HKUST proposes LexAgentHallu to trace hidden hallucinations in legal agents

Legal large models are moving from single-turn Q&A to agents: systems no longer just generate a piece of text, but plan tasks, call retrieval tools, read materials, and continue acting based on intermediate results. LexAgentHallu, proposed by a research team at HKUST, precisely expands the observation target from the final answer to the complete trajectory and localizes errors to specific steps.

The reason for this shift is that the way errors propagate has changed. Writing a statute name incorrectly may only leave a textual error; treating a repealed provision as current law, or treating a lower-level norm as a higher-level one, may alter subsequent rule selection, fact application, and remedy recommendations. The risk of agents therefore comes not only from fabrication, but also from finding real materials but using them incorrectly, calling the right tool but filling in wrong parameters, or seeing relevant results but misreading the scope of their support.

LexAgentHallu therefore checks step by step along the execution trajectory: how the system plans, what tools it calls, what results it reads, what information it retains, and how it connects facts with rules. Evaluation no longer only asks whether the conclusion is correct, but also checks whether the reasons supporting the conclusion are true, accurate, and internally consistent.

LexAgentHallu establishes a two-layer taxonomy. The first layer focuses on legal content itself, including errors in legal sources, legal principles, procedural rules, and fact application; the second layer focuses on the agent execution process, including errors in planning and reasoning, memory, and tool invocation and interpretation of observations. Together, the two layers contain 7 mid-level categories and 27 fine-grained subcategories.

The purpose of the taxonomy is not to give errors a new set of names, but to make problems localizable: fabricated legal sources require citation verification, fact-rule mismatches require rechecking the elements, tool parameter errors require constraining the invocation interface, and memory drift points to context management.

The benchmark construction revolves around hard cases and verifiability: the research team collected data from multiple types of legal tasks, filtered out easy samples, then had annotators with legal training backgrounds check answers, legal sources, and reasoning trajectories, and finally completed hallucination classification and expert review. The final collection includes 3,414 instances, covering 17 legal categories and 6 task types.

The paper evaluated 18 closed-source and open-source agent configurations. The results show that even for the best-performing configuration, 89% of execution trajectories still had at least one hallucination; all systems had a legal content hallucination frequency of no less than 87.5%.

This set of results does not mean that all legal answers carry the same risk. What it shows is that in this evaluation, which emphasizes difficult samples and complete execution trajectories, current systems find it very difficult to maintain a clean, verifiable reasoning chain from beginning to end.

Models, tools, and orchestration methods also jointly change the error distribution. ReAct-style action-observation loops have an advantage in overall hallucinations and legal content hallucinations; legal-specific workflows are better at reducing process errors; the approach of planning in advance and then executing did not show a stable lead in this experiment. Therefore, when deploying agents, models, tools, and processes cannot be evaluated separately.

The paper proposes the RAWR metric, namely Right-Answer-Wrong-Reason, which only looks at samples with correct final answers and then checks whether hallucinations still exist in the execution trajectories of these samples. The results show that even when the answer is correct, on average 68% of trajectories still contain at least one type of legal content hallucination, and 37% of trajectories contain at least one type of agent process hallucination.

A correct answer only shows that the conclusion hit the mark; it cannot prove that the reasoning chain is clean. For applications such as legal consultation, contract review, and litigation assistance, users need not just a sentence that looks correct, but also a chain of reasons that can be traced, verified, and withstand questioning. If the system only gives conclusions at the output end without exposing the quality of citations, reasoning, and tool calls, errors may continue to persist under the appearance of a correct answer.

Hallucination frequencies are not uniform across tasks. Open-ended, long-chain tasks that require integrating facts and rules are more likely to expose legal content and process errors: the legal content hallucination frequency for judgment analysis reached 1.00, and for case analysis 0.95; among process hallucinations, judgment analysis reached 0.83 and judgment prediction 0.71. Shorter outputs are not necessarily safe—as long as a task requires multi-step evidence integration, deadline judgment, or rule application, planning and memory can still become risk points.

The paper also analyzed the co-occurrence relationships among 27 fine-grained hallucination subcategories, and the results show that these errors are not random scattered points, but form structured combinations. The co-occurrence lift between procedural deadline errors and remedy path errors reached 2.82, and between procedural step errors and procedural consequence errors reached 2.59; the strongest cross-group signal appeared between legal source hierarchy errors and legal stance confusion, with a lift of 7.07.

This means that many seemingly scattered errors may share the same upstream cause: once the legal source hierarchy is judged incorrectly, subsequent rule stances and fact application may shift together; once the procedural clock is miscalculated, deadlines, steps, and remedy paths may also go wrong in succession. For system governance, high-risk errors can be regarded as early signals—once anomalies are detected in legal source hierarchy, deadline calculation, procedural steps, or fact-element mapping, secondary retrieval, rule verification, or human review should be triggered, rather than passively correcting errors after the final answer is generated.

In products, an agent needs at least three checks: clarify boundaries before generation, confirming the applicable jurisdiction, task scope, and answerability, and not directly giving definitive judgments when jurisdiction, limitation periods, or procedural paths are unclear; verify grounds during execution, continuously checking retrieval results, cited sources, key facts, and tool return values; check consistency before output, verifying the validity of legal sources, procedural deadlines, constitutive elements, and remedy paths. The evaluation target should also expand from a single model to the model-tool-workflow as a whole.

The paper also cautions against overgeneralization: LexAgentHallu is mainly based on the Chinese legal system and focuses on single-agent scenarios; when transferred to common law, multi-jurisdiction retrieval, or multi-agent collaboration, the authority of legal sources, application of precedents, and procedural rules all need to be redefined.