One in Four NeurIPS Papers Cites a Reference That Doesn't Exist

Also available as a plain-text transcript page.

0:00Bella: A factory ships a hundred thousand units a year, and its defect rate is half of one percent. On the quality dashboard, that's a triumph. Out in the world, it's five hundred broken products sitting in customers' hands. Now make the factory a machine learning conference, and make the units citations. Roughly one in four papers accepted at NeurIPS in 2025 cites at least one work that doesn't seem to exist.

0:29Tyler: One fact before anything else: this explainer is AI-made, both of our voices included. Fine print at the end.

0:36Bella: The paper is called Phantom References, from a Microsoft team of Mark Russinovich, Ram Shankar Siva Kumar, and Ahmed Salem. They audited about forty-eight thousand accepted papers and over two and a half million references across ICLR, ICML, NeurIPS, and USENIX Security. By the end of this video you'll understand why peer review is structurally blind to fabricated citations, and why the fix costs about four cents a paper. And this matters beyond tidy bibliographies. LLMs now sit inside the workflows that produce scientific writing, and a hallucination that survives to publication stops being a model error. It becomes a permanent line in the scientific record.

1:22Tyler: My honest first reaction, Bella, is that this shouldn't be possible. Every one of these papers was read by three to five expert reviewers. A fake citation is the easiest thing in a paper to catch. You paste the title into a search bar, and either something comes up or it doesn't. And the paper's own per-reference numbers seem to back me up: 0.38 percent at ICLR 2025, 0.68 percent at NeurIPS. Under one percent everywhere they looked. That sounds like a system that's working.

1:54Bella: That case has two cracks in it. The first is empirical: reviewers don't paste titles into search bars. The paper cites a survey in which 76.7 percent of reviewers report not checking references at all. Reviewers evaluate the ideas, the method, and the results; the bibliography rides through on trust. The second crack is arithmetic, and it's the paper's central move. Under one percent per reference is true. But a conference proceedings is not a single bibliography. Take ICLR 2025 as the worked example. On screen it's a grid, one dot per paper — 3,703 dots, and behind them about 221 thousand references. That under-one-percent rate works out to 835 flagged references. Now watch where they land. They don't pile up in a few rotten papers. They scatter, roughly one per bibliography, and 692 distinct dots turn red. Nearly one in five accepted papers, at one conference, in one year.

3:01Tyler: Huh. So the same scattering drives both numbers. Spread thin, the rate looks negligible. Spread thin, no reviewer ever sees a pattern, because one phantom in a forty-entry bibliography is below any human's detection threshold. "Under one percent" and "one in five papers" are the same dataset read through two different denominators.

3:26Bella: That reframing is the spine of the whole paper, and it deserves one clean restatement: the failure is rare enough per reference to sound dismissible, and common enough per paper to touch a fifth of a leading conference's proceedings. Both descriptions are accurate. Only one tells you the footprint.

3:48Tyler: Okay, but the arithmetic assumes the flags are real. Anyone who's touched bibliographic metadata knows it's filthy. Mangled author strings, retitled preprints, and databases that flatly disagree with each other. How much of that 835 is a tool misreading a PDF rather than an author citing a ghost?

4:11Bella: That's the right question, and the honest answer cuts both ways — hold it, because the paper pays it off properly. First you need to see what they count, because the definition is built to survive exactly that objection. The reason this audit is even possible is that a citation is a checkable object. Verifying a reference is like dialing a phone number: it connects to the person named, or it doesn't. Fact-checking a paper's actual claims is like adjudicating a rumor — judgment, expertise, and often no clean ground truth. The authors deliberately walked away from the hard problem and audited only the phone numbers. And they count exactly two failures as hallucination. Fabrication, where no indexed work matches the cited title anywhere. And author-identity corruption, where the title is real but it's credited to a substantially different set of authors — a real book attributed to a writer who never wrote it. Everything else is excluded: a preprint that later became a conference paper, a wrong year, a wrong venue, or a misspelled name. All of that gets logged as ordinary drift and never counted. Whatever these numbers are, they're a floor.

5:27Tyler: Two and a half million references, though. Checking those by hand is centuries of labor, so something automated has to do it. And the obvious worry is recursive: what stops the checker itself from hallucinating?

