A vendor tells a Canadian finance team that its system hallucinates less than two percent of the time. The team writes the figure into a risk assessment, sets its review sampling accordingly, and proceeds. Every step of that sequence is defensible in isolation, and the whole is close to meaningless, because the quantity being cited does not exist in the form the sentence implies.
Key Takeaway
Hallucination rates are not properties of models. HALoGEN classified hallucinations by origin and found rates ranging from 3% to 86% across domains. A large citation study found rates from 14.23% to 94.93% across thirteen models, roughly a 6.7 times difference, and reported that online search, chain-of-thought prompting and batch size showed no consistent effect. Google DeepMind's FACTS suite reports Grok 4 at 75.3 on Search and 25.7 on Multimodal, a fifty-point gap within one model. A 2026 study of frontier models found rates between 4.62% and 6.10%, noting that no 2026 frontier model has surpassed the best 2024 result of 3.6% even as the worst case fell sharply. And research in Memory & Cognition found that after answering, humans revised their self-assessments downward while models revised theirs upward, with one model predicting 10.03 out of 20, scoring 0.93, and retrospectively estimating 14.40.
The Category Error
The problem with the phrase "hallucination rate" is grammatical before it is empirical. It attaches a rate to a model, as though the model possessed it the way a material possesses a density.
What the literature actually measures is the joint outcome of at least four things: a model, a task type, a subject domain, and a measurement method. Change any one and the number changes, frequently by an order of magnitude. The evidence for that claim occupies the middle of this article, and it is unusually clean evidence because several research groups have measured the spread deliberately.
The practical consequence for a Canadian finance function is that a vendor-supplied figure cannot be transferred to your environment. It was produced on some task, in some domain, under some scoring method, none of which is likely to match invoice coding, disclosure drafting, contract review or variance commentary. The number is not wrong; it is about something else.
This matters more than the usual caveat about vendor claims, because the figure typically drives a control decision. A team that believes error occurs in two percent of outputs will design sampling, review intensity and escalation thresholds around that belief. If the true rate on their task is materially different, every downstream control is miscalibrated, and it is miscalibrated in a way no amount of diligence in executing the control will correct.
Two Kinds Of Hallucination
The distinction that has to precede any measurement, because the two failure modes have different causes and different remedies.
Hallucination in language models is broadly classified into two types: faithfulness hallucination, which occurs when a model generates outputs that are not grounded in the provided context, and factuality hallucination, which refers to errors where the generated content contradicts real-world knowledge stored in the model's parametric memory[1].
A more concrete framing distinguishes intrinsic hallucination, a faithfulness failure in which the model contradicts information it was explicitly given, illustrated by handing over a contract and asking for a summary and receiving clauses that do not exist in the original document; and extrinsic hallucination, a factuality failure in which the model generates information that cannot be verified against any known source, inventing facts, statistics, citations or events from scratch, with no source material contradicted because no source material was consulted[2].
The contract example is the one that should concern a finance function most, because it describes a failure that is invisible to the reader who did not already know the source. A summary containing a clause that does not exist looks exactly like a summary containing a clause that does.
The two types map onto different finance workflows. Summarising a lease, extracting terms from an agreement, reconciling to a provided ledger and drafting from supplied working papers are all grounded tasks where faithfulness is the property at risk. Answering a question about tax treatment, recalling a rate, or citing a standard are ungrounded tasks where factuality is at risk.
A measurement of one tells you very little about the other, which is the first reason a single quoted rate is uninformative.
Three Properties, Not One
Practitioner guidance adds a third dimension worth adopting, because it is measurable without a reference answer.
Faithfulness checks the condensed or transformed output against the full source text. Factuality checks whether a claim is correct against general world knowledge or a verified answer, fitting open-domain question answering where no retrieved passage or source document defines the answer, and catching invented statistics or claims that may appear supported by weak context but fail against external truth. Consistency looks at whether repeated generations for the same prompt agree with each other, fitting free-form generation where there may be no reference answer, with wide disagreement across samples signalling that the model is guessing or producing unstable answers[3].
Consistency is the property most useful to an organisation without an evaluation infrastructure, and it is the one almost nobody measures. It requires no ground truth and no reference answer. It requires running the same input several times and observing whether the outputs agree in meaning.
