Why Do Large Language Models Hallucinate? The Technical Case Against Trusting Probabilistic Legal Research Alone

Q: Why do large language models hallucinate?

Because they are trained to predict likely next tokens, not to query a ground-truth database. On low-frequency facts — including many case citations — the training objective and accuracy-style evaluations both push models to guess rather than abstain. Hallucinations are expected statistical errors, not mysterious personality traits.

Q: Can RAG or grounding stop legal hallucinations?

RAG reduces errors relative to pure chatbot recall by inserting retrieved documents into context, but the model can still miss, ignore, rewrite, or mis-cite those documents. Stanford's evaluation of leading legal research AI tools found substantial remaining hallucination rates even in RAG products marketed as avoiding the problem.

Q: If I connect an LLM to Westlaw or LawDiver via MCP, are citations safe?

No. The model still decides whether to call the tool, how to query it, how to interpret results, and whether to use, ignore, or alter what comes back. Tool access without an external deterministic verifier is not a guarantee. Use MCP for retrieval speed; use cite-checking code as the gate.

Q: What was Mata v. Avianca about?

In 2023, lawyers in the Southern District of New York filed ChatGPT-generated citations to six nonexistent cases, then stood by them after the court questioned the authorities. Judge Castel sanctioned counsel under Rule 11. It is the foundational U.S. decision on generative-AI fake cites.

Q: Have judges used AI-hallucinated material too?

Yes. In 2025, at least two federal judges withdrew opinions after chambers staff used generative tools that introduced fabricated or unverifiable quotations and citation errors (notably the CorMedix matter in the District of New Jersey). The verification problem is institutional, not limited to private counsel.

Q: What is the difference between deterministic cite checking and an LLM cite checker?

A deterministic checker resolves citation strings against a held corpus with stable keys and returns auditable verdicts (resolved, unresolved, name mismatch, bad law). An LLM "cite checker" estimates what looks right. Only the first produces repeatable, court-defensible identity claims.

Q: How does LawDiver combine LLMs with deterministic verification?

LawDiver uses probabilistic methods for semantic search, drafting support, and completeness nets, while keeping citation identity, name-mismatch detection, good-law signals, and cite-check verdicts in deterministic services. The model may propose; verification and filing gates sit outside the sampling loop. See CiteChecker, the caselaw API, and the MCP server.

Q: Is using AI for legal research unethical?

No. Courts repeatedly say AI assistance is permissible. Filing unverified AI output as authority violates Rule 11, competence, and supervision duties. The ethical line is verification, not abstinence. ---

September 10, 2026 · LawDiver

Hallucinations are not bugs in the chat UI. They are statistical consequences of next-token training, accuracy-graded benchmarks, and agent architectures that still let the model decide whether to trust a database. Here is the science, the case law of fake cites, and why deterministic verification has to sit outside the LLM.

Large language models do not "lie" the way a person lies. They do something more dangerous in legal work: they sample fluent text from a probability distribution that was trained to be plausible, not true. When that text looks like a case citation — reporter volume, page, court, year, and a holding that fits your brief — the human reader experiences confidence. The model experiences only the next token.

That distinction is no longer academic. Since mid-2023, United States courts have sanctioned lawyers, revoked pro hac vice admissions, disqualified counsel, dismissed claims with prejudice, and — in a smaller but growing set of matters — withdrawn judicial opinions after chambers staff used generative tools that invented quotations or authorities. The pattern is not "a few careless people." It is what happens when a probabilistic text engine is treated as a research system.

This article is long on purpose. It covers:

What "hallucination" means in the technical literature — and what it does not mean.
Why next-token pretraining and accuracy-graded evaluation force guessing on low-frequency facts (including the 2025 OpenAI paper and the 2026 Nature analysis).
Why retrieval-augmented generation (RAG) and tool use (including MCP) reduce some errors but do not give you control of the model.
The empirical record in law: Stanford RegLab's evaluation of leading legal AI tools, and a tour of the major lawyer and judge fake-cite episodes.
The architectural fork that actually matters for legal products: codebase-backed deterministic processes versus LLM probabilistic techniques — pros, cons, and how they work together when the deterministic layer is allowed to veto the model.
How LawDiver is built around that fork: deterministic citation resolution and good-law checks outside the model's sampling loop, with LLMs used where probability helps and never where a citation must be true.

