RAG Citations Are Frequently Lying — And the Standard Way to Catch Them Is No Better Than a Coin Flip

Up to 15.7% of RAG citations point to retrieved documents the model never actually used. NLI verification can't detect this. The best detector found still can't act on its signal.

Imagine you're a student writing an essay with a stack of library books on your desk. You already know the answer from last semester's lecture, so you write it from memory — then grab the nearest book that happens to agree with you and slap it in the footnotes. The citation is real, the book does say what you claim, but the book had nothing to do with how you arrived at the answer. That's the core mechanism this paper measures in retrieval-augmented generation. The committed claim: RAG systems routinely cite retrieved passages for facts they actually pulled from parametric (memorized) memory, and the standard verification tool — natural language inference — cannot detect this at better than chance. The authors test this with a clean counterfactual method: swap a fact in the retrieved passage for a false variant, re-query the model, and check whether the answer changes. If it doesn't, the model was never reading from that document in the first place. Across five sizes of one model family and a second comparator, the "cited but unused" rate ranges from 1.2% to 15.7%, with larger models more prone to ignoring their context. The ladder position here is uncomfortable for the field. NLI-based attribution verification — the approach most deployed RAG pipelines rely on — produces results "indistinguishable from chance" even when restricted to only the cited passage. That's not weak performance; it's structural failure. The authors explain why: a model answering from memory picks a citation that agrees with its output, so entailment between answer and citation is always high regardless of provenance. You're checking whether the footnote is consistent with the claim, not whether the footnote caused the claim. Ten attribution methods are compared head-to-head on identical claims. The best separator is the contrast between the model's output distribution with and without context — essentially measuring how much the retrieval actually shifted the model's beliefs. But even this signal, while it separates provenance in measurement, doesn't improve honesty when acted upon at the observed base rates. The architecture insight is that this is fundamentally a causal inference problem dressed in NLP clothing. The counterfactual value substitution method is a do-calculus intervention: change the input, observe whether the output changes. The paper treats LLMs as causal systems where the question is whether the retrieved context is on the causal path to the output, or whether it's a decorative post-hoc rationalization. This framing is more productive than treating attribution as a classification problem. The integrity profile is solid for a measurement paper. The counterfactual substitution is clean and interpretable. Testing across two model families and five model sizes prevents the result from being an artifact of one architecture. The authors are unusually honest about their detector's limitations — they explicitly state it "measures what the model knew rather than what it used" and that separating those remains open. The key weakness is that both model families are unnamed beyond "one family" and "a comparator," which limits independent replication specificity. The most important number is the scaling relationship: cited-but-unused rates rise with model size within a family. This means the problem gets worse as models get more capable, not better. The larger the parametric memory, the more facts the model already "knows," and the more often retrieved context becomes decorative. At the most conservative substitution distance, the two tested models show 4.6% and 8.5% phantom citation rates. These are not edge cases. The open problem the authors name plainly — separating what a model knew from what it used — is the successor experiment nobody has cracked. The obvious next step is an intervention that forces models to condition on context rather than memory, perhaps through architectural modifications that gate parametric knowledge during retrieval-augmented inference. The authors likely didn't run this because it requires modifying model internals, not just probing outputs. This paper is diagnostic, not therapeutic, and that's the honest framing.