Disturbing Revelations - Annual Assessment of the IRS’s Information Technology Program

The Treasury Inspector General for Tax Administration (TIGTA) released its annual assessment of the IRS’s Information Technology (IT) Program for 2024. This review, based on audit reports from TIGTA and the Government Accountability Office (GAO), paints a mixed picture: while progress has been made in some areas, significant vulnerabilities and management failures persist. These issues threaten the security of taxpayer data, the effectiveness of IRS operations, and public trust in the agency.

Summary of Findings

The IRS is a massive and complex organization, collecting $5.1 trillion in federal tax payments and processing 267 million tax returns and forms in FY 2024. Its reliance on computerized systems is absolute, making IT security and modernization paramount. Despite efforts to modernize and secure its systems, the IRS faces mounting challenges due to funding cuts, workforce reductions, and persistent weaknesses in cybersecurity, access controls, and IT asset management.

Audits revealed that while the IRS is making strides in areas like identity proofing for its Direct File pilot and blocking suspicious email websites, it falls short in critical cybersecurity functions, proper management of user access, timely vulnerability remediation, and oversight of cloud services. Insider threats, incomplete audit trails, and inadequate separation of duties further exacerbate the risks.

Some Disturbing Revelations

• The IRS’s cybersecurity program was rated “not fully effective,” failing in three of five core cybersecurity functions (Identify, Protect, Detect), including shortcomings in system inventories, vulnerability remediation, encryption, and multifactor authentication.

• 279 former IRS users retained access to sensitive systems for up to 502 days after separation, exposing taxpayer data to unauthorized access and potential misuse.

• The IRS failed to timely remediate tens of thousands of critical and high-risk vulnerabilities, including 2,048 critical and 13,558 high-risk vulnerabilities in a single security application environment.

• Personally Identifiable Information (PII) for over 613,000 IRS user authentications was sent to unauthorized locations outside the U.S. due to a vendor’s flaw in the Login.gov system, placing sensitive data at risk.

• The IRS was unable to locate all cloud services contracts or determine their value for nearly half of its cloud applications, undermining financial oversight and increasing the risk of waste or duplication.

• 35% of IRS systems required to send audit trails for detecting unauthorized access to PII and Federal Tax Information failed to do so, severely limiting the ability to investigate or detect data breaches.

• The IRS did not fully comply with federal mandates to block TikTok on government devices, leaving more than 2,800 mobile devices and 900 computers potentially exposed to foreign surveillance risks.

• Inadequate separation of duties was found in 70% of reviewed cloud systems, with the same individuals controlling multiple key roles, heightening the risk of fraud or error going undetected.

• The IRS’s data loss prevention controls could be circumvented, allowing users to intentionally exfiltrate sensitive taxpayer data despite existing monitoring tools.

• Despite identifying 334 legacy systems needing updates or retirement, only 2 had specific decommissioning plans, leaving the IRS reliant on outdated, potentially insecure systems.

The findings underscore the need for the IRS to address IT security and management deficiencies. Without corrective action, the agency remains vulnerable to internal and external threats, risking taxpayer privacy, financial integrity, and the effective administration of the nation’s tax system.

Read the full report at this link: https://www.tigta.gov/sites/default/files/reports/2025-06/20252S0007fr.pdf

Recruiters Targeted by Fake Job Seekers in Malware Scam

Recruiters are facing a cyber threat as financially motivated hackers, notably the FIN6 group (also known as Skeleton Spider), shift tactics to social engineering campaigns. The attackers are posing as job seekers on popular platforms like LinkedIn and Indeed, luring unsuspecting recruiters into downloading malware via fake portfolio websites.

How the Scam Works

The scam starts when cybercriminals, pretending to be legitimate job applicants, reach out to recruiters through job-hunting platforms. After initial contact, they send a follow-up phishing email that directs the recruiter to a convincing online portfolio site. These sites, often hosted on Amazon Web Services (AWS), mimic authentic job seeker pages, sometimes using plausible names associated with the applicant.

To evade automated security systems, the phishing emails do not contain clickable hyperlinks. Instead, recruiters are prompted to manually type the provided web address into their browser, which helps the attackers bypass link-detection tools[1].

The Malware: More_eggs

Once on the fake portfolio site, the recruiter is asked to complete a CAPTCHA and other checks to prove they are human, further evading automated scanners. If they proceed, they are offered a ZIP file to download—purportedly a resume or work sample. Inside the ZIP is a Windows shortcut (.LNK) file that, when opened, executes a hidden JavaScript payload using wscript.exe. This payload connects to the attackers' command-and-control server and installs the More_eggs backdoor.

More_eggs is a modular, JavaScript-based malware-as-a-service tool that allows attackers to:

• Remotely execute commands
• Steal credentials
• Deliver additional malicious payloads

Notably, More_eggs operates in the memory of the users device, making it harder for traditional antivirus solutions to detect.

Evasion Tactics

FIN6 leverages several techniques to avoid detection and takedown:

• Anonymous Domain Registration: Domains are registered through GoDaddy with privacy services, obscuring the true identity of the registrants[1].
• Cloud Hosting: Hosting malicious sites on AWS infrastructure provides legitimacy and resilience against quick takedowns[1].
• Human Verification: CAPTCHAs and environmental checks ensure only real users (not automated scanners) reach the malware download stage[1].

