Hallucination Detection Tools Compared: 11 Options

There is a large gap between “which hallucination detection method should I understand” and “which hallucination detection tool do I deploy on Monday”. The four detection method families explain the mechanisms. This page is the shopping list: eleven tools that exist today, what each one actually is, and the two or three questions that decide between them.

The single most useful sorting question is not accuracy. It is whether you have a source document. Nearly every practical tool in this category checks whether an output is supported by supplied context — a faithfulness check. Very few check whether an output is true about the world — a factuality check. Buying the first while needing the second is the most expensive mistake in this category.

The eleven, at a glance

Tool	Family	Needs a source document	Runs where	Cost model
Vectara HHEM-2.1-Open	Small classifier	Yes	Self-hosted	Apache 2.0
Patronus Lynx	Small classifier (LLM)	Yes	Self-hosted or hosted	Open weights + paid platform
MiniCheck	Small classifier	Yes	Self-hosted	Open source
AlignScore	Small classifier	Yes	Self-hosted	Open source
SelfCheckGPT	Sampling consistency	No	Self-hosted, calls any model	Open source + N extra calls
Cleanlab TLM	Uncertainty scoring	No	Hosted API	Commercial
RAGAS	Eval framework	Yes	Self-hosted, calls a judge model	Open source + judge cost
DeepEval	Eval framework	Optional	Self-hosted, calls a judge model	Open source + judge cost
TruLens	Eval framework	Yes	Self-hosted, calls a judge model	Open source + judge cost
Bedrock contextual grounding	Managed guardrail	Yes	AWS Bedrock	Per-request
Azure groundedness detection	Managed guardrail	Yes	Azure AI Content Safety	Per-request

Four families, and they answer different questions. Read the family column before the tool name.

Small classifiers: the production workhorses

These are purpose-trained models that take a (source, claim) pair and return a support score. They are small, fast, and cheap enough to run inline on real traffic, which is the property that matters once a check moves from a notebook into a request path.

Vectara HHEM-2.1-Open is the most deployable option in the set. Roughly 0.1B parameters under Apache 2.0, it scores a premise/hypothesis pair from 0 to 1 for factual consistency. The 2.1 generation removed the 512-token context cap of HHEM-1.0, which was the constraint that made the original unusable on realistic RAG contexts. Vectara also runs the model as a hosted faithfulness score inside its own query API, and publishes a public leaderboard of hallucination rates across popular models — useful as a rough ranking, though a leaderboard on summarization tasks is not a prediction of your own domain’s behaviour.

Patronus Lynx takes the other approach: a fine-tuned Llama-3 model, published in 8B and 70B sizes with open weights, trained specifically to judge whether an answer is supported by retrieved context. The 8B is small enough to serve, the 70B is closer to LLM-judge quality without the API bill. Lynx shipped alongside HaluBench, a RAG-hallucination benchmark assembled from several question-answering domains, which makes its claims easier to inspect than most vendor numbers.

MiniCheck is the efficiency argument in its purest form. The work behind it demonstrates that small fact-checking models, trained on synthetic data built for the task, can approach large-model fact-checking quality on grounding documents at a small fraction of the inference cost. If you are running a faithfulness check on every response rather than a sample, cost per check is the design constraint, and this is the family that respects it.

AlignScore is the older general-purpose entry: a single alignment function trained on 4.7M examples drawn from seven tasks — NLI, question answering, paraphrase, fact verification, information retrieval, semantic similarity, and summarization — rather than on faithfulness data alone. It remains a reasonable open baseline and a sensible second scorer in an ensemble, precisely because that training mix differs from the others; correlated detectors fail together.

Sampling and uncertainty: when there is no source document

SelfCheckGPT is the reference method for the no-grounding case. It samples the same prompt several times and measures whether the statements hold steady across samples; content that diverges is treated as confabulated. It needs no logits and no reference text, which makes it the only classical option that works against a closed API model on open-ended generation. The cost is structural: N additional generations per check, so it belongs in asynchronous review of high-stakes output, not on the hot path.

Cleanlab TLM productises the same intuition as a hosted service. It wraps a model call and returns a trustworthiness score alongside the response, without requiring a retrieval context. That makes it one of the few commercial options aimed at closed-book generation rather than RAG faithfulness. It is a paid API and the scoring is proprietary, so treat the score as a calibrated-in-their-domain signal that you should re-validate against your own labelled sample before wiring it to an automatic block.

