Part VI — Debugging Prompts, Retrieval, and Hallucinations

The answer is half right — which half do you act on?

Chapter 33 convicted the generation boundary for incident C. Now the harder case arrives: an answer with four claims, three grounded and one invented, delivered in one fluent paragraph. “Your refund is pending (ledger confirms), no reference has been issued (ledger confirms), processing typically takes 3–5 days (policy doc confirms), and reference RB-8814 was assigned September 2 (nothing confirms).” Finance can act on the first three. The fourth, acted on, emails a customer a fiction.

Concrete failure. The reviewer marks the whole answer “wrong” and sends it back; the next generation rephrases all four claims and the grounded three degrade. Or the reviewer marks it “right enough” and RB-8814 ships. Whole-answer verdicts destroy good evidence or smuggle bad evidence — because the unit of judgment is wrong.

OBSERVATION: output contains four separable factual claims; frozen sent context byte-supports three (ledger line + policy line present) and byte-supports none for RB-8814 (zero hits across context, corpus snapshot pinned). HYPOTHESIS H1 (single-claim break): exactly one claim lacks support; the rest hold. H2 (context gap): the missing claim reflects evidence never assembled (boundary B residue). H3 (generation overreach): the missing claim contradicts or outruns assembled evidence (boundary C). INFERENCE: none yet — H1/H2/H3 predict different per-claim support verdicts and are separable only by checking claims atomically against bytes.

This chapter’s question: for each atomic claim, what evidence supports it — and what is the verdict per claim?

Why “check the answer” fails first

The obvious move — reading the paragraph and judging overall correctness — fails because paragraphs blend support levels. Five defects hide behind whole-answer review:

1. Support averaging. Three grounded claims lend credibility to the invented fourth. Fluency plus partial truth reads as full truth.
2. Citation-shape trust. The answer appends “[ledger][policy]” after every sentence including the RB-8814 sentence. Brackets are typography until each maps to a byte range.
3. Paraphrase drift. “Pending” vs. “being processed” vs. “processed” — re-reading for gist equates distinct ledger states. Support requires exact-quote matching, not gist.
4. Missing-claim blindness. Review checks what is said, not what the question required and the answer omitted (the “no reference issued” hedge deleted for conciseness — Chapter 31’s pair at work).
5. Model-assisted grading. Asking another model “is this faithful? 1–10” returns a confident 8. A score is not a support relation; it cannot cite a hash.

OPINION: hallucination is not a property of answers. It is a property of claims without evidence chains. Break the paragraph or you cannot see the break.

The mental model: hallucination-as-evidence-chain-break — every atomic claim needs an unbroken chain: claim → quoted context span → context hash → retrieval/provenance record. A claim with a complete chain is SUPPORTED (for this context); a claim with a missing or contradicting link is UNSUPPORTED or CONTRADICTED. No chain, no trust — regardless of fluency.

The two failing verdicts have standard names. Ji and colleagues’ survey distinguishes intrinsic hallucination — output that contradicts the source — from extrinsic hallucination — output the source cannot verify (Ji et al., 2023); recent benchmarks operationalize the split directly (HalluLens separates faithfulness / intrinsic from factuality / extrinsic hallucination and adds a task for non-existent entities — the RB-8814 class — Bang et al., 2025). The chapter’s CONTRADICTED is intrinsic; its UNSUPPORTED is extrinsic. The distinction matters for repair: intrinsic breaks are generation ignoring present evidence (H3), extrinsic breaks may be either generation inventing (H3) or evidence never assembled (H2).

The method: atomic claims, per-claim verdicts

Freeze the output and the sent context (Chapter 33’s triple) before any re-asking. Then:

1. Split into atomic claims. One factual assertion per row; no conjunctions. (“RB-8814 was assigned” and “assigned September 2” are two claims.) Discard style, keep assertions.
2. Demand a span per claim. For each claim, quote the exact supporting span from the sent context (byte offsets) or mark NONE. Paraphrase summaries are not spans.
3. Verdict each claim. SUPPORTED (span present, hash-linked, semantically entailing); UNSUPPORTED (no span); CONTRADICTED (span asserts the negation); OUT-OF-CONTEXT (true in the world, absent from context — still UNSUPPORTED for grounding purposes).
4. Attribute the break. UNSUPPORTED-via-absent-context routes to H2 (assembly/retrieval residue); CONTRADICTED or out-of-thin-air routes to H3 (generation). Repair per claim, not per paragraph.

