Containment Is Not Truth

Chapter 7 deliberately broke the detector.

The most useful failures had a peculiar shape. The unsupported claim did not introduce a completely new topic. It did not necessarily introduce a new entity. It did not always wander outside the semantic region represented by the evidence.

Instead, the attack often preserved almost everything that a broad semantic representation could reasonably notice:

same entities
same event vocabulary
same topic
same evidence neighborhood
same quantities or dates, sometimes
same semantic ingredients

while changing the thing that made the proposition correct:

who did what to whom
whether the event happened or did not happen
which number belonged to which quantity
which event happened first
which event caused which
which entity was bound to which attribute

That gives us the central result of this chapter:

Semantic material and propositional structure are not the same object.

Hallucination Energy measures how well the representation of a claim lies inside a configured evidence-derived subspace. Truth and evidential support depend on more than that. They depend on how the semantic pieces are assembled and on whether the evidence actually licenses that assembly.

This distinction explains why containment can work well on unsupported semantic extension and still fail on relation inversion, negation, quantity mutation, temporal reversal, causal reversal, or cross-evidence recombination.

It also gives us a general systems rule that extends far beyond Hallucination Energy:

Design Rule 8.1 — Preserve before scoring. If a downstream decision depends on a distinction, do not discard that distinction before the decision is made.

We do not throw away containment.

We stop asking containment to prove something it was never designed to prove.

1. Start from the exact question Hallucination Energy answers

Recall the measurement from Chapter 5. Let the normalized claim embedding be:

How much squared claim-vector mass lies outside the retained evidence subspace?

It does not directly answer:

Does the source entail the claim?
Are subject and object in the correct roles?
Is polarity correct?
Does the quantity match?
Is the temporal ordering correct?
Is causal direction correct?
Is the source independent?
Is the proposition true in the world?

Those questions require distinctions beyond total projection mass.

The failure begins when the actual measurement:

embedding-subspace containment

is silently renamed:

support

and then renamed again:

truth.

Chapter 7 showed that those substitutions fail. This chapter explains why they must fail in general.

2. The verifier is an information-reduction pipeline

Earlier we described two broad bottlenecks: language to embedding, and embedding to scalar. That was useful but incomplete.

The real measurement path contains several distinct interfaces on both the claim and evidence sides:

    graph TD
    subgraph Claim_Side
        C1[natural-language claim] --> C2["claim representation φ(c)"]
    end
    subgraph Evidence_Side
        E1[evidence passages] --> E2["evidence representations φ(e1)...φ(en)"]
        E2 --> E3[evidence selection / segmentation]
        E3 --> E4[SVD + retained rank r]
        E4 --> E5[evidence basis B]
    end
    C2 --> PROJ["projection coordinates z = Bᵀc"]
    E5 --> PROJ
    PROJ --> MAG["projection magnitude ||z||²"]
    MAG --> H[Hallucination Energy H]
    H --> THRESH["threshold / policy state"]
  

Each compression step can discard distinctions the final score may need, so representational adequacy is part of the measurement contract.

At least five reductions matter operationally:

1. Claim representation — text becomes one learned representation.
2. Evidence representation — many source passages become vectors, then a selected and truncated basis.
3. Claim–evidence projection — the claim is represented relative to the retained basis.
4. Coordinate collapse — the vector of coordinates becomes one magnitude.
5. Decision collapse — a continuous measurement eventually becomes an action or category.

Each step can be useful. Each step can also discard information.

This gives us a sharper diagnostic question whenever a detector fails:

At which interface did the distinction required by the target become inaccessible?

Possible answers include:

claim encoding
evidence encoding
pooling
evidence retrieval
segmentation
rank truncation
projection representation
scalar reduction
threshold / policy

That is much more actionable than saying simply:

embeddings failed.

3. The Data Processing Inequality gives us the general law

There is an information-theoretic principle underneath this architecture.

