Grounding and Detection: Catching It Before the User Does

The single most effective structural change is to stop asking the model what it knows and start asking what a provided document says.

An ungrounded question requires the model to produce information from its parameters, where there is no boundary between recalled and constructed. A grounded question supplies the material and asks for extraction or synthesis, which is a task the model is far better at and, crucially, a task whose output can be checked against something.

That second property is the important one. Grounding does not only reduce the error rate. It creates a reference against which faithfulness becomes measurable, converting an unverifiable claim about the world into a verifiable claim about a document. Every detection method in this lesson depends on that reference existing.

The retrieval mechanics, chunking, hybrid search, reranking and query rewriting, are covered properly in the Advanced RAG cursus and are not repeated here. What matters for this lesson is what grounding does and does not buy.

What it buys: a large reduction in extrinsic hallucination, and a verification surface.

What it does not buy: immunity. The next step is about the ways a grounded system still fails, because teams that deploy retrieval and consider the problem solved are the ones surprised in production.

Six failure modes survive retrieval, and recognising them prevents misattributing a hallucination to the model when the cause is upstream.

Retrieval returns nothing relevant, and the model answers anyway from parametric knowledge. The most common and most preventable.

Retrieval returns something partially relevant, and the model bridges the gap between what was retrieved and what was asked, inventing the connective tissue.

The sources conflict, and the model silently picks one or blends them into a claim neither source makes.

The source is wrong or stale, and the model faithfully reproduces it. Faithful and false, from the previous lesson.

The model over-generalises from a specific passage, turning one case into a general rule.

And citation drift, where the answer is broadly right but the specific citation attached to a specific sentence does not support that sentence. This one is particularly corrosive, because the presence of a citation is what makes readers stop checking.

The first three share a cause worth naming: the model has no built-in permission to fail. Where retrieval is inadequate, the useful design allows the system to say the corpus does not answer this, which is the abstention path in the next lesson.

The first detection method needs no external reference at all, which makes it the only one available for ungrounded generation.

The insight: a fact the model reliably knows will be reproduced consistently across independent samples. A fabrication is drawn from a distribution over plausible continuations, so resampling produces different fabrications.

So generate the same answer several times at non-zero temperature, in independent calls rather than in one conversation, and compare. Claims appearing consistently are more likely supported. Claims that vary between samples are candidates for fabrication.

This is the principle behind SelfCheckGPT and related approaches, and its appeal is that it requires no knowledge base, no labels and no external service.

Three limitations set its scope. It costs several generations per answer, which is a real multiplier on a production system. It detects uncertainty rather than falsehood, so a model consistently wrong about something, a widely repeated misconception, passes cleanly. And comparing free-text samples for agreement is itself non-trivial, usually needing an entailment model or a judge, which adds back some of the cost.

Where it fits: high-value, low-volume generation, and as a targeted check on the specific claim types the first lesson identified as risky rather than on every output.

Where the system is grounded, the strongest and cheapest check is whether each claim in the output is entailed by the retrieved passages.

Natural language inference gives the vocabulary. For a premise and a hypothesis, the relation is entailment, contradiction, or neutral. Treat the retrieved passages as the premise and each generated claim as the hypothesis.

Entailment means the claim is supported. Contradiction means the output disagrees with its own sources, which is a serious finding and usually a bug rather than a nuance. Neutral is the interesting case: the sources neither support nor contradict, which means the model produced something from outside its evidence. That is unfaithfulness, and in a grounded system it is what you are looking for.

The practical advantage over self-consistency is decisive. A dedicated entailment model is small and fast, so this runs at a fraction of the cost of extra generations, and it produces a claim-level result rather than a document-level score.

The judgement call is what to do with neutral. Not every neutral claim is a fabrication, since connective language and reasonable inference are also neutral. So neutral is a flag for review or citation removal rather than an automatic block, and the threshold belongs in the false-positive budget from the guardrails cursus.

Verifying a whole response as one unit produces a score nobody can act on. Decomposing it into atomic claims produces something you can route.

Split the output into individual verifiable assertions. One sentence often contains several: a name, a date, a quantity, and a causal relation, each independently checkable and independently wrong.

Route each claim by type, because the right check differs. Numeric and factual claims go to entailment against sources. Citations go to existence and support checks. Claims about the world outside the corpus may need an external lookup or may simply be out of scope.

