The grounding gate: how to stop an AI research pipeline inventing quotes

Everybody worried about AI research pipelines is worried about the wrong failure.

The fear is invention from nothing: a model producing a quote from a company that does not exist, a statistic with no source, an entire fabricated finding. That does happen, and it is comparatively easy to catch, because a claim with no source anywhere fails the most basic check.

The failure that actually gets through is quieter. It is a quote that is nearly right.

The ninety percent problem

A model reads a competitor’s homepage. The page says:

Compliance-critical sites do not get to have downtime.

The model, summarising, writes:

Compliance-critical facilities cannot afford downtime.

Same meaning. Better sentence, arguably. Completely unusable as evidence.

Because now you have a quotation mark around words the company did not write. If a client puts that in a deck, and a competitor reads it, the competitor can correctly say they never said that. Everything else in your report is now suspect, and you deserve it to be.

Multiply that by three hundred evidence records and the probability that at least one improved quote reaches a client approaches certainty.

The gate

The rule that fixes it is unforgiving and simple:

Every quote is verified byte for byte against the cached source page before it can become a record. A quote that is not literally present is rejected.

Two design decisions in that sentence carry the weight.

Against a cached copy, not against a live fetch

The page you verify against must be the page that was captured, stored, with a timestamp.

Live re-fetching fails for obvious reasons: the page changes, the site goes down, the CDN serves something different, and worst of all it succeeds most of the time so the failures are sporadic and confusing.

More subtly, a cached copy makes a claim durable. Six months later somebody asks where a quote came from. You have the page as it existed on the day, not a link to a page that has since been rewritten. Competitors update their sites, and a claim that cannot be checked after the source changes is not much of a claim.

Rejected, not flagged

This is the decision people push back on, and it is the one that matters.

Flagging feels safer. Mark it for review, let a human decide, keep the information.

Flagging does not work, for a reason that has nothing to do with the technology. A flag queue with three hundred items in it gets processed by somebody under time pressure who is looking for reasons to approve. Flags become noise. Noise becomes a rubber stamp.

Rejection has no queue. The record does not exist. There is nothing to approve.

The cost is real: occasionally a legitimate quote gets rejected because of a whitespace difference, an encoding artefact, or a smart quote character. That is an annoyance, and the correct response is to normalise those specific things carefully and then hold the line.

The alternative, a gate that can be talked past, is not a gate.

What the gate does not catch

Here is where honesty about the control matters more than the control.

The gate verifies quotes. That is all it does. Which means it is blind to every fabrication that does not involve a quotation.

We audited it adversarially against seven fabrication classes. It caught two.

It cannot see:

• A claim that misrepresents a real quote. The quote is verbatim and correct. The sentence around it says the quote means something it does not.
• An invented figure in a summary. “They publish roughly twice a month” when nobody counted.
• An inflated importance ranking. Calling a minor finding the most significant thing in the audit.
• A claim filed under the wrong lens. A content observation scored as a positioning finding, which quietly moves a score in a lens where the evidence does not belong.
• A correct claim about the wrong company. Everything verbatim, everything true, attributed to the competitor next to the one it came from.

Every one of those passes a quote check cleanly, because every individual fact in them is real.

That is why a second, deliberately skeptical pass exists, reading each claim against its own evidence and trying to refute it. And it is why the second pass publishes its objections beside the claim rather than resolving them silently.

Two controls, because one was demonstrably insufficient. Publishing the insufficiency, because a security claim that has not been tested against itself is marketing.

Negative controls, briefly

A verification gate that has quietly stopped working looks exactly like a verification gate that is working: everything passes.

So every scan plants a deliberately false claim for each competitor. If the gate ever accepts one, the run fails loudly rather than producing a report.

Across a live audit, all twelve planted false claims were rejected, with every competitor showing exactly one rejection and that one being the control. That is the shape you want: the control fires, nothing else does.

Without that, you are trusting the gate on faith, and faith is precisely what the gate exists to replace.

The generalisable lesson

If you are building anything that uses a language model for research, three rules are worth stealing.

Verify against a stored artefact, not against the world. The world changes and your claim needs to outlive the change.

Reject rather than flag. Any human review queue large enough to matter will be rubber-stamped.

Test your verifier deliberately, on every run. A control that only fires when something is wrong tells you nothing on the days it does not fire, unless you also plant something that should make it fire.

And one meta-rule underneath all of them: audit your control against itself and publish what it misses. We found ours caught 2 of 7 and said so on a public page, which is uncomfortable and is also the only version of this claim worth believing.

The full description of all four controls is on how we prove it.