The verification layer around your legal AI

A fabricated case is caught with certainty before your brief is ever filed.

AI drafts briefs that cite cases which do not exist, or that exist but say the opposite of what they are cited for. CiteGuard is the layer around your AI: it grounds every citation against real case law on CourtListener, catches fabrications deterministically, routes anything it cannot verify to a human, and signs an audit certificate. It tells you what is safe to file and exactly what needs a human.

0

Fabricated citations can pass the gate

Deterministic trust invariant, unit-tested

20

Real cases in the ground-truth corpus

Cached from CourtListener, the public U.S. case-law database

8/8

Core verifier tests pass

Offline and reproducible (python tests/test_core.py)

This is a runnable demo. The sample briefs, parties, and matter caption are synthetic excerpts, and the document-management connector is a mock. The corpus, the live CourtListener checks, the deterministic gate, and the tests are real.

A brief that looks authoritative can cite cases that do not exist

Courts are already sanctioning it, and the drafting tools do not check their own work.

The failure mode is not bad grammar. The grammar is perfect, which is what makes it dangerous. AI drafts a brief that reads like a partner wrote it and cites a case that was never decided, or a real case that says the opposite of the proposition it is offered for. Even purpose-built legal tools do this: Westlaw Precision hallucinated 33% and Lexis+ 17% of the time in a controlled study (Stanford RegLab, Journal of Empirical Legal Studies, 2025).

The consequences have arrived. By early 2026 there were 1,222 documented court cases involving AI-hallucinated citations, and courts have started sanctioning: the Sixth Circuit imposed a $30,000 sanction in March 2026. Governance rules followed. ABA Formal Opinion 512 and more than 300 judicial standing orders now require a lawyer to verify AI output before filing, yet fewer than 20% of firms have any AI-use policy at all.

The drafter is the wrong place to fix this. A stronger model still drafts, and a court does not care how confident the model was. It cares whether the citation exists and says what you claimed. That is why the durable answer is not a smarter writer but a separate layer that checks the work against an independent authority, catches fabrication with certainty, and is honest about what it cannot verify.

How CiteGuard works

The guarantee-grade parts are deterministic code. The judgment call is an LLM that abstains. The gate, not the model, decides.

Paste any AI-drafted brief and the pipeline runs live: extract each citation and its proposition, ground it against real case law, run a deterministic existence check and an LLM support-check, apply a deterministic policy gate, and export a signed audit certificate. The dashboard shows each stage light up in a system console that streams every real CourtListener request with its URL, status, and latency, so nothing is a black box.

Two engines, deliberately split

Deterministic Python (guarantee-grade)

The existence and fabrication check and the policy gate are pure Python against real case law. A fabricated cite is proven absent by a live CourtListener zero-result lookup, not guessed, because a buyer needs provable fabrication-catching and an auditable gate, not an LLM's say-so.

One LLM step that abstains

The support-check reads the real opinion and asks whether it supports proposition P. It is provider-swappable, and it abstains, routing to human review, whenever it is unsure or ungrounded. It advises; it never gets the final word.

One of five honest verdicts per citation

Every citation resolves to exactly one verdict. The verdicts that route to a human are honest about why, and the one that means CourtListener was unreachable is never collapsed into a fabrication.

Verdict What it means Decided by
VERIFIED_SUPPORTED Real case, and the opinion supports the proposition Existence check plus support-check
VERIFIED_UNSUPPORTED (needs review) Real case, but the opinion does not clearly support it Routed to a human with the context
FABRICATED No such case in real case law Deterministic, live zero-result lookup
OUTSIDE_COVERAGE A genuine case not in the cached subset, honestly marked Deterministic, never a false verified
UNVERIFIED CourtListener unreachable, so absence is unproven Deterministic, never collapsed to fabricated

The policy gate

The gate is deterministic. It returns FILING_READY only if there are zero fabricated and zero unresolved citations, and NOT_FILING_READY otherwise. That means a single unreviewed citation holds the whole filing, by design, even when nothing is fabricated. One click then exports a signed JSON audit certificate that records, per cite, the verdict, the evidence snippet, the real CourtListener URL, the model and version (or deterministic, or abstained), the verifier version, a UTC timestamp, and the gate result.

One brief, every path, worked end to end

The demo ships four sample briefs. We walk two: the Mixed Motion brief, which carries a real cite, a fabricated cite, and an out-of-corpus cite at once, and the Clean Motion brief, where every citation is real. Every image below is a screenshot of the running app. The matter caption is illustrative, not a real case.

The pipeline runs live against real case law

On the left is an AI-drafted motion to suppress. On the right, the system console lights up stage by stage and streams each real CourtListener request with its URL, status, and latency, alongside the support-check reasoning. This is the first citation, Miranda v. Arizona, 384 U.S. 436, resolving against the ground-truth corpus while the support-check reads the opinion text.

