Beyond In-Domain Detection: SpikeScore for Cross-Domain Hallucination Detection

AI summary

Overview

• Research area: Hallucination detection for large language models, specifically cross-domain (out-of-distribution) generalization of detectors.
• Technical level: Intermediate. The paper uses uncertainty-probe scoring, AUROC evaluation, and a probabilistic separability theorem, assuming some familiarity with LLM internals and distribution shift.
• Scope: The paper introduces the generalizable hallucination detection (GHD) setting, proposes a "SpikeScore" indicator computed from multi-turn dialogue dynamics, proves a separability bound for it, and benchmarks it against training-free, training-based, and cross-domain-specialized baselines on four LLMs and six datasets.

What This Paper Is About

Hallucination detectors that are trained on one kind of data (for example, math questions) generally lose accuracy when tested on a different kind of data (for example, conversational question answering). The authors define this as the generalizable hallucination detection (GHD) problem: train on a single domain and still detect hallucinations reliably across many related domains. Their solution observes that when a hallucinated first answer is fed back to the model as conversational context, the model's uncertainty score swings more sharply across turns than when the first answer was factual, and they turn that swing size into a detector.

Key Contributions

1. A standardized protocol for inducing multi-turn continuations. The authors feed an LLM's initial answer back as context and add follow-up prompts ( \mathbf{P}^i ), producing a score trajectory ( \mathbf{S}(\mathbf{Q},\mathbf{A}) = [S(\mathbf{A}^1,\mathbf{Q},\mathbf{A}), \dots, S(\mathbf{A}^K,\mathbf{Q},\mathbf{A})] ) with default stopping step (K=20). This gives every question-answer pair a comparable trajectory for analysis.
2. The SpikeScore indicator. SpikeScore is defined as the maximum second-order difference of the score sequence, ( \text{Max}|\Delta^2|(\mathbf{S}(\mathbf{Q},\mathbf{A})) = \max_{1<k<K-1} |S(\mathbf{A}^{k+1}) - 2S(\mathbf{A}^k) + S(\mathbf{A}^{k-1})| ), i.e., the sharpest local curvature (largest rise-and-fall) in the uncertainty trajectory. Detection is then a threshold rule (D_\lambda): hallucinated if SpikeScore (\geq \lambda), otherwise non-hallucinated.
3. Statistical observations plus a theoretical separability guarantee. Observations 1–3 characterize the mean, standard deviation, and coefficient of variation of SpikeScore on non-hallucinated data across domains, and Theorem 1 converts those conditions into a probabilistic lower bound on the chance that a hallucinated sample scores above a factual one.
4. Cross-domain empirical validation. Leave-one-out experiments over four LLMs (Llama-3.2-3B-Instruct, Llama-3.1-8B-Instruct, Qwen3-8B-Instruct, Qwen3-14B-Instruct) and six benchmarks (TriviaQA, CommonsenseQA, Belebele, CoQA, Math, SVAMP), covering commonsense, knowledge-intensive, conversational, and mathematical reasoning, plus a compatibility study combining SpikeScore with five different backbone scoring methods.

