LLM Uncertainty Methods Compared: What Actually Catches Hallucinations

A systematic review accepted to IEEE Transactions on Neural Networks and Learning Systems compares seven uncertainty measurement and mitigation methods for large language models across three reliability datasets, and it is currently single-source and unreplicated: no independent team has confirmed its rankings as of 2026-08-27. That caveat matters because the review’s subject, which uncertainty signal can gate a hallucinating model, is exactly the kind of claim teams wire into production guardrails on the strength of one paper.

What did arXiv 2504.18346 actually test?

The review, titled “Comparing Uncertainty Measurement and Mitigation Methods for Large Language Models,” empirically evaluates seven related methods on three widely used reliability datasets, according to its arXiv abstract. Acceptance to IEEE TNNLS means the work passed peer review. It does not mean the results have been replicated, and at present they have not been.

That distinction drives everything below. The abstract names uncertainty quantification and calibration as the territory but never enumerates the seven methods under comparison, so the families mapped below are the ones practitioners actually argue about rather than a verified contents list for the review: verbalized confidence (ask the model how sure it is), calibration techniques (make stated probabilities match observed accuracy), sampling-based signals such as semantic entropy (generate multiple answers, measure how much they disagree in meaning), and conformal prediction (wrap the model’s output in a statistically guaranteed coverage set or abstention rule). The review puts numbers on relative detection performance among its seven methods, but those per-method figures rest on one group’s experiments, and the available evidence establishes the scope of the comparison rather than its per-method results under distribution shift.

So treat the review as a map of the territory, not a leaderboard. The useful question for a team building guardrails is not which method won on three datasets. It is which signal can honestly power the gate you are building, at a cost you can pay, against traffic that will try to break it.

Which uncertainty method can power which gate?

Each method family maps to a different deployment gate, and mismatching them is the most common way hallucination cost escapes the eval suite. There are three gates in practice: abstain (decline to answer), route (escalate to a stronger model), and block (refuse or suppress the output entirely). The honest fit looks like this:

Verbalized confidence is the cheapest signal and the least trustworthy. It costs nothing extra to ask a model to rate its own certainty, which makes it tempting as a routing heuristic: low self-confidence, escalate. The problem is structural. A model’s stated confidence is itself a generated token, subject to the same distribution shift as any other output, and teams that wire it into a blocking gate are trusting the model to grade its own homework. It is a reasonable tiebreaker inside a routing policy. It is not a gate.

Calibration methods convert raw signals into probabilities that mean something: when the system says 0.8, it should be right roughly eight times in ten on the calibration distribution. That makes calibration the natural fit for abstention, where you need a threshold you can defend. The catch is that calibration is a property of a distribution, not of a model. A threshold calibrated on a trivia benchmark is a trivia-benchmark threshold.

Sampling-based methods, semantic entropy chief among them, answer a different question: does the model settle on one meaning when you ask it repeatedly? Descending from the Farquhar et al. work that the current red-team effort is explicitly trying to replicate, semantic entropy generates multiple candidate answers, clusters them by meaning rather than surface form, and treats high dispersion across clusters as a hallucination signal. That is a stronger detection signal than anything single-pass, and the price is literal: you are paying for the extra generations.

Conformal prediction is the only family that ships a guarantee. Given a calibration set and a target error rate, it produces answer sets or abstention rules with a statistical coverage bound. That makes it the only candidate for a block gate, and even there the guarantee is about coverage on the calibration distribution, not about truth on adversarial traffic.

What does sampling-based detection actually cost?

The measured bill for semantic-entropy-style detection is roughly ten generations per query, and an in-progress replication puts a concrete number on it: the ScriptSampler red-team project reports sustained N=10 sampling throughput of 14.27 seconds per question, about 35 generated tokens per second, on a 4-bit-quantized Llama 3.1 8B Instruct running on a single consumer GPU.

Extrapolate that to eval scale. The TriviaQA rc.nocontext validation set used in the attack work contains 17,944 examples, per the replication project’s loading log, and at 14.27 seconds per question the full sweep projects to roughly 71 hours of continuous compute. That is one validation set, one model, one method. A team comparing two uncertainty signals across three datasets at this rate is looking at weeks of GPU time before it has an opinion.

