When Retrieval Makes an Answer Sound Safer Than It Is

A citation can increase trust before anyone checks whether it supports the sentence beside it.

In a 2025 AAAI study, participants reported greater trust in language-model answers when citations were present—even when those citations had been selected at random. Participants who opened and examined the citations reported less trust. The experiment exposed a distinction that retrieval-augmented systems often blur: evidence can improve an answer, but the appearance of evidence can improve its credibility without improving its accuracy.

Retrieval-augmented generation, usually shortened to RAG, gives a language model access to external documents while it produces an answer. The technique can make responses more factual, current, and verifiable. It can also wrap an unsupported conclusion in source cards, footnotes, and authoritative-looking excerpts.

Retrieval does not make an answer safe by default. It relocates the uncertainty.

A credible evaluation therefore has to examine the entire evidence chain: what the system searched, what it retrieved, what it omitted, how it used the retrieved material, whether each claim is supported, whether the cited source is authoritative and current, and whether the system knew when the available evidence was insufficient. When those questions remain unanswered, retrieval may create a stronger impression of safety than the underlying system deserves.

Retrieval can improve an answer without guaranteeing it

The case for retrieval is real.

The original RAG paper, published at NeurIPS in 2020, combined a language model’s parametric memory with an external document index. Across the paper’s experiments, the approach outperformed several parametric-only and task-specific baselines on knowledge-intensive tasks, and the authors reported more specific and factual generated language than a comparable parametric-only model. Retrieval also offered a practical way to update accessible knowledge without retraining the entire model.

Those findings support a bounded claim: supplying relevant external evidence can improve performance under tested conditions.

They do not support the broader claim that a response produced by a RAG pipeline is grounded, correct, or safe merely because retrieval occurred. A deployed pipeline contains several components that can fail independently. The user’s question may be ambiguous. A query-rewriting step may change its meaning. The retriever may miss the controlling document. A ranking model may prioritize a related but nonresponsive passage. The generator may ignore the retrieved evidence, combine incompatible sources, or add information that appears nowhere in the context.

The source list shown to the user is the end of that chain. It is not a record that every link held.

Retrieval can fail before the model writes a word

A RAG answer inherits the limits of its corpus and search process.

If an institution asks, “What is the current filing deadline?” the system may retrieve an older guidance page that uses the same terminology as the current rule. If the corpus contains a press release but not the operative regulation, retrieval can return a highly relevant document that lacks legal authority. If a question contains a misspelling, unusual phrasing, or a term used differently across departments, the retriever may surface an adjacent policy instead of the controlling one.

The answer can then be fluent, specific, and accurately summarized from the wrong evidence.

Research has found that this sensitivity is not hypothetical. A 2025 study tested multiple retrievers across general and domain-specific datasets and found consistent performance variation when queries were perturbed, including through relatively minor wording changes and typographical errors. The authors conducted more than 1,000 experiments and concluded that query-level robustness must be evaluated across the full RAG pipeline rather than assumed from performance on clean benchmark questions.

Traditional retrieval scores do not necessarily reveal the problem. Information-retrieval metrics such as mean reciprocal rank and normalized discounted cumulative gain were designed around assumptions about how human searchers inspect ranked results. A 2026 EACL paper found that those assumptions can break down when the consumer is a language model. Related but distracting passages may actively degrade generation rather than sit harmlessly below a useful result. Across the study’s five datasets and six models, a proposed utility-and-distraction-aware metric improved correlation with end-to-end answer accuracy by as much as 36 percent relative to traditional retrieval metrics.

That finding changes the evaluation question. The important issue is not simply whether the retriever found documents labeled relevant. It is whether the retrieved set helped this generator produce a correct answer to this question under these conditions.

A document can be topically relevant and still be harmful to the answer.

The right evidence can be present and still go unused

Successful retrieval does not ensure successful reasoning over the retrieved material.

Language models do not use long contexts uniformly. In Lost in the Middle, researchers tested multi-document question answering and controlled retrieval tasks by changing where relevant information appeared in the context. Performance was often strongest when the needed evidence appeared near the beginning or end and substantially weaker when it appeared in the middle—even for models designed to accept long contexts.

