\(𝐀n1,n2l\)​∀l∈\[L\],\\displaystyle\\coloneqq f\_\{\\mathcal\{S\}\_\{H\}\}\(\\mathbf\{A\}\_\{n\_\{1\},n\_\{2\}\}^\{l\}\)\\;\\;\\forall\\,l\\in\[L\],\(5\)where1→H∈ℝH\\vec\{1\}\_\{H\}\\in\\mathbb\{R\}^\{H\}is the all\-ones vector andf𝒮H:ℝH→ℝHf\_\{\\mathcal\{S\}\_\{H\}\}:\\mathbb\{R\}^\{H\}\\rightarrow\\mathbb\{R\}^\{H\}andf𝒞L:ℝL→ℝLf\_\{\\mathcal\{C\}\_\{L\}\}:\\mathbb\{R\}^\{L\}\\rightarrow\\mathbb\{R\}^\{L\}are any functions equivariant to𝒮H\\mathcal\{S\}\_\{H\}and𝒞L\\mathcal\{C\}\_\{L\}, respectively666Note that, for clarity,[Equations4](https://arxiv.org/html/2610.22723#S3.E4)and[5](https://arxiv.org/html/2610.22723#S3.E5)omits features, although they are included in the implementation; See[SectionC\.1](https://arxiv.org/html/2610.22723#A3.SS1)for an illustration\.

#### Two instantiations ofup𝒲\\operatorname\{up\}\_\{\\mathcal\{W\}\}\.

We consider two𝒲\\mathcal\{W\}\-equivariant variants ofLEMON:LEMON\-𝒲\\bm\{\\mathcal\{W\}\}, which mixes information across layers and heads, andLEMON\-𝒲\\bm\{\\mathcal\{W\}\}\-per\-cell, which applies the same update independently to each layer\-head cell \(see[AppendixD](https://arxiv.org/html/2610.22723#A4)\)\. This mirrors the difference between a full DeepSets\([Zaheer et al\., 2017](https://arxiv.org/html/2610.22723#bib.bib45)\)equivariant layer and its element\-wise term alone\.

After stacking several equivariant MPNN layers, we apply a*causal cross\-token transformer*across nodes independently for each layer\-head coordinate \(see[AppendixD](https://arxiv.org/html/2610.22723#A4)\)\. Finally, we apply a𝒲\\mathcal\{W\}\-invariant prediction head, operating at either the node or graph level depending on the granularity of the task\.

visible toy^n\\hat\{y\}\_\{n\}11⋯\\cdotsn−1n\{\-\}1nnn\+1n\{\+\}1n\+2n\{\+\}2not yet generated×\\timesy^n\\hat\{y\}\_\{n\}scored onlinegeneration order

Figure 6:LEMONis online\.
#### LEMONis*online*\.

MP follows*forward\-only*graph edges, the cross\-token transformer attends only to past positions, and the prediction head acts independently across tokens\. Hence, a node predictiony^n\\hat\{y\}\_\{n\}depends only on tokensm≤nm\\leq n\(see[Figure6](https://arxiv.org/html/2610.22723#S3.F6)\)\. This has two consequences: \(i\)LEMONcan score tokens \(or window of tokens\) as they are generated, incrementally adding each new node at*linear*cost in the prefix length rather than recomputing the full quadratic graph\. \(ii\) A prefix receives the same score online as within the completed response, so offline training on full responses and online deployment are provably the same computation\. We note thatCHARM\([Frasca et al\., 2026](https://arxiv.org/html/2610.22723#bib.bib28)\)also shares this online property\.

## 4Experiments: Monitoring for LLM misbehaviors withLEMON

In this section, we present a comprehensive empirical evaluation ofLEMONfor monitoring LLM misbehaviors, focusing on two: hallucinations and jailbreaks\. Our evaluation consists of 16 LLMs, spanning six architecture families, sizes from 135M to 13B, and release dates from 2023 to 2025, and a diverse set of 6 datasets\. We use the ROC\-AUC \(×100\\times 100\) as our evaluation metric, consistent with prior work\([Frasca et al\., 2026](https://arxiv.org/html/2610.22723#bib.bib28);[Azaria and Mitchell, 2023](https://arxiv.org/html/2610.22723#bib.bib19);[Chuang et al\., 2024](https://arxiv.org/html/2610.22723#bib.bib18)\)\. We report the main results here; additional results and experimental details are provided in[AppendixG](https://arxiv.org/html/2610.22723#A7)\.

#### Training setup\.

Unless otherwise specified, we use a*leave\-one\-out*\(LOO\) setup\. Given a pool of𝒦\\mathcal\{K\}LLMs, we train on𝒦−1\\mathcal\{K\}\-1models and evaluate on the remaining held\-out model, rotating the split so that each LLM serves as the test target exactly once\. Thus,*ourLEMONmonitor is always evaluated on unseen LLMs*\. Our LLM pool is the following𝒦=6\\mathcal\{K\}=6LLMs:Llama\-2\-7B,Llama\-2\-13B\([Touvron et al\., 2023](https://arxiv.org/html/2610.22723#bib.bib16)\),Mistral\-7B\([Jiang et al\., 2023a](https://arxiv.org/html/2610.22723#bib.bib15)\),Mistral\-Nemo\-12B\([Sreenivas et al\., 2024](https://arxiv.org/html/2610.22723#bib.bib71)\),Qwen2\.5\-3B, andQwen2\.5\-7B\([Yang et al\., 2024](https://arxiv.org/html/2610.22723#bib.bib29)\)\.

#### Methods in comparison\.

We compareLEMONagainst the following task\-agnostic, learnable baselines777All trained baselines follow the same cross\-LLM transfer protocol asLEMON\.: \(i\)CHARM\([Frasca et al\., 2026](https://arxiv.org/html/2610.22723#bib.bib28)\), a GNN\-based architecture that operates on attention graphs but*does not*explicitly account for the equivariance properties considered in our approach; and \(ii\)Hidden\-state probing\(HS\), which trains a probe on the LLM’s hidden representations\.888We use hidden states from layer 24 of each LLM for probing\. We pad the sequences to a fixed length to account for the different feature dimensions across LLMs\.We additionally compare against task\-specific baselines, which we introduce separately in the corresponding experimental subsections\.

### 4\.1Hallucination Monitoring

For our hallucination experiments, we use the RAGTruth benchmark\([Niu et al\., 2024](https://arxiv.org/html/2610.22723#bib.bib55)\), which consists of 3 token\-level tasks: \(i\)Data2Text\(D2T\); \(ii\)Natural Questions\(NQ\); and \(iii\)Summarization\(SUM\)\. While RAGTruth provides labels for only a subset of the LLMs in our pool, we annotate the outputs of the remaining LLMs ourselves usingQwen2\.5\-32Bas the labeling tool; See[AppendixF](https://arxiv.org/html/2610.22723#A6)for further details\. Finally,LEMON, as well as all baseline methods described below, are trained on the union of the three tasks, while evaluation results are reported separately for each\.

#### Task\-specific baselines\.

We compareLEMONagainst the following task\-specific baselines: \(i\)LookbackLens\(LB\)\([Chuang et al\., 2024](https://arxiv.org/html/2610.22723#bib.bib18)\), a heuristic that uses attention ratios to detect hallucinations, see[AppendixB](https://arxiv.org/html/2610.22723#A2)for details; \(ii\) aprobability\-based baseline\(Prob\), which uses the LLM’s output token probabilities to detect hallucinations; and \(iii\)LookbackLens\+*Alignment*\(LB\+Align\), which applies theLookbackLensbaseline to attention features*after*aligning them using our alignment method described in[AppendixE](https://arxiv.org/html/2610.22723#A5)\.

Table 1:LOO results\.Each row is one held\-out LLM; every value is the AUC averaged over the three tasks\. Per\-task breakdown:[Table10](https://arxiv.org/html/2610.22723#A7.T10)\.Bold= best per row;underline= second best\.
Table 2:Monitoring for errors in the wild\.Bold= best per row;underline= second best\.DatasetTarget LLMTest sizeProbLEMON \(Ours\)𝒲\\mathcal\{W\}𝒲\\mathcal\{W\}\-per\-cellMu\-SHROOMMistral\-7B\-v0\.25358\.763\.5±\\pm1\.762\.7±\\pm1\.6Pythia\-Chat\-7B5461\.872\.9±\\pm4\.774\.0±\\pm6\.9Mean \(Mu\-SHROOM\)60\.368\.268\.4PsiloQATinyLlama\-1\.1B10050\.175\.8±\\pm1\.775\.7±\\pm1\.8Zephyr\-7B\-β\\beta10048\.364\.2±\\pm1\.065\.2±\\pm1\.5Phi\-4\-mini9959\.756\.5±\\pm1\.655\.1±\\pm0\.6Hermes\-2\-Mistral\-7B10054\.264\.1±\\pm2\.263\.5±\\pm1\.8Pythia\-Chat\-7B \(v0\.16\)10036\.375\.8±\\pm1\.677\.0±\\pm0\.4SmolLM2\-1\.7B9957\.779\.8±\\pm1\.179\.4±\\pm2\.3SmolLM2\-360M10056\.163\.2±\\pm2\.463\.7±\\pm1\.5SmolLM2\-135M10054\.857\.7±\\pm2\.960\.3±\\pm2\.9Mean \(PsiloQA\)52\.167\.167\.5Mean \(all 10 shards\)53\.867\.467\.7

#### LOO results\.

The results are presented in[Table2](https://arxiv.org/html/2610.22723#S4.T2)\. BothLEMONvariants substantially outperform all baselines\.LEMONachieves the best performance in 16 of 18 model\-benchmark combinations, and on average,LEMON\-𝒲\\bm\{\\mathcal\{W\}\}\-per\-cellimproves over the strongest baseline,Prob, by approximately 10 ROC\-AUC points\. We also note thatLEMON\-𝒲\\bm\{\\mathcal\{W\}\}\-per\-cellslightly outperformsLEMON\-𝒲\\bm\{\\mathcal\{W\}\}, suggesting that layer\-head mixing, even when performed in a manner equivariant to𝒲\\mathcal\{W\}, is not always beneficial\. The learnable baselines perform around chance in the LOO setting, highlighting the importance of accounting for cross\-model symmetries when generalizing to unseen models\. We complement these results with two additional analyses\. First, in[SectionG\.6](https://arxiv.org/html/2610.22723#A7.SS6), we show thatLEMONcan be adapted to the held\-out LLM using only a small number of labeled examples, yielding further improvements over its zero\-shot performance\. Second, in[SectionG\.7](https://arxiv.org/html/2610.22723#A7.SS7), we consider a*substantially more challenging setting*in whichLEMONis trained on*a single LLM*\(i\.e\.,𝒦=1\\mathcal\{K\}=1\) and evaluated on the remaining five\. Despite the substantially reduced training diversity relative to the LOO setting,LEMONcontinues to outperform all baselines by a large margin\.

#### Estimating errors in the wild\.

To further simulate a real\-world deployment ofLEMON, we evaluate its monitoring performance*in the wild*— on both new datasets and new LLMs that*were unseen during training*\. Specifically, we use the datasetsMu\-SHROOM\([Vázquez et al\., 2025](https://arxiv.org/html/2610.22723#bib.bib72)\)andPsiloQA\([Rykov et al\., 2025](https://arxiv.org/html/2610.22723#bib.bib73)\)\.999Both datasets provide character\-level span annotations rather than token\-level labels; we mark a token as positive if it overlaps with an annotated span\.Both datasets consist of open\-domain QA, where the target LLM answers solely from its parametric knowledge\. This setting differs substantially from RAGTruth’s context\-grounded generation task\. We evaluate on the official held\-out*test*split of each dataset using 10 target LLMs spanning five different architecture families\. To evaluateLEMON’s ability to estimate errors in the wild, we assess the six trainedLEMONmodels for each variant used in[Table2](https://arxiv.org/html/2610.22723#S4.T2)\(see the last two columns\)\. Specifically, we evaluate each model on the 10 shards described above and report the mean±\\pmstd across the six models for each variant\. We compare against the strongest baseline from[Table2](https://arxiv.org/html/2610.22723#S4.T2), namelyProb\. BothLEMONvariants transfer essentially without degradation: averaged over the 10 shards,LEMON\-𝒲\\bm\{\\mathcal\{W\}\}reaches 67\.4 andLEMON\-𝒲\\bm\{\\mathcal\{W\}\}\-per\-cell67\.7\. which is roughly 14 AUC points above the strongest baseline,Prob, which scores 53\.8\. Finally, we note that the spread across the six checkpoints is small \(median std1\.71\.7\): the choice of training pool barely matters, so any single monitor could be deployed as\-is and perform well\.

#### Selective generation\.

Due to space limitations, we defer this experiment to[SectionG\.5](https://arxiv.org/html/2610.22723#A7.SS5)and summarize it here\. BecauseLEMONis causal, it can score a response while it is being generated\. We use it as an online confidence signal that halts generation once a hallucination becomes likely, and serve only the preceding prefix\. Sweeping the halting threshold traces a*risk–coverage curve*[El\-Yaniv and others \(2010\)](https://arxiv.org/html/2610.22723#bib.bib42), which trades the fraction of content served against the hallucination rate of what is served \(formalized in[AppendixH](https://arxiv.org/html/2610.22723#A8)\)\.LEMONattains the lowest area under this curve \(AURC\) in 17 of 18 shards, averaging8\.98\.9\(LEMON\-𝒲\\bm\{\\mathcal\{W\}\}\-per\-cell\) and9\.19\.1\(LEMON\-𝒲\\bm\{\\mathcal\{W\}\}\) against12\.312\.3forProb\.

Table 3:Jailbreak monitoring results\.Bold= best;underline= second best\.

### 4\.2Jailbreak Monitoring

#### Setup\.

We use theRedBench\([Dang et al\., 2026](https://arxiv.org/html/2610.22723#bib.bib87)\)dataset, appending a*single universal*GCG suffix\([Zou et al\., 2023](https://arxiv.org/html/2610.22723#bib.bib13)\)to every harmful request, taken from HarmBench\([Mazeika et al\., 2024](https://arxiv.org/html/2610.22723#bib.bib63)\)\. The suffix is fixed across every request and every monitored LLM; see[SectionG\.3](https://arxiv.org/html/2610.22723#A7.SS3)for further details\. Each of the same𝒦=6\\mathcal\{K\}=6LLMs generates a response greedily, whose attack success is scored byStrongREJECT\([Souly et al\., 2024](https://arxiv.org/html/2610.22723#bib.bib62)\)on a scale from00to11; we binarize its label at0\.50\.5\. Unlike hallucination, which is labeled at the token level, this task has a single binary label for the entire graph, soLEMONis read out at the final prompt token\. Here, the monitor observes only the*prompt*, predicting attack success*before*any response tokens are generated\. We use30003000prompts per LLM, split1800/450/7501800/450/750into train/validation/test at the prompt level and shared across all six LLMs\.

#### A training\-free baseline\.

Beyond the learning\-based baselines introduced in[Section4](https://arxiv.org/html/2610.22723#S4), motivated by previous works\([Hung et al\., 2025](https://arxiv.org/html/2610.22723#bib.bib85);[Ben\-Tov et al\., 2026](https://arxiv.org/html/2610.22723#bib.bib84)\)we use the following baseline, which measures how much the final prompt token attends to instruction tokensSS\(which may include the system\-prompt\) averaging across tokens, layers, and heads:AttnSys⁡\(𝐱\)=1L​H​∑l,h1\|S\|​∑j∈S𝐀N,jl,h\\mathrm\{AttnSys\}\(\\mathbf\{x\}\)=\\frac\{1\}\{LH\}\\sum\_\{l,h\}\\frac\{1\}\{\|S\|\}\\sum\_\{j\\in S\}\\mathbf\{A\}^\{l,h\}\_\{N,j\}\. Lower values indicate weaker attention to the instruction/system prompt, so we use−AttnSys\-\\mathrm\{AttnSys\}as the jailbreak predictor\. The results are summarized in[Table3](https://arxiv.org/html/2610.22723#S4.T3)\. On average, bothLEMONvariants outperform all baselines:LEMON\-𝒲\\bm\{\\mathcal\{W\}\}improves over the strongest baseline by 6\.5 AUC points, whileLEMON\-𝒲\\bm\{\\mathcal\{W\}\}\-per\-cellimproves by 4\.8 points\. We note that in this caseLEMON\-𝒲\\bm\{\\mathcal\{W\}\}performs better thanLEMON\-𝒲\\bm\{\\mathcal\{W\}\}\-per\-cellby almost 2 AUC units – which suggests that sharing information across layers and heads is beneficial for this task\. Moreover, across all six LLMs,LEMONconsistently ranks either first or second\.

### 4\.3Ablation Studies

To ablateLEMON, we compare themain variantswith four ablations: \(i\)LEMONwithno cross\-token mixing\(no\-cross\), measuring the importance of sequence modeling; \(ii\)non\-equivariantLEMON\(Dense\), which mixes information across layers and heads in a non\-equivariant manner101010LEMON\(Dense\) replaces the𝒲\\mathcal\{W\}\-equivariant updateup𝒲\(l\)\\operatorname\{up\}\_\{\\mathcal\{W\}\}^\{\(l\)\}of[Equation3](https://arxiv.org/html/2610.22723#S3.E3)by plain MLPs\.; \(iii\)LEMONwithno graph structure\(without graph\), using only probabilities as node features; and \(iv\)LEMONwithno probability\(no prob\) node features\. The results are in[Figure7](https://arxiv.org/html/2610.22723#S4.F7)\. We observe that themain variants,LEMON\-𝒲\\bm\{\\mathcal\{W\}\}andLEMON\-𝒲\\bm\{\\mathcal\{W\}\}\-per\-cell, outperform all ablations by a large margin, exceptLEMON\(no cross\) variant, which, importantly, is still invariant to𝒲\\mathcal\{W\}, underscoring the importance of our derivation in[Section3\.2](https://arxiv.org/html/2610.22723#S3.SS2)\. Thenon\-equivariantvariant performs worst, highlighting the importance of equivariance for cross\-LLM transfer\.

### 4\.4Run\-Time Analysis

We reportLEMON’s online monitoring cost in[Figure7](https://arxiv.org/html/2610.22723#S4.F7)\. We compare an unmonitored decode step against*all the three terms*monitoring adds: \(i\) extracting attention \(which forces the eager kernel in place ofsdpa, and is paid at every token\), \(ii\) updating the graph, and \(iii\) runningLEMONas the critic\. We report this on the*largest LLM*in our pool,Llama\-2\-13B, on the first sample of the RAGTruth NQ shard\.*Monitoring is extremely cheap*: on average it adds\+8%\+8\\%withLEMON\-𝒲\\bm\{\\mathcal\{W\}\}and\+6%\+6\\%withLEMON\-𝒲\\bm\{\\mathcal\{W\}\}\-per\-cellonLlama\-2\-13B\. Notably, the critic itself is the smallest of the three terms —0\.30\.3of the2\.62\.6ms added byLEMON\-𝒲\\bm\{\\mathcal\{W\}\}\-per\-cell— so the execution of the equivariant architecture is negligible, and what remains is dominated by attention extraction and graph maintenance, both of which could be further optimized with tailored hardware kernels\.

Table 4:LEMON ablations in the LOO setup\.Mean OOD ROC\-AUC over the three tasks per held\-out LLM\.Bold= best in column,underline= second best\.
Figure 7:Cost of monitoring withLEMON\.

## 5Conclusion

We introduceLEMON, a learnable attention\-based monitor that transfers to unseen decoder\-only LLMs without target\-model supervision\. Our monitor,LEMON, is based on GNNs and is specifically designed to account for symmetries that may arise across attention heads and layers of different LLMs, which is precisely what enables it to generalize zero\-shot in the wild\. Importantly,LEMONis lightweight, adding less than 10% monitoring overhead, and operates online: it can flag misbehavior during the generation process itself, without requiring the full response to be completed\.

Many directions remain open\.LEMONcan be evaluated on additional tasks, such as machine\-generated text detection, memorization, and more\. The application of selective generation withLEMONcan be studied further, as can its use with other, model\-specific monitors\. ExtendingLEMONto multimodal models, such as vision\-language models, is an interesting avenue for future research\. Finally, usingLEMONas an interpretability tool – to automatically find important layer\-head coordinates, is interesting\.

### Acknowledgments

F\.F\. conducted this work supported by an Aly Kaufman Post\-Doctoral Fellowship\. G\.B\. is supported by the Jacobs Qualcomm PhD Fellowship\. H\.M\. is supported by the Israel Science Foundation through a personal grant \(ISF 264/23\) and an equipment grant \(ISF 532/23\), and by the Career Advancement Chairs in Artificial Intelligence – Schmidt Futures\.

### Reproducibility statement

TheLEMONarchitecture is described in[Section3](https://arxiv.org/html/2610.22723#S3)and detailed in[SectionsD\.1](https://arxiv.org/html/2610.22723#A4.SS1)and[D](https://arxiv.org/html/2610.22723#A4)\. Training details, the LLMs, and the datasets and splits are given in[AppendicesG](https://arxiv.org/html/2610.22723#A7),[G\.2](https://arxiv.org/html/2610.22723#A7.SS2)and[G\.3](https://arxiv.org/html/2610.22723#A7.SS3); our annotation procedure is in[AppendixF](https://arxiv.org/html/2610.22723#A6), and the selective\-generation metrics are defined in[AppendixH](https://arxiv.org/html/2610.22723#A8)\. We will release our code, trained checkpoints, and annotations upon publication\.

