# AI Citation Verification Receipts: Stop Research Agents From Turning Real Papers Into False Claims > Source: > Published: 2026-09-28 16:01:03+00:00 A real DOI is not proof that an AI agent read the paper, understood its limits, or used it to support the right sentence. Build a receipt that makes those checks visible before anyone trusts the report. Research agents need evidence links that a reviewer can inspect, not a longer list of citations. An AI research report can look remarkably careful. It has tidy prose, numbered references, and citations to papers that really exist. Then a reviewer opens one source and finds the problem: the report treated a correlation as a result, quoted an abstract as if it were a full experiment, or attached a real paper to a claim it never made. That failure matters more now because research agents are moving from literature summaries into scientific and professional workflows. [Anthropic’s recent account of Claude-assisted biological discovery](https://www.anthropic.com/news/claude-discovers-novel-enzyme-system) is a useful reminder of the opportunity. Faster discovery is exciting. But the more an AI system helps surface hypotheses, the more important it becomes to preserve the path from a sentence to the evidence that limits it. The fix is not another instruction that says “only cite real sources.” It is an **AI citation verification receipt**: a durable, machine-readable record of which claims were checked, which source version and evidence span were used, what the verifier found, what it did not check, and who accepted the remaining risk. **The key distinction:** a bibliography answers “can I find this paper?” A verification receipt answers “what did this report claim, what exact evidence was inspected, and did the system allow that claim to ship?” Teams often treat citation quality as one problem. It is at least four different problems, and each needs a different control. A source can pass identity and still fail the rest. A DOI may resolve perfectly while the agent misstates the finding. A paper can be current but only cover a narrow model, dataset, or laboratory condition. A polished answer can then turn “this study observed” into “this is known.” That is why a second model that says “looks supported” is not enough. It may be useful as one signal, but its verdict should not be the only record. The review system needs the inspected material and a repeatable way to decide what happens next. Think of the receipt as a release artifact for knowledge. It sits beside the final report, just as test results sit beside a software release. It does not certify that a conclusion is universally true. It states, precisely, what the pipeline checked before the conclusion was delivered. Start with the exact report version. Split it into atomic, checkable claims. A long sentence may contain three claims: a method description, an outcome, and an interpretation. Give each one a stable ID. If the prose changes after verification, the changed claim must be checked again. Store more than a URL. Keep identifiers, the source type, retrieval time, version, license or access note, and a content hash when your workflow can lawfully retain the source. For scholarly work, query more than one registry when possible. Crossref, OpenAlex, PubMed, arXiv, and a publisher page each reveal different failure modes. Every high-stakes claim should point to a quoted or bounded source span: a section, figure, table, result paragraph, or structured database field. The model may draft a paraphrase, but the receipt should retain the original evidence used to judge it. This is what lets a scientist challenge the interpretation without having to reconstruct the whole run. Use a small, boring vocabulary: supported, partially_supported, contradicted, unverified, out_of_scope, and not_checked. “Not checked” is vital. A green-looking receipt that hides sampling is worse than an honest incomplete one. The receipt should declare which rules were used. For example, numerical health claims might require direct primary evidence and a human reviewer, while background definitions may allow a trusted review article. Record the policy version, reviewer, decision, and any explicit exception. Do not let a generated explanation become the audit trail. A practical receipt separates cheap deterministic checks from higher-cost semantic review. The cheapest reliable check should run first. This protects latency and prevents a costly language-model review of a citation that fails basic metadata validation. This is a workflow pattern, not a demand for a huge platform. A small team can start with JSONL records in object storage, a simple source resolver, and a review queue. The important move is to make every claim’s status explicit. One of the easiest mistakes to miss is version drift. An agent may retrieve a preprint, while a reviewer later opens a journal version with changed numbers, a narrower conclusion, or an added correction. Both records can be real. They are not always interchangeable. Give the resolver a version policy. For each source, record whether the report relies on a publisher version, preprint, repository copy, abstract-only record, or database metadata. If the workflow falls back to an abstract because full text is unavailable, the receipt should say so and block any claim that requires methods or result-level detail. A source link without an access boundary tempts the model to imply more certainty than it earned. The same rule applies to figures, supplementary files, dataset cards, and code. If a report says a result was reproduced, the receipt should point to the execution artifact or explicitly label the statement as an untested assertion from the source. Do not let a citation to a paper impersonate evidence that