Industry Response

AWS responded to the incident by reaffirming its commitment to enforcing its terms of service and collaborating with the security research community. The company encourages reporting of any suspected abuse through its dedicated channels for swift action.

Takeaways for Recruiters and Organizations

This campaign highlights the evolving landscape of cyber threats, where even those in hiring roles are now prime targets. Key steps for recruiters and organizations to protect themselves include:

• Treat unsolicited portfolio links with suspicion, especially if they require manual entry into a browser.
• Avoid downloading ZIP files or clicking on shortcut files from unknown or untrusted sources.
• Ensure endpoint security solutions are updated and capable of detecting in-memory malware.
• Report suspicious activity to IT or security teams immediately.

Recruiters and organization should be aware of the attacks and use caution with job applicants.

References

Disturbing Spying Revelations: Meta/Facebook/Instagram & Yandex

Overview:

The web page https://localmess.github.io/ discloses a previously undocumented and highly invasive tracking technique used by Meta (Facebook/Instagram) and Yandex that affected billions of Android users. Researchers [4] discovered that this method covertly linked users' mobile web browsing sessions to their identities in native apps, bypassing standard privacy protections. 

The practice was active until early June 2025, when both Meta and Yandex, after being caught with their hands in the proverbial PII cookie-jar, ceased these behaviors following public disclosure [1][2][3].

Key Findings

1. Covert Web-to-App Tracking via Localhost on Android

·       Meta and Yandex embedded scripts (Meta Pixel and Yandex Metrica) on millions of websites.

·       When a user visited such a site in a mobile browser on Android, the script would communicate directly with native apps (like Facebook, Instagram, or Yandex Maps) installed on the same device.

·       This communication happened via localhost sockets—special network ports on the device that allow apps to talk to each other without user knowledge or consent [1][3].

2. How the Tracking Worked

·       Meta Pixel:

o   The Meta Pixel JavaScript sent the browser’s _fbp cookie (used for advertising and analytics) to Meta apps via WebRTC (using STUN/TURN protocols) on specific UDP ports (12580–12585).

o   Native Facebook and Instagram apps listened on these ports in the background, received the _fbp value, and linked it to the user’s app identity, effectively de-anonymizing web visits[1][3].

o   This bypassed protections like cookie clearing, incognito mode, and Android permission controls.

·       Yandex Metrica:

o   Yandex’s script sent HTTP/HTTPS requests with tracking data to localhost ports (29009, 29010, 30102, 30103), where Yandex apps listened.

o   The apps responded with device identifiers (e.g., Android Advertising ID), which the script then sent to Yandex servers, bridging web and app identities[1].

3. Privacy and Security Implications

·       This method allowed companies to:

o   Circumvent privacy mechanisms such as incognito mode, cookie deletion, and even Android’s app sandboxing.

o   Link browsing habits and cookies with persistent app/user identifiers, creating a cross-context profile of the user.

o   Potentially expose browsing history to any third-party app that listened on those ports, raising the risk of malicious exploitation[1][3].

4. Prevalence

·       Meta Pixel was found on over 5.8 million websites; Yandex Metrica on nearly 3 million.

·       In crawling studies, thousands of top-ranked sites were observed attempting localhost communications, often before users had given consent to tracking cookies[1].

5. Timeline and Disclosure

·       Yandex has used this technique since 2017; Meta adopted similar methods in late 2024.

·       Following responsible disclosure to browser vendors and public reporting in June 2025, both companies stopped the practice. Major browsers (Chrome, Firefox, DuckDuckGo, Brave) have since implemented or are developing mitigations to block such localhost abuse[1][3]

Technical Details

Aspect	Meta/Facebook Pixel	Yandex Metrica
Communication Method	WebRTC STUN/TURN to UDP ports (12580–12585)	HTTP/HTTPS requests to TCP ports (29009, etc.)
Data Shared	_fbp cookie, browser metadata, page URLs	Device IDs (AAID), browser metadata
Apps Involved	Facebook, Instagram	Yandex Maps, Browser, Navigator, etc.
User Awareness	None; bypassed consent and privacy controls	None; bypassed consent and privacy controls
Platform Affected	Android only (no evidence for iOS or desktop)	Android only (no evidence for iOS or desktop)
Risk of Abuse	High: enables de-anonymization, history leakage	High: enables de-anonymization, history leakage

Broader Implications

·       Bypassing Privacy Controls:
This method undermined the effectiveness of cookie controls, incognito/private browsing, and Android’s app isolation, showing that even sophisticated privacy tools can be circumvented by creative inter-app communications[1][3].

·       Need for Platform-Level Fixes:
Browser and OS vendors are now patching this specific exploit, but the underlying issue—unrestricted localhost socket access—remains a systemic risk on Android. The researchers call for stricter platform policies and user-facing controls for localhost access[1].

·       User and Developer Awareness:
Most website owners were unaware their sites enabled this tracking. End-users had no indication or control over the process. The lack of transparency and documentation from Meta and Yandex is highlighted as a major concern[1].