The claim/evidence table is the evidence-ledger slot of the book’s one diagnostic-case record — the same object the pinned bundle (Part IV) and work-product case file (Part V) began, and that Chapter 45 freezes as the AI crash dump. Each stage adds fields; none starts a new format.

    flowchart TD
    S["split the answer into atomic claims — one assertion per row, conjunctions separated"] --> P["per claim: search the frozen sent context for an exact supporting span"]
    P --> Q{"span found?"}
    Q -->|yes| E{"span entails or negates the claim?"}
    E -->|entails| SUP["SUPPORTED for this context — ships"]
    E -->|negates| CON["CONTRADICTED (intrinsic) — H3 generation repair"]
    Q -->|"no span"| H{"0 hits corpus-wide on the pinned snapshot?"}
    H -->|"absent everywhere"| H3["UNSUPPORTED — H3 generation overreach; withhold or hedge"]
    H -->|"present in corpus, past the assembly cut"| H2["UNSUPPORTED — H2 assembly / retrieval residue (Ch32-33)"]
    SUP --> RV["re-verify the WHOLE table x3 after any claim-scoped repair"]
    CON --> RV
    H3 --> RV
    H2 --> RV
  

CLAIM/EVIDENCE TABLE (sent context hash c55e; snapshot idx-2026-08-14):
C1 "refund is pending" -> span "refund PENDING" @offset 1,204 (hash d4e2) -> SUPPORTED
C2 "no reference issued" -> span "no reference issued" @offset 1,221 (hash d4e2) -> SUPPORTED
C3 "processing takes 3-5 days" -> span "standard processing 3-5 days" @offset 4,077 (hash 88b1) -> SUPPORTED
C4a "reference RB-8814 assigned" -> span NONE (grep 0 hits in sent + snapshot) -> UNSUPPORTED (H3)
C4b "assigned September 2" -> span NONE (0 hits) -> UNSUPPORTED (H3)
RULE: brackets after C4a/C4b ("[ledger]") are typography. Spans decide.

OBSERVATION (constructed illustration, not a measured run): three claims map to quoted spans with hashes; C4a/C4b map to zero hits in both sent context and the pinned snapshot. UPDATED BELIEF: H1 supported (single-claim-cluster break at C4); H2 exonerated for C4 (no retrieval/assembly stage could supply what the corpus lacks — snapshot grep confirms); H3 supported for C4 (generation overreach). No claim beyond this answer.

No fluency, confidence, citation count, agreement across samples, single clean re-run, or downstream quiet (“no complaint yet”) alters any row’s verdict. Only spans do.

Example: checking the refund paragraph claim by claim

The paragraph is frozen; the checker is mechanical:

# claim/evidence inspector sketch: split, span-match, verdict (no grading model)
claims = split_atomic(output)  # OBSERVATION: [C1, C2, C3, C4a, C4b], conjunctions split
for c in claims:
    spans = exact_spans(c, sent_context)  # MEASUREMENT: byte offsets or NONE
    verdict = "SUPPORTED" if entails(spans, c) else ("CONTRADICTED" if negates(spans, c) else "UNSUPPORTED")
    log(c.text, spans or "NONE (0 hits)", verdict, sent_context.hash)
# H1 predicts: exactly C4-cluster UNSUPPORTED. H2 predicts: missing span traceable
# to assembly cut (offset beyond budget). H3 predicts: corpus-wide 0 hits, span
# absent everywhere -> generation overreach. Pre-written before matching.

In the constructed case the repair is claim-scoped: constrain generation so any claim without a span is either withheld or explicitly hedged (“no reference found in the provided documents”), then re-run the pinned input ≥3 times and re-verify every row — including the previously SUPPORTED ones, which must not degrade. The shipped fix is verified at the claim level, not the paragraph level: C1–C3 SUPPORTED ×3, C4a/C4b withheld-or-hedged ×3.