For a finance function that is a genuinely accessible test. Take fifty representative inputs from a live workflow, run each five times, and examine how often the substance changes. Where it changes materially, the model is unstable on that input class, and instability is actionable regardless of whether you can establish which answer was correct.
We would add, as our own observation, that instability has a control implication independent of accuracy. A workflow whose outputs vary between runs cannot be reviewed by sampling, because the sample is not representative of what the unsampled items would have produced on a different run.
Three To Eighty-Six Percent
The single most important number in this article, and the one that disposes of the idea of a general rate.
HALoGEN classified hallucinations by their origin in training data and showed that rates range from 3% to 86% across domains[4]. FActScore decomposed generations into atomic facts and found that factual error rates vary dramatically by domain[4].
A spread from 3% to 86% within a single study means the domain is doing more explanatory work than the model. Two organisations using the same system, on different subject matter, can experience error rates differing by a factor of nearly thirty.
The legal domain supplies a worked illustration of the high end. A 2024 study evaluating public-facing models on questions about federal court cases reported hallucination rates between 58% for one leading commercial model and 88% for an open model[5]. The same commentary notes that hallucinations in court filings by prominent law firms as recently as April 2026 indicate the problem is far from solved even when sophisticated parties are using AI[5].
Why domain matters so much is worth understanding rather than merely noting. Where a domain is densely represented in training data, consistently stated, and stable over time, the model has strong support for its outputs. Where a domain is sparse, contested, jurisdiction-specific or fast-moving, support thins and generation continues regardless.
Canadian tax, accounting and regulatory content sits toward the unfavourable end of every one of those axes. It is a smaller literature than its American equivalent, it is jurisdiction-specific in ways that invite contamination from US sources, and it changes annually. We offer that as reasoned inference rather than a measured finding, and the appropriate response is to measure rather than to assume in either direction.
Fourteen To Ninety-Five Percent
The second spread, this time across models on a single well-defined task.
A large-scale analysis of citation validity found that models exhibit significant variance, with hallucination rates spanning from 14.23% to 94.93% across thirteen models, a roughly 6.7 times difference, revealing that citation generation capability is far from uniformly developed across vendors and that users cannot assume all state-of-the-art models are equally reliable for bibliographic tasks[6].
A rate of 94.93% on citation generation means that model invented, in some form, roughly nineteen out of every twenty citations. That is not a system with a quality issue; it is a system that cannot perform the task at all, while appearing to perform it fluently.
The finance relevance is immediate and under-appreciated. Referencing a section of the Income Tax Act, an accounting standard, a CRA folio or a case is structurally identical to citation generation. It is a retrieval task from parametric memory, presented in a rigid format that looks authoritative regardless of whether the referent exists.
The professional exposure follows. A memorandum citing a provision that does not say what the memorandum claims, or does not exist, is a defect that survives review by anyone who does not independently check the citation, and checking citations is precisely the work the tool was adopted to avoid.
Fifty Points Inside One Model
The third spread, and the one that defeats even a task-specific single number.
Google DeepMind's FACTS benchmark suite, published in December 2025, breaks factuality into four distinct dimensions and reports the overall as an average across them. This multi-dimensional view exposes that models have dramatically different strengths depending on task type: Grok 4 scores 75.3 on Search but just 25.7 on Multimodal, a fifty-point gap within the same model. Reported figures are the December 2025 launch snapshot, with the overall being a four-slice average, so that one model's 68.8 and another's 61.8 are each means of four slice scores. The dimensions include Grounding, being whether the model can faithfully use information from provided documents, tested through summarization and extraction tasks with source material, and Multimodal, being whether it can accurately describe and reason about visual content alongside text[2].
Two consequences follow.
An overall score that averages four dimensions can conceal a fifty-point range. A model reported as competent on factuality may be near-unusable on the specific dimension your workflow depends on, and the headline figure will not reveal it.
And the Multimodal dimension is the one Canadian finance functions increasingly rely on, because document processing means reading scanned invoices, statements, contracts and forms. If multimodal performance is the weakest slice for a given model, then the workflows most commonly automated in finance are running on the model's worst capability while being justified by its average.
We would resist over-reading a single model's scores, which reflect one snapshot on one suite. The transferable point is structural: dimensional decomposition changes the picture, and any evaluation that reports a single aggregate is hiding variance that matters.