A RAG interface may therefore display the correct source while the generator gives more weight to a distractor, a nearby passage, or its own parametric associations. Adding further documents can make the answer look better researched while making the controlling evidence harder for the model to use.

The RAGTruth project provides direct evidence that retrieval does not eliminate unsupported generation. Its researchers assembled nearly 18,000 RAG-produced responses across several models, tasks, and domains, then annotated hallucinations at both response and word level. The corpus includes claims that were unsupported by or contradictory to the retrieved material.

This is a different failure from retrieving the wrong document. The evidence can be correct, available, and visible, while the answer still departs from it.

That distinction matters for remediation. Improving the retriever will not fix a generator that adds unsupported details. Tightening the prompt will not repair a corpus missing the authoritative record. A single end-to-end accuracy score can hide both failures by showing only whether the final answer happened to match a reference.

A citation is a claim about support

Citations create two separate obligations.

The first is completeness: every material factual assertion that requires support should have it. The second is correctness: the cited source should actually entail the assertion attached to it.

A source can be reputable and still fail the second test. A government report may support the existence of a program without supporting a claim about its effectiveness. A study may establish an association while the answer describes causation. A document may be current but applicable to a different jurisdiction, population, product version, or time period.

The visual presence of an authoritative source cannot repair a mismatch between the source and the sentence.

A 2023 audit of four generative search engines found that their responses were fluent and appeared informative, but only 51.5 percent of generated sentences were fully supported by citations on average, while 74.5 percent of citations supported the sentence with which they were associated. The authors described the systems’ presentation as creating an appearance of trustworthiness that exceeded their measured verifiability. These figures are a historical snapshot of the products and versions evaluated in 2023, not a measurement of current systems in 2026. Their continuing relevance lies in the demonstrated gap between citation display and citation support.

The ALCE benchmark reached a related conclusion from controlled experiments. It evaluated retrieval, generation, factual correctness, and citation quality together. On its ELI5 task, even the strongest systems studied lacked complete citation support approximately half the time. The researchers identified retrieval quality, long-context use, and multi-source synthesis as separate areas requiring improvement.

These results make “includes citations” an inadequate evaluation category. A rigorous assessment has to examine support at the level of individual claims.

The most dangerous answer may be the one the corpus cannot answer

Most RAG demonstrations begin with questions for which the knowledge base contains an answer. Real users do not respect that experimental boundary.

They ask underspecified questions. They introduce false premises. They request facts outside the indexed corpus. They combine several questions, omit a jurisdiction, or ask for a conclusion that the available documents cannot support.

A system optimized only on answerable questions can learn the wrong behavioral lesson: produce an answer whenever retrieval returns something.

Research presented at ACL in 2025 evaluated RAG systems against six classes of unanswerable requests, including underspecified questions, false presuppositions, modality limitations, safety concerns, and requests outside the database. The study found that no single tested configuration performed best across all datasets on both answerable and unanswerable requests. Component choices and prompting strategies changed the balance between answering valid questions and rejecting those the corpus could not responsibly resolve.

This is where retrieval can make an answer sound especially safe. The system finds a document related to the question, extracts a plausible passage, and converts the passage into a definite conclusion. The citation makes the answer look bounded by evidence even though the evidence never contained the requested answer.

A refusal or request for clarification may be the most accurate output. That behavior has to be tested deliberately; it will not emerge reliably from citation formatting.

The real safety advantage is inspectability

The strongest case for RAG is narrower than the usual promise of “grounded answers.”

Retrieval can create an inspectable path from a response back to external evidence. That path can support debugging, correction, independent review, and accountability. But inspectability exists only when the system preserves enough information to reconstruct what happened.

An institution should be able to identify the original user request, any rewritten query, the corpus and version searched, the documents retrieved, their ranking and metadata, the exact passages given to the generator, the model and configuration used, the resulting claims, and the citations associated with those claims. Without that record, the decisive judgments remain hidden inside the pipeline.

The answer may display its sources while concealing how those sources were selected.

