The citation that gets a lawyer sanctioned is rarely the one that reads badly. It reads perfectly. It is a confident cite to a case that does not exist, or a real case quoted for the opposite of what it actually held. A stronger legal model writes that sentence more fluently. It does not make the case exist, and it does not make the holding say what the brief claims. The distance between a fluent citation and a true one is a verification problem, and no model on any current roadmap closes it.
We kept landing on that distance while building CiteGuard, a demo for legal AI citation verification that grounds every cite against real case law on CourtListener before a brief is ever called filing-ready. You can run it at https://veriprajna.com/demos/legal-ai-citation-verification. The structural argument holds without the demo, though, and most firms are still betting on the wrong side of it.
The number the industry keeps trying to model its way out of
Even purpose-built legal tools hallucinate. Westlaw Precision hallucinated on 33 percent of tested queries, and Lexis+ on 17 percent (Stanford RegLab, Journal of Empirical Legal Studies, 2025). Those are the tools built specifically for this work. By early 2026 there were 1,222 documented court cases involving AI-hallucinated citations, and the bench has stopped extending patience: the Sixth Circuit imposed a 30,000 dollar sanction in March 2026. ABA Formal Opinion 512 and more than 300 judicial standing orders now require a lawyer to verify AI output before it is filed. Fewer than 20 percent of firms have any AI-use policy at all.
The reflex is to wait for a model that hallucinates less. That reflex misreads the problem. A more accurate drafter lowers the rate of invented cites, but the failure that reaches a judge is not a rate. It is a single citation, in a single brief, that a court will check against the actual reporter. The question a court asks is binary and external: does this case exist, and does it say what you claimed. A model's confidence has no standing in that question.
Why a better model does not close the gap
That is the whole thesis, and it is why we think this is worth building rather than waiting out. Filing-ready is a governance property, not a model property. It does not live inside the drafter's weights. It lives in an independent check that the drafter cannot grade itself on.
A court does not care how confident the model was. It cares whether the citation exists and whether the opinion says what you claimed. That makes filing-ready a governance property, not a model property, and no better model relocates it back inside the drafter.
There are two failure shapes, and they need different treatment. One is fabrication: a cite to a case that is simply not in the law. The other is misapplication: a real case cited for a proposition its opinion does not support, sometimes the exact opposite. Fabrication can be caught with certainty, because existence is a fact you can check against real case law. Misapplication is a judgment call, and the honest move there is not to bluff a verdict but to route it to a human. CiteGuard splits those on purpose. Existence checking and the policy gate are deterministic Python against real case law. The support-check that reads an opinion and asks whether it backs the proposition is one LLM step, and it is built to abstain when it cannot establish the answer from the opinion text.
The pipeline in the running demo. Extract, grounding, the policy gate, and the certificate are deterministic; only the support-check is the LLM step, and it is labeled as such. The console under it streams each real CourtListener request, here a GET to the opinions API returning 200 with the retrieved opinion length, so the grounding is an actual lookup and not a guess.
Watch one catch happen
Assertions about determinism are cheap, so the demo makes it mechanical. Take the "Mixed Motion" sample brief, a synthetic motion excerpt. One of its cites reads Halstead v. Ferngate Holdings, 823 U.S. 1199. The existence check does not reason about whether that sounds plausible. It queries live CourtListener for that reporter cite and gets zero results, because United States Reports has no volume 823. The cite is impossible, and the verdict is FABRICATED, proven absent rather than suspected. On the same brief, Miranda v. Arizona, 384 U.S. 436 cleared green in this run when the support-check found the custodial-interrogation holding in the opinion's own text, Brown v. Board of Education, 347 U.S. 483 is a genuine case that falls outside the 20-case cached subset and is honestly marked OUTSIDE_COVERAGE instead of a false green, and Bell Atlantic v. Twombly routed to human review. One brief, four different verdicts.
