I've read statements like this "it is derived from citrus fruit by fermentation of crude sugars" which makes absolutely no sense (it's contradictory: corn sugar or other sugars are fermented to make it OR it's extracted from citrus).
But having worked for a major citric acid manufacturer I can tell you that very little is extracted and that's pretty expensive.
(It is FOUND in citrus fruits, but not generally extracted).
To be safe, I'd avoid it altogether. Because you will never know. Be sure to read labels very carefully! Even foods like cottage cheese and gummy bears contain citric acid. And a zillion other foods and products.).