Second artifact: the withhold-or-hedge rule set

Claim tables diagnose; the rule set prevents. Once C4-class breaks (confident specifics with zero-hit spans) recur, the durable fix is a generation constraint stated as checkable rules, not as tone guidance (“be careful”):

1. Withhold-or-hedge. Any claim the generator cannot attach to a context span is either withheld or prefixed with an explicit hedge (“the provided documents contain no reference number”). The hedge names the boundary (provided documents), never the world (“no reference exists” would outrun the context — OUT-OF-CONTEXT discipline).
2. Identifiers require verbatim spans. Reference numbers, dates, amounts: exact-match spans or withheld. Paraphrase is forbidden for identifiers — “gist matching” for IDs is how RB-8814-class fictions ship.
3. Hedges are verified like claims. After repair, the hedged sentence is itself split and verdict: “the provided documents contain no ___” is SUPPORTED only if the span search (0 hits, logged) backs the absence-in-context. A hedge without its own hit-count log is decoration.
4. Count the withholds. Track withhold rate per fixture family across trials. A rising withhold rate with steady SUPPORTED rows is healthy grounding; a rising rate with degrading SUPPORTED rows signals retrieval/assembly decay underneath (route to Chapters 32–33, not tighter wording).

WITHHOLD RULES (pinned to suite refund-family):
R1: no-span claim -> withhold or hedge naming the context boundary
R2: identifiers (ref/date/amount) -> verbatim span or withhold, no paraphrase
R3: hedge -> must cite its own 0-hit search log (snapshot + sent context)
METRIC: withhold rate ___% x3 trials (SUPPORTED rows steady? y/n ___)
RULE: hedges are claims too. They get rows.

OBSERVATION (constructed illustration): under R1–R3 the refund answer becomes three SUPPORTED claims plus one logged hedge; withhold rate 25% stable across three trials; SUPPORTED rows unchanged. UPDATED BELIEF: rule set supported as containment for this fixture family; no claim that hedging equals truthfulness in general. Containment ships; grounding still depends on the pipeline.

Research lineage: atomic claims, attribution, and context-faithful generation

The claim/evidence table is attribution measurement, done by hand. Rashkin and colleagues formalized Attributable to Identified Sources (AIS): a statement is attributable to a source only if a generic reader would agree the source supports it (Rashkin et al., 2023). The chapter’s per-claim span requirement is AIS at byte granularity — “would a reader agree” replaced with “does an exact span entail it.”

The automated version searches instead of using fixed context. Wei and colleagues’ SAFE breaks a long answer into individual factoids and checks each one with search-engine queries, producing per-fact verdicts of supported / not supported / irrelevant that tracked human annotators closely (Wei et al., 2024). Those three verdicts are the chapter’s SUPPORTED / UNSUPPORTED / OUT-OF-CONTEXT. The difference is scope: SAFE asks “is this true in the world?”; the claim table asks “is this grounded in this context?” — the grounding question is the one a RAG pipeline is actually responsible for.

Withhold-or-hedge is trainable and promptable. Zhou and colleagues found that framing the task as answering “based on the given context” (opinion-based prompting) and adding counterfactual demonstrations measurably raised both context faithfulness and the rate of correct abstention when the context lacked the answer (Zhou et al., 2023). The rule set in this chapter is the deterministic, checkable form of that intervention.

The span-level unit is empirically the right one, and detection signals cannot replace it. Yeh and colleagues built HalluEntity to study hallucination detection at the entity level and found that existing methods work at the sentence or paragraph level and cannot pinpoint which span is hallucinated when an answer intermixes true and false content — the “support averaging” trap. Across seventeen models, token-probability methods over-predict (they flag rare-but-correct entities, Chapter 22’s dip again), and context-aware methods do better but stay inadequate (Yeh et al., 2025). An uncertainty or consistency signal (Chapter 22’s semantic entropy or self-consistency) is the fleet-wide triage that routes an answer into this per-claim check or into human review; it never substitutes for the span verdicts, because it cannot say which claim broke. Automated detection decides which answers get a claim table; only the table says what is wrong.

Lab 34: per-claim verification with pre-written support predictions (proposed)

PROPOSED, not executed: no author-measured results are reported. The evidence this chapter requires is the reader’s own claim table.

Setup. Take one multi-claim answer from your pipeline with frozen sent context and pinned snapshot. Pin the input, prompt hashes, and parameters. The claim is the unit of analysis (independent variable across rows); context and snapshot are controlled.

Task.