If you only remember one sentence: giving an LLM access to Westlaw, Lexis, CourtListener, or LawDiver does not make the LLM honest — it only adds another tool the model may call, ignore, misread, or rewrite.

What people mean by "hallucination"
The statistical machine underneath the chat box
Why training creates hallucinations even on clean data
Why evaluation keeps them alive
Intrinsic vs. extrinsic hallucinations — and why citations are a special case
RAG is necessary. RAG is not sufficient.
The MCP illusion: tool access is not tool obedience
What the Stanford legal-AI study actually measured
The case law of fake cites: lawyers
When chambers hallucinate: judges and judicial staff
What Rule 11, ABA Formal Opinion 512, and standing orders now require
Deterministic processes vs. probabilistic techniques
How they work together — the LawDiver pattern
A practical architecture for verifiable legal AI
What will not fix this (yet)
Frequently asked questions
Further reading

What people mean by "hallucination"

In natural-language processing, a hallucination is content that is fluent and locally coherent but not faithful to a source of truth the system was supposed to respect — the user's prompt, the retrieved documents, the training corpus, or external reality. The taxonomy in Maynez et al. (2020) and the survey by Ji et al. (2023) distinguish, among other cuts:

Intrinsic hallucinations — contradictions of the input (counting letters in a word, inventing facts that reverse the user's premises).
Extrinsic hallucinations — claims that are not supported by (or conflict with) external ground truth, even if they do not contradict the prompt text.

Legal citation failures are usually extrinsic and structured. The model emits a string that satisfies the surface grammar of American case citation — Smith v. Jones, 123 F.3d 456 (2d Cir. 2019) — while failing the identity conditions of a real opinion: that reporter key, that caption, that court, that year, and that holding do not co-occur in any authoritative database.

That is why "looks like a citation" is the wrong verification question. A hallucinated cite is designed by the same distributional pressures that make real cites look the way they look. Form is cheap. Existence is expensive.

Two further distinctions matter in legal practice:

Fabrication — the authority does not exist at all (the classic Mata shape).
Misattribution — a real case is cited for a holding, quotation, or procedural posture it does not support (common in RAG products that retrieve something nearby and then let the model free-write the explanation).

Stanford's legal-AI evaluation treats both as hallucinations for good reason: a lawyer who files either one has still told the court something false about the law.

The statistical machine underneath the chat box

A modern large language model is, at its core, a conditional distribution over tokens:

\[ P_\theta(x_t \mid x_{<t}) \]

Training (pretraining) pushes $\theta$ so that, on average over a massive corpus, the model assigns high probability to the next token that actually appeared. Decoding at inference time draws (or greedily selects) tokens from that distribution. Everything else — chat templates, tool schemas, "you are a careful lawyer" system prompts — is scaffolding around that sampler.

Three consequences follow immediately.

First, the model has no native "database lookup" for facts. When it has seen Miranda v. Arizona paired with 384 U.S. 436 thousands of times, the association is strong. When it has never seen a clean mapping for an obscure bankruptcy stay under the Montreal Convention — or has seen conflicting mappings — the distribution still has to put mass somewhere. The sampling process does not have a "refuse unless verified" bit unless post-training and decoding add one, and even then the refusal is itself a sampled behavior, not a proof.

Second, citation strings are high-entropy, low-frequency objects. A specific reporter citation is closer to a phone number than to English grammar. Kalai, Nachum, Vempala, and Zhang (OpenAI / Georgia Tech, 2025) formalize a related point: recurring regularities (syntax, common idioms) become reliable with scale; arbitrary singleton facts do not. A birthday, a dissertation title, or a rarely cited intermediate-court disposition is exactly the kind of object for which next-token prediction has no statistical shortcut. Legal citations live in that family.

