The brief improved until it cited a ghost

Here is the paradox the legal AI wave has produced, and it is genuinely strange: the drafting got better, and the drafts got more dangerous, by the same mechanism, at the same time.

The early tools wrote like tired interns, and everyone treated them accordingly; every line got checked because every line looked checkable. The current generation writes like a fifth-year associate on a good day: clean argument structure, correct register, citations formatted immaculately, *Meridian Holdings v. Carter*, 512 F.3d 219, pinpoint cite and all. The prose earns trust, and the trust transfers to the citations, which were generated by the same statistical machinery as the prose and carry none of the same reliability. Some of those cases do not exist. Some exist and say something else. A few were overruled years ago and now testify for the other side.

The professional cost is not hypothetical; sanctions orders over AI-invented citations are now a recurring genre, and the named parties are working lawyers at real firms. But the sanction is the cheap version of the loss. The expensive version is a client reading about their own matter in a sanctions order and re-pricing everything the firm has ever filed for them.

The instinct is to wait for models that do not hallucinate, and the instinct misreads the mechanism. A language model's job is to produce the most plausible continuation, and an authoritative-sounding citation is maximally plausible in legal prose precisely where an argument needs support. As fluency rises, the invented citation gets harder to spot by eye, because the eye was always using fluency as its proxy for reliability. The failure does not shrink with model quality. It camouflages.

Which points to the actual fix: stop asking the generative layer to be trustworthy about facts that live in a database, and put the database in the doorway.

The method is a deterministic citation-verification gate, and the word deterministic is the whole point.

Before any draft leaves the building, a parser extracts every citation, case names, reporters, statutes, pinpoints, into structured form; citation grammar is regular enough that this is solved plumbing. Each one is then resolved against a canonical authority source, a reporter database or court API. Resolution is a lookup with three outcomes, not a judgment call. Verified: the case exists, the caption matches, and, where the citator supports it, the treatment is checked, so the case that was overruled in 2019 gets flagged even though it exists. Mismatched: real citation, wrong proposition or wrong court, flagged with the diff. Unresolvable: no such case in any authority source, and the draft physically cannot be filed until a human disposes of the flag.

No model in that loop, which is what makes it a gate instead of another opinion; a lookup cannot be sweet-talked by good prose. We built this as the exit door of a drafting pipeline for a legal team: every citation in every AI-assisted draft resolves against the authority database, verified ones annotated with treatment status, unresolvable ones blocking. The gate flags a steady trickle, most of them mundane, a transposed volume number, a real case with an aging citation, and that mundane trickle is the point. The ghost citation, when it comes, is caught by the same boring machinery as the typo. (The associates, initially insulted by the gate, now route their own hand-written cites through it.)

Fluency is a property of the prose. Authority is a property of the record. The failure mode is using one to vouch for the other.

The honest limit: the gate verifies that authority exists and stands; it cannot verify that the argument reads the authority correctly, which remains lawyer work and should. But notice what the gate changes about that work: reviewers stop spending attention proving existence, the part a machine does perfectly, and spend it on interpretation, the part machines do worst. The scarce hour moves up the value chain.

TensorLabs builds AI drafting systems with this gate welded to the exit, because the lesson generalizes past law: wherever a model's output cites a verifiable record, verification belongs to the record, not the model. The brief can sound like your best associate. The docket only remembers whether the cases were real.