Automated legal citation verification systems are critical for ensuring the factual integrity of AI-assisted legal research and drafting, but large language models (LLMs) serving as verifiers remain vulnerable to adversarial persuasion. We introduce a three-class benchmark dataset (valid, real_wrong_content, fabricated) derived from CourtListener opinions via a hybrid extraction and dual-model validation pipeline, and evaluate two model families (Llama, GPT-OSS) plus a cross-family adversarial pairing across control, authority-appeal, and fabricated-citation conditions, both ungrounded and retrieval-grounded. Within-model logistic regressions with item-clustered robust standard errors show that authority appeals massively increase the odds of a correct GPT-OSS 20B verification flipping to incorrect (OR=23.333, p<0.0001) and show strong effects in Llama 70B (OR=11.953, p=0.0029), avoiding small-model contamination. Retrieval grounding broadly reduces flip rates in large models (GPT-OSS 120B OR_Grounded=0.123; Llama 70B OR_Grounded=0.239). Cross-family attacks (GPT-OSS 120B → Llama 70B) achieve 98.0% ungrounded authority true_ASR vs. a 70.6% control baseline, and grounding does not eliminate this gap (+39.7pp, p<0.000001). Beyond these findings, we argue that persuasion benchmarks require a content-free control condition and a Confidence-Weighted Attack Success Rate (CW-ASR) to separate genuine "confident override" from "hesitant doubt": authority appeals make verifiers confidently wrong (mean final confidence 8.56/10; 96.8% of flips at confidence ≥ 8), whereas content-free reconsideration produces hesitant, low-confidence reversals (mean 6.80/10).

Neural text representations often lack structural guarantees for syntactic variations, relying instead on statistical interpolation to recognize paraphrases. We introduce the Pāṇinian Intermediate Representation (PIR), a deterministic compiler that maps English sentences to role-tagged canonical sequences using Universal Dependency parses. Unlike heuristic methods such as stopword removal, the PIR compiler is deterministic: given a correct dependency parse, syntactically equivalent paraphrases compile to identical strings. On a 200-pair diagnostic suite of templated syntactic alternations spanning active/passive voice, dative shift, and topicalization, the compiler produces identical strings for 196 pairs; all four failures are structurally typed and traced to known parser limitations. Stopword removal produces identical strings for 0 of 200 pairs. To bridge the performance gap in downstream tasks, we propose Hybrid PIR, which selectively restores lexical content through a deduplication mechanism. Hybrid PIR achieves similarity performance comparable to stopword removal (0.8130 vs. 0.8154 average ρ; bootstrap 95% CI on the difference includes zero) at 43.8% token compression, while providing structural guarantees that surface-level methods cannot. On retrieval benchmarks, Hybrid PIR reaches 80% of the English baseline nDCG@10 on BEIR SciFact and 86% of MRR@10 on MS MARCO QA at 39.0% compression. A three-variant representation ablation validates our deduplication design: removing this mechanism degrades retrieval performance by 3.5 points and turns the compression benefit negative (-3.0%). In a QQP-validation duplicate-detection use case (40,430 pairs), Hybrid PIR reaches precision 0.861 with no tuning, matching a tuned embedding threshold and validating the intended deployment as an offline canonicalization tool for deduplication and index construction.