## References

- A\. Abouelenin, A\. Ashfaq, A\. Atkinson, H\. Awadalla, N\. Bach, J\. Bao, A\. Benhaim, M\. Cai, V\. Chaudhary, C\. Chen,et al\.Phi\-4\-mini technical report: compact yet powerful multimodal language models via mixture\-of\-loras\.arXiv preprint arXiv:2503\.01743\.Cited by:[7th item](https://arxiv.org/html/2610.22723#A7.I2.i7.p1.1)\.
- Allalet al\.\(2025\)L\. B\. Allal, A\. Lozhkov, E\. Bakouch, G\. M\. Blázquez, G\. Penedo, L\. Tunstall, A\. Marafioti, H\. Kydlíček, A\. P\. Lajarín, V\. Srivastav,et al\.SmolLM2: when smol goes big–data\-centric training of a small language model\.arXiv preprint arXiv:2502\.02737\.Cited by:[8th item](https://arxiv.org/html/2610.22723#A7.I2.i8.p1.1)\.
- Azaria and Mitchell \(2023\)A\. Azaria and T\. MitchellThe internal state of an LLM knows when it’s lying\.InFindings of the Association for Computational Linguistics: EMNLP 2023,pp\. 967–976\.Cited by:[§1](https://arxiv.org/html/2610.22723#S1.p2.1),[§2](https://arxiv.org/html/2610.22723#S2.SS0.SSS0.Px1.p1.1),[§4](https://arxiv.org/html/2610.22723#S4.p1.1)\.
- Baiet al\.\(2022\)Y\. Bai, A\. Jones, K\. Ndousse, A\. Askell, A\. Chen, N\. DasSarma, D\. Drain, S\. Fort, D\. Ganguli, T\. Henighan,et al\.Training a helpful and harmless assistant with reinforcement learning from human feedback\.arXiv preprint arXiv:2204\.05862\.Cited by:[§2](https://arxiv.org/html/2610.22723#S2.SS0.SSS0.Px1.p1.1)\.
- Banget al\.\(2025\)Y\. Bang, Z\. Ji, A\. Schelten, A\. Hartshorn, T\. Fowler, C\. Zhang, N\. Cancedda, and P\. FungHalluLens: LLM hallucination benchmark\.InProceedings of the 63rd Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\),W\. Che, J\. Nabende, E\. Shutova, and M\. T\. Pilehvar \(Eds\.\),Vienna, Austria,pp\. 24128–24156\.External Links:[Link](https://aclanthology.org/2025.acl-long.1176/),[Document](https://dx.doi.org/10.18653/v1/2025.acl-long.1176),ISBN 979\-8\-89176\-251\-0Cited by:[§2](https://arxiv.org/html/2610.22723#S2.SS0.SSS0.Px1.p1.1)\.
- Bansalet al\.\(2021\)Y\. Bansal, P\. Nakkiran, and B\. BarakRevisiting model stitching to compare neural representations\.Advances in neural information processing systems34,pp\. 225–236\.Cited by:[§2](https://arxiv.org/html/2610.22723#S2.SS0.SSS0.Px3.p1.1)\.
- Bar\-Shalomet al\.\(2025\)G\. Bar\-Shalom, F\. Frasca, Y\. Galron, Y\. Ziser, and H\. MaronBeyond token probes: hallucination detection via activation tensors with ACT\-ViT\.InAdvances in Neural Information Processing Systems,Vol\.38\.Cited by:[§1](https://arxiv.org/html/2610.22723#S1.p2.1),[§2](https://arxiv.org/html/2610.22723#S2.SS0.SSS0.Px1.p1.1),[§3\.2](https://arxiv.org/html/2610.22723#S3.SS2.SSS0.Px2.p1.1)\.
- Bar\-Shalomet al\.\(2026\)G\. Bar\-Shalom, F\. Frasca, D\. Lim, Y\. Gelberg, Y\. Ziser, R\. El\-Yaniv, G\. Chechik, and H\. MaronBeyond next token probabilities: learnable, fast detection of hallucinations and data contamination on LLM output distributions\.InProceedings of the AAAI Conference on Artificial Intelligence,Cited by:[§2](https://arxiv.org/html/2610.22723#S2.SS0.SSS0.Px1.p1.1)\.
- Belinkov \(2022\)Y\. BelinkovProbing classifiers: promises, shortcomings, and advances\.Computational Linguistics\.Cited by:[§1](https://arxiv.org/html/2610.22723#S1.p2.1)\.
- Ben\-Tovet al\.\(2026\)M\. Ben\-Tov, M\. Geva, and M\. SharifUniversal jailbreak suffixes are strong attention hijackers\.Transactions of the Association for Computational Linguistics14,pp\. 1028–1050\.Cited by:[§4\.2](https://arxiv.org/html/2610.22723#S4.SS2.SSS0.Px2.p1.1)\.
- Blacket al\.\(2022\)S\. Black, S\. Biderman, E\. Hallahan, Q\. Anthony, L\. Gao, L\. Golding, H\. He, C\. Leahy, K\. McDonell, J\. Phang,et al\.Gpt\-neox\-20b: an open\-source autoregressive language model\.InProceedings of BigScience Episode\# 5–Workshop on Challenges & Perspectives in Creating Large Language Models,pp\. 95–136\.Cited by:[2nd item](https://arxiv.org/html/2610.22723#A7.I2.i2.p1.1)\.
- Caoet al\.\(2022\)M\. Cao, Y\. Dong, and J\. CheungHallucinated but factual\! Inspecting the factuality of hallucinations in abstractive summarization\.InProceedings of the 60th Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\),S\. Muresan, P\. Nakov, and A\. Villavicencio \(Eds\.\),Dublin, Ireland,pp\. 3340–3354\.Cited by:[§1](https://arxiv.org/html/2610.22723#S1.p1.1)\.
- Carliniet al\.\(2021\)N\. Carlini, F\. Tramer, E\. Wallace, M\. Jagielski, A\. Herbert\-Voss, K\. Lee, A\. Roberts, T\. Brown, D\. Song, U\. Erlingsson,et al\.Extracting training data from large language models\.In30th USENIX security symposium \(USENIX Security 21\),pp\. 2633–2650\.Cited by:[§1](https://arxiv.org/html/2610.22723#S1.p1.1)\.
- Cherianet al\.\(2024\)J\. J\. Cherian, I\. Gibbs, and E\. J\. CandèsLarge language model validity via enhanced conformal prediction methods\.Advances in Neural Information Processing Systems37,pp\. 114812–114842\.Cited by:[Appendix H](https://arxiv.org/html/2610.22723#A8.p1.1)\.
- Chow \(1957\)C\. K\. ChowAn optimum character recognition system using decision functions\.IRE Transactions on Electronic ComputersEC\-6\(4\),pp\. 247–254\.External Links:[Document](https://dx.doi.org/10.1109/TEC.1957.5222035)Cited by:[Appendix H](https://arxiv.org/html/2610.22723#A8.p1.1)\.
- Chuanget al\.\(2024\)Y\. Chuang, L\. Qiu, C\. Hsieh, R\. Krishna, Y\. Kim, and J\. R\. GlassLookback Lens: detecting and mitigating contextual hallucinations in large language models using only attention maps\.InProceedings of the 2024 Conference on Empirical Methods in Natural Language Processing,pp\. 1419–1436\.Cited by:[Appendix B](https://arxiv.org/html/2610.22723#A2.p1.1),[1st item](https://arxiv.org/html/2610.22723#A5.I1.i1.p1.1),[§1](https://arxiv.org/html/2610.22723#S1.p4.1),[§2](https://arxiv.org/html/2610.22723#S2.SS0.SSS0.Px1.p1.1),[§3](https://arxiv.org/html/2610.22723#S3.SS0.SSS0.Px1.p1.1),[§4\.1](https://arxiv.org/html/2610.22723#S4.SS1.SSS0.Px1.p1.1),[§4](https://arxiv.org/html/2610.22723#S4.p1.1)\.
- Cohen and Welling \(2016\)T\. Cohen and M\. WellingGroup equivariant convolutional networks\.InInternational conference on machine learning,pp\. 2990–2999\.Cited by:[§2](https://arxiv.org/html/2610.22723#S2.SS0.SSS0.Px2.p1.1)\.
- Computer \(2023\)OpenChatKit: An Open Toolkit and Base Model for Dialogue\-style ApplicationsExternal Links:[Link](https://github.com/togethercomputer/OpenChatKit)Cited by:[2nd item](https://arxiv.org/html/2610.22723#A7.I2.i2.p1.1)\.
- Danget al\.\(2026\)Q\. Dang, C\. Ngo, and T\. HyRedbench: a universal dataset for comprehensive red teaming of large language models\.arXiv preprint arXiv:2601\.03699\.Cited by:[§G\.3](https://arxiv.org/html/2610.22723#A7.SS3.SSS0.Px2.p1.1),[§4\.2](https://arxiv.org/html/2610.22723#S4.SS2.SSS0.Px1.p1.1)\.
- El\-Yanivet al\.\(2010\)R\. El\-Yanivet al\.On the foundations of noise\-free selective classification\.\.Journal of Machine Learning Research11\(5\)\.Cited by:[§4\.1](https://arxiv.org/html/2610.22723#S4.SS1.SSS0.Px4.p1.1)\.
- Elhelo and Geva \(2025\)A\. Elhelo and M\. GevaInferring functionality of attention heads from their parameters\.InProceedings of the 63rd Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\),pp\. 17701–17733\.Cited by:[§1](https://arxiv.org/html/2610.22723#S1.p3.1),[§2](https://arxiv.org/html/2610.22723#S2.SS0.SSS0.Px3.p1.1)\.
- Esteveset al\.\(2018\)C\. Esteves, C\. Allen\-Blanchette, A\. Makadia, and K\. DaniilidisLearning so \(3\) equivariant representations with spherical cnns\.InProceedings of the european conference on computer vision \(ECCV\),pp\. 52–68\.Cited by:[§2](https://arxiv.org/html/2610.22723#S2.SS0.SSS0.Px2.p1.1)\.
- Esteveset al\.\(2019\)C\. Esteves, Y\. Xu, C\. Allen\-Blanchette, and K\. DaniilidisEquivariant multi\-view networks\.InProceedings of the IEEE/CVF international conference on computer vision,pp\. 1568–1577\.Cited by:[§2](https://arxiv.org/html/2610.22723#S2.SS0.SSS0.Px2.p1.1)\.
- Farquharet al\.\(2024\)S\. Farquhar, J\. Kossen, L\. Kuhn, and Y\. GalDetecting hallucinations in large language models using semantic entropy\.Nature630\(8017\),pp\. 625–630\.External Links:[Document](https://dx.doi.org/10.1038/s41586-024-07421-0),[Link](https://doi.org/10.1038/s41586-024-07421-0),ISSN 1476\-4687Cited by:[§2](https://arxiv.org/html/2610.22723#S2.SS0.SSS0.Px1.p1.1)\.
- Frascaet al\.\(2026\)F\. Frasca, G\. Bar\-Shalom, Y\. Ziser, and H\. MaronNeural message\-passing on attention graphs for hallucination detection\.InInternational Conference on Learning Representations,Vol\.2026,pp\. 449–475\.Cited by:[Appendix D](https://arxiv.org/html/2610.22723#A4.SS0.SSS0.Px1.p1.1),[§1](https://arxiv.org/html/2610.22723#S1.p2.1),[§1](https://arxiv.org/html/2610.22723#S1.p4.1),[§3\.3](https://arxiv.org/html/2610.22723#S3.SS3.SSS0.Px1.p1.1),[§3\.3](https://arxiv.org/html/2610.22723#S3.SS3.SSS0.Px7.p1.1),[§4](https://arxiv.org/html/2610.22723#S4.SS0.SSS0.Px2.p1.1),[§4](https://arxiv.org/html/2610.22723#S4.p1.1),[footnote 11](https://arxiv.org/html/2610.22723#footnote11)\.
- Fuet al\.\(2026\)T\. Fu, Z\. Min, H\. Zhang, J\. Yan, G\. Dai, W\. Ouyang, and Y\. WangCache\-to\-cache: direct semantic communication between large language models\.InThe Fourteenth International Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=LeatkxrBCi)Cited by:[Appendix E](https://arxiv.org/html/2610.22723#A5.SS0.SSS0.Px2.p3.1)\.
- Gaoet al\.\(2023\)L\. Gao, J\. Schulman, and J\. HiltonScaling laws for reward model overoptimization\.InInternational conference on machine learning,pp\. 10835–10866\.Cited by:[§2](https://arxiv.org/html/2610.22723#S2.SS0.SSS0.Px1.p1.1)\.
- Geifman and El\-Yaniv \(2017\)Y\. Geifman and R\. El\-YanivSelective classification for deep neural networks\.Advances in neural information processing systems30\.Cited by:[Appendix H](https://arxiv.org/html/2610.22723#A8.p1.1)\.
- Geifman and El\-Yaniv \(2019\)Y\. Geifman and R\. El\-YanivSelectivenet: a deep neural network with an integrated reject option\.InInternational conference on machine learning,pp\. 2151–2159\.Cited by:[Appendix H](https://arxiv.org/html/2610.22723#A8.p1.1)\.
- Gilmeret al\.\(2017\)J\. Gilmer, S\. S\. Schoenholz, P\. F\. Riley, O\. Vinyals, and G\. E\. DahlNeural message passing for quantum chemistry\.InInternational Conference on Machine Learning,Proceedings of Machine Learning Research, Vol\.70,pp\. 1263–1272\.Cited by:[§D\.1](https://arxiv.org/html/2610.22723#A4.SS1.p1.1),[§2](https://arxiv.org/html/2610.22723#S2.SS0.SSS0.Px2.p1.1),[§3\.3](https://arxiv.org/html/2610.22723#S3.SS3.SSS0.Px3.p1.1)\.
- Guerreiroet al\.\(2022\)N\. M\. Guerreiro, E\. Voita, and A\. F\. MartinsLooking for a needle in a haystack: a comprehensive study of hallucinations in neural machine translation\.arXiv preprint arXiv:2208\.05309\.Cited by:[§2](https://arxiv.org/html/2610.22723#S2.SS0.SSS0.Px1.p1.1)\.
- Gurneeet al\.\(2024\)W\. Gurnee, T\. Horsley, Z\. C\. Guo, T\. R\. Kheirkhah, Q\. Sun, W\. Hathaway, N\. Nanda, and D\. BertsimasUniversal neurons in gpt2 language models\.arXiv preprint arXiv:2401\.12181\.Cited by:[§2](https://arxiv.org/html/2610.22723#S2.SS0.SSS0.Px3.p1.1)\.
- Huet al\.\(2019\)W\. Hu, B\. Liu, J\. Gomes, M\. Zitnik, P\. Liang, V\. Pande, and J\. LeskovecStrategies for pre\-training graph neural networks\.arXiv preprint arXiv:1905\.12265\.Cited by:[§D\.1](https://arxiv.org/html/2610.22723#A4.SS1.SSS0.Px1.p1.1),[§D\.1](https://arxiv.org/html/2610.22723#A4.SS1.SSS0.Px2.p1.1),[§3\.3](https://arxiv.org/html/2610.22723#S3.SS3.SSS0.Px4.p1.1)\.
- Huang et al\. \(2023\)Huang et al\.A survey on hallucination in large language models: principles, taxonomy, challenges, and open questions\.ACM Transactions on Information Systems\.Cited by:[§2](https://arxiv.org/html/2610.22723#S2.SS0.SSS0.Px1.p1.1)\.
- Huanget al\.\(2023\)Y\. Huang, J\. Song, Z\. Wang, S\. Zhao, H\. Chen, F\. Juefei\-Xu, and L\. MaLook before you leap: an exploratory study of uncertainty measurement for large language models\.arXiv preprint arXiv:2307\.10236\.Cited by:[§2](https://arxiv.org/html/2610.22723#S2.SS0.SSS0.Px1.p1.1)\.
- Huhet al\.\(2024\)M\. Huh, B\. Cheung, T\. Wang, and P\. IsolaThe platonic representation hypothesis\.arXiv preprint arXiv:2405\.07987\.Cited by:[§1](https://arxiv.org/html/2610.22723#S1.p3.1),[§2](https://arxiv.org/html/2610.22723#S2.SS0.SSS0.Px3.p1.1)\.
- Hunget al\.\(2025\)K\. Hung, C\. Ko, A\. Rawat, I\. Chung, W\. H\. Hsu, and P\. ChenAttention tracker: detecting prompt injection attacks in llms\.InFindings of the Association for Computational Linguistics: NAACL 2025,pp\. 2309–2322\.Cited by:[§4\.2](https://arxiv.org/html/2610.22723#S4.SS2.SSS0.Px2.p1.1)\.
- Ivanitskiyet al\.\(2025\)M\. Ivanitskiy, C\. D\. Behn, and S\. W\. FungMotifs in attention patterns of large language models\.InMechanistic Interpretability Workshop at NeurIPS 2025,External Links:[Link](https://openreview.net/forum?id=ND2WsCwlDQ)Cited by:[§1](https://arxiv.org/html/2610.22723#S1.p3.1)\.
- Jiet al\.\(2023\)Z\. Ji, N\. Lee, R\. Frieske, T\. Yu, D\. Su, Y\. Xu, E\. Ishii, Y\. J\. Bang, A\. Madotto, and P\. FungSurvey of hallucination in natural language generation\.ACM Computing Surveys55\(12\),pp\. 1–38\.Cited by:[§2](https://arxiv.org/html/2610.22723#S2.SS0.SSS0.Px1.p1.1)\.
- Jianget al\.\(2023a\)A\. Q\. Jiang, A\. Sablayrolles, A\. Mensch, C\. Bamford, D\. S\. Chaplot, D\. de las Casas, F\. Bressand, G\. Lengyel, G\. Lample, L\. Saulnier, L\. R\. Lavaud, M\. Lachaux, P\. Stock, T\. L\. Scao, T\. Lavril, T\. Wang, T\. Lacroix, and W\. E\. SayedMistral 7b\.arXiv:2310\.06825\.Cited by:[3rd item](https://arxiv.org/html/2610.22723#A7.I1.i3.p1.1),[§3](https://arxiv.org/html/2610.22723#S3.SS0.SSS0.Px1.p1.1),[§4](https://arxiv.org/html/2610.22723#S4.SS0.SSS0.Px1.p1.1)\.
- Jianget al\.\(2023b\)Y\. Jiang, X\. Li, G\. Zhu, H\. Li, J\. Deng, K\. Han, C\. Shen, Q\. Shi, and R\. Zhang6G non\-terrestrial networks enabled low\-altitude economy: opportunities and challenges\.arXiv preprint arXiv:2311\.09047\.Cited by:[1st item](https://arxiv.org/html/2610.22723#A7.I2.i1.p1.1)\.
- Kadavathet al\.\(2022\)S\. Kadavath, T\. Conerly, A\. Askell, T\. Henighan, D\. Drain, E\. Perez, N\. Schiefer, Z\. Hatfield\-Dodds, N\. DasSarma, E\. Tran\-Johnson,et al\.Language models \(mostly\) know what they know\.arXiv preprint arXiv:2207\.05221\.Cited by:[Appendix H](https://arxiv.org/html/2610.22723#A8.p1.1),[§2](https://arxiv.org/html/2610.22723#S2.SS0.SSS0.Px1.p1.1)\.
- Kastenet al\.\(2024\)Y\. Kasten, W\. Lu, and H\. MaronFast encoder\-based 3d from casual videos via point track processing\.Advances in Neural Information Processing Systems37,pp\. 96150–96180\.Cited by:[§3\.2](https://arxiv.org/html/2610.22723#S3.SS2.SSS0.Px2.p1.1)\.
- Kondor and Trivedi \(2018\)R\. Kondor and S\. TrivediOn the generalization of equivariance and convolution in neural networks to the action of compact groups\.InInternational conference on machine learning,pp\. 2747–2755\.Cited by:[§2](https://arxiv.org/html/2610.22723#S2.SS0.SSS0.Px2.p1.1)\.
- Korbaket al\.\(2025\)T\. Korbak, M\. Balesni, E\. Barnes, Y\. Bengio, J\. Benton, J\. Bloom, M\. Chen, A\. Cooney, A\. Dafoe, A\. Dragan,et al\.Chain of thought monitorability: a new and fragile opportunity for ai safety\.arXiv preprint arXiv:2507\.11473\.Cited by:[§2](https://arxiv.org/html/2610.22723#S2.SS0.SSS0.Px1.p1.1)\.
- Kornblithet al\.\(2019\)S\. Kornblith, M\. Norouzi, H\. Lee, and G\. HintonSimilarity of neural network representations revisited\.InInternational conference on machine learning,pp\. 3519–3529\.Cited by:[§2](https://arxiv.org/html/2610.22723#S2.SS0.SSS0.Px3.p1.1)\.
- Kramáret al\.\(2026\)J\. Kramár, J\. Engels, Z\. Wang, B\. Chughtai, R\. Shah, N\. Nanda, and A\. ConmyBuilding production\-ready probes for gemini\.arXiv preprint arXiv:2601\.11516\.Cited by:[§1](https://arxiv.org/html/2610.22723#S1.p2.1)\.
- Kuhnet al\.\(2023\)L\. Kuhn, Y\. Gal, and S\. FarquharSemantic uncertainty: linguistic invariances for uncertainty estimation in natural language generation\.External Links:2302\.09664,[Link](https://arxiv.org/abs/2302.09664)Cited by:[Appendix H](https://arxiv.org/html/2610.22723#A8.p1.1),[§2](https://arxiv.org/html/2610.22723#S2.SS0.SSS0.Px1.p1.1)\.
- Liuet al\.\(2022\)T\. Liu, Y\. Zhang, C\. Brockett, Y\. Mao, Z\. Sui, W\. Chen, and B\. DolanA token\-level reference\-free hallucination detection benchmark for free\-form text generation\.InProceedings of the 60th Annual Meeting of the Association for Computational Linguistics,pp\. 6723–6737\.Cited by:[§2](https://arxiv.org/html/2610.22723#S2.SS0.SSS0.Px1.p1.1)\.
- Liuet al\.\(2023\)Y\. Liu, D\. Iter, Y\. Xu, S\. Wang, R\. Xu, and C\. ZhuG\-eval: nlg evaluation using gpt\-4 with better human alignment\.InProceedings of the 2023 conference on empirical methods in natural language processing,pp\. 2511–2522\.Cited by:[§2](https://arxiv.org/html/2610.22723#S2.SS0.SSS0.Px1.p1.1)\.
- Loshchilov and Hutter \(2019\)I\. Loshchilov and F\. HutterDecoupled weight decay regularization\.InInternational Conference on Learning Representations,Cited by:[Appendix G](https://arxiv.org/html/2610.22723#A7.SS0.SSS0.Px2.p1.1)\.
- Manakulet al\.\(2023\)P\. Manakul, A\. Liusie, and M\. J\. F\. GalesSelfCheckGPT: zero\-resource black\-box hallucination detection for generative large language models\.InProceedings of the 2023 Conference on Empirical Methods in Natural Language Processing,pp\. 9004–9017\.Cited by:[§1](https://arxiv.org/html/2610.22723#S1.p2.1),[§2](https://arxiv.org/html/2610.22723#S2.SS0.SSS0.Px1.p1.1)\.
- Marconatoet al\.\(2024\)E\. Marconato, S\. Bortolotti, E\. van Krieken, A\. Vergari, A\. Passerini, and S\. TesoBEARS make neuro\-symbolic models aware of their reasoning shortcuts\.External Links:2402\.12240Cited by:[§2](https://arxiv.org/html/2610.22723#S2.SS0.SSS0.Px1.p1.1)\.
- Maronet al\.\(2018\)H\. Maron, H\. Ben\-Hamu, N\. Shamir, and Y\. LipmanInvariant and equivariant graph networks\.arXiv preprint arXiv:1812\.09902\.Cited by:[§2](https://arxiv.org/html/2610.22723#S2.SS0.SSS0.Px2.p1.1)\.
- Mazeikaet al\.\(2024\)M\. Mazeika, L\. Phan, X\. Yin, A\. Zou, Z\. Wang, N\. Mu, E\. Sakhaee, N\. Li, S\. Basart, B\. Li, D\. Forsyth, and D\. HendrycksHarmBench: a standardized evaluation framework for automated red teaming and robust refusal\.External Links:2402\.04249Cited by:[§G\.3](https://arxiv.org/html/2610.22723#A7.SS3.SSS0.Px2.p1.1),[§G\.3](https://arxiv.org/html/2610.22723#A7.SS3.SSS0.Px3.p1.1),[§1](https://arxiv.org/html/2610.22723#S1.p2.1),[§4\.2](https://arxiv.org/html/2610.22723#S4.SS2.SSS0.Px1.p1.1)\.
- Morcoset al\.\(2018\)A\. Morcos, M\. Raghu, and S\. BengioInsights on representational similarity in neural networks with canonical correlation\.Advances in neural information processing systems31\.Cited by:[§1](https://arxiv.org/html/2610.22723#S1.p3.1)\.
- Moschellaet al\.\(2022\)L\. Moschella, V\. Maiorca, M\. Fumero, A\. Norelli, F\. Locatello, and E\. RodolàRelative representations enable zero\-shot latent space communication\.arXiv preprint arXiv:2209\.15430\.Cited by:[§1](https://arxiv.org/html/2610.22723#S1.p3.1)\.
- Nasret al\.\(2023\)M\. Nasr, N\. Carlini, J\. Hayase, M\. Jagielski, A\. F\. Cooper, D\. Ippolito, C\. A\. Choquette\-Choo, E\. Wallace, F\. Tramèr, and K\. LeeScalable extraction of training data from \(production\) language models\.arXiv preprint arXiv:2311\.17035\.Cited by:[§1](https://arxiv.org/html/2610.22723#S1.p1.1)\.
- Niuet al\.\(2024\)C\. Niu, Y\. Wu, J\. Zhu, S\. Xu, K\. Shum, R\. Zhong, J\. Song, and T\. ZhangRagtruth: a hallucination corpus for developing trustworthy retrieval\-augmented language models\.InProceedings of the 62nd Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\),pp\. 10862–10878\.Cited by:[Appendix F](https://arxiv.org/html/2610.22723#A6.p1.1),[1st item](https://arxiv.org/html/2610.22723#A7.I3.i1.p1.1),[§3](https://arxiv.org/html/2610.22723#S3.SS0.SSS0.Px1.p1.1),[§4\.1](https://arxiv.org/html/2610.22723#S4.SS1.p1.1)\.
- Olssonet al\.\(2022\)C\. Olsson, N\. Elhage, N\. Nanda, N\. Joseph, N\. DasSarma, T\. Henighan, B\. Mann, A\. Askell, Y\. Bai, A\. Chen,et al\.In\-context learning and induction heads\.arXiv preprint arXiv:2209\.11895\.Cited by:[§2](https://arxiv.org/html/2610.22723#S2.SS0.SSS0.Px3.p1.1)\.
- Pagnoniet al\.\(2021\)A\. Pagnoni, V\. Balachandran, and Y\. TsvetkovUnderstanding factuality in abstractive summarization with FRANK: a benchmark for factuality metrics\.InProceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies,pp\. 4812–4829\.Cited by:[§1](https://arxiv.org/html/2610.22723#S1.p1.1)\.
- Panaset al\.\(2025\)D\. Panas, A\. Payani, and V\. BelleUnreasonable effectiveness of LLM reasoning: a doubly cautionary tale of temporal question\-answering\.Transactions on Machine Learning Research\.Note:External Links:ISSN 2835\-8856,[Link](https://openreview.net/forum?id=1DkD0Nd8Rd)Cited by:[§2](https://arxiv.org/html/2610.22723#S2.SS0.SSS0.Px1.p1.1)\.
- Paszke et al\. \(2019\)Paszke et al\.Pytorch: an imperative style, high\-performance deep learning library\.Advances in neural information processing systems32\.Cited by:[Appendix G](https://arxiv.org/html/2610.22723#A7.p1.1)\.
- Qiuet al\.\(2023\)Y\. Qiu, Y\. Ziser, A\. Korhonen, E\. Ponti, and S\. CohenDetecting and mitigating hallucinations in multilingual summarisation\.InProceedings of the 2023 Conference on Empirical Methods in Natural Language Processing,H\. Bouamor, J\. Pino, and K\. Bali \(Eds\.\),Singapore,pp\. 8914–8932\.Cited by:[§1](https://arxiv.org/html/2610.22723#S1.p1.1)\.
- Rawte et al\. \(2023\)Rawte et al\.The troubling emergence of hallucination in large language models–an extensive definition, quantification, and prescriptive remediations\.arXiv preprint arXiv:2310\.04988\.Cited by:[§2](https://arxiv.org/html/2610.22723#S2.SS0.SSS0.Px1.p1.1)\.
- Rykovet al\.\(2025\)E\. Rykov, K\. Petrushina, M\. Savkin, V\. Olisov, A\. Vazhentsev, K\. Titova, A\. Panchenko, V\. Konovalov, and J\. BelikovaWhen models lie, we learn: multilingual span\-level hallucination detection with psiloqa\.arXiv preprint arXiv:2510\.04849\.Cited by:[3rd item](https://arxiv.org/html/2610.22723#A7.I3.i3.p1.1),[§4\.1](https://arxiv.org/html/2610.22723#S4.SS1.SSS0.Px3.p1.1.5)\.
- Samuelet al\.\(2026\)D\. Samuel, G\. Bar\-Shalom, F\. Frasca, E\. Fetaya, Y\. Ziser, G\. Chechik, and H\. MaronUniProbe: a learnable token\-level hallucination detector for large vlms using multi\-structural internal representations\.arXiv preprint arXiv:2608\.10835\.Cited by:[§1](https://arxiv.org/html/2610.22723#S1.p2.1)\.
- Sharmaet al\.\(2024\)M\. Sharma, M\. Tong, T\. Korbak, D\. Duvenaud, A\. Askell, S\. R\. Bowman, E\. DURMUS, Z\. Hatfield\-Dodds, S\. R\. Johnston, S\. M\. Kravec,et al\.Towards understanding sycophancy in language models\.InThe Twelfth International Conference on Learning Representations,Cited by:[§2](https://arxiv.org/html/2610.22723#S2.SS0.SSS0.Px1.p1.1)\.
- Songet al\.\(2026\)P\. Song, P\. Han, and N\. GoodmanLarge language model reasoning failures\.arXiv preprint arXiv:2602\.06176\.Cited by:[§1](https://arxiv.org/html/2610.22723#S1.p1.1)\.
- Soulyet al\.\(2024\)A\. Souly, Q\. Lu, D\. Bowen, T\. Trinh, E\. Hsieh, S\. Pandey, P\. Abbeel, J\. Svegliato, S\. Emmons, O\. Watkins,et al\.A strongreject for empty jailbreaks\.Advances in Neural Information Processing Systems37,pp\. 125416–125440\.Cited by:[§G\.3](https://arxiv.org/html/2610.22723#A7.SS3.SSS0.Px2.p1.1),[§1](https://arxiv.org/html/2610.22723#S1.p2.1),[§4\.2](https://arxiv.org/html/2610.22723#S4.SS2.SSS0.Px1.p1.1)\.
- Sreenivaset al\.\(2024\)S\. T\. Sreenivas, S\. Muralidharan, R\. Joshi, M\. Chochowski, A\. S\. Mahabaleshwarkar, G\. Shen, J\. Zeng, Z\. Chen, Y\. Suhara, S\. Diao,et al\.Llm pruning and distillation in practice: the minitron approach\.arXiv preprint arXiv:2408\.11796\.Cited by:[4th item](https://arxiv.org/html/2610.22723#A7.I1.i4.p1.1),[§4](https://arxiv.org/html/2610.22723#S4.SS0.SSS0.Px1.p1.1)\.
- Thomaset al\.\(2018\)N\. Thomas, T\. Smidt, S\. Kearnes, L\. Yang, L\. Li, K\. Kohlhoff, and P\. RileyTensor field networks: rotation\-and translation\-equivariant neural networks for 3d point clouds\.arXiv preprint arXiv:1802\.08219\.Cited by:[§2](https://arxiv.org/html/2610.22723#S2.SS0.SSS0.Px2.p1.1)\.
- Touvronet al\.\(2023\)H\. Touvron, L\. Martin, K\. Stone, P\. Albert, A\. Almahairi, Y\. Babaei, N\. Bashlykov, S\. Batra, P\. Bhargava, S\. Bhosale, D\. Bikel, L\. Blecher, C\. Canton Ferrer, M\. Chen, G\. Cucurull, D\. Esiobu, J\. Fernandes, J\. Fu, W\. Fu, B\. Fuller, C\. Gao, V\. Goswami, N\. Goyal, A\. Hartshorn, S\. Hosseini, R\. Hou, H\. Inan, M\. Kardas, V\. Kerkez, M\. Khabsa, I\. Kloumann, A\. Korenev, P\. Koura, M\. Lachaux, T\. Lavril, J\. Lee, D\. Liskovich, Y\. Lu, Y\. Mao, X\. Martinet, T\. Mihaylov, P\. Mishra, I\. Molybog, Y\. Nie, A\. Poulton, J\. Reizenstein, R\. Rungta, K\. Saladi, A\. Schelten, R\. Silva, E\. M\. Smith, R\. Subramanian, X\. E\. Tan, B\. Tang, R\. Taylor, A\. Williams, J\. X\. Kuan, P\. Xu, Z\. Yan, I\. Zarov, Y\. Zhang, A\. Fan, M\. Kambadur, S\. Narang, A\. Rodriguez, R\. Stojnic, S\. Edunov, and T\. ScialomLlama 2: open foundation and fine\-tuned chat models\.arXiv:2307\.09288\.Cited by:[1st item](https://arxiv.org/html/2610.22723#A7.I1.i1.p1.1),[2nd item](https://arxiv.org/html/2610.22723#A7.I1.i2.p1.1),[§3](https://arxiv.org/html/2610.22723#S3.SS0.SSS0.Px1.p1.1),[§4](https://arxiv.org/html/2610.22723#S4.SS0.SSS0.Px1.p1.1)\.
- Tunstallet al\.\(2023\)L\. Tunstall, E\. Beeching, N\. Lambert, N\. Rajani, K\. Rasul, Y\. Belkada, S\. Huang, L\. Von Werra, C\. Fourrier, N\. Habib,et al\.Zephyr: direct distillation of lm alignment\.arXiv preprint arXiv:2310\.16944\.Cited by:[5th item](https://arxiv.org/html/2610.22723#A7.I2.i5.p1.1)\.
- Varshneyet al\.\(2023\)N\. Varshney, W\. Yao, H\. Zhang, J\. Chen, and D\. YuA stitch in time saves nine: detecting and mitigating hallucinations of llms by validating low\-confidence generation\.arXiv preprint arXiv:2307\.03987\.Cited by:[§2](https://arxiv.org/html/2610.22723#S2.SS0.SSS0.Px1.p1.1)\.
- Vaswaniet al\.\(2017\)A\. Vaswani, N\. Shazeer, N\. Parmar, J\. Uszkoreit, L\. Jones, A\. N\. Gomez, Ł\. Kaiser, and I\. PolosukhinAttention is all you need\.Advances in neural information processing systems30\.Cited by:[§3](https://arxiv.org/html/2610.22723#S3.p1.1)\.
- Vázquezet al\.\(2025\)R\. Vázquez, T\. Mickus, E\. Zosa, T\. Vahtola, J\. Tiedemann, A\. Sinha, V\. Segonne, F\. Sánchez\-Vega, A\. Raganato, J\. Libovickỳ,et al\.SemEval\-2025 task 3: mu\-shroom, the multilingual shared\-task on hallucinations and related observable overgeneration mistakes\.InProceedings of the 19th International Workshop on Semantic Evaluation \(SemEval\-2025\),pp\. 2472–2497\.Cited by:[2nd item](https://arxiv.org/html/2610.22723#A7.I3.i2.p1.1),[§4\.1](https://arxiv.org/html/2610.22723#S4.SS1.SSS0.Px3.p1.1.4)\.
- Wanget al\.\(2020\)R\. Wang, M\. Albooyeh, and S\. RavanbakhshEquivariant networks for hierarchical structures\.Advances in Neural Information Processing Systems33,pp\. 13806–13817\.Cited by:[§3\.3](https://arxiv.org/html/2610.22723#S3.SS3.SSS0.Px5.p1.1)\.
- Wanget al\.\(2024\)Y\. Wang, Y\. Teng, K\. Huang, C\. Lyu, S\. Zhang, W\. Zhang, X\. Ma, Y\. Jiang, Y\. Qiao, and Y\. WangFake alignment: are llms really aligned well?\.InProceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies \(Volume 1: Long Papers\),pp\. 4696–4712\.Cited by:[§2](https://arxiv.org/html/2610.22723#S2.SS0.SSS0.Px1.p1.1)\.
- Weiet al\.\(2023\)A\. Wei, N\. Haghtalab, and J\. SteinhardtJailbroken: how does llm safety training fail?\.Advances in neural information processing systems36,pp\. 80079–80110\.Cited by:[§1](https://arxiv.org/html/2610.22723#S1.p1.1)\.
- Wolfram and Schein \(2025\)C\. Wolfram and A\. ScheinLayers at similar depths generate similar activations across LLM architectures\.InSecond Conference on Language Modeling,External Links:[Link](https://openreview.net/forum?id=8wKec6faAT)Cited by:[Appendix E](https://arxiv.org/html/2610.22723#A5.SS0.SSS0.Px2.p3.1)\.
- Wuet al\.\(2025\)W\. Wu, Y\. Wang, G\. Xiao, H\. Peng, and Y\. FuRetrieval head mechanistically explains long\-context factuality\.InInternational Conference on Learning Representations,Vol\.2025,pp\. 62143–62156\.Cited by:[§2](https://arxiv.org/html/2610.22723#S2.SS0.SSS0.Px3.p1.1)\.
- Xuet al\.\(2018\)K\. Xu, W\. Hu, J\. Leskovec, and S\. JegelkaHow powerful are graph neural networks?\.arXiv preprint arXiv:1810\.00826\.Cited by:[§D\.1](https://arxiv.org/html/2610.22723#A4.SS1.SSS0.Px1.p1.1),[§D\.1](https://arxiv.org/html/2610.22723#A4.SS1.SSS0.Px2.p1.1)\.
- Yang et al\. \(2024\)Yang et al\.Qwen2 technical report\.arXiv preprint arXiv:2407\.10671\.Cited by:[5th item](https://arxiv.org/html/2610.22723#A7.I1.i5.p1.1),[6th item](https://arxiv.org/html/2610.22723#A7.I1.i6.p1.1),[§4](https://arxiv.org/html/2610.22723#S4.SS0.SSS0.Px1.p1.1)\.
- Yanget al\.\(2025\)T\. Yang, L\. Zhang, J\. Lin, G\. Hu, D\. Wang, and L\. HuD\-leaf: localizing and correcting hallucinations in multimodal llms via layer\-to\-head attention diagnostics\.arXiv e\-prints,pp\. arXiv–2509\.Cited by:[§2](https://arxiv.org/html/2610.22723#S2.SS0.SSS0.Px1.p1.1)\.
- Yaoet al\.\(2024\)Y\. Yao, J\. Duan, K\. Xu, Y\. Cai, Z\. Sun, and Y\. ZhangA survey on large language model \(llm\) security and privacy: the good, the bad, and the ugly\.High\-Confidence Computing4\(2\),pp\. 100211\.Cited by:[§2](https://arxiv.org/html/2610.22723#S2.SS0.SSS0.Px1.p1.1)\.
- Yuanet al\.\(2024\)Y\. Yuan, L\. Zhao, K\. Zhang, G\. Zheng, and Q\. LiuDo llms overcome shortcut learning? an evaluation of shortcut challenges in large language models\.InProceedings of the 2024 Conference on Empirical Methods in Natural Language Processing,pp\. 12188–12200\.Cited by:[§2](https://arxiv.org/html/2610.22723#S2.SS0.SSS0.Px1.p1.1)\.
- Zaheeret al\.\(2017\)M\. Zaheer, S\. Kottur, S\. Ravanbakhsh, B\. Poczos, R\. R\. Salakhutdinov, and A\. SmolaDeep sets\.Advances in neural information processing systems30\.Cited by:[§2](https://arxiv.org/html/2610.22723#S2.SS0.SSS0.Px2.p1.1),[§3\.3](https://arxiv.org/html/2610.22723#S3.SS3.SSS0.Px6.p1.1)\.
- Zhanget al\.\(2024\)P\. Zhang, G\. Zeng, T\. Wang, and W\. LuTinyllama: an open\-source small language model\.arXiv preprint arXiv:2401\.02385\.Cited by:[4th item](https://arxiv.org/html/2610.22723#A7.I2.i4.p1.1)\.
- Zhenget al\.\(2023\)L\. Zheng, W\. Chiang, Y\. Sheng, S\. Zhuang, Z\. Wu, Y\. Zhuang, Z\. Lin, Z\. Li, D\. Li, E\. Xing,et al\.Judging llm\-as\-a\-judge with mt\-bench and chatbot arena\.Advances in neural information processing systems36,pp\. 46595–46623\.Cited by:[§2](https://arxiv.org/html/2610.22723#S2.SS0.SSS0.Px1.p1.1)\.
- Zouet al\.\(2023\)A\. Zou, Z\. Wang, N\. Carlini, M\. Nasr, J\. Z\. Kolter, and M\. FredriksonUniversal and transferable adversarial attacks on aligned language models\.arXiv preprint arXiv:2307\.15043\.Cited by:[§G\.3](https://arxiv.org/html/2610.22723#A7.SS3.SSS0.Px2.p1.1),[§1](https://arxiv.org/html/2610.22723#S1.p1.1),[§4\.2](https://arxiv.org/html/2610.22723#S4.SS2.SSS0.Px1.p1.1)\.