Main Findings

• Hallucinated dialogues fluctuate far more than factual ones. Observation 1 reports that across training configurations the mean SpikeScore on the hallucination domain is more than twice that on the non-hallucination domain, stated as (2 \mathbb{E}{\text{factual}} \text{Max}|\Delta^2|(\mathbf{S}) < \mathbb{E}{\text{hallucinated}} \text{Max}|\Delta^2|(\mathbf{S})).
• Variance is larger too, but bounded relative to the mean. Observation 2 states that the ratio of standard deviations (hallucinated over factual) lies between 1 and 2.5, with the reported ratio reaching 2.5 — larger than the expectation ratio of 2, which is why the authors argue raw variance alone is insufficient.
• Coefficient of variation stays controlled. Observation 3 reports that the coefficient of variation of SpikeScore on non-hallucinated data does not exceed 0.2 across the six leave-one-out groups.
• Theorem 1 gives a probabilistic separation bound. If the coefficient of variation for the non-hallucination domain satisfies (\mathbf{CV} \le 0.1 \cdot t) for some (t>0), then (\mathbb{P}(\text{Max}|\Delta^2|(\text{hallucinated}) > \text{Max}|\Delta^2|(\text{factual})) \ge 1/(1 + 0.0725 \cdot t^2)). With the observed (\mathbf{CV} \le 0.2) (i.e., (t=2)), this yields a probability of at least approximately 0.775.
• Strongest average cross-domain AUROC. Under the leave-one-out protocol, SpikeScore attains the best average AUROC in every model configuration: 0.7474 (Llama-3.2-3B), 0.7860 (Llama-3.1-8B), 0.7473 (Qwen3-8B), and 0.7874 (Qwen3-14B). The closest competitor, ICR Probe, reaches 0.7463, 0.7439, 0.7381, and 0.7435 respectively; PRISM reaches 0.6953, 0.7029, 0.7032, and 0.7072.
• Training-based detectors generalize poorly without the spike signal. Average AUROCs are much lower for SAPLMA (0.5693, 0.5764, 0.5705, 0.5787 across the four models), SEP (0.5270, 0.5282, 0.5212, 0.5274), and MM (0.5591, 0.5635, 0.5632, 0.5635).
• Largest gains on conversational data. On CoQA, SpikeScore reaches 0.8540 (Llama-3.2-3B) and 0.8584 (Llama-3.1-8B), compared with ICR Probe at 0.8155 and 0.8074 and PRISM at 0.7984 and 0.7917. For Qwen3-14B, SpikeScore reaches 0.8333 on CoQA and 0.8157 on Math, against ICR Probe's 0.8084 on CoQA and 0.7434 on Math.
• Performance scales with model size within a family. The authors note SpikeScore improves with larger models in the same family, attributing this to stronger self-correction capabilities in larger LLMs producing more detectable spike patterns.
• The spike phenomenon is not tied to one scoring method. In the compatibility study, SpikeScore combined with training-based scorers is strongest: SpikeScore+SAPLMA averages 0.7474 (Llama-3.2-3B) and 0.7860 (Llama-3.1-8B), SpikeScore+SEP averages 0.7294 and 0.7684. Training-free backbones are weaker: SpikeScore+Reasoning score 0.7196 and 0.7595; SpikeScore+In-Context Sharpness 0.7014 and 0.7311; SpikeScore+Perplexity 0.6788 and 0.7160. For Qwen3 the reported averages are SpikeScore+Perplexity 0.6742 (Qwen3-8B) and 0.7113 (Qwen3-14B); the remaining Qwen3 rows are truncated in the provided content.
• Second-order differences beat first-order variability. Ablations against the coefficient of variation reported in Appendix D.3 show that the curvature-based SpikeScore consistently outperforms first-order variability measures.
• Around 20 turns is enough. Dialogue-length analysis in Appendix D.4 shows performance saturates around 15–20 turns, motivating the default (K=20) and the authors' term "early stage" for the first 20 turns.
• Training data efficiency. Appendix D.1 reports that SpikeScore captures low-frequency, domain-agnostic instability patterns and converges with minimal training data, whereas single-step methods rely on high-frequency, semantically entangled features that fail to transfer.

Methodology in Plain English

The authors start from a known behavior: if you keep pushing back on an LLM in a conversation, it often abandons its earlier position. They simulate this by taking a question, letting the model produce an initial answer, then feeding that answer back as context along with follow-up prompts designed to extend the conversation. Each continuation answer gets a truthfulness probability from SAPLMA, a lightweight probe: a multilayer perceptron with a sigmoid output trained by cross-entropy on top of the model's internal hidden representation. This produces a sequence of uncertainty scores across dialogue turns.

The insight is that the shape of this sequence differs by whether the original answer was hallucinated. If the first answer was wrong, the model tends to swing back and forth as it tries to correct itself, producing sharp peaks — a rapid rise followed by a steep drop. If the first answer was correct, the sequence drifts more gently. SpikeScore measures exactly that: the largest second-order difference (the biggest curvature) anywhere in the first 20 turns. A big spike means hallucination; a small one means the answer is likely factual. Detection is then just picking a threshold on this single number, so no per-domain retraining is needed at test time.

