TL;DR

• What it does: The paper “Unmediated AI-Assisted Scholarly Citations” by Stefan Szeider (TU Wien) presents MCP-DBLP, a system that lets you chat naturally with an AI to build a perfectly correct list of references, while guaranteeing the citation data is never invented by the AI.
• The trick: Instead of letting citation text flow through the language model (where it can be silently altered), the reference is fetched straight from the DBLP database and written directly to a file on disk — the AI only ever receives the file path, never the citation data itself. This is called unmediated export.
• The result: With unmediated export, 82.7% of citations were perfect matches (versus 28.2% for a web-search-only AI — a 2.9× improvement) and 0% of citations had corrupted metadata, measured across 104 deliberately garbled citations in three independent experiments.

Key Findings

• The system is built on the Model Context Protocol (MCP), an open standard Anthropic introduced on November 25, 2024 that lets AI assistants call external programs in a uniform way. The paper notes that “since its November 2024 release, over 7,000 MCP servers have been developed.”
• MCP-DBLP was, in the author’s words, “released in February 2025 … among the first bibliography-focused MCP servers.” It is open source on GitHub and PyPI and ships with a test suite of 49 automated tests.
• It exposes eight tools for searching and exporting from DBLP, the computer-science bibliography, which the paper describes as having “over 6 million publications.” (DBLP itself passed the 2²³ = 8,388,608 publications milestone at its September 2025 anniversary colloquium.)
• The experiments used Claude Code subagents running Claude Sonnet 4.5, compared three ways of working: web-only (Web), MCP with manual/mediated export (MCP-M), and MCP with unmediated export (MCP-U).
• Unmediated export won decisively on every accuracy measure and, crucially, hit 0% corrupted metadata and 0% incomplete metadata.

What is a large language model, really?

A large language model (LLM) — the technology behind ChatGPT, Claude, and Gemini — is, at heart, a very sophisticated next-token prediction machine. A “token” is a small chunk of text (a word or part of a word). The model reads everything so far and asks one question over and over: “Given all these words, what is the most likely next chunk of text?” Then it adds that chunk and repeats.

This design is astonishing for fluent writing. But it has a built-in weakness that is the whole reason this paper exists.

Why AI invents fake citations (“hallucination”)

A hallucination is when an LLM produces text that sounds completely plausible but is simply not true. A citation hallucination is the special, dangerous case where the AI invents a scholarly reference: a real-looking author list, a believable title, a proper-looking venue, and a valid-looking DOI — for a paper that does not exist.

How common is this? The paper’s own “Obstacle” section quantifies it: “Agrawal et al. tested GPT-3, ChatGPT, and GPT-4, finding error rates declining from over 70% to under 50% with more advanced models. Kim et al. examined citations from four models and found fabrication rates exceeding 80% in certain publication categories.” In other words, even good models get references wrong very often — and this is now a real problem in academic publishing.

Bibliographic databases and DBLP

A bibliographic database is a carefully curated catalogue of publications. Each entry (a “record”) stores the exact, verified facts about one paper: its title, its authors, the venue where it appeared, the year, and identifiers like a DOI or URL. Think of it as a giant, trustworthy library card catalogue — but digital and machine-readable.

DBLP (originally “DataBase systems and Logic Programming”) is the leading bibliographic database for computer science. It is maintained by Schloss Dagstuhl – Leibniz Center for Informatics in Germany, has been running since 1993, and is free to use. The paper describes it as having “over 6 million publications”; DBLP’s own website celebrated crossing 2²³ = 8,388,608 publications at its 2025 anniversary. Every DBLP record includes titles, authors, venues, years, DOIs, and URLs — exactly the fields a citation needs.

What is BibTeX?

BibTeX is a plain-text format for storing a citation so that typesetting software (used to write scientific papers) can format it automatically. A BibTeX entry is just a labelled block of fields. Here is a real example:

@inproceedings{vaswani2017attention,
  author    = {Ashish Vaswani and Noam Shazeer and Niki Parmar and others},
  title     = {Attention Is All You Need},
  booktitle = {Advances in Neural Information Processing Systems},
  year      = {2017},
  pages     = {5998--6008}
}

The @inproceedings part says “this is a conference paper.” The text right after the brace — vaswani2017attention — is the citation key, a nickname you use inside your document to point at this reference. Everything else is the exact data. If even one character of the author name or the DOI is wrong, the citation is broken. That is why exactness matters so much here.