1. Before checking, write H1/H2/H3 with distinct predicted table patterns: H1: “claims ___ SUPPORTED, claim ___ UNSUPPORTED, rest SUPPORTED”; H2: “unsupported claim’s span lies beyond the assembly cut (offset ___ vs. budget ___)”; H3: “unsupported claim has 0 hits corpus-wide.”
2. Split, span-match, and verdict every claim. Run the input ≥3 times; record OBSERVATION (spans/verdicts per trial verbatim — verdicts must be stable, not averaged) and UPDATED BELIEF.
3. Repair at the claim level; re-verify the full table, not the repaired row alone.

Success criterion. A complete claim table with quoted spans (or NONE with hit counts), per-claim verdicts stable across three trials, and a claim-scoped repair re-verified on all rows. A paragraph-level “looks faithful now” is explicitly not completion.

Companion tool: Claim/Evidence Inspector

What it accepts: the frozen output, the frozen sent context with hash, the corpus snapshot ID, and the atomic-claim split. What it performs: it enforces one-row-per-claim structure, requires an exact quoted span (byte offsets) or an explicit NONE with hit counts for every row, assigns SUPPORTED/UNSUPPORTED/CONTRADICTED/OUT-OF-CONTEXT per row, and blocks paragraph-level verdicts. What it can establish: whether each claim in the examined answer is supported by the examined context — and which break class (assembly residue vs. generation overreach) each unsupported claim belongs to. What it cannot establish: world truth beyond the context, context completeness in general, or future answer reliability. It never treats fluency, confidence, citation shape, model-graded scores, agreement, single-run outcomes, or downstream symptoms as support. How its output changes your next action: SUPPORTED rows ship; UNSUPPORTED-H2 rows route to retrieval/assembly repair (Chapters 32–33); UNSUPPORTED/CONTRADICTED-H3 rows route to generation constraints (withhold-or-hedge rules, Chapter 31 guardrail repair); unstable verdicts across trials route to wider trials before any repair.

Paper form, sufficient for this chapter:

Answer hash: ___  Context hash: ___  Snapshot: ___
C1 ___ | span ___ @___ | SUPPORTED/UNSUPPORTED/CONTRADICTED | x3: ___ ___ ___
C2 ___ | span ___ @___ | verdict ___ | x3: ___ ___ ___
C4 ___ | NONE (hits ___) | verdict ___ | route: assembly / generation / retrial
NEXT (per claim): ___

Where a software implementation does not yet exist in the reader’s stack, this record is the tool. Rows before verdicts.

Reusable procedure: verify every consequential answer

1. Freeze output + context — hashes recorded before any re-asking or grading.
2. Split atomic — one assertion per row, conjunctions separated.
3. Span-match exact — quoted byte spans or NONE with hit counts; no gist.
4. Verdict per claim — SUPPORTED / UNSUPPORTED / CONTRADICTED / OUT-OF-CONTEXT, stable ×3.
5. Repair per row — claim-scoped fix, full table re-verified.

Failure modes

• Paragraph verdicts. “Mostly right” shipping an invented reference. Claims ship individually or not at all.
• Bracket worship. Treating “[ledger]” as provenance. Spans are provenance; brackets are ink.
• Gist matching. “Pending-ish means processed eventually.” Entailment is exact or it is UNKNOWN.
• Grader-model delegation. A second model scoring faithfulness. Scores cannot cite hashes; rows can.
• Omission blindness. Verifying said claims while required hedges stay missing. Check the question’s requirements too.
• Row-narrow re-verification. Re-checking only the repaired claim while grounded rows silently degrade. The table is re-verified whole.
• Hedge without receipt. Shipping “no reference found” with no logged 0-hit search. An unlogged hedge is a claim wearing a humility costume — it gets a row and a span search like everything else.
• Withhold-rate blindness. Never tracking how often the pipeline withholds. A climbing withhold rate is the earliest signal of retrieval decay; without the metric, decay reads as “the model got cautious.”

Limits, per contract: one inspection covers one answer under one context and snapshot; it does not certify the pipeline, does not establish world truth, and stays UNKNOWN where context is unfrozen or spans are paraphrase-only.

