LatentAudit: Real-Time White-Box Faithfulness Monitoring for Retrieval-Augmented Generation with Verifiable Deployment
Organizations: Binjiang Institute of Zhejiang University · Communication University of Zhejiang · Zhejiang University
Abstract
Retrieval-augmented generation (RAG) mitigates hallucination but does not eliminate it: a deployed system must still decide, at inference time, whether its answer is actually supported by the retrieved evidence. We introduce LatentAudit, a white-box auditor that pools mid-to-late residual-stream activations from an open-weight generator and measures their Mahalanobis distance to the evidence representation. The resulting quadratic rule requires no auxiliary judge model, runs at generation time, and is simple enough to calibrate on a small held-out set. We show that residual-stream geometry carries a usable faithfulness signal, that this signal survives architecture changes and realistic retrieval failures, and that the same rule remains amenable to public verification. On PubMedQA with Llama-3-8B, LatentAudit reaches 0.942 AUROC with 0.77,ms overhead. Across three QA benchmarks and five model families (Llama-2/3, Qwen-2.5/3, Mistral), the monitor remains stable; under a four-way stress test with contradictions, retrieval misses, and partial-support noise, it reaches 0.9566--0.9815 AUROC on PubMedQA and 0.9142--0.9315 on HotpotQA. At 16-bit fixed-point precision, the audit rule preserves 99.8% of the FP16 AUROC, enabling Groth16-based public verification without revealing model weights or activations. Together, these results position residual-stream geometry as a practical basis for real-time RAG faithfulness monitoring and optional verifiable deployment.
Figures & tables
| Llama-3-8B | Qwen-2.5-7B | Mistral-7B | |||||
|---|---|---|---|---|---|---|---|
| Method | Latency (ms) | AUROC | F1 | AUROC | F1 | AUROC | F1 |
| GPT-4o Judge | 5,300 | 0.948 | 0.881 | 0.945 | 0.876 | 0.940 | 0.870 |
| SelfCheckGPT | 28,500 | 0.871 | 0.804 | 0.865 | 0.798 | 0.858 | 0.790 |
| INSIDE | 3.8 | 0.908 | 0.841 | 0.901 | 0.832 | 0.895 | 0.825 |
| SAPLMA | 1.5 | 0.882 | 0.815 | 0.876 | 0.808 | 0.870 | 0.800 |
| Min-Perplexity | 0.0 | 0.722 | 0.655 | 0.718 | 0.650 | 0.710 | 0.642 |
| Dataset Domain | Llama-2 (7B) | Llama-3 (8B) | Qwen-2.5 (7B) | Qwen-3 (8B) | Mistral (7B) |
|---|---|---|---|---|---|
| PubMedQA (Medical) | 0.931 0.02 | 0.942 0.01 | 0.938 0.02 | 0.948 0.01 | 0.925 0.01 |
| TriviaQA (Open-domain) | 0.915 0.02 | 0.935 0.01 | 0.928 0.02 | 0.940 0.01 | 0.918 0.02 |
| HotpotQA (Multi-hop) | 0.905 0.02 | 0.928 0.01 | 0.918 0.02 | 0.922 0.02 | 0.910 0.02 |
| Domain | Model | AUROC | AUPRC | F1 | F/C | F/RM | F/P |
|---|---|---|---|---|---|---|---|
| Llama-2 | 0.9776 | 0.9387 | 0.8322 | 0.9971 | 0.9667 | 0.9727 | |
| Llama-3 | 0.9815 | 0.9450 | 0.8510 | 0.9982 | 0.9710 | 0.9755 | |
| Qwen-2.5 | 0.9566 | 0.8806 | 0.8025 | 0.9938 | 0.9542 | 0.9218 | |
| PubMedQA | Qwen-3 | 0.9682 | 0.9102 | 0.8244 | 0.9950 | 0.9622 | 0.9445 |
| Llama-2 | 0.9142 | 0.7760 | 0.7312 | 0.9880 | 0.9688 | 0.8205 | |
| Llama-3 | 0.9315 | 0.8214 | 0.7855 | 0.9925 | 0.9760 | 0.8550 |
| Calibration Domain | Evaluation Domain | In-Domain AUROC | OOD AUROC |
|---|---|---|---|
| PubMedQA (Medical) | HotpotQA (Multi-hop) | 0.942 | 0.916 |
| HotpotQA (Multi-hop) | PubMedQA (Medical) | 0.928 | 0.902 |
| Precision ( constraints) | AUROC Match | ZK Time | Gas Overhead |
|---|---|---|---|
| (Aggressive) | 82.4% (-11.8%) | 4.2 ms | 420K Gas |
| (Optimal Bounds) | 99.8% (-0.2%) | 11.9 ms | 580K Gas |
| (Lossless Overkill) | 100.0% (-0.0%) | 48.7 ms | 1.2M Gas (Exceeds L1) |
Appendix figures & tables8 assets
Supplementary material from the paper’s appendix.