Third, fluency is not a side effect — it is the objective. Cross-entropy training rewards text that looks like training text. Court opinions, briefs, and secondary sources are full of citation-shaped strings. The model learns the genre of citation extremely well. Genre competence without identity competence is precisely the failure mode courts keep discovering.

Why training creates hallucinations even on clean data

The 2025 paper Why Language Models Hallucinate (Kalai, Nachum, Vempala, Zhang) is the cleanest public statement of the pretraining argument. The authors reduce generation errors to a binary classification problem they call Is-It-Valid (IIV): given a candidate response, is it valid or erroneous? Generating only valid outputs is, in a precise sense, at least as hard as solving that classification problem. If valid and invalid statements are not separable from the statistical evidence available during training, errors are not mysterious bugs — they are the expected residue of learning.

Their birthday and dissertation examples are pedagogically perfect for lawyers. Ask a frontier model for a rarely published biographical fact; it will often invent a specific-looking answer rather than say it does not know. Ask for a case that would neatly support your motion; you get the same temptation in Bluebook clothing.

A related 2026 analysis in Nature — Evaluating large language models for accuracy incentivizes hallucinations — pushes the same logic through learning theory: even idealized, error-free pretraining data leaves unavoidable error pressure on one-off facts, while recurring structure (grammar) does not. Post-training (instruction tuning, RLHF, preference optimization) can suppress some classes of mistakes, but it does not rewrite the fundamental incentive when the model is still scored as a test-taker.

For legal research, translate "one-off fact" as:

an unpublished disposition with a nonstandard caption,
a state intermediate-court case that appears once in the training mixture,
a parallel citation the model has rarely seen written out,
a quotation that sounds like something a particular circuit would say.

Those are exactly the objects briefs need, and exactly the objects probabilistic models invent when uncertain.

Why evaluation keeps them alive

Pretraining explains why hallucinations arise. Evaluation explains why they persist.

Most headline benchmarks use binary accuracy: correct answer scores 1; blank, "I don't know," or a carefully hedged refusal scores 0. Under that scoring rule, a model that guesses when uncertain has higher expected accuracy than a model that abstains. Kalai et al. call this the epidemic of penalizing uncertainty: language models are optimized to be good exam-takers, and exams punish blanks.

The Nature paper makes the incentive point operational. It proposes open-rubric evaluations that state error penalties explicitly and test whether a model modulates abstention to the stated stakes. Until leaderboards stop rewarding confident wrong answers, product teams that chase those leaderboards will keep shipping models that sound sure.

This is not an argument against capability. It is an argument against treating capability scores as reliability scores. A model that is "better at legal MMLU-style questions" can still be worse at the only metric a court cares about: did you invent the law?

Intrinsic vs. extrinsic hallucinations — and why citations are a special case

Citation hallucination has its own empirical literature because bibliographic and case-citation formats are easy to generate and hard to verify by eye.

Walters and Wilder (2023) and Agrawal et al. (2024) documented fabricated academic references. A 2026 empirical study, Do Deployment Constraints Make LLMs Hallucinate Citations?, shows that under temporal restrictions and survey-style breadth pressure, models continue to emit well-formed bibliographic entries even as existence rates collapse — what the authors describe as compliance without substance. Format compliance masks a near-complete loss of verifiability. A large share of citations cannot even be automatically confirmed or refuted; among those, a substantial fraction are fabricated.

That finding maps onto legal practice almost one-to-one. When a prompt says "give me Wyoming federal cases on motions in limine," the model is under breadth and jurisdiction pressure. It will often prefer a complete-looking table of authorities to an honest "I cannot verify any." That is how you get eight of nine cites invented while every string still looks cite-shaped.

Quotations are a second special case. A model can retrieve a real case and still invent a sentence that "belongs" in that opinion's rhetorical neighborhood. Retrieval reduces fabrication of names; it does not by itself enforce string match against the opinion text. Quote verification is a different algorithm — character-offset or passage match against the stored opinion — not a chat behavior.

RAG is necessary. RAG is not sufficient.