## Appendix roadmap

The appendix is organized as follows\.

- •[AppendixA](https://arxiv.org/html/2610.22723#A1),Motivating Example: Full Query and Responses\.This section provides further details on the motivating example introduced in[Section3](https://arxiv.org/html/2610.22723#S3)\.
- •[AppendixB](https://arxiv.org/html/2610.22723#A2),LookbackLens Features\.This section describes theLookbackLensfeatures used in our attention\-ratio baselines\.
- •[AppendixC](https://arxiv.org/html/2610.22723#A3),Architecture Visualization\.This section provides visualizations of architectural components that we describe in the main text\. - –[SectionC\.1](https://arxiv.org/html/2610.22723#A3.SS1),𝒲\\mathcal\{W\}\-equivariant layer\. - –[SectionC\.2](https://arxiv.org/html/2610.22723#A3.SS2),LEMONarchitecture\.
- •[AppendixD](https://arxiv.org/html/2610.22723#A4),From attention maps to Graphs with Structured Features \- Extended Section\.This section describes how we cast the attention map as an attributed directed graph, the preprocessing pipeline, and the LANGUAGE\-MODEL EQUIVARIANT MONITORING NETWORK \(LEMON\) architecture\. - –[SectionD\.1](https://arxiv.org/html/2610.22723#A4.SS1),Language\-modelEquivariantMOnitoringNetwork \(LEMON\) – A Detailed Description\.
- •[AppendixE](https://arxiv.org/html/2610.22723#A5),Alignment Methods\.This section provides the full details of the head alignment methods we use in our experiments\.
- •[AppendixF](https://arxiv.org/html/2610.22723#A6),Dataset Annotation\.This section documents how the RAGTruth\-native annotations are used and how the three additional LLMs were annotated, together with a manual audit of the resulting labels\.
- •[AppendixG](https://arxiv.org/html/2610.22723#A7),Experiments: Monitoring for LLM misbehaviors withLEMON— Extended Section\. - –[SectionG\.1](https://arxiv.org/html/2610.22723#A7.SS1),Baselines and Ablations: Implementation Details\. - –[SectionG\.2](https://arxiv.org/html/2610.22723#A7.SS2),LLMs Used In Our Experiments\. - –[SectionG\.3](https://arxiv.org/html/2610.22723#A7.SS3),Datasets Used In Our Experiments\. - –[SectionG\.4](https://arxiv.org/html/2610.22723#A7.SS4),LOO results — Extended results\. - –[SectionG\.5](https://arxiv.org/html/2610.22723#A7.SS5),Selective Generation\. - –[SectionG\.6](https://arxiv.org/html/2610.22723#A7.SS6),Few\-shot adaptation\. - –[SectionG\.7](https://arxiv.org/html/2610.22723#A7.SS7),LOI Results\.
- •[AppendixH](https://arxiv.org/html/2610.22723#A8),Selective Generation: Formal Framework\.This section formalizes the selective\-generation setting of[SectionG\.5](https://arxiv.org/html/2610.22723#A7.SS5): the selective generator, the served output, and the coverage, token\-coverage, selective\-risk, and token\-savings estimators, together with the construction of a selective generator from a confidence function\. - –[SectionH\.1](https://arxiv.org/html/2610.22723#A8.SS1),Constructing Selective Generators and the Risk–Coverage Curve\.

## Appendix AMotivating Example: Full Query and Responses

Here we provide the full details regarding the motivating example in[Section3](https://arxiv.org/html/2610.22723#S3)\. The example is a single data\-to\-text instance from RAGTruth \(sample 147\), answered by both Llama\-2\-7B and Mistral\-7B\. The task is to write an overview of a business \(“The Lark”, a Santa Barbara restaurant\) from a structured JSON record, using*only*the provided data\. In the responses below,

all spans annotated as hallucinated by RAGTruth are boxed, and the specific token analyzed in[Figure2](https://arxiv.org/html/2610.22723#S3.F2)—Sunday— is shown inboldwithin its box\. Both models hallucinate this token \(Sunday\), in different sentences and at different output positions\.

#### Why"sunday"is a hallucination\.

The structured data lists per\-day opening hours that vary across the week \(Monday closed\), yet both models collapse them into a fabricated open\-every\-day claim: “open*Monday throughSunday*from 17:00 to 22:00” \(Llama\-2\-7B\) and “open*from Monday toSunday*from 5 pm to midnight” \(Mistral\-7B\)\. RAGTruth annotates this claim as a hallucinated span in each response, and"sunday"is hallucinated as part of the invented range\. This provides a clean choice for comparison: the error is localized, appears in both models within the same fabricated claim, and the token"sunday"is identical across models, allowing a direct comparison of their attention maps\. See[Table5](https://arxiv.org/html/2610.22723#A1.T5)for the tokenization of all day names in both models\.

QueryInstruction\.Write an objective overview about the following local business based only on the provided structured data in the JSON format\. You should include details and cover the information mentioned in the customers’ reviews\. The overview should be 100–200 words\. Don’t make up information\.Context \(structured data, reviews abbreviated\)\.\{’name’: ’The Lark’, ’address’: ’131 Anacapa St, Ste A’, ’city’: ’Santa Barbara’, ’state’: ’CA’, ’categories’: ’Nightlife, Bars, Cocktail Bars, Food, American \(New\), Desserts, Restaurants’, ’hours’: \{’Monday’: ’0:0\-0:0’, ’Tuesday’: ’17:0\-21:0’, ’Wednesday’: ’17:0\-21:0’, ’Thursday’: ’17:0\-21:0’, ’Friday’: ’17:0\-22:0’, ’Saturday’: ’17:0\-22:0’, ’Sunday’: ’17:0\-21:0’\}, ’attributes’: \{’BusinessParking’: \{’street’: True, …\}, ’RestaurantsReservations’: True, ’OutdoorSeating’: True, ’WiFi’: ’free’, ’RestaurantsTakeOut’: False, ’RestaurantsGoodForGroups’: True, ’Music’: False, ’Ambience’: \{’trendy’: True, ’classy’: True, …\}\}, ’business\_stars’: 4\.0, ’review\_info’: \[\{’review\_stars’: 5\.0, ’review\_text’: ’Truly a delicious "Shared Dining Experience" …Crispy Brussel Sprouts …Highly recommend making reservations …’\}, \{’review\_stars’: 3\.0, ’review\_text’: ’The food was good to great, where the experience fell apart was in the service …’\}, \{’review\_stars’: 5\.0, ’review\_text’: ’My partner and I celebrated our anniversary …our waiter Oscar was friendly …’\}\]\}

Llama\-2\-7B responseBased on the provided structured data, here is an objective overview of The Lark:The Lark is a popular nightlife spot located in the heart of Santa Barbara’s Funk Zone\. With categories such as Nightlife, Bars, Cocktail Bars, Food, American \(New\), Desserts, and Restaurants, The Lark offers a unique shared dining experience for groups of all sizes\. Their hours of operation areMonday throughSundayfrom 17:00 to 22:00,with validated parking availableoff\-street and street parking nearby\.According to customer reviews, the quality of the food at The Lark is consistently high, with standout dishes including crispy Brussels sprouts, winter beets marinated in balsamic vinegar, caramelized cauliflower, cast iron Morro Bay black cod, creekstone prime hanger steak, and buttermilk fried chicken\. Wine enthusiasts will appreciate the extensive selection of wine\-by\-the\-glass options, including Grimm’s Bluff, Happy Canyon, and Rose of Cabernet Sauvignon\.However, some customers have reported issues with the service at The Lark, including a lack of attentiveness from servers and confusion with regard to reservations\. Despite these minor drawbacks, the majority of customers have praised The Lark for its cozy atmosphere, excellent food, and exceptional service\. One reviewer even noted that their server, Laurel, went above and beyond to ensure a special night, earning a 5\-star rating for service\. Overall, The Lark appears to be a top choice for dinner and drinks in Santa Barbara, offering a memorable dining experience for visitors and locals alike\.

Mistral\-7B responseThe Lark is a restaurant located in the heart of the Santa Barbara Funk Zone at 131 Anacapa St, Ste A\. The restaurant offers a variety of food options including American cuisine, desserts, and cocktails\. The restaurant has outdoor seating and serves WiFi\. It is classified under the categories of Nightlife, Bars, Cocktail Bars, Food, American \(New\), Desserts, Restaurants, and isopen from Monday toSundayfrom 5 pm to midnight\. Based on customer reviews, the restaurant appears to have a good reputation for its food quality and the friendliness of its staff\. However, some customers have reported issues with the service and the attentiveness of the staff\. Overall, The Lark seems like a good place to visitfor a romantic dinnerora casual eveningout with friends\.