Conclusion

The research revealed a disturbing tracking vector that allowed Meta and Yandex to link users’ web and app identities on Android at a massive scale, defeating standard privacy safeguards. The disclosure led to rapid mitigation, but the incident underscores the need for deeper systemic changes in how browsers and mobile platforms handle inter-app communications and tracking[1][2][3]. “This tracking method defeats Android's inter-process isolation and tracking protections based on partitioning, sandboxing, or clearing client-side state.”[1]

1.      https://localmess.github.io

2.      https://www.grc.com/sn/sn-1029-notes.pdf

3.      https://gigazine.net/gsc_news/en/20250604-meta-yandex-tracking/

4.      Researchers & Authors of the localmess github page: Aniketh Girish (PhD student),  Gunes Acar (Assistant Professor),  Narseo Vallina-Rodriguez (Associate Professor), Nipuna Weerasekara (PhD student), Tim Vlummens (PhD student).

Note: Perplexity.AI was used to assist in preparing this report.

Google's AI Glasses and Implications for Law Enforcement

Google announced a series of partnerships with eyewear companies to develop glasses that incorporate artificial intelligence (AI), marking a significant step in the evolution of wearable technology and its integration into daily life and professional sectors, including law enforcement.

Google's AI Glasses Partnerships

Google has committed up to $150 million to work with Warby Parker on development and sale of AI-powered smart glasses, leveraging the Android XR platform and Gemini AI model[1][2][10]. The initiative extends to partnerships with other eyewear brands, such as Gentle Monster and Kering, and includes a broader collaboration with Samsung to build both the hardware and software foundation for future AR glasses[6][8][10]. The glasses will feature cameras, microphones, and speakers, providing hands-free access to information, live translation, and integration with users’ smartphones[3][10]. Google states that their approach emphasizes making these devices both functional and suitable for all-day wear, with plans to involve developers in building applications for the platform later this year[6][10].

Implications for Law Enforcement

The integration of AI into smart glasses has implications for law enforcement operations:

• Real-Time Data Access and Situational Awareness: AI-enabled glasses can provide officers with immediate access to critical information, such as suspect identification, navigation, and threat assessments, directly within their field of view[4][9][11]. This can streamline investigations, support enforcement actions, and enhance officer safety.

• Facial Recognition and Surveillance: Smart glasses equipped with AI-driven facial recognition can rapidly compare faces in real time against law enforcement databases, aiding in the identification of suspects and missing persons[4][7][11]. Such systems have already been deployed in various jurisdictions, including China, Dubai, and New York, where they have improved the speed and accuracy of suspect recognition[4][7][11].

• Evidence Collection and Communication: The ability to record and transmit evidence in real time, as well as translate languages or communicate with dispatch and other officers, can improve operational efficiency and support community engagement[4][11].

• Privacy and Ethical Concerns: The widespread use of AI-powered smart glasses raises privacy issues. Real-time surveillance and facial recognition capabilities may lead to concerns about data security, potential misidentification, and the erosion of privacy in public spaces[4][5][9]. Research and pilot programs have emphasized the need for ethical frameworks, clear protocols, and legislation to govern the use of such technologies in law enforcement, aiming to balance operational benefits with the protection of civil liberties[4][9][11].

Challenges and Considerations

• Public Trust and Acceptance: The deployment of AI smart glasses by law enforcement requires transparency and public engagement to address concerns about surveillance and misuse[4][9][11].
• Technical and Operational Readiness: Successful integration depends on reliable hardware, effective AI algorithms, and compatibility with existing law enforcement databases and workflows[4][11].
• Legislation and Policy: Policymakers should consider establishing clear guidelines for the appropriate use of smart glasses, including data handling, retention, and oversight mechanisms[4][9].

Conclusion

Google’s partnerships to develop AI-powered smart glasses signal a shift toward more immersive and context-aware wearable technology. For law enforcement, these advancements offer new tools for real-time information access, surveillance, and communication. However, adoption should be accompanied by consideration of privacy, and ethics to ensure lawful use.

Citations:

[1] https://techcrunch.com/2025/05/20/google-commits-150m-to-develop-ai-glasses-with-warby-parker/

[2] https://www.wsj.com/business/warby-parker-partners-with-google-to-develop-intelligent-eyewear-aabedfb2

[3] https://www.cnet.com/tech/computing/exclusive-google-sees-xr-smart-glasses-as-the-ultimate-use-for-ai-with-warby-parker-samsung-and-xreal-on-deck/

[4] https://ijsret.com/2025/03/29/enhancing-law-enforcement-with-smart-glasses-a-comprehensive-investigation-into-real-time-criminal-detection-using-ai-and-machine-learning/

[5] https://www.foxnews.com/tech/facial-recognition-glasses-turn-everyday-life-creepy-privacy-nightmare

[6] https://blog.google/products/android/android-xr-gemini-glasses-headsets/

[7] https://kustomsignals.com/blog/smart-glasses-the-latest-police-weapon-against-crime

[8] https://www.cnbc.com/2025/05/21/sergey-brin-google-glass-android-xr.html

[9] https://pmc.ncbi.nlm.nih.gov/articles/PMC10446065/

[10] https://www.pymnts.com/google/2025/google-to-partner-with-eyewear-brands-on-ai-equipped-smart-glasses/

[11] https://www.police1.com/vision/the-transformative-impact-of-wearable-technologies

[12] https://www.reuters.com/business/google-unveil-ai-upgrades-io-conference-amid-search-challenges-2025-05-20/

