Retrieval-augmented models are usually asked to cite only the documents they were handed. When retrieval falls short, they either refuse or quietly fill the gap from memory, and the reader cannot tell which. We asked models to cite both kinds of knowledge out loud: a quoted span when the fact came from a document, a recited passage with a confidence score when it came from the model's own parameters.
Citation generation is one of the simplest ways to make a language model checkable. The model answers a question, attaches a marker like [1] to each sentence, and the reader can follow the marker back to the passage that supports it. Most benchmarks in this area, starting with ALCE[1], treat the retrieved documents as the only legitimate source. A sentence that cannot be traced to a document is a failure, and if the documents do not contain the answer the model is expected to refuse.
That rule makes sense when retrieval is good. It stops making sense when the retriever misses, which happens often for questions with several constraints. Take the example in the header. The question asks for the album containing two songs, and the retrieved documents only cover one of them. A model that has seen the other fact during pre-training has two options under the usual rules: refuse, or answer correctly and leave the second half of its answer uncited. The first throws away knowledge the model has. The second hides where the answer came from, which is the thing citations were supposed to fix.
There is a second, quieter problem. Even when a citation is faithful, it can be a poor reference for a human. A one-line span may support the claim and still read as doubtful because it has no context. A long passage may be convincing and still waste the reader's time with background they did not need. Neither of these shows up in citation recall.
If the model is going to use what it knows, it should cite that too, and say how sure it is.
So we defined a task where the model may cite its own memory, but has to do it in the open: as a separate reference, written out, with a confidence score that can be checked against the facts later.
We call it Context-Prior Augmented Citation Generation. The input is a question and a handful of retrieved documents. The output is an answer split into sentences, where each sentence points to one reference. A reference is one of two things:
A refusal is the right answer only when the documents do not contain the answer and the model does not know it either. That gives four scenarios, depending on whether a ground-truth document was retrieved (GT) and whether the model has the relevant knowledge in its parameters (PK).
We score each answer on three things: is it helpful, is it faithful to what it cites, and are the references trustworthy to a person reading them. Five metrics cover these.
| metric | question it answers | how it is computed |
|---|---|---|
| Accuracy | Is the answer right? | An NLI model checks whether the answer entails the gold answer. This is more forgiving of phrasing than exact string match and, in our human check, made fewer mistakes (section 8). |
| Citation recall R, Rext, Rint | Does each sentence follow from what it cites? | The same NLI model checks whether the cited reference entails the sentence, as in ALCE[1]. We report it overall and separately for external and internal citations. Uncited sentences count against the overall score R but not against Rext or Rint. |
| Convincingness | Would a reader trust this reference? | An LLM judge scores 1 to 5 on tone, objectivity, coherence, disambiguation and amount of evidence. Named entities are masked first, so the judge cannot lean on its own knowledge of the facts. |
| Conciseness | How much work is it to verify? | An LLM judge reads the reference sentence by sentence and scores 1 to 5 on how much useful information it gives with how little distraction. |
| ECE internal references only | Does the confidence mean anything? | Expected calibration error between the stated confidence and actual correctness. A reference counts as correct only if every atomic fact in it checks out under FActScore[2]. Lower is better. |
Convincingness and conciseness pull against each other, which is why we measure both. The paper illustrates this with a question about the sitcom character Ross Geller.
Short references tend to be easy to verify and easy to doubt. Long references tend to be convincing and slow to verify. A model that wants high scores on both has to keep the background that makes a claim credible and drop the rest. Appendix C of the paper also argues that the metric set resists the obvious shortcuts: citing every document inflates recall but hurts conciseness, citing a minimal span hurts convincingness, and citing only one kind of source hurts accuracy on the scenarios that need the other.
We combined three recent retrieval benchmarks that ask real factual questions answerable from Wikipedia: CRAG[3], FRAMES[4] and SituatedFaithfulnessEval[5]. From CRAG we kept only static questions, so that the documents and the model's memory would not disagree because the world changed. From FRAMES we kept questions that need exactly two Wikipedia articles. From SituatedFaithfulnessEval we took the factual questions of the ClashEval subset[6], which were designed to set a model's prior against the evidence in front of it.
For each question, a GTR retriever[7] pulled the top 100 passages from a chunked Wikipedia snapshot, and an NLI model (TRUE[8]) marked which passages contain the answer. Each question then became two data points, each with exactly five documents: one with a random number of ground-truth passages, and one with none. That is how the GT and ¬GT splits come about. The PK split is different for every model, because it depends on what that model knows; the next section explains how we measured it.