NIST’s Generative AI Profile treats retrieval as a system modification that requires documentation and renewed risk assessment, not as a general assurance of safety. Its recommended actions include verifying sources and citations, confirming that retrieval-augmented data is grounded, documenting how a model has been adapted for a specific task, and reassessing risks after a RAG implementation is introduced. NIST also cautions against extrapolating system performance from narrow or anecdotal assessments. The profile is voluntary risk-management guidance, not a certification that a system is trustworthy or legally compliant.

The midpoint of the safety argument is therefore not a better retrieval score. It is a better record of judgment.

Retrieval becomes valuable when it makes evidence selection, evidence use, and uncertainty easier to inspect. When those operations remain undocumented, RAG can add components without adding accountability.

What evidence would justify calling the answer safer?

The appropriate comparison is not between an uncited response and the same response with links added. It is between complete systems evaluated under the intended conditions of use.

A credible claim of improved safety would require evidence that the RAG system performs better than an appropriate non-retrieval baseline on the actual task. Retrieval quality would need to be evaluated separately from generation quality. Material claims would need to be checked for faithfulness to the retrieved passages, while citations would need to be assessed for both completeness and entailment. Tests would have to include stale, conflicting, irrelevant, and missing evidence rather than only clean answerable questions.

The system would also need to demonstrate sensible behavior when the corpus cannot answer. Query variations should not produce unexplained swings in conclusions. Evaluators should examine whether performance changes across topics, document types, languages, user phrasing, and corpus versions. Any automatic evaluator used for these judgments would itself require validation against qualified human review.

This decomposition is consistent with RAGChecker, a NeurIPS 2024 evaluation framework that separates diagnostic measures for retrieval and generation. Its authors argued that RAG evaluation is difficult precisely because the system is modular, the responses may be long, and aggregate measurements can be unreliable. Their meta-evaluation found stronger correlation with human judgments than competing automated metrics in the conditions studied.

No resulting score would establish that the system is universally safe. It would support a narrower statement tied to a named corpus, task, model version, evaluation protocol, user population, and risk tolerance.

That narrower statement is more useful because another institution can test it.

Retrieval should change the burden of proof

Rejecting RAG because it remains fallible would be a mistake. Parametric-only models can produce unsupported answers without exposing any source trail. Well-designed retrieval can improve factual performance, incorporate updated records, constrain the available evidence, and make verification more practical.

The mistake lies in treating those possible benefits as properties of every retrieved answer.

A visible source should increase the burden of proof, not lower it. The system is asserting that the answer is connected to evidence. That assertion can be tested. Evaluators can ask whether the source was the right one, whether it was current, whether the passage supported the claim, whether relevant contrary evidence was omitted, and whether the system should have answered at all.

In consequential settings, those questions cannot be delegated entirely to the same model that produced the answer. Legal, medical, financial, eligibility, public-safety, and other high-impact uses require qualified human review and the preservation of the responsible institution’s authority. Retrieval does not convert an advisory language model into a clinician, lawyer, regulator, adjudicator, or government decision-maker.

TAIRC’s research scope preserves that distinction: its LLM safety work is limited to controlled evaluation and documentation and does not certify systems as universally safe or deploy them into operational decision environments.

Retrieval can make an answer safer. It can also make a weak answer easier to believe.

The difference is not the citation icon. It is whether the evidence chain survives inspection.

Sources and verification

Patrick Lewis and colleagues, “Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks,” Advances in Neural Information Processing Systems 33, 2020. Verified through the official NeurIPS proceedings and used for the original RAG architecture and comparative-performance claims.

Yifan Ding and colleagues, “Citations and Trust in LLM Generated Responses,” Proceedings of the Thirty-Ninth AAAI Conference on Artificial Intelligence, 2025. Verified through the official AAAI publication record and author abstract; used for the finding that citations increased reported trust even when randomly selected.

Nelson Liu, Tianyi Zhang, and Percy Liang, “Evaluating Verifiability in Generative Search Engines,” Findings of EMNLP, 2023. Verified through the ACL Anthology; used for the human-audit results on sentence support and citation accuracy.