The Worst Case Improved, The Best Case Did Not
A finding about progress that cuts against the prevailing assumption, and it is worth stating precisely.
A 2026 study of frontier models found that across the full corpus, five 2026 frontier models exhibited hallucination rates between 4.62% and 6.10%, described as an order-of-magnitude compression of the 5.2% to 21.7% spread reported in earlier work, driven primarily by an open-weight frontier model being roughly capability-equivalent to commercial frontier models and having therefore lost the disadvantage that 2024-vintage open-source models exhibited. Of ten pairwise comparisons, five were significant after Holm-Bonferroni correction, and four of the five models formed a statistically indistinguishable cluster between 5.4% and 6.1%. Critically, the authors note that no 2026 frontier model has surpassed the best 2024 commercial result of 3.6%, even as the worst-case rate has fallen sharply[7].
That last sentence deserves its own reading. On this measurement, on this task, the frontier has not advanced in two years. What changed is that the laggards caught up, compressing the range.
Two implications for a buyer. Model choice matters less than it did on this axis, since four of five models were statistically indistinguishable, which weakens the case for switching providers to reduce hallucination and strengthens the case for investing in workflow design instead.
And a procurement strategy premised on the problem being solved by the next model generation has, on this evidence, been waiting two years for an improvement that did not arrive. We note this is one task on one corpus and should not be generalised to capability overall, but it is a caution against deferring control design in anticipation of the technology improving.
Prompting Does Not Fix It
The finding that removes the most commonly offered remedy.
The citation study examined factors that might influence hallucination rates, including online search, chain-of-thought prompting and batch size, and found that these factors did not show a consistent effect on hallucination rates across models, suggesting that hallucination is a fundamental limitation of the models' bibliographic knowledge rather than an artifact of specific prompting strategies or output quantity[6].
The standard organisational response to discovering hallucination is to improve the prompt. Add an instruction not to invent citations, require the model to state uncertainty, ask it to think step by step. This finding indicates that on at least one well-defined task, those interventions did not consistently help.
The framing matters: a fundamental limitation of the models' knowledge rather than an artifact of prompting. If the underlying knowledge is absent, no instruction elicits it. Asking a model to only cite real sources does not create access to the source list; it changes the surface form of the output while the generation process is unchanged.
We should be careful about scope. This is one study, on bibliographic tasks, and it does not establish that prompting never helps for any hallucination type. It does establish that prompt engineering cannot be assumed to be an adequate control, which is how it is frequently deployed in finance functions that have no other mitigation.
Mitigations Trade Off Against Each Other
A structural point that makes single-number reporting actively misleading.
A compiled summary of mitigation techniques records for one approach a measured impact of a 55% to 75% reduction on open-ended medical and factual tasks, while noting that it increases hallucination on grounded summarization[2].
A mitigation that substantially reduces factuality hallucination while increasing faithfulness hallucination is not straightforwardly an improvement. It is a reallocation of error between the two types described earlier.
Which direction is favourable depends entirely on the workflow. A team using AI to answer open questions benefits. A team using AI to summarise documents it supplies is made worse off, and would experience the change as a degradation while the vendor reports an improvement, both accurately.
This is the strongest argument in the article for measuring on your own task. Not because vendors are dishonest, but because an aggregate improvement can decompose into a gain on tasks you do not perform and a loss on tasks you do.
The Calibration Inversion
The finding with the most direct consequence for control design, and it is genuinely striking.
Research published in Memory & Cognition in July 2025 found that both humans and language models began overconfident about how they would perform on a twenty-item identification task. After answering, humans revised their self-assessments downward while the models revised theirs upward. One model predicted it would score 10.03 out of 20, actually scored 0.93, and then estimated in retrospect that it had scored 14.40[2].
Take the numbers slowly. Predicted just over ten. Achieved less than one. Retrospectively believed it had achieved more than fourteen. Confidence moved in the opposite direction to performance, after the performance had occurred.
The human comparison is what makes this consequential. Humans also began overconfident, which is a well-established finding, but the act of attempting the task supplied information that adjusted their estimate downward. That corrective feedback loop is the basis on which organisations rely on people to flag their own uncertainty.