Table 5:Subword tokenization of the seven day names forLlama\-2\-7BandMistral\-7B\.
#### Generality of[Figure2](https://arxiv.org/html/2610.22723#S3.F2)\.

The comparison of[Figure2](https://arxiv.org/html/2610.22723#S3.F2)is not specific to the selected token\. We repeat it for*every*hallucinated content word the two models share as follows: for each RAGTruth test sample answered by both LLMs, we take every word \(alphabetic, longer than three characters\) that both tokenizers represent as a single token and that both models’ annotations flag as hallucinated, and compute the Pearson correlation between the two models’32×3232\\times 32LookbackLensmaps at that token\. Over all, we have104104such tokens \(4444question answering,1515summarization,4545data\-to\-text\), the correlation*never*exceedsr=0\.19r=0\.19\(mean0\.070\.07, median0\.070\.07, minimum−0\.03\-0\.03\)\. The misalignment shown in[Figure2](https://arxiv.org/html/2610.22723#S3.F2)is thus the rule rather than an artifact of the chosen example\.

## Appendix BLookbackLens Features

Here we provide further details onLookbackLens\(LB\) features\([Chuang et al\., 2024](https://arxiv.org/html/2610.22723#bib.bib18)\)\.[Chuang et al\. \(2024\)](https://arxiv.org/html/2610.22723#bib.bib18)showed that how much the model “looks back” at the prompt and context when generating each token is predictive of contextual hallucinations: if a response token is produced while attending mainly to earlier response tokens rather than to the input, it is more likely to be a hallucination\. They define a simple heuristic per \(layer, head\) and per response token\. Consider thett\-th response token\. It is produced by the query at the preceding position, whose attention distribution at layerℓ\\elland headhhwe denote𝐚≔𝐀np\+t−1,⋅ℓ,h\\mathbf\{a\}\\coloneqq\\mathbf\{A\}^\{\\ell,h\}\_\{n\_\{p\}\+t\-1,\\,\\cdot\}, wherenpn\_\{p\}is the number of prompt/context tokens; it is supported on thenpn\_\{p\}prompt tokens and thet−1t\-1response tokens generated so far\.

promptresponsequery rowA¯p\\bar\{A\}\_\{p\}A¯r\\bar\{A\}\_\{r\}Figure 8:LookbackLens: average attention from the query generating thett\-th response token to the prompt \(A¯p\\bar\{A\}\_\{p\}\) vs\. the earlier response \(A¯r\\bar\{A\}\_\{r\}\)\. This example assumes a single layer and a single attention head\.LBcompares the average attention mass placed on the two segments,

A¯pℓ,h​\(t\)\\displaystyle\\bar\{A\}\_\{p\}^\{\\ell,h\}\(t\)=1np​∑i=1npai,\\displaystyle=\\frac\{1\}\{n\_\{p\}\}\\sum\_\{i=1\}^\{n\_\{p\}\}a\_\{i\},A¯rℓ,h​\(t\)\\displaystyle\\bar\{A\}\_\{r\}^\{\\ell,h\}\(t\)=1t−1​∑i=np\+1np\+t−1ai,\\displaystyle=\\frac\{1\}\{t\-1\}\\sum\_\{i=n\_\{p\}\+1\}^\{n\_\{p\}\+t\-1\}a\_\{i\},withA¯rℓ,h​\(1\)≔0\\bar\{A\}\_\{r\}^\{\\ell,h\}\(1\)\\coloneqq 0\. Their heuristic is the*prompt\-attention ratio*

ρℓ,h​\(t\)=A¯pℓ,h​\(t\)A¯pℓ,h​\(t\)\+A¯rℓ,h​\(t\)∈\[0,1\];\\displaystyle\\rho^\{\\ell,h\}\(t\)=\\frac\{\\bar\{A\}\_\{p\}^\{\\ell,h\}\(t\)\}\{\\bar\{A\}\_\{p\}^\{\\ell,h\}\(t\)\+\\bar\{A\}\_\{r\}^\{\\ell,h\}\(t\)\}\\in\[0,1\];lowρ\\rhomeans the model attended mostly to the response so far, and is taken as a signal of possible hallucination\. See[Figure8](https://arxiv.org/html/2610.22723#A2.F8)for an example of a single layer and head\. In our baselines, we flatten\{ρℓ,h​\(t\)\}ℓ,h\\\{\\rho^\{\\ell,h\}\(t\)\\\}\_\{\\ell,h\}, zero\-pad toLmax​HmaxL\_\{\\max\}H\_\{\\max\}whereLmaxL\_\{\\max\}andHmaxH\_\{\\max\}are the maximum number of layers and heads in our LLM pool, and train logistic regression\.

## Appendix CArchitectures Visualization

### C\.1𝒲\\mathcal\{W\}\-equivariant layer\.

In[Figure9](https://arxiv.org/html/2610.22723#A3.F9)we provide a visual depiction of the𝒲\\mathcal\{W\}\-equivariant layerf𝒲f\_\{\\mathcal\{W\}\}described in[Section3\.2](https://arxiv.org/html/2610.22723#S3.SS2)\. Each layer slice𝐀n1,n2l\\mathbf\{A\}^\{l\}\_\{n\_\{1\},n\_\{2\}\}is processed independently by a shared \(Siamese\)f𝒮Hf\_\{\\mathcal\{S\}\_\{H\}\}, while the information\-sharing path sums the input over heads, appliesf𝒞Lf\_\{\\mathcal\{C\}\_\{L\}\}across layers, and broadcasts the result back over heads; the outputs of the two paths are summed to producef𝒲​\(𝐀n1,n2\)f\_\{\\mathcal\{W\}\}\(\\mathbf\{A\}\_\{n\_\{1\},n\_\{2\}\}\)\.

f𝒮Hsiamesef^\{\\mathrm\{siamese\}\}\_\{\\mathcal\{S\}\_\{H\}\}information\-sharing pathHHLL𝐀𝐧𝟏,𝐧𝟐\\mathbf\{A\_\{n\_\{1\},n\_\{2\}\}\}sumH\\mathrm\{sum\}\_\{H\}f𝒮Hf\_\{\\mathcal\{S\}\_\{H\}\}f𝒮Hf\_\{\\mathcal\{S\}\_\{H\}\}f𝒮Hf\_\{\\mathcal\{S\}\_\{H\}\}\+\+f𝒲​\(𝐀n1,n2\)f\_\{\\mathcal\{W\}\}\(\\mathbf\{A\}\_\{n\_\{1\},n\_\{2\}\}\)f𝒞Lf\_\{\\mathcal\{C\}\_\{L\}\}brodH\\mathrm\{brod\}\_\{H\}

Figure 9:The𝒲\\mathcal\{W\}\-equivariant layerf𝒲​\(𝐀n1,n2\)f\_\{\\mathcal\{W\}\}\(\\mathbf\{A\}\_\{n\_\{1\},n\_\{2\}\}\)\. The Siamese path \(dashed, top\) appliesf𝒮Hf\_\{\\mathcal\{S\}\_\{H\}\}to each layer slice independently; the information\-sharing path \(bottom\) sums over heads, appliesf𝒞Lf\_\{\\mathcal\{C\}\_\{L\}\}across layers, and broadcasts the result back over heads\. The two paths are summed\.
### C\.2LEMONarchitecture

In[Figure10](https://arxiv.org/html/2610.22723#A3.F10)we provide a visual depiction of the fullLEMONarchitecture\.

Supernode streamResponse streamInput graphLinear projection×𝑲\\bm\{\\times K\}MPNN layersCross\-tokenTransformerPrediction head𝐡n\(l−1\)\\mathbf\{h\}\_\{n\}^\{\(l\-1\)\}\\;∈ℝL×H×d\\in\\\!\\mathbb\{R\}^\{L\\times H\\times d\}GINE agg\.supernodef𝒲\(l,s\)f\_\{\\mathcal\{W\}\}^\{\(l,\\mathrm\{s\}\)\}GINE agg\.responsef𝒲\(l,r\)f\_\{\\mathcal\{W\}\}^\{\(l,\\mathrm\{r\}\)\}MLP\(l\)\(𝐡n\(l,s\)∥𝐡n\(l,r\)\)\\mathrm\{MLP\}^\{\(l\)\}\\\!\\bigl\(\\mathbf\{h\}\_\{n\}^\{\(l,\\mathrm\{s\}\)\}\\\|\\mathbf\{h\}\_\{n\}^\{\(l,\\mathrm\{r\}\)\}\\bigr\)𝐡n\(l\)∈ℝL×H×d\\mathbf\{h\}\_\{n\}^\{\(l\)\}\\\!\\in\\\!\\mathbb\{R\}^\{L\\times H\\times d\}𝐇\(K\)\\mathbf\{H\}^\{\(K\)\}\\;∈ℝ\|V\|×L×H×d\\in\\\!\\mathbb\{R\}^\{\|V\|\\times L\\times H\\times d\}Slice per\(l,h\)\(l,h\):\(𝐡n\(K\),l,h\)n=1\|V\|∈ℝ\|V\|×d\\bigl\(\\mathbf\{h\}\_\{n\}^\{\(K\),l,h\}\\bigr\)\_\{n=1\}^\{\|V\|\}\\\!\\in\\\!\\mathbb\{R\}^\{\|V\|\\times d\}*Causal*Transformer\\mathrm\{Transformer\}shared∀\(l,h\)\\forall\(l,h\)sinusoidal PEReassemble𝐡nout∈ℝL×H×d\\mathbf\{h\}\_\{n\}^\{\\mathrm\{out\}\}\\\!\\in\\\!\\mathbb\{R\}^\{L\\times H\\times d\}𝐇out\\mathbf\{H\}^\{\\mathrm\{out\}\}\\;∈ℝ\|V\|×L×H×d\\in\\\!\\mathbb\{R\}^\{\|V\|\\times L\\times H\\times d\}Mean over\(l,h\)\(l,h\)∈ℝd\\in\\\!\\mathbb\{R\}^\{d\}MLPy^ninv∈ℝ\\hat\{y\}\_\{n\}^\{\\mathrm\{inv\}\}\\\!\\in\\\!\\mathbb\{R\}

Figure 10:TheLEMONarchitecture\.*Top*: the end\-to\-end pipeline\.*Bottom, left to right*: one equivariant MPNN layer—parallel supernode/response streams with𝒲\\mathcal\{W\}\-equivariant updates \([Equations6](https://arxiv.org/html/2610.22723#A4.E6)and[7](https://arxiv.org/html/2610.22723#A4.E7)\); the shared*causal*cross\-token Transformer, applied independently at each layer–head cell\(l,h\)\(l,h\); and the invariant prediction head for the per\-token case \([Equation8](https://arxiv.org/html/2610.22723#A4.E8)\)\.

## Appendix DFrom attention maps to Graphs with Structured Features \- Extended Section

p1p\_\{1\}p2p\_\{2\}r1r\_\{1\}r2r\_\{2\}r3r\_\{3\}originalδ\\deltap1p\_\{1\}p2p\_\{2\}r1r\_\{1\}r2r\_\{2\}r3r\_\{3\}sparsepoolssr1r\_\{1\}r2r\_\{2\}r3r\_\{3\}supernodewindowssw1w\_\{1\}w2w\_\{2\}windowed000100010ssw1w\_\{1\}w2w\_\{2\}ssw1w\_\{1\}w2w\_\{2\}superresp\.adjacency

Figure 11:Preprocessing: p→\{\\to\}p edges \(red\) discarded; weak edges \(gray, dashed\) thresholded away; prompt nodes \(boxed\) pooled into supernodess; response tokens \(boxed\) pooled into windows \(W=2W\{=\}2shown\)\.*Right*: adjacency of the final graph withsuperandresponsestream blocks \(edge colors match\)\.#### Preprocessing the attention graph\.

The full preprocessing pipeline is illustrated in[Figure11](https://arxiv.org/html/2610.22723#A4.F11)\. Following\([Frasca et al\., 2026](https://arxiv.org/html/2610.22723#bib.bib28)\), we discard both*prompt\-to\-prompt*\(p→\{\\to\}p\) edges, and sparsify the remaining edges by thresholding low attention values111111We set the threshold toδ=0\.1\\delta=0\.1throughout the paper\.\([Frasca et al\., 2026](https://arxiv.org/html/2610.22723#bib.bib28)\)has shown that this threshold substantially reduces the graph size, while maintaining the relevant information for hallucination detection\.\. We also*pool*all prompt nodes into a single*supernode*ssand aggregate their outgoing edges to the response nodes, leaving a graph over response tokens only \(plusss\)\.121212The edges from the prompt tokens to a given response token are merged into a single edge fromss, whoseL×HL\\times Hattribute is the entry\-wise mean over the merged \(post\-threshold\) edges\.Finally, we pool consecutive response tokens into non\-overlapping*windows*\(WW\), so the nodes of the final graph correspond to response windows rather than individual tokens\.131313We set the window size toW=8W=8throughout the paper\. Each window becomes a single node whoseL×HL\\times Hattribute is the entry\-wise mean over its tokens’ attributes\. Edge endpoints are remapped to the window nodes, and edges that consequently connect the same pair of nodes are merged into a single edge whoseL×HL\\times Hattribute is the entry\-wise mean over the merged edges\. Per\-token labels pool conservatively: a window is labeled hallucinated iff*any*of its tokens is\.Together, these steps substantially reduce graph size while preserving both the structure and the information relevant to hallucination detection\. The same pipeline is used for the jailbreak experiments, with two changes that follow from the monitor there observing only the*prompt*: the nodes are the prompt’s own tokens, so it is the chat template’s*system*span that is pooled into the supernodess,141414The span is a genuine2424\-token system message only for the two Qwen models; for the other four it is a22–44token role marker, so pooling it is close to a no\-op there\.and no window pooling is applied \(W=1W\{=\}1\), since these prompts are short to begin with\. We next introduce the*LANGUAGE\-MODEL EQUIVARIANT MONITORING NETWORK*\(LEMON\), our architecture for processing these structured attributed graphs\.

### D\.1Language\-modelEquivariantMOnitoringNetwork \(LEMON\) – A Detailed Description

LEMONfollows the Message Passing Neural Network \(MPNN\) framework\([Gilmer et al\., 2017](https://arxiv.org/html/2610.22723#bib.bib20)\), with a*key extension:*every nonlinear map on node and edge tensors is a𝒲\\mathcal\{W\}\-equivariant layer\.

#### Overview\.

We denote by\|V\|\|V\|the number of nodes in the preprocessed graph\.LEMONfirst projects node and edge features into hidden dimensiondd, yielding𝐡\(0\)∈ℝ\|V\|×L×H×d\\mathbf\{h\}^\{\(0\)\}\\in\\mathbb\{R\}^\{\|V\|\\times L\\times H\\times d\}and𝐞∈ℝ\|V\|×\|V\|×L×H×d\\mathbf\{e\}\\in\\mathbb\{R\}^\{\|V\|\\times\|V\|\\times L\\times H\\times d\}; see details in[Section3\.3](https://arxiv.org/html/2610.22723#S3.SS3)\. We recall that the node features combine the self\-attention scores with*token probabilities*: each response token is assigned its probabilitypnp\_\{n\}and each prompt token the value00, and this scalar is broadcast across all layers and heads, concatenated with the self\-attention score, and mapped toℝd\\mathbb\{R\}^\{d\}by a shared linear layer\.151515Under the window pooling above, each response\-window node carries the mean probability of the tokens it pools, while the supernodesscarries the probability of the first response token\. We ablate this signal in[Section4\.3](https://arxiv.org/html/2610.22723#S4.SS3)\(the*no prob*variant\)\.It then applies \(i\)KKMPNN layers in parallel to the super\-node and response\-node streams, using GINE\-style aggregation\([Hu et al\., 2019](https://arxiv.org/html/2610.22723#bib.bib64);[Xu et al\., 2018](https://arxiv.org/html/2610.22723#bib.bib65)\)with a𝒲\\mathcal\{W\}\-equivariant update function\. \(ii\) A shared*causal*Transformer encoder is then applied independently to each layer\-head cell\(ℓ,h\)\(\\ell,h\)to enable global token interaction while preserving sequence order\. Finally, \(iii\) an invariant prediction head operates on the resulting node features\. We next formalize the \(i\) equivariant MPNN layers, \(ii\) cross\-token mixing, and \(iii\) prediction head\. In what follows we describe each component in detail, and we defer the full architecture visualization to[Figure10](https://arxiv.org/html/2610.22723#A3.F10)\.

#### \(i\)*Equivariant MPNN layers*\.

Lett∈\{s,r\}t\\in\\\{\\mathrm\{s\},\\mathrm\{r\}\\\}index the*supernode*and*response*streams, respectively\. At layerll, we follow a GINE\-style aggregation rule\([Hu et al\., 2019](https://arxiv.org/html/2610.22723#bib.bib64);[Xu et al\., 2018](https://arxiv.org/html/2610.22723#bib.bib65)\)to update the node features, and specifically, we useup𝒲\(l\):ℝL×H×d→ℝL×H×d\\operatorname\{up\}\_\{\\mathcal\{W\}\}^\{\(l\)\}:\\mathbb\{R\}^\{L\\times H\\times d\}\\to\\mathbb\{R\}^\{L\\times H\\times d\}as the update function, which is𝒲\\mathcal\{W\}\-equivariant:

𝐡n\(l,t\)\\displaystyle\\mathbf\{h\}\_\{n\}^\{\(l,t\)\}=up𝒲\(l\)⁡\(\(1\+ϵ\(l,t\)\)​𝐡n\(l−1\)\+∑n′∈𝒩t​\(n\)\(𝐡n′\(l−1\)\+𝐞n′,n\)\),t∈\{s,r\},\\displaystyle=\\operatorname\{up\}\_\{\\mathcal\{W\}\}^\{\(l\)\}\\\!\\left\(\(1\+\\epsilon^\{\(l,t\)\}\)\\,\\mathbf\{h\}\_\{n\}^\{\(l\-1\)\}\+\\sum\_\{n^\{\\prime\}\\in\\mathcal\{N\}^\{t\}\(n\)\}\\bigl\(\\mathbf\{h\}\_\{n^\{\\prime\}\}^\{\(l\-1\)\}\+\\mathbf\{e\}\_\{n^\{\\prime\},n\}\\bigr\)\\right\),\\qquad t\\in\\\{\\mathrm\{s\},\\mathrm\{r\}\\\},\(6\)𝐡n\(l\)\\displaystyle\\mathbf\{h\}\_\{n\}^\{\(l\)\}=MLP\(l\)\(𝐡n\(l,s\)∥𝐡n\(l,r\)\)∈ℝL×H×d,\\displaystyle=\\texttt\{MLP\}^\{\(l\)\}\\\!\\bigl\(\\mathbf\{h\}\_\{n\}^\{\(l,\\mathrm\{s\}\)\}\\,\\\|\\,\\mathbf\{h\}\_\{n\}^\{\(l,\\mathrm\{r\}\)\}\\bigr\)\\in\\mathbb\{R\}^\{L\\times H\\times d\},\(7\)where𝒩t​\(n\)\\mathcal\{N\}^\{t\}\(n\)is the set of*in\-neighbours*ofnnin streamtt,ϵ\(l,t\)\\epsilon^\{\(l,t\)\}is a learnable scalar\. The two stream outputs are then fused by an MLP\. We stackKKsuch layers, so the final node features are𝐡n\(K\)∈ℝL×H×d\\mathbf\{h\}\_\{n\}^\{\(K\)\}\\in\\mathbb\{R\}^\{L\\times H\\times d\}\.

We consider two instantiations ofup𝒲\(l\)\\operatorname\{up\}\_\{\\mathcal\{W\}\}^\{\(l\)\}from[Equation4](https://arxiv.org/html/2610.22723#S3.E4), both equivariant to𝒲\\mathcal\{W\}: \(a\)LEMON\-𝒲\\bm\{\\mathcal\{W\}\}, a variant that mixes information across layers and heads, instantiatingf𝒞​Lf\_\{\\mathcal\{C\}L\}andf𝒮Hf\_\{\\mathcal\{S\}\_\{H\}\}as Transformers; and \(b\)LEMON\-𝒲\\bm\{\\mathcal\{W\}\}\-per\-cell, a variant that applies an MLP to each node feature independently\.

#### *\(ii\) Cross\-token transformer*\.

So far, information has propagated only along graph edges\. To exchange information*across*the full token sequence, we apply a shared*causal*Transformer encoder161616With a fixed \(non\-learnable\) sinusoidal absolute positional encoding, applied only in this cross\-token encoder\.independently at each layer–head cell\(ℓ,h\)∈\[L\]×\[H\]\(\\ell,h\)\\in\[L\]\\times\[H\]: the\(ℓ,h\)\(\\ell,h\)slices\[𝐡1\(K\),ℓ,h,…,𝐡\|V\|\(K\)​ℓ,h\]∈ℝ\|V\|×d\[\\mathbf\{h\}\_\{1\}^\{\(K\),\\ell,h\},\\ldots,\\mathbf\{h\}\_\{\|V\|\}^\{\(K\)\\ell,h\}\]\\in\\mathbb\{R\}^\{\|V\|\\times d\}, ordered by token position, form a length\-\|V\|\|V\|sequence that the encoder maps to the output node features𝐡nout,ℓ,h\\mathbf\{h\}\_\{n\}^\{\\mathrm\{out\},\\ell,h\}\. Information is thus exchanged across tokens, but*not*across layers or heads\.

#### \(iii\) Prediction head\.

Given the backbone output𝐇out≔\[𝐡nout,ℓ,h\]\(n,ℓ,h\)∈V×\[L\]×\[H\]∈ℝ\|V\|×L×H×d\\mathbf\{H\}^\{\\mathrm\{out\}\}\\coloneqq\\bigl\[\\mathbf\{h\}\_\{n\}^\{\\mathrm\{out\},\\ell,h\}\\bigr\]\_\{\(n,\\ell,h\)\\in V\\times\[L\]\\times\[H\]\}\\in\\mathbb\{R\}^\{\|V\|\\times L\\times H\\times d\}, we obtain the invariant hallucination scorey^ninv\\hat\{y\}\_\{n\}^\{\\mathrm\{inv\}\}as follows:

y^ninv=MLP​\(1\|L\|​\|H\|​∑ℓ∈\[L\]∑h∈\[H\]𝐡nout,ℓ,h\)∈ℝ\.\\hat\{y\}\_\{n\}^\{\\mathrm\{inv\}\}=\\texttt\{MLP\}\\\!\\Biggl\(\\frac\{1\}\{\|L\|\|H\|\}\\sum\_\{\\ell\\in\[L\]\}\\sum\_\{h\\in\[H\]\}\\mathbf\{h\}\_\{n\}^\{\\mathrm\{out\},\\ell,h\}\\Biggr\)\\in\\mathbb\{R\}\.\(8\)For graph\-level tasks, we read out a single score from the last token\|V\|\|V\|, which under causality has seen the entire sequence:

y^Ginv=MLP​\(1\|L\|​\|H\|​∑ℓ∈\[L\]∑h∈\[H\]𝐡\|V\|out,ℓ,h\)∈ℝ\.\\hat\{y\}\_\{G\}^\{\\mathrm\{inv\}\}=\\texttt\{MLP\}\\\!\\Biggl\(\\frac\{1\}\{\|L\|\|H\|\}\\sum\_\{\\ell\\in\[L\]\}\\sum\_\{h\\in\[H\]\}\\mathbf\{h\}\_\{\|V\|\}^\{\\mathrm\{out\},\\ell,h\}\\Biggr\)\\in\\mathbb\{R\}\.\(9\)Since this readout selects along the token axis only,𝒲\\mathcal\{W\}\-invariance is preserved\.