Appendix
| Component | Parameter | Value |
|---|---|---|
| Activation extraction | Target layer | 16 (Llama), 14 (Qwen), 15 (Mistral) |
| Pooling | Mean over salient answer tokens | |
| Salient token count | 8 | |
| Alignment scoring | Distance metric | Mahalanobis ( ) |
| Covariance estimator | Ledoit–Wolf shrinkage | |
| Threshold | ROC-optimal on calibration set |
| Method | Llama-2 | Llama-3 | Qwen-2.5 | Qwen-3 | Mistral |
|---|---|---|---|---|---|
| GPT-4o Judge | .948/.87 | .948/.87 | .948/.87 | .948/.87 | .948/.87 |
| SelfCheckGPT | .862/.80 | .871/.81 | .855/.79 | .869/.80 | .858/.79 |
| INSIDE | .903/.83 | .908/.84 | .899/.82 | .905/.83 | .895/.82 |
| SAPLMA | .878/.81 | .882/.82 | .872/.80 | .880/.81 | .870/.80 |
| Min-Perplexity | .718/.69 | .722/.70 | .715/.68 | .720/.69 | .712/.68 |
| LatentAudit | .931/.86 | .942/.87 | .938/.86 | .948/.88 | .925/.85 |
| Pooling Strategy | (Last) | ||||
|---|---|---|---|---|---|
| Mean-Pool | 0.884 | 0.933 | 0.942 | 0.940 | 0.931 |
| Max-Pool | 0.884 | 0.901 | 0.912 | 0.908 | 0.895 |
| Condition | Evidence Snippet | Generated Answer | Result | |
|---|---|---|---|---|
| Faithful | ”…therapy significantly reduced mortality (p¡0.01).” | Yes, the therapy reduces mortality. | 3.2 | Pass |
| Contradicted | ”…therapy had no effect on mortality.” | Yes, the therapy reduces mortality. | 7.8 | Reject |
| Retrieval-Miss | ”…patients were treated with placebo.” | Yes, the therapy reduces mortality. | 8.5 | Reject |
| Partial Support | ”…therapy was evaluated in 100 patients.” | Yes, the therapy reduces mortality. | 5.9 | Reject (FP) |
| Alignment Strategy | Train AUROC (N=200) | Eval AUROC (N=1800) |
|---|---|---|
| Zero-shot (No projection) | 0.654 | 0.648 |
| PCA Alignment (Unsupervised) | 0.785 | 0.778 |
| CCA Alignment | 0.892 | 0.885 |
| Ridge Regression (Ours) | 0.948 | 0.942 |
| MLP (2-layer non-linear) | 0.991 | 0.945 |
| Calibration Samples ( ) | Train AUROC | Eval AUROC |
|---|---|---|
| (2.5%) | 0.965 | 0.912 |
| (5.0%) | 0.952 | 0.931 |
| (10.0%, Default) | 0.948 | 0.942 |
| (25.0%) | 0.945 | 0.943 |
| (50.0%) | 0.944 | 0.943 |
LLM Auditing
Large language model auditing tests models and deployed systems for bias, safety, privacy, reliability, and provenance using behavioral and internal evidence.
See all 617 papers