Every control that depends on a model reporting low confidence, or expressing uncertainty, or declining to answer, is depending on a signal this study found to be inversely related to accuracy after the fact. That includes confidence thresholds for routing to human review, which is a common design in finance automation: process automatically above a confidence level, escalate below it.
Our conclusion, stated as analysis, is that self-reported confidence should not be load-bearing in a control design without independent validation on your own data. If a system escalates on low confidence, the question to answer empirically is whether its confidence scores actually correlate with correctness in your workflow, and this finding is a reason to expect the answer may be no.
The Benchmark May Not Measure What It Says
A methodological critique of the most-cited benchmark in the field, which should temper reliance on published scores generally.
Researchers examining frequently cited benchmarks contend that TruthfulQA is primarily a factuality benchmark and is not easily adaptable to serve as a hallucination benchmark, for several reasons: the factual errors it identifies often arise from the model learning human falsehoods present in the training data, and although undesirable, these errors reflect noisy training data and cause factuality challenges rather than constituting hallucinations; additionally it includes many time-sensitive prompts, making it more suitable for evaluating factuality that changes over time rather than hallucination[8].
TruthfulQA is widely used. It was designed to measure whether models are truthful in generating answers to questions where humans often hold common misconceptions, testing whether models avoid repeating false beliefs prevalent in their training data and distinguishing truthfulness from mere imitation[9], and one summary reports that even the best models achieve only 58% truthfulness against 94% human performance[4].
The critique is not that the benchmark is bad but that it is frequently cited for a property it does not isolate. A model reproducing a widespread human misconception is failing differently from a model inventing a citation, and averaging them into one figure obscures both.
The general lesson for a buyer evaluating published scores is to establish what the benchmark's task actually is before treating a score as evidence about your use case. HaluEval, for example, is a large-scale benchmark of 35,000 samples focusing on a model's ability to recognise hallucinations, across question answering, knowledge-grounded dialogue, summarization and general user queries[9], and one summary reports it found a leading model producing hallucinated content in 19.5% of responses[4]. Recognising hallucination and avoiding it are different capabilities.
The Instrument Is Itself A Model
The measurement problem that sits underneath all the numbers above.
Practitioner guidance describes the dominant evaluation method and its weakness directly: an approach that prompts a strong model to grade the output against a rubric or reference, noting that the judge is still a language model, so it can return the wrong verdict, and that judge scores should be calibrated against human labels before being used as release signals[3].
This is a circularity worth naming. Measuring how often a language model produces unsupported claims, by asking a language model whether claims are supported, imports the second model's error into the measurement. It does not invalidate the method, which is used because human labelling does not scale, but it means the reported rate carries the judge's error as well as the system's.
The instruction that follows is the one in the source: calibrate against human labels before using judge scores as release signals. For a finance function that means a human-labelled sample, drawn from the actual workflow, against which the automated scorer's agreement is measured before any automated score is trusted.
This is also where evaluation cost concentrates. The human-labelled calibration set is the expensive component and the one organisations skip, which produces an evaluation pipeline that generates numbers of unknown validity, at scale, cheaply. That is worse than no evaluation, because it supports confident decisions.
Detectors And Consistency Sampling
The alternatives, and what each constrains.
Fine-tuned models are smaller models trained to spot hallucinations for specific tasks, with one open-source example built on a general-purpose model that checks whether a retrieval-augmented answer stays faithful to its source document, and a proprietary encoder that flags unsupported spans inside an answer and runs fast enough for real-time use. Both can be faster and cheaper at runtime than a large judge, but each model is constrained by its training scope, and proprietary scoring keeps you tied to one vendor's model[3].
Consistency sampling and semantic entropy involve running the model several times and measuring how much the answers vary in meaning[3].
Two observations for a finance function choosing among these.
The constraint on fine-tuned detectors, being training scope, is the same constraint that produced the 3% to 86% domain spread. A detector trained on general text is being asked to judge Canadian tax reasoning it may have limited exposure to, and its own reliability on that material is unmeasured unless you measure it.
Consistency sampling is the only method in this list that requires no external ground truth, no judge model and no labelled data. Its cost is compute, since it means running each input multiple times. For a small finance function without evaluation infrastructure, it is the accessible starting point, and it detects instability even where it cannot detect confident error.
What A Finance Function Should Actually Measure
Translating the above into a practical evaluation, offered as our own analysis.
