Large language models can produce fluent answers that the supplied context does not support. A compact frozen proxy model can detect such answers by reading the context and another model's response, even from a proprietary generator. Attention-based detectors use summary statistics of the proxy's attention weights, but standard pipelines materialize the attention matrix, whose memory grows quadratically with sequence length. We compute these statistics without materializing attention, by accumulation in the FlashAttention pass, sparse lookups after it, or a second tiled pass over the scores, and classify them by this path into nearly free and costlier ones. On an H100, the statistics of five published detectors add 16% to the latency of a Qwen3-8B forward at 2K tokens, falling to 1.4% at 35K, and store 22.5 KiB per response token. On three benchmarks, probes trained on frozen Qwen3 proxies of 0.6B to 8B parameters prove strong detectors: a 4B proxy outperforms the strongest of nine zero-shot 4-9B LLM judges in F1 on two of the three, the proxies match or outperform specialized grounding checkers of up to 7B parameters, probing each proxy beats prompting it as a judge, and adding attention features significantly improves F1 in half of the 12 benchmark-proxy pairs, never significantly lowering it.
Figures & tables
Figure 1: Cost of extracting all implemented attention statistics for hallucination detection in every layer of Qwen3-8B and Qwen3-0.6B using our kernels. Top: model forward-pass latency. Bottom: relative overhead compared with the same forward using standard scaled dot-product attention (SDPA), without statistic extraction.
Figure 2: Attention with statistics. Blue : standard FlashAttention ( Dao et al., 2022 ; Dao, 2024 ) ; green : our additions. (a) We compute statistics for response rows only; prompt rows can go through any production kernel (§ 2.1 ). sIJ : scores of query tile I against key tile J . (b) One tile of the pass: the exponentials that FlashAttention already computes also feed the T1 statistics, which are finalized after the last tile; the pass also stores the log-sum-exp (LSE) that T2 and T3 reuse (§ 2.2 ). (c) The four tiers, i.e. computation paths of a statistic, ordered by the extra work they need: none (T1, fused), a few positions per row (T2, lookup), a second pass over all scores (T3, rescore), or the whole stored map (T4, dense) (§ 3 ).
Tier
Scores
Stat. ops
Memory
T1 (fused) entropy, prompt mass, effective support, max weight
none
O(NsNR)
NsR
T2 (lookup) logpii , pi,i−1 , BOS weight
bR
O(bR)
bR
T3 (rescore) column sums, sink rates, threshold counts
NR
O(NR)
O(R+L)
T4 (dense) MTopDiv, stored maps
NR
Ω(NR)
NR
Table 1: Work per head beyond the pass over the response block, by tier. Scores : extra attention scores evaluated, each costing d multiply-adds and one exponential. Stat. ops : statistic-specific elementwise operations, plus the statistic’s own algorithm for T4. Memory : numbers written per head besides the attention output and LSE.
Figure 3: What each benchmark configuration adds to one attention layer (Q2). Configuration ≤ Tk enables the paths up to T k ; ≤ T3 reads the BOS column sum from the column sums instead of the lookup. (a) Overhead of each configuration over our statistics-off Base layer at L=32K (whiskers: 16K–32K), and of Base relative to SDPA on the whole sequence (diamonds). (b) Latency from 1K to 100K tokens at d=128 , r=0.3 . (c) Overhead relative to SDPA cuDNN on the whole sequence, at r=0.3 (solid) and r=0.1 (dashed).
Figure 4: Added latency and peak memory over the forward without features, per sample, by prompt length (Q3). Lines: binned medians. The shortest prompts are RAGTruth QA, the others PHANTOM.