[13] https://finance.yahoo.com/news/google-announces-smart-glasses-partnerships-as-it-takes-on-meta-apple-preps-its-own-eyewear-034542364.html

[14] https://www.boozallen.com/insights/velocity/another-set-of-eyes.html

[15] https://www.vuzix.com/blogs/vuzix-blog/smart-glasses-and-the-future-of-law-enforcement

[16] https://www.zdnet.com/article/googles-upcoming-ai-smart-glasses-may-finally-convince-me-to-switch-to-a-pair-full-time/

[17] https://hypebeast.com/2025/5/google-gentle-monster-ai-smart-eyewear-partnership-android-xr-announcement

[18] https://kustomsignals.com/blog/ai-technology-promoting-better-public-safety

[19] https://www.futurepolicing.org/explaining-ai/the-double-edged-sword-of-ai-in-police-reporting

[20] https://www.reddit.com/r/privacy/comments/1khl1xh/meta_has_resumed_research_on_real_time_facial_id/

Understanding False-Positive Hallucinations in AI Research: Implications for Academic Integrity

The emergence of generative artificial intelligence tools transformed academic research. While these tools offer significant assistance in content generation, they also introduce unique challenges-particularly the phenomenon known as "hallucinations." This (AI-assisted) analysis explores the nature, prevalence, and implications of false-positive hallucinations in AI-assisted academic work, along with strategies for educators and students.

Defining False-Positive Hallucinations in AI Research

AI hallucinations occur when large language models (LLMs) generate content that appears factual and authoritative but is actually incorrect, fabricated, or misleading. In the academic context, false-positive hallucinations specifically refer to instances where AI systems confidently present fabricated information as legitimate scholarly content.

Recent research defines hallucinations as occurring "anytime an AI responds incorrectly to a prompt that it should be able to respond correctly to," with outputs presented as facts within an otherwise factual context despite their fundamental flaws[12]. A more nuanced taxonomy categorizes hallucinations based on their degree (mild, moderate, alarming), orientation (factual mirage or silver lining), and specific types such as acronym ambiguity, numeric nuisance, generated golem, virtual voice, geographic erratum, and time wrap[2].

Unlike traditional misinformation, AI hallucinations emerge not from human intent to deceive but from probabilistic processes within the models themselves. This distinction prompted researchers to propose conceptual frameworks that treat AI hallucinations as a distinct form of misinformation requiring specialized understanding and mitigation approaches[10].

The most concerning manifestation in academic contexts is the generation of seemingly legitimate citations and references that don't actually exist. These fabricated references often appear remarkably convincing, using names of authors with previous relevant publications, creating plausible titles, and formatting citations in credible journal styles[3][8].

Types of Academic Hallucinations

Academic hallucinations typically manifest in several forms:

1. Reference fabrication: Generation of non-existent academic sources
2. Fact fabrication: Creation of plausible but false statistical data or research findings
3. Expert fabrication: Attribution of statements to non-existent or misrepresented authorities
4. Methodological fabrication: Description of studies or experiments that never occurred

Prevalence of False-Positive Hallucinations in Academic AI

The prevalence of AI hallucinations in academic contexts is alarmingly high across various disciplines. In the medical domain, a systematic analysis of ChatGPT responses to medical questions revealed that 69% of references provided were completely fabricated, despite appearing authentic and professionally formatted[8]. The responses themselves demonstrated limited quality with a median score of 60% as rated by medical experts, who identified both major and minor factual errors throughout the evaluated content[8].

Legal research tools incorporating AI technologies fare somewhat better but still exhibit significant hallucination rates. An evaluation of leading legal research AI systems including LexisNexis (Lexis+ AI) and Thomson Reuters (Westlaw AI-Assisted Research and Ask Practical Law AI) found hallucination rates between 17% and 33%, despite vendors' claims of "hallucination-free" legal citations[14].

These findings contradict optimistic marketing claims that retrieval-augmented generation (RAG) and similar techniques have "eliminated" or "avoided" hallucinations in specialized academic AI tools. While RAG does reduce hallucination rates compared to general-purpose chatbots, it clearly has not resolved the issue entirely[14].

The problem extends beyond specialized tools to general-purpose LLMs used directly by students and researchers. A preliminary investigation of ChatGPT revealed its tendency to generate fake peer-reviewed citations that appear legitimate but are entirely fabricated through predictive processes rather than factual knowledge[3].

Notable Examples of False-Positive Hallucinations in Academia

Several documented instances illustrate the real-world impact of AI hallucinations in academic settings:

Medical Research Hallucinations

A particularly concerning example comes from medical research, where ChatGPT provided responses containing both major and minor factual errors when answering medical questions. In one instance, when prompted to provide references for its claims, the AI generated a citation to a seemingly authoritative journal article-complete with real researcher names and a plausible title-that simply did not exist[8]. This fabrication is especially problematic in medical contexts where treatment decisions might be influenced by such misinformation.

Legal Research Fabrications

In the legal domain, AI research tools have been documented producing non-existent case law citations. A preregistered empirical evaluation demonstrated that proprietary legal AI tools would create citations to court cases that never occurred or substantially misrepresent the holdings of real cases[14]. What makes these hallucinations particularly dangerous is their presentation within otherwise factually accurate content, making detection challenging for even experienced legal professionals.