Tools, function calls, and MCP (the universal adapter)

Modern AI assistants are not limited to talking. They can call tools — also called function calls. A tool is simply an external program the AI is allowed to run: a calculator, a web search, a weather lookup, a database query. The AI decides “I need to search DBLP now,” fills in the search words, runs the tool, and reads back the result.

But there was a messy problem: every AI app and every tool spoke a different “language,” so connecting M models to N tools meant building M×N custom bridges. The Model Context Protocol (MCP), introduced by Anthropic on November 25, 2024, is an open standard that fixes this. Each AI implements MCP once; each tool implements MCP once; now everything can talk. An “MCP server” is a program that offers a set of tools in this standard way.

The paper notes MCP’s rapid rise — “over 7,000 MCP servers have been developed” since launch — and builds its system, MCP-DBLP, as one such server that plugs the DBLP database into any MCP-compatible chat app such as Claude Desktop or Cursor.

The core idea: “mediated” vs “unmediated”

This is the single most important concept in the whole paper, so let’s go slowly.

When the AI fetches a citation from a database, the data has to get back to your file somehow. There are two possible routes:

Mediated (the risky, normal way)

Mediated means the citation data travels through the language model. The database sends the reference to the AI; the AI reads it into its “context” (its working memory of text); and then the AI writes it out for you. The problem: while the data is inside the AI, the AI is still a next-token predictor. It might “tidy up” a name, drop a DOI it thinks is optional, or auto-correct an unusual spelling. The paper gives a chilling real example: the model “corrects” the unfamiliar name “Ma’mon Abu Hammad” into the more common-looking “Manal Abu Hammad,” or “invents page numbers when actual values are unavailable.” The data was correct — until it passed through the model.

Unmediated (the paper’s solution)

Unmediated means the citation data never enters the model at all. MCP-DBLP fetches the BibTeX entry directly from DBLP and writes it straight to a file on your disk. The only thing that travels back through the model is the file path (something like /Users/you/refs.bib). The model literally never sees the author names, titles, or DOIs, so it cannot possibly corrupt them.

The “shopping cart” workflow

The paper describes the export mechanism with a lovely everyday analogy: an online shopping cart. As the AI finds each paper, it calls add_bibtex_entry(dblp_key, citation_key) — like adding an item to your cart. At that moment the server builds the URL https://dblp.org/rec/{dblp_key}.bib, fetches the real BibTeX (with a 10-second timeout for safety), and stores it. Later, one call to export_bibtex(path) is the “checkout”: it writes the whole cart to your file. The only thing the model ever does to the data is a purely mechanical, deterministic swap of the citation key label — done by simple pattern matching, not by “thinking.”

The eight MCP-DBLP tools

MCP-DBLP exposes exactly eight tools. The first six are for finding papers; the last two implement the safe two-step export.

Search tools accept a similarity threshold between 0.0 and 1.0 for fuzzy matching, which the system computes using Python’s built-in difflib.SequenceMatcher. That leads us neatly to the next idea.

Fuzzy matching, explained simply

Fuzzy matching (or approximate string matching) is a way to decide whether two pieces of text are “close enough” to be the same thing, even when they are not identical. It gives a similarity score instead of a strict yes/no.

Why does a bibliography search need this? Because people almost never type a citation perfectly. They write “Devlin paper from 2018” instead of the full title, or “neurips’20” instead of “Advances in Neural Information Processing Systems 2020.” A strict, exact search would find nothing. Fuzzy matching lets the system say “this is a 0.87 match — probably the paper you meant.”

How the experiment worked

To test the idea fairly, the author needed messy inputs with known correct answers. Here is the setup, step by step.

• The test set: 104 real papers were sampled from DBLP as “ground truth,” using stratified sampling — “50% from 2020–2025, 25% from 2015–2019, and 25% from 2010–2014.” All their correct BibTeX entries were fetched from DBLP “with a 100% success rate.”
• Degrading (obfuscating) the citations: Each correct citation was deliberately made vague/noisy to mimic how researchers actually write. Difficulty ranged “from full author names with years to minimal topic hints.” Real examples from the paper: “Grassi’s paper on computer virus from 2025” and “hybrid algorithm paper on auvs task by Sun 2024.” This is what “degrade a citation” means: strip it down to a realistic, imperfect hint.
• Three conditions compared: Web (the AI uses only web search — the baseline), MCP-M (uses MCP-DBLP search but builds BibTeX manually, so data passes through the model — mediated), and MCP-U (uses the unmediated file export).
• The judge (models): Each condition was run by Claude Code subagents using Claude Sonnet 4.5, in non-interactive mode (the agent worked alone, with no human confirming ambiguous matches).