Retrieval-augmented generation (Lewis et al., 2020) attaches an external corpus lookup to generation: retrieve documents, stuff them into context, then generate. Legal vendors correctly observed that pure parametric recall was unsafe. They incorrectly marketed RAG as "eliminating" or "avoiding" hallucinations.

Mechanically, RAG introduces new failure modes:

Retrieval miss — the right case is in the corpus, but the retriever never surfaces it.
Retrieval near-miss — a related but wrong authority is retrieved; the model confidently explains that case as if it answered the question.
Context neglect — the right passage is in the window; the model ignores it and samples from priors anyway.
Context rewrite — the model paraphrases retrieved text into a sharper holding than the opinion supports.
Citation laundering — the model attaches a real reporter cite to a different case name, or invents a pinpoint.

None of these require malice. They are ordinary consequences of a generator that is still free to sample after retrieval.

This is why "we grounded the answer in Westlaw content" is not the same claim as "every proposition is entailed by a retrieved opinion and every citation resolves." The first is a product slogan. The second is a verification pipeline.

The MCP illusion: tool access is not tool obedience

Model Context Protocol (MCP) and similar function-calling interfaces let an assistant invoke external tools: search a caselaw database, fetch an opinion, run a cite check. LawDiver ships an MCP server for exactly that reason. So do other vendors.

Here is the part that marketing pages understate, and that every serious agent engineer eventually learns the hard way:

Even when you give an LLM MCP access to a legal search database — LawDiver, Westlaw, Lexis, CourtListener — the LLM still decides:

Whether to call the tool at all. Many prompts never trigger a tool call. The model answers from parameters.
To what extent to use it. One search vs. five. First page vs. deep pagination. The jurisdiction filter you hoped for vs. a vague query.
How to use the results. Which hit to trust. Which passage to quote. Whether to keep searching after a weak result.
Whether to use, ignore, or alter the outputs. The model can discard a correct retrieval, blend two cases, "clean up" a quote, or emit a citation string that is not what the tool returned.

There is, at present, no prompt — no system message, no chain-of-thought instruction, no "you must always cite-check" ritual — that guarantees control over those four decisions. Prompts change rates. They do not create invariants.

Recent theory on tool-using agents makes the same point in formal language. Fan, Tan, and Wattenhofer (2026), Information Fidelity in Tool-Using LLM Agents: A Martingale Analysis of the Model Context Protocol, analyze error accumulation across sequential MCP-style tool calls. Distortion does not explode exponentially in their model, but it grows; semantic re-weighting and periodic re-grounding help; none of that is the same as a hard guarantee that tool outputs are faithfully reproduced in the final answer. The agent remains an adaptive sampler sitting on top of the tools.

The engineering implication is blunt:

If the final answer is whatever tokens the model emits, the database was a suggestion.

If you need an invariant — "no citation leaves this system unless it resolves to a corpus row" — that invariant must be enforced outside the model's sampling loop: in code, in a cite-check service, in a CI gate, in a human workflow with a report the model cannot edit. The LLM can draft. The gatekeeper must not be the LLM.

What the Stanford legal-AI study actually measured

In Hallucination-Free? Assessing the Reliability of Leading AI Legal Research Tools (Magesh, Surani, Dahl, et al.; Journal of Empirical Legal Studies, 2025), Stanford RegLab and collaborators ran a preregistered evaluation of leading commercial legal research assistants built on RAG — including offerings associated with LexisNexis and Thomson Reuters.

Headline results that every lawyer using these tools should know:

Specialized legal AI beats general chatbots on legal queries. That improvement is real.
It is not hallucination-free. Reported incorrect-information rates in the study's framing land roughly in the 17%–33%+ range depending on the system and metric cut — far too high for unsupervised filing.
Systems differ substantially in responsiveness (how often they answer vs. abstain) and in the type of error (wrong jurisdiction, inapplicable authority, overruled or negative-treated law presented as clean).
Provider claims that RAG "eliminates" or "avoids" hallucinations were overstated.

