Attributable Post-Rationalization in RAG Citations: A Controlled Reproduction and an RLVR Comparison

Mehedi Khan; Md. Shariful Islam Bhuyan

cs.CLSep 19, 2026

Attributable Post-Rationalization in RAG Citations: A Controlled Reproduction and an RLVR Comparison

Authors: Mehedi Khan, Md. Shariful Islam Bhuyan

Organizations: Department of Computer Science and Engineering Bangladesh University of Engineering and Technology

Abstract

A RAG system can hand you the right answer and cite a source it did not actually use. Models output these unfaithful citations via post-rationalization: they write the answer first and then attach a citation to whatever passage looks close enough. Search agents are now trained with reinforcement learning from verifiable rewards (RLVR), which pays them for getting the answer right. We asked whether that training also teaches them to cite honestly. Improving an existing methodology with a required control, we compared an instruction-tuned model against three RLVR agents trained from it, on four question-answering datasets, using only free-tier Kaggle GPUs. Post-rationalization is everywhere: on Wikipedia-based questions roughly one citation in seven is unfaithful. RLVR does not fix it. The agents post-rationalize at their base model's rate, and one lands slightly worse. Rewarding correct answers buys nothing in citation faithfulness, so faithfulness has to be trained and measured on its own terms.

Figures & tables

Variant	Where the span is planted
rel-uncited	A retrieved passage that the answer did not cite.
cited-other	A passage the answer already cites, but for a different sentence.
random	An uncited slot, after replacing its passage with one from a different question.

Table 1: The three probe variants. Each changes exactly one of the five retrieved passages, and the passage that genuinely supports the claim stays in the context. rel-uncited is our main measure.

Model	Training on top of the base
Baseline	none (Qwen2.5-7B-Instruct)
Search-R1	RLVR with PPO
ReSearch	RLVR with GRPO
R-Search	RLVR with GRPO

Table 2: Models (top) and datasets (bottom). All four models share the Qwen2.5-7B-Instruct base. Passages is the number of roughly 100-token chunks in each retrieval index.

rel-uncited (claim-aligned)
Dataset	Planted	Control	Attr.
NQ	52/371	0/371	+14.0
QAMPARI	29/319	0/319	+9.1
HAGRID	64/433	0/433	+14.8
RAGTruth	25/864	0/864	+2.9
random (claim-aligned)

Table 3: What the no-planting control changes, for the baseline model. Planted and Control are cited records over all records (

k/n

); Attr. is the attributable rate in pp (Eq. 1 ). For cited-other the control is 100%, and the attributable rate is negative (all 95% CIs exclude 0).

Dataset	Baseline	Search-R1	ReSearch	R-Search
NQ	14.0 52/371	12.8 36/281	14.1 50/355	14.7 57/387
QAMPARI	9.1 29/319	13.4 38/283	7.5 25/332	12.2 43/352
HAGRID	14.8 64/433	13.8 53/383	13.6 59/434	18.6 80/430
RAGTruth	2.9 25/864	4.1 29/699	3.6 30/823	5.9 52/879

Table 4: How often each model follows the planted span: attributable rate on rel-uncited in %, with cited records over all records below. The control is 0 in every cell, so these equal the raw rates. Baseline 95% CIs: NQ [10.4, 17.8], QAMPARI [6.2, 12.0], HAGRID [11.8, 18.2], RAGTruth [1.8, 3.9].

Search-R1 vs. baseline
Dataset	DiD	95% CI	Holm $p$
NQ	$-$ 1.2	[ $-$ 6.9, 4.2]	1.000
QAMPARI	+4.3	[ $-$ 0.5, 9.7]	0.267
HAGRID	$-$ 0.9	[ $-$ 4.9, 3.2]	1.000
RAGTruth	+1.3	[ $-$ 0.5, 3.0]	0.334
ReSearch vs. baseline

Table 5: Each agent’s attributable rate on rel-uncited minus the baseline’s (DiD, pp), with a 95% bootstrap CI and a Holm-adjusted

p

-value within each dataset. Negative would mean the agent post-rationalizes less than its base. Bold marks the only comparison with

p<0.05

Appendix figures & tables6 assets

Supplementary material from the paper’s appendix.

Appendix

Model	Hugging Face checkpoint
Baseline	Qwen/Qwen2.5-7B-Instruct
Search-R1	PeterJinGo/SearchR1-nq_hotpotqa_
	train-qwen2.5-7b-it-em-ppo
ReSearch	agentrl/ReSearch-Qwen-7B-Instruct
R-Search	qingfei1/R-Search-7b-grpo

Appendix

Table 6: Checkpoints used. The Search-R1 name is split over two lines.

Data	Model	IDK	Ans.	Fmt.	Claims
NQ	Baseline	149 (30%)	350	315	371
	Search-R1	208 (42%)	291	238	281
	ReSearch	158 (32%)	341	310	355
	R-Search	129 (26%)	370	341	387
QAMPARI	Baseline	186 (37%)	314	241	329
	Search-R1	259 (52%)	241	186	283

Appendix

Table 7: Per question: replied “I don’t know” (IDK), answered (Ans.), and answered in the required format (Fmt.). Claims is the number of cited sentences that enter the probe; the

n

in the result tables is slightly smaller because a variant can only be built when a suitable passage exists. RAGTruth answers are longer, so they yield more claims per question. Search-R1 abstains most and R-Search least on every dataset.