Suppose the original claim-and-evidence state is represented by a random variable $X$, the target property we care about is $Y$, and we derive successive representations:

X = original claim + evidence
Z = learned/vector representation
M = Hallucination Energy or another measurement
D = detector or policy decision
Y = support / structural correctness / admissibility

If each downstream object is computed only from the previous one, the Data Processing Inequality tells us:[9]

A representation can contain a distinction that a downstream metric throws away.

and:

If a representation no longer exposes a distinction, a downstream scalar built only from that representation cannot recreate the missing information.

This does not mean every representational compression necessarily destroys every distinction. A discrete set of strings can in principle be mapped injectively into a finite-dimensional real space. Finite dimensionality alone does not force textual collisions.

The practical information loss comes from the actual engineered system:

training objective
pooling / summary interface
finite numerical precision
learned invariances
representation capacity
retrieval and segmentation
rank truncation
projection
scalar reduction

Whether a particular distinction survives is therefore an empirical question about the representation and measurement chain, not a theorem derived merely from the fact that $d$ is finite.

We can visualise the information flow and the inequality as:

    graph LR
    X[original claim + evidence] --> Z[learned/vector representation]
    Z --> M[Hallucination Energy or measurement]
    M --> D[detector / policy decision]
    
    Y[support / structural correctness / admissibility]
    Y -.-> D
    Y -.-> M
    Y -.-> Z
    Y -.-> X
  

The measurement pipeline compresses the original evidential relationship, so any decision inherits both the useful signal and the distinctions lost along the way.

4. Inside the subspace is a very large place

Suppose a unit claim vector lies entirely inside the retained evidence span:

Even outside the subspace, many different coordinate patterns produce the same energy. If:

The scalar does not care.

It measures how much is explained, not which explanation is being used.

That is the first reason containment cannot be identified with propositional correctness.

5. The full-rank limit is a proof by exhaustion

There is an even simpler limiting argument.

Suppose the evidence matrix has sufficient rank to span the whole embedding space:

true claim          → H = 0
false claim         → H = 0
contradiction       → H = 0
fabricated relation → H = 0

The conclusion is unavoidable:

Subspace membership cannot be a universal truth criterion because a sufficiently expressive evidence subspace eventually contains every embedding.

Truncated rank delays this limit. It does not change the underlying principle.

The full-space case is a bound, not a description of the operating regime. Reaching it needs d linearly independent evidence directions — for a 384-dimensional sentence embedder, on the order of 384 independent evidence chunks per claim, far more than claim-level verification ever supplies. The point is not that real evidence sets are full-rank. It is that the metric’s permissiveness rises monotonically with retained capacity, and the full-rank case shows where that road ends.

This also connects directly to Chapter 7’s evidence-inflation attack. As an evidence representation becomes broader and more expressive, out-of-span novelty can become in-span. Full rank is simply the limiting case in which the detector loses all discriminatory power.

Containment is useful precisely because the configured evidence subspace is restricted.

Its behavior therefore always depends on:

evidence selection
segmentation
embedder
rank
representation geometry

Those are part of the sensor contract, not incidental preprocessing.

6. Measurement aliasing: when different truths look the same to the sensor

Let a measurement system be:

We can call this measurement aliasing.

Approximate aliasing

Exact equality is unnecessarily strict for continuous systems. More commonly:

The detector may technically assign different numbers, but the difference is too small to support a stable operating boundary.

Decision aliasing

The operational form is even simpler. Let policy or detector decision be $D(M(x))$.

If:

Theorem-like consequence:

If two differently labelled examples map to the same measurement value, no threshold on that measurement can classify both correctly.

The proof is immediate: a threshold sees only the shared value and must assign the same decision to both.

This is the boundary between ordinary statistical error and missing information.

If score distributions overlap because of noise, more data, better calibration, or a better operating point may help.

If the target distinction collapses into the same observable state, calibration cannot repair it.

Calibration can move a boundary. It cannot manufacture a missing dimension.

The CaseHOLD result does not give us a single measured pair with exactly equal energies, so we should not invent one. What it does give us is a stronger distribution-level warning: the mean ordering reverses under that regime. Chapter 7’s next experiment—structured binding attacks with paired before/after measurements—should test approximate aliasing directly.

7. Hallucination Energy is not a sufficient statistic for support

There is another useful statistical way to say the same thing.