your own pipeline produced. Version awareness also makes updates manageable. When a source changes, find the claims that depend on its identifier and version, then re-run only those checks. That is far safer than regenerating an entire report and hoping the new prose happened to preserve every valid conclusion. Keep the schema small enough that developers will actually use it. The following example deliberately separates a source match from a support decision. A verified DOI should never automatically make the claim pass. ``` { "receipt_id": "rcpt_01JQ...", "report_sha256": "...", "policy_version": "research-evidence-v1", "created_at": "2026-09-26T00:00:00Z", "claims": [{ "claim_id": "c-014", "text": "The intervention improved outcome X in the studied cohort.", "risk": "high", "source": { "doi": "10.example/abc", "version": "publisher", "resolved": true, "retraction_status": "not_found" }, "evidence": { "locator": "Results, paragraph 3", "excerpt_hash": "...", "retrieved_at": "2026-09-26T00:00:00Z" }, "verdict": "partially_supported", "reason": "Outcome improved, but the source does not establish causality.", "action": "rewrite_required", "review": { "required": true, "decision": "pending" } }]} ``` Notice what this receipt does not claim. It does not say the paper is correct, that the literature is complete, or that a reviewer can skip reading. It says this report’s sentence passed or failed a declared, inspectable check against a specific source state. Checking every sentence with a large model is expensive and can create a slow, fragile process. Instead, classify claims before you verify them. Risk tiers also make metrics meaningful. Instead of claiming an abstract “citation accuracy score,” track how often each tier is fully checked, how many claims were downgraded, how long evidence retrieval took, and how many failures were identity failures versus support failures. Those numbers tell you where the workflow is breaking. A common shortcut is to ask the same model that wrote a research report to review its own citations. It can help catch obvious mistakes, but it should not close the loop. The authoring model knows the wording it intended; that can make it good at rationalizing a weak match. Separate responsibilities. One component drafts claims from a bounded evidence set. Another resolves source metadata. A third selects evidence spans or compares a claim against them. Deterministic code enforces identifier and schema checks. A human owns the decision on claims that materially affect a scientific, professional, or customer outcome. The separation does not require different vendors. It requires different permissions, inputs, and exit conditions. The writer should not be able to mark its own unsupported claim as approved. A failed citation check should produce a useful next state, not a vague warning. Give the system a controlled choice: Preserve the original failure in the receipt. If a later run fixes the problem, emit a new receipt that links back to the old one. Overwriting failure history makes it impossible to learn whether your prompts, retrieval policy, or source normalization are improving. Human review works best when the system presents the evidence and the exact unresolved question. Start with one report type where a bad citation has a visible cost: an internal technical brief, a research digest, a customer-facing analysis, or a scientific literature review. Do not start by promising universal truth verification. That last metric is the one worth protecting. A team does not need every sentence to be machine-certified. It needs the statements people rely on to have a traceable evidence path and a clear owner for the final judgment. Research agents will keep getting better at finding papers, synthesizing evidence, and proposing next experiments. The teams that earn trust will not be the ones with the smoothest generated prose. They will be the ones that can answer three questions fast: what was claimed, what evidence was checked, and what remains uncertain? An AI citation verification receipt makes that answer concrete. It turns “the agent cited a paper” into a release decision with evidence, policy, and an honest boundary. That is a much stronger foundation for moving faster. It is a machine-readable record that links each checked AI-generated claim to a resolved source, inspected evidence span, verification verdict, policy version, and any human review decision. No. A DOI proves that a source record can be resolved. It does not prove the report used the right paper, read the relevant passage, preserved the study limits, or accurately represented the result. No. Use risk tiers. Run deterministic checks first, reserve semantic verification for important claims, and show clearly which claims were sampled or not checked. No. It makes expert review faster and more precise by presenting the source, evidence, rule, and unresolved issue. It does not establish scientific truth or replace domain judgment. At minimum, fabricated or unresolved sources, unsupported high-risk claims, missing required evidence spans, retracted sources used without disclosure, and any policy-required review that remains pending. Track high-risk claim coverage, identity failure rate, support failure rate, rewrite and escalation rate, retrieval latency, verification cost, and reviewer corrections after a receipt passes. [AI Citation Verification Receipts: Stop Research Agents From Turning Real Papers Into False Claims](https://pub.towardsai.net/ai-citation-verification-receipts-stop-research-agents-from-turning-real-papers-into-false-claims-55899592244f) was originally published in [Towards AI](https://pub.towardsai.net) on Medium, where people are continuing the conversation by highlighting and responding to this story.