Avoiding fabricated citations: a governance approach

By now every practicing lawyer has read some version of the story: a brief filed with confident citations to cases that do not exist, a judge who checked, an order to show cause, and a lawyer explaining under oath that the AI seemed reliable. Courts across the country have sanctioned attorneys for filings built on fabricated authority, and the pattern keeps repeating — not because lawyers stopped caring about accuracy, but because the tools they reached for were never built to guarantee it.

The instinctive responses — ban the tools, add a disclaimer, tell everyone to double-check — all miss the actual mechanics of the problem. To fix fabricated citations you have to understand why language models produce them in the first place, and then build a system in which a fabricated citation cannot survive long enough to reach a filing.

Why models fabricate citations at all

A language model is not a database with a search function bolted on. It is a system trained to continue text plausibly, and it has read an enormous amount of legal writing. It knows, statistically, what a citation looks like: party names of a certain shape, a reporter volume, a page number, a court, a year. When a model is asked for authority supporting a proposition, it produces text shaped like the authorities it has seen — and the shape can be perfect while the substance is invented.

This is why fabricated citations are so treacherous. A made-up case name does not look made up. It has plausible parties, a real reporter, a page number in a sensible range, often a real court and a believable year. Sometimes the model blends fragments of genuine cases into a chimera — a real case name attached to the wrong reporter, or a real holding attributed to a case about something else entirely. Nothing in the output distinguishes recalled authority from composed authority, because to the model there is no distinction. It was asked to produce citation-shaped text, and it did.

The corollary matters just as much: you cannot fix this with better prompting. Telling a model to only cite real cases changes the tone of the output, not the mechanism that produces it. The model has no internal flag that separates memory from invention. Verification has to happen outside the model — against a source of truth the model cannot influence.

A made-up case does not look made up. It has plausible parties, a real reporter, a believable year — and nothing in the output distinguishes recalled authority from composed authority.

The wrong fix: asking the model to check itself

Some tools respond to the fabrication problem by adding a second AI pass — the model, or another model, reviews the citations and confirms they seem right. This is asking the same class of system that produced the error to detect it, and it fails for the same reason the citation was invented in the first place: the reviewing model is also generating plausible text, this time in the form of a reassurance.

Verification of a citation is not a judgment call, and it should not be treated as one. Either a citation resolves to a real, identifiable authority or it does not. That is a lookup — a deterministic operation with a provable answer — and the moment you frame it that way, the architecture writes itself: check every citation against a real corpus of law, by exact resolution rather than AI opinion, before any model gets to say what the case means.

Deterministic first: validation against an authority ledger

That is the order of operations EdgeLex enforces through EdgeCite, its citation governance layer. When a document is cite-checked — a draft brief, a memo, an opposing party's filing — citations are extracted and validated deterministically against an authority ledger before any AI inference touches the question. The ledger, built from the Free Law Project's CourtListener corpus, covers essentially every published US caselaw citation, and it lives inside the firm's own deployment. A citation either resolves against it or it does not. No model is consulted, no probability is weighed, and the lookup produces the same answer every time.

Keeping the ledger inside the deployment does two jobs at once. It means verification requires no data egress — the text of a draft brief never has to leave the firm's infrastructure to have its citations checked. And it means the baseline is provable: the firm can say exactly what corpus a citation was verified against, which is a very different posture from trusting a vendor's assurance that the AI is usually right about cases.

For citations the local ledger cannot resolve — a decision published last week, a contested or unusual cite — verification escalates to a live check against CourtListener. Fresh authority gets confirmed against the source rather than assumed, and the distinction between verified locally, verified live, and unverified is preserved in the result instead of being flattened into a single green checkmark.

AI where it belongs, humans where they belong

None of this makes AI useless in citation work — it puts AI in the right seat. Deterministic lookup answers the binary question of whether an authority exists. On top of that verified foundation, AI handles the genuinely fuzzy work: resolving a mangled or abbreviated cite to its likely target, matching a quotation to its source, reading how a document actually uses a case. The model is doing interpretation over verified inputs rather than manufacturing the inputs themselves.

And some questions belong to neither the lookup nor the model. Citations that need judgment — an ambiguous resolution, a cite the system cannot confidently classify — route to a human review queue rather than being silently passed or silently dropped. The output of a full-document cite-check is a report with verification status and counts: what verified, what escalated, what needs a lawyer's eyes. It is the difference between a system that tells you everything is fine and a system that shows you its work.

EdgeCite also maintains a citation graph — a record of how the firm's documents cite cases, with the context and the character of each mention: holding, dicta, criticism. Over time that turns citation checking from a per-document chore into an asset. When a case central to your argument gets treated critically in a later decision, the graph knows which of your documents lean on it.

The same pipeline runs in both directions of practice. Before your own brief goes out, a full cite-check validates everything it relies on. When opposing counsel files, the same machinery can be pointed at their authorities — and because EdgeLex supports standing AI delegations, that can be a standing instruction rather than a chore someone remembers: whenever opposing counsel files anything in the matter, verify every authority they cite and brief me. A fabricated or misdescribed citation in the other side's papers is worth finding early, and it is exactly the kind of mechanical vigilance that should not depend on an associate's spare hour.

Fabrication is a symptom. Governance is the treatment.

It is worth stepping back from citations to the general principle, because fabricated cases are just the most photogenic instance of it. A generative model padding over a gap in its knowledge is the same failure whether the gap is a case citation, a deadline, or a fact about your client. The treatment is the same too: identify the claims that admit deterministic verification, verify them outside the model, and gate what the model may assert on what the verification actually found.

In EdgeLex this is a platform-wide posture, not a citation feature. Answers must carry typed evidence — a document span, an email span, a rule authority, a verified citation — and a legal claim that cannot be grounded is blocked and shown as blocked. Citation validation is simply the sharpest edge of that architecture, aimed at the failure mode that has produced the most public damage.

For the lawyer signing the filing, the practical difference is what you are being asked to trust. A generate-then-hope tool asks you to trust the model, with your bar card as the backstop. A governed pipeline asks you to review a verification report — every citation resolved against a named corpus, unknowns escalated and marked, judgment calls queued for a human — before the document goes anywhere. One of those is a defensible supervision process. The other is the fact pattern in the sanctions decisions.