Research map / Large language models / Retrieval and knowledge

Deceptive Grounding: Entity Attribution Failure in Clinical Retrieval-Augmented Generation

NeurIPS 2026 · Large language models › Retrieval and knowledge · approach: RAG robustness and evaluation · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Introduces "deceptive grounding," a RAG failure where accurate evidence about drug Y is attributed to queried drug X, passing faithfulness, hallucination and citation checks; measures it across 13 models in a factorial benchmark, a production deployment, and proposes entity-attribution verification (EAV).

Problem

Clinical RAG evaluations check faithfulness, hallucination, and citations but not whether retrieved evidence is attributed to the correct entity, so responses that present drug Y's evidence as drug X's evidence pass all checks.

Approach

Defines deceptive grounding as a faithful, citation-correct response that attributes another entity's evidence to the queried entity, shows a two-stage mechanism (disease-context priming plus presence of completing information), and proposes a per-claim entity-attribution verification check implemented with an LLM judge.

Key results

• Peak DG rates span 8.0-86.7% across 13 models at absent-complete-retrieval x synthetic_Y condition; OpenBioLLM-70B reaches 86.7%.
• Removing completing information from alternate-drug documents drops entity-attribution failure from 67.0% to 0.0% while incorrect responses rise to 98.1% as confabulation.
• Production measurement finds 7.8% overall DG (58/740) and 13.6% for recently approved drugs; EAV achieves 97.0% precision and 98.7% EAF recall on a human gold standard (n=88, IPW-adjusted).

Surprising findings

• Medical and biomedical fine-tuned models show higher deceptive grounding rates than general models, with domain specialization amplifying rather than mitigating the failure.
• Models that correctly notice the entity mismatch still produce deceptive grounding at similar rates.

Limitations

• Controlled benchmark is maximally adversarial; naturalistic production rates are about 5.5x lower than benchmark rates.
• Kimi-K2.5 both generated benchmark documents and judged responses, and the judge misses entity-substitution cases (EAV outputs PASS for them by design).
• Entity-anchoring mitigation works only for parametric-prior profiles (-30.7 pp) and is near-null for others (-4.2 pp).

Experimental setup

Datasets: 264 synthetic drug-disease-alternate-drug triples 740 pre-registered drug-disease pairs from production clinical RAG

Benchmarks: Controlled 2D factorial deceptive grounding benchmark Production clinical RAG measurement (740 pairs)

Metrics: deceptive grounding rate precision recall specificity Cohen's kappa McNemar test Wilcoxon signed-rank test

Baselines: String match NER entity coverage Llama-3.1-70B-Instruct judge

Builds on: D-FActScore RAGAS FActScore

Closest papers by meaning

• Position: Retrieval-augmented systems can be dangerous medical communicators (ICML 2025 · similarity 0.87)
• ClashEval: Quantifying the tug-of-war between an LLM’s internal prior and external evidence (NeurIPS 2024 · similarity 0.85)
• Worse than Zero-shot? A Fact-Checking Dataset for Evaluating the Robustness of RAG Against Misleading Retrievals (NeurIPS 2025 · similarity 0.85)
• MedVIGIL: Evaluating Trustworthy Medical VLMs Under Broken Visual Evidence (NeurIPS 2026 · similarity 0.85)
• DoAtlas-1: A Causal Compilation Paradigm for Clinical AI (NeurIPS 2026 · similarity 0.84)
• Trust, but Don’t Verify: Epistemic Blind Spots in LLM Source Evaluation (NeurIPS 2026 · similarity 0.84)