Every result was sorted into one of six categories. This is how the paper decides whether a citation “counts” as a success:

What is “metadata corruption”? It is when the citation points to the right paper but contains a wrong value in a field — a changed name, an invented page number. The paper stresses these “are not typos but plausible fabrications,” which makes them especially hard to catch by eye.

The results

Here are the averaged numbers across the three experiments (104 citations each), straight from the paper.

How to read these numbers

• The headline: The paper’s conclusion states it plainly — “82.7% PM for MCP-U versus 28.2% for Web, a 2.9× improvement, with zero metadata corruption, across three independent experiments with 104 obfuscated citations each.”
• Why MCP-M is only halfway there: Mediated export got a much better Perfect-Match rate than the web baseline (47.1%), but it suffered a huge 36.5% Incomplete-Metadata rate — “because the agent constructs BibTeX entries manually, often omitting DOI, volume, or page numbers.” When the model builds the entry by hand, it forgets fields.
• Why MCP-U wins: Because the entry is copied whole, directly from DBLP, it “achieves 0% IM by exporting directly from DBLP. This validates unmediated export: every MCP-U entry contains exactly the metadata provided by DBLP.”
• Honest limits: Wrong-Paper stayed at 15–19% for every method. The paper attributes this to genuine ambiguity, not the retrieval method: if a hint like “Chaki ieee25” matches several papers, any method may pick the wrong one. Importantly, the experiments ran in non-interactive mode; in real use, a human could confirm the right candidate and shrink this number.

Comparison with other 2025–2026 work

Citation reliability became a hot research topic in 2025–2026, partly because fabricated references started showing up in real conference submissions. But most of that work solves a different half of the problem than Szeider’s paper does. Here is the crucial distinction:

Here are four genuinely comparable, verified works from this period, explained in beginner terms.

1. CiteCheck — a retrieval-grounded detector

CiteCheck: Retrieval-Grounded Detection of LLM Citation Hallucinations in Scientific Text (Khashayar Khajavi, Shaghayegh Sadeghi, Rise Adhikari, Alexander Tessier; arXiv:2605.27700, 26 May 2026). It takes a finished citation and checks it: it searches scholarly databases (CrossRef, Semantic Scholar, OpenAlex, arXiv) for the closest real paper, then uses an LLM to compare and label the citation as Exact, Minor (a real paper with a corrupted field), or Major (fabricated). On a 982-citation physics benchmark it reached “88.7 macro-F1 and 88.9% accuracy,” beating GPT, Claude, and Gemini baselines. Same as Szeider: both separate “retrieval” from the model’s judgment and both use controlled corruption to test. Different: CiteCheck grades existing citations; Szeider prevents bad ones from being created.

2. “Source or It Didn’t Happen” / CiteTracer — a multi-agent detector

Source or It Didn’t Happen: A Multi-Agent Framework for Citation Hallucination Detection (Mingzhe Li, Zhiqiang Lin, Shiqing Ma; University of Massachusetts Amherst & Ohio State; arXiv:2605.08583, updated 14 Jul 2026). Its system, CiteTracer, breaks the checking job across specialised “agents”: one extracts references from a PDF, one gathers evidence from eight bibliographic sources, one matches fields with deterministic rules, and specialists give a verdict from a 12-code taxonomy (Real / Potential / Hallucinated). It reached “97.1% accuracy on the synthetic benchmark” and detected 97.1% of real fabricated citations from the ICLR 2026 desk-reject queue. Same as Szeider: both value deterministic (non-generative) steps for exactness. Different: CiteTracer is a heavyweight auditor for reviewers; MCP-DBLP is a lightweight writing assistant.

3. Cited but Not Verified — measuring the problem in deep-research agents

Cited but Not Verified: Parsing and Evaluating Source Attribution in LLM Deep Research Agents (Hailey Onweller, Elias Lumer, Austin Huber, Pia Ramchandani, Vamse Kumar Subbiah, Corey Feld; PwC; arXiv:2605.06635, 7 May 2026). This is a measurement study of the “deep research” agents that write cited reports. Its striking finding: even top models keep link validity above 94% and relevance above 80%, “yet achieve only 39–77% factual accuracy,” and — counter-intuitively — accuracy drops ~42% as the agent does more searching. Same as Szeider: both show that giving an AI web/tool access does not, by itself, make citations trustworthy. Different: this paper quantifies the disease; Szeider offers a cure for one specific case (bibliographic export).

