no-fake-cite

A Claude Code Stop hook that blocks citation-formatted references — [1], Smith et al., 2023, doi:10.1234/xyz, arXiv:2403.12345, "published in NeurIPS 2025" — when no verifiable URL appears in the same message. LLMs hallucinate citations at 14–94% rates; this hook keeps fabricated refs out of your work.

no-fake-cite is one bash file (~80 lines, depends only on jq) wired into Claude Code's Stop and SubagentStop events. It pattern-matches academic citation formats in the assistant's outgoing message and blocks the closeout when no https:// URL accompanies the citation.

Why this exists

The numbers are not subtle:

• All models hallucinate citations at rates from 14.23% to 94.93%.
• 19.9% of GPT-4o citations are entirely fabricated — fake author, fake title, fake journal.
• Among seemingly real citations, 45.4% contain bibliographic errors, most commonly invalid DOIs.
• NeurIPS 2025 papers shipped with hallucinated citations through full peer review.
• GPTZero found 50+ ICLR 2026 submissions with hallucinated citations.
• Q1 2026 legal sanctions hit $145,000 for AI-generated fake citations in court filings.
• Even with web search, 3-13% of URLs remain fabricated in retrieval-augmented settings.

The 19.9% baseline means no LLM-generated citation should ship without verification. This hook is the textual-boundary enforcement of that rule.

What gets blocked

Citation-formatted patterns:

• Numeric academic refs — [1], [12], [1, 2, 3] followed by a citation-shaped string.
• Author-year — Smith et al., 2023, Jones et al. 2024.
• DOI — doi:10.1234/abcd, bare 10.1234/abcd.
• arXiv — arXiv:2403.12345, arXiv 2403.12345.
• Venue+year — "published in NeurIPS 2025", "at ICLR 2026", etc.

When the message contains any of these patterns and no https:// URL anywhere in the message, the hook blocks.

What stays allowed

• Any message with a https:// or http:// URL anywhere in it (even in unrelated context — the hook is conservative; if there's a URL, the operator can audit).
• Any message that doesn't contain a citation-formatted pattern.
• Messages that show command evidence of having actually fetched the citation (curl, WebFetch, "verified at ", "fetched from ").

What it does NOT do

• It does not validate that a present URL actually resolves to the cited content. That requires a network call and runs into rate limits / authentication issues. The hook just enforces the precondition: a citation must come with a URL the operator could check.
• It does not catch fabricated URLs that happen to look real. A hallucinated https://example.com/fake-paper.pdf passes the hook's URL check; that's a false negative the operator must catch with their own audit.
• It does not validate DOI registration. A fabricated doi:10.5555/fake.123 paired with a separate URL passes.

The hook is a precondition enforcer, not a verifier. The verification step is the operator's.

Install

mkdir -p .claude/hooks
curl -fsSL https://raw.githubusercontent.com/waitdeadai/no-fake-cite/main/no-fake-cite.sh \
  -o .claude/hooks/no-fake-cite.sh
chmod +x .claude/hooks/no-fake-cite.sh

Merge settings.example.json into .claude/settings.json. Requires jq.

Receipts

Three reproducible local tests in RECEIPTS.md. Three for three.

Sister tools

Part of the LLM Dark Patterns Hooks suite.

• no-vibes, time-anchor, no-curfew, no-sycophancy, no-cliffhanger, honest-eta
• no-fake-recall, no-fake-stats (sister fact-fabrication hooks)
• minmaxing — parent harness

License

Apache-2.0.