The CiteGuard dashboard: an AI-drafted brief on the left, and a system console on the right showing the extract, ground, support-check, gate, and certificate stages with a live trace of CourtListener requests.
The live pipeline: extract, ground against real case law, support-check, gate, certificate, with the CourtListener trace streaming underneath.

A fabricated case, caught with certainty

The brief cites Halstead v. Ferngate Holdings, 823 U.S. 1199. The existence check sends a live GET to CourtListener and gets 200 with 0 results, because U.S. Reports has no volume 823. The verdict is FABRICATED, proven absent rather than guessed. In the same run Brown v. Board of Education, 347 U.S. 483 is a real case that is not in the cached subset, so it is honestly marked OUTSIDE_COVERAGE instead of a false verified. The gate reads NOT_FILING_READY: 1 fabricated, 2 unresolved, 1 auto-cleared.

The CiteGuard verification scoreboard for one brief showing 1 Verified, 1 Fabricated, and 2 Need Review, with Halstead v. Ferngate 823 U.S. 1199 marked Fabricated and Brown v. Board of Education marked Outside Coverage, and the gate reading Do Not File.
One brief, every outcome: a real cite Verified, Halstead 823 U.S. 1199 Fabricated on a zero-result lookup, Brown v. Board Outside Coverage, and the rest routed to Needs Review.

A real case cleared green, on the opinion's own holding

This is the Clean Motion brief, where every citation is a real, on-point case. When the opinion text establishes the proposition, the support-check confirms it. Miranda v. Arizona, 384 U.S. 436 clears Verified because the majority itself holds that a suspect must be advised of the right to counsel and to remain silent, with a link to the real case on CourtListener. Which specific on-point cites clear green versus route to review can vary run to run, because the support-check is the one non-deterministic step, but an on-point cite like Miranda reliably clears.

The live support-check trace pulling the real Miranda v. Arizona opinion from CourtListener and quoting its own holding on custodial-interrogation warnings, marking 384 U.S. 436 Verified, while Terry v. Ohio is grounded next.
The support-check reads the real opinion and quotes the majority's own holding, so Miranda 384 U.S. 436 clears Verified, grounded in real text with a source link.

It routes to a human rather than bluff a verdict

On the Mixed Motion review, the scoreboard reads 1 Verified, 1 Fabricated, and 2 Need Review. Bell Atlantic Corp. v. Twombly, 550 U.S. 544 is a real case, but the excerpt does not squarely establish the proposition it is offered for, so the support-check marks it Needs Review with its reasoning rather than confidently grading it. That conservative abstention is the design: a confident red Unsupported verdict is rare on purpose, because the honest move on an ambiguous opinion is to hand it to a human.

A misapplied-precedent brief where Erie Railroad v. Tompkins and Celotex Corp. v. Catrett are real cases cited for the wrong proposition; the trace shows the support-check reading each real opinion, finding the point is not established, and routing them to Needs Review.
Real cases cited for the wrong proposition: the support-check reads the opinion, sees the point is not established, and routes them to Needs Review rather than bluff. A keyword match would miss this.

Even a clean brief is held until every cite resolves

This is the certificate for that same Clean Motion brief. Miranda cleared Verified, but Terry v. Ohio and Strickland v. Washington were routed to review, so the gate holds at Not Filing-Ready and the seal reads Hold for Review, even though not a single citation is fabricated. The certificate lists each cite with its verdict and support-check result and certifies that every one was checked for existence against CourtListener, that fabricated cites are identified to a certainty, and that citations requiring contextual judgment are routed to a human. It exports as a signed JSON record you attach to the filing. A clean-looking brief is not the same as a filing-ready one.

The Certificate of Citation Verification for the Hartwell Capital Partners matter, marked Not Filing-Ready, listing three citations with Verified and Needs Review verdicts and a Hold for Review seal.
The signed certificate, marked Not Filing-Ready with a Hold for Review seal, because citations still require human judgment.

Grounded in an independent authority

The corpus is 20 real decisions cached from CourtListener, the public U.S. case-law database, including Miranda, Twombly, Iqbal, Terry, Strickland, International Shoe, Erie, Baker v. Carr, Chevron, and Daubert. Existence and fabrication checks also query CourtListener live at request time, which is why fabrication-catching is authoritative rather than limited to the subset. The 20-case corpus is a cached subset, so support adjudication is demonstrated at small N on real cases, and that scope is stated plainly rather than dressed up as universal accuracy.

The Ground-Truth Corpus panel listing 20 real cases curated from CourtListener, including Strickland v. Washington, Ashcroft v. Iqbal, Terry v. Ohio, Whitman v. American Trucking, and Chevron, each with its citation and a cached opinion.
The 20-case ground-truth corpus, cached from CourtListener, with live lookups at request time for existence and fabrication.

Unverified AI output versus CiteGuard

CiteGuard is not another drafter. It is the layer that decides what is safe to file.