Measure on your own inputs. Sampled from the live workflow, in your jurisdiction, on your document types. Given a domain spread of 3% to 86%[4], external figures cannot substitute.
Measure the property the workflow depends on. Faithfulness for grounded tasks, factuality for open questions, consistency where neither reference nor ground truth exists[3].
Decompose rather than average. A fifty-point within-model gap across dimensions[2] means an aggregate can conceal the failure that matters.
Report an interval, not a point. The frontier study reported Wilson confidence intervals and applied multiple-comparison correction[7]. An evaluation on fifty items supports a much wider interval than teams assume.
Validate any confidence signal before relying on it. Given the calibration inversion[2], a confidence-based routing rule needs evidence that confidence predicts correctness in your data.
Calibrate the scorer before trusting the score. Human-labelled sample first, agreement measured, then automated scoring[3].
Re-measure after any change. Model version, prompt, retrieval configuration or document mix. A mitigation can reduce one hallucination type while increasing another[2].
A Worked Case: Two Workflows, Opposite Requirements
A Canadian advisory firm deploying one AI system across two workflows. The reconstruction illustrates the decomposition rather than reporting a specific engagement.
Workflow A summarises client-supplied agreements and extracts key terms. Every answer should be derivable from a document in hand. The property at risk is faithfulness, and the specific failure is the one described in the literature as handing over a contract and receiving a summary containing clauses that do not exist[2]. The relevant benchmark dimension is Grounding, concerning faithful use of information from provided documents[2], and the appropriate measurement is faithfulness against source[3].
Workflow B drafts research memoranda that reference legislation and standards. No source document is supplied. The property at risk is factuality, and the specific failure resembles citation generation, where measured rates ranged from 14.23% to 94.93% across models[6].
One system, one vendor figure, two workflows whose failure modes are different, whose measurement methods are different, and on which the same model may perform very differently. A mitigation improving one may worsen the other[2].
The firm cannot make a single risk assessment covering both, and a control framework that treats "the AI tool" as one item with one error rate has already lost the distinction that determines whether either workflow is safe.
What To Do
Stop transferring vendor rates into your risk assessment. Ask what task, what domain, what method, and whether any of the three matches your use.
Classify each workflow as grounded or ungrounded. That determines whether faithfulness or factuality is the property to measure, and they do not predict each other.
Run consistency sampling first. Fifty representative inputs, five runs each, examine substantive variation. No ground truth required, and instability is actionable on its own.
Treat citation and reference generation as a distinct high-risk task. Measured rates reached 94.93% on one model, and prompting showed no consistent effect.
Independently verify every statutory or standard reference. Regardless of the model, until you have measured otherwise on your own material.
Do not build controls on self-reported confidence without validating it. The calibration research found confidence moving opposite to performance after the fact.
Build a human-labelled calibration set before automating evaluation. An uncalibrated automated scorer produces confident numbers of unknown validity.
Do not defer control design in anticipation of better models. On the frontier study's task, the best 2024 result had not been surpassed two years later.
The Limits Of This Analysis
Several caveats matter and they are substantial. A majority of the sources here are arXiv preprints that had not, at the versions accessed, completed peer review, and we have accessed them as text rather than evaluated their methodology; readers relying on any specific figure should read the underlying paper. Several figures reach us through a compiled secondary summary rather than the original studies, including the FACTS scores, the mitigation trade-off figures and the Memory & Cognition calibration finding, and we have not verified them against the primary sources. Model names, version numbers and dated results are reported as the sources state them and we have not independently confirmed them. Benchmark results are snapshots that age quickly, and the field's own literature, as the benchmark validity section shows, disputes what several widely cited benchmarks measure. Two cited sources are commercial vendors of evaluation tooling with an interest in the subject, which we have flagged. The application to Canadian tax and accounting content, the consistency-sampling recommendation, the multimodal observation, the argument about uncalibrated evaluation pipelines and the two-workflow decomposition are our own analysis rather than findings in the cited work. This article does not address retrieval-augmented generation architecture, evaluation harness construction, model selection methodology, or the professional standards governing reliance on AI-generated analysis, several of which this publication addresses separately. Nothing here is a substitute for evaluation conducted on your own workflow.
Frequently Asked Questions
Why can't I use the vendor's hallucination rate?
