The verification layer around your legal AI
AI drafts briefs that cite cases which do not exist, or that exist but say the opposite of what they are cited for. CiteGuard is the layer around your AI: it grounds every citation against real case law on CourtListener, catches fabrications deterministically, routes anything it cannot verify to a human, and signs an audit certificate. It tells you what is safe to file and exactly what needs a human.
0
Fabricated citations can pass the gate
Deterministic trust invariant, unit-tested
20
Real cases in the ground-truth corpus
Cached from CourtListener, the public U.S. case-law database
8/8
Core verifier tests pass
Offline and reproducible (python tests/test_core.py)
This is a runnable demo. The sample briefs, parties, and matter caption are synthetic excerpts, and the document-management connector is a mock. The corpus, the live CourtListener checks, the deterministic gate, and the tests are real.
Courts are already sanctioning it, and the drafting tools do not check their own work.
The failure mode is not bad grammar. The grammar is perfect, which is what makes it dangerous. AI drafts a brief that reads like a partner wrote it and cites a case that was never decided, or a real case that says the opposite of the proposition it is offered for. Even purpose-built legal tools do this: Westlaw Precision hallucinated 33% and Lexis+ 17% of the time in a controlled study (Stanford RegLab, Journal of Empirical Legal Studies, 2025).
The consequences have arrived. By early 2026 there were 1,222 documented court cases involving AI-hallucinated citations, and courts have started sanctioning: the Sixth Circuit imposed a $30,000 sanction in March 2026. Governance rules followed. ABA Formal Opinion 512 and more than 300 judicial standing orders now require a lawyer to verify AI output before filing, yet fewer than 20% of firms have any AI-use policy at all.
The drafter is the wrong place to fix this. A stronger model still drafts, and a court does not care how confident the model was. It cares whether the citation exists and says what you claimed. That is why the durable answer is not a smarter writer but a separate layer that checks the work against an independent authority, catches fabrication with certainty, and is honest about what it cannot verify.
The guarantee-grade parts are deterministic code. The judgment call is an LLM that abstains. The gate, not the model, decides.
Paste any AI-drafted brief and the pipeline runs live: extract each citation and its proposition, ground it against real case law, run a deterministic existence check and an LLM support-check, apply a deterministic policy gate, and export a signed audit certificate. The dashboard shows each stage light up in a system console that streams every real CourtListener request with its URL, status, and latency, so nothing is a black box.
The existence and fabrication check and the policy gate are pure Python against real case law. A fabricated cite is proven absent by a live CourtListener zero-result lookup, not guessed, because a buyer needs provable fabrication-catching and an auditable gate, not an LLM's say-so.
The support-check reads the real opinion and asks whether it supports proposition P. It is provider-swappable, and it abstains, routing to human review, whenever it is unsure or ungrounded. It advises; it never gets the final word.
Every citation resolves to exactly one verdict. The verdicts that route to a human are honest about why, and the one that means CourtListener was unreachable is never collapsed into a fabrication.
| Verdict | What it means | Decided by |
|---|---|---|
| VERIFIED_SUPPORTED | Real case, and the opinion supports the proposition | Existence check plus support-check |
| VERIFIED_UNSUPPORTED (needs review) | Real case, but the opinion does not clearly support it | Routed to a human with the context |
| FABRICATED | No such case in real case law | Deterministic, live zero-result lookup |
| OUTSIDE_COVERAGE | A genuine case not in the cached subset, honestly marked | Deterministic, never a false verified |
| UNVERIFIED | CourtListener unreachable, so absence is unproven | Deterministic, never collapsed to fabricated |
The gate is deterministic. It returns FILING_READY only if there are zero fabricated and zero unresolved citations, and NOT_FILING_READY otherwise. That means a single unreviewed citation holds the whole filing, by design, even when nothing is fabricated. One click then exports a signed JSON audit certificate that records, per cite, the verdict, the evidence snippet, the real CourtListener URL, the model and version (or deterministic, or abstained), the verifier version, a UTC timestamp, and the gate result.
The demo ships four sample briefs. We walk two: the Mixed Motion brief, which carries a real cite, a fabricated cite, and an out-of-corpus cite at once, and the Clean Motion brief, where every citation is real. Every image below is a screenshot of the running app. The matter caption is illustrative, not a real case.
On the left is an AI-drafted motion to suppress. On the right, the system console lights up stage by stage and streams each real CourtListener request with its URL, status, and latency, alongside the support-check reasoning. This is the first citation, Miranda v. Arizona, 384 U.S. 436, resolving against the ground-truth corpus while the support-check reads the opinion text.
The brief cites Halstead v. Ferngate Holdings, 823 U.S. 1199. The existence check sends a live GET to CourtListener and gets 200 with 0 results, because U.S. Reports has no volume 823. The verdict is FABRICATED, proven absent rather than guessed. In the same run Brown v. Board of Education, 347 U.S. 483 is a real case that is not in the cached subset, so it is honestly marked OUTSIDE_COVERAGE instead of a false verified. The gate reads NOT_FILING_READY: 1 fabricated, 2 unresolved, 1 auto-cleared.