Then aggregate by consequence rather than by count. Nine supported claims and one unsupported dosage is not ninety percent good.

The output of this is not a score but an action: strip the unsupported claim, flag it, ask the model to regenerate without it, or abstain.

A technique that uses the model against itself, structured to avoid the self-review trap from the previous lesson.

The sequence. The model produces a draft. From the draft, generate a set of verification questions, each targeting a specific factual claim. Answer each verification question independently, critically without the original draft in context, so the earlier claim cannot condition the answer. Then revise the draft in light of the answers.

The independence of step three is the entire mechanism. Asking is this right about a claim sitting in context produces agreement. Asking the underlying question fresh produces an answer generated on its own terms, which can then be compared.

It is genuinely effective for factual claims in longer generations, and it has two costs worth pricing. It multiplies calls by roughly the number of claims verified, and it adds substantial latency, which puts it outside the budget for interactive use.

Where it fits: asynchronous or batch generation where correctness matters more than speed. Reports, summaries of source material, drafted correspondence. Not a chat interface.

It also composes usefully with entailment checking rather than competing: entailment catches claims unsupported by the corpus, chain-of-verification catches claims the corpus does not cover at all.

Citation is the most visible grounding signal and the easiest to get wrong in a way that makes things worse.

A citation attached to a sentence is a claim that the source supports that sentence. When it does not, you have not merely failed to help the reader, you have actively suppressed their scepticism. An uncited assertion invites checking. A cited false assertion does not.

Three failure patterns, in increasing subtlety.

The fabricated source, which does not exist. Detectable by existence check against the corpus, and there is no excuse for shipping it.

The real source that does not support the claim. Requires an entailment check between the specific sentence and the specific cited passage, not merely between the answer and the retrieved set.

And the correct source cited for the wrong span, where the answer contains several claims and the citations have drifted relative to them. This is the common one in longer generations and it is invisible to any check operating at document level.

The design implications. Generate citations at the claim level rather than appending them at the end. Verify each against the passage it points to. Surface the supporting text so a reader can check in one click rather than opening a document. And where a claim cannot be cited, say so explicitly instead of leaving it silently uncited among cited neighbours.

The methods differ in cost, coverage and what they require, and the right combination depends on the deployment.

Entailment against sources: cheap, fast, claim-level, requires grounding. The default for any retrieval-augmented system, and the highest return per unit cost.

Citation existence and support checks: very cheap, narrow, catches the most damaging and most visible failures. Effectively mandatory wherever citations are shown.

Self-consistency sampling: expensive, works without grounding, detects uncertainty rather than falsehood. Reserve for ungrounded generation or high-value claims.

Chain-of-verification: expensive and slow, strong on factual claims in long outputs. Batch and asynchronous work only.

Model-as-judge groundedness scoring: moderate cost, flexible, and itself fallible, so useful as a monitoring signal rather than as a gate.

The assembly principle mirrors the guardrails cursus. Cheap checks on everything, expensive checks targeted at the claim types and conditions the first lesson flagged as high-risk. Uniform application of an expensive method is how verification budgets get spent without improving the outcome.

And whatever you build, run it against a fixed evaluation set with known hallucinations, so you can measure detection rate rather than assume it. A detector nobody has measured is a component with unknown behaviour in the safety path.

Detection is the second-best intervention. Several upstream changes reduce the rate before anything needs catching, and they are usually cheaper.

Improve retrieval quality. A large share of hallucination in grounded systems is a retrieval failure wearing a generation costume: nothing relevant came back, so the model improvised. Measuring retrieval separately from generation is what makes this visible, and it is the single most useful diagnostic split.

Give the model permission to fail. A prompt that explicitly authorises saying the provided documents do not contain this dramatically changes behaviour, because the default instruction-tuned disposition is to be helpful, and helpfulness under thin evidence produces fabrication.

Restrict the task. Extraction is safer than synthesis, which is safer than open generation. Where the product tolerates it, narrowing the task narrows the failure surface.

Supply the structure. Asking for output in a schema with a field for source per claim makes uncited claims structurally visible rather than requiring detection.

And fix the corpus. The faithful-and-false quadrant is not addressable downstream at all, so staleness governance, conflicting-version resolution and authoritative-source designation do work that no verifier can.

The general rule: every hallucination prevented upstream is one you do not have to pay to detect, and detection is the expensive half.