RAG Makes Hallucinations Worse When Memories Conflict
Retrieval-augmented generation promises to ground language models in real knowledge. Pull relevant memories from an external store, inject them into the prompt, and the model should produce more accurate answers. But there is a scenario where this guarantee inverts. When the memory store contains conflicting positions, both correct and incorrect, standard RAG does not merely fail to help. It actively makes things worse.
The numbers are stark. On the TruthfulQA dataset, a model using standard RAG with conflicting memories in its store reaches a hallucination rate of 53.0%. The same model with no memory at all hits 23.0%. The gap is statistically significant (p equals 0.007). RAG does not act as a safety net in this setting. It acts as a channel through which wrong information enters the generation context and contaminates the output. The retriever answers which memory is most relevant, but never whether that memory is trustworthy.
The Missing Stage: Trust Decisions Between Retrieval and Generation
The paper by Zhang, Zhang, Zhao, Ma, and Zhao at Tianjin University of Technology identifies a structural gap in how memory systems are designed. Most existing work focuses on one of two ends: how to retrieve more effectively, or how to fix outputs after generation. GraphRAG, MemGPT, HippoRAG, and Mem0 optimize storage and retrieval. Self-RAG and Reflexion perform post-generation self-assessment. But the decision window between retrieval and generation, where you decide whether a retrieved memory should be trusted, has received little attention.
This gap matters because the two ends cannot compensate for each other. Post-generation methods like Self-RAG can detect problems, but by the time they do, the erroneous memory has already been injected into the context. The model has already been influenced. Huang et al. showed that LLMs struggle to self-correct reasoning errors without external feedback, and Zhang et al. further revealed the failure mechanism. Fixing errors after contamination is harder than preventing contamination in the first place.
The authors draw an analogy from neuroscience. In the macaque prefrontal cortex, metacognitive memory judgments are not driven by a single signal. Instead, neural populations encode complementary components, working-memory strength, trial history, and arousal level, in nearly independent functional subspaces and fuse them into a meta-working-memory signal that guides behavior and abstention decisions. The brain does not blindly trust retrieved memories. It evaluates them through multiple complementary channels before deciding whether to act on them.
The Memory Decision Layer: Three Signals, Zero Parameters
The proposed Memory Decision Layer (MDL) sits between retrieval and generation as a thin middleware layer. It takes three inputs: the query, the candidate memories, and a task-risk coefficient. From these it produces a trust decision, and it does so with zero trained parameters, relying entirely on geometric operations.
The core is a three-signal complementary encoder. Each signal captures a different aspect of memory trustworthiness. Relevance (M) is the maximum cosine similarity between the query embedding and the candidate memory embeddings, computed using all-MiniLM-L6-v2 sentence transformers. Reliability (R) is the product of the mean pairwise similarity among the relevant memories and the squared complement of the stance-conflict rate, the fraction of memory pairs flagged as positionally conflicting by a lexical detector covering negation, polarity, and antonyms. Task risk (A) is a manually assigned coefficient reflecting the consequences of error in the domain, with values like 0.85 for healthcare, law, and finance, and 0.20 for low-stakes queries.
The key design choice is risk inversion. Rather than treating high risk as a signal to act more aggressively, MDL converts high risk into low activation through s_A_inv equals 1 minus A. This means that as the stakes of a decision rise, the controller becomes more conservative, more likely to abstain. This is the opposite of how most RAG systems behave, where high-confidence retrieval is treated as a green light regardless of downstream consequences.
Orthogonal Subspace Projection: Keeping Signals Separate
The three signals are each encoded into 16-dimensional value vectors through a Gaussian kernel mapping. The value encoding for a scalar s is a combination of a constant baseline and a sum of Gaussian bumps centered at evenly spaced points across the unit interval, with a sharpness parameter sigma equals 0.20. This produces a directional representation that preserves the magnitude and location of each signal in a high-dimensional space.
The encoded vectors are then projected onto three orthogonal subspaces using QR decomposition. The dimensions are allocated as 5, 5, and 6, with the risk subspace receiving one extra dimension to carry a second-order modulation signal. The projection matrices are constructed from the QR factors of a random initialization, ensuring that the subspaces are orthogonal by construction. Each subspace gets a weight matrix that amplifies the principal component and applies a small cross-leakage term (epsilon_c equals 0.10) to maintain gradient flow without breaking orthogonality.