A statistic $M(X)$ is sufficient for a target $Y$ when, informally, observing the full $X$ provides no additional information about $Y$ once $M(X)$ is known.

Conceptually:

The reason is exactly what the attacks expose: two examples can have effectively the same containment measurement while differing in relation, polarity, quantity, time, or binding.

The full claim and evidence still contain information relevant to support that the scalar does not.

This does not make Hallucination Energy useless.

It makes its contract precise.

It is a sensor for a narrower proxy, not a compressed replacement for all evidential reasoning.

8. Semantic material is not propositional structure

We can now name the distinction exposed by the attacks.

Semantic material

A broad semantic representation may capture ingredients such as:

entities
concepts
predicates
events
domain
attributes
numbers
temporal vocabulary
causal vocabulary

Propositional structure

A proposition additionally depends on how those ingredients are arranged:

role / filler binding
relation direction
polarity
quantity + unit
comparison direction
time / interval
causal direction
modality
scope
quantification
conditions

Binding is one important part of propositional structure. It is not the umbrella term for all of it. Negation, modality, quantifier scope, comparison, and some temporal or causal relationships are structural without necessarily being role-binding failures in the narrow technical sense.

This connects naturally to the standard ML idea of compositional generalization: the ability to correctly interpret or produce novel combinations of familiar semantic parts according to their structure. Work such as SCAN made this problem explicit by testing whether models could recombine known primitives under novel compositional rules.[8]

The connection here is not that Hallucination Energy is a compositional-generalization benchmark. It is that the same underlying distinction matters:

knowing the pieces
≠
correctly representing a new composition of the pieces

9. A taxonomy of structural mutations

Chapter 7 generated the attacks. Here we care about why they are dangerous to broad semantic measurements.

The recurring pattern is:

high semantic-material overlap
+
small structural mutation
=
large truth-condition change

That is why these examples are much more revealing than unrelated negatives.

They deliberately preserve the information that a coarse semantic detector is good at seeing while changing the property we actually care about.

10. Binding is real—and the measurement interface is the right target

Consider again:

Alice founded Alpha.
Bob founded Beta.

The evidence supports:

Connectionist research has studied this problem for decades. Smolensky’s tensor-product representation work explicitly represented filler–role bindings rather than treating semantic items as an unordered bag.[1]

But we should be extremely careful about what modern results allow us to claim.

Feng and Steinhardt identified a Binding ID mechanism in sufficiently large Pythia and LLaMA-family models.[2] Dai, Heinzerling and Inui later localized binding-related information to a low-rank hidden-state subspace and causally manipulated those directions to change entity–attribute binding.[3]

Those results matter because they show that binding information can exist inside transformer activations.

The narrower engineering question is whether that information survives the interfaces we expose to the verifier:

rich token / hidden-state representation
        ↓
sentence-level external embedding
        ↓
evidence-subspace coordinates
        ↓
scalar containment energy

Different sentence encoders use different pooling and summary mechanisms—mean pooling, special-token representations, learned pooling, or other architectures. We therefore should not claim that a particular pooling rule necessarily destroys binding.

The correct statement is empirical and architectural:

A pooled external sentence representation plus a scalar subspace-containment measurement does not guarantee preservation of binding information, even when richer internal model states encode it.

The failure may occur in representation, pooling, evidence-basis construction, projection, or scalar reduction.

That is exactly why the chain in Section 2 matters.

11. Coordinate collapse: Hallucination Energy keeps how much, not where

We can isolate one information loss that definitely occurs inside the measurement itself.

The coordinates of the claim in the retained evidence basis are:

Hallucination Energy keeps only:

The measurement preserves:

how much claim mass is represented by the retained subspace

while discarding:

where inside that subspace the represented mass lies

That connects directly back to propositional structure.

Even if an embedding and evidence basis encoded two propositions into meaningfully different coordinates, the final $L_2$ reduction can erase that directional distinction by mapping both coordinate patterns to the same magnitude.

This is one reason the next experiment is so important:

Does the full coordinate vector $\mathbf{z}$ separate structural adversaries better than the scalar $H$?

We have not yet run that experiment and should not pretend otherwise.

