Anti-hallucination: mandatory provenance and explicit conflicts

Hallucination in a summarizer is not a model bug you prompt away — it is a missing constraint. Two rules — mandatory provenance and explicit conflict flags — cut it down more than any prompt tweak.

TL;DR — You cannot prompt hallucination away, but you can make it visible. Require a source id for every claim, and require cross-domain conflicts to be flagged rather than merged. Once claims without provenance are a schema error, fabrication stops paying.

The real problem is not "lying"

A summarizer that invents a source is not lying — it is optimising for fluency under uncertainty. Given a gap, the model fills it with something plausible. The fluent output then reads as authoritative. The bug is that nothing in the process marks the difference between a claim that came from the input and a claim that did not.

Rule 1 — Mandatory provenance

Every conclusion in the Overview must carry the id of the idea it came from:

cluster: "memory as an asset"
members: [A-001:01, A-003:01, A-006:03]   ← traceable

A conclusion with no id is not "less certain" — it is structurally invalid. Making provenance a schema requirement, not a style guideline, changes the model's incentive: a fabricated claim now fails validation instead of reading smoothly.

Rule 2 — Explicit conflicts, no silent merging

When the same term means different things across domains, the temptation is to merge them into one tidy cluster. That hides the disagreement. The rule is the opposite:

Same term, different meaning → record it as a conflict, with both statements and both ids, and let a human decide.

Why this beats prompt tweaking

A prompt like "do not hallucinate" is aspirational. A schema that rejects unsourced output is enforced on every run. The former is a hope; the latter is a contract.

The residual risk

Provenance does not stop a model from misreading a source it correctly cites. It narrows the failure from "invented a fact" to "misquoted a fact" — a much smaller and more detectable surface. Completeness is not the goal; visibility is.

This is implemented in the open-source spec §2.5 — see the repo.