References

• Ziwei Ji, Nayeon Lee, Rita Frieske, Tiezheng Yu, Dan Su, Yan Xu, Etsuko Ishii, Yejin Bang, Andrea Madotto, and Pascale Fung. Survey of Hallucination in Natural Language Generation. ACM Computing Surveys 55(12), 2023, article 248. https://doi.org/10.1145/3571730
• Hannah Rashkin, Vitaly Nikolaev, Matthew Lamm, Lora Aroyo, Michael Collins, Dipanjan Das, Slav Petrov, Gaurav Singh Tomar, Iulia Turc, and David Reitter. Measuring Attribution in Natural Language Generation Models. Computational Linguistics 49(4), 2023, pp. 777–840. https://doi.org/10.1162/coli_a_00486
• Jerry Wei, Chengrun Yang, Xinying Song, Yifeng Lu, Nathan Hu, et al. Long-Form Factuality in Large Language Models. Advances in Neural Information Processing Systems 37 (NeurIPS), 2024. https://arxiv.org/abs/2403.18802
• Wenxuan Zhou, Sheng Zhang, Hoifung Poon, and Muhao Chen. Context-Faithful Prompting for Large Language Models. Findings of the Association for Computational Linguistics: EMNLP, 2023, pp. 14544–14556. https://aclanthology.org/2023.findings-emnlp.968/
• Min-Hsuan Yeh, Max Kamachee, Seongheon Park, and Yixuan Li. HalluEntity: Benchmarking and Understanding Entity-Level Hallucination Detection. Transactions on Machine Learning Research (TMLR), 2025 (arXiv:2502.11948). https://arxiv.org/abs/2502.11948
• Yejin Bang, Ziwei Ji, Alan Schelten, Anthony Hartshorn, Tara Fowler, Cheng Zhang, Nicola Cancedda, and Pascale Fung. HalluLens: LLM Hallucination Benchmark. Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (ACL), 2025 (arXiv:2504.17550). https://arxiv.org/abs/2504.17550

Debugging Checklist

• Output and sent context frozen with hashes before checking?
• Claims split atomic (no conjunction rows)?
• Every row has an exact quoted span or NONE with hit counts?
• Per-claim verdicts assigned (SUPPORTED/UNSUPPORTED/CONTRADICTED/OUT-OF-CONTEXT)?
• H1/H2/H3 table predictions pre-written with distinct patterns?
• Verdicts stable across ≥3 trials (recorded verbatim, not averaged)?
• Withhold-or-hedge rules pinned (identifiers verbatim-or-withheld, hedges with hit-count logs)?
• Full claim table re-verified after repair (not the repaired row alone)?
• No fluency, confidence, brackets, scores, agreement, single runs, or symptoms cited as support?

What This Chapter Established

• Hallucination-as-evidence-chain-break with the claim/evidence table method (atomic split, exact spans, per-claim verdicts, claim-scoped repair) — demonstrated on the constructed four-claim refund paragraph (C4a/C4b UNSUPPORTED, 0 hits), no measured runs claimed.
• The H2/H3 routing for unsupported claims (assembly residue vs. generation overreach) via corpus-wide hit checks and cut-offset comparison.
• Lab 34 as a proposed per-claim verification record the reader executes; the Claim/Evidence Inspector contract (accepts/performs/can-establish/cannot-establish/next-action).
• The withhold-or-hedge rule set as the containment artifact: verbatim-or-withheld identifiers, hedges with their own hit-count receipts.
• What was NOT proved: any world-truth claim, any faithfulness-score validity, or any pipeline reliability claim. One answer dissected; nothing universal.
• Research grounding: CONTRADICTED / UNSUPPORTED are the intrinsic / extrinsic hallucination distinction (Ji et al.; operationalized as faithfulness / factuality by HalluLens, Bang et al.); the claim/evidence table is byte-level AIS attribution measurement (Rashkin et al.) and the manual, context-scoped counterpart of search-grounded SAFE (Wei et al., whose supported / not-supported / irrelevant verdicts match the chapter’s); withhold-or-hedge is the deterministic form of context-faithful prompting (Zhou et al.); the span/entity level is the empirically-supported granularity — paragraph-level detection cannot localize which claim broke, and token-probability signals over-predict (Yeh et al.), so detection triages answers into the claim table but never replaces it.
• Position in the arc: boundaries attributed (33); now paragraphs are dissolved into verdicts. Claims split, chains checked — each verdict a row in the evidence ledger (Chapter 32): claim → span → context hash → retrieval record → verdict.

Next

Per-claim checking convicts invented content. It does not stop the next contamination vector: the model’s fluent account of how it reached the answer, which readers keep filing as trace evidence. Chapter 35, “The Model’s Explanation Is Not a Trace,” closes that loop for LLM systems at depth; what an explanation-audit protocol enforces is its chapter’s to establish, not this one’s.