4. GhostCite — the scale of the epidemic

GhostCite: A Large-Scale Analysis of Citation Validity in the Age of Large Language Models (Zuyao Xu, Yuqi Qiu, Lu Sun, and colleagues; arXiv:2602.06718, 6 Feb 2026). Using an open framework called CiteVerifier, it benchmarked 13 LLMs across 40 research fields and found “all models hallucinate citations at rates from 14.23% to 94.93%.” It also analysed 2.2 million citations from 56,381 published papers and confirmed a sharp rise in invalid citations. Same as Szeider: both agree the raw LLM is an unreliable citation source. Different: GhostCite is a diagnosis at population scale; Szeider is an engineering solution.

Also worth knowing (real, verifiable): CiteAudit (Yuan et al., arXiv:2602.23452) — a multi-agent benchmark checking whether a cited source truly supports its claim; LongCite (Zhang et al., arXiv:2409.02897) — trains models to add sentence-level citations in long answers; and Detecting and Correcting Reference Hallucinations in Commercial LLMs and Deep Research Agents (Rao et al., arXiv:2604.03173), which found “3–13% of citation URLs are hallucinated.”

Why this matters: “reducing” vs “eliminating”

Nearly every other approach makes hallucination rarer. Szeider’s makes one specific hallucination impossible. That difference is bigger than it sounds.

And the principle generalises far beyond bibliographies. The lesson is: whenever an AI must return exact, arbitrary data that cannot be reconstructed from meaning, route that data around the model, not through it. The model should orchestrate and explain; the authoritative source should deliver the exact value untouched. This applies to:

• Identifiers: DOIs, ISBNs, product SKUs, tracking numbers, account IDs.
• Financial figures: exact prices, balances, invoice totals fetched from a ledger.
• Legal citations: exact case numbers and statute references — a domain where AI-fabricated citations have already caused real courtroom sanctions.
• Medical codes: ICD diagnosis codes, drug identifiers, dosages pulled from an authoritative formulary.

In all of these, the safe pattern is the same: let the model handle the conversation, but let a verified source write the exact value directly to the output, returning only a reference through the model.

Limitations and future work (as the paper frames them)

• Ambiguity remains: Wrong-Paper errors (15–19%) come from vague queries, not the export method. The author notes that interactive use — where a human confirms the intended paper — “would reduce both WP and NF rates.” The experiments deliberately used non-interactive mode.
• Scope is DBLP / computer science: The demonstration is on DBLP, but the author argues “the architectural principles apply to any bibliographic database with a programmatic interface (PubMed, arXiv, Semantic Scholar, or institutional repositories).”
• The model still chooses the tools: Unmediated export protects the data, but the AI still decides which paper to add — so it must add the right DBLP key. The “shopping cart” design mitigates this by adding each entry immediately, “reducing the risk of key corruption.”
• Framing of the contribution: The paper positions itself modestly and precisely — it is an architectural contribution (a way of wiring the components together), not a new model. Its claim is that “specialized database tools with architectural safeguards can provide both natural language interaction and publication-quality citations.”

The contribution in 5 plain bullets

1. LLMs invent fake citations because a DOI or reference is an arbitrary string with no meaning to reason from — so a next-token predictor just produces a plausible-looking guess.
2. MCP-DBLP connects an AI chatbot to the DBLP database through the Model Context Protocol, exposing eight tools for searching and exporting references.
3. Its key move — unmediated export — writes verified BibTeX straight from DBLP to a file and returns only the file path to the model, so the citation data never passes through the model and cannot be corrupted.
4. In tests on 104 deliberately garbled citations, unmediated export hit 82.7% perfect matches (vs 28.2% web-only, a 2.9× gain) with 0% corrupted and 0% incomplete metadata.
5. The broader lesson is architectural: to guarantee exact data from an AI, route the data around the model, turning “rarely wrong” into “impossible to be wrong” — a pattern that extends to financial, legal, and medical identifiers.

