New benchmark catches RAG models citing unsupported sources
Correct answers can still cite wrong sources. EviScope shows enterprise RAG evaluation must move beyond accuracy.
Key takeaways
- RAG systems can produce correct answers while citing unsupported or wrong sources — answer accuracy does not catch this.
- Explicit evidence-action gates, a common grounding intervention, score below 0.20 on EviScope vs. 0.50 for vanilla RAG.
- Gemini 3.5 Flash scores 0.944 overall but still answers 5% of queries after contradictory evidence is inserted.
- Financial services and multilateral institutions face direct compliance risk when citation chains are unverifiable.
- Any RAG procurement evaluation resting on answer accuracy alone is measuring the wrong variable.
Gemini 3.5 Flash scores 0.944 on EviScope's joint-success metric. It still answers 5% of queries correctly after researchers insert contradictory evidence. That gap, small in percentage terms and consequential in practice, is what a new benchmarking paper on arXiv sets out to measure.
The paper introduces EviScope, a paired counterfactual framework that holds a question fixed while systematically manipulating its evidence: adding support, removing it, inserting distractors, or introducing direct contradictions. The resulting benchmark, EviScope-v1.1, contains 40 four-condition quartets tested across 960 model generations. The point is not to ask whether a model gets the answer right. The point is to ask whether it gets the answer right for the right reasons, with the right evidence, from the right source.
This distinction is not academic. Retrieval-augmented generation has become the standard architecture for any enterprise system that needs to ground an LLM in proprietary documents, regulatory filings, or institutional knowledge. The implicit promise is traceability: the model cites a source, the user can verify it, and the chain of accountability holds. EviScope's findings suggest that promise is systematically overstated.
When accuracy is the wrong metric
The numbers from the open models are blunt. Qwen2.5-7B and Llama 3.1 8B both score below 0.20 on the paper's QCS metric (which measures whether the model correctly distinguishes sufficient from insufficient evidence conditions) when fitted with an explicit evidence-action gate, the kind of structured prompting intervention vendors routinely promote as a grounding improvement. Vanilla RAG, without the gate, scores 0.50 for Qwen and 0.375 for Llama on the same metric. The intervention designed to improve faithfulness makes it worse. A system that passes a standard accuracy evaluation may simultaneously be fabricating its evidentiary basis for the answer.
This matters structurally for the sectors where RAG is being deployed fastest. A financial services institution building an LLM layer over its research library needs citations that are independently auditable, not just answers that happen to be correct. An answer about a company's credit position that cites the wrong filing, or no filing at all, is a compliance exposure regardless of whether the number in the answer is accurate. The same logic applies to a multilateral institution using RAG to synthesise donor reports or policy briefs: citation integrity is the product, not an optional feature of it.
The Gemini result is more nuanced and in some ways more troubling. A 0.944 joint-success rate is impressive. But the 5% contradiction-case failure rate means the model continues to produce answers after researchers have inserted evidence explicitly designed to contradict the query. In a benchmark of 40 quartets, that is a small count. In a production system processing thousands of queries per week, it is a recurring error class that answer-accuracy metrics will never surface, because the answers look fine.