Tianyu Gao and colleagues, “Enabling Large Language Models to Generate Text with Citations,” EMNLP, 2023. Verified through the ACL Anthology; used for the ALCE benchmark and its citation-completeness finding.

Cheng Niu and colleagues, “RAGTruth: A Hallucination Corpus for Developing Trustworthy Retrieval-Augmented Language Models,” ACL, 2024. Verified through the ACL Anthology; used for the corpus size and the finding that RAG responses can remain unsupported or contradictory to retrieved content.

Nelson F. Liu and colleagues, “Lost in the Middle: How Language Models Use Long Contexts,” Transactions of the Association for Computational Linguistics, 2024. Verified through the ACL Anthology; used for the evidence-position and long-context-utilization findings.

Sezen Perçin and colleagues, “Investigating the Robustness of Retrieval-Augmented Generation at the Query Level,” GEM², 2025. Verified through the ACL Anthology; used for the query-perturbation and retriever-robustness findings.

Giovanni Trappolini and colleagues, “Redefining Retrieval Evaluation in the Era of LLMs,” EACL, 2026. Verified through the ACL Anthology; used for the analysis of distracting passages, traditional retrieval metrics, and end-to-end answer utility.

Xiangyu Peng and colleagues, “Unanswerability Evaluation for Retrieval Augmented Generation,” ACL, 2025. Verified through the ACL Anthology paper and first-page methodological summary; used for the taxonomy and evaluation of unanswerable RAG requests.

Dongyu Ru and colleagues, “RAGChecker: A Fine-grained Framework for Diagnosing Retrieval-Augmented Generation,” NeurIPS, 2024. Verified through the official NeurIPS proceedings; used for the modular evaluation and human-correlation claims.

National Institute of Standards and Technology, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile, NIST AI 600-1, July 2024. Verified from the official NIST publication; used for source verification, grounding, documentation, risk reassessment, and system-evaluation guidance.

TAIRC Research Portfolio and TAIRC Research Categories & Topics. Used only to verify TAIRC’s organizational scope, planned research boundaries, and prohibition on unsupported safety certification or operational deployment claims.

A citation can increase trust before anyone checks whether it supports the sentence beside it.

In a 2025 AAAI study, participants reported greater trust in language-model answers when citations were present—even when those citations had been selected at random. Participants who opened and examined the citations reported less trust. The experiment exposed a distinction that retrieval-augmented systems often blur: evidence can improve an answer, but the appearance of evidence can improve its credibility without improving its accuracy.

Retrieval-augmented generation, usually shortened to RAG, gives a language model access to external documents while it produces an answer. The technique can make responses more factual, current, and verifiable. It can also wrap an unsupported conclusion in source cards, footnotes, and authoritative-looking excerpts.

Retrieval does not make an answer safe by default. It relocates the uncertainty.

A credible evaluation therefore has to examine the entire evidence chain: what the system searched, what it retrieved, what it omitted, how it used the retrieved material, whether each claim is supported, whether the cited source is authoritative and current, and whether the system knew when the available evidence was insufficient. When those questions remain unanswered, retrieval may create a stronger impression of safety than the underlying system deserves.

Retrieval can improve an answer without guaranteeing it

The case for retrieval is real.

The original RAG paper, published at NeurIPS in 2020, combined a language model’s parametric memory with an external document index. Across the paper’s experiments, the approach outperformed several parametric-only and task-specific baselines on knowledge-intensive tasks, and the authors reported more specific and factual generated language than a comparable parametric-only model. Retrieval also offered a practical way to update accessible knowledge without retraining the entire model.

Those findings support a bounded claim: supplying relevant external evidence can improve performance under tested conditions.

They do not support the broader claim that a response produced by a RAG pipeline is grounded, correct, or safe merely because retrieval occurred. A deployed pipeline contains several components that can fail independently. The user’s question may be ambiguous. A query-rewriting step may change its meaning. The retriever may miss the controlling document. A ranking model may prioritize a related but nonresponsive passage. The generator may ignore the retrieved evidence, combine incompatible sources, or add information that appears nowhere in the context.

The source list shown to the user is the end of that chain. It is not a record that every link held.

