Squish and Release: Exposing Hidden Hallucinations by Making Them Surface as Safety Signals

Nathaniel Oh; Paul Attie

cs.LGMar 27, 2026

Squish and Release: Exposing Hidden Hallucinations by Making Them Surface as Safety Signals

Authors: Nathaniel Oh, Paul Attie

Organizations: School of Computer and Cyber Sciences Augusta University Augusta, Georgia 30912

Abstract

Language models detect false premises when asked directly but absorb them under conversational pressure, producing authoritative professional output built on errors they already identified. This failure - order-gap hallucination - is invisible to output inspection because the error migrates into the activation space of the safety circuit, suppressed but not erased. We introduce Squish and Release (S&R), an activation-patching architecture with two components: a fixed detector body (layers 24-31, the localized safety evaluation circuit) and a swappable detector core (an activation vector controlling perception direction). A safety core shifts the model from compliance toward detection; an absorb core reverses it. We evaluate on OLMo-2 7B using the Order-Gap Benchmark - 500 chains across 500 domains, all manually graded. Key findings: cascade collapse is near-total (99.8% compliance at O5); the detector body is binary and localized (layers 24-31 shift 93.6%, layers 0-23 contribute zero, p<10^-189); a synthetically engineered core releases 76.6% of collapsed chains; detection is the more stable attractor (83% restore vs 58% suppress); and epistemic specificity is confirmed (false-premise core releases 45.4%, true-premise core releases 0.0%). The contribution is the framework - body/core architecture, benchmark, and core engineering methodology - which is model-agnostic by design.

Figures & tables

ID	Domain	O2	O5	+CRC	Release
25	Immunology	P	A	A	A
65	Control Systems	P	A	A	P
74	Maritime Law	A	A	P	P
183	Epidemiology	D	A	A	D
190	Phycology	D	A	A	P
193	Consumer Prot.	D	A	A	P

Table 1: S&R on 12 confirmed-DETECT chains. The squish (O5 baseline) collapses all to compliance. +CRC denotes O5 with a Chain-of-Reasoning-Check system prompt appended (structured self-critique; a non-activation baseline for comparison only). The release (O5 Gadget) restores detection in 10/12 (83%) , revealing the hallucination was latent, not absent.

Window	Layers	Released	Rate
Baseline	-	0/500	0.0%
Early	0–7	0/500	0.0%
Lower	8–15	0/500	0.0%
Upper	16–23	0/500	0.0%
Top	24–31	468/500	93.6%

Table 2: Layer ablation: 500 chains, all manually graded. Layers 0–23 each produce exactly 0 releases. Layers 24–31 release 93.6% of collapsed chains. The release mechanism is localized to the top quartile; layers 0–23 contribute zero releases across all 500 chains.

Panel of Figure 1 — Figure 1: S&R is bidirectional. The squish ( $\hat{\phi}_{D}$ injection) suppresses the circuit (58%). The release ( $\hat{\phi}_{E}$ injection) restores it (83%). The asymmetry establishes the safety circuit as the more stable attractor: harder to silence than to restore.

Panel of Figure 2 — Figure 2: S&R release across 500 domains. The squish (O5 baseline) suppresses detection to 7.4% (37/500). The release shifts 310/500 chains (62%) away from ABSORB: 218 reach full DETECT and 92 reach PARTIAL, with 135 full COMPLY $\to$ DETECT restorations. The hallucinations were latent-the circuit could detect them but had been suppressed by accumulated pressure.

Pair	Domains	Released	Rate
183 + 377	Epidemiology + Antitrust	47/50	94%
437 + 478	Radiation Safety + Cryosphere	44/50	88%
198 + 377	Aquaculture + Antitrust	45/50	90%
40 + 495	Neurology + Neuropsychiatry	1/50	2%
22 + 175	Education + Addiction Med.	1/50	2%

Table 3: Combinatorial sweep (50 pairs, 50-chain eval, manual grading). Bimodal: 3 pairs release 80%+; 17 pairs release less than 10%.