How to cite this paper

Note a small subtlety verified from the publisher’s record: the article was published online on 2025-12-22, but the proceedings volume is officially labelled Vol. 8 (2026). The publisher uses an article number (3161) rather than page numbers. The publisher’s own auto-generated APA string uses year 2025; the arXiv journal reference uses the 2026 volume. Both forms below are correct.

@inproceedings{szeider2026unmediated,
  author    = {Stefan Szeider},
  title     = {Unmediated {AI}-Assisted Scholarly Citations},
  booktitle = {The Second Bridge on Artificial Intelligence for
               Scholarly Communication (AAAI-26)},
  series    = {Open Conference Proceedings},
  volume    = {8},
  year      = {2026},
  publisher = {TIB Open Publishing},
  address   = {Hannover, Germany},
  doi       = {10.52825/ocp.v8i.3161},
  note      = {arXiv:2602.01686 [cs.DL]}
}

Software: MCP-DBLP is available on PyPI (mcp-dblp) and GitHub (szeider/mcp-dblp). Supplementary material: Zenodo, DOI 10.5281/zenodo.17688073.

FAQ for beginners

Does this make the AI itself more honest?

No — and that is the elegant part. It does not try to fix the model. It simply removes the citation data from the model’s reach, so the model’s tendency to “improve” text can never touch it.

Is “unmediated” a fancy word for “the AI just uses a database”?

Not quite. Even an AI using a database can corrupt the answer if the data flows back through the model before reaching your file (that is the “mediated” case, MCP-M in the paper, which still had 36.5% incomplete metadata). “Unmediated” specifically means the data goes straight to the file and only the file path returns through the model.

What is a DOI and why can’t the AI just remember it?

A DOI is a unique identifier for a document, like 10.52825/ocp.v8i.3161. Its exact characters are arbitrary — they carry no meaning the model can reason toward — so a memory-based guess is almost always slightly wrong.

Why does the paper compare against “web search only”?

Because letting an AI browse the web is the common, intuitive fix people try. The paper shows it is not enough: the web baseline reached only 28.2% perfect matches and still corrupted 6.7% of entries.

Could this idea break if I ask for a paper that isn’t in DBLP?

Yes — DBLP covers computer science, so a paper outside that field may not be found (a “Not Found” result). The guarantee is about not corrupting data, not about having every paper. The author notes the same architecture could wrap PubMed, arXiv, or Semantic Scholar.

Which AI model did the experiments use?

Claude Code subagents running Claude Sonnet 4.5, in a non-interactive mode where the agent worked without a human confirming ambiguous matches.

Is MCP-DBLP something I can actually use?

Yes. It is open source, installable from PyPI as mcp-dblp, and works with MCP-compatible chat apps like Claude Desktop and Cursor. It ships with 49 automated tests.

Is this the same as the citation-detector papers I’ve heard about?

No. Detectors (like CiteCheck or CiteTracer) find bad citations after they are written. MCP-DBLP prevents bad citations from being created in the first place. They are complementary.

Further reading (with real arXiv IDs)

• Szeider, S. — Unmediated AI-Assisted Scholarly Citations — arXiv:2602.01686 (the paper this guide explains); DOI 10.52825/ocp.v8i.3161.
• Khajavi et al. — CiteCheck: Retrieval-Grounded Detection of LLM Citation Hallucinations in Scientific Text — arXiv:2605.27700.
• Li, Lin & Ma — Source or It Didn’t Happen: A Multi-Agent Framework for Citation Hallucination Detection (CiteTracer) — arXiv:2605.08583.
• Onweller et al. — Cited but Not Verified: Parsing and Evaluating Source Attribution in LLM Deep Research Agents — arXiv:2605.06635.
• Xu et al. — GhostCite: A Large-Scale Analysis of Citation Validity in the Age of Large Language Models — arXiv:2602.06718.
• Yuan et al. — CiteAudit: You Cited It, But Did You Read It? — arXiv:2602.23452.
• Rao et al. — Detecting and Correcting Reference Hallucinations in Commercial LLMs and Deep Research Agents — arXiv:2604.03173.
• Zhang et al. — LongCite: Enabling LLMs to Generate Fine-grained Citations in Long-Context QA — arXiv:2409.02897.
• Gao et al. — Enabling Large Language Models to Generate Text with Citations (the ALCE benchmark, cited by the paper) — arXiv:2305.14627.
• Background: Model Context Protocol — introduced by Anthropic on November 25, 2024 (modelcontextprotocol.io); DBLP computer science bibliography — dblp.org.