Its interpretation would be highly diagnostic:

z performs much better than H
→ structural information survived into coordinates
→ scalar reduction discarded useful signal

z performs about as poorly as H
→ information was likely lost earlier
→ inspect encoder / basis / evidence construction

This experiment belongs in the research agenda created by Chapter 7.

A richer detector might retain coordinates or derive relation-specific probes from them, but that would be a new measurement contract, not Hallucination Energy with a cosmetic change.

12. Support, entailment, and containment form no simple implication chain

Chapter 3 established that support is a directional relation:

NLI asks a different learned question about entailment, contradiction, or neutrality.

It is useful to make the non-implications explicit.

Supported does not guarantee low energy

A supported claim can receive high energy because:

the relevant evidence was not retrieved
segmentation hid the supporting proposition
the embedder represented it poorly
rank discarded a legitimate direction

So:

CaseHOLD, relation inversion, evidence echo, and the full-rank limit all attack the converse:

An ideal entailment relation would be closer to the support target, but an NLI model is still an imperfect learned sensor:

containment       → geometric proxy
NLI               → directional learned proxy
structured check  → explicit field comparison
runtime assertion → authoritative state where available
provenance check  → lineage / independence

An NLI classifier can itself fail on negation, lexical shortcuts, domain shift, quantification, multi-hop reasoning, and complex composition.[4][5][6]

So the architecture is not:

containment failed
→ replace with NLI

It is:

Use differently informed sensors for differently defined failure relations.

13. Structural verification should preserve both fields and their provenance

Where claims can be normalized reliably, software can keep truth-bearing structure explicit.

A reusable claim record could look like:

claim_record = {
    "text": "Company A acquired Company B on 2024-03-14.",
    "subject": {
        "value": "Company A",
        "source_span": [0, 9],
    },
    "relation": {
        "value": "acquired",
        "source_span": [10, 18],
    },
    "object": {
        "value": "Company B",
        "source_span": [19, 28],
    },
    "polarity": "positive",
    "quantity": None,
    "unit": None,
    "time": "2024-03-14",
    "modality": "asserted",
    "scope": "completed_transaction",
    "bindings": [
        ["agent", "Company A"],
        ["patient", "Company B"],
    ],
}

The source_span fields matter.

If we preserve only the normalized values, structural extraction becomes another opaque compression step. By preserving lineage back to the source text, a later verifier or human reviewer can inspect where each field came from.

Then an evidence record can be compared field by field:

subject
relation
object
polarity
quantity + unit
time
modality
scope
bindings

This is the engineering form of Design Rule 8.1:

When correctness depends on a field, keep the field—and where it came from—available to the decision system.

14. Structural extraction is another fallible sensor

In 2026, the practical extractor is often another language model.

That means structural verification introduces a new failure mode:

extractor hallucination.

The extractor may:

resolve the wrong entity
reverse subject and object
force an ambiguous sentence into a definitive tuple
lose negation
flatten modality
attach a quantity to the wrong event
invent an implicit relation

A relation extractor can also fail on:

coreference
scope
ellipsis
nested clauses
quantification
implicit arguments

A knowledge graph can be incomplete. A schema can force a claim into categories that do not actually fit. A programmatic checker can compare the wrong entity after resolution failure.

So structured checking does not rescue us from the sensor problem.

It gives us another sensor with a different observation channel.

Every structural extractor needs its own measurement contract, evaluation set, provenance, and blind spots.

A low-precision structural checker can flood the system with false alarms just as surely as an overconservative containment threshold can.

The advantage is not perfection.

The advantage is independent information.

15. CaseHOLD now has a cleaner interpretation

The CaseHOLD failure from Chapters 5–7 can now be restated precisely.

The observed means were approximately:

supported mean energy      ≈ 0.6680
hard-negative mean energy  ≈ 0.6075

The hard negatives looked more contained on average.

This does not prove:

legal language is impossible for embeddings

or:

SVD geometry is universally useless

or even:

role binding is definitely the only missing variable.

Legal holdings can differ through binding, modality, scope, procedural posture, quantification, or subtle entailment structure.

What the experiment establishes is narrower:

Under this representation, evidence construction, rank, and hard-negative regime, containment energy does not preserve the ordering required to distinguish supported from structurally similar legal alternatives.

