Preserving Exact Source Wording in LLM Systems

A retrieval pipeline can supply the right document, the right passage, and the right version of a fact, yet the final answer can still be wrong in a particularly quiet way. The model may retain the general meaning while changing the wording, adjusting a number, replacing a defined term with a near-synonym, or smoothing a quotation into language the source never used.

This is not limited to cases where retrieval fails. The source can be visible in the model context and correctly identified as relevant. The drift occurs later, when the model generates the answer. Large language models produce text by selecting probable continuations token by token. They are highly capable of restating meaning, but ordinary generation does not provide a deterministic copy operation. A request to reproduce a passage verbatim remains an instruction within a probabilistic process.

The distinction is visible in an example documented by the VerbatimRAG project. Its retrieved source stated, "We created 60k examples." A conventional generative response rendered that as "Around 58,000 examples." Retrieval had succeeded. The alteration occurred during generation. The output remained plausible enough to escape casual review, which is precisely what makes this failure mode operationally dangerous.

Matt Yeung’s work on deterministic quoting makes the architectural implication explicit: source material that passes through an LLM may be transformed before it reaches the user. His proposed pattern separates generated commentary from quotations retrieved through a conventional lookup. The model may decide which source segment is relevant, but the displayed quotation is inserted from the source rather than accepted from the generated output.

For architects, a model’s ability to often copy text correctly is not the relevant standard. Occasional accuracy is not an acceptable control standard for fields where a single changed numeral, omitted qualifier, or substituted term can alter a decision. In those fields, verbatim reproduction must be treated as a data-preservation requirement rather than a language-quality preference.

Prompts such as "quote exactly," "do not paraphrase," and "copy the figure as written" can improve behavior. They can reduce casual rewriting and make the expected output clearer. They cannot convert generation into a guarantee.

Instruction-following remains probabilistic. It competes with other learned tendencies: summarization, stylistic smoothing, format completion, abbreviation expansion, and the production of language that appears natural in context. Model updates, decoding settings, surrounding instructions, longer contexts, and multi-step agent workflows can all change the likelihood that an exact-copy instruction is followed. A prompt is a behavioral influence, not an enforcement boundary.

Citations do not close that gap. A citation can identify a relevant source while the adjacent sentence misstates it. It can also be attached because the model has learned that a citation is expected in that position, rather than because the cited passage causally supported the wording produced.

Research by Ian van Dort and Maria Heuss, published as How Do LLMs Cite?, examines citation behavior through activation patching. The authors describe citation production as a distributed, multi-stage mechanism and identify a potential disconnect between an answer’s apparent attribution and the model’s internal computational path. Their conclusion is directly relevant to system design: the presence of an inline citation can create a false sense of security.

The FACTUM study reaches a complementary conclusion from the perspective of citation-hallucination detection. It models correct and incorrect citation behavior through the interaction of attention and feed-forward pathways rather than treating citation failure as a simple matter of the model ignoring retrieved context. The detected signatures also vary with model scale. That mechanistic complexity argues against treating a well-formed citation as sufficient proof that the accompanying claim faithfully reproduces its source.

Prompt compliance, citation presence, and source faithfulness are three different properties. A production architecture should measure and control them separately.

Three patterns are useful, but they address different assurance levels. The appropriate choice depends on whether the system must guarantee exact text, repair selected fields, or detect unsupported output.

Extractive or verbatim retrieval

The strongest pattern is to remove protected content from the generative path. Instead of asking the model to reproduce a quotation, the system asks it to identify a source span or return a stable span identifier. The application then renders the original characters from the indexed source.

VerbatimRAG formalizes this as "extract, don’t generate." Retrieved chunks are passed to an extraction layer that selects existing spans, and a separate composition layer presents them without generative rewriting. Yeung’s deterministic-quoting design follows the same control principle: generated quote text is discarded, the cited reference is resolved against the source index, and the original passage is inserted after model generation.

This pattern provides wording integrity, but it does not guarantee relevance. A model can still select the wrong span, omit necessary context, or choose language from an outdated document. Exact reproduction solves transformation risk, not source-governance or retrieval-quality risk. The system must therefore preserve document identity, version, location, and surrounding context alongside the quoted span.

Deterministic post-processing

Some applications need fluent generated prose while protecting only particular elements. In that case, the model can produce a structured answer containing source identifiers or typed placeholders. A deterministic post-processor then replaces protected content with canonical values from an authoritative store.

For example, the model might return a narrative containing a contract-clause identifier, a metric identifier, and a quote-span identifier. The application resolves each identifier after generation and inserts the approved clause text, stored metric representation, or original quotation. Any identifier that cannot be resolved should cause the protected field to fail closed rather than allowing the model’s version to remain visible.