Retrieval can fail before the model writes a word

A RAG answer inherits the limits of its corpus and search process.

If an institution asks, “What is the current filing deadline?” the system may retrieve an older guidance page that uses the same terminology as the current rule. If the corpus contains a press release but not the operative regulation, retrieval can return a highly relevant document that lacks legal authority. If a question contains a misspelling, unusual phrasing, or a term used differently across departments, the retriever may surface an adjacent policy instead of the controlling one.

The answer can then be fluent, specific, and accurately summarized from the wrong evidence.

Research has found that this sensitivity is not hypothetical. A 2025 study tested multiple retrievers across general and domain-specific datasets and found consistent performance variation when queries were perturbed, including through relatively minor wording changes and typographical errors. The authors conducted more than 1,000 experiments and concluded that query-level robustness must be evaluated across the full RAG pipeline rather than assumed from performance on clean benchmark questions.

Traditional retrieval scores do not necessarily reveal the problem. Information-retrieval metrics such as mean reciprocal rank and normalized discounted cumulative gain were designed around assumptions about how human searchers inspect ranked results. A 2026 EACL paper found that those assumptions can break down when the consumer is a language model. Related but distracting passages may actively degrade generation rather than sit harmlessly below a useful result. Across the study’s five datasets and six models, a proposed utility-and-distraction-aware metric improved correlation with end-to-end answer accuracy by as much as 36 percent relative to traditional retrieval metrics.

That finding changes the evaluation question. The important issue is not simply whether the retriever found documents labeled relevant. It is whether the retrieved set helped this generator produce a correct answer to this question under these conditions.

A document can be topically relevant and still be harmful to the answer.

The right evidence can be present and still go unused

Successful retrieval does not ensure successful reasoning over the retrieved material.

Language models do not use long contexts uniformly. In Lost in the Middle, researchers tested multi-document question answering and controlled retrieval tasks by changing where relevant information appeared in the context. Performance was often strongest when the needed evidence appeared near the beginning or end and substantially weaker when it appeared in the middle—even for models designed to accept long contexts.

A RAG interface may therefore display the correct source while the generator gives more weight to a distractor, a nearby passage, or its own parametric associations. Adding further documents can make the answer look better researched while making the controlling evidence harder for the model to use.

The RAGTruth project provides direct evidence that retrieval does not eliminate unsupported generation. Its researchers assembled nearly 18,000 RAG-produced responses across several models, tasks, and domains, then annotated hallucinations at both response and word level. The corpus includes claims that were unsupported by or contradictory to the retrieved material.

This is a different failure from retrieving the wrong document. The evidence can be correct, available, and visible, while the answer still departs from it.

That distinction matters for remediation. Improving the retriever will not fix a generator that adds unsupported details. Tightening the prompt will not repair a corpus missing the authoritative record. A single end-to-end accuracy score can hide both failures by showing only whether the final answer happened to match a reference.

A citation is a claim about support

Citations create two separate obligations.

The first is completeness: every material factual assertion that requires support should have it. The second is correctness: the cited source should actually entail the assertion attached to it.

A source can be reputable and still fail the second test. A government report may support the existence of a program without supporting a claim about its effectiveness. A study may establish an association while the answer describes causation. A document may be current but applicable to a different jurisdiction, population, product version, or time period.

The visual presence of an authoritative source cannot repair a mismatch between the source and the sentence.

A 2023 audit of four generative search engines found that their responses were fluent and appeared informative, but only 51.5 percent of generated sentences were fully supported by citations on average, while 74.5 percent of citations supported the sentence with which they were associated. The authors described the systems’ presentation as creating an appearance of trustworthiness that exceeded their measured verifiability. These figures are a historical snapshot of the products and versions evaluated in 2023, not a measurement of current systems in 2026. Their continuing relevance lies in the demonstrated gap between citation display and citation support.

The ALCE benchmark reached a related conclusion from controlled experiments. It evaluated retrieval, generation, factual correctness, and citation quality together. On its ELI5 task, even the strongest systems studied lacked complete citation support approximately half the time. The researchers identified retrieval quality, long-context use, and multi-source synthesis as separate areas requiring improvement.

