Detecting Hallucinations in Retrieval-Augmented Generation through Grounding-Aware Sensitivity by Perturbation (GASP)

Abstract: Retrieval-augmented generation (RAG) reduces but does not eliminate hallucination, and existing detectors return a single answer-level score that does not indicate which sentence is unsupported, or why. To close this gap, we introduce Grounding-Aware Sensitivity by Perturbation (GASP), a span-level detector that scores each answer sentence by how strongly its likelihood depends on the retrieved evidence, a quantity we term grounding sensitivity. GASP holds the answer fixed and re-scores it under the full context, under no context, and with each chunk removed, then measures the log-likelihood drops and Jensen-Shannon divergences (JSD). The likelihood of a grounded sentence collapses once its supporting passage is removed, whereas a hallucinated sentence is almost unaffected, a contrast we interpret by casting decoding as a random nonlinear iterated function system (RNIFS). We evaluate GASP on three benchmarks (RAGTruth, TofuEval, RAGBench) with three instruction-tuned scorers from two model families (Qwen2.5-0.5B, Qwen2.5-1.5B, and SmolLM2-1.7B) under a leakage-clean protocol. On RAGTruth it reaches a response-level area under the ROC curve (AUC) of about 0.73 and a span-level AUC of about 0.67, improving significantly over perplexity and by clear margins over length, whole-context natural language inference (NLI), and self-consistency baselines. The only baseline competitive at the span level is a well-configured chunk-level entailment verifier, which requires a separate model, whereas a training-free threshold on the grounding features matches the trained classifier without labeled data and serves as the default detector. Beyond RAGTruth, the signal transfers to TofuEval but not to short-answer question answering in RAGBench, showing GASP is best suited to outputs constructed from the retrieved context rather than answers recoverable from parametric knowledge.

• The paper introduces GASP, a span-level hallucination detector that uses controlled context perturbations to assess grounding sensitivity in retrieval-augmented generation.
• It achieves up to 0.74 AUC in response-level detection and 0.67–0.68 AUC at span-level on benchmarks like RAGTruth, TofuEval, and RAGBench.
• The method provides explainable outputs by attributing maximal influence to specific context chunks and is deployable as a model-agnostic, training-free detection technique.

Grounding-Aware Sensitivity by Perturbation (GASP) for Hallucination Detection in Retrieval-Augmented Generation

Motivation and Problem Statement

Retrieval-Augmented Generation (RAG) architectures leverage context retrieval to ground LLM outputs in supported evidence. While RAG mitigates hallucination, it does not eliminate it: LLMs frequently blend retrieved passages with their parametric priors, leading to unsupported (hallucinated) statements indistinguishable by surface fluency or confidence. Existing hallucination detectors largely operate at whole-answer granularity, return opaque scores, or rely on surface statistics such as perplexity, which are poorly correlated with true grounding.

The paper introduces Grounding-Aware Sensitivity by Perturbation (GASP) (2607.04223). GASP offers span-level (typically sentence-level) hallucination detection by measuring the extent to which each span's likelihood is sensitive to the removal or alteration of retrieved context. The central claim is grounding is a relational property between claims and specific context units; thus, controlled perturbations of the evidence provide a direct test, in contrast to intrinsic measures.

Methodology

GASP evaluates the grounding of each answer span using a set of context perturbations. For a given response, the method:

1. Scores the answer under full context, no context, and each context chunk removed in turn.
2. Extracts four grounding-sensitivity features per span: gap in log-likelihood (full context vs. no context), JSD between prediction distributions (full vs. no context), maximum leave-one-out log-likelihood drop (largest decrease from any chunk removal), and maximum leave-one-out JSD.
3. Aggregates features for each span and uses either a fixed threshold (training-free) or a simple classifier to assign hallucination scores.

This approach is both model-agnostic (the scoring model can differ from the generator) and lightweight, requiring only $K+2$ forward passes per answer for $K$ context chunks. Importantly, the method naturally attributes the maximal influence chunk as supporting evidence, yielding an explicit context citation with every grounding decision.

The approach is theoretically motivated by casting decoding under context as a random nonlinear iterated function system (RNIFS), where removing context chunks perturbs the invariant measure supporting grounded generations. Notably, entropy or perplexity are insufficient, since unsupported but fluent text is frequent under the prior; only direct context-dependence reveals true grounding.

Experimental Evaluation

Datasets and Protocol

GASP is evaluated on three strong RAG faithfulness/hallucination benchmarks:

• RAGTruth: Span-annotated, multi-domain dataset for summarization and data-to-text generation.
• TofuEval (MeetingBank): Meeting summarization benchmark with sentence-level consistency labels.
• RAGBench: Large-scale, multi-domain question answering, probing the limits of grounding detection in short factual answers.

Benchmarks are evaluated under a strict leakage-clean protocol: all spans from an answer are grouped in the same fold; no answer is ever split between train and test (addressing common overestimation in prior work).

