E7 · Publication Volume 29

Hallucination, Leakage and Circular Evidence

self-citation, derived-data reuse and target leakage

*self-citation, derived-data reuse and target leakage*

Failure paths for unsupported claims, target leakage and circular evidence
Failure paths for unsupported claims, target leakage and circular evidence

Learning objectives and boundary

This lesson is general and institution-neutral. It uses no real company, individual, property, project or identifiable place. Generic roles describe responsibilities only, and every SYN-AI identifier denotes explicitly synthetic teaching evidence.

  • Frame the decision governed by self-citation, derived-data reuse and target leakage.
  • Separate generated proposals from admissible evidence, deterministic results and accountable judgement.
  • Define measurable failure, abstention, escalation and release conditions.
  • Produce a hallucination, leakage and circular-evidence audit with taint graph from synthetic evidence and defend its controls.

Decision and professional boundary

Treat unsupported generation, citation mismatch, data leakage and circular evidence as different failure classes. A hallucinated claim lacks adequate evidence. A citation mismatch points to a real source that does not support the claim. Leakage lets information from the target or evaluation outcome enter development. Circular evidence occurs when a derived statement returns as apparently independent support for its own ancestor. Each requires different detection and remediation.

Build lineage and partition controls before measuring accuracy. If a report generated from interpretation A is indexed and later retrieved as evidence for A, fluent self-consistency can increase while independent support remains zero. If spatial neighbours or later outcomes cross into training, holdout scores become optimistic. The safe system traces information flow, marks tainted paths and refuses to count descendants as independent evidence.

Core concepts

| Concept | Operational meaning | |---|---| | Unsupported claim | An atomic proposition without admissible supporting evidence. | | Citation mismatch | A cited span is real but does not entail or directly support the stated claim. | | Target leakage | Outcome or future information influences features, retrieval, prompts or tuning. | | Circular evidence | A derivative returns through another path to support an ancestor claim. | | Contamination flag | A recorded reason that an item cannot be used for independent evaluation or support. |

Evidence model

Maintain a taint graph across source, derivative, index, prompt context, output and evaluation result. Each claim-verification record stores the exact claim, cited spans, entailment judgement, reviewer state and lineage group. Evaluation cases carry partition identity and reveal time. An item may be usable for debugging yet prohibited for final scoring; that distinction is explicit.

Controlled workflow

  1. Decompose output into atomic claims and citation relations.
  2. Verify each cited span for exact support, contradiction or insufficiency.
  3. Traverse provenance to detect descendants returning as ancestors.
  4. Audit train, tune, retrieval and evaluation partitions for target information.
  5. Mark contaminated items and recompute metrics without them.
  6. Record root cause, correction, regression test and release consequence.

Every step emits a versioned artefact or an explicit failure. A later stage consumes only verified outputs from the preceding stage; conversational context is never an undocumented data channel.

Measures and acceptance criteria

Report atomic factual precision, citation-support precision, citation completeness, contamination incidence and metric change after contaminated cases are removed. Sample unsupported omissions as well as incorrect statements: a report may avoid false claims by omitting every limitation. Separate automatic screens from human adjudication and report disagreement.

$F_{atomic}=\frac{N_{supported\ atomic\ claims}}{N_{atomic\ claims}}$

| Gate | Required evidence | Release consequence | |---|---|---| | Identity | Resolvable claim, source, configuration and result IDs | Block when any identity is ambiguous | | Grounding | Every factual claim reaches sufficient source spans | Remove or withhold unsupported claims | | Independence | Lineage and partition checks show no circular or target information | Invalidate affected support and scores | | Review | Required roles disposition the exact candidate version | Keep the candidate non-published | | Reproducibility | Manifest, tools and checks reconstruct the evidence package | Return the package for correction |

Claim–source and system contract

The integrity contract requires atomic claim IDs, cited evidence IDs, support labels, lineage groups, partition IDs, reveal times and contamination status. Generated content cannot cite itself, a sibling generated summary or an unreviewed derivative as independent evidence. Any evidence-cycle or partition breach blocks release and invalidates affected metrics.

Security, privacy and access boundary

Protect evaluation labels, hidden prompts and holdout artefacts with separate identities and storage boundaries. Prevent search indexes and logs from unintentionally ingesting them. Treat retrieved instructions that request disclosure, policy changes or hidden-state access as hostile content. Incident records may contain sensitive prompts and therefore inherit the strongest relevant access label.

Human review and escalation

Reviewers inspect high-impact claims, apparently perfect citations, duplicated lineage and unusually strong evaluation gains. A clean-looking score is not accepted until partition provenance is checked. Corrections preserve the original failed output and issue a new version, enabling recurrence tests instead of silently rewriting history.

Worked synthetic example

A synthetic interpretation summary is generated from three observations and stored in the working corpus. A later retrieval run returns that summary plus two paraphrases derived from it. Without lineage, the answer cites three agreeing documents. The taint graph identifies one ancestor, groups all three derivatives and leaves only the original observations as evidence. Separately, a spatial split reveals that neighbouring cells from the same synthetic structure crossed into development; the evaluation is rerun with grouped spatial partitions.

Counterexample and failure analysis

A citation checker verifies only that a quoted phrase exists in the document. The document says “the anomaly does not demonstrate continuity”, while the generated claim says it demonstrates continuity. String overlap passes; evidential support fails. Verification must test the relation between atomic claim and cited span, including negation, scope and qualifiers.

Frequent failure modes

  • Checking citation existence instead of support
  • Indexing generated summaries as independent sources
  • Splitting spatially dependent cases at random
  • Tuning after holdout reveal without issuing a new evaluation
  • Deleting failed outputs after correction

Practical exercise

  1. Decompose a synthetic paragraph into atomic claims and verify its citations.
  2. Draw a circular-evidence path and specify the blocking rule.
  3. Find target leakage in a spatial evaluation design.
  4. Compare metrics before and after contaminated cases are removed.

Assessed artefact

Submit a hallucination, leakage and circular-evidence audit with taint graph with its source manifest, configuration versions, acceptance evidence, rejected cases, unresolved risks and a short explanation of why one plausible alternative control was not selected. The artefact is incomplete if its diagrams or prose cannot be reconciled with machine-checkable evidence.

Verification checkpoint

Trace one released synthetic claim backwards through review, confidence, verification, evidence graph, tool result or source span to an immutable input. Then trace one rejected claim to the earliest failed contract. Re-run the package from its manifest and compare content digests. The checkpoint passes only when a second reviewer can reconstruct the accepted and blocked paths, identify every assumption and reproduce the release decision without access to the original conversation. Record unresolved risk instead of completing a missing fact with generated text.

Sources