The hardware envelope is worth stating precisely, because it is more generous than the “you need a datacenter” assumption. The replication runs under WSL2 on Ubuntu 24.04 with ROCm 6.4 and PyTorch 2.9.1+rocm6.4, on an AMD Radeon RX 9070 XT with 16 GB of VRAM, with the 4-bit model peaking at about 5.6 GB. Detection-side uncertainty work is cheap to experiment on. It is expensive to operate, because the cost is per query, forever, in the serving path.

That is the decision the sampling bill forces. If semantic entropy sits inline as a routing signal, every user query pays the ten-generation premium before the router decides anything. At 14.27 seconds of consumer-GPU time per question, the latency alone rules it out for interactive traffic on that class of hardware, and the compute cost compounds at frontier-model prices. The arithmetic pushes sampling-based detection toward two honest roles: an offline eval instrument, or a routing trigger reserved for queries already flagged as high-stakes by cheaper signals. Deployed naively as an always-on gate, it moves hallucination cost off the eval suite and onto the inference bill, where it is larger.

Where do the methods disagree, and what breaks under distribution shift?

The review’s central comparative claim is that these methods do not rank consistently across settings, and the practical reading is that disagreement concentrates exactly where deployment hurts: under distribution shift. Verbalized confidence and calibration are both single-pass and both bound to the distribution they were measured on; sampling-based signals are more robust to surface variation but pay for it per query; conformal methods hold their guarantee only while production traffic resembles the calibration set.

The honest summary of the current evidence is thinner than anyone selling guardrails would like. The review compares seven methods on three reliability datasets, which is a real empirical contribution, but the available record establishes that scope without independently confirming per-method behavior off-distribution. The one independent check currently in flight is narrow by design: the red-team project’s Phase 1 stop condition is to replicate the Farquhar semantic-entropy AUROC within plus or minus three percentage points, on one 8B model, before it proceeds to attacks. A ±3-point replication gate on a single quantized 8B model tells you whether one baseline holds. It says nothing about whether the review’s seven-method ranking transfers to the model you actually serve.

So the disagreement that matters for a buyer is not between method families. It is between the review’s numbers and your traffic, and nobody has measured that gap yet. The defensible posture is to treat every threshold and ranking as a prior, re-derive it on a calibration sample of your own production queries, and budget for the re-derivation to recur whenever the model or the traffic mix changes.

Is semantic entropy robust to paraphrase attacks?

Not established, and there is a dated deadline for finding out. An independent red-team project on GitHub is explicitly building adversarial paraphrasing attacks against Semantic Entropy and SRE hallucination detection, two of the detection signals in the class this review compares, with an arXiv preprint targeted for 15 September 2026, three weeks from today.

The attack logic is straightforward enough to state without the preprint. Semantic entropy clusters sampled answers by meaning; a paraphrase attack probes whether an adversary can push a confident-but-wrong answer through the clustering so that wrongness looks like consensus, or fragment a correct answer’s cluster so that correctness looks like uncertainty. Either direction degrades the AUROC that makes the method worth its sampling bill. SRE, the other named target, shares the sampling-based detection lineage and therefore the same attack surface.

What makes this project worth tracking rather than dismissing is its methodology. The stated Phase 1 stop condition is replicating the Farquhar baseline within three percentage points before attacking anything, which means the attack results, when they land, will come pinned to a verified baseline rather than a strawman. If the paraphrase attacks succeed against a faithful reproduction, every guardrail built on semantic-entropy-style signals inherits the vulnerability. If they fail against it, that is the first independent evidence that the signal is robust to the most obvious adversarial pressure. Either outcome is load-bearing for the decision guide above, and both arrive within the month.

Until then, “semantic entropy catches hallucinations” needs a standing caveat: it catches them on benchmark traffic, in one unreplicated comparison, with an adversarial evaluation due 15 September 2026.

What does adopting conformal abstention do to your guardrail thresholds?

It forces you to rebuild them, because conformal coverage guarantees change rejection rates by construction. A conformal abstention rule commits to a coverage level: the system answers on a guaranteed fraction of queries and abstains on the rest, with the error rate on answered queries bounded by the calibration. Switching from a heuristic threshold to a conformal one, or between methods with different coverage behavior, moves the rejection rate whether you want it to or not.