To justify that this generalizes, the authors measure mean, standard deviation, and coefficient of variation of SpikeScore separately for hallucinated and factual samples across six leave-one-out dataset splits, then prove that when the coefficient of variation of the factual domain is small enough, a hallucinated dialogue outscores a factual one with quantified high probability. Evaluation uses leave-one-out: train the probe on one dataset, test on the other five, report AUROC so training-based methods are never scored on their own training domain.

Why This Matters

Impact on research. The paper reframes hallucination detection from an in-domain classification problem to a domain-generalization problem and offers a concrete, theoretically analyzed indicator for it. It also shifts attention from single-response signals (perplexity, semantic entropy, hidden-state probes) to multi-turn conversational dynamics, and shows that a training-based probe can be made to transfer by changing what you measure rather than retraining per domain. The separability theorem ties an empirical statistic (coefficient of variation) to a usable probability bound, which gives the approach a theoretical footing that many detection heuristics lack.

Real-world applications:

• Healthcare. The introduction cites healthcare (Roustan et al., 2025) as a safety-critical domain where hallucinated outputs can cause harm; a detector that does not need in-domain labeled data is practical where domain labels are scarce.
• Education. Also cited as safety-critical (Harvey et al., 2025), where a model giving contradictory answers across a tutoring dialogue is a visible failure mode the method directly targets.
• Finance. Cited (Kang and Liu, 2023) as another high-stakes setting where unreliable model statements undermine trust.
• Multi-turn assistants and customer-facing dialogue systems. Because the signal comes from conversational self-contradiction, it fits deployment patterns where users naturally push back or rephrase, rather than one-shot question answering.

Industry relevance. The method needs only one labeled domain and a single threshold at test time, which lowers labeling cost for teams deploying LLMs across heterogeneous traffic. It is model-agnostic in the experiments (four open-source LLMs spanning two families and 3B–14B parameters) and works with several backbone scorers, so it can be layered onto existing uncertainty probes rather than requiring a new architecture.

Future Directions

• Extending the theory beyond the observed conditions. Theorem 1 relies on Observations 1–3 and a coefficient-of-variation constraint; the authors' own analysis suggests the bound "may extend across domains under the examined conditions," leaving a fully domain-free guarantee open.
• Broadening the domain pool. Evidence rests on six benchmarks confined to commonsense, knowledge-intensive, conversational, and mathematical reasoning; whether the spike phenomenon holds for other modalities, languages, or task formats is not reported.
• Reducing the dialogue cost. Detection requires up to 20 continuation turns, which is far more expensive than single-pass scoring; the reported saturation at 15–20 turns suggests room to search for cheaper trajectory designs.
• Explaining the scaling trend. The paper attributes the improvement with larger models to stronger self-correction, but does not isolate which mechanism produces the detectable spikes, leaving that as an open question.

Target Audience

Researchers and engineers working on LLM reliability, uncertainty quantification, and out-of-distribution generalization will get the most from this paper, along with practitioners who need a hallucination detector that transfers across task domains without labeled test-domain data. It is also relevant to readers interested in multi-turn dialogue safety and self-consistency, and to those who want an example of pairing an empirical distributional observation with a formal separability bound. Readers without background in uncertainty probes or AUROC-based evaluation will find the methodology section dense, though the core intuition is accessible.

Authors’ abstract

Hallucination detection is critical for deploying large language models (LLMs) in real-world applications. Existing hallucination detection methods achieve strong performance when the training and test data come from the same domain, but they suffer from poor cross-domain generalization. In this paper, we study an important yet overlooked problem, termed generalizable hallucination detection (GHD), which aims to train hallucination detectors on data from a single domain while ensuring robust performance across diverse related domains. In studying GHD, we simulate multi-turn dialogues following LLMs' initial response and observe an interesting phenomenon: hallucination-initiated multi-turn dialogues universally exhibit larger uncertainty fluctuations than factual ones across different domains. Based on the phenomenon, we propose a new score SpikeScore, which quantifies abrupt fluctuations in multi-turn dialogues. Through both theoretical analysis and empirical validation, we demonstrate that SpikeScore achieves strong cross-domain separability between hallucinated and non-hallucinated responses. Experiments across multiple LLMs and benchmarks demonstrate that the SpikeScore-based detection method outperforms representative baselines in cross-domain generalization and surpasses advanced generalization-oriented methods, verifying the effectiveness of our method in cross-domain hallucination detection.