Academic Writing Distortions

In academic writing contexts, AI tools have generated fake journal articles, conferences, and even entire research institutions that sound plausible but don't actually exist. The fabricated references often follow proper citation formats and include realistic publication dates, journal names, and volume numbers-all contributing to their deceptive authenticity[3].

What makes these examples particularly troubling is the confidence with which AI systems present hallucinated information, often seamlessly integrating fabrications with factual content. This blending makes detection challenging without thorough verification of every claimed source.

Should Instructors Require URLs to Source Materials?

Given the prevalence of AI hallucinations, the question arises whether instructors should require students to provide direct URLs to source materials referenced in their submissions.

Arguments Supporting URL Requirements

Requiring URLs to source materials creates an additional verification layer that could significantly reduce the risk of undetected hallucinations. This approach:

1. Forces students to verify that their sources actually exist before submission
2. Streamlines the instructor's verification process
3. Creates a habit of source verification that serves students throughout their academic careers
4. Aligns with emerging institutional policies on AI use in academic writing[13]

A survey of policies from top universities in English-speaking countries reveals a trend toward requiring transparency in AI use, with explicit guidelines for both academic staff and students[13]. Extending these transparency requirements to include verifiable source links represents a logical evolution of these policies.

Arguments Against Strict URL Requirements

However, mandatory URL requirements present several challenges:

1. Not all legitimate academic sources have accessible URLs (physical books, paywalled content, etc.)
2. The focus on URLs might prioritize digital sources over print resources
3. Implementation could create additional workload for both students and instructors
4. URL verification alone doesn't guarantee content accuracy

The increasing integration of AI writing tools into academic environments suggests that education should focus on responsible use rather than prohibition[5]. Surveys of EFL university students indicate that these tools are already actively used for enhancing writing quality, with tools like Grammarly and ChatGPT being particularly favored[5][11].

Balanced Recommendation

A balanced approach would involve requiring URLs or other definitive source identifiers (DOIs, ISBN numbers, etc.) for key claims and statistics while focusing on broader verification skills. Instructors should develop clear guidelines for AI use in academic writing that emphasize transparency about AI assistance while teaching responsible verification practices[9][13].

Strategies for Students to Address False-Positive Hallucinations

Students can take several proactive steps to minimize the risk of including hallucinated content in their academic submissions:

1. Verify Every Citation

When using AI tools for research assistance or writing support, students should verify every citation and factual claim generated. This verification process should include:

• Confirming the existence of cited sources through library databases or academic search engines
• Cross-checking key facts with multiple reliable sources
• Being particularly cautious with statistical claims and specific numerical data[3][8].
• Use in-text citations associated with the references in a References section of academic submissions. 

2. Use AI as a Supplement, Not a Replacement

Research on EFL students' experiences with ChatGPT suggests that the most successful approach involves using AI as a supporting tool rather than the primary source of content. Students benefit most when using AI for:

• Overcoming uncertainties
• Clarifying vocabulary
• Receiving content suggestions that they then critically evaluate and refine

This approach enhances essay quality by allowing students to focus on creative aspects while maintaining authenticity in their work[11].

3. Develop Critical Evaluation Skills

Students should develop and apply critical thinking skills specifically adapted to evaluating AI-generated content. This includes:

• Questioning implausible or too-perfect statistics
• Being skeptical of convenient but unsourced claims
• Looking for internal consistency in arguments and evidence
• Recognizing that AI tends to provide overly complex suggestions that may lack cultural sensitivity[11]

4. Declare AI Usage Transparently

Transparency regarding AI tool usage is increasingly recognized as an ethical requirement in academic writing. Students should:

• Follow institutional guidelines for declaring AI assistance
• Specify which portions of their work were AI-assisted
• Describe their verification process
• Maintain a clear distinction between AI-suggested content and their original analysis[9]

A study of transparency in academic research journals found that 37.6% of nursing studies journals now require explicit statements about generative AI use in their authors' guidelines, indicating a growing expectation for transparency[9].

5. Utilize Multiple Tools and Approaches

Students can reduce hallucination risks by:

• Using multiple AI tools and comparing outputs
• Employing specialized AI detection tools to identify potentially hallucinated content
• Combining AI assistance with traditional research methods
• Seeking human feedback from peers, writing centers, or instructors[11][13]

Conclusion

False-positive hallucinations represent a significant challenge in AI-assisted academic research, with documented prevalence across disciplines including medicine, law, and general academic writing. The ability of AI systems to generate convincing yet entirely fabricated references and facts threatens academic integrity and the reliability of scholarly work.

Rather than prohibiting AI tools, educational institutions should develop comprehensive policies that balance innovation with integrity. These policies should emphasize transparency, verification, and responsible use while equipping students with the critical skills needed to detect and avoid hallucinated content.

For students, the key to successful navigation of this new landscape lies in developing a balanced approach-leveraging AI's capabilities for improving writing quality and efficiency while maintaining rigorous verification practices and critical evaluation of all AI-generated content.

As AI evolves, so too must the approaches to academic integrity. By acknowledging the challenges posed by hallucinations and implementing targeted strategies to address them, academia can harness the benefits of AI while preserving the values of rigor and honesty.