RAGTruth QA
HaluBench
TRIVIA+
Features
N
0.6B
1.7B
4B
8B
0.6B
1.7B
4B
8B
0.6B
1.7B
4B
8B
A 7
7
.573
.567
.503
.550
.615
.639
.631
.637
.531
.524
.545
.527
L 9
9
.440
.444
.467
.433
.633
.627
.642
.665
.545
.523
.518
.576
A 7 L 9
16
.566
.532
.541
.546
.642
.643
.656
.675
.555
.560
.543
.578
H 64
64
.557
.559
.566
.557
.697
.734
.742
.742
.627
.638
.634
.670
A 7 H 64
71
.637
.581
.547
.600
.698
.729
.744
.746
.613
.638
.639
.645
Table 2: Test F1 by feature set and Qwen3 proxy size. A 7 : cheap attention features; A 64 : all-head sink values; H 64 : compact hidden states; L 9 : logit features; combinations concatenate blocks (Section 5.2 ). N : number of classifier inputs. Bold : best in column; underlined : second best. Bottom: the best of nine LLM judges of 4–9B parameters, Qwen3.5-9B on every dataset (Table 13 ).
Appendix figures & tables15 assets
Supplementary material from the paper’s appendix.
Appendix
Statistic
Definition (per head)
Tier
Shape
Kernel computation
Derived feature and use
Log-sum-exp
LSEi=log∑j∈Jiesij
Base
Nh×R
mi+logℓi after the last key tile, as in FlashAttention
Table 3: Statistics computed by the response-stage kernels. Tier: computation path (Section 3.1 ); Base: written by the statistics-off forward. Shape: kernel output per layer for one sequence, with Nh query heads, R response rows, L keys, and S fixed sink keys. Ai is the T1 accumulator of Equation 3 for the given α and g after the last key tile, and ℓi the running sum of the online softmax. Derived features are defined in the text; “adapted”: restricted to response rows.
Statistic
dense
fused
ratio
Entropy H (T1)
1.6e−2
3.5e−6
4.5e3
Effective support Neff,2 (T1)
5.3e0
5.9e−3
9.0e2
Maximum weight (T1)
4.3e−3
1.5e−7
2.9e4
Prompt mass (T1)
2.2e−3
1.3e−7
1.7e4
LSE (Base)
1.1e−2
1.1e−6
1.0e4
logpii (T2)
2.0e−2
1.2e−6
1.7e4
Appendix
Table 4: Mean absolute error on response rows against an fp64 reference for materialized attention (the dense bf16 path) and our bf16 kernels, and their ratio. Each entry averages the per-head error over heads and layers and reports the worst input type (random or PHANTOM) and length (2K, 8K, 32K). Our statistics are about three to four orders of magnitude closer to fp64; they have the lower error for every statistic, input, and length, in both mean and maximum error.
d=64
d=128
d=256
Overhead (%)
r=.1
r=.3
r=.5
r=.1
r=.3
r=.5
r=.1
r=.3
r=.5
≤ T1 (in pass) vs. Base
9–12
22
27–28
3–7
12–15
9
1–4
6–9
2–6
≤ T2 (+ lookups) vs. Base
9–12
21–22
27–30
3–6
12–20
9–10
1–4
6–10
4–7
≤ T3 (+ col. sums) vs. Base
25–26
64
87
16–19
39–44
53–58
19–26
39–43
54–57
Base vs. full cuDNN
6–11
12–19
16–20
4–9
7–15
10–17
10–13
20–25
28–34
Base vs. full FA2
0–3
−4 – −1
−9 – −8
−2 – +1
−8 – −5
−13 – −12
−5 – −2
−16 – −11
−21 – −20
Appendix
Table 5: The numbers behind Figure 3 a (Q2): latency overhead (%) of one attention layer, as a range over L∈{16K,32K} . Upper rows: each configuration of Section 4 over the statistics-off split Base, with the prompt stage on SDPA cuDNN. Lower rows: Base over SDPA on the whole sequence, with the prompt stage on the same backend, and the cost of all row statistics ( ≤ T2 ) over full SDPA cuDNN, the fastest production kernel here. H100 NVL, bf16.
Figure 5: Figure 1 at every length, for Qwen3-8B (left) and Qwen3-0.6B (right, all 16 heads of all 28 layers), with the overhead on a log scale. Dotted line: the 2K cut of Figure 1 . Same inputs, backends, and binning; batch 1, H100 NVL, bf16.