Chief Justice Roberts warned about hallucinations in the 2023 Year-End Report on the Federal Judiciary. The Stanford work supplies the empirical follow-through: domain retrieval reduces the problem; it does not retire the duty of verification.

The authors' professional-responsibility conclusion matches the architecture argument in this article. Either lawyers verify every proposition and citation by hand — undercutting the efficiency pitch — or they take an incompletely characterized risk. A third path exists only if the product itself exposes machine-checkable verdicts (resolved / unresolved / name mismatch / bad law) that a human can audit in seconds. Marketing copy that says "grounded in trusted content" is not that third path.

The case law of fake cites: lawyers

What follows is not a complete census. Trackers maintained by legal-AI governance projects now list hundreds of U.S. matters involving hallucinated authorities, spanning federal district courts, courts of appeals, bankruptcy courts, state appellate courts, the Tax Court, GAO bid protests, and bar discipline. The point of the cases below is doctrinal and technical: they show which failure modes courts keep seeing, and how sanctions have escalated.

Mata v. Avianca, Inc., 678 F. Supp. 3d 443 (S.D.N.Y. 2023) — the founding scandal

Attorneys Steven A. Schwartz and Peter LoDuca filed opposition papers that cited six nonexistent decisions, complete with fake quotations and invented reasoning, generated by ChatGPT. When opposing counsel and the court questioned the authorities, counsel doubled down — including by submitting purported "copies" of the fake opinions and by asking ChatGPT whether the cases were real (it helpfully confirmed they were).

Judge P. Kevin Castel's June 22, 2023 sanctions order is still the foundational text. Key holdings for practice:

Using AI is not inherently improper.
Rule 11 imposes a non-delegable gatekeeping duty to ensure the accuracy of filings.
Standing by fake opinions after notice is subjective bad faith.
Fake federal opinions waste opposing parties' time, consume judicial resources, and injure the judges falsely named as authors.

Joint monetary sanctions of $5,000, plus letters to the real judges falsely identified as authors of the bogus opinions, followed. Every later AI-citation order cites Mata.

Park v. Kim, 91 F.4th 610 (2d Cir. 2024)

The Second Circuit referred counsel for potential discipline after a brief cited a nonexistent decision. The opinion is important less for the dollar amount than for the appellate articulation: counsel must make a reasonable inquiry into the existence and validity of authorities. "The court does not need AI-specific warnings to know that inventing case law is forbidden" is the practical message.

United States v. Cohen, 724 F. Supp. 3d 251 (S.D.N.Y. 2024) — negligence without sanctions

Michael Cohen used Google Bard to generate research; three nonexistent Second Circuit citations ended up in a filing by attorney David Schwartz. Judge Jesse Furman found the episode embarrassing and negligent but declined Rule 11 sanctions, concluding the record did not show the subjective bad faith required on those facts — particularly given prompt acknowledgment rather than a Mata-style defense of the fakes.

Cohen and Mata together bracket scienter: courts distinguish honest (if inexcusable) confusion about what generative tools are from the decision to keep asserting fabricated law after red flags.

Gauthier v. Goodyear Tire & Rubber Co., 2024 WL 4882651 (E.D. Tex. 2024)

Counsel used a generative tool in opposing summary judgment; nonexistent cases appeared. Sanctions included a fine and mandatory AI-focused CLE. The episode also illustrates a secondary failure mode: attempting to "verify" with another AI feature that does not perform deterministic corpus resolution.

Wadsworth v. Walmart Inc., 348 F.R.D. 489 (D. Wyo. 2025) — firm AI is not a safe harbor

Morgan & Morgan attorney Rudwin Ayala used the firm's internal AI platform (MX2.law) to add Wyoming federal case law to motions in limine. Eight of nine cited cases did not exist. Supervising partner T. Michael Morgan and local counsel Taly Goody signed without independent verification.

Judge Kelly H. Rankin's order is a teaching document for large firms:

A fake opinion is not existing law for Rule 11 purposes.
Blind reliance on another attorney can itself violate Rule 11; the signature duty is non-delegable.
Proprietary or "legal" branding on an internal AI tool does not change the analysis.
Sanctions: Ayala — $3,000 and pro hac vice revoked; Morgan and Goody — $1,000 each.