One synthetic brief resolving into four verdicts. Miranda cleared green in this run, Halstead v. Ferngate Holdings at 823 U.S. 1199 is caught as Fabricated because that volume does not exist, Brown v. Board is honestly marked Outside Coverage rather than falsely verified, and Twombly is routed to a human. The banner stays Do Not File.
The guarantee we lean on is narrow and provable: zero fabricated citation can ever pass the gate. It is a deterministic invariant, and it is unit-tested directly, as test_fabricated_never_passes_gate, one of 8 of 8 offline tests that also confirm an unreachable source is treated as unverified rather than fabricated, and that the support-check abstains when it has no grounding. We are careful about scope. The 20-case corpus is a cached subset, so adjudication is demonstrated at small N. Fabrication detection is the part that is authoritative in the open world, because it queries live CourtListener and not just the local cache.
The gate that holds the filing, and the receipt it leaves
The policy gate is a single deterministic rule: a brief is filing-ready only if it has zero fabricated and zero unresolved citations. Anything else is NOT_FILING_READY, and the demo says Do Not File in red until every citation is accounted for. One click then exports a signed JSON certificate: each cite to its verdict, an evidence snippet, the real CourtListener URL, the model and version or the label "deterministic" or "abstained", the verifier version, a UTC timestamp, and the gate result.
Zero fabricated citations can ever pass the gate. Not because the model was careful, but because a fabricated cite returns zero results from real case law and a deterministic rule, not a probability, refuses to clear it.
The exportable certificate for a reviewed brief. It records the verifier version, a UTC generation time, the matter, and every citation with its verdict and support-check result. Here one cite at 921 U.S. 77 is Fabricated and two real cases are routed to Needs Review, so the certificate reads Not Filing-Ready. This is the artifact a firm attaches to answer ABA Opinion 512 and a standing order.
That certificate is the part that ages well. Model accuracy resets with every base-model release. Provenance, an audit trail, and a deterministic gate do not age out when the next model ships, and today fewer than one firm in five has any AI-use policy for the certificate to plug into. The durable work is the layer around the AI, not a smarter AI.
The other half: an honest "I am not sure"
Fabrication is the clean case. The harder one is the real case cited for the wrong proposition, and it is where confident systems get lawyers in trouble. In the "Misapplied Precedent" brief, Erie Railroad v. Tompkins, 304 U.S. 64 is cited for a uniform body of federal common law, which is close to the opposite of what Erie held. The existence check passes, because Erie is real. The support-check reads the fetched opinion, cannot establish that proposition from the text, and returns UNCERTAIN rather than inventing a verdict. The cite is routed to human review, and the gate holds the filing.
The support-check declining to bluff. On a real case cited for a proposition the opinion does not support, it returns UNCERTAIN and routes to human review rather than asserting a verdict it cannot ground. The console note reads model advises, deterministic gate plus human decide.
That abstention is deliberate, and it is the uncomfortable part of the design. The most valuable behavior in high-stakes work is the willingness to say the opinion does not settle this, a person needs to look. We do not claim the support-check labels every misapplication red on its own; that confident red verdict is rare by design. What it does reliably is decline to certify what it cannot prove, and hand the judgment to the attorney with the contradicting context attached.
Where this is, and one question
This is a demo, not a deployed pipeline. Default grounding is the public majority-opinion snippet, the document store is a mock connector, and the corpus is a 20-case cached subset, so it proves the mechanism rather than running your filings. What we are confident about is the shape: fabrication can be caught with certainty, misapplication should be abstained on rather than bluffed, and filing-ready has to be decided outside the model that drafted the brief. You can watch the full run at https://veriprajna.com/demos/legal-ai-citation-verification.
So one concrete question for anyone putting AI drafting near a court: once your model writes the brief, does anything independently confirm that each cited case exists in the reporter and says what the brief claims, or does it go toward filing on the model's word? We would genuinely like to hear where your team draws that line. The problem is industry-wide, and the good answers will be too.