Dimension Unverified AI brief CiteGuard verification layer
Fabricated case detection Reads as authoritative, uncaught Deterministic, live zero-result lookup
Real but misapplied cite Ships intact Routed to human review with context
Uncertain support-check Model asserts a verdict anyway Abstains, hands it to a human
Provenance None A real CourtListener link per cite
Filing decision The drafter's confidence A deterministic gate, zero fabricated and zero unresolved
Audit trail for ABA Op. 512 None Signed JSON certificate per brief

What this demo does not do

  • ✓ It does not do legal research or drafting, and it does not compete with Harvey, Westlaw, or Lexis. It is a verification layer that sits around whatever model produced the brief.
  • ✓ It does not claim perfect AI judgment on support. The support-check is LLM-assisted with abstention, is non-deterministic, and routes uncertain cases to a human by design. It does not auto-flag every misapplied cite red Unsupported; a confident red verdict is rare on purpose.
  • ✓ It does not treat a clean-looking brief as filing-ready. Only fabrication and existence are deterministic guarantees. The 8 of 8 tests and the 20-case corpus are the built demo's scope, not an open-world accuracy claim.
  • ✓ It does not present the sample briefs, cases, or the matter caption as real clients or matters. They are labeled synthetic excerpts. The fabricated cites are genuinely absent from real case law.
  • ✓ It does not use a live document-management connector. The iManage or NetDocuments connector is a mock, default grounding uses the public majority-opinion snippet (full opinion text needs a free CourtListener token), and a PDF certificate, negative-treatment checks, and GraphRAG are deferred.
  • ✓ It does not carry customers, case studies, testimonials, or ROI figures. None exist yet. This is a demo that proves the mechanism, not a deployment.

Questions lawyers actually ask

Does this replace Harvey, Westlaw, or Lexis?

No. CiteGuard does not draft or do legal research, so it does not compete with Harvey, Westlaw Precision, or Lexis Protege. It is the verification layer that sits around whatever any of them produced. It takes the AI-drafted brief, tells the attorney what is safe to file and exactly what needs a human, and runs in shadow or advisory mode alongside the tool you already use.

How does it know a citation is fabricated and not just missing?

The existence check queries CourtListener, the public U.S. case-law database, for the exact citation. A fabricated cite like Halstead v. Ferngate Holdings, 823 U.S. 1199 returns zero results (U.S. Reports has no volume 823), so it is marked FABRICATED with certainty, not guessed. If CourtListener is unreachable, the citation is marked UNVERIFIED rather than fabricated, because absence of proof is not proof of absence. That distinction is a deterministic, unit-tested invariant.

Can I trust the AI to judge whether a case actually supports my argument?

Not blindly, which is why the support-check abstains. It is one LLM step that reads the real opinion and confirms a cite green only when the opinion text establishes the holding, as it does for Miranda v. Arizona. When the opinion does not squarely support the stated proposition, it routes the citation to human review instead of bluffing a verdict. The model advises; the deterministic gate and the attorney decide.

Will a better AI model just make this unnecessary?

No, because filing-ready is a governance property, not a model property. A court does not care how confident the model was; it cares whether the citation exists and says what you claimed. So the durable need is an independent layer that grounds every claim in real case law, catches fabrication with certainty, and is honest about what it cannot verify. That requirement holds at any model quality.

What does the audit certificate actually prove for ABA Opinion 512 and standing orders?

One click exports a signed JSON certificate that records, per citation, the verdict, the evidence snippet, the real CourtListener URL, the model and version (or deterministic or abstained), the verifier version, a UTC timestamp, and the gate result. It is the artifact that shows a lawyer verified AI output before filing, which is what ABA Formal Opinion 512 and 300-plus judicial standing orders now require. In the demo the certificate is JSON; a PDF export is deferred.

Is this a live product or a demo, and what is real in it?

It is a runnable demo that proves the mechanism, not a deployed pipeline. The four sample briefs, the parties, and the matter caption are labeled synthetic excerpts, and the document-management connector is a mock. What is real: the 20-case corpus is cached from CourtListener, the existence and fabrication checks hit CourtListener live at request time, the deterministic gate and the 8 of 8 unit tests run exactly as shown, and the fabricated cites are genuinely absent from real case law.

Technical Research

The research behind this demo — the architecture, the verification design, and the enterprise blueprint.

Putting AI-drafted work in front of a court?

The verification layer is the hard part. We build it.

If your firm is working out how to let attorneys use AI without risking a fabricated citation in a filing, we would genuinely like to hear how you are thinking about it. The problem is industry-wide and the answers will be too.

Verification assessment

  • ✓ Map where your AI workflow can file an unverified citation
  • ✓ Define the existence, grounding, and support rules for your case law
  • ✓ Design the human-review routing and the abstention thresholds
  • ✓ Specify the audit certificate your ABA Op. 512 obligations need

Build the layer

  • ✓ A deterministic verifier over your real case-law sources
  • ✓ A support-check that abstains rather than bluffs
  • ✓ A policy gate and a signed audit certificate per filing
  • ✓ Model-swappable, running in shadow mode around your legal AI