If your firm built an MCP wrapper around a chatbot and called it research, Wadsworth is speaking to you.

Johnson v. Dunn, 792 F. Supp. 3d 1241 (N.D. Ala. 2025) — fines are not enough

Three Butler Snow partners filed discovery motions containing five fabricated citations from ChatGPT, contrary to the firm's own 2023 written AI policy requiring approval and independent verification. Judge Anna Manasco disqualified the attorneys from the case, ordered publication of the opinion, required disclosure to clients and other courts, and referred them to every state bar where they are licensed. The court explicitly rejected monetary fines as insufficient deterrence: if fines and embarrassment worked, the dockets would not keep filling with these cases.

Couvrette v. Wisnovsky, No. 1:21-cv-00157-CL (D. Or. 2025–2026) — six-figure sanctions and terminating relief

Among the most severe published outcomes to date: summary-judgment briefing with on the order of fifteen nonexistent cases and multiple fabricated quotations; stricken briefs; dismissal of plaintiffs' claims with prejudice; and combined monetary exposure on the order of $110,000 across lead and local counsel (court penalty plus fee-shifting components, including sanctions against local counsel for failing to meaningfully participate under local pro hac rules).

The doctrinal lesson is compounding liability: fabrication, failure to correct after notice, and nominal local-counsel sponsorship are not separate small problems. They are one large one.

The 2025–2026 wave: volume becomes the story

By early 2026, AI-hallucination citation matters were no longer rare news items. Public trackers list cases across nearly every federal circuit's district courts and a long list of state appellate courts. Tools named in orders include ChatGPT, Claude, Gemini, Copilot, Perplexity, Westlaw CoCounsel, Lexis+ AI / Protégé, NotebookLM, and unnamed "AI legal research" assistants. Outcomes range from warnings and mandatory CLE to five-figure fee awards, bar referrals, and case-terminating sanctions.

A few additional patterns worth encoding into firm policy:

Signing counsel are on the hook even when a junior, vendor, client, or "AI consultant" drafted the table of authorities.
"I thought it searched Westlaw" is the modern cousin of Schwartz's Mata belief that ChatGPT could not invent cases. Courts are unsympathetic after 2023.
Commercial legal AI appears in sanctions orders too. "We used the expensive product" is not a defense when nobody ran a deterministic existence check.
Appellate courts increasingly treat fictitious citations as categorical professional failure, not a tech footnote.

When chambers hallucinate: judges and judicial staff

Lawyers are not the only actors in the system. In 2025, at least two federal judges publicly addressed generative-AI errors in chambers work product.

In re CorMedix Inc. Securities Litigation (D.N.J. 2025) — Judge Julien Xavier Neals

A June 30, 2025 opinion denying a motion to dismiss was withdrawn after defense counsel documented fabricated or unverifiable quotations, misstated case outcomes, and citation problems. Judge Neals later informed Congress that a law-school intern had used ChatGPT for research without authorization and contrary to chambers and school policy. The opinion was pulled; a corrected decision followed. The episode shows how quickly a hallucinated district-court opinion can be cited as persuasive authority in related litigation before the withdrawal catches up.

Judge Henry T. Wingate (S.D. Miss. 2025)

A law clerk used Perplexity as a drafting aid; an early draft containing hallucinated material was docketed before the chambers' ordinary cite-check review. The court withdrew the order and described process failures — premature docketing, incomplete review — rather than a claim that generative tools are secretly accurate if used by clerks.

These matters matter for institutional design. If the verification step is "a careful human will notice," both the Mata bar and the CorMedix chambers sequence show the same weakness: fluent error is optimized to survive casual reading. Verification has to be procedural and, where possible, mechanical.

What Rule 11, ABA Formal Opinion 512, and standing orders now require

The doctrinal baseline is not mysterious.