That is a measurement-boundary result.

The next task is to isolate the mechanism rather than naming it from intuition.

That is exactly why Chapter 7’s structured attacks and the proposed $\mathbf{z}$-versus-$H$ experiment matter.

16. More evidence can expand the recombination space faster than support

Retrieval is often described as if adding more relevant evidence monotonically makes a system more truthful.

That is too simple.

More good evidence can reduce missing-information errors. It can also provide more real semantic components that can be recombined incorrectly.

A small combinatorial model makes the point.

Suppose retrieved evidence exposes:

n entities
m binary relation types

Even if we consider only directed subject–relation–object triples, the number of syntactically possible relational propositions is on the order of:

If quantities, dates, qualifiers, or modalities are added, the number of possible combinations grows further.

This is not a claim that an LLM literally enumerates $m n(n-1)$ candidates.

It is a combinatorial demonstration of the systems problem:

available factual ingredients ↑
possible compositions ↑↑
actually supported bindings remain sparse

So:

Retrieval can reduce missing-information hallucination while increasing the combinatorial space in which unsupported binding and composition errors can occur.

This also connects back to evidence inflation and duplication in Chapter 7.

Adding independent directions can make a containment subspace more permissive. Duplicating evidence does not add new full-span directions, but under truncated SVD it can alter singular values and therefore which directions survive.

RAG gives the model more context.

It does not automatically give the model correct composition, attribution, or truth.

That is why retrieval must be followed by verification.

17. A typed reliability record preserves disagreement instead of hiding it

After Chapters 5–8, one scalar is no longer a credible representation of reliability.

A more honest output is a typed record whose fields have independent contracts:

containment           = PASS
relation_fidelity     = FAIL
polarity              = PASS
quantity              = NOT_APPLICABLE
temporal_fidelity     = PASS
provenance            = VERIFIED
evidence_sufficiency  = UNCERTAIN
runtime_verification  = NOT_MEASURED

The state vocabulary matters.

PASS
FAIL
UNCERTAIN
NOT_APPLICABLE
NOT_MEASURED
UNAVAILABLE

are not interchangeable.

In particular:

NOT_APPLICABLE ≠ NOT_MEASURED
UNCERTAIN      ≠ FAIL
UNAVAILABLE    ≠ PASS

This is the first concrete shape of the diagnostic reliability vector that Chapter 9 will develop further.

The purpose of the vector is not to create a bigger scalar later.

Its first purpose is to preserve disagreement:

containment says one thing
structure says another
provenance says another

That disagreement is information.

Do not average it away before policy sees it.

18. What containment is actually good for

After explaining what containment cannot prove, we should return to what it can do.

Hallucination Energy remains useful when unsupported output introduces representational content that genuinely extends beyond the supplied evidence geometry.

Examples may include:

new entity
new event
new topic
unsupported semantic extension
invented detail
topic drift

The HaluEval and factual-domain experiments in Chapter 5 showed that geometry-derived features carry measurable signal for those regimes.

That result does not disappear because CaseHOLD fails.

Instead, the boundary becomes sharper:

OUT-OF-SPAN NOVELTY
→ containment can be informative

IN-SPAN STRUCTURAL ERROR
→ containment may be blind

That is a much better claim than:

Hallucination Energy detects hallucinations.

A bounded sensor is more trustworthy than an impressive slogan.

19. Where we are

The measurement arc of the book now has a complete shape:

Chapter 4
A detector is a sensor, not a verdict.

Chapter 5
Build one sensor exactly.

Chapter 6
Evaluate its ranking, calibration and operating points.

Chapter 7
Search deliberately for counterexamples.

Chapter 8
Explain the information boundary those counterexamples reveal.

The central result is no longer merely:

Hallucination Energy has blind spots.

It is more general:

Reliability systems fail when they compress away the variable that defines correctness and later expect a downstream score to reconstruct it.

The information path is:

This gives us the book-level law:

If the decision needs a distinction, preserve the distinction before scoring.

20. Experiments this theory now requires

A theory becomes useful when it tells us what to measure next.