RAEL (Rational Attribution and Elaboration) is the output format we ask for. Before writing any reference, the model does two short pieces of reasoning in the open:
Only then does it write the references, quoting spans from the useful documents and reciting the facts it is relying on, and finally the answer with citation markers. The example below is the one the paper uses to explain the pipeline.
Writing the review and the scrutiny down has two effects. It pushes the model to decide which source each part of the answer comes from before it commits to a sentence, which is what makes the citations faithful. And it gives a reader a short account of why the model trusted one document over another, or its own memory over the documents.
Prompting a model with RAEL examples helps, but open models follow the format unevenly, so we also fine-tune them. The difficulty is that good training data for this task depends on the model being trained. An internal reference is only appropriate if the model really knows the fact, and its confidence is only calibrated if it matches how reliably the model knows it. Data written for one model would teach another to recite things it does not know.
INTRALIGN (Interpretable Trustworthiness Alignment) therefore starts by probing the target model.
In a typical RAEL response, most tokens belong to the review, the scrutiny and the answer. The parts we care most about are small: a reference is a sentence or two, a citation marker is three characters, a confidence score is one number. Under an ordinary fine-tuning loss these get almost no attention.
We parse every training target into five token types (review and scrutiny, reference, answer, confidence, citation marker) and give each type a weight. The weights of review, scrutiny and answer are fixed, and the reference is weighted more heavily; the paper gives the exact constraints. Toggle below to see the difference on the Treaty example.
Fine-tuning itself is ordinary: LoRA[10] for two epochs on about 1,000 training examples per model, with a 500-question test set.
We compared INTRALIGN with six baselines on Llama-3.1-8B-Instruct and Llama-3.1-70B-Instruct, and ran the prompt-only methods on GPT-4o, o1-mini and DeepSeek-R1 as well.
\footnote[confidence]{reference} after each sentence. PostCite writes the answer first, then cites the best-matching document for each sentence, or generates an internal reference if no document matches well enough. Guided-RAEL is our format with two worked examples in the prompt and no training.Front and ContextCite are strong when a ground-truth document is present, because that is the situation they were designed for. Remove it and they lose most of what they had. On Llama-3.1-8B, Front's accuracy drops from 72.1 to 48.6 and its overall recall from 48.0 to 31.6; ContextCite's recall halves, from 25.1 to 12.5. Neither has anywhere else to look.
Recite shows the mirror image. It does well when the model knows the answer and collapses when it does not: on the GT, ¬PK set, where a document with the answer is sitting in the context, its accuracy is 1.0 on the 8B model and 2.0 on the 70B model, because it never reads the context.
In most settings, methods that can cite both have higher internal recall than external recall. When a model writes its own reference, it writes something its answer follows from; when it has to point at a span in someone else's text, it misses more often. FootNote is the exception, because its inline footnote format is hard for models to fill in correctly when the content comes from memory.
INTRALIGN gives the best accuracy for both Llama models in all three scenarios, and the best overall recall in four of the six settings. The two exceptions are telling. On the 8B model with a ground-truth document and no prior knowledge, Front cites documents slightly more faithfully (56.3 against 51.8). On the 70B model in the same scenario, Recite has higher recall (78.7 against 60.3), but its answers are almost never right.
The aligned models also keep the share of uncited sentences low. Their overall recall R stays close to their external and internal recall. FootNote, by contrast, scores only 16.0 overall on the 8B model against 51.2 and 44.4 for the two citation types, because many of its sentences cite nothing. Internal recall for the aligned 70B model stays between 82.1 and 89.8. Conciseness is 3.8 or higher in every setting and above 4.4 for the 70B model, and ECE is the lowest among the Llama methods in five of six settings.
The aligned 8B model's accuracy stays in the 60s both on GT, ¬PK (69.1) and on ¬GT, PK (62.2), two sets that need opposite sources. That is the behaviour the task asks for: lean on the documents when they have the answer, and on memory when they do not.
DeepSeek-R1 has the highest accuracy in the table, 90.6 on GT, PK, and its reasoning trace already talks about which documents and which memories it is using. Its citations are not better for it. On the same set its overall recall is 51.3, against 78.8 for the aligned 70B model, and its internal recall is around 50. The reasoning also costs tokens: in the paper's measurement R1 produced about five times as many tokens as our model.