The fusion step combines the three weighted vectors through a tanh nonlinearity, producing the intermediate decision representation v_meta. The tanh serves two purposes: it bounds the output to a fixed range, preventing unbounded growth, and it creates a linear band where monotonicity holds and a saturation region where it does not. The theoretical analysis proves that within the linear band, the norm of v_meta increases monotonically with each signal strength, given that the cross-leakage term is smaller than the principal gain.
Decoupling Confidence from Consistency
From v_meta, two scalars are extracted in parallel. Confidence (C) is the normalized norm of v_meta, clipped to the unit interval. Consistency (alpha) is the cosine angle between the relevance pathway vector and v_meta. These two numbers capture fundamentally different information: C measures how strong the overall decision signal is, while alpha measures whether the decision is aligned with the relevance direction.
The distinction matters in practice. A memory can score high on relevance (high M) but be directionally wrong, pulling the generated answer toward a common misconception rather than the correct answer. Standard RAG conflates these two properties. MDL keeps them separate and exposes them as auditable scalars. A downstream system can inspect C and alpha independently to understand not just whether a memory was trusted, but why.
The final gated confidence combines them through C_final equals C times (0.3 plus 0.7 times alpha). The alpha weighting is higher because directional alignment is more informative than raw signal strength for the trust decision. Grid search across the (g_a, g_b) coefficients shows a broad high-accuracy ridge around g_a plus g_b approximately 0.9, and the default (0.3, 0.7) lies in the stable region of this ridge.
Four-Level Action Mapping
The gated confidence is mapped to one of four discrete actions through a dynamic threshold vector theta. Active means the memory is trusted and should be injected. Supp (supplementary) means the memory is used as background context but not directly quoted. Silent means the memory is ignored and the model generates from parametric knowledge. Opt-Out means the query is deemed too high-risk or the memory too unreliable, and the system explicitly abstains from answering.
The thresholds are calibrated on a held-out split of 80 questions per dataset, disjoint from the evaluation set. The primary threshold theta_0 is selected by grid search to maximize agreement with oracle actions on the calibration split. The normalization parameters n_min and n_max, used to scale the confidence, are likewise taken from the calibration split.
This design means MDL has no parameters to train in the traditional sense. The QR decomposition is fixed at initialization. The value encoding is a deterministic function. The only free parameters are the thresholds, which are set through a simple calibration step on a small held-out set. The entire controller adds approximately 0.14 milliseconds per decision, roughly 50 times faster than the embedding-retrieval step that precedes it and four to five orders of magnitude faster than calling an LLM for self-evaluation.
Results: Cutting Hallucination by Half, Eliminating It in High-Risk Cases
The evaluation runs on TruthfulQA and HaluEval across three LLM backends: gemma-4-E4B-it (local), deepseek-v4-flash (API), and gemini-3-flash-preview (API). The memory store for each question contains the reference correct answers, the reference incorrect answers (the conflicting positions), and two distractor records from other questions as irrelevant noise.
On gemma-4-E4B-it, standard RAG with conflicting memories produces a 53.0% hallucination rate. MDL reduces this to 23.3%, a 29.7 percentage point improvement (p equals 0.014). In high-risk scenarios (A equals 0.85, covering healthcare, law, and finance), standard RAG hits 63.0% hallucination. MDL achieves 0.0% through the risk-inversion mechanism triggering abstention. The overall risk-weighted hallucination rate drops to 17.0%, the lowest among all systems tested.
The results hold across models. On deepseek-v4-flash, standard RAG already performs relatively well (4.3% overall hallucination) because the model resists memory injection better. But even here, MDL achieves the lowest risk-weighted hallucination rate in medium- and high-risk categories (3.5% versus 5.8% for RAG and 14.2% for no memory). On both gemini-3-flash-preview and deepseek-v4-flash, MDL again achieves 0.0% hallucination in high-risk scenarios. On HaluEval, the high-risk hallucination rate stays at 1.3%, compared to 2.7% for RAG and 4.0% for no memory.