This is the Clean Motion brief, where every citation is a real, on-point case. When the opinion text establishes the proposition, the support-check confirms it. Miranda v. Arizona, 384 U.S. 436 clears Verified because the majority itself holds that a suspect must be advised of the right to counsel and to remain silent, with a link to the real case on CourtListener. Which specific on-point cites clear green versus route to review can vary run to run, because the support-check is the one non-deterministic step, but an on-point cite like Miranda reliably clears.
On the Mixed Motion review, the scoreboard reads 1 Verified, 1 Fabricated, and 2 Need Review. Bell Atlantic Corp. v. Twombly, 550 U.S. 544 is a real case, but the excerpt does not squarely establish the proposition it is offered for, so the support-check marks it Needs Review with its reasoning rather than confidently grading it. That conservative abstention is the design: a confident red Unsupported verdict is rare on purpose, because the honest move on an ambiguous opinion is to hand it to a human.
This is the certificate for that same Clean Motion brief. Miranda cleared Verified, but Terry v. Ohio and Strickland v. Washington were routed to review, so the gate holds at Not Filing-Ready and the seal reads Hold for Review, even though not a single citation is fabricated. The certificate lists each cite with its verdict and support-check result and certifies that every one was checked for existence against CourtListener, that fabricated cites are identified to a certainty, and that citations requiring contextual judgment are routed to a human. It exports as a signed JSON record you attach to the filing. A clean-looking brief is not the same as a filing-ready one.
The corpus is 20 real decisions cached from CourtListener, the public U.S. case-law database, including Miranda, Twombly, Iqbal, Terry, Strickland, International Shoe, Erie, Baker v. Carr, Chevron, and Daubert. Existence and fabrication checks also query CourtListener live at request time, which is why fabrication-catching is authoritative rather than limited to the subset. The 20-case corpus is a cached subset, so support adjudication is demonstrated at small N on real cases, and that scope is stated plainly rather than dressed up as universal accuracy.
CiteGuard is not another drafter. It is the layer that decides what is safe to file.
| Dimension | Unverified AI brief | CiteGuard verification layer |
|---|---|---|
| Fabricated case detection | Reads as authoritative, uncaught | Deterministic, live zero-result lookup |
| Real but misapplied cite | Ships intact | Routed to human review with context |
| Uncertain support-check | Model asserts a verdict anyway | Abstains, hands it to a human |
| Provenance | None | A real CourtListener link per cite |
| Filing decision | The drafter's confidence | A deterministic gate, zero fabricated and zero unresolved |
| Audit trail for ABA Op. 512 | None | Signed JSON certificate per brief |
No. CiteGuard does not draft or do legal research, so it does not compete with Harvey, Westlaw Precision, or Lexis Protege. It is the verification layer that sits around whatever any of them produced. It takes the AI-drafted brief, tells the attorney what is safe to file and exactly what needs a human, and runs in shadow or advisory mode alongside the tool you already use.
The existence check queries CourtListener, the public U.S. case-law database, for the exact citation. A fabricated cite like Halstead v. Ferngate Holdings, 823 U.S. 1199 returns zero results (U.S. Reports has no volume 823), so it is marked FABRICATED with certainty, not guessed. If CourtListener is unreachable, the citation is marked UNVERIFIED rather than fabricated, because absence of proof is not proof of absence. That distinction is a deterministic, unit-tested invariant.
Not blindly, which is why the support-check abstains. It is one LLM step that reads the real opinion and confirms a cite green only when the opinion text establishes the holding, as it does for Miranda v. Arizona. When the opinion does not squarely support the stated proposition, it routes the citation to human review instead of bluffing a verdict. The model advises; the deterministic gate and the attorney decide.
No, because filing-ready is a governance property, not a model property. A court does not care how confident the model was; it cares whether the citation exists and says what you claimed. So the durable need is an independent layer that grounds every claim in real case law, catches fabrication with certainty, and is honest about what it cannot verify. That requirement holds at any model quality.
One click exports a signed JSON certificate that records, per citation, the verdict, the evidence snippet, the real CourtListener URL, the model and version (or deterministic or abstained), the verifier version, a UTC timestamp, and the gate result. It is the artifact that shows a lawyer verified AI output before filing, which is what ABA Formal Opinion 512 and 300-plus judicial standing orders now require. In the demo the certificate is JSON; a PDF export is deferred.
It is a runnable demo that proves the mechanism, not a deployed pipeline. The four sample briefs, the parties, and the matter caption are labeled synthetic excerpts, and the document-management connector is a mock. What is real: the 20-case corpus is cached from CourtListener, the existence and fabrication checks hit CourtListener live at request time, the deterministic gate and the 8 of 8 unit tests run exactly as shown, and the fabricated cites are genuinely absent from real case law.
The research behind this demo — the architecture, the verification design, and the enterprise blueprint.
The verification layer is the hard part. We build it.
If your firm is working out how to let attorneys use AI without risking a fabricated citation in a filing, we would genuinely like to hear how you are thinking about it. The problem is industry-wide and the answers will be too.