This approach works well when exact content is embedded within broader analysis. It also creates a clear interface between model judgment and system authority: the model selects and explains; deterministic components reproduce.

Citation-verification passes

Verification is appropriate where fully extractive output would be too restrictive or where generated paraphrase is acceptable provided that it remains supported. A verifier compares each claim with its cited passage, checking entailment, numeric consistency, quotation equality, and source identity.

CiteFix demonstrates post-processing citation correction as a distinct layer after answer generation. Its methods cross-check generated citations against retrieved articles using keyword and semantic matching, a fine-tuned model with BERTScore, and a lightweight LLM-based technique. The paper reports a 15.46 percent relative improvement in its overall RAG accuracy metrics.

A verification pass is still weaker than deterministic insertion for content that must remain character-for-character identical. Verifiers have thresholds, model errors, and ambiguous cases. They are best used to reject, flag, reroute, or repair output, not to create the appearance of a guarantee that the verification mechanism itself cannot provide.

The control boundary should be defined by consequence, not by content type alone. Exact preservation is warranted where a small textual change can alter interpretation, obligation, provenance, or a downstream calculation.

Figures require protection when they feed decisions, comparisons, thresholds, reports, or calculations. Systems should preserve not only the value but also units, scale, sign, currency, time period, and qualifiers such as "approximately," "up to," or "as of." Normalizing a value for computation may be useful, but the displayed source wording should remain independently recoverable.

Direct quotations should come from source spans rather than generated reconstruction. This applies even when the model’s version appears stylistically cleaner. A cleaned-up quotation is no longer a quotation. The architecture should retain source location and enough surrounding text for a reviewer to judge whether the selected passage was represented fairly.

Legal and contractual language is sensitive to modal verbs, exceptions, defined scopes, punctuation, and cross-references. A fluent paraphrase can change an obligation or remove a condition without looking obviously defective. Generated explanation may sit beside the clause, but the clause itself should be rendered from the controlling document.

Defined terms should be resolved from a canonical term store or source span. Substituting a familiar synonym can collapse a distinction that the document deliberately established. This is especially important when terms vary across policies, contracts, technical standards, or document versions.

Not every sentence needs this treatment. Paraphrase is usually acceptable for orientation, synthesis, narrative transitions, and analysis where the system clearly distinguishes generated interpretation from source text. Applying verbatim controls everywhere can produce unreadable answers, expose irrelevant source language, and increase retrieval and interface complexity. The objective is to prevent generation from silently rewriting fields whose integrity carries material consequences, not to eliminate generation altogether.

The preceding principles improve the quality of what reaches the model, but they do not control what leaves it. Architectural principles for token efficiency keep context deliberate rather than expansive. Minimal-and-complete context reduces distraction while retaining the evidence needed for the task. Authoritative state separation prevents generated prose from becoming the system of record. Normalized entities and context slices reduce ambiguity in how relevant information is assembled.

None of those controls guarantees that text will survive generation unchanged. Once a protected figure, quotation, clause, or term is entrusted to token generation, wording integrity becomes probabilistic again. The final architectural principle is therefore a boundary around generation itself: use models for selection, synthesis, and explanation, but use source retrieval and deterministic computation for exact reproduction.

This distinction closes the series at the point where context design becomes output control. Efficient, authoritative, well-structured context is necessary. For high-consequence fields, it is not sufficient. The pipeline must preserve the difference between text the model wrote and text the system can prove came directly from an identified source.

• Part 1: Architectural Principles for Token-Efficient Agentic Systems
• Part 2: Minimal and Complete Model Context Design
• Part 3: Authoritative State Must Live Outside the Model Context
• Part 4: Normalized Entities and Context Slices Beyond Chunk Retrieval
• Part 1: Governing the Digital Investigation Lifecycle Across Systems and Teams
• Part 2: From UAE and Dubai Cybersecurity Controls to Operational Investigation Evidence
• Part 3: A Vendor-Neutral Event Architecture for Digital Investigation Governance
• Part 4: Human Authority in AI-Assisted Digital Investigation Governance

Browse the full Architectural Insights series →

• Matt Yeung, "Deterministic Quoting: Making LLMs Safer for Healthcare"
• Adam Kovacs, "Build Hallucination-Free RAG with Verbatim"
• Maxime Dassen et al., "FACTUM: Mechanistic Detection of Citation Hallucination in Long-Form RAG"
• Ian van Dort and Maria Heuss, "How Do LLMs Cite? A Mechanistic Interpretation of Attribution in Retrieval-Augmented Generation"
• Harsh Maheshwari, Srikanth Tenneti, and Alwarappan Nakkiran, "CiteFix: Enhancing RAG Accuracy Through Post-Processing Citation Correction"