5:41Bella: The pipeline design — this is the densest stretch of the paper, and it pays off in that four-cent price tag. The tool is called RefChecker, and it's a funnel. Stage one: extract every reference from the PDF, keeping the raw original string alongside the parsed fields, so a garbled parse can be audited later. Stage two: check each reference against six big bibliographic catalogs — Semantic Scholar, OpenAlex, CrossRef, DBLP, the ACL Anthology, and direct identifier lookups like DOIs and arXiv. These are the giant card catalogs of science, and the overwhelming majority of references match cleanly and exit the funnel right there, for fractions of a cent.

6:26Tyler: And the ones the catalogs can't clear? That's precisely where I'd expect the tool to start hallucinating about hallucinations.

6:35Bella: Which is why the escalation is caged. Only the suspicious residue goes further — a reference nobody can find, an author list that barely overlaps the matched record, or an identifier that resolves to a different work. Those cases go to an LLM with web search, and the task is constrained: the model has to find a dedicated source page for the cited work, not just some other paper repeating the citation, and anything it finds gets re-verified against the metadata before the reference is cleared. The authors are explicit that this reduces model risk rather than eliminating it. But the LLM only ever gathers evidence. It never gets the last word.

7:19Tyler: So, quick check before the numbers — why is the funnel shape the entire reason this is deployable?

7:26Bella: Because the expensive, flaky step only ever sees the residue. Cheap deterministic lookups clear nearly everything, which is how scanning all of ICLR 2025 — every reference in every accepted paper — cost about a hundred and fifty-seven dollars. Four cents per paper to audit a top-tier conference. Most affected papers carry exactly one phantom. The tail is where it gets dark. Back to the grid on screen: most red dots are papers with a single bad reference, which is precisely the profile that slips through review. But watch the right edge of the distribution. Papers glowing with five flags. Ten. One NeurIPS 2022 paper carries twenty hallucinated references in a single bibliography. And the tail is where the authors are most confident, for a simple reason: one flag might be a tool misreading a PDF. Twenty independent failures in one reference list is not a parsing accident, and it's not a borderline case.

8:29Tyler: The timeline points somewhere uncomfortable, too. This corpus straddles ChatGPT's public release, and in the post-ChatGPT years the affected-paper rate climbs across most of these venues and stays elevated. The authors are careful here. The series isn't perfectly monotonic, and they don't claim causation — consistent with a change in how bibliographies get assembled is as far as they'll go. But they did something more direct than trend-reading: they emailed the authors of the five-plus-flag papers and asked what happened.

9:06Bella: Not one claimed the references were real, and not one was accused of fraud either. Uniformly, authors traced the errors to LLM-based tools that generated or reformatted their bibliographies, in some cases at the camera-ready stage, after review had already finished. The paper frames it as a workflow breakdown rather than misconduct: a model turns a fuzzy memory of a paper into a polished, alphabetized BibTeX entry in seconds, and on the page it looks exactly like scholarly care. Several of those authors went on to notify program chairs and correct public versions. Which leaves the sharper question: a paper with twenty phantom references passed peer review at NeurIPS. How does that happen?

9:53Tyler: Because peer review is a home inspector who never opens the electrical panel. The inspector grades the foundation, the roof, and the layout with real rigor, and the wiring still isn't in scope, so a glowing report tells you nothing about it. The paper tests this three ways. First, reviewer ratings: papers with phantom references score higher than clean ones. Plus 0.02 at ICLR, plus 0.04 at NeurIPS. Effectively zero, and leaning the wrong direction. Second, acceptance tier: posters, spotlights, and orals carry the problem at similar rates, and the affected list includes award-winning papers. The authors point that out more than once.

10:39Bella: Ratings are noisy, though — a skeptic could still say the signal is buried in the averages. There's a cleaner test, and it's the sharpest number in the paper. If reviewers catch fabricated citations even occasionally, the papers they reject should be worse offenders than the papers they accept.

10:59Tyler: ICLR 2023, accepted versus rejected. Accepted papers averaged a reviewer rating of 6.61; rejected papers, 4.67. Nearly two full points — by review's own yardstick, a chasm in quality. Now the phantom rates. Accepted papers: sixteen point zero percent affected. Rejected papers: sixteen point nine. The process sorted thousands of papers hard on perceived quality and did not sort them at all on whether their bibliographies survive verification. The signal exists in the record, and it's invisible to the process that decides what enters the record.

11:39Bella: And it isn't one pipeline's artifact. GPTZero independently scanned three hundred ICLR 2026 submissions and found more than fifty with at least one human-verified hallucinated citation — after each of those papers had received three to five expert reviews. Different corpus, different method, same neighborhood. One more twist, from the breakdown by research area: all fourteen areas land between roughly fifteen and twenty-six percent affected, and the LLM and foundation-models community itself sits near the bottom of that range, at 16.1 percent. The paper's claim is modest — the people most fluent in these tools appear slightly less prone to getting burned by them, possibly because they know exactly what the tools do to references, and check.