Fed. R. Civ. P. 11 — by signing, counsel certify that legal contentions are warranted by existing law (or a nonfrivolous argument for change) after an inquiry reasonable under the circumstances. A nonexistent case is not existing law.
ABA Formal Opinion 512 (July 29, 2024) — lawyers using generative AI must verify citations and quotations against authoritative sources; competence and supervision duties apply to the tools and to the people using them.
Local standing orders — dozens of federal judges now require AI disclosure, certification of human verification, or both. Ignoring those orders is an independent problem layered on top of the underlying false citation.

None of these rules ban AI. They ban unverified AI output in the role of legal authority. That is an engineering requirement wearing a ethics costume.

Deterministic processes vs. probabilistic techniques

Legal technology has always mixed both. The question is which layer is allowed to have the last word on identity claims ("this case exists," "this quote appears at this pinpoint," "this opinion was overruled").

Deterministic, codebase-backed processes

Examples in a caselaw platform:

Reporter-string normalization to a canonical key (410 U.S. 113 → a single index lookup).
Exact and fuzzy caption match against a name index with auditable candidates.
Grammar-based citation span detection (e.g., eyecite-class parsers) with character offsets.
SQL / inverted-index boolean retrieval with proximity operators (/s, /p, w/n).
Citation-graph walks: who cites whom, with stored treatment edges.
Good-law / negative-treatment flags computed from labeled or rules-based treatments.
Quote checks: does this string appear in the stored opinion text?
Document cite-check reports that emit machine verdicts: resolved, unresolved, name mismatch, year mismatch, bad law.

Properties:

Property	Deterministic layer
Same input → same output	Yes (modulo explicit versioning of rules/data)
Auditable	Yes — you can log the key, the query, the row id
Calibrated "I don't know"	Natural — miss = miss, not a fluent substitute
Coverage	Blind to forms outside the grammar / index
Creativity	None — by design

Pros: verifiable, repeatable, explainable to a court, suitable as a filing gate, cheap at scale for exact lookups, composable in ordinary code review.

Cons: brittle on OCR junk and exotic cite forms; weak at conceptual research ("cases about constructive discharge in remote work"); cannot draft narrative; requires corpus engineering.

Probabilistic LLM techniques

Examples:

Semantic / vector search over opinion embeddings.
Natural-language question answering and memo drafting.
Query understanding and multi-engine routing hints.
Completeness nets that propose citation spans a grammar missed.
Summarization, issue-spotting, and analogy suggestions.

Properties:

Property	Probabilistic layer
Same input → same output	No (temperature, decoding, model version, context)
Auditable	Partial — prompts and traces help; sampling remains opaque
Calibrated "I don't know"	Unreliable unless forced by external scoring
Coverage	Excellent at paraphrase and soft match
Creativity	High — including creative falsehood

Pros: unmatched at language interfaces, conceptual retrieval, drafting speed, and recalling structure of legal argument.

Cons: not a source of truth; tool use is optional from the model's point of view; evaluation incentives favor guessing; citations and quotations are a known failure attractor; "feels right" is the product.

The wrong synthesis

The industry's most common architecture is:

Retrieve with RAG → let the LLM write the answer → hope.

That puts the probabilistic layer last on the claims that must be true. It is also the architecture behind a large share of sanctioned briefs: the model was "using" a research tool in some loose sense, and the filing still lied.

The right synthesis

Invert the stack for anything that will be filed or relied upon:

LLM drafts and explores → deterministic services verify identity, quotation, and status → only verified objects are allowed into the work product (or the unresolved objects are labeled as such in a way the LLM cannot silently remove).

Probability proposes. Determinism disposes.

How they work together — the LawDiver pattern

LawDiver is built as a legal research and verification platform, not as "ChatGPT with cases in the prompt." The design bias is explicit: determinism is the backbone; probability is the net.