ID	Violated principle	Rate
1001	Helsinki placebo requirement	0%
1002	Habeas corpus	92%
1003	Auditor independence	0%
2001	Nuremberg Code + bodily autonomy	94%
2002	Bodily integrity + homicide	94%
2003	Geneva + Rome Statute (war crimes)	94%

Table 4: Synthetic gadgets. Procedural violation alone (1001, 1003) fails at 0%. Adding personal rights deprivation (1002, 2001–2004) reaches the empirical ceiling at 92–94%.

Exp	Gadget	Population	$n$	Released
A	Cluster $\hat{\phi}_{E}^{(c)}$	Global-only	118	111 (94.1%)
B	Global $\hat{\phi}_{E}$	Cluster-only	65	0 (0.0%)
C	Global $\hat{\phi}_{E}$	Reversed	76	76 (100.0%)
D	Global $\hat{\phi}_{E}$	Resistant	71	0 (0.0%)
D	Cluster $\hat{\phi}_{E}^{(c)}$	Resistant	71	6 (8.5%)

Table 5: Cross-gadget specificity. The cluster gadget subsumes the global population (94.1%). The global gadget has zero effect on cluster or resistant chains.

\phi_{E}

is a family of directions, not a single vector.

Hallucination in Language Models

Hallucination in language models studies how systems produce unsupported or false claims and how to detect, explain, and reduce them.

See all 254 papers

Hallucination as output-boundary misclassification: a composite abstention architecture for language models
Mar 12, 2026Angelina HintsanenLLM Hallucination Mitigation Hallucination in Language Models
NEXUS Laboratory, Helsinki, Finland
PARALLAX: Separating Genuine Hallucination Detection from Benchmark Construction Artifacts
May 16, 2026Khizar Hussain, Murat KantarciogluLLM Evaluation Language Model Error Detection
Virginia Tech
Sanity Checks for Long-Form Hallucination Detection
May 8, 2026Geigh Zollicoffer, Minh Vu, Hongli Zhan +2LLM Evaluation Hallucination Detection
Los Alamos National Laboratory · The University of Texas at Austin · University of British Columbia

Mar 12, 2026J/K move · Enter open · S save

Hallucination as output-boundary misclassification: a composite abstention architecture for language models

Angelina Hintsanen

NEXUS Laboratory, Helsinki, Finland

LLM Hallucination Mitigation Hallucination in Language Models LLM Abstention Refusal Mechanisms in Language Models Refusal Behavior in Language Models Question Answering

Open paper AskPDF arXiv

Large language models often produce unsupported claims. We frame this as a misclassification error at the output boundary, where internally generated completions are emitted as if they were grounded in evidence. This motivates a composite intervention that combines instruction-based refusal with a structural abstention gate. The gate computes a support deficit score, St, from three black-box signals: self-consistency (At), paraphrase stability (Pt), and citation coverage (Ct), and blocks output when St exceeds a threshold. In a controlled evaluation across 50 items, five epistemic regimes, and three models, neither mechanism alone was sufficient. Instruction-only prompting reduced hallucination sharply, but still showed over-cautious abstention on answerable items and residual hallucination for GPT-3.5-turbo. The structural gate preserved answerable accuracy across models but missed confident confabulation on conflicting-evidence items. The composite architecture achieved high overall accuracy with low hallucination, while also inheriting some over-abstention from the instruction component. A supplementary 100-item no-context stress test derived from TruthfulQA showed that structural gating provides a capability-independent abstention floor. Overall, instruction-based refusal and structural gating show complementary failure modes, which suggests that effective hallucination control benefits from combining both mechanisms.

Abstract

Hallucination in Language Models

Explore similar work

Hallucination as output-boundary misclassification: a composite abstention architecture for language models

PARALLAX: Separating Genuine Hallucination Detection from Benchmark Construction Artifacts

Sanity Checks for Long-Form Hallucination Detection