12:31Tyler: So the ledger so far: tiny per reference and large per paper, a tail too dense to be noise, and review scores carrying no information about any of it. Which means everything now rests on the question I asked at the top, Bella, and it's time to cash it. When a human looks at an individual flag, how often is it real?

12:53Bella: The answer is uncomfortable, and to the authors' credit they print it plainly: most of the flags they inspected by hand were not hallucinations. The pipeline is an aggressive spam filter, and sometimes it quarantines real mail because the sender's name got garbled in transit. The best case in the paper: RefChecker flagged "Adam: A Method for Stochastic Optimization" by Kingma and Ba, one of the most-cited papers in the history of machine learning. PDF extraction had dropped "Adam" out of the title and mashed it into the author field as "Jimmy Ba Adam," and the tool, reasoning over that mangled copy, couldn't find the paper. Two more from their taxonomy: a real journal paper flagged because the citation listed one extra name, which turned out to be the volume's editor rather than a coauthor. And two real 2023 tutorials that share an identical title — the citation named the right authors, but the tool matched the better-indexed record by the other team and reported a fabrication where both works exist.

14:02Tyler: Then what does a real phantom look like, next to all that noise?

14:06Bella: Immaculate. One true positive reads "Applying Novelty Detection Techniques for Quality Assurance in Manufacturing," attributed to Emily Roberts and Rajesh Gupta, complete with a journal and a year. It resolves to nothing in six databases plus a constrained web search. Another cites "Compressive Transformers for Long-Range Sequence Modelling" — a real title — credited to five people who didn't write it. On a fast read that one passes, precisely because the title checks out. The fakes are often better-formatted than the real citations around them.

14:43Tyler: Which brings me to my reservation, and I think it reframes how this paper should be quoted. The quotable figure and the trustworthy figure are two different figures. "One in four NeurIPS papers" rests on the least reliable threshold, a single flag per paper, which is exactly where the Adam-style false positives live. The authors tell us, qualitatively, that most hand-inspected flags weren't real, but they never audited a labeled ground-truth sample, so the pipeline has no measured precision. And the fabrication bucket has a structural hole: "not indexed anywhere" looks identical to "doesn't exist yet," and some contacted authors confirmed their flagged reference was simply unpublished. So the defensible core is narrower than the number that will get quoted. The high-count tail is solid. The accepted-versus-rejected result is solid. The one-in-four is an estimate whose error bars nobody has measured.

15:47Bella: You win that one, Tyler, and the authors would concede it themselves — they name false positives as the primary limitation and insist an individual flag should never be treated as conclusive without human review. So quote the conservative number instead: papers carrying at least two hallucinated academic references. At NeurIPS 2025 that's 5.1 percent, with USENIX Security about the same. One in twenty papers, two independent phantoms each, at the field's most selective venues, under a definition designed to undercount. The magnitude is debatable. The existence isn't.

16:27Tyler: And the paper's closing move is constructive rather than accusatory. This is a failure automated pre-publication verification is well suited to catch, and human review, in its current form, demonstrably is not. So run the four-cent check at submission, and again at camera-ready, where some of these errors were introduced. ICLR and ICML 2026 already list hallucinated references as grounds for desk rejection, and the authors endorse the deterrent with one condition that should sound familiar by now: a flag opens an evidence-backed conversation with the authors. It doesn't fire automatically.

17:10Bella: So — the factory from the cold open. The defect rate looked like a triumph because we were reading the wrong denominator, and the inspection everyone assumed was happening was never in scope. That's the claim to carry out of this paper: the scientific record has a new, LLM-shaped failure mode, and the realistic defense is cheap automated verification of the one layer of a paper that's mechanically checkable.

17:40Tyler: So pick your policy. Should a failed citation check desk-reject a paper outright, or does every flag deserve a human and a chance to explain? Conferences are deciding this year — leave your call in the comments.

17:55Bella: The full annotated version of this episode is at paperdive.ai, with every technical term tap-to-define and links to related papers grouped by theme. Quick details: this script was written by Anthropic's Claude Fable 5; Tyler and I are AI voices from Eleven Labs; the producer isn't affiliated with either company. The paper is Phantom References, posted July first, 2026 — we made this on July sixth.

18:25Tyler: Two and a half million references audited for the price of one conference dinner. Money well spent, probably.