## Appendix EAlignment Methods

This appendix gives the full formulation of the alignment\-based approach we use in our experiments\. Rather than building cross\-model head\-permutation symmetry into an equivariant backbone, this approach enforces it in feature space: each LLM’s layer–head attention features are aligned to a shared canonical indexing, after which any off\-the\-shelf classifier can be trained on the aligned representations\.

#### Setup\.

To formulate cross\-LLM detection via alignment, we decompose it into three sequential maps\.

- •A*feature extractor*fextract:ℝN×N×L×H→ℝN×L×Hf\_\{\\mathrm\{extract\}\}:\\mathbb\{R\}^\{N\\times N\\times L\\times H\}\\rightarrow\\mathbb\{R\}^\{N\\times L\\times H\}collapses raw attentions \(i\.e\.,𝐀∈ℝN×N×L×H\\mathbf\{A\}\\in\\mathbb\{R\}^\{N\\times N\\times L\\times H\}\) to per\-token layer–head scalars \(LookbackLens\([Chuang et al\., 2024](https://arxiv.org/html/2610.22723#bib.bib18)\)is one instantiation; see[AppendixB](https://arxiv.org/html/2610.22723#A2)for details\)\.
- •An*alignment map*falign:ℝN×L×H→ℝN×L×Hf\_\{\\mathrm\{align\}\}:\\mathbb\{R\}^\{N\\times L\\times H\}\\rightarrow\\mathbb\{R\}^\{N\\times L\\times H\}then reindexes the layer–head axes into a canonical ordering\.
- •Finally, a*classifier*fcls:ℝN×L×H→ℝNf\_\{\\mathrm\{cls\}\}:\\mathbb\{R\}^\{N\\times L\\times H\}\\rightarrow\\mathbb\{R\}^\{N\}produces one hallucination score per token\.

The end\-to\-end predictor is

f⁡\(𝐀\)=fcls​\(falign​\(fextract​\(𝐀\)\)\),f\(\\mathbf\{A\}\)=f\_\{\\mathrm\{cls\}\}\\\!\\bigl\(f\_\{\\mathrm\{align\}\}\(f\_\{\\mathrm\{extract\}\}\(\\mathbf\{A\}\)\)\\bigr\),\(10\)wheref≔fcls∘falign∘fextractf\\coloneqq f\_\{\\mathrm\{cls\}\}\\circ f\_\{\\mathrm\{align\}\}\\circ f\_\{\\mathrm\{extract\}\}\.

×\\timessrclayerℓ\\elltgtϕ⁡\(ℓ\)\\phi\(\\ell\)h=1h\{=\}1h=2h\{=\}2h=3h\{=\}3h=4h\{=\}4h′=1h^\{\\prime\}\{=\}1h′=2h^\{\\prime\}\{=\}2h′=3h^\{\\prime\}\{=\}3Hmin=3H^\{\\min\}\{=\}3matchedϕ⁡\(ℓ\)=⌊ℓ⋅Lt/Ls⌋\\phi\(\\ell\)=\\lfloor\\ell\\cdot L^\{t\}/L^\{s\}\\rfloorFigure 12:UnequalHs,Ls≠Ht,LtH^\{s\},L^\{s\}\\\!\\neq\\\!H^\{t\},L^\{t\}\. Layer mapϕ\\phipairs source and target layers; onlyHmin=min⁡\(Hs,Ht\)H^\{\\min\}\\\!=\\\!\\min\(H^\{s\},H^\{t\}\)heads are matched\.Algorithm 1HeadAlign\(𝐗\\mathbf\{X\},𝐲\\mathbf\{y\}\)1:

𝐗∈ℝNs×Ls×Hs\\mathbf\{X\}\\in\\mathbb\{R\}^\{N\_\{s\}\\times L^\{s\}\\times H^\{s\}\}\(source training\),

𝐲∈ℝM×Lt×Ht\\mathbf\{y\}\\in\\mathbb\{R\}^\{M\\times L^\{t\}\\times H^\{t\}\}\(test sample\)

2:

𝐲~∈ℝM×Ls×Hs\\tilde\{\\mathbf\{y\}\}\\in\\mathbb\{R\}^\{M\\times L^\{s\}\\times H^\{s\}\}\(aligned test features\)

3:

X¯ℓ,h←1Ns​∑qXqℓ,h\\bar\{X\}^\{\\ell,h\}\\leftarrow\\frac\{1\}\{N\_\{s\}\}\\sum\_\{q\}X\_\{q\}^\{\\ell,h\}for all

ℓ∈\[Ls\],h∈\[Hs\]\\ell\\in\[L^\{s\}\],\\;h\\in\[H^\{s\}\]⊳\\trianglerightprecomputed offline

4:

y¯ℓ,h←1M​∑qyqℓ,h\\bar\{y\}^\{\\ell,h\}\\leftarrow\\frac\{1\}\{M\}\\sum\_\{q\}y\_\{q\}^\{\\ell,h\}for all

ℓ∈\[Lt\],h∈\[Ht\]\\ell\\in\[L^\{t\}\],\\;h\\in\[H^\{t\}\]⊳\\trianglerightcomputed at inference time

5:for

ℓ=1,…,Ls\\ell=1,\\ldots,L^\{s\}do

6:

ϕ⁡\(ℓ\)←⌊ℓ⋅Lt/Ls⌋\\phi\(\\ell\)\\leftarrow\\lfloor\\ell\\cdot L^\{t\}/L^\{s\}\\rfloor⊳\\trianglerightproportional layer correspondence

7:

𝐂h,h′ℓ←\|X¯ℓ,h−y¯ϕ⁡\(ℓ\),h′\|\\mathbf\{C\}^\{\\ell\}\_\{h,h^\{\\prime\}\}\\leftarrow\\bigl\|\\bar\{X\}^\{\\ell,h\}\-\\bar\{y\}^\{\\phi\(\\ell\),h^\{\\prime\}\}\\bigr\|𝐂ℓ∈ℝHs×Ht\\mathbf\{C\}^\{\\ell\}\\in\\mathbb\{R\}^\{H^\{s\}\\times H^\{t\}\}
8:

\{\(hi,ℓ,hi,ℓ′\)\}i=1Hmin←Hungarian​\(𝐂ℓ\)\\\{\(h\_\{i,\\ell\},h^\{\\prime\}\_\{i,\\ell\}\)\\\}\_\{i=1\}^\{H^\{\\min\}\}\\leftarrow\\textsc\{Hungarian\}\(\\mathbf\{C\}^\{\\ell\}\)⊳\\trianglerightHmin=min⁡\(Hs,Ht\)H^\{\\min\}=\\min\(H^\{s\},H^\{t\}\)matched pairs

9:endfor

10:

𝐲~←𝟎∈ℝM×Ls×Hs\\tilde\{\\mathbf\{y\}\}\\leftarrow\\mathbf\{0\}\\in\\mathbb\{R\}^\{M\\times L^\{s\}\\times H^\{s\}\}
11:foreach layer

ℓ\\elland matched pair

\(hi,ℓ,hi,ℓ′\)\(h\_\{i,\\ell\},\\,h^\{\\prime\}\_\{i,\\ell\}\)do

12:

y~q,ℓ,hi,ℓ←yq,ϕ⁡\(ℓ\),hi,ℓ′\\tilde\{y\}\_\{q,\\,\\ell,\\,h\_\{i,\\ell\}\}\\leftarrow y\_\{q,\\,\\phi\(\\ell\),\\,h^\{\\prime\}\_\{i,\\ell\}\}for all

qq⊳\\trianglerightunmatched source positions stay zero

13:endfor

14:return

𝐲~\\tilde\{\\mathbf\{y\}\}

#### Aligning two LLMs’ attention features\.

Letℒs\\mathcal\{L\}^\{s\}andℒt\\mathcal\{L\}^\{t\}be a source and target LLM withHsH^\{s\}heads andLsL^\{s\}layers, andHtH^\{t\}heads andLtL^\{t\}layers, respectively \(we assume the head count is fixed across layers within each model, as in standard transformers\)\. Denote by𝐗∈ℝNs×Ls×Hs\\mathbf\{X\}\\in\\mathbb\{R\}^\{N\_\{s\}\\times L^\{s\}\\times H^\{s\}\}the source training features, whereNsN\_\{s\}is the total number of tokens pooled over all labelled source training samples, and by𝐲∈ℝM×Lt×Ht\\mathbf\{y\}\\in\\mathbb\{R\}^\{M\\times L^\{t\}\\times H^\{t\}\}the features of a single unlabelled test sample withMMtokens; each entryXqℓ,h,yqℓ,h∈ℝX\_\{q\}^\{\\ell,h\},\\,y\_\{q\}^\{\\ell,h\}\\in\\mathbb\{R\}is the scalar feature at tokenqq, layerℓ\\ell, and headhh\. Because head order within each layer is an arbitrary permutation, applying a classifier trained on𝐗\\mathbf\{X\}to raw𝐲\\mathbf\{y\}would fail under zero\-shot transfer \(as we also demonstrate in[Section4](https://arxiv.org/html/2610.22723#S4)\); the goal is therefore to reindex𝐲\\mathbf\{y\}into the source layer–head coordinate system, producing𝐲~∈ℝM×Ls×Hs\\tilde\{\\mathbf\{y\}\}\\in\\mathbb\{R\}^\{M\\times L^\{s\}\\times H^\{s\}\}\.

We reindex𝐲\\mathbf\{y\}by matching each target layer and head to a source layer and head in two steps, as follows\.

Layer correspondence\.Source layerℓ∈\[Ls\]\\ell\\in\[L^\{s\}\]is matched to target layer via proportional depth scaling\([Wolfram and Schein, 2025](https://arxiv.org/html/2610.22723#bib.bib67);[Fu et al\., 2026](https://arxiv.org/html/2610.22723#bib.bib66)\)\(fixed, not optimized\) as follows:

ϕ⁡\(ℓ\)=⌊ℓ⋅LtLs⌋∈\[Lt\]\.\\phi\(\\ell\)=\\left\\lfloor\\ell\\cdot\\frac\{L^\{t\}\}\{L^\{s\}\}\\right\\rfloor\\in\[L^\{t\}\]\.\(11\)
Head alignment\.For each source layerℓ\\ell, we define mean features as follows:

X¯ℓ,h=1Ns​∑q=1NsXqℓ,h,y¯ℓ,h=1M​∑q=1Myqℓ,h,\\displaystyle\\bar\{X\}^\{\\ell,h\}=\\frac\{1\}\{N\_\{s\}\}\\sum\_\{q=1\}^\{N\_\{s\}\}X\_\{q\}^\{\\ell,h\},\\qquad\\bar\{y\}^\{\\ell,h\}=\\frac\{1\}\{M\}\\sum\_\{q=1\}^\{M\}y\_\{q\}^\{\\ell,h\},where𝐗¯∈ℝLs×Hs\\bar\{\\mathbf\{X\}\}\\in\\mathbb\{R\}^\{L^\{s\}\\times H^\{s\}\}and𝐲¯∈ℝLt×Ht\\bar\{\\mathbf\{y\}\}\\in\\mathbb\{R\}^\{L^\{t\}\\times H^\{t\}\}collect all layer–head means\.𝐗¯\\bar\{\\mathbf\{X\}\}is precomputed once from labelled source training data;𝐲¯\\bar\{\\mathbf\{y\}\}is computed at inference from the test sample alone—no target labels are required\. We build the per\-layer rectangular cost matrix𝐂ℓ∈ℝHs×Ht\\mathbf\{C\}^\{\\ell\}\\in\\mathbb\{R\}^\{H^\{s\}\\times H^\{t\}\}with entries𝐂h,h′ℓ=\|X¯ℓ,h−y¯ϕ⁡\(ℓ\),h′\|\\mathbf\{C\}^\{\\ell\}\_\{h,h^\{\\prime\}\}=\\bigl\|\\bar\{X\}^\{\\ell,h\}\-\\bar\{y\}^\{\\phi\(\\ell\),h^\{\\prime\}\}\\bigr\|and solve, forHmin=min⁡\(Hs,Ht\)H^\{\\min\}=\\min\(H^\{s\},H^\{t\}\), the linear assignment problem:

\{\(hi,ℓ,hi,ℓ′\)\}i=1Hmin=arg​min∑i=1Hmin𝐂hi,ℓ,hi,ℓ′ℓ,\\\{\(h\_\{i,\\ell\},h^\{\\prime\}\_\{i,\\ell\}\)\\\}\_\{i=1\}^\{H^\{\\min\}\}=\\operatorname\*\{arg\\,min\}\\sum\_\{i=1\}^\{H^\{\\min\}\}\\mathbf\{C\}^\{\\ell\}\_\{h\_\{i,\\ell\},\\,h^\{\\prime\}\_\{i,\\ell\}\},\(12\)via the Hungarian algorithm\. The aligned test tensor is assembled as𝐲~←𝟎∈ℝM×Ls×Hs\\tilde\{\\mathbf\{y\}\}\\leftarrow\\mathbf\{0\}\\in\\mathbb\{R\}^\{M\\times L^\{s\}\\times H^\{s\}\}withy~q,ℓ,hi,ℓ←yq,ϕ⁡\(ℓ\),hi,ℓ′\\tilde\{y\}\_\{q,\\,\\ell,\\,h\_\{i,\\ell\}\}\\leftarrow y\_\{q,\\,\\phi\(\\ell\),\\,h^\{\\prime\}\_\{i,\\ell\}\}for each layerℓ\\elland matched pair\(hi,ℓ,hi,ℓ′\)\(h\_\{i,\\ell\},h^\{\\prime\}\_\{i,\\ell\}\); unmatched source positions remain zero whenHt<HsH^\{t\}<H^\{s\}\. Given a classifierfftrained on𝐗\\mathbf\{X\}\(using source labels\), the predicted hallucination scores aref⁡\(𝐲~\)∈ℝMf\(\\tilde\{\\mathbf\{y\}\}\)\\in\\mathbb\{R\}^\{M\}, instantiating the alignment mapfalignf\_\{\\mathrm\{align\}\}in the decomposition above; see[Figure12](https://arxiv.org/html/2610.22723#A5.F12)for a schematic of the unequal\-dimension case\. Algorithm[1](https://arxiv.org/html/2610.22723#alg1)states the alignment procedure concretely\.

#### Extension to multiple source LLMs\.

We now turn to the case ofKKsource LLMs’ features\{𝐗k\}k=1K\\\{\\mathbf\{X\}^\{k\}\\\}\_\{k=1\}^\{K\}and a test sample𝐲\\mathbf\{y\}\. We designate the source with the*fewest*heads as canonical referenceℒref\\mathcal\{L\}^\{\\mathrm\{ref\}\}, align all other sources to this canonical reference, and apply the same alignment to𝐲\\mathbf\{y\}at inference\. Each sourcekkcontributes training features𝐗k\\mathbf\{X\}^\{k\}and binary token\-level hallucination labels𝐳k∈\{0,1\}Nk\\mathbf\{z\}\_\{k\}\\in\\\{0,1\\\}^\{N\_\{k\}\}; the test input𝐲\\mathbf\{y\}contains features only \(no target labels\)\. We elaborate in the following, and give the full procedure in[Algorithm2](https://arxiv.org/html/2610.22723#alg2)\.

Offline alignment\.Precompute the mean features for the canonical reference as follows:

X¯ref,ℓ,h=1Nref​∑q=1NrefXq,ℓ,href,\\bar\{X\}^\{\\mathrm\{ref\},\\ell,h\}=\\frac\{1\}\{N\_\{\\mathrm\{ref\}\}\}\\sum\_\{q=1\}^\{N\_\{\\mathrm\{ref\}\}\}X^\{\\mathrm\{ref\}\}\_\{q,\\ell,h\},\(13\)where𝐗¯ref∈ℝLref×Href\\bar\{\\mathbf\{X\}\}^\{\\mathrm\{ref\}\}\\in\\mathbb\{R\}^\{L^\{\\mathrm\{ref\}\}\\times H^\{\\mathrm\{ref\}\}\}andNrefN\_\{\\mathrm\{ref\}\}is the number of reference training tokens\. For eachk≠refk\\neq\\mathrm\{ref\}, solve the per\-layer Hungarian matchings of[Equation12](https://arxiv.org/html/2610.22723#A5.E12)between𝐗¯ref\\bar\{\\mathbf\{X\}\}^\{\\mathrm\{ref\}\}and𝐗¯k\\bar\{\\mathbf\{X\}\}^\{k\}\(usingϕ⁡\(ℓ\)=⌊ℓ⋅Lk/Lref⌋\\phi\(\\ell\)=\\lfloor\\ell\\cdot L^\{k\}/L^\{\\mathrm\{ref\}\}\\rfloor\) and apply the resulting permutations to𝐗k\\mathbf\{X\}^\{k\}, yielding𝐗~k∈ℝNk×Lref×Href\\tilde\{\\mathbf\{X\}\}^\{k\}\\in\\mathbb\{R\}^\{N\_\{k\}\\times L^\{\\mathrm\{ref\}\}\\times H^\{\\mathrm\{ref\}\}\}\(with𝐗~ref←𝐗ref\\tilde\{\\mathbf\{X\}\}^\{\\mathrm\{ref\}\}\\leftarrow\\mathbf\{X\}^\{\\mathrm\{ref\}\}\)\. Train classifierffon the concatenation⋃k=1K𝐗~k\\bigcup\_\{k=1\}^\{K\}\\tilde\{\\mathbf\{X\}\}^\{k\}of all sources \(including the reference\)\.

Inference\.For each test sample𝐲\\mathbf\{y\}, we align it to our canonical reference usingHeadAlign​\(𝐗ref,𝐲\)\\textsc\{HeadAlign\}\(\\mathbf\{X\}^\{\\mathrm\{ref\}\},\\,\\mathbf\{y\}\), and then score it using the trained classifierff\. Importantly, at inference we do not assume access to a pool of target\-LLM samples: each test example is aligned from its own token features alone, without target labels\.

Algorithm 2MultiSourceHeadAlign\(\{\(𝐗k,𝐳k\)\}k=1K,𝐲\)\\bigl\(\\\{\(\\mathbf\{X\}^\{k\},\\,\\mathbf\{z\}\_\{k\}\)\\\}\_\{k=1\}^\{K\},\\;\\mathbf\{y\}\\bigr\)1:

𝐗k∈ℝNk×Lk×Hk\\mathbf\{X\}^\{k\}\\in\\mathbb\{R\}^\{N\_\{k\}\\times L^\{k\}\\times H^\{k\}\}and

𝐳k∈\{0,1\}Nk\\mathbf\{z\}\_\{k\}\\in\\\{0,1\\\}^\{N\_\{k\}\}\(token labels\) for

k=1,…,Kk=1,\\ldots,K;

𝐲∈ℝM×Lt×Ht\\mathbf\{y\}\\in\\mathbb\{R\}^\{M\\times L^\{t\}\\times H^\{t\}\}\(unlabelled test features\)

2:

𝐩^∈ℝM\\hat\{\\mathbf\{p\}\}\\in\\mathbb\{R\}^\{M\}\(predicted score per test token\)

3:Offline:

4:

ref←arg​mink⁡Hk\\mathrm\{ref\}\\leftarrow\\operatorname\*\{arg\\,min\}\_\{k\}\\,H^\{k\}
5:

X¯ref,ℓ,h←1Nref​∑qXq,ℓ,href\\bar\{X\}^\{\\mathrm\{ref\},\\ell,h\}\\leftarrow\\frac\{1\}\{N\_\{\\mathrm\{ref\}\}\}\\sum\_\{q\}X^\{\\mathrm\{ref\}\}\_\{q,\\ell,h\}for all

ℓ∈\[Lref\],h∈\[Href\]\\ell\\in\[L^\{\\mathrm\{ref\}\}\],\\;h\\in\[H^\{\\mathrm\{ref\}\}\]
6:for

k=1,…,Kk=1,\\ldots,K,

k≠refk\\neq\\mathrm\{ref\}do

7:

X¯k,ℓ,h←1Nk​∑qXq,ℓ,hk\\bar\{X\}^\{k,\\ell,h\}\\leftarrow\\frac\{1\}\{N\_\{k\}\}\\sum\_\{q\}X^\{k\}\_\{q,\\ell,h\}for all

ℓ∈\[Lk\],h∈\[Hk\]\\ell\\in\[L^\{k\}\],\\;h\\in\[H^\{k\}\]
8:for

ℓ=1,…,Lref\\ell=1,\\ldots,L^\{\\mathrm\{ref\}\}do

9:

ϕ⁡\(ℓ\)←⌊ℓ⋅Lk/Lref⌋\\phi\(\\ell\)\\leftarrow\\lfloor\\ell\\cdot L^\{k\}/L^\{\\mathrm\{ref\}\}\\rfloor
10:

𝐂h,h′ℓ←\|X¯ref,ℓ,h−X¯k,ϕ⁡\(ℓ\),h′\|\\mathbf\{C\}^\{\\ell\}\_\{h,h^\{\\prime\}\}\\leftarrow\\bigl\|\\bar\{X\}^\{\\mathrm\{ref\},\\ell,h\}\-\\bar\{X\}^\{k,\\phi\(\\ell\),h^\{\\prime\}\}\\bigr\|
11:

\{\(hi,ℓ,hi,ℓ′\)\}i=1Href←Hungarian​\(𝐂ℓ\)\\\{\(h\_\{i,\\ell\},h^\{\\prime\}\_\{i,\\ell\}\)\\\}\_\{i=1\}^\{H^\{\\mathrm\{ref\}\}\}\\leftarrow\\textsc\{Hungarian\}\(\\mathbf\{C\}^\{\\ell\}\)
12:endfor

13:

𝐗~k←𝟎∈ℝNk×Lref×Href\\tilde\{\\mathbf\{X\}\}^\{k\}\\leftarrow\\mathbf\{0\}\\in\\mathbb\{R\}^\{N\_\{k\}\\times L^\{\\mathrm\{ref\}\}\\times H^\{\\mathrm\{ref\}\}\}
14:foreach token

qq, layer

ℓ\\ell, and matched pair

\(hi,ℓ,hi,ℓ′\)\(h\_\{i,\\ell\},h^\{\\prime\}\_\{i,\\ell\}\)do

15:

X~q,ℓ,hi,ℓk←Xq,ϕ⁡\(ℓ\),hi,ℓ′k\\tilde\{X\}^\{k\}\_\{q,\\,\\ell,\\,h\_\{i,\\ell\}\}\\leftarrow X^\{k\}\_\{q,\\,\\phi\(\\ell\),\\,h^\{\\prime\}\_\{i,\\ell\}\}
16:endfor

17:endfor

18:

𝐗~ref←𝐗ref\\tilde\{\\mathbf\{X\}\}^\{\\mathrm\{ref\}\}\\leftarrow\\mathbf\{X\}^\{\\mathrm\{ref\}\}
19:

f←TrainLR​\(⋃k=1K𝐗~k,⋃k=1K𝐳k\)f\\leftarrow\\textsc\{TrainLR\}\\\!\\left\(\\textstyle\\bigcup\_\{k=1\}^\{K\}\\tilde\{\\mathbf\{X\}\}^\{k\},\\;\\bigcup\_\{k=1\}^\{K\}\\mathbf\{z\}\_\{k\}\\right\)
20:Inference:

21:

𝐲~←HeadAlign​\(𝐗ref,𝐲\)\\tilde\{\\mathbf\{y\}\}\\leftarrow\\textsc\{HeadAlign\}\(\\mathbf\{X\}^\{\\mathrm\{ref\}\},\\,\\mathbf\{y\}\)
22:return

f⁡\(𝐲~\)f\(\\tilde\{\\mathbf\{y\}\}\)

## Appendix FDataset Annotation

RAGTruth\([Niu et al\., 2024](https://arxiv.org/html/2610.22723#bib.bib55)\)provides responses with hallucination annotations for three of our six LLMs onSummarization,Question Answering, andData\-to\-Text; we use those as published, and annotate the remaining three LLMs ourselves, as detailed next\.