Per forward
Floor
Ours
Latency (ms)
33
108
GPU busy (ms)
13
18
GPU kernels
2,005
5,173
Host–device syncs
1
361
Appendix
Table 6: Where the time of a short forward goes: Qwen3-8B on five TRIVIA+ inputs of 90–253 tokens, all 36 layers scored, FlashAttention-2, H100 NVL. GPU busy is the summed device time of all kernels (PyTorch profiler); syncs are counted with PyTorch’s synchronization debug mode.
Figure 6: Figure 1 for peak memory: the peak of each forward above the memory allocated before it, so the model weights are excluded, with all features (solid, points) and without (dashed). Same runs, inputs of at least 2K tokens, and binning; batch 1, H100 NVL, bf16.
Dataset
Train
Val
Test
Hal.
Grp.
RAGTruth QA
3921
971
875
160
150
HaluBench
4206
898
904
409
546
TRIVIA+
2263
316
645
224
358
Appendix
Table 7: Splits used in Section 5 . Hal.: hallucinated test answers; Grp.: test groups for the bootstrap.
RAGTruth
HaluBench
Baseline
QA
TRIVIA+
filtered
unfiltered
AUROC
Words
.702
.574
.580
.727
Characters
.720
.598
.568
.725
TF–IDF
.726
.658
.663
.842
F1
Appendix
Table 8: Text-only baselines on the test splits of Table 7 : answer length in words or characters, and TF–IDF of the answer alone. The last column uses a split of HaluBench built the same way without the length filtering (2,231 test answers, 1,075 hallucinated). The 95% group-bootstrap intervals of AUROC are at most ±0.05 .
Statistic
Definition (per answer token t )
Shape
Answer-token probability
qt(yt)
R
Answer-token rank
1+∣{v∈V:qt(v)>qt(yt)}∣
R
Top- k probabilities
qt(r) for each rank r=1,…,50
R×50
Entropy
−∑v∈Vqt(v)logqt(v)
R
Effective vocabulary size
(∑v∈Vqt(v)2)−1
R
Zipf slope
least-squares slope of logqt(r) against logr , r=1,…,50
R
Appendix
Table 9: Logit statistics computed per answer token from the proxy’s next-token distribution. Shape: output for one sequence with R answer tokens.
RAGTruth QA
HaluBench
TRIVIA+
Features
N
0.6B
1.7B
4B
8B
0.6B
1.7B
4B
8B
0.6B
1.7B
4B
8B
A 7
7
.852
.847
.838
.856
.627
.636
.652
.660
.642
.653
.666
.645
L 9
9
.764
.765
.793
.765
.654
.646
.661
.680
.684
.661
.696
.703
A 7 L 9
16
.852
.849
.859
.859
.663
.667
.680
.693
.686
.682
.706
.707
H 64
64
.864
.855
.869
.862
.792
.824
.846
.846
.775
.786
.807
.804
A 7 H 64
71
.871
.861
.866
.872
.795
.824
.846
.847
.777
.789
.806
.793
Appendix
Table 10: Test AUROC of the detectors of Table 2 . Bold : best in column; underlined : second best (ties marked alike). Bottom: the best of nine LLM judges of 4–9B parameters, Qwen3.5-9B on every dataset (Table 13 ).
RAGTruth QA
HaluBench
TRIVIA+
Addition
0.6B
1.7B
4B
8B
0.6B
1.7B
4B
8B
0.6B
1.7B
4B
8B
Δ F1
H 64→ A 7 H 64
+.080
+.022
− .020
+.043
+.001
− .005
+.002
+.004
− .014
.000
+.005
− .025
L 9→ A 7 L 9
+.126
+.088
+.074
+.114
+.009
+.015
+.014
+.009
+.011
+.038
+.025
+.002
H 64 L 9→ A 7 H 64 L 9
+.007
+.005
− .016
+.030
+.006
− .010
+.006
+.002
+.042
+.002
+.005
+.020
p , Holm-12
H 64→ A 7 H 64
.005
.557
.605
.017
1
1
1
1
1
1
1
1
L 9→ A 7 L 9
< .001
.004
.002
< .001
1
1
.503
1
1
.317
1
1
Appendix
Table 11: Change in test F1 when A 7 is added, with two-sided p -values from 100,000 paired bootstrap resamples of test groups (seed 42; models, regularization, and thresholds fixed), Holm-corrected over the 12 dataset–proxy pairs of an addition (Holm-12). A gain is significant if Δ>0 and the corrected p<0.05 ; bold : significant gain. No addition gives a significant loss.
