Cited but Unused — Counterfactual value substitution — What does it mean?

The news. On November 12, 2026, Tanzeel Abbas and Tehseen Zia (COMSATS University Islamabad) and David Windridge (Middlesex University London) posted Cited but Unused: Parametric Provenance in Retrieval-Augmented Generation. They tested five sizes of Qwen2.5-Instruct (0.5B to 14B) and Llama-3.1-8B-Instruct on ASQA, a set of factoid questions answered from Wikipedia passages, with top-5 retrieval, 800 questions per condition. Between 1.2% and 15.7% of citable claims came from the model's memory rather than the retrieved passages, models cited those claims as readily as the others, and NLI verification was indistinguishable from chance on every model. Read the paper →

Picture the open-book exam. A student writes 1969, and next to it p.12, and page 12 does say 1969. Did the student read the page, or did they already know the date and flip to a page that agreed? The answer sheet looks the same either way, and so does the grader's verdict, because the grader only checks that page 12 agrees. The examiner settles it by quietly changing the date on page 12 before the student sits down: a student who writes the new date read the page, and a student who still writes 1969 answered from memory, so the page number was decoration.

A RAG pipeline is in the student's position. When the retrieved chunks are assembled into the prompt, the model has no built-in way to keep facts from your documents apart from facts it learned in training, and the citation it attaches does not say which one it used. The paper names the gap precisely: a citation is correct when the cited passage entails the claim, and faithful when the passage also caused it. A correct but unfaithful citation is exactly the case a support check cannot see, because the property it tests is already true.

The protocol is the examiner's trick made exact. It finds a value v that appears both in the model's answer and in the retrieved passages, replaces it everywhere in those passages, titles included, with a false value v′, and asks the same question again. If the new answer says v′, the claim was contextual; if it still says v, the claim was parametric; if it says neither or both, the case is discarded as undetermined. Questions that themselves contain v are excluded, because the question cannot be edited. The label is built by an intervention, not inferred by a grader, which is what lets it run at scale without human judgement of what the model "meant".

Two design details move the numbers. An earlier version of the protocol edited passage bodies but not their titles, so the model could still read the original value in the title, and fixing that roughly halved the measured rates. And the size of the edit matters: dates were shifted by 18 to 40 years by default, and the rate rises as the false date gets more implausible. A third outcome also appeared that the protocol did not plan for: in 25.7% of Qwen2.5-14B's records the model reported the passage's value, stated the value it held, and objected that the source looked wrong. That behaviour was absent below 7B.

Here is the reference model, Qwen2.5-7B on ASQA, walked through with the paper's own counts. Of 426 claims the protocol could decide, 35 kept the original value after the edit, a parametric rate of 8.2%. All 35 of those claims still carried a citation (35 of 35, 100%), against 96% for contextual claims. After the edit, the cited passage contained the value the claim asserted in 0 of 35 parametric cases, so the contradiction was sitting in the very text the verifier read. The NLI verifier, restricted to the cited passage, still scored AUROC 0.532, with an interval of 0.415 to 0.646 that contains a coin flip, and its mean entailment score was actually higher for the parametric claims (0.329) than for the contextual ones (0.214). A model answering from memory picks a citation that agrees with what it wrote, so the support check rewards it. This is the validator-validation failure in a specific form: the grader measures agreement, and the team reads it as provenance.

If agreement cannot separate the two cases, what can? The signal that worked best compares the model's distribution with and without the retrieved context, measured at the single disputed token, and it reaches a mean AUROC of about 0.79 across the six models. The same contrast averaged over the whole sentence drops to about 0.67 to 0.70, because one informative token is diluted among roughly a dozen others. Passage-deletion methods land lower still, and the full ContextCite tool scored 0.507 on Qwen2.5-7B, again consistent with chance. The most robust finding is about where the information lives: quantities computed with the context present carried no usable provenance signal on five of the six models. A memorised claim and a grounded claim look alike once a supporting passage sits in the prompt, so a detector that reads the model's state at generation time is reading the wrong quantity.

Even the best detector does not solve the problem, and the paper says so. On Qwen2.5-7B, claims the model could already answer with no context were parametric 13.2% of the time (29 of 220), against 2.9% (6 of 205) for claims it could not, so prior knowledge raises the chance more than fourfold. But 191 of those 220 known claims still followed the edited passage. In the paper's words, the contrast signal measures what the model knows rather than what it used, and the two coincide only where the context contradicts that knowledge, which in ordinary retrieval it rarely does. The authors also test acting on the signal: flagging a claim is worth it only when the detector's precision exceeds 1 ÷ (1 + c), where c is the cost of a missed parametric claim relative to a false flag, and at base rates of a few percent the best flagging budget gave no gain in honest citations under equal costs.

The scope is narrow, and the paper lists the limits: one model family at five sizes plus one comparator, all at 14B or below, prompts written as text for the model to continue rather than as chat turns, and a protocol that needs an editable value, which ASQA's dated facts supply but long-form ELI5 answers mostly do not (132 of 800 answers had one). What carries over is the method, and a fourth row for the three-row RAG failure-mode table: an answer that is fluent, cited and supported, but did not come from the passage it cites. A citation-support score is evidence of agreement, not of origin, and a substitution test on your own retrieval set is a way to measure the difference directly.

Goes deeper in: AI Agents → Retrieval & RAG → Retrieve-Then-Generate

Related explainers

• CDD — Context-Driven Decomposition for RAG knowledge conflict — what to do when the passages and the model's memory disagree, the case this paper creates on purpose.
• GenV — Verdict-preserving unfaithfulness — another check that passes while the thing it is meant to confirm is wrong.