Citations:

[1] https://www.semanticscholar.org/paper/c7a54be535e0d1f2715b214e598109e05e6f7507

[2] https://arxiv.org/abs/2310.04988

[3] https://www.semanticscholar.org/paper/324bee1adcaafc336f0255980db8544fe883449f

[4] https://arxiv.org/pdf/2401.06796.pdf

[5] https://www.semanticscholar.org/paper/8d716fe6571ef65bf61e4563e58d0d04c190e6ca

[6] https://www.semanticscholar.org/paper/8d3c4171a3f0e873596702688f9318e71bb22d6f

[7] https://arxiv.org/abs/2405.09589

[8] https://www.ncbi.nlm.nih.gov/pmc/articles/PMC11975740/

[9] https://pubmed.ncbi.nlm.nih.gov/37904646/

[10] https://arxiv.org/abs/2504.13777

[11] https://www.semanticscholar.org/paper/6656081678c7777d59ada86713fc03beb584caeb

[12] https://www.semanticscholar.org/paper/40804fcbf832bf4642f1329c20cfb3d505d7e7d2

[13] https://www.semanticscholar.org/paper/86dd7119a3f29d66fd379cbcc1241344c8c8e105

[14] https://arxiv.org/abs/2405.20362

[15] https://www.semanticscholar.org/paper/a653040e98acdd2b6bc87f64985b5ace8646de88

[16] https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6322788/

[17] https://www.semanticscholar.org/paper/e1fdda1c63b11b42df98a1e2bb348d1853fc6f5f

[18] http://arxiv.org/pdf/2412.15264.pdf

[19] http://arxiv.org/pdf/2405.19648.pdf

[20] https://arxiv.org/pdf/2501.13946.pdf

[21] https://arxiv.org/abs/2406.04175

[22] https://arxiv.org/abs/2410.22349

[23] https://arxiv.org/html/2407.05474v1

[24] https://arxiv.org/html/2502.01812v1

[25] https://en.wikipedia.org/wiki/Hallucination_(artificial_intelligence)

[26] https://pmc.ncbi.nlm.nih.gov/articles/PMC10483440/

[27] https://originality.ai/blog/ai-hallucination-factual-error-problems

[28] https://pmc.ncbi.nlm.nih.gov/articles/PMC11681264/

[29] https://www.aryaka.com/blog/ai-hallucinations-in-cybersecurity/

[30] https://www.ibm.com/think/topics/ai-hallucinations

[31] https://www.forbes.com/sites/conormurray/2025/05/06/why-ai-hallucinations-are-worse-than-ever/

[32] https://www.amu.apus.edu/docs/shared/success-center-pdfs/caution-about-ai-hallucinations---all-text.pdf

[33] https://www.datacamp.com/blog/ai-hallucination

[34] https://bhmpc.com/2024/12/ai-hallucination/

[35] https://www.semanticscholar.org/paper/88b6efb0edc940847704c73701f61b82ff85fdf6

[36] https://www.semanticscholar.org/paper/87acf1f6c7f6fcf6bde6b7298063271d10b275d5

[37] http://arxiv.org/pdf/2403.08542v1.pdf

[38] https://arxiv.org/pdf/2406.12221.pdf

[39] https://cloud.google.com/discover/what-are-ai-hallucinations

[40] https://mitsloanedtech.mit.edu/ai/basics/addressing-ai-hallucinations-and-bias/

[41] https://www.techtarget.com/whatis/definition/AI-hallucination

[42] https://hechingerreport.org/proof-points-combat-ai-hallucinations-math/

[43] https://builtin.com/artificial-intelligence/ai-hallucination

[44] https://neilpatel.com/blog/ai-hallucination/

[45] https://lennartnacke.com/how-to-prevent-ai-hallucinations-in-academic-work/

[46] https://arxiv.org/abs/2504.18423

[47] https://www.semanticscholar.org/paper/67e67ac9484d54fd48e5273564271432da5fc398

[48] http://arxiv.org/pdf/2402.19103.pdf

[49] https://www.forbes.com/sites/shashankagarwal/2024/06/12/battling-ai-hallucinations--detect-and-defeat-false-positives/

[50] https://vancouver.northeastern.edu/dont-be-surprised-by-ai-chatbots-creating-fake-citations/

[51] https://www.reddit.com/r/AcademicPsychology/comments/1cbqqv1/false_positive_with_ai_detector/

[52] https://www.nature.com/articles/s41598-023-41032-5

[53] https://www.semanticscholar.org/paper/01b6515d7ccd16d4e46acdb344dbd8f9ca5d7629

[54] https://www.semanticscholar.org/paper/c4f006c02190ddd7ece01542c3f0089c3be6ab7a

[55] https://arxiv.org/html/2411.03108v2

[56] http://arxiv.org/pdf/2406.15130.pdf

[57] https://teche.mq.edu.au/2023/02/why-does-chatgpt-generate-fake-references/

[58] https://www.reddit.com/r/OpenAI/comments/105pib0/chatgpt_gives_me_references_i_cant_find_back/

[59] https://blogs.library.duke.edu/blog/2023/03/09/chatgpt-and-fake-citations/

[60] https://www.enttoday.org/article/chatgpt-generated-fake-references-in-academic-manuscripts-is-a-problem/