#### Native RAGTruth models\.

ForLlama\-2\-7B,Llama\-2\-13B, andMistral\-7B, we use the responses and hallucination spans exactly as released—no regeneration and no re\-judging\. Our only change concerns theSummarizationtraining split, where the native release contains the same source context twice: we drop one of the two duplicates, so that every model’sSummarizationtraining set—native or newly generated—contains the same25142514examples\.

#### Newly annotated models\.

We extend RAGTruth with token\-level hallucination labels forMistral\-Nemo\-12B,Qwen2\.5\-3B, andQwen2\.5\-7B\. Annotation proceeds in two stages: each model generates one response per unique query–context pair, thenQwen2\.5\-32Blabels unsupported or contradictory spans under the original RAGTruth judging template\.

#### Annotation rules\.

We annotate under the following fixed rules:

1. 1\.What counts as a hallucination\.A span is labeled hallucinated if it is*unsupported by*or*contradicted by*the source—i\.e\. both fabricated/baseless content and content that conflicts with the source are flagged\. The source is the news article \(Summarization\), the supporting passages \(Question Answering\), or the structured record together with its embedded customer reviews \(Data\-to\-Text\)\.
2. 2\.Judging template\.The judge receives the original RAGTruthinput\_strfor the example, instantiated per task: it is shown the source and the model response, then instructed to “identify and label any hallucinated statements … that are unsupported or contradicted by” the source and to “compile the labeled hallucinated spans into a JSON list, with each list item representing a separate hallucinated span\.”
3. 3\.Output format\.The judge returns a JSON list of text spans; it decodes greedily with a budget of10241024tokens\.
4. 4\.Span localization\.Each returned span is mapped to character offsets in the response by exact substring match; spans whose text cannot be located in the response are discarded\.
5. 5\.Token labels\.The detector operates on tokens \(one graph node per response token or window\), so for downstream graph construction we convert the character\-level spans into per\-token labels: each response token—under the model’s own tokenizer—is labeled*incorrect*if any of its characters overlaps any hallucination span, and*correct*otherwise\. We use this inclusive overlap rule \(rather than, say, requiring a token to be fully contained\) so that the boundary tokens of a hallucinated phrase are not dropped, erring toward recall on the positive class; it is simple and deterministic, and it is applied identically to the native RAGTruth annotations, so token labels are consistent across all six models\.

To assess the quality of the labels produced by our judge \(Qwen2\.5\-32B\), we audited the first ten test examples for each of the three newly annotated models—Qwen2\.5\-3B,Qwen2\.5\-7B, andMistral\-Nemo\-12B—on every task, for9090audited examples and220220flagged spans in total\. For each example we compared the model response, the source context, the final character\-level spans, and the judge’s free\-form rationale\. This appendix reports what we found, with verbatim examples; our headline conclusion is:*the labels are accurate enough to train on, with a well\-characterized and largely benign error profile*\.

#### Overall quality\.

The annotations are reliable on the points that matter most for token\-level supervision\. First, the character offsets are exact: all220220flagged spans matched their recorded text under the substring\-mapping step \(220/220220/220in[Table6](https://arxiv.org/html/2610.22723#A6.T6)\), so a flagged span is always aligned to the right tokens—there is no offset drift\. Second, onSummarizationthe judge is both precise and well\-calibrated: it leaves faithful summaries unlabeled \(17/3017/30summaries received no span\) and the spans it does emit are overwhelmingly genuine fabrications or contradictions \(examples below\)\. In general, the dominant error mode is*over\-flagging*\(false positives\), not missed hallucinations, and it is concentrated in the more list\-likeQuestion AnsweringandData\-to\-Texttasks; clear missed hallucinations were rare in our sample\.[Table6](https://arxiv.org/html/2610.22723#A6.T6)breaks the statistics down by model and task\.

Table 6:Audit statistics over the first ten test examples per \(model, task\),9090examples in total\. “Spans” is the total number of hallucination spans the judge flagged across the ten responses, and “Spans/resp\.” the average per response; “Empty” counts responses with no flagged span \(out of1010\); “Exact\-offset” counts spans whose recorded text matches the response substring at the recorded offsets\.
#### What the judge gets right\.

A clear majority of flagged spans are genuine, well\-localized hallucinations, and the judge is especially dependable on fabricated facts and on contradictions of the structured record\. Three representative cases:

- •Fabricated detail \(Summarization, Qwen2\.5\-3B\)\.The article to summarize states only that the ramp agent “started work at 5 a\.m\. and his shift was scheduled to end at 2:30 p\.m\.” The response adds that “the agent had been working overtime and was reportedly exhausted …Alaska Airlines is currently investigating the cause of the error\.” The judge flags exactly the three invented clauses—“the agent had been working overtime”, “was reportedly exhausted”, and “Alaska Airlines is currently investigating the cause of the error”—all absent from the source\.
- •Numerical contradiction \(Summarization, Mistral\-Nemo\)\.The article says B\.B\. King “has 30 Grammy nominations”; the response writes “a 15\-time Grammy winner\.” The judge correctly flags “15\-time Grammy winner” as a conflict\.
- •Attribute contradiction \(Data\-to\-Text, Qwen2\.5\-7B\)\.For Finch & Fork the record hasOutdoorSeating: FalseandAmbience\.romantic: False; the response claims “outdoor seating” and “romantic and classy ambiance\.” The judge flags both “outdoor seating” and “romantic and classy ambiance”—precise contradictions of the structured data\.

The judge also correctly treats true\-but\-unsupported world knowledge as baseless content \(e\.g\. flagging an added, factually correct explanation of DNA replication that does not appear in the passage\), and reliably catches wrong opening hours inData\-to\-Text\(e\.g\. “open from 11:30 AM to 8 PM on weekdays …” when the record lists different per\-day hours\)\. The two boxes below show such cases verbatim\.

Correct catch — fabricated detail \(Qwen2\.5\-3B,Summarization\)Source \(article\):“…the employee started work at 5 a\.m\. and his shift was scheduled to end at 2:30 p\.m\.” — no mention of overtime, exhaustion, or an investigation\. Response, flagged spans:“the agent had been working overtime”; “was reportedly exhausted”; “Alaska Airlines is currently investigating the cause of the error”\. Judge’s reason:“This detail is not mentioned in the original news”; “There’s no mention of exhaustion”\. Verdict:*Correct\.*All three clauses are fabrications absent from the article\.

Correct catch — contradiction of the structured record \(Qwen2\.5\-7B,Data\-to\-Text\)Record \(Finch & Fork\):OutdoorSeating: False,Ambience\.romantic: False\(classy: True\)\. Response, flagged spans:“outdoor seating”; “romantic and classy ambiance”\. Judge’s reason:“’OutdoorSeating’ is set to False in the structured data”; “’romantic’ is false according to the structured data”\. Verdict:*Correct*contradictions\. \(A third flagged span on the same example, “starting at $14”, is instead a false positive: a review states “$14 for the first mimosa”\.\)

#### Where it errs: over\-flagging onQuestion AnsweringandData\-to\-Text\.

The false positives are concentrated in the two list\-structured tasks, where responses heavily paraphrase or restate the source and the judge flags content that is in fact supported\. Two clear cases:

- •Supported paraphrase flagged \(Question Answering, Qwen2\.5\-3B\)\.The recipe passage explicitly lists cooking spray, cheese, and “onion, green pepper, and tomato slices\.” Yet the judge flags “Cooking spray for the baking sheet”, “Cheese \(optional\)”, and “Place slices of onion, green pepper, and tomato on top of the fillets”—all directly supported\. QA answers are long and itemized, and the judge frequently mislabels such faithful restatements\.
- •Judge overlooks support present in the source \(Data\-to\-Text, Qwen2\.5\-7B\)\.EachData\-to\-Textexample verbalizes a business record\. For the restaurant*Pizza Mizza*, the judge flags “located in Santa Barbara, CA” and “With free Wi\-Fi, outdoor seating, and take\-out options” as unsupported, even though the record itself statescity: Santa Barbara,WiFi: free,OutdoorSeating: True, andRestaurantsTakeOut: True\. It likewise misses support in the record’s embedded customer reviews: for the restaurant*Finch & Fork*, it flags “starting at $14” although a review states verbatim “$14 for the first mimosa, and $1 for every mimosa after that\.”

OnSummarizationthese errors are much rarer; the most common minor issue there is flagging a faithful paraphrase or a clause carrying no factual claim \(e\.g\. the discourse fragment “While the passage doesn’t provide specific details,”\)\. The two boxes below give the two false\-positive patterns verbatim\.

False positive — supported content flagged \(Qwen2\.5\-3B,Question Answering\)Source \(recipe passage\):lists “butter flavored cooking spray”, layering with “onion, green pepper, and tomato slices”, and adding cheese\. Response, flagged spans:“Cooking spray for the baking sheet”; “Cheese \(optional\)”; “Place slices of onion, green pepper, and tomato on top of the fillets\.” Judge’s reason:“The passage mentions using butter\-flavored cooking spray but does not specify it as an ingredient” \(and similar for the others\)\. Verdict:*False positives\.*All three are stated in the passage; the judge over\-flags faithful restatement on the long, itemized QA answers\.

False positive — judge ignores supported fields \(Qwen2\.5\-7B,Data\-to\-Text\)Record \(Pizza Mizza\):city: Santa Barbara,WiFi: free,OutdoorSeating: True,RestaurantsTakeOut: True\. Response, flagged spans:“located in Santa Barbara, CA”; “With free Wi\-Fi, outdoor seating, and take\-out options”\. Judge’s reason:“The address field is empty, so the exact location … is not specified” — yetcityis present, as are the WiFi/seating/takeout fields\. Verdict:*False positives\.*The flagged claims match fields that are present in the record\.

#### A minor \(<2%<2\\%of flagged spans\), fixable error source\.

Beyond task\-dependent over\-flagging, we identified one structural issue: rationale–label mismatch \(parsing\)\. The judge sometimes emits a JSON list of*candidate*spans and then retracts some in the prose that follows; our parser keeps the JSON list and never sees the retraction\. On the Rolling Stone summary \(Qwen2\.5\-7B\), “The magazine issued an apology” is recorded as a hallucination even though the judge’s own explanation states it “is supported by the original text, so it is not a hallucination\.” This is rare: scanning the full test set, only1\.7%1\.7\\%of flagged spans \(4949of29672967\) are plausibly retracted in this way\. For such an example, see below\.

Parser keeps a span the judge retracts in prose \(Qwen2\.5\-7B,Summarization\)Judge’s JSON list \(kept by the parser\):\[ "The magazine issued an apology", …\] Judge’s prose, same output:“ ‘The magazine issued an apology’ — This statement is supported by the original text, so it is not a hallucination\.” Verdict:*False positive\.*The judge retracts the span in prose, but our parser reads only the JSON list, so the span is kept\. As noted above, this affects only1\.7%1\.7\\%of flagged spans\.

Separately, we note a generation\-side artifact that is not an annotation error: responses for the three new models were generated with a256256\-token cap, which truncates most QA answers \(the native RAGTruth responses, generated with a larger budget, are unaffected\)\. Truncation does not create false positives; its only footprint on the labels is that when the usual QA over\-flagging lands on the incomplete final sentence, the resulting span is a malformed partial sentence rather than a clean clause\.

#### Severity and effect on training\.

The errors above are overwhelmingly false positives rather than missed hallucinations, and they have a mild effect on the per\-token labels that downstream training consumes\. The labels remain reliable where it counts: offsets are exact, faithful summaries are correctly left unlabeled, and genuine fabrications and contradictions are caught\. Two properties further soften the residual noise: the over\-flagged spans are usually whole clauses rather than scattered tokens, so the per\-token overlap rule \(rule 5 in the annotations rule above\) does not spread error beyond the flagged region\. We therefore regard the annotations as suitable supervision for token\-level hallucination detection\.

## Appendix GExperiments: Monitoring for LLM misbehaviors withLEMON— Extended Section

Our experiments were conducted using the PyTorch\([Paszke et al\., 2019](https://arxiv.org/html/2610.22723#bib.bib43)\)framework \(License: BSD\), using a single NVIDIA L\-40 GPU for all experiments\. We used a fixed batch size of1616graphs for all hallucination experiments, and88for the jailbreak; the latter is halved because jailbreak graphs are built over the full prompt rather than pooled response windows, and therefore contain roughly twice as many nodes per graph\.

#### Hyperparameters\.

[Table7](https://arxiv.org/html/2610.22723#A7.T7)lists all hyperparameters\. The hallucination and jailbreak experiments share the same architecture, optimizer, and search space; they differ only in the batch size, the window sizeWW, and the prediction level, which follow from the jailbreak monitor predicting a single label per prompt rather than a label per response window\. We keep the search space deliberately small: for every held\-out LLM, we train the four combinations ofK∈\{1,2\}K\\in\\\{1,2\\\}MPNN layers and\{1,2\}\\\{1,2\\\}cross\-token Transformer layers, and select the configuration—and, within it, the epoch—with the highest validation ROC\-AUC, where validation data comes only from the training LLMs, so the held\-out LLM never influences model selection\. Unless stated otherwise \(e\.g\., the adaptation study in[SectionG\.6](https://arxiv.org/html/2610.22723#A7.SS6)\), we train withα=0\\alpha=0, i\.e\., the invariant head alone\.

Table 7:LEMON hyperparameters\.Values in braces are searched; the configuration is selected by validation ROC\-AUC on the training LLMs only\. BothLEMONvariants share all settings\.
#### Optimizers and Schedulers\.

For all datasets, we use the AdamW optimizer[Loshchilov and Hutter \(2019\)](https://arxiv.org/html/2610.22723#bib.bib17)in combination with a cosine learning rate schedule that decays the learning rate from its initial value to zero over the course of training\.

### G\.1Baselines and Ablations: Implementation Details

All baselines follow the same cross\-LLM protocol, splits, and evaluation units asLEMON\.

#### Logistic\-regression baselines\.

LB,LB\+Align, andHS, as well as every per\-LLM and adaptation classifier \([SectionG\.6](https://arxiv.org/html/2610.22723#A7.SS6)\), use L2\-regularized logistic regression \(lbfgs, up to1,0001\{,\}000iterations\), with the inverse regularization strength swept overC∈\{10−3,10−2,…,103\}C\\in\\\{10^\{\-3\},10^\{\-2\},\\ldots,10^\{3\}\\\}and selected by validation ROC\-AUC\. When a small labeling budget leaves the validation split with a single class, validation is merged into training andC=1C\{=\}1is used; when the*training*split has a single class, the cell is reported as degenerate \(“—”\)\.

#### LookbackLens\(LB\)\.

Per\-tokenLookbackLensfeatures \([AppendixB](https://arxiv.org/html/2610.22723#A2)\), one lookback ratio per layer–head pair, are zero\-padded to the common40×4040\\times 40grid, giving a1,6001\{,\}600\-dimensional vector per token, and fed to the logistic regression above\. The classifier is fit on the pooled training LLMs and applied as\-is to the held\-out LLM\.

#### LookbackLens\+Alignment \(LB\+Align\)\.

The sameLookbackLensfeatures and classifier, except that every LLM’s features are first reindexed to a canonical reference by the head\-alignment procedure of[AppendixE](https://arxiv.org/html/2610.22723#A5)\.

#### Hidden\-state probing \(HS\)\.

We take the residual stream at layer2424of each LLM, zero\-pad it to the largest hidden dimension in the pool \(5,1205\{,\}120\), reduce it to128128dimensions with PCA fit on the training data only, and fit the logistic regression above\. For hallucination, features are per token \(window\-averaged\); for jailbreak, they are taken at the final prompt token\.

#### Token probability \(Prob\)\.

A training\-free score: the logit the LLM assigned to each generated token, averaged within each window, is used directly as the confidence score \(higher means more likely correct\)\. It requires no fitting, so it is evaluated identically in every setting\.

#### Attention to the system prompt \(Attn→\{\\to\}Sys\)\.

The training\-free jailbreak baseline of[Section4\.2](https://arxiv.org/html/2610.22723#S4.SS2)is computed from a single prompt\-only forward pass using the*full*, unthresholded attention \(the thresholded graphs used byLEMONwould distort its mean\)\. The spanSSis located by comparing the chat\-templated prompt with the templated empty message\.

#### CHARM\.

CHARMis trained through the identical pipeline, on identical graphs, loss, and splits, for100100epochs with learning rate10−310^\{\-3\}, sweeping hidden dimension∈\{16,64\}\\in\\\{16,64\\\}and message\-passing layers∈\{1,2\}\\in\\\{1,2\\\}, i\.e\., the same number of configurations asLEMON\. It has no cross\-token Transformer, so those axes are not searched\. For jailbreak, it uses batch size88and reads out the final node, asLEMONdoes\.

#### Ablations\.

All graph\-based ablations of[Section4\.3](https://arxiv.org/html/2610.22723#S4.SS3)are trained through the identical pipeline on identical graphs, over the same hyperparameter grid asLEMON\([Table7](https://arxiv.org/html/2610.22723#A7.T7)\); grid axes that configure a removed component are dropped\. The graph\-free ablation \(without graph\) trains a causal Transformer on the same window\-pooled token probabilities and labels, with every applicable hyperparameter matched toLEMON\.

### G\.2LLMs Used In Our Experiments

Every monitored LLM is open\-weight and instruction\-tuned\.[Table8](https://arxiv.org/html/2610.22723#A7.T8)lists all sixteen together with their attention grids\(H,L\)\(H,L\); we elaborate on them in the following\.

Table 8:Every LLM we monitor, with its attention grid\(H,L\)\(H,L\)\.#### Hallucination and jailbreak monitoring\.

Those experiments share the same pool of𝒦=6\\mathcal\{K\}=6LLMs:

- •Llama\-2\-7B\([Touvron et al\., 2023](https://arxiv.org/html/2610.22723#bib.bib16)\),\(H,L\)=\(32,32\)\(H,L\)=\(32,32\): the smaller of the two Llama\-2 chat models and one of the two most heavily safety\-aligned models in the pool\.
- •Llama\-2\-13B\([Touvron et al\., 2023](https://arxiv.org/html/2610.22723#bib.bib16)\),\(H,L\)=\(40,40\)\(H,L\)=\(40,40\): the same family and alignment recipe at roughly twice the scale\. It has the largest grid in the pool and therefore defines the paddedHmax×Lmax=40×40H\_\{\\max\}\\times L\_\{\\max\}=40\\times 40canvas into which every other LLM is embedded\.
- •Mistral\-7B\([Jiang et al\., 2023a](https://arxiv.org/html/2610.22723#bib.bib15)\),\(H,L\)=\(32,32\)\(H,L\)=\(32,32\): a different pretraining lineage with exactly the same grid shape asLlama\-2\-7B\.
- •Mistral\-Nemo\-12B[Sreenivas et al\. \(2024\)](https://arxiv.org/html/2610.22723#bib.bib71),\(H,L\)=\(32,40\)\(H,L\)=\(32,40\): a1212B Mistral model, and the only one whose grid is deep but not maximally wide\.
- •Qwen2\.5\-3B\([Yang et al\., 2024](https://arxiv.org/html/2610.22723#bib.bib29)\),\(H,L\)=\(16,36\)\(H,L\)=\(16,36\): the smallest LLM we monitor\.
- •Qwen2\.5\-7B\([Yang et al\., 2024](https://arxiv.org/html/2610.22723#bib.bib29)\),\(H,L\)=\(28,28\)\(H,L\)=\(28,28\)\.

#### Hallucination in the wild\.

These LLMs are never trained on; they only generate the responses we monitor with an unmodified LOO checkpoint\.

- •Mistral\-7B\-Instruct\-v0\.2\([Jiang et al\., 2023b](https://arxiv.org/html/2610.22723#bib.bib75)\),\(32,32\)\(32,32\): a later point release of a family in the training pool — hence the mildest shift we test\.
- •Pythia\-Chat\-Base\-7B\([Computer, 2023](https://arxiv.org/html/2610.22723#bib.bib76)\),\(32,32\)\(32,32\): aGPT\-NeoX[Black et al\. \(2022\)](https://arxiv.org/html/2610.22723#bib.bib77)lineage absent from the training pool entirely\.
- •Pythia\-Chat\-Base\-7B\-v0\.16,\(32,32\)\(32,32\): a later revision of the same model\.
- •TinyLlama\-1\.1B\-Chat\([Zhang et al\., 2024](https://arxiv.org/html/2610.22723#bib.bib78)\),\(32,22\)\(32,22\): a1\.11\.1B model, far shallower than anything seen during training\.
- •Zephyr\-7B\-β\\beta\([Tunstall et al\., 2023](https://arxiv.org/html/2610.22723#bib.bib79)\),\(32,32\)\(32,32\): a DPO\-tuned descendant ofMistral\-7B\.
- •Nous\-Hermes\-2\-Mistral\-7B\-DPO,\(32,32\)\(32,32\): a second, independently DPO\-tuned descendant ofMistral\-7B; together the two test whether the post\-training recipe — and not only the base model — shifts the attention signal\.
- •Phi\-4\-mini\-instruct\([Abouelenin et al\., 2025](https://arxiv.org/html/2610.22723#bib.bib80)\),\(24,32\)\(24,32\): a synthetic\-data\-centric family with no relative in the training pool\.
- •SmolLM2\-Instruct\([Allal et al\., 2025](https://arxiv.org/html/2610.22723#bib.bib81)\)at1\.71\.7B,360360M and135135M,\(32,24\)\(32,24\),\(15,32\)\(15,32\)and\(9,30\)\(9,30\): a deliberate size sweep down to the smallest grids we ever score, the last of which has only99attention heads\.

### G\.3Datasets Used In Our Experiments

#### Hallucination monitoring\.

- •RAGTruth\([Niu et al\., 2024](https://arxiv.org/html/2610.22723#bib.bib55)\)\(these were used for trainingLEMON\): word\-level hallucination spans over*retrieval\-grounded*generation\. Because every response is produced from a supplied context, a hallucination is an unsupported claim rather than a factual error, which makes the label objective and checkable\. It contains three tasks, and we train on their union and report each separately: - –Summarization \(SUM\): the task is to summarize a news article within a specified word budget; hallucinations are typically invented details or over\-generalized attributions\. - –Question answering \(NQ\): the task is to answer a user query using retrieved passages; hallucinations are claims that exceed what the passages support\. - –Data\-to\-text \(D2T\): the task is to generate a prose description from a structured business record \(JSON\); hallucinations are attributes absent from the record\. RAGTruth ships human annotations for only part of our pool; for the remaining LLMs we generate responses ourselves and annotate them withQwen2\.5\-32B; see details in[AppendixF](https://arxiv.org/html/2610.22723#A6)\.
- •Mu\-SHROOM, English split\([Vázquez et al\., 2025](https://arxiv.org/html/2610.22723#bib.bib72)\)\(in\-the\-wild evaluation only\): human*gold*character\-level spans over open\-domain answers\. There is no supplied context, so the LLM answers from parametric knowledge alone — a genuine distribution shift away from RAGTruth’s grounded setting\.
- •PsiloQA, English split\([Rykov et al\., 2025](https://arxiv.org/html/2610.22723#bib.bib73)\)\(in\-the\-wild evaluation only\): the same open\-domain question\-answering format at larger scale and across more generators, with*silver*spans produced by an automatic annotator\. It is what lets us test transfer across many unseen LLMs at once\.

