Ninety citations, thirty-five papers
Granite’s protocol library carries the research behind its coaching rules — the studies a physiotherapist would want to see before trusting a threshold. In August we sat down to verify one of those files properly: ninety citations, each with an author, a year, and a PubMed ID. They looked exactly like a bibliography should look.
The ninety citations used only thirty-five unique PubMed IDs. That was the first tell. Batch-checking every ID against PubMed’s own records finished the job: every single one resolved to a real paper — and not one of them was the paper claimed. The citation for a 2022 ACL rehabilitation study pointed at a triarylborane chemistry paper. Another landed on sea-lion pharmacology. One ID was reused thirteen times, under thirteen different author names, for thirteen different claims.
All ninety were drafted with a language model. All ninety were removed the same day.
Plausible is the failure mode
The unsettling part isn’t that a model invents references — everyone knows that by now. It’s that these were individually checkable and still survived. A fabricated citation doesn’t look fabricated. It has a real journal’s name, a plausible author, an ID that resolves. It passes every review that stops short of clicking through — which, in practice, is nearly every review. The work looks finished precisely because the checking hasn’t happened.
For most software a wrong reference is embarrassing. For a product that proposes rehabilitation plans it’s the highest-severity failure there is: the entire promise is that a clinician can inspect the reasoning — and the first physio who clicks a citation and finds sea lions is right to stop trusting everything else on the screen.
What survived checking
The same pass ran over the seventeen citations that had been written by hand for the clinic demo. Fifteen verified exactly — right paper, right author, right year — and now carry their PubMed ID and a link to the record. Two couldn’t be confirmed and were cut: a real test published somewhere PubMed doesn’t index, and one reference with no matching paper. Fifteen of seventeen, versus zero of ninety. The difference wasn’t diligence at writing time. It was whether a person had actually read the thing they were citing.
The product changed that day too. A protocol whose evidence hasn’t been verified no longer shows nothing — it shows Evidence — pending review, in so many words. Silence reads as “no evidence exists” when it means “nobody has checked yet,” and those are very different statements to put in front of a clinician.
The job now
We use these models daily; they drafted, at some point, part of nearly everything we ship. This note isn’t a confession that a machine wrote something — it’s a record of what the job has become. Production got cheap. Plausible got free. The scarce thing, the thing a client is actually paying for, is the click-through: the unglamorous afternoon where someone opens all ninety references and finds the sea lions before a clinician does.
---
cybercyber is a product design lab. We work with a small number of clients each year. You work directly with Dan, with scope and fees agreed before work starts. Email hello@cybercyber.ai.