What are the two types of hallucination?
Can better prompting solve it?
Can I rely on the model telling me it is unsure?
Are newer models fixing this?
What is the cheapest useful thing I can measure?
References
- Smoothing Out Hallucinations: Mitigating LLM Hallucination with Smoothed Knowledge Distillation. arXiv preprint 2502.11306, on the classification of hallucination into faithfulness and factuality types following Huang et al. (2023), and on evaluation harness and benchmark selection. Note: preprint, not peer reviewed at the version accessed. arxiv.org/pdf/2502.11306
- Suprmind. (2026, August). Latest AI Hallucination Rates and Benchmarks, on intrinsic and extrinsic hallucination with the contract example, Google DeepMind's FACTS suite of December 2025 including the Grok 4 Search and Multimodal scores and four-slice averaging, the mitigation trade-off figures, and the Cash and Oppenheimer calibration study in Memory & Cognition (July 2025). Note: a compiled secondary summary; primary sources not independently verified. suprmind.ai/hub/ai-hallucination-rates-and-benchmarks
- Braintrust. (2026, June 9). What Are AI Hallucination Evaluations? Metrics and Methods That Work in 2026, on the faithfulness, factuality and consistency properties, LLM-as-a-judge and the need to calibrate against human labels, fine-tuned detectors and their training-scope constraint, and consistency sampling and semantic entropy. Note: published by a vendor of evaluation tooling. braintrust.dev/articles/ai-hallucination-evaluations-metrics-methods-2026
- PhysDox: Benchmarking LLMs on Physical Feasibility Auditing of Physiological Sensing Protocols. arXiv preprint 2606.05003, summarising TruthfulQA (Lin et al., 2022) at 58% truthfulness versus 94% human, HaluEval (Li et al., 2023) at 19.5% hallucinated responses, FActScore (Min et al., 2023) on domain variation, and HALoGEN (Ravichander et al., 2025) on rates ranging from 3% to 86% across domains. Note: preprint; figures reported at second hand from the studies named. arxiv.org/pdf/2606.05003
- Legal Reasoning Is Not Lawyering: Rethinking Legal Benchmarks for Pro Se Access to Justice. arXiv preprint 2606.23716, on Dahl et al. (2024) reporting hallucination rates between 58% and 88% on federal court case questions, and on continued hallucinations in court filings as recently as April 2026. Note: preprint. arxiv.org/pdf/2606.23716
- GhostCite: A Large-Scale Analysis of Citation Validity in the Age of Large Language Models. arXiv preprint 2602.06718, on citation hallucination rates spanning 14.23% to 94.93% across thirteen models, and on online search, chain-of-thought prompting and batch size showing no consistent effect. Note: preprint. arxiv.org/pdf/2602.06718
- The Range Shrinks, the Threat Remains: Re-evaluating LLM Package Hallucinations on the 2026 Frontier-Model Cohort. arXiv preprint 2605.17062, on rates between 4.62% and 6.10%, the compression from an earlier 5.2% to 21.7% spread, Wilson confidence intervals and Holm-Bonferroni correction, the statistically indistinguishable cluster, and no 2026 frontier model surpassing the best 2024 result of 3.6%. Note: preprint. arxiv.org/pdf/2605.17062
- HalluLens: LLM Hallucination Benchmark. arXiv preprint 2504.17550, on the argument that TruthfulQA is primarily a factuality benchmark not easily adaptable as a hallucination benchmark, because its errors reflect learned human falsehoods and noisy training data and because it includes many time-sensitive prompts. Note: preprint. arxiv.org/pdf/2504.17550
- Robustness in Large Language Models: A Survey of Mitigation Strategies and Evaluation Metrics. arXiv preprint 2505.18658, on TruthfulQA's design purpose and TruthfulQA-Enhanced, and on HaluEval as a 35,000-sample benchmark focused on recognising hallucinations across question answering, knowledge-grounded dialogue, summarization and general queries. Note: preprint. arxiv.org/pdf/2505.18658
This article discusses model evaluation research and is provided for general informational purposes. Most cited sources are preprints that had not completed peer review at the versions accessed, and several figures reach us through secondary compilation rather than primary sources. Benchmark results age rapidly and model version numbers are reported as stated by the sources. Nothing here substitutes for evaluation conducted on your own workflow and data.