Evaluation frameworks: offline first, online later

RAGAS, DeepEval, and TruLens are not detectors. They are harnesses that orchestrate detectors — usually an LLM judge — over a dataset, and they exist to answer “did this week’s retrieval change make faithfulness worse”, not “should I block this response”.

RAGAS is the most RAG-specific of the three, with reference-free metrics for faithfulness, answer relevance, and context quality; its value is that it scores the retrieval and the generation separately, so a faithfulness regression can be traced to the stage that caused it. DeepEval is the broadest, with hallucination, faithfulness, and general-purpose G-Eval style metrics plus a pytest-shaped runner that fits CI. TruLens leans on its feedback-function abstraction and its groundedness metric, and is the easiest of the three to point at an existing application without restructuring it.

All three inherit the LLM judge’s cost and latency. Use them in CI and in nightly evaluation, then promote one small classifier to the request path once you know which metric actually correlates with your incidents.

Managed guardrails: already in your cloud bill

AWS Bedrock Guardrails includes a contextual grounding check that scores a response on two separate axes — grounding (is it supported by the source?) and relevance (does it answer the query?) — each with its own configurable threshold anywhere from 0 to 0.99. The split matters: a correct, well-grounded sentence that answers a different question fails on relevance while scoring clean on grounding, and only the two-axis form catches it. The documented ceilings are 100,000 characters of grounding source, 1,000 of query, and 5,000 of response, and conversational chatbot use is explicitly out of scope.

Azure AI Content Safety offers groundedness detection with a comparable shape plus two modes: non-reasoning for online use, and a reasoning mode that returns an explanation of which segment was unsupported. It also ships a preview correction feature that rewrites the ungrounded span to match the source. Two limits decide adoption: it is English-only, and it is scoped to summarization and QnA tasks rather than open-ended generation.

Both are the right default if you are already inside that platform: no model to host, no checkpoint to keep current, thresholds in the same console as the rest of your policy. Both carry the same two caveats — per-request pricing that scales with traffic rather than with value, and an opaque model you cannot version-pin or evaluate offline. NVIDIA NeMo Guardrails occupies adjacent ground with its self-check-facts rail, and the NeMo Guardrails production review covers what that rail costs to operate in practice.

Choosing, in three questions

Do you have a source document at check time? If yes, a small classifier is almost always the right answer and HHEM-2.1-Open or MiniCheck is the cheapest credible starting point. If no, the field collapses to sampling consistency and uncertainty scoring, both of which are slower and weaker.

Is the check online or offline? Online means sub-100ms and a fixed cost per request: small classifier, no LLM judge. Offline means an evaluation framework, and there the judge cost is amortised across a dataset instead of charged to a user.

What happens when it fires? A detector that routes to human review can run at a loose threshold. A detector that blocks a response needs a tight one, per-domain calibration, and a measured error budget — the same discipline that keeps false-positive costs from quietly exceeding the harm the control prevents.

What none of them do

Three gaps survive every tool in the table.

Closed-book factuality at scale. If there is no source document and no retrieval index, nothing here verifies a claim against the world. Sampling consistency detects instability, not falsehood, and a model that is confidently and consistently wrong passes.

Agent trajectories. A tool call with the wrong argument, or a plan that skips a required verification step, is an agent failure rather than an unsupported sentence. Response-level faithfulness scoring does not see it, which is why agent pipelines need step-level validation on top of output checks.

Retrieved-source integrity. Every faithfulness checker assumes the source document is trustworthy. An output that faithfully reproduces a poisoned retrieval passage scores perfectly, and the control that catches it lives upstream in moderation for RAG applications rather than in the detector.

Where this sits in a moderation stack

Hallucination detection is an output-side control, and it composes with the harm-side controls rather than replacing them. A realistic pipeline runs a harm classifier such as the omni-moderation endpoint on input and output, a faithfulness classifier on every grounded response, and sampling-based review asynchronously on the high-stakes tail. That is the same layered logic behind the classifier ensemble pattern for content harms, applied to a different failure mode, and the Moderation Stack Matcher will narrow the harm-side half of it to the tools that match your modalities and volume.

Related across the network

• Guardrails AI: Output Validation That Doesn’t Require Retraining — aisecreviews.com
• Data Poisoning in RAG Systems: A 2026 Threat Briefing — ai-alert.org
• Indirect Prompt Injection in RAG Pipelines — aiattacks.dev
• OWASP LLM Top 10 2025: What Changed and Why It Matters — ai-alert.org
• LLM-as-a-Judge Bias: How to Detect and Correct It — evalsml.com
• Qdrant vs Milvus vs Pinecone: Vector DB Comparison — ragstackguide.com