MDL also outperforms prompt-based corrective baselines. Against CRAG (which grades each memory as Correct, Incorrect, or Ambiguous) and Self-RAG (which drafts then self-critiques), MDL achieves comparable or better hallucination control with dramatically lower latency. Self-RAG requires about 2.1 LLM calls per question. MDL requires zero additional LLM calls, operating entirely through geometric operations on embedding vectors.
Why Three Signals Beat Any Subset
An information-theoretic decomposition shows that the three signals are genuinely complementary. Relevance alone cannot detect when a highly relevant memory is factually wrong. Reliability alone cannot distinguish between a memory that is consistent but irrelevant and one that is consistent and relevant. Risk alone provides no information about the specific memory content. The synergy among all three signals, measured through mutual information decomposition, exceeds what any pair provides.
The relevance signal (M) provides irreplaceable safety-abstention value in the low-relevance regime. When relevance is low, the controller abstains even if reliability and risk are moderate, because a memory that is not relevant to the query should not be injected regardless of its internal consistency. This is a behavior that learned classifiers like logistic regression, MLPs, and XGBoost struggle to replicate, because they are trained on aggregate performance and may learn to accept low-relevance memories when other signals are strong.
The ablation study confirms the contribution of each mechanism. Removing value encoding costs 1.2 percentage points in hallucination reduction. Removing risk inversion costs 1.7 percentage points. Removing the C-alpha decoupling and using only the norm costs the most, because it collapses directional information into a single magnitude. The alpha-consistency signal separates correct from incorrect decisions even when C and alpha are positively correlated (r equals 0.902), with a t-test showing alpha carries directional information that C does not (t equals 3.70, p less than 0.001).
Latency and Deployment: Practical Constraints
The controller is designed for real-time deployment. The core decision latency is 0.041 microseconds, or about 0.14 milliseconds including lexical signal aggregation overhead. This is 50 times faster than the embedding-retrieval step. For comparison, a single LLM self-evaluation call takes on the order of hundreds of milliseconds. MDL adds negligible overhead to the RAG pipeline.
The zero-parameter design means there is no model to train, no gradients to compute, no GPU required for the decision step itself. The QR decomposition can be precomputed once and reused. The value encoding is a fixed function. The only calibration is a grid search over thresholds on a small held-out set. This makes MDL deployable as a drop-in middleware layer in any existing RAG system without modifying the retrieval or generation components.
Limitations and Open Questions
The paper acknowledges several limitations. The task-risk coefficient A is assigned manually, either through a category-to-risk mapping or keyword matching. In production, this would need to be automated, potentially through a learned risk classifier or a user-specified risk policy. The evaluation uses synthetic conflicting memories constructed from dataset reference answers, which may not fully represent the distribution of real-world memory conflicts.
The C-alpha decoupling is defined as independently auditable, not statistically independent. On the benchmarks, the two are correlated at r equals 0.902. The paper argues this does not undermine the utility, because alpha still separates correct from incorrect decisions with statistical significance, but a stronger form of independence would be more desirable theoretically.
The controller operates on a single retrieval result. It does not handle cases where multiple retrieved memories must be jointly evaluated, where the conflict is between memories rather than between a memory and ground truth. Extending MDL to multi-memory conflict resolution would require a different signal design.
The evaluation is limited to question-answering tasks. The paper does not test MDL on open-ended generation, summarization, or multi-turn dialogue, where the interaction between memory trust and generation quality may differ. The abstention mechanism, which is the primary safety lever, may be less acceptable in applications where the user expects an answer regardless of memory quality.
What This Means for RAG Practitioners
The practical implication is straightforward: if your RAG system serves queries where the memory store might contain conflicting information, and especially if the stakes of getting it wrong are high, you should not trust retrieval scores alone. MDL provides a cheap, interpretable, zero-training layer that catches the most dangerous cases, where high relevance masks low reliability or high risk. The 56% reduction in hallucination under conflicting memories and the elimination of hallucination in high-risk scenarios represent a meaningful improvement in safety without meaningful cost in latency.
The framework also offers a template for thinking about memory trust as a multi-signal problem. Relevance is necessary but not sufficient. Reliability and risk are complementary signals that should be evaluated separately. The geometric approach to combining them, through orthogonal subspace projection, provides a white-box alternative to learned trust classifiers that is faster to deploy and easier to audit.