RAGTruth QA
HaluBench
TRIVIA+
Addition
0.6B
1.7B
4B
8B
0.6B
1.7B
4B
8B
0.6B
1.7B
4B
8B
Δ F1
H 64→ A 64 H 64
+.044
− .030
− .001
+.037
+.027
+.012
+.035
+.050
+.009
+.002
+.040
+.001
p , Holm-12
H 64→ A 64 H 64
.201
.324
1
.269
.198
1
.027
< .001
1
1
.189
1
Appendix
Table 12: Change in test F1 when A 64 is added to H 64 (Section 5.4 ), with two-sided p -values from 100,000 paired bootstrap resamples of test groups as in Table 11 , Holm-corrected over the 12 dataset–proxy pairs (Holm-12). Bold : significant gain. No change is a significant loss.
AUROC
F1
Judge
Prompt
RAGTruth
HaluB.
TRIVIA+
RAGTruth
HaluB.
TRIVIA+
Qwen3.5-9B
Strict few-shot
.909
.859
.786
.623
.755
.655
Gemma-4-E4B
Evidence
.878
.855
.774
.617
.751
.621
Granite-4.2-8B
Strict
.843
.848
.755
.547
.753
.645
Ministral-3-8B
Strict
.823
.817
.735
.517
.721
.613
Falcon-H1-7B
Strict few-shot
.752
.834
.747
.434
.726
.624
Appendix
Table 13: LLM judges on the test splits of Table 7 with F1 at the threshold selected on validation. Top: nine instruction-tuned LLMs prompted as judges. Middle: the four Qwen3 proxy backbones prompted as judges and two specialized grounding checkers. Bottom: our proxy detectors for reference.
Test domain
Fit on
Method
RAGTruth
CovidQA
PubMedQA
FinanceBench
DROP
HaluEval
Mean
RAUQ (no fitting)
.58
.67
.66
.52
.66
.85
.66
RAGTruth
INTRYGUE
.89
.77
.55
.48
.41
.92
.62
Sink rate
.80
.72
.53
.49
.56
.91
.64
LLM-Check
.59
.58
.62
.53
.53
.75
.60
TOHA
.68
.59
.44
.46
.61
.80
.58
Appendix
Table 14: Cross-domain transfer on HaluBench (Qwen3-8B reader): test AUROC of each method fit on the source of its row group and tested on each source. Shaded: same source. Other five : fit on the five sources other than the test domain (leave-one-source-out); All six : fit on all six sources (pooled). Mean: over the five other test domains for a single fitting source, over all six for the last two groups. RAUQ fits nothing and scores the same for every fitting source. Bold : best method of the group in each column (ties marked alike). Each test domain has 138–166 examples; the 95% bootstrap intervals span ±0.09 at the median ( ±0.03 to ±0.12 ).
Artifact
Use
Licence
RAGTruth
detection
MIT
HaluBench
detection
CC BY-NC 2.0
TRIVIA+
detection
CC BY-NC-ND 4.0
PHANTOM
kernels
Apache 2.0
Qwen3 0.6B–8B
proxy, judge
Apache 2.0
Qwen3.5-9B
judge
Apache 2.0
Appendix
Table 15: Licences of the artifacts we use, as stated by their releases; Falcon LLM and GLM-4 are the custom licences of these models. Detection: Section 5 ; kernels: Section 4 ; judges and grounding checkers (checker): Appendix L.5 , where the models are cited.