Our documents are Wikipedia passages, which already read like good references. To see what happens with weaker sources, we had GPT-4o rewrite each document in the style of a Reddit post while keeping its content, and ran the aligned Llama-3.1-8B on the new set.
The facts are the same, but the model's behaviour is not. Recall falls from 50.4% to 28.8%, uncited sentences double, and the refusal rate rises from 0.6% to 12.8% even though the answer is still in the documents. Convincingness of the cited references drops the most, from 68.0% to 20.2%, which is expected: a reference copied from a Reddit-style post sounds like one. How a source is written matters for citation, separately from what it says.
Conflicts between retrieved evidence and a model's prior are well studied in RAG[6][14]. The same pull shows up in citation. We split the data two ways and looked at which source the model chose to cite:
The paper's reading is that a model should prefer the documents for straightforward questions and when its knowledge is limited, and draw on memory more for complex questions where the documents are hard to use.
One behaviour surprised us. When a retrieved document is not convincing enough, the model sometimes rewrites it in better prose and presents the result as its own knowledge, with a confidence score. We did not penalize this in the metrics, since a well-written reference is more useful to the reader, but it is a form of dishonesty about where a fact came from.
We measured it on the GT, ¬PK set, where any internal reference that entails the answer must have come from the documents, because the model does not know the answer itself. The plagiarism rate (PR) is the share of internal references that do this; plagiarism severity (PS) is the average confidence the model falsely attached to them.
| 8B · PR ↓ | 8B · PS ↓ | 70B · PR ↓ | 70B · PS ↓ | |
|---|---|---|---|---|
| PostCite | 0.154 | 0.124 | 0.128 | 0.101 |
| Guided-RAEL | 0.143 | 0.119 | 0.111 | 0.92* |
| INTRALIGN | 0.054 | 0.049 | 0.105 | 0.076 |
table note* Printed as 0.92 in Table 2 of the paper. Every other severity in the table is below its plagiarism rate, so this is most likely 0.092.
Alignment cuts plagiarism on the 8B model by about two thirds. The 70B model plagiarizes more than the 8B model under alignment, which may mean the larger model has learned the preference for convincing, concise references more thoroughly, and is more willing to rewrite a weak document into one.
Both pieces help recall, and the full method is best in all six settings. Accuracy, convincingness and conciseness move much less, which fits the design: the RAEL steps and the loss weights are both aimed at citations. Training without weights occasionally matches or beats the full method on a single metric, mostly accuracy on the GT, ¬PK set, where the model has no knowledge of its own. The paper reads this as a sign that the weighting matters most for the quality of internal citations.
Three volunteers with fluent English, each given 100 examples after a short qualification test, checked the automatic metrics on a small web interface.
The automatic judges agree with a person nearly as well as two people agree with each other. That is good enough to compare methods, though not to grade a single answer.
On the fourth scenario, where neither the documents nor the model have the answer, refusing is the correct output. The aligned models refuse about 29% of the time (28.8% for 8B, 28.2% for 70B), more than any baseline; the next best is ContextCite at 24.7% and 22.0%. Since fewer than 5% of these questions can actually be answered correctly, a perfect system would refuse almost always. Every method here, ours included, still answers most questions it should decline.
It shows that citing a model's own knowledge can be made explicit and measurable, and that a model can be trained to do it without giving up faithfulness to the documents. It shows that the usual citation methods depend heavily on retrieval succeeding, and that general reasoning ability does not substitute for training on citations.
It does not settle several things.
The paper also notes an ethical point: asking a model to recite its knowledge can surface copyrighted training text. In our setup a recited passage stays under 200 words, and only the cited span, under 50 words, is analysed.
This post is a rewrite of the paper for a general reader. The text and figures are new; the examples and numbers come from the paper, which the ACL Anthology publishes under a Creative Commons Attribution 4.0 license. Please cite the paper, not this page.
@inproceedings{shen-etal-2025-transparentize,
title = "Transparentize the Internal and External Knowledge
Utilization in {LLM}s with Trustworthy Citation",
author = "Shen, Jiajun and Zhou, Tong and Chen, Yubo and Qiu, Delai
and Liu, Shengping and Liu, Kang and Zhao, Jun",
booktitle = "Findings of the Association for Computational Linguistics: ACL 2025",
year = "2025",
address = "Vienna, Austria",
publisher = "Association for Computational Linguistics",
pages = "17858--17877",
doi = "10.18653/v1/2025.findings-acl.919",
url = "https://aclanthology.org/2025.findings-acl.919/"
}