[61] https://www.psypost.org/chatgpt-hallucinates-fake-but-plausible-scientific-citations-at-a-staggering-rate-study-finds/

[62] https://guides.library.illinois.edu/generativeAI/hallucinations

[63] https://www.tidio.com/blog/ai-hallucinations/

[64] https://www.asccc.org/sites/default/files/ASCCC_AI_Resources_2024.pdf

[65] https://pmc.ncbi.nlm.nih.gov/articles/PMC10277170/

[66] https://www.semanticscholar.org/paper/7bef4b1b091bd0957e6f2a8eade4053613307ad7

[67] https://arxiv.org/abs/2504.08832

[68] https://arxiv.org/pdf/2401.11817.pdf

[69] https://www.nature.com/articles/s41599-024-03811-x

[70] https://www.coursera.org/articles/ai-hallucinations

[71] https://detecting-ai.com/blog/ultimate-guide-to-hallucination-detection-metrics

[72] https://academic.oup.com/jla/article/16/1/64/7699227

[73] https://www.ecampusnews.com/featured/2023/09/05/detect-ai-generated-text/

[74] https://arxiv.org/html/2401.06796v1

[75] https://pmc.ncbi.nlm.nih.gov/articles/PMC2702442/

[76] https://datascientest.com/en/understanding-ai-hallucinations-causes-and-consequences

[77] https://arxiv.org/abs/2310.10627

[78] https://pubmed.ncbi.nlm.nih.gov/38516933/

[79] https://www.semanticscholar.org/paper/24e9a44f0bf645583603c7ee03bdddd71831bef6

[80] https://www.thesify.ai/blog/teaching-ethical-ai-in-academic-writing-a-guide-for-professors-and-instructors

[81] https://poorvucenter.yale.edu/AIguidance

[82] https://www.montclair.edu/faculty-excellence/ofe-teaching-resources/clear-course-design/practical-responses-to-chat-gpt/red-flags-detecting-ai-writing/

[83] https://www.facultyfocus.com/articles/teaching-with-technology-articles/mitigating-hallucinations-in-llms-for-community-college-classrooms-strategies-to-ensure-reliable-and-trustworthy-ai-powered-learning-tools/

[84] https://community.canvaslms.com/t5/Canvas-Question-Forum/Speedgrader-Website-URL-submission-with-no-preview/td-p/481971

[85] https://www.vpaa.uillinois.edu/digital_risk_management/generative_ai/instructors

[86] https://craigball.net/2023/12/11/policy-for-student-use-of-ai/

[87] https://honorcode.nd.edu/ai-recommendations-for-instructors/

[88] https://www.vanderbilt.edu/generative-ai/academic-integrity/

[89] https://arxiv.org/abs/2504.17550

[90] https://www.semanticscholar.org/paper/04cc443974ce641d3d1de381070d87ff630238db

[91] https://arxiv.org/pdf/2311.05232.pdf

[92] https://library.potsdam.edu/AI_Ethics/Hallucinations

[93] https://www.asapp.com/blog/preventing-hallucinations-in-generative-ai-agent

[94] https://www.mobihealthnews.com/news/study-ai-hallucinations-limit-reliability-foundation-models

[95] https://www.semanticscholar.org/paper/e5f183ffafd74e2fba831420fa1f3e5f07b7ce2d

[96] https://arxiv.org/abs/2402.06647

[97] https://arxiv.org/pdf/2407.08039.pdf

[98] https://arxiv.org/abs/2401.11817

[99] https://www.lakera.ai/blog/guide-to-hallucinations-in-large-language-models

[100] https://www.gigaspaces.com/data-terms/llm-hallucinations

[101] https://pmc.ncbi.nlm.nih.gov/articles/PMC10619792/

[102] https://my.clevelandclinic.org/health/symptoms/23350-hallucinations

[103] https://arxiv.org/abs/2311.05232

[104] https://arxiv.org/html/2504.07863v1

[105] http://arxiv.org/pdf/2403.06710.pdf

[106] https://arxiv.org/pdf/2402.13331.pdf

[107] https://arxiv.org/pdf/2503.00436.pdf

[108] https://arxiv.org/html/2410.10408v1

[109] https://www.semanticscholar.org/paper/a0a26cc12a8dddf91267b21ae703291257cdcf85

[110] https://arxiv.org/abs/2408.09429

[111] https://arxiv.org/abs/2408.07852

[112] https://pubmed.ncbi.nlm.nih.gov/8870325/

[113] https://arxiv.org/abs/2403.17306

[114] https://www.semanticscholar.org/paper/88cdca57a248f7d1d9a0667834dc9f9af24bd2be

[115] https://arxiv.org/pdf/2401.06796.pdf

[116] https://arxiv.org/abs/2503.05777

[117] https://arxiv.org/abs/2401.01572

[118] http://arxiv.org/pdf/2403.12244.pdf

[119] http://arxiv.org/pdf/2502.12187.pdf

[120] http://arxiv.org/pdf/2403.17306.pdf

[121] https://arxiv.org/abs/2308.15126

[122] http://arxiv.org/pdf/2503.06149.pdf

[123] https://arxiv.org/abs/1811.10800

[124] https://www.semanticscholar.org/paper/9ad28ee68c50627ffb107daa0a7d2a48fda270e6