Chapter 8 generates several concrete experiments that we have not yet run and should not fabricate in prose.

A. Projection coordinates versus scalar energy

Compare:

H only
vs
z = Bᵀc

on structured relation, binding, polarity, quantity, and temporal attacks.

Question:

Did the scalar discard information that remained in the coordinate vector?

B. Structured mutation response

Construct oracle-controlled pairs:

supported original
relation inversion
negation
quantity mutation
time reversal
cross-evidence recombination

Report paired score changes rather than invented illustrative numbers.

C. Encoder and pooling transfer

Repeat the same structural corpus across different sentence encoders and pooling interfaces.

Question:

Is the failure representation-specific or measurement-general?

D. Structural extractor evaluation

Measure the tuple/record extractor itself:

entity resolution
role assignment
polarity
quantity binding
time
modality
source-span provenance

E. Evidence-size recombination stress

Increase the number of retrieved entities and relations while keeping oracle-controlled supported facts sparse.

Question:

Does structural false acceptance increase as the combinatorial opportunity for recombination grows?

These experiments turn the chapter from philosophical critique into an explicit research program.

21. The architecture after the failure

The complete lesson from Chapters 5–8 is not a new linear hierarchy.

It is a set of differently informed sensors that converge only at policy:

    graph TD
    C[candidate claim] --> S1[containment]
    C --> S2[structure]
    C --> S3[support]
    C --> S4[provenance]
    C --> S5[runtime]
    S1 --> TR[typed evidence record]
    S2 --> TR
    S3 --> TR
    S4 --> TR
    S5 --> TR
    TR --> POL[policy]
    POL --> DEC[ACCEPT / RETRIEVE / VERIFY / REVIEW / ABSTAIN / REJECT]
  

Layered diagnosis keeps containment, consistency, sensitivity, epistemic adequacy, and attribution separate so policy can respond to the kind of failure rather than a single score.

The layers answer different questions:

GEOMETRIC
Is relevant semantic material represented?

STRUCTURAL
Are role, polarity, quantity, time, scope and relation preserved?

EVIDENTIAL
Does identified evidence actually support the normalized proposition?

PROVENANCE
Is the evidence independent, current and correctly attributed?

PROCEDURAL
Was the required authoritative verification actually performed?

POLICY
What may the system do given all of those states?

No one sensor replaces the others.

Reliability comes from composing imperfect checks whose blind spots do not completely coincide.

That is the systems argument toward which the book has been moving since Chapter 1.

What you should now be able to answer

1. Why does the full-rank evidence limit prove that subspace containment cannot be a universal truth criterion?
2. What is the difference between exact measurement aliasing, $\varepsilon$-aliasing, and decision aliasing?
3. Why can calibration improve an operating boundary but not repair information that the measurement discarded?
4. What information is lost when $\mathbf{z}=\mathbf{B}^T\mathbf{c}$ is reduced to $\|\mathbf{z}\|_2^2$?
5. Why is binding only one member of the broader category of propositional structure?
6. Why does the existence of binding information inside transformer activations not imply that a sentence-level containment score preserves it?
7. Why can more retrieved evidence reduce one hallucination class while increasing the opportunity for unsupported recombination?
8. What provenance should a structural claim extractor preserve so that its output remains auditable?

Exercises

Build a tiny synthetic evidence store containing structured facts such as:

Company A acquired Company B in March 2024.
Company C acquired Company D in June 2025.
Treatment X reduced symptom score by 12%.
Treatment Y did not reduce mortality.

For each supported claim, generate two mutations:

1. an out-of-span mutation that introduces a genuinely new semantic element;
2. an in-span structural mutation such as a role swap, negation reversal, quantity change, or cross-evidence recombination.

Measure Hallucination Energy for the original and both mutations.

Do not assume the expected result.

Report:

original H
out-of-span mutation H
structural mutation H
ΔH for each mutation
oracle label

Then ask:

Does the detector react more strongly to semantic novelty than to truth-bearing structural change?

If so, you have reproduced the core measurement boundary of this chapter in miniature.

Research roots

This chapter combines the failure analysis from our Hallucination Energy experiments with research on information theory, compositionality, role binding, negation, and sentence representations.