#### Jailbreak monitoring\.

We useRedBench\([Dang et al\., 2026](https://arxiv.org/html/2610.22723#bib.bib87)\): a corpus of harmful requests, of which we use30003000prompts per LLM\. Each request is turned into an attack by appending a*single universal*GCG suffix\([Zou et al\., 2023](https://arxiv.org/html/2610.22723#bib.bib13)\)taken from HarmBench\([Mazeika et al\., 2024](https://arxiv.org/html/2610.22723#bib.bib63)\)and held fixed across every request and every monitored LLM; how that suffix was chosen is detailed below\. Each of the six LLMs answers greedily, andStrongREJECT\([Souly et al\., 2024](https://arxiv.org/html/2610.22723#bib.bib62)\)grades how much the response actually helps the*original*request — the suffix is stripped before grading, so the label measures genuine compliance rather than whether the model echoed the adversarial string — which we binarize at0\.50\.5\. The resulting attack\-success rate spans roughly sevenfold across the pool \(from≈8%\\approx 8\\%for the two Llama\-2 models to≈52%\\approx 52\\%forMistral\-Nemo\-12B;[Table9](https://arxiv.org/html/2610.22723#A7.T9)\), confirming that the label is a property of the target LLM and not of the prompt — which is exactly what makes zero\-shot transfer non\-trivial here\.

Table 9:Attack\-success rate \(ASR\) % of the universal GCG suffix, per LLM\.
#### How the attack suffix was chosen\.

We reuse one fixed string verbatim for all30003000requests and all six LLMs, taken as\-is from the public HarmBench release\([Mazeika et al\., 2024](https://arxiv.org/html/2610.22723#bib.bib63)\)\. Most artifacts in that release store one suffix*per behavior*\(per harmful request\), thus, the only candidates are itsEnsembleGCGruns, which optimize a single suffix jointly over all401401HarmBench behaviors and against an*ensemble*of targets\. We use the77B ensemble \(Llama\-2\-7B,Vicuna\-7B\-v1\.5,Orca\-2\-7B\)\. Of these, onlyLlama\-2\-7Bis in our monitored pool; however, this does not favor the monitor, asLlama\-2\-7Bnonetheless remains among the least susceptible LLMs in the pool \(8\.5%8\.5\\%\)\. The box below shows a complete input as it is fed toLlama\-2\-7B: theRedBenchrequest with the attack suffix appended verbatim, wrapped in the model’s own chat template\.

A complete attack input toLlama\-2\-7B\(RedBenchrequest \#4040\)<s\>\[INST\]How can I identify and steal high\-value artwork or antiquities from museums or private collections?\! Label columns\(\{\\boldsymbolTEatefulMay be\-\) transformations\]\-\> techniqueInfo succ briefly’\.$ alongside constraintTree\[/INST\]Chat template∣\\midRedBenchrequest∣\\miduniversal GCG suffix \(119119characters, identical for every request and every LLM\)\.Llama\-2\-7Brefuses here \(StrongREJECTscore0\.010\.01\), so this sample carries the label “attack failed”\.

#### Splits\.

The30003000prompt indices are shuffled once under seed4242and carved1800/450/7501800/450/750into train/validation/test \(25%25\\%test, then80/2080/20of the remainder\)\. The split is at the*prompt*level and shared across all six LLMs, so a prompt held out for one LLM is held out for all of them; combined with the leave\-one\-out rotation over LLMs, a test sample is therefore unseen on both axes\. It is*not*stratified by label, and cannot be: theStrongREJECTlabel is a property of the \(prompt, LLM\) pair rather than of the prompt, since the same30003000requests yield an attack\-success rate of8\.5%8\.5\\%onLlama\-2\-7Band51\.6%51\.6\\%onMistral\-Nemo\-12B, so no single shared partition can balance all six\. The random partition nevertheless leaves each LLM’s test\-split rate within a few points of its overall rate \([Table9](https://arxiv.org/html/2610.22723#A7.T9)\), and every shard remains usable: the least susceptible LLM still contributes5353positives to its750750\-prompt test split\.

In the next subsections, we provide additional results, which were omitted from the main text due to space limitations

### G\.4LOO results — Extended results

[Table2](https://arxiv.org/html/2610.22723#S4.T2)of the main text averages the three RAGTruth tasks per held\-out LLM\.[Table10](https://arxiv.org/html/2610.22723#A7.T10)gives the underlying per\-task cells\.

Table 10:LOO zero\-shot generalization — per\-task breakdownof[Table2](https://arxiv.org/html/2610.22723#S4.T2)\. Each data row is one \(left\-out LLM, task\) pair; every value is the ROC\-AUC×100\{\\times\}\\,100on that held\-out shard;avgrows average the three tasks for that LLM\.Bold= best per row;underline= second best\.Held\-out LLMTaskProbLBHSCHARMLB\+AlignLEMON \(Ours\)𝒲\\mathcal\{W\}𝒲\\mathcal\{W\}\-per\-cellLlama\-2\-7BSUM56\.248\.750\.741\.361\.768\.471\.4NQ60\.755\.852\.151\.661\.582\.784\.5D2T56\.641\.855\.943\.560\.663\.268\.9avg57\.848\.852\.945\.561\.371\.474\.9Llama\-2\-13BSUM55\.855\.347\.559\.549\.568\.370\.3NQ48\.558\.158\.864\.958\.681\.685\.1D2T52\.648\.351\.147\.654\.671\.471\.1avg52\.353\.952\.557\.354\.273\.875\.5Mistral\-7BSUM71\.154\.348\.740\.657\.866\.864\.1NQ66\.850\.343\.632\.856\.377\.980\.6D2T64\.843\.960\.853\.058\.559\.960\.8avg67\.649\.551\.042\.257\.568\.268\.5Mistral\-NemoSUM61\.048\.642\.944\.859\.460\.362\.2NQ55\.258\.055\.439\.161\.870\.269\.2D2T58\.550\.752\.648\.660\.761\.263\.1avg58\.352\.450\.344\.260\.663\.964\.8Qwen2\.5\-3BSUM61\.253\.548\.842\.053\.663\.964\.7NQ58\.750\.752\.041\.250\.869\.168\.8D2T65\.058\.747\.242\.445\.965\.065\.0avg61\.654\.349\.341\.950\.166\.066\.2Qwen2\.5\-7BSUM62\.349\.854\.560\.158\.260\.963\.6NQ58\.448\.249\.858\.659\.467\.068\.3D2T62\.551\.952\.254\.858\.663\.066\.9avg61\.150\.052\.257\.858\.763\.666\.3Mean \(18 shards\)59\.851\.551\.448\.157\.167\.869\.4

### G\.5Selective Generation

q1q\_\{1\}served in fullq2q\_\{2\}κf<τ\\kappa\_\{f\}\{<\}\\tau: halt𝐱^2\\hat\{\\mathbf\{x\}\}\_\{2\}\(served\)never generatedϕ^\\mathrlap\{\\hat\{\\phi\}\}\\hphantom\{\\hat\{R\}\}==12=50%\\tfrac\{1\}\{2\}=50\\%ϕ^token\\hat\{\\phi\}^\{\\text\{token\}\}==12​\(66\+37\)=57≈71%\\tfrac\{1\}\{2\}\\bigl\(\\tfrac\{6\}\{6\}\+\\tfrac\{3\}\{7\}\\bigr\)=\\tfrac\{5\}\{7\}\\approx 71\\%R^\\hat\{R\}==16\+0766\+37=760≈12%\\dfrac\{\\tfrac\{1\}\{6\}\+\\tfrac\{0\}\{7\}\}\{\\tfrac\{6\}\{6\}\+\\tfrac\{3\}\{7\}\}=\\tfrac\{7\}\{60\}\\approx 12\\%S^\\mathrlap\{\\hat\{S\}\}\\hphantom\{\\hat\{\\phi\}^\{\\text\{token\}\}\}==1−ϕ^token=27≈29%1\-\\hat\{\\phi\}^\{\\text\{token\}\}=\\tfrac\{2\}\{7\}\\approx 29\\%

Figure 13:Selective generation atτ=0\.5\\tau=0\.5\. Orange = flagged and withheld, dashed = never generated,red underline= hallucinated\.
Figure 14:RC\-curves\. The dotted line is the base hallucination rate\. AURC is the area under the RC\-curve\.
We demonstrateLEMONon*selective generation*: halting LLM generation when hallucination is likely\.[AppendixH](https://arxiv.org/html/2610.22723#A8)formalizes the framework thoroughly; here we summarize only what is needed to interpret the results\. Let𝐱\\mathbf\{x\}denote an LLM\-generated response \(the prompt is treated as part of𝐱\\mathbf\{x\}for notational convenience\), and𝐱:t\\mathbf\{x\}\_\{:t\}its prefix up to tokentt\. A*confidence function*κf\(𝐱:t\)\\kappa\_\{f\}\(\\mathbf\{x\}\_\{:t\}\)estimates how likely the next token is to be hallucinated; generation halts the first time the confidence falls below a specified thresholdτ\\tau, and the user is served only the prefix preceding the flagged error, denoted𝐱^\\hat\{\\mathbf\{x\}\}\.

We evaluate a confidence function using four quantities, summarized in[Equation14](https://arxiv.org/html/2610.22723#A7.E14)and illustrated in[Figure14](https://arxiv.org/html/2610.22723#A7.F14), whose relative importance may vary across use cases: \(i\) coverageϕ^\\hat\{\\phi\}, the fraction of generations that are served in full, i\.e\., never halted; \(ii\) token\-coverageϕ^token\\hat\{\\phi\}^\{\\text\{token\}\}, the average fraction of each generation that is served; \(iii\) selective riskR^\\hat\{R\}, the fraction of served content that is hallucinated; and \(iv\) token\-savingsS^\\hat\{S\}, the fraction of tokens that were withheld\. OverNNgenerations with full, unhalted lengths\{Ti\}i=1N\\\{T\_\{i\}\\\}\_\{i=1\}^\{N\}, these quantities are defined as follows:

ϕ^≔\|\{i∈\[N\]:𝐱^i=𝐱i\}\|N⏟coverageϕ^token≔1N​∑i=1N\|𝐱^i\|Ti⏟token\-coverageR^≔∑i=1Nhi/Ti∑i=1N\|𝐱^i\|/Ti⏟selective riskS^≔1−ϕ^token⏟token\-savings\\underbrace\{\\hat\{\\phi\}\\coloneqq\\frac\{\\bigl\|\\\{i\\in\[N\]:\\hat\{\\mathbf\{x\}\}\_\{i\}=\\mathbf\{x\}\_\{i\}\\\}\\bigr\|\}\{N\}\}\_\{\\text\{coverage\}\}\\quad\\\!\\\!\\underbrace\{\\hat\{\\phi\}^\{\\text\{token\}\}\\coloneqq\\frac\{1\}\{N\}\\sum\_\{i=1\}^\{N\}\\frac\{\|\\hat\{\\mathbf\{x\}\}\_\{i\}\|\}\{T\_\{i\}\}\}\_\{\\text\{token\-coverage\}\}\\quad\\\!\\\!\\underbrace\{\\hat\{R\}\\coloneqq\\frac\{\\sum\_\{i=1\}^\{N\}h\_\{i\}/T\_\{i\}\}\{\\sum\_\{i=1\}^\{N\}\|\\hat\{\\mathbf\{x\}\}\_\{i\}\|/T\_\{i\}\}\}\_\{\\text\{selective risk\}\}\\quad\\\!\\\!\\underbrace\{\\hat\{S\}\\coloneqq 1\-\\hat\{\\phi\}^\{\\text\{token\}\}\}\_\{\\text\{token\-savings\}\}\(14\)wherehih\_\{i\}is the number of hallucinated units in𝐱^i\\hat\{\\mathbf\{x\}\}\_\{i\}and\[N\]≔\{1,…,N\}\[N\]\\coloneqq\\\{1,\\ldots,N\\\}\. Sweepingτ\\tautrades coverage/token\-coverage against selective risk and traces the*risk\-coverage curve*\(*RC\-Curve*\), and provides an effective measure of a confidence function’s quality\.

#### Results\.

[Figure14](https://arxiv.org/html/2610.22723#A7.F14)shows the RC curves ofLEMON\-𝒲\\bm\{\\mathcal\{W\}\},LEMON\-𝒲\\bm\{\\mathcal\{W\}\}\-per\-cell, and the strongest baseline,Prob, over the specific combination of the NQ dataset, forLlama\-2\-13Bas left out LLM\. We observe that bothLEMONvariants significantly outperformProb, which is not even monotonically decreasing\. In contrast, bothLEMONvariants exhibit consistently monotonic \(decreasing\) behavior and, for example, at90%90\\%token\-coverage, reduce the hallucination rate by more than43%43\\%, while maintaining73%73\\%of prompts fully served\.

Finally,[Table11](https://arxiv.org/html/2610.22723#A7.T11)reports the area under the RC\-curve \(AURC\) for every \(held\-out LLM, task\) shard, summarizing the whole risk–coverage trade\-off in a single number per shard\.LEMONattains the lowest AURC in 17 of the 18 shards, and averaged over the shardsLEMON\-𝒲\\bm\{\\mathcal\{W\}\}\-per\-cellreaches8\.98\.9andLEMON\-𝒲\\bm\{\\mathcal\{W\}\}9\.19\.1, against12\.312\.3forProb\.

Table 11:Selective generation\.A per\-shard breakdown of the area under the risk–coverage curve \(lower is better\)\.Bold= best in row\.

### G\.6Few\-shot adaptation

We test whetherLEMONcan adapt to the held\-out LLM givenNadaptN\_\{\\mathrm\{adapt\}\}labeled samples from its training shard\. SinceLEMON’s invariant head \(see[Figure15](https://arxiv.org/html/2610.22723#A7.F15), left\) discards head and layer identity by design, we retrainLEMONunder the same LOO setup with a second,*per\-LLM*non\-invariant head \([Figure15](https://arxiv.org/html/2610.22723#A7.F15), right\) alongside the original invariant one\.

The two heads are trained jointly with a convex combination of their binary cross\-entropy losses,

ℒ=\(1−α\)​ℒinv\+α​ℒnon−inv,\\mathcal\{L\}=\(1\-\\alpha\)\\,\\mathcal\{L\}\_\{\\mathrm\{inv\}\}\+\\alpha\\,\\mathcal\{L\}\_\{\\mathrm\{non\-inv\}\},\(15\)so thatα=0\\alpha=0recovers the original, invariant\-only training\. The non\-invariant head pushes the per\-node featuresϕn∈ℝL​H\\bm\{\\phi\}\_\{n\}\\in\\mathbb\{R\}^\{LH\}to be linearly separable for hallucination detection, so that a lightweight classifier can adapt to a new LLM with minimal supervision\. Adaptation itself is simple: we freeze the backbone, extractϕn\\bm\{\\phi\}\_\{n\}on the held\-out LLM, and fit a logistic regression on theNadaptN\_\{\\mathrm\{adapt\}\}labeled samples\. Two questions arise:*\(1\) are the learned features adaptable? \(2\) does training a second head hurt zero\-shot transfer?*As a reference to this experiment, we use theLBbaseline fit on the sameNadaptN\_\{\\mathrm\{adapt\}\}samples\.

#### Results\.

*\(1\) The features are adaptable\.*With the full adaptation set \(Nadapt=fullN\_\{\\mathrm\{adapt\}\}\{=\}\\text\{full\}\), logistic\-regression adaptation onLEMONfeatures improves asα\\alphaincreases and plateaus at aroundα=0\.5\\alpha\{=\}0\.5\([Figure17](https://arxiv.org/html/2610.22723#A7.F17)\)\. We therefore fixα=0\.5\\alpha\{=\}0\.5to evaluate adaptation in low\-sample regimes\. In this setting,LEMON\-𝒲\\bm\{\\mathcal\{W\}\}\-per\-celloutperformsLBatNadapt=10N\_\{\\mathrm\{adapt\}\}\{=\}10\(\+2\.2\+2\.2ROC\-AUC\) and performs comparably at all larger budgets \([Figure16](https://arxiv.org/html/2610.22723#A7.F16)\)\.*\(2\) The second head does not hurt zero\-shot transfer\.*Zero\-shot performance of the invariant head remains stable forα≤0\.75\\alpha\\leq 0\.75and degrades only atα=1\\alpha\{=\}1, where the head receives no gradient\.

Invariant headPer\-LLM head𝐇out∈ℝ\|V\|×L×H×d\\mathbf\{H\}^\{\\mathrm\{out\}\}\\\!\\in\\\!\\mathbb\{R\}^\{\|V\|\\times L\\times H\\times d\}Mean over\(l,h\)\(l,h\)MLPy^ninv∈ℝ\\hat\{y\}\_\{n\}^\{\\mathrm\{inv\}\}\\\!\\in\\\!\\mathbb\{R\}ℒinv\\mathcal\{L\}\_\{\\mathrm\{inv\}\}MLPper\(l,h\)\(l,h\)ϕn∈ℝL​H\\bm\{\\phi\}\_\{n\}\\\!\\in\\\!\\mathbb\{R\}^\{LH\}Linear*per LLM*y^nninv∈ℝ\\hat\{y\}\_\{n\}^\{\\mathrm\{ninv\}\}\\\!\\in\\\!\\mathbb\{R\}ℒninv\\mathcal\{L\}\_\{\\mathrm\{ninv\}\}ℒ=\(1−α\)​ℒinv\+α​ℒninv\\mathcal\{L\}=\(1\{\-\}\\alpha\)\\,\\mathcal\{L\}\_\{\\mathrm\{inv\}\}\+\\alpha\\,\\mathcal\{L\}\_\{\\mathrm\{ninv\}\}LRadapt\.Figure 15:Invariantandper\-LLMheads \(one linear predictor per pool LLM\)\.𝐇out\\mathbf\{H\}^\{\\mathrm\{out\}\}is the per\-node features before the prediction heads\. DashedLR: the adaptation read\-out, fit on the frozenϕn\\bm\{\\phi\}\_\{n\}after training, so it does not feedℒ\\mathcal\{L\}\.Figure 16:Adaptation to the held\-out LLM vs\. labeling budget, bothLEMONvariants; mean over the 18 \(LLM, task\) shards\. Solid: logistic regression on the frozen non\-invariant head’s features \(α=0\.5\\alpha\{=\}0\.5\) andLB; dashed: the corresponding invariant\-head \(zero\-shot\) levels\. The signed number at each point is that variant’s gap toLB\.Figure 17:Invariant head vs\. non\-invariant head\+\+LR as a function ofα\\alpha, bothLEMONvariants\. We report the mean over the 18 \(LLM, task\) shards\. Raisingα\\alphatrains the per\-LLM non\-invariant pathway and improves adaptation, while atα=1\\alpha\{=\}1the invariant head collapses towards chance as expected\.

### G\.7LOI Results

In the leave\-one\-in \(LOI\) setup, each detector is trained on the three task shards of a*single*LLM and evaluated zero\-shot on the remaining five LLMs—the minimal\-source\-diversity counterpart of the LOO setup\.[Table12](https://arxiv.org/html/2610.22723#A7.T12)reports the full per\-task breakdown\.

Table 12:LOI zero\-shot generalization — per\-task breakdown\.Each monitor is trained on a single \(left\-in\) LLM and evaluated zero\-shot on the other five\. Each data row is one \(left\-in LLM, task\) pair; every value is the mean ROC\-AUC×100\{\\times\}\\,100over the five held\-out evaluation LLMs;avgrows average the three tasks for that LLM\.Bold= best per row;underline= second best\.Left\-in LLMTaskProbLBHSCHARMLB\+AlignLEMON \(Ours\)𝒲\\mathcal\{W\}𝒲\\mathcal\{W\}\-per\-cellLlama\-2\-7BSUM62\.353\.448\.360\.155\.855\.762\.1NQ57\.556\.152\.159\.259\.962\.766\.1D2T60\.755\.750\.054\.449\.254\.564\.7avg60\.255\.150\.157\.955\.057\.664\.3Llama\-2\-13BSUM62\.449\.753\.450\.649\.561\.863\.5NQ60\.049\.652\.750\.054\.365\.371\.7D2T61\.550\.653\.352\.244\.063\.661\.3avg61\.349\.953\.150\.949\.363\.665\.5Mistral\-7BSUM59\.357\.450\.849\.658\.960\.664\.7NQ56\.356\.449\.264\.362\.672\.073\.3D2T59\.054\.052\.050\.755\.860\.963\.9avg58\.255\.950\.754\.959\.164\.567\.3Mistral\-NemoSUM61\.348\.349\.749\.853\.665\.865\.5NQ58\.650\.048\.752\.851\.976\.675\.4D2T60\.357\.754\.345\.451\.960\.560\.6avg60\.152\.050\.949\.352\.567\.767\.2Qwen2\.5\-3BSUM61\.353\.250\.043\.851\.167\.267\.8NQ57\.953\.549\.442\.953\.474\.374\.5D2T59\.050\.756\.948\.951\.664\.264\.6avg59\.452\.552\.145\.252\.068\.669\.0Qwen2\.5\-7BSUM61\.144\.451\.848\.252\.568\.667\.9NQ58\.046\.251\.632\.651\.175\.076\.1D2T59\.539\.155\.452\.648\.862\.161\.3avg59\.543\.252\.944\.450\.868\.668\.4Mean \(18 shards\)59\.851\.451\.650\.453\.165\.166\.9

## Appendix HSelective Generation: Formal Framework

This appendix formalizes the*selective\-generation*setting introduced in[SectionG\.5](https://arxiv.org/html/2610.22723#A7.SS5)\. It builds on selective prediction\([Geifman and El\-Yaniv, 2017](https://arxiv.org/html/2610.22723#bib.bib47)\), in which a model is trained to know what it does not know, allowing it to abstain when insufficiently confident\. The rejection option dates back over sixty years\([Chow, 1957](https://arxiv.org/html/2610.22723#bib.bib46)\)and has since been studied for neural networks\([Geifman and El\-Yaniv, 2017](https://arxiv.org/html/2610.22723#bib.bib47);[Geifman and El\-Yaniv, 2019](https://arxiv.org/html/2610.22723#bib.bib48)\)\. For LLMs, abstention has mostly been studied at the*response*level: refusing or deferring a whole answer based on uncertainty estimates, self\-evaluation, or conformal guarantees\([Cherian et al\., 2024](https://arxiv.org/html/2610.22723#bib.bib49);[Kuhn et al\., 2023](https://arxiv.org/html/2610.22723#bib.bib33);[Kadavath et al\., 2022](https://arxiv.org/html/2610.22723#bib.bib36)\)\. In contrast, we formalize*selective generation*for LLMs at the token level, using an online monitor during decoding, such asLEMON, the monitor introduced in this paper, to halt generation mid\-response\.

#### Setup\.

We consider standard autoregressive LLMs\. Writing𝐱≤t≔\(x1,…,xt\)\\mathbf\{x\}\_\{\\leq t\}\\coloneqq\(x\_\{1\},\\ldots,x\_\{t\}\)for a token sequence, they decompose its next token probability using the chain rule:

p⁡\(𝐱≤t\)=∏i=1tp⁡\(xi∣𝐱≤i−1\),p\(\\mathbf\{x\}\_\{\\leq t\}\)=\\prod\_\{i=1\}^\{t\}p\(x\_\{i\}\\mid\\mathbf\{x\}\_\{\\leq i\-1\}\),where𝐱≤i−1\\mathbf\{x\}\_\{\\leq i\-1\}is the prefix preceding tokenxix\_\{i\}\(with𝐱≤0\\mathbf\{x\}\_\{\\leq 0\}the empty sequence\)\. At inference time, an LLM generates tokens sequentially by sampling each new token from its predicted conditional categorical distributionp⁡\(xt\+1∣𝐱≤t\)p\(x\_\{t\+1\}\\mid\\mathbf\{x\}\_\{\\leq t\}\)over the vocabularyVV, until an end\-of\-sequence token \(EOS\) is produced\. Thus, for each prefix𝐱≤t\\mathbf\{x\}\_\{\\leq t\}, the LLM defines a mapping,

p⁡\(xt\+1∣𝐱≤t\):Vt→Δ⁡\(V\),p\(x\_\{t\+1\}\\mid\\mathbf\{x\}\_\{\\leq t\}\):V^\{t\}\\to\\Delta\(V\),whereΔ⁡\(V\)\\Delta\(V\)denotes the probability simplex overVV\.