The second-order consequence lands on the eval team. Every downstream threshold, alerting rule, and human-review SLA that was tuned to the old rejection rate is now miscalibrated against the new one. A guardrail that rejected four percent of traffic under a calibrated heuristic might reject nine percent under a conformal rule at the same nominal error target, and the support queue absorbs the difference. Teams adopting conformal abstention for its guarantee, which is the only statistically defensible reason to adopt it, need to re-derive guardrail thresholds and re-baseline their rejection-rate dashboards as part of the migration, not as a follow-up.

There is also a hosting-footnote worth one paragraph, because the review’s venue keeps coming up in these discussions. arXiv hosts more than three million scholarly articles across eight subject areas, curated by volunteer moderators, per arXiv’s own about page; hosting is not endorsement. The platform itself has changed shape recently: it separated from Cornell University on 1 July 2026 to become an independent nonprofit and announced its first CEO, Penelope Lewis, in August 2026, according to Wikipedia’s arXiv entry, though both governance facts trace to that single page and describe post-cutoff events worth verifying before citing elsewhere. None of this bears on the review’s numbers. It bears on the habit of treating “on arXiv” or “accepted somewhere” as a quality signal, which it is not. IEEE TNNLS acceptance is peer review. Peer review is not replication.

Which method should you actually deploy?

Treat method choice as a cost-and-gate decision, not a leaderboard pick, and the practical answer falls out of the arithmetic above. For high-traffic gates, reserve single-pass, threshold-calibrated approaches: calibrated abstention where you can afford to decline, conformal abstention where you need the coverage guarantee and can absorb the threshold rebuild. Use sampling-based checks such as semantic entropy where the per-query cost buys something cheaper signals cannot: offline evaluation, high-stakes routing triggers, and disagreement measurement on queries already flagged as risky. Never block answers outright on any single uncertainty signal, because the comparison behind that signal is single-source and unreplicated, and the only independent verification in flight is a ±3-point AUROC replication gate on one 8B model.

Before adopting anything, price the bill. Ten generations per query at a measured 14.27 seconds on consumer hardware is the floor, not the ceiling, for sampling-based detection, and a single 17,944-example validation sweep projects to 71 hours at that rate. Run that arithmetic against your traffic volume and your routing prices first; the method that wins on AUROC and loses on cost is not a method, it is a demo.

The limitation to keep taped to the monitor: everything ranked here rests on one review whose evidence establishes scope but not per-method results under distribution shift, plus one self-reported replication on a quantized consumer-GPU model. The rankings may not transfer to frontier models or production traffic, and the adversarial preprint due 15 September 2026 may move the semantic-entropy row of the table in either direction. Build the guardrail so the method is swappable. The one thing this literature already establishes beyond dispute is that whatever signal you pick, your traffic will test the version of it that the benchmarks didn’t.

Frequently Asked Questions

How does the 14.27-second sampling latency compare to typical interactive LLM inference times?

Standard single-pass inference for an 8B model typically completes in under 2 seconds on similar hardware, making the 14.27-second semantic entropy check roughly seven times slower than the base generation. This latency gap forces teams to treat sampling-based detection as an asynchronous background process rather than a synchronous gate for real-time user interactions.

What specific operational change is required when migrating from heuristic thresholds to conformal abstention?

Teams must re-baseline their support queue capacity and alerting rules because conformal coverage guarantees often shift rejection rates by 5 to 10 percentage points compared to heuristic baselines. For example, a system rejecting 4% of traffic under a heuristic might reject 9% under a conformal rule with the same nominal error target, requiring a proportional increase in human review staffing.

Why is the 4-bit quantization of the Llama 3.1 8B model a limitation for generalizing the cost estimates?

Quantization reduces memory footprint to 5.6 GB but can introduce numerical instability that affects the clustering stability of semantic entropy, potentially inflating the measured AUROC variance. The 14.27-second throughput figure is specific to the ROCm 6.4 stack on AMD RDNA 4 hardware and does not account for the higher latency overheads typically seen in full-precision CUDA deployments on NVIDIA datacenter GPUs.

What is the specific risk of using verbalized confidence as a routing signal under distribution shift?

Verbalized confidence is a generated token subject to the same distribution shift as the answer itself, meaning a model can confidently assert incorrect facts when encountering out-of-distribution queries. Unlike calibration methods that are bound to a specific dataset, verbalized confidence lacks a statistical anchor, making it unreliable for high-stakes routing decisions where false negatives are costly.