Model Scorers

Detection uses three small, instruction-tuned LLMs (Qwen2.5-0.5B, Qwen2.5-1.5B, SmolLM2-1.7B). The detection model and generative model are not required to match, increasing deployment flexibility.

Baselines

Baselines encompass:

• Perplexity and Length: Intrinsic model uncertainty.
• NLI Entailment: Cross-encoder-based entailment scored both on full and chunked contexts.
• SelfCheckGPT-style self-consistency.
• Trained classifiers incorporating perplexity and length.

Main Results

GASP achieves significantly higher AUCs than perplexity, length, and self-consistency baselines at both response and span levels in summarization and data-to-text (RAGTruth, TofuEval). Detection is moderately above a well-configured chunk-level NLI entailment verifier ($\sim$0.67–0.70 AUC), but competitive. Critically, a training-free thresholded variant matches the trained classifier, eliminating any supervised data requirement.

Strong Numerical Results

• Response-level detection: Up to $0.74$ AUC (Qwen2.5-0.5B, RAGTruth), with confidence intervals always above perplexity ($<0.63$).
• Span-level detection: $0.67$–$0.68$ AUC, statistically superior to all intrinsic baselines.
• Transfer to distinct domains: Method generalizes to TofuEval, maintaining similar performance ($\sim$0.69 AUC).
• Limit of grounding detection: On short-answer RAGBench, GASP only matches perplexity ($\sim$0.60 AUC), marking the practical boundary of context-based grounding detection.

  Figure 1: Span-level AUC by feature set for the three scorers, demonstrating GASP's strong performance above perplexity, length, and chance.

  

  Figure 2: Response-level AUC by feature set, showing GASP methods uniformly dominate intrinsic baselines and chance.

Feature Analysis

All four grounding features contribute materially (ablation shows no single dominant term). No-context divergence (full context vs. no context) is particularly strong for response-level detection; leave-one-out features provide additional span-level discrimination.

Figure 3: Classifier feature importance (gain) at the span level, indicating balanced contributions from all grounding features.

Sensitivity and Interpretability

The method's default (training-free) scores are robust to chunk granularity and aggregation heuristics. GASP provides natural attribution: the context chunk whose removal most affected each span’s probability can be directly cited as supporting evidence or highlighted as missing for hallucinated content.

Detection Signal and Dynamics

Grounded spans exhibit substantially decreased likelihood and sharply diverged predictive distributions on support removal; hallucinated spans' probabilities are insensitive to any specific context chunk.

Figure 4: Distribution of grounding sensitivity, with clear separation between grounded and hallucinated sentences as measured by context-removal log-likelihood drop.

Figure 5: Per-token log-probability of grounded vs. hallucinated spans, illustrating how grounded content collapses on evidence removal, while hallucinated spans are unaffected.

Scope and Failure Cases

• Successes: GASP is robust and explainable for summarization, data-to-text, and domains requiring outputs closely constructed from retrieved context.
• Limitation: For conventional QA, where correct answers are recoverable without retrieval, grounding-sensitivity is no better than perplexity—an expected, but critical, boundary of causal contextual detection.

Theoretical Implications

The RNIFS-based stability analysis establishes that context perturbation induces controlled, measurable movement of the context-conditioned invariant measure; empirical results validate this with strong correlation between likelihood drop and hidden-state trajectory movement in LLMs.

Figure 6: Trajectory shift in middle-layer hidden states under context perturbation, highlighting the distinct paths for influential vs. control chunk removals.

Grounding detection is thus reframed as local stability analysis: unsupported claims are locally insensitive to evidence perturbations, while grounded claims’ attractors are highly context-dependent.

Practical and Future Directions

Implications

• Explainable AI: Each detection instance provides a candidate context chunk as rationale, supporting both automated and human review.
• Low-resource settings: The training-free variant is directly applicable where labeled supervision is unavailable.
• Model-agnosticism: As the method only requires a probabilistic scorer, it is deployable with distinct or black-box generators.

Prospects

• Refinements: Future research should pursue direction-aware signals (separating support removal decrease from contradiction-induced increase), adaptive chunking aligning with retriever boundaries, multi-unit removals in cases of composite support, and cross-lingual generalization.
• Tighter Theory: Quantifying contraction and spread constants for real LLMs could yield explicit bounds linking measured divergence to generative stability.
• Broader Detection: Integrating complementary black-box and white-box mechanisms (e.g., mechanistic detectors relying on model internals) may further constrain adversarial or ambiguous cases.

Conclusion

GASP demonstrates that controlled perturbations of retrieved context provide a direct, interpretable, and effective signal for hallucination detection in RAG when answers genuinely depend on retrieval. Grounding remains inherently relational, unreachable by fluency or confidence alone, and effective detection is best formulated as sensitivity to evidence, not as an intrinsic judgment over model output. The practical instantiation is competitive with supervised, entailment-based methods; it offers attribution, extensibility, deployment ease, and clear theoretical grounding.

---

For more details and implementation, see: (2607.04223).