Sparse attention reads only a small subset of the key-value cache, and how to treat the unread tail remains a key challenge. Discarding the tail biases the output, and sampling it as previous approaches do fails at reads of 5% and below, where the tail likely holds heavy hitters the selector missed. Our key observation is that the simplest possible proxy, one token that folds the entire tail into its count-aware mean, already yields lower output error than a sample at every read behind a practical selector. We further show in closed form that at low reads sampling nearly doubles the weight error of discarding while a single proxy stays below it. Building on these findings, we explore approximating the dense attention distribution with a few proxies that target the tail. We propose OpenAttention, a pipeline of clustering, ErrorGate and top-k selection followed by a count-aware mean proxy. To implement clustering and selection both efficiently and effectively, we design training-free Query-Geometry Clustering (QGC) and a Query-Geometry Selector (QGS), which compress the keys while respecting the query directions. Additionally, unlike prior methods that rank clusters by centroid alone, ErrorGate allocates the exact read by the estimated weight error of each cluster. On RULER-32K HARD with Llama-3.1-8B, OpenAttention retains 99% of dense accuracy at a 1% read. It also achieves state-of-the-art accuracy across models, context lengths and datasets. Our customized attention kernel for OpenAttention runs the decode attention stage 10× faster than dense attention at a 1% read.
Hyunwoo Yu, Jongbeom Lee, Hyunbin Kim +8
Sogang University · Samsung Electronics · Pusan National University
Modern large language models increasingly require long contexts for reasoning and multi-document tasks, but attention's quadratic complexity creates a severe computational bottleneck. We present Block Sparse Flash Attention (BSFA), a drop-in replacement that accelerates long-context inference while preserving model quality. Unlike methods that predict importance before computing scores, BSFA computes exact query-key similarities to select the top-k most important value blocks for each query. By comparing per-block maximum scores against calibrated thresholds, we skip approximately 50% of the computation and memory transfers for pruned blocks. Our training-free approach requires only a one-time threshold calibration on a small dataset to learn the per-layer and per-head attention score distributions. We provide a CUDA kernel implementation that can be used as a drop-in replacement for FlashAttention. On Llama-3.1-8B, BSFA achieves up to 1.13x end-to-end speedup on LongBench with only a 1.1% accuracy drop, and up to 1.24x on Needle-in-a-Haystack retrieval at a 1% accuracy drop. The attention kernel itself accelerates by up to 1.38x. We compare BSFA against five recent sparse attention baselines (SpargeAttention, MInference, FlexPrefill, XAttention, and BLASST), and verify the method on Qwen2.5-7B and on A6000 and H100 GPUs. The implementation is available at https://github.com/Danielohayon/Block-Sparse-Flash-Attention.
Daniel Ohayon, Itay Lamprecht, Itay Hubara +3
Technion – Israel Institute of Technology, Haifa, Israel · Intel - Habana Labs · Intel – Habana Labs, Tel Aviv, Israel
We introduce a proxy-analyzer framework for detecting hallucinations in large language models. Instead of looking inside the generating model, our system reads already-generated text through a small locally hosted open-weight model and spots hallucinations using the reader's own internal activations. This works just as well when the generator is a closed API like GPT-4 as when it is any open-weight model. We built eighteen features grounded in how transformers process text, covering residual stream norms, per-head source-document attention, entropy, MLP activations, logit-lens trajectories, and three new token-level grounding statistics. We trained a stacking ensemble on 72,135 samples from five hallucination datasets. We tested across seven analyzer architectures from 0.5 billion to 9 billion parameters: Qwen2.5 at 0.5B and 7B, Gemma-2 at 2B and 9B, Pythia at 1.4B, and LLaMA-3 at both 3B and 8B. Across all seven, we consistently beat ReDeEP's token-level AUC of 0.73 on RAGTruth by 7.4 to 10.3 percentage points. Qwen2.5-7B reached an F1 of 0.717, just above ReDeEP's 0.713, while Qwen2.5-0.5B hit 0.706. The most striking finding is how tightly all seven models cluster: AUC spans only 2.3 percentage points across an eighteen-fold difference in model size. Even more surprising, our 3B LLaMA outperforms our 8B LLaMA on RAGTruth, showing that bigger is not always better even within the same model family. Both RAGTruth and LLM-AggreFact include outputs from multiple LLM families, so our results are not skewed toward any particular generator.
Akshita Singh, Prabesh Paudel, Siddhartha Roy
Khoury College of Computer Sciences Northeastern University