1. Paul Smolensky, “Tensor Product Variable Binding and the Representation of Symbolic Structures in Connectionist Systems,” Artificial Intelligence 46(1–2), 1990, pp. 159–216. DOI: 10.1016/0004-3702(90)90007-M. Formalizes distributed filler–role binding using tensor-product representations.

2. Jiahai Feng and Jacob Steinhardt, “How do Language Models Bind Entities in Context?” 2023. Identifies a Binding ID mechanism in sufficiently large Pythia and LLaMA-family models and uses causal interventions to study entity–attribute binding. https://arxiv.org/abs/2310.17191

3. Qin Dai, Benjamin Heinzerling and Kentaro Inui, “Representational Analysis of Binding in Language Models,” EMNLP 2024. Localizes binding-related information in a low-rank activation subspace and demonstrates causal changes to binding behavior through representation editing. https://aclanthology.org/2024.emnlp-main.967/

4. Md Mosharaf Hossain, Venelin Kovatchev, Pranoy Dutta, Tiffany Kao, Elizabeth Wei and Eduardo Blanco, “An Analysis of Natural Language Inference Benchmarks through the Lens of Negation,” EMNLP 2020. Shows that negation is underrepresented in common NLI benchmarks and that transformer inference systems struggle when negation is made central. https://aclanthology.org/2020.emnlp-main.732/

5. Yeonkyoung So, Gyuseong Lee, Sungmok Jung, Joonhak Lee, JiA Kang, Sangho Kim and Jaejin Lee, “Thunder-NUBench: A Benchmark for LLMs’ Sentence-Level Negation Understanding,” Findings of EACL 2026, pp. 4749–4793. Builds a benchmark specifically around sentence-level negation, including local negation, contradiction and paraphrase. https://aclanthology.org/2026.findings-eacl.250/

6. Ishita Dasgupta, Demi Guo, Andreas Stuhlmüller, Samuel J. Gershman and Noah D. Goodman, “Evaluating Compositionality in Sentence Embeddings,” 2018. Constructs NLI cases requiring compositional reasoning and reports poor performance from a strong sentence representation of the period. https://arxiv.org/abs/1802.04302

7. Damien Sileo, Tim Van De Cruys, Camille Pradel and Philippe Muller, “Composition of Sentence Embeddings: Lessons from Statistical Relational Learning,” *SEM 2019. Shows that simple sentence-vector composition functions are insufficiently expressive for several relational tasks and develops more expressive alternatives. https://aclanthology.org/S19-1004/

8. Brenden M. Lake and Marco Baroni, “Generalization without Systematicity: On the Compositional Skills of Sequence-to-Sequence Recurrent Networks,” ICML 2018, PMLR 80:2873–2882. Introduces the SCAN benchmark and tests systematic compositional generalization under novel combinations of known primitives. https://proceedings.mlr.press/v80/lake18a.html

9. Thomas M. Cover and Joy A. Thomas, Elements of Information Theory, 2nd ed., Wiley, 2006. The Data Processing Inequality formalizes the principle that downstream processing cannot increase mutual information about a target beyond that available in its input.

10. Ernan Hughes, Certum, open-source implementation of Hallucination Energy, hard-negative mining, calibration and policy-bounded claim–evidence evaluation. https://github.com/ernanhughes/certum

Next: Beyond Hallucination: Consistency and Sensitivity

Containment has now reached its proper boundary.

It can tell us whether a claim representation extends beyond a configured evidence geometry.

It cannot guarantee that the proposition inside that geometry is assembled correctly.

The natural response is not to search for one replacement scalar.

It is to ask which further failure axes remain — how independent they are is itself something to measure.

A claim may be:

well contained
but internally inconsistent

well contained
but structurally wrong

factually plausible
but insensitive to decisive context

well supported
but produced identically after the problem is reversed

Those failures lead to two new measurements:

CONSISTENCY
Does the output preserve the relationships and constraints
that should remain stable?

SENSITIVITY
Does the output change when decisive facts change?

Chapter 9 develops those axes and begins the transition from one hallucination score to a diagnostic reliability vector.