These results make “includes citations” an inadequate evaluation category. A rigorous assessment has to examine support at the level of individual claims.

The most dangerous answer may be the one the corpus cannot answer

Most RAG demonstrations begin with questions for which the knowledge base contains an answer. Real users do not respect that experimental boundary.

They ask underspecified questions. They introduce false premises. They request facts outside the indexed corpus. They combine several questions, omit a jurisdiction, or ask for a conclusion that the available documents cannot support.

A system optimized only on answerable questions can learn the wrong behavioral lesson: produce an answer whenever retrieval returns something.

Research presented at ACL in 2025 evaluated RAG systems against six classes of unanswerable requests, including underspecified questions, false presuppositions, modality limitations, safety concerns, and requests outside the database. The study found that no single tested configuration performed best across all datasets on both answerable and unanswerable requests. Component choices and prompting strategies changed the balance between answering valid questions and rejecting those the corpus could not responsibly resolve.

This is where retrieval can make an answer sound especially safe. The system finds a document related to the question, extracts a plausible passage, and converts the passage into a definite conclusion. The citation makes the answer look bounded by evidence even though the evidence never contained the requested answer.

A refusal or request for clarification may be the most accurate output. That behavior has to be tested deliberately; it will not emerge reliably from citation formatting.

The real safety advantage is inspectability

The strongest case for RAG is narrower than the usual promise of “grounded answers.”

Retrieval can create an inspectable path from a response back to external evidence. That path can support debugging, correction, independent review, and accountability. But inspectability exists only when the system preserves enough information to reconstruct what happened.

An institution should be able to identify the original user request, any rewritten query, the corpus and version searched, the documents retrieved, their ranking and metadata, the exact passages given to the generator, the model and configuration used, the resulting claims, and the citations associated with those claims. Without that record, the decisive judgments remain hidden inside the pipeline.

The answer may display its sources while concealing how those sources were selected.

NIST’s Generative AI Profile treats retrieval as a system modification that requires documentation and renewed risk assessment, not as a general assurance of safety. Its recommended actions include verifying sources and citations, confirming that retrieval-augmented data is grounded, documenting how a model has been adapted for a specific task, and reassessing risks after a RAG implementation is introduced. NIST also cautions against extrapolating system performance from narrow or anecdotal assessments. The profile is voluntary risk-management guidance, not a certification that a system is trustworthy or legally compliant.

The midpoint of the safety argument is therefore not a better retrieval score. It is a better record of judgment.

Retrieval becomes valuable when it makes evidence selection, evidence use, and uncertainty easier to inspect. When those operations remain undocumented, RAG can add components without adding accountability.

What evidence would justify calling the answer safer?

The appropriate comparison is not between an uncited response and the same response with links added. It is between complete systems evaluated under the intended conditions of use.

A credible claim of improved safety would require evidence that the RAG system performs better than an appropriate non-retrieval baseline on the actual task. Retrieval quality would need to be evaluated separately from generation quality. Material claims would need to be checked for faithfulness to the retrieved passages, while citations would need to be assessed for both completeness and entailment. Tests would have to include stale, conflicting, irrelevant, and missing evidence rather than only clean answerable questions.

The system would also need to demonstrate sensible behavior when the corpus cannot answer. Query variations should not produce unexplained swings in conclusions. Evaluators should examine whether performance changes across topics, document types, languages, user phrasing, and corpus versions. Any automatic evaluator used for these judgments would itself require validation against qualified human review.

This decomposition is consistent with RAGChecker, a NeurIPS 2024 evaluation framework that separates diagnostic measures for retrieval and generation. Its authors argued that RAG evaluation is difficult precisely because the system is modular, the responses may be long, and aggregate measurements can be unreliable. Their meta-evaluation found stronger correlation with human judgments than competing automated metrics in the conditions studied.

No resulting score would establish that the system is universally safe. It would support a narrower statement tied to a named corpus, task, model version, evaluation protocol, user population, and risk tolerance.

That narrower statement is more useful because another institution can test it.