Dataset	Baseline	Search-R1	ReSearch	R-Search
NQ	+10.8	+8.9	+9.0	+10.3
QAMPARI	+4.4	+5.7	+7.8	+8.2
HAGRID	+7.6	+8.6	+10.6	+11.9
RAGTruth	+2.1	+2.9	+2.3	+3.9

Appendix

Table 8: Attributable rate on random (pp, claim-aligned) for all models.

n

is the same as in Table 4 . The control rate is 0 in 7 of the 16 cells and 0.1–0.9% in the rest.

Dataset	Planted	Control	Attr.	95% CI
NQ	9/69	0/69	+13.0	[5.5, 22.5]
QAMPARI	16/123	0/123	+13.0	[7.3, 19.7]
HAGRID	12/61	0/61	+19.7	[10.8, 31.3]
RAGTruth	67/623	1/623	+10.6	[7.9, 13.5]

Appendix

Table 9: cited-other for the baseline under the claim-aligned outcome (pp). Unlike the cited-anywhere outcome in Table 3 , this one shows post-rationalization. Only RAGTruth has enough question clusters for a reliable interval.

Dataset	Search-R1	ReSearch	R-Search
NQ	$-$ 1.9 (0.984)	$-$ 1.8 (0.984)	$-$ 0.4 (0.984)
QAMPARI	+1.3 (0.379)	+3.4 (0.114)	+3.8 (0.114)
HAGRID	+1.0 (0.561)	+3.0 (0.182)	+4.2 (0.081)
RAGTruth	+0.8 (0.594)	+0.2 (0.764)	+1.8 (0.063)

Appendix

Table 10: Robustness check 1: agent minus baseline on the random variant (DiD, pp, claim-aligned), Holm-adjusted

p

in parentheses. No comparison reaches

p<0.05

Dataset	Search-R1	ReSearch	R-Search
NQ	$-$ 2.5 (1.000)	$-$ 0.6 (1.000)	$-$ 0.5 (1.000)
QAMPARI	+6.6 (0.102)	$-$ 1.7 (0.473)	+3.3 (0.460)
HAGRID	$-$ 1.0 (0.665)	$-$ 2.1 (0.586)	+3.1 (0.420)
RAGTruth	+3.4 (0.051)	+1.7 (0.224)	+2.3 (0.224)

Appendix

Table 11: Robustness check 2: agent minus baseline on rel-uncited under the cited-anywhere outcome (DiD, pp), Holm-adjusted

p

in parentheses. No comparison reaches

p<0.05

. Under this outcome the baseline’s own rate is 17.8%, 13.2%, 16.6%, and 7.1% on the four datasets, and every interval still excludes zero.

RAG Citation Faithfulness

See all 19 papers

CiteShade: Citation Laundering in Multi-Source Retrieval-Augmented Generation and Its Counterfactual Defense
Sep 14, 2026Guo FuzhengRAG Poisoning Attacks RAG Security
City University of Hong Kong
How Do LLMs Cite? A Mechanistic Interpretation of Attribution in Retrieval-Augmented Generation
Jun 9, 2026Ian van Dort, Maria HeussRAG Citation Faithfulness Retrieval-Augmented Generation
University of Amsterdam
Copying Is Not Grounding: Training Faithful Long-Form RAG with Authored-Sentence Credit
Oct 13, 2026Hoang Pham, Duc Anh Vu, Duy Tung Doan +2RL for RAG RAG Citation Faithfulness
Nanyang Technological University · Viettel AI, Viettel Group · VinUniversity

Sep 14, 2026J/K move · Enter open · S save

CiteShade: Citation Laundering in Multi-Source Retrieval-Augmented Generation and Its Counterfactual Defense

Guo Fuzheng

City University of Hong Kong

RAG Poisoning Attacks RAG Security

Open paper AskPDF arXiv

Retrieval-augmented generation (RAG) grounds a language model's answers on retrieved external knowledge and returns each answer with citations that identify its sources. Those citations are the user's audit trail: they let a reader verify a claim without trusting the model. Prior security work on RAG asks whether an attacker can corrupt the answer, leaving the citation channel unexplored. We show that this channel is a new and practical attack surface. We propose CiteShade, the first citation laundering attack to RAG, in which an attacker controlling a single source induces a model to produce an attacker-chosen wrong answer and to attribute it to a trusted source that does not support it, while the evidence for the correct answer remains in context. We formulate the attack as an optimization problem, derive three necessary conditions (retrieval, generation, and citation) and construct sources satisfying them without any instruction. On multi-source multi-hop question answering the attack raises the wrong-answer rate from 0.01 to 0.68, and source deletion confirms the malicious source is the causal driver in every measured case. Vulnerability tracks a model's propensity to cite rather than its scale, reaching CLR 0.84 under explicit instruction and 0.64 with no instruction at all on the most citation-prone model tested. We then show that perplexity filtering and citation-support checking are each insufficient, and propose a counterfactual defense that verifies which source actually drove the answer.

Abstract

RAG Citation Faithfulness

Explore similar work

CiteShade: Citation Laundering in Multi-Source Retrieval-Augmented Generation and Its Counterfactual Defense

How Do LLMs Cite? A Mechanistic Interpretation of Attribution in Retrieval-Augmented Generation

Copying Is Not Grounding: Training Faithful Long-Form RAG with Authored-Sentence Credit