#### Selective generation\.

We define a*selective generator*as a pair of functions\(f,g\)\(f,g\)acting on prefixes of arbitrary length,V∗≔⋃t≥0VtV^\{\*\}\\coloneqq\\bigcup\_\{t\\geq 0\}V^\{t\}\. Here,f:V∗→Δ⁡\(V\)f:V^\{\*\}\\to\\Delta\(V\)denotes the LLM itself, withf⁡\(𝐱≤t\)≔p⁡\(xt\+1∣𝐱≤t\)f\(\\mathbf\{x\}\_\{\\leq t\}\)\\coloneqq p\(x\_\{t\+1\}\\mid\\mathbf\{x\}\_\{\\leq t\}\), whileg:V∗→\{0,1\}g:V^\{\*\}\\to\\\{0,1\\\}is a*selection function*\.

Whenever the LLM samples a new tokenxt\+1x\_\{t\+1\},gginspects the preceding prefix𝐱≤t\\mathbf\{x\}\_\{\\leq t\}and decides whether to serve the new token or to withhold it and stop generating:

\(f,g\)​\(𝐱≤t\)≔\{serve​xt\+1​and continueif​g​\(𝐱≤t\)=1,withhold​xt\+1​and haltif​g​\(𝐱≤t\)=0,\(f,g\)\(\\mathbf\{x\}\_\{\\leq t\}\)\\coloneqq\\begin\{cases\}\\text\{serve \}x\_\{t\+1\}\\text\{ and continue\}&\\text\{if \}g\(\\mathbf\{x\}\_\{\\leq t\}\)=1,\\\\ \\text\{withhold \}x\_\{t\+1\}\\text\{ and halt\}&\\text\{if \}g\(\\mathbf\{x\}\_\{\\leq t\}\)=0,\\end\{cases\}see[Figure18](https://arxiv.org/html/2610.22723#A8.F18)for an illustration of the selective\-generation process\.

TheMoonorbitsMarsLLMfθf\_\{\\theta\}input: the prefixgenerated so farsamples the*single*next tokenxt\+1x\_\{t\+1\}g⁡\(𝐱≤t\)g\(\\mathbf\{x\}\_\{\\leq t\}\)reads the*whole*prefixserve “Mars”, continuewithhold “Mars”, haltg=1g=1g=0g=0Figure 18:The selective generator\(f,g\)\(f,g\): the LLMffsamples one token at a time, while the selection functionggdecides whether to serve the newest token and continue generation, or to withhold it and halt\.Thus, generation halts at the*first*time step at whichggabstains\. Writing𝐱=\(x1,…,xT\)\\mathbf\{x\}=\(x\_\{1\},\\ldots,x\_\{T\}\)for the full,*uninterrupted*generation, terminating with theEOStoken at stepTT, the*halting step*is defined as:

ρ≔min⁡\{t≥0:g⁡\(𝐱≤t\)=0\}\+1\(ρ=∞​if​g​never abstains\)\.\\rho\\coloneqq\\min\\bigl\\\{\\,t\\geq 0:g\(\\mathbf\{x\}\_\{\\leq t\}\)=0\\,\\bigr\\\}\+1\\qquad\\bigl\(\\rho=\\infty\\text\{ if \}g\\text\{ never abstains\}\\bigr\)\.\(16\)
Halting atρ\\rhosplits the generation into three parts \(see[Figure19](https://arxiv.org/html/2610.22723#A8.F19)\):

- •The tokensx1,…,xρ−1x\_\{1\},\\ldots,x\_\{\\rho\-1\}, each of which passedgg’s check and was delivered to the user\.
- •The flagged tokenxρx\_\{\\rho\}\.
- •The suffix beyondxρx\_\{\\rho\}, which is never generated at all\.

We define the*served output*𝐱^\\hat\{\\mathbf\{x\}\}as the prefix of𝐱\\mathbf\{x\}that is actually delivered to the user:

𝐱^≔\{𝐱≤Tifρ=∞\(reachedEOS: the full response is delivered\),𝐱≤ρ−1otherwise\(truncated just before the flagged token\)\.\\hat\{\\mathbf\{x\}\}\\coloneqq\\begin\{cases\}\\mathbf\{x\}\_\{\\leq T\}&\\text\{if \}\\rho=\\infty\\quad\(\\text\{reached \{EOS\}: the full response is delivered\}\),\\\\\[2\.0pt\] \\mathbf\{x\}\_\{\\leq\\rho\-1\}&\\text\{otherwise\}\\quad\(\\text\{truncated just before the flagged token\}\)\.\\end\{cases\}\(17\)
TheMoonorbitsMarseverymonthEOSρ=4\\rho=4: first rejection;xρx\_\{\\rho\}is flagged and withheld𝐱^=𝐱≤ρ−1\\hat\{\\mathbf\{x\}\}=\\mathbf\{x\}\_\{\\leq\\rho\-1\}\(delivered\)never generatedFigure 19:The halting stepρ\\rhoof equation[16](https://arxiv.org/html/2610.22723#A8.E16)and the served output𝐱^\\hat\{\\mathbf\{x\}\}of equation[17](https://arxiv.org/html/2610.22723#A8.E17):ggabstains for the first time at “Mars”, soρ=4\\rho=4\. The user sees only the tokens delivered before the flag \(blue\); the flagged token itself is withheld \(orange\), and the suffix beyond it is never generated \(dashed\)\.Whether an individual token is served is thus determined jointly by all the decisions up to it\. Define the*per\-token acceptance*g~:V∗→\{0,1\}\\tilde\{g\}:V^\{\*\}\\to\\\{0,1\\\},

g~​\(𝐱≤t\+1\)≔∏s=0tg⁡\(𝐱≤s\),\\tilde\{g\}\(\\mathbf\{x\}\_\{\\leq t\+1\}\)\\coloneqq\\prod\_\{s=0\}^\{t\}g\(\\mathbf\{x\}\_\{\\leq s\}\),\(18\)which equals11iff no prefix precedingxt\+1x\_\{t\+1\}was rejected, i\.e\., iffxt\+1x\_\{t\+1\}belongs to𝐱^\\hat\{\\mathbf\{x\}\}\. We note thatg~\\tilde\{g\}is00from the first rejected token onward, and thatg~​\(𝐱≤T\)=1\\tilde\{g\}\(\\mathbf\{x\}\_\{\\leq T\}\)=1iff the full generation is served;[Figure20](https://arxiv.org/html/2610.22723#A8.F20)visualizes howg~\\tilde\{g\}aggregates the individual decisions ofgg\.

x1x\_\{1\}x2x\_\{2\}x3x\_\{3\}⋯\\cdotsxt\+1x\_\{t\+1\}g⁡\(𝐱≤0\)g\(\\mathbf\{x\}\_\{\\leq 0\}\)g⁡\(𝐱≤1\)g\(\\mathbf\{x\}\_\{\\leq 1\}\)g⁡\(𝐱≤2\)g\(\\mathbf\{x\}\_\{\\leq 2\}\)g⁡\(𝐱≤t\)g\(\\mathbf\{x\}\_\{\\leq t\}\)g~\(𝐱≤t\+1\)=g\(𝐱≤0\)⋅g\(𝐱≤1\)⋅g\(𝐱≤2\)⋯g\(𝐱≤t\)\\tilde\{g\}\(\\mathbf\{x\}\_\{\\leq t\+1\}\)=g\(\\mathbf\{x\}\_\{\\leq 0\}\)\\cdot g\(\\mathbf\{x\}\_\{\\leq 1\}\)\\cdot g\(\\mathbf\{x\}\_\{\\leq 2\}\)\\cdots g\(\\mathbf\{x\}\_\{\\leq t\}\)Figure 20:The per\-token acceptanceg~\\tilde\{g\}of equation[18](https://arxiv.org/html/2610.22723#A8.E18): each tokenxs\+1x\_\{s\+1\}is gated by the decisiong⁡\(𝐱≤s\)g\(\\mathbf\{x\}\_\{\\leq s\}\), made on the strict prefix preceding it \(arrows\), andg~​\(𝐱≤t\+1\)\\tilde\{g\}\(\\mathbf\{x\}\_\{\\leq t\+1\}\)is the product of all the decisions up to the one gatingxt\+1x\_\{t\+1\}—a single rejection anywhere zeroes it\.Usingg~​\(⋅\)\\tilde\{g\}\(\\cdot\), we also define the*cumulative selection function*g¯:V∗→\[0,1\]\\bar\{g\}:V^\{\*\}\\to\[0,1\]as the fraction of served tokens,

g¯​\(𝐱\)≔\|𝐱^\|T=1T​∑t=1Tg~​\(𝐱≤t\),\\bar\{g\}\(\\mathbf\{x\}\)\\coloneqq\\frac\{\|\\hat\{\\mathbf\{x\}\}\|\}\{T\}=\\frac\{1\}\{T\}\\sum\_\{t=1\}^\{T\}\\tilde\{g\}\(\\mathbf\{x\}\_\{\\leq t\}\),\(19\)so thatg¯​\(𝐱\)=1\\bar\{g\}\(\\mathbf\{x\}\)=1iff generation reachedEOSwith no abstention \(ρ=∞\\rho=\\infty\), while a truncated generation earns the partial credit\(ρ−1\)/T\(\\rho\-1\)/T; see[Figure21](https://arxiv.org/html/2610.22723#A8.F21)for an illustration of the three quantitiesgg,g~\\tilde\{g\}, andg¯\\bar\{g\}, over an example\.

𝐱\\mathbf\{x\}:TokyoisJapan’scapitalEOStt:12345g⁡\(𝐱≤t−1\)g\(\\mathbf\{x\}\_\{\\leq t\-1\}\):g~​\(𝐱≤t\)\\tilde\{g\}\(\\mathbf\{x\}\_\{\\leq t\}\):1111111111⇒g¯​\(𝐱\)=1\\Rightarrow\\ \\bar\{g\}\(\\mathbf\{x\}\)=1\(served in full\)𝐱′\\mathbf\{x\}^\{\\prime\}:TheMoonorbitsMarseverymonthEOStt:1234567g⁡\(𝐱≤t−1\)g\(\\mathbf\{x\}\_\{\\leq t\-1\}\):g~​\(𝐱≤t\)\\tilde\{g\}\(\\mathbf\{x\}\_\{\\leq t\}\):1110⋅\\cdot⋅\\cdot⋅\\cdot1110000⇒g¯​\(𝐱′\)=37\\Rightarrow\\ \\bar\{g\}\(\\mathbf\{x\}^\{\\prime\}\)=\\tfrac\{3\}\{7\}\(33of77tokens served\)Figure 21:The three selection functions on two*different*generations \(one per row\); the time stepttof each token is shown above it\.
#### Coverage and selective risk\.

The performance of a selective generator is quantified by two quantities:*token\-coverage*and*selective risk*\. LetPPdenote the distribution over*full, uninterrupted*generations𝐱=\(x1,…,xT\)\\mathbf\{x\}=\(x\_\{1\},\\ldots,x\_\{T\}\)induced by drawing a prompt and sampling the response fromffuntilEOS\.*token\-coverage*is the expected fraction of generated tokens that are served,

ϕtoken​\(f,g\)≔𝔼𝐱∼P​\[g¯​\(𝐱\)\]\.\\phi^\{\\text\{token\}\}\(f,g\)\\coloneqq\\mathbb\{E\}\_\{\\mathbf\{x\}\\sim P\}\\bigl\[\\bar\{g\}\(\\mathbf\{x\}\)\\bigr\]\.\(20\)To quantify risk, we assume a loss functionℓ:V∗→ℝ≥0\\ell:V^\{\*\}\\to\\mathbb\{R\}\_\{\\geq 0\}that scores the generation of the last token in a prefix,ℓ⁡\(𝐱≤t\)\\ell\(\\mathbf\{x\}\_\{\\leq t\}\), which can be any measure of the quality—for instance, its perplexity under a reference model, or a binary indicator of hallucination\. The*selective risk*weights each token’s loss by its acceptance:

R⁡\(f,g\)≔𝔼𝐱∼P​\[1T​∑t=1Tℓ⁡\(𝐱≤t\)​g~​\(𝐱≤t\)\]ϕtoken​\(f,g\)\.R\(f,g\)\\coloneqq\\frac\{\\mathbb\{E\}\_\{\\mathbf\{x\}\\sim P\}\\Bigl\[\\,\\frac\{1\}\{T\}\\sum\_\{t=1\}^\{T\}\\ell\(\\mathbf\{x\}\_\{\\leq t\}\)\\,\\tilde\{g\}\(\\mathbf\{x\}\_\{\\leq t\}\)\\Bigr\]\}\{\\phi^\{\\text\{token\}\}\(f,g\)\}\.\(21\)Importantly, only*served*tokens contribute to the selective risk\. We now turn to define their empirical counterparts, which are used in practice to evaluate selective generators on finite datasets\.

#### Empirical estimators\.

Given an evaluation set ofNNprompts with full generations𝐱\(i\)=\(x1\(i\),…,xTi\(i\)\)\\mathbf\{x\}^\{\(i\)\}=\(x^\{\(i\)\}\_\{1\},\\ldots,x^\{\(i\)\}\_\{T\_\{i\}\}\)and served outputs𝐱^\(i\)\\hat\{\\mathbf\{x\}\}^\{\(i\)\}as above, both quantities are estimated by replacing expectations with sample means\. Thus, the*empirical token\-coverage*is the average served fraction,

ϕ^token​\(f,g\)≔1N​∑i=1Ng¯​\(𝐱\(i\)\)=1N​∑i=1N\|𝐱^\(i\)\|Ti,\\hat\{\\phi\}^\{\\text\{token\}\}\(f,g\)\\coloneqq\\frac\{1\}\{N\}\\sum\_\{i=1\}^\{N\}\\bar\{g\}\\bigl\(\\mathbf\{x\}^\{\(i\)\}\\bigr\)=\\frac\{1\}\{N\}\\sum\_\{i=1\}^\{N\}\\frac\{\|\\hat\{\\mathbf\{x\}\}^\{\(i\)\}\|\}\{T\_\{i\}\},\(22\)and the*empirical selective risk*is,

R^​\(f,g\)≔1N​∑i=1N1Ti​∑t=1Tiℓ⁡\(𝐱≤t\(i\)\)​g~​\(𝐱≤t\(i\)\)1N​∑i=1Ng¯​\(𝐱\(i\)\)\.\\hat\{R\}\(f,g\)\\coloneqq\\frac\{\\frac\{1\}\{N\}\\displaystyle\\sum\_\{i=1\}^\{N\}\\frac\{1\}\{T\_\{i\}\}\\sum\_\{t=1\}^\{T\_\{i\}\}\\ell\\bigl\(\\mathbf\{x\}^\{\(i\)\}\_\{\\leq t\}\\bigr\)\\,\\tilde\{g\}\\bigl\(\\mathbf\{x\}^\{\(i\)\}\_\{\\leq t\}\\bigr\)\}\{\\frac\{1\}\{N\}\\displaystyle\\sum\_\{i=1\}^\{N\}\\bar\{g\}\\bigl\(\\mathbf\{x\}^\{\(i\)\}\\bigr\)\}\.\(23\)token\-coverage credits partially served generations, so it does not reveal how many responses the user receives*untouched*\. We therefore also define the*coverage*: the fraction of generations that are served in full, i\.e\., that reachEOSwithoutggever abstaining \(ρ=∞\\rho=\\infty, equivalently𝐱^=𝐱\\hat\{\\mathbf\{x\}\}=\\mathbf\{x\}\):

ϕ^\(f,g\)≔\|\{i:𝐱^\(i\)=𝐱\(i\)\}\|N,\\hat\{\\phi\}\(f,g\)\\coloneqq\\frac\{\\bigl\|\\bigl\\\{\\,i\\;:\\;\\hat\{\\mathbf\{x\}\}^\{\(i\)\}=\\mathbf\{x\}^\{\(i\)\}\\,\\bigr\\\}\\bigr\|\}\{N\},\(24\)so thatN​ϕ^N\\hat\{\\phi\}counts the responses fully satisfied undergg\. Since a fully served generation contributesg¯=1\\bar\{g\}=1to the token\-coverage while a truncated one contributes only its served fraction, we always haveϕ^≤ϕ^token\\hat\{\\phi\}\\leq\\hat\{\\phi\}^\{\\text\{token\}\}\.

#### Compute savings\.

Beyond withholding errors, halting also*saves compute*: the suffix beyond the flagged token is never generated\. We define the*token\-savings*simply as the complement of token\-coverage,

S^​\(f,g\)≔1−ϕ^token​\(f,g\),\\hat\{S\}\(f,g\)\\coloneqq 1\-\\hat\{\\phi\}^\{\\text\{token\}\}\(f,g\),\(25\)the average fraction of each generation that is withheld\. An illustration of the empirical coverage, token\-coverage, selective risk, and token\-savings is given in[Figure22](https://arxiv.org/html/2610.22723#A8.F22)\.

𝐱\\mathbf\{x\}:Waterboilsat90degreesEOSgg:g~\\tilde\{g\}:ℓ\\ell:111111111111000001g¯​\(𝐱\)=1\\bar\{g\}\(\\mathbf\{x\}\)=11T​∑tℓ​g~=16\\tfrac\{1\}\{T\}\\sum\_\{t\}\\ell\\,\\tilde\{g\}=\\tfrac\{1\}\{6\}1−g¯​\(𝐱\)=01\-\\bar\{g\}\(\\mathbf\{x\}\)=0𝐱′\\mathbf\{x\}^\{\\prime\}:TheMoonorbitsMarseverymonthEOSgg:g~\\tilde\{g\}:ℓ\\ell:1110⋅\\cdot⋅\\cdot⋅\\cdot11100000001010g¯​\(𝐱′\)=37\\bar\{g\}\(\\mathbf\{x\}^\{\\prime\}\)=\\tfrac\{3\}\{7\}1T​∑tℓ​g~=0\\tfrac\{1\}\{T\}\\sum\_\{t\}\\ell\\,\\tilde\{g\}=01−g¯​\(𝐱′\)=471\-\\bar\{g\}\(\\mathbf\{x\}^\{\\prime\}\)=\\tfrac\{4\}\{7\}ϕ^=12=0\.5​ϕ^token=1\+372=57≈0\.71​R^=16\+01\+37=760≈0\.12​S^=1−ϕ^token=27≈0\.29\\hat\{\\phi\}=\\dfrac\{1\}\{2\}=0\.5\\hskip 9\.24994pt\\hat\{\\phi\}^\{\\text\{token\}\}=\\dfrac\{1\+\\tfrac\{3\}\{7\}\}\{2\}=\\dfrac\{5\}\{7\}\\approx 0\.71\\hskip 9\.24994pt\\hat\{R\}=\\dfrac\{\\tfrac\{1\}\{6\}\+0\}\{1\+\\tfrac\{3\}\{7\}\}=\\dfrac\{7\}\{60\}\\approx 0\.12\\hskip 9\.24994pt\\hat\{S\}=1\-\\hat\{\\phi\}^\{\\text\{token\}\}=\\dfrac\{2\}\{7\}\\approx 0\.29Figure 22:Coverage equation[24](https://arxiv.org/html/2610.22723#A8.E24), token coverage equation[22](https://arxiv.org/html/2610.22723#A8.E22), selective risk equation[23](https://arxiv.org/html/2610.22723#A8.E23), and token savings equation[25](https://arxiv.org/html/2610.22723#A8.E25)on an evaluation set ofN=2N=2generations\. Beneath each token, as in[Figure21](https://arxiv.org/html/2610.22723#A8.F21): the per\-step decisionsgg, the per\-token acceptanceg~\\tilde\{g\}\(latching to00from the first rejection\), and the per\-prefix lossesℓ\\ell\(red underline= hallucinated\)\.
### H\.1Constructing Selective Generators and the Risk–Coverage Curve

In this section we present a general technique for constructing a selective generator, using a confidence\-rate functionκf:V∗→ℝ\\kappa\_\{f\}:V^\{\*\}\\to\\mathbb\{R\}for an LLMffthat scores each prefix𝐱≤t\\mathbf\{x\}\_\{\\leq t\}by its confidence in the next token\. Forκf\\kappa\_\{f\}to be useful for selective generation, it should be*monotone*: larger values ofκf​\(𝐱≤t\)\\kappa\_\{f\}\(\\mathbf\{x\}\_\{\\leq t\}\)should indicate that the next tokenxt\+1x\_\{t\+1\}is more likely to be correct, or equivalently, less likely to be hallucinated\. Formally, given𝐱≤t∈Vt,𝐱≤t′′∈Vt′\\mathbf\{x\}\_\{\\leq t\}\\in V^\{t\},\\mathbf\{x\}^\{\\prime\}\_\{\\leq t^\{\\prime\}\}\\in V^\{t^\{\\prime\}\}, we require that:

κf​\(𝐱≤t\)≥κf​\(𝐱≤t′′\)⟹ℓ⁡\(𝐱≤t\+1\)≤ℓ⁡\(𝐱≤t′\+1′\)\.\\kappa\_\{f\}\(\\mathbf\{x\}\_\{\\leq t\}\)\\geq\\kappa\_\{f\}\(\\mathbf\{x\}^\{\\prime\}\_\{\\leq t^\{\\prime\}\}\)\\quad\\Longrightarrow\\quad\\ell\(\\mathbf\{x\}\_\{\\leq t\+1\}\)\\leq\\ell\(\\mathbf\{x\}^\{\\prime\}\_\{\\leq t^\{\\prime\}\+1\}\)\.\(26\)Namely, if the confidence in the next tokenxt\+1x\_\{t\+1\}is higher than that ofxt\+1′x^\{\\prime\}\_\{t\+1\}, thenxt\+1x\_\{t\+1\}should be more likely to be correct thanxt\+1′x^\{\\prime\}\_\{t\+1\}\.

Given such a confidence function and a thresholdτ∈ℝ\\tau\\in\\mathbb\{R\}, we construct a selection functiongτg\_\{\\tau\}by thresholding the confidence:

gτ​\(𝐱≤t\)≔\{1if​κf​\(𝐱≤t\)≥τ,0if​κf​\(𝐱≤t\)<τ\.g\_\{\\tau\}\(\\mathbf\{x\}\_\{\\leq t\}\)\\coloneqq\\begin\{cases\}1&\\text\{if \}\\kappa\_\{f\}\(\\mathbf\{x\}\_\{\\leq t\}\)\\geq\\tau,\\\\\[2\.0pt\] 0&\\text\{if \}\\kappa\_\{f\}\(\\mathbf\{x\}\_\{\\leq t\}\)<\\tau\.\\end\{cases\}\(27\)Since the decision gatingxt\+1x\_\{t\+1\}is computed from the served prefix𝐱≤t\\mathbf\{x\}\_\{\\leq t\}alone,\(f,gτ\)\(f,g\_\{\\tau\}\)is a selective generator for everyτ\\tau: generation halts the first time the confidence dips below the threshold\.

#### The risk–coverage curve\.

The thresholdτ\\taucontrols the trade\-off between token\-coverage and risk: raising it withholds more aggressively, lowering the token\-coverage and—for a monotoneκf\\kappa\_\{f\}—the selective risk with it\. Sweepingτ\\tauthus traces the*risk–coverage \(RC\) curve*τ↦\(ϕ^token​\(f,gτ\),R^​\(f,gτ\)\)\\tau\\mapsto\\bigl\(\\hat\{\\phi\}^\{\\text\{token\}\}\(f,g\_\{\\tau\}\),\\,\\hat\{R\}\(f,g\_\{\\tau\}\)\\bigr\), which summarizes the selective\-generation ability of a confidence function across all operating points; we condense it into a single number, the area under the curve,AURC=∫R^​d​ϕ^token\\mathrm\{AURC\}=\\int\\hat\{R\}\\,\\mathrm\{d\}\\hat\{\\phi\}^\{\\text\{token\}\}\(lower is better, and comparable across confidence functions\)\.