Retrieval should change the burden of proof

Rejecting RAG because it remains fallible would be a mistake. Parametric-only models can produce unsupported answers without exposing any source trail. Well-designed retrieval can improve factual performance, incorporate updated records, constrain the available evidence, and make verification more practical.

The mistake lies in treating those possible benefits as properties of every retrieved answer.

A visible source should increase the burden of proof, not lower it. The system is asserting that the answer is connected to evidence. That assertion can be tested. Evaluators can ask whether the source was the right one, whether it was current, whether the passage supported the claim, whether relevant contrary evidence was omitted, and whether the system should have answered at all.

In consequential settings, those questions cannot be delegated entirely to the same model that produced the answer. Legal, medical, financial, eligibility, public-safety, and other high-impact uses require qualified human review and the preservation of the responsible institution’s authority. Retrieval does not convert an advisory language model into a clinician, lawyer, regulator, adjudicator, or government decision-maker.

TAIRC’s research scope preserves that distinction: its LLM safety work is limited to controlled evaluation and documentation and does not certify systems as universally safe or deploy them into operational decision environments.

Retrieval can make an answer safer. It can also make a weak answer easier to believe.

The difference is not the citation icon. It is whether the evidence chain survives inspection.

Sources and verification

Patrick Lewis and colleagues, “Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks,” Advances in Neural Information Processing Systems 33, 2020. Verified through the official NeurIPS proceedings and used for the original RAG architecture and comparative-performance claims.

Yifan Ding and colleagues, “Citations and Trust in LLM Generated Responses,” Proceedings of the Thirty-Ninth AAAI Conference on Artificial Intelligence, 2025. Verified through the official AAAI publication record and author abstract; used for the finding that citations increased reported trust even when randomly selected.

Nelson Liu, Tianyi Zhang, and Percy Liang, “Evaluating Verifiability in Generative Search Engines,” Findings of EMNLP, 2023. Verified through the ACL Anthology; used for the human-audit results on sentence support and citation accuracy.

Tianyu Gao and colleagues, “Enabling Large Language Models to Generate Text with Citations,” EMNLP, 2023. Verified through the ACL Anthology; used for the ALCE benchmark and its citation-completeness finding.

Cheng Niu and colleagues, “RAGTruth: A Hallucination Corpus for Developing Trustworthy Retrieval-Augmented Language Models,” ACL, 2024. Verified through the ACL Anthology; used for the corpus size and the finding that RAG responses can remain unsupported or contradictory to retrieved content.

Nelson F. Liu and colleagues, “Lost in the Middle: How Language Models Use Long Contexts,” Transactions of the Association for Computational Linguistics, 2024. Verified through the ACL Anthology; used for the evidence-position and long-context-utilization findings.

Sezen Perçin and colleagues, “Investigating the Robustness of Retrieval-Augmented Generation at the Query Level,” GEM², 2025. Verified through the ACL Anthology; used for the query-perturbation and retriever-robustness findings.

Giovanni Trappolini and colleagues, “Redefining Retrieval Evaluation in the Era of LLMs,” EACL, 2026. Verified through the ACL Anthology; used for the analysis of distracting passages, traditional retrieval metrics, and end-to-end answer utility.

Xiangyu Peng and colleagues, “Unanswerability Evaluation for Retrieval Augmented Generation,” ACL, 2025. Verified through the ACL Anthology paper and first-page methodological summary; used for the taxonomy and evaluation of unanswerable RAG requests.

Dongyu Ru and colleagues, “RAGChecker: A Fine-grained Framework for Diagnosing Retrieval-Augmented Generation,” NeurIPS, 2024. Verified through the official NeurIPS proceedings; used for the modular evaluation and human-correlation claims.

National Institute of Standards and Technology, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile, NIST AI 600-1, July 2024. Verified from the official NIST publication; used for source verification, grounding, documentation, risk reassessment, and system-evaluation guidance.

TAIRC Research Portfolio and TAIRC Research Categories & Topics. Used only to verify TAIRC’s organizational scope, planned research boundaries, and prohibition on unsupported safety certification or operational deployment claims.