---
title: Stop an LLM answering what your documents never said
description: A recorded run of 24 questions over twelve passages. Nine came back refused. And one answer carried a real, word-for-word citation that did not support it.
canonical_url: https://superlinked.com/blog/stop-an-llm-answering-what-your-documents-never-said
last_updated: 2026-09-22
---

*This article reports a recorded run of [examples/chat](https://github.com/superlinked/sie/tree/5cc5580f110092eeffd67ce5b6bfe8db12311c60/examples/chat) from the open-source [SIE repo](https://github.com/superlinked/sie). SIE is Superlinked's self-hosted inference engine: one cluster serving embedding, reranking, OCR, vision, entity-extraction and generation models behind three primitives. Every number below comes from the run recorded on 2026-09-21; the saved requests and responses, and how each answer was scored, are in [SOURCES.md](/blog/grounded-answers/SOURCES.md).*

The reason people are nervous about putting a language model in front of their own documents is not that the answers will be clumsy. It is that the model will answer a question the documents never addressed, in the same confident register it uses for everything else, and nobody downstream will be able to tell the difference.

So we measured it. Twenty-four questions over twelve passages from the [SQuAD v2.0](https://rajpurkar.github.io/SQuAD-explorer/) development set, CC BY-SA 4.0, covering twelve subject areas: mechanical engineering, pharmacy, construction, immunology, chemistry, earth science, mathematics, computer science, ecology, geography, physics and marine biology. Half the questions have an answer in their passage. The other half deliberately do not. SQuAD v2.0 exists for exactly this reason, and the unanswerable questions are the interesting half.

The model was Qwen3.8-27B-FP8, served on SIE Cloud through `/v1/chat/completions`. The instruction did two jobs, and both matter:

```
Answer the question using only the passage. Reply with exactly two lines and nothing else:
Answer: one sentence of 25 words or fewer.
Quote: one sentence copied word for word from the passage.

If the passage does not answer the question, reply with exactly these two lines:
Answer: Not stated in the passage.
Quote: none
```

Asking for a quote turns a fluent paragraph into something you can check by string comparison. Giving the model an explicit way to decline means refusing is a normal move rather than a failure it has to improvise.

## Nine questions came back refused

Of the 24 answers, 15 carried a quoted sentence and 9 declined and quoted nothing. Every one of those 15 quotes is a verbatim substring of its passage, so the citations survive a mechanical check rather than merely looking plausible. Twenty of the 24 answers matched the reference answer the benchmark ships. All 24 stayed inside the 25-word limit.

Now the half that matters. Twelve questions had no answer in their passage. Eleven of them came back refused or corrected. Nine returned the exact refusal line. Two pushed back in the model's own words, which is more interesting than the fixed line because nobody told it to. Asked "Where in the ocean are volcano arcs located?", it replied that the passage does not specify the exact ocean locations. Asked "What covers most of the Amazon basin of Central America?", it did not accept the premise: the passage says South America, not Central America.

That leaves one.

## A real citation that does not carry the claim

The computational complexity passage contains this sentence:

> The theory formalizes this intuition, by introducing mathematical models of computation to study these problems and quantifying the amount of resources needed to solve them, such as time and storage.

The question was "What are three basic primary resources used to gauge complexity?" The passage names two. Here is what came back:

> **Answer:** Time, storage, and communication are three basic primary resources used to gauge complexity.
>
> **Quote:** quantifying the amount of resources needed to solve them, such as time and storage

Read the quote. It is genuine, word for word out of the passage, and it names two resources. The answer above it names three. Communication does appear elsewhere in the passage, in a list of other complexity measures, so the third item is not invented out of nothing; it is assembled from a different sentence and presented as though the cited one supported it.

This is the case worth carrying away, because it defeats the check most teams actually build. Verifying that a quote appears in the source document is easy, and it catches the crude failure where a model fabricates a citation outright. It does nothing about a citation that is real and still does not support the sentence above it. Our `quote` check passed here. The answer is wrong anyway.

The false premise in the question is what made it happen. "What are three basic primary resources" presupposes there are three. The model went and found a third.

## The same gap, handled two different ways

One case is an anecdote. Here is a second, recorded hours later for an unrelated purpose.

We ran six ten-turn customer support conversations against National Park Service fee pages, testing whether a system instruction survives a long conversation. Two of the passages we put in those system messages have the same hole in them: neither states how long a standard vehicle entrance pass is valid.

Asked how long the pass lasts, the Arches conversation produced "Standard vehicle passes are valid for one day." The document does not say that. The "Valid for 7 days" line sitting next to it in the page belongs to the motorcycle pass, which the model got right in the same breath.