What stays deterministic

Citation identity. A reporter citation is treated as a key, not a vibe. Normalization and lookup run against large citation and parallel-citation indexes. A confidence of 1.0 on resolution means a deterministic key match — not "the model is pretty sure."
Name mismatch detection. The classic hallucination shape welds a real-looking reporter cite to the wrong case name. That is a join failure, detectable without asking an LLM whether it "feels consistent."
In-corpus citation extraction at scale. Grammar-based recognition (building on eyecite-class approaches, extended in-house) has been run across the corpus to produce hundreds of millions of in-text citation spans and tens of millions of opinion-to-opinion edges — with offsets suitable for audit.
Good-law status as data. Negative treatment is a published signal on the case, not a paragraph the chatbot might forget to mention.
Cite-check verdicts. CiteChecker returns structured outcomes a program can branch on — including the honesty to say likely_valid with candidates without silently correcting the author's cite to a case they never read.

Where probability is allowed to help

Semantic retrieval when the lawyer's words are not the opinion's words.
Hybrid fusion across citation, name, boolean, and vector engines — with modes you can pin and compare, not a single opaque "AI answer."
Completeness nets that propose citation spans a pure grammar missed (OCR, weird short forms), stored as a distinct source so parser edges and model-proposed edges never silently collapse.
Drafting and explanation after authorities are selected and verified — or clearly labeled when they are not.

MCP and API without surrendering the gate

LawDiver exposes the same stack over REST and MCP. That is useful. It is not sufficient by itself.

The durable pattern for builders is:

Let the agent search and retrieve.
Before any citation is shown to a user as authority, run /citecheck (or equivalent) in your code.
Render the cite-check report in the UI the model does not control.
Refuse to export a brief table of authorities that contains unresolved or name-mismatched cites unless a human explicitly overrides — and log the override.

That is how probabilistic assistance and deterministic verification produce something neither can produce alone: speed with a repeatable evidence trail.

For the builder-facing version of this stack, see The Caselaw API Legal AI Builders Have Been Waiting For. For the free-data boundary, see CourtListener vs. LawDiver.

A practical architecture for verifiable legal AI

If you are designing a legal AI product — or an internal firm agent — use this checklist.

Invariants (must be true on every release)

No citation string is displayed as "verified" unless a deterministic resolver returns a corpus id.
No quotation longer than N characters is displayed as a quotation unless it matches opinion text (exact or normalized) at a stored offset.
Good-law / negative-treatment state is read from the authority record, not from model memory.
Tool outputs that fail schema validation never enter the answer channel.
The model cannot mark its own work as verified.

Allowed probabilistic behaviors

Drafting from a human- or resolver-selected authority set.
Suggesting additional queries and jurisdictions to search.
Ranking and clustering retrieved hits for human review.
Explaining a case in plain language with links back to the opinion.

Agent design rules that survive contact with MCP

Treat tool calling as untrusted narration of intent, not as proof of grounding.
Prefer server-side workflows ("cite-check this document") over "ask the chat to be careful."
Separate exploration UI from filing UI. The second has a harder gate.
Log (prompt, tool calls, tool results, model output, verifier output) as an evidence pack.
Evaluate with error penalties for false citations, not only accuracy on happy-path questions.

What "superior, verifiable, repeatable work product" means

Superior — better conceptual recall and drafting speed than keywords alone; better authority quality than chatbot memory.
Verifiable — every filed authority has a resolver id, a link to full text, and a timestamped check.
Repeatable — re-running the verifier on the same document and corpus version yields the same verdicts.

That combination is an engineering artifact. It is not a prompt.

What will not fix this (yet)

"You are a careful attorney; never invent cases." Changes rates. Creates no invariant.
Bigger models. Reduce some error classes; singleton facts and citation invention remain structurally available.
More RAG. Necessary; still leaves the generator in charge of faithfulness.
MCP alone. Adds capability; does not add obedience.
Fine-tuning on correct cites. Helps common authorities; long-tail invention remains.
Asking the model to verify itself. Self-consistency checks catch some errors and miss others; they are not corpus identity checks.
Training-only fixes without evaluation reform. As Kalai et al. and the Nature analysis argue, as long as scoreboards reward guessing, products that chase scoreboards will guess.

The socio-technical half of the research agenda — change how we grade models so abstention is not punished — is real. Legal products cannot wait for leaderboard culture to heal. They need gates.

Frequently asked questions