[125] https://www.semanticscholar.org/paper/88bb5edda1ef91b1af2fd22b546c542a6df39ba2

[126] https://www.semanticscholar.org/paper/04a8cf33d0d3ea6b937e791354e62bb3f53d291e

[127] https://www.semanticscholar.org/paper/a851bba1e6f67122eb6a0ad9ae4f55a52d1e3874

[128] https://www.ncbi.nlm.nih.gov/pmc/articles/PMC10350445/

[129] https://www.ncbi.nlm.nih.gov/pmc/articles/PMC10323419/

[130] https://arxiv.org/abs/2503.14933

[131] https://arxiv.org/pdf/2404.04845.pdf

[132] https://arxiv.org/pdf/2310.06498.pdf

[133] https://arxiv.org/pdf/2306.06085.pdf

[134] https://arxiv.org/pdf/2311.14648.pdf

[135] https://arxiv.org/pdf/2401.03205.pdf

[136] http://arxiv.org/pdf/2503.05806.pdf

[137] https://www.semanticscholar.org/paper/13f004cdf3df3496bcf90e1e07456ea371a484d1

[138] https://www.semanticscholar.org/paper/c9e049592d7630c3805c7b94fd66a7b311547cc6

[139] https://pubmed.ncbi.nlm.nih.gov/37442292/

[140] https://www.semanticscholar.org/paper/c984da7a7689948294693f2f8345f15528b26923

[141] https://arxiv.org/abs/2406.15130

[142] https://www.semanticscholar.org/paper/68bd6debf2edae10c8750d981491589224f0d2e3

[143] http://arxiv.org/pdf/2309.09401.pdf

[144] https://arxiv.org/ftp/arxiv/papers/2308/2308.03301.pdf

[145] http://arxiv.org/pdf/2308.11767.pdf

[146] http://arxiv.org/pdf/2310.05046.pdf

[147] https://arxiv.org/abs/2305.05133

[148] https://arxiv.org/pdf/2402.08467.pdf

[149] http://arxiv.org/pdf/2305.13534.pdf

[150] https://arxiv.org/pdf/2312.11870.pdf

[151] https://www.semanticscholar.org/paper/6bf4e95e63df023c81458ec60a8324788535a2f4

[152] https://arxiv.org/abs/2310.04988

[153] https://www.semanticscholar.org/paper/cf67e6eddedbed026b6e6bebedd010cee8dcc0f5

[154] https://www.semanticscholar.org/paper/c77058caeb3eb79e69b12968d02c11690fbeeb28

[155] https://www.semanticscholar.org/paper/adc549943b8ac320b9d1a2e4a9277ee66de9b048

[156] https://www.semanticscholar.org/paper/1755a4bf7472e9b69a1f53b26b0b86faf315df41

[157] https://www.semanticscholar.org/paper/abb7d581d278ace41100019cb745a1b5c2178c98

[158] https://arxiv.org/pdf/2312.05209.pdf

[159] https://arxiv.org/abs/2405.09589

[160] https://www.semanticscholar.org/paper/69703c222a5c11c2bb7d0a78195f0985e5e5afd0

[161] https://www.semanticscholar.org/paper/b886924472c55d68ddda5bab195c0ecbd145e849

[162] https://www.semanticscholar.org/paper/e99c9b0dd750bece8bef047e4058605c5ab1d79a

[163] https://www.semanticscholar.org/paper/a953654628dee771445ea2da8314adfd24796d55

[164] https://arxiv.org/abs/2311.14720

[165] https://arxiv.org/pdf/2309.06794.pdf

[166] https://arxiv.org/pdf/2501.13946.pdf

[167] https://arxiv.org/pdf/2310.17143.pdf

[168] https://arxiv.org/pdf/2502.05698.pdf

[169] https://arxiv.org/pdf/2304.02478.pdf

[170] https://www.semanticscholar.org/paper/f27dd152582b9da3c3a879025eceaebbf2a50752

[171] https://www.semanticscholar.org/paper/f5c3faa8002fcaa458c023bf6e2f44ec83d89fbe

[172] https://www.semanticscholar.org/paper/1edab696120cd508731a8a20e25bf600e8838a18

[173] https://arxiv.org/abs/2401.06796

[174] https://www.semanticscholar.org/paper/6f1643e182bafe77e12b288b5ffcbfc6110a368f

[175] https://arxiv.org/pdf/2401.06792.pdf

[176] https://arxiv.org/abs/2404.03732

[177] https://arxiv.org/abs/2406.08184

[178] https://arxiv.org/abs/2503.17309

[179] https://arxiv.org/abs/2410.03026

[180] https://arxiv.org/pdf/2402.09733.pdf

[181] https://arxiv.org/html/2404.07461v2

[182] https://arxiv.org/pdf/2402.01769.pdf

[183] https://www.arxiv.org/pdf/2402.06647.pdf

[184] http://arxiv.org/pdf/2502.11113.pdf

[185] https://arxiv.org/pdf/2502.16143.pdf

 

Note: The author was assisted by Artificial Intelligence in the creation of this document. Efforts were made to verify the source material. 

https://kardasz.blogspot.com/2025/05/understanding-false-positive.html

 

Frank Kardasz, May 16, 2025