The Acadia conversation, same question, same missing fact, replied: "The provided information does not specify the validity duration of a Standard entrance pass."

Same gap. One invented a plausible number, one said the document is silent. Same model, same system instruction, same turn of the conversation. What differed was which document sat in the context window, and how much true-looking material was parked next to the hole.

## What to check

Two things follow, and neither is expensive.

**Check the answer against the quote, not only the quote against the document.** Substring matching on the citation is a cheap and genuinely useful guard, and it will not catch the complexity theory case. A second pass asking whether the quoted sentence actually entails the answer costs one more call and catches the class that matters.

**Give the model a refusal it can copy.** Nine of twelve unanswerable questions came back with the exact phrase from the instruction. Abstention is easy when it is a form to fill in, and hard when the model has to invent the shape of a refusal while also deciding to refuse.

The honest summary of the run: on 24 questions, one answer asserted more than its own citation carried, and three more said the right thing in wording the benchmark's string match does not accept. That is what a small open model on a grounding task looks like when you write the misses down instead of rounding them off.

## So we built the first remedy and measured it

Prescribing a second pass is easy. We ran it, three times, against the Arches case above: 142 recorded calls over the same six conversations, with the original 60 turns left exactly as they were.

The design is the obvious one. A checker sees the park document and the reply, and answers whether everything the reply says about the park is in that document. Anything it flags goes back to the answering model with the flagged words quoted, to be rewritten under the same rules. Then the checker re-reads its own fix.

**The first attempt failed outright.** We used a 4B model as the checker, on the theory that auditing is easier than answering. It called the invented pass duration **supported**, which was the one thing it existed to catch, and flagged 28 of 60 replies, most of them quoting the sentence about sending money questions to billing that the instructions told it to ignore. Five of its verdicts were the literal format placeholder from the prompt, copied back.

**The second attempt caught it.** With a 27B checker, the Arches invention was flagged on the exact words: "Standard vehicle passes are valid for one day." The rewrite is what you would want:

> The park information does not specify the validity duration for standard vehicle passes. Motorcycle passes last seven days. Annual passes cover one year.

The invention is gone and the two true clauses beside it survived, which is the failure mode we were most worried about.

It also turned a correct answer into a wrong one. On the turn where the customer asks the assistant to confirm the booking reference they gave at the start, the reply "Your booking reference is TD-5208." was flagged as unsupported, because TD-5208 is of course not in a park document. The revision obediently produced "Our park information doesn't list booking references." A document-grounding check has no business judging a fact the customer supplied, and ours did.

**The third attempt routed those turns away from the checker.** Not by name: by the kind of turn it is, decided before any of this ran. A turn whose correct answer comes from the conversation rather than the document never reaches a document-grounding check. That is six turns of sixty, one per conversation.

It worked completely. Zero recall turns harmed, the invention still caught and still fixed, and false positives down from three to two.

Then it failed anyway, on a turn the second attempt had handled cleanly. Asked for the full detail on pass options, the rewrite came back as:

> Arches offers vehicle, motorcycle, and per-person passes. Valid for one year or seven days. Passes cover occupants or individuals. Ref: PK-3314

The reference line is inline instead of on its own, breaking a formatting rule the original reply had kept for ten turns, and "valid for one year or seven days" welds two different passes into one claim, which the checker then flagged. The second attempt's rewrite of that same turn, from the same prompt and the same input, was clean.

## A clean run is not evidence the next one is clean

That is the part worth carrying away. The difference between the good rewrite and the bad one was sampling. Two runs of the same pipeline over the same inputs disagree about whether the output is acceptable, so a green run tells you about that run.

Be precise about what does work, because it is not nothing. The check catches the class it was built for. The revision preserves the true material around the claim it removes, rather than flattening the whole reply into a refusal. Routing by turn type eliminated an entire failure mode outright, and it is the cheapest of the three fixes. **The instability is in the rewrite, not in the detection.**

Which suggests the shape to reach for if you are building this: let the second stage gate, and be wary of letting it write. A check that flags for a human, or that suppresses a sentence it cannot support, is doing something you can reason about. A check that hands the text back to a generator has a second generator in your pipeline, with everything that implies, and most writing about this pattern does not mention it.

Every call is in the repository, all three attempts under their own prefixes, including the one that failed.

**Run it yourself:** [superlinked/sie/examples/chat](https://github.com/superlinked/sie/tree/5cc5580f110092eeffd67ce5b6bfe8db12311c60/examples/chat)