Authentic Sources, Potentially Unsafe Conclusions: Evidence Traceability Does Not Ensure Clinical Reliability in Retrieval-Augmented Generation for Perioperative IBD

Abstract

Purpose

Retrieval-augmented generation (RAG) is increasingly used to reduce hallucination in medical large language models (LLMs), but authentic retrieval does not necessarily ensure clinically correct output. We evaluated whether full-text-enriched RAG improves the clinical reliability of locally deployed models for perioperative inflammatory bowel disease (IBD) question answering.

Methods

We constructed a locally deployed full-text IBD perioperative knowledge base and a 50-question high-difficulty benchmark. Two 8B models (Qwen3-VL-8B and DeepSeek-R1-Distill-Llama-8B) were evaluated under matched no-retrieval and RAG conditions. Three physicians independently scored clinical accuracy, patient safety, and faithfulness under a source-blinded, format-homogeneous protocol. Evidence traceability was assessed objectively by verifying all retrieved PubMed identifiers (PMIDs) against PubMed.

Results

All retrieved PMIDs existed in PubMed (236 verifications; 187 unique), confirming source-existence authenticity at the retrieval layer. RAG significantly improved Qwen3 accuracy (Δ=+0.44, P<0.001) but not DeepSeek accuracy (Δ=+0.21, P=0.09), and the model-by-retrieval interaction for accuracy was not significant. Patient safety showed no reliable benefit. Faithfulness decreased significantly with RAG on Qwen3 (Δ=−0.24, P<0.001), with a significant model-by-retrieval interaction. Inter-rater reliability was excellent (ICC 0.86–0.93).

Conclusion

PubMed-based retrieval achieved source-existence authenticity but did not consistently improve clinical correctness or safety. Authentic references could accompany incorrect or unsafe conclusions, indicating that evidence traceability and clinical reliability should be evaluated separately. Additional model-external safety mechanisms may be warranted in high-risk settings but require independent validation.

Introduction

Large language models (LLMs) have advanced rapidly in medicine. They encode substantial clinical knowledge and perform well on medical question answering and documentation tasks.^1–3 Early applications span drafting clinic letters and discharge summaries and generating patient-facing advice.^4–6 This progress comes with well-documented fragilities. LLMs are prone to hallucination, a term referring to the generation of fluent and plausible-sounding information that is unsupported, fabricated, or factually incorrect^7,8 and foundation models trained on electronic health records inherit unstable, hard-to-audit behaviors.⁸ In high-stakes clinical contexts, such errors are not benign stylistic lapses; they are potential sources of direct patient harm.

Retrieval-augmented generation (RAG) is an approach in which relevant external documents are retrieved in response to a user query and supplied to the language model as additional context before the answer is generated. By allowing the model to draw on retrieved evidence rather than relying solely on information encoded during training, RAG is widely promoted as a strategy for reducing hallucination and is increasingly applied to medical question answering.⁹ Yet the evidence base for medical RAG suffers from two recurring evaluation weaknesses. First, many studies rely on automated lexical metrics, or on expert ratings collected without rigorous blinding and without controlling answer format. When retrieval-augmented answers visibly carry citations while baselines do not, raters may reward the appearance of evidence rather than its substance. This formatting bias inflates apparent gains. Second, and more fundamentally, evaluations rarely separate two qualitatively different failure modes: whether the model fabricates non-existent references (source hallucination), and whether it reaches an incorrect clinical conclusion (content hallucination). The two are routinely collapsed under the single banner of “reducing hallucination”. This obscures a real possibility: a system may cite genuine literature and still be clinically wrong.¹⁰ In medical RAG evaluation, these dimensions should be considered separately. Citation existence refers to whether a retrieved source is real and verifiable; citation relevance refers to whether that source is pertinent to the clinical question; evidentiary support refers to whether the source directly supports the generated claim; and clinical correctness refers to whether the resulting recommendation is medically accurate and appropriate in context. A system may therefore retrieve authentic literature while still producing unsupported or clinically incorrect conclusions.

Perioperative management of inflammatory bowel disease (IBD) is a rigorous clinical testbed for these artificial intelligence (AI) vulnerabilities. It demands precise pharmacokinetic titration, rapid recognition of absolute contraindications, and management of complex drug–drug interactions. In such scenarios, a single hallucinated dosing parameter can precipitate fatal outcomes.^11–14 Evaluating RAG in this strict clinical environment benchmarks system safety in ways that general medical trivia cannot. At the same time, data-privacy and regulatory constraints often prevent clinical queries from being sent to external commercial LLM services, and institutions must instead deploy smaller, locally hosted models on-premises. This creates a practically important but understudied regime. The models that compliance permits are also those whose limited clinical reasoning most needs external support. This is exactly the setting in which RAG is expected to help, and in which its failure carries the greatest risk.

In this study, we developed a locally deployed, full-text RAG system for perioperative IBD question answering based on a two-layer knowledge base with parent–child indexing and two-stage retrieval with reranking. We further implemented an evaluation framework that treats source reliability and clinical content quality as distinct dimensions. Citation existence was verified objectively against PubMed, whereas clinical accuracy, patient safety, and faithfulness were assessed under a format-homogeneous, source-blinded expert-scoring protocol. Using two heterogeneous 8B open models, we aimed to determine whether retrieval augmentation improved these clinical-quality dimensions, whether authentic retrieval consistently translated into clinically correct and safe answers, and whether retrieval effects differed across model configurations.

Methods

Study Design

This retrospective, controlled evaluation comprised three parts: construction of a locally deployed full-text IBD-RAG system; an evaluation framework separating source from content reliability via format-homogeneous source-blinded expert scoring and objective traceability verification; and, on two heterogeneous open models (Qwen3-VL-8B, DeepSeek-R1-Distill-Llama-8B), a comparison of a no-retrieval baseline against a RAG-augmented condition to examine cross-model consistency. All models were deployed and run locally on a MacBook Air (Apple M3, 16 GB unified memory) using LM Studio through its local OpenAI-compatible API endpoint, with a fixed sampling temperature of 0.1. We used 4-bit quantized GGUF builds: DeepSeek-R1-Distill-Llama-8B (Q4_K_M, lmstudio-community build) and Qwen3-VL-8B (4-bit, official Qwen build). On-premises deployment on consumer hardware was used to preserve data privacy and to reflect the resource-constrained, locally hosted setting that compliance often mandates.^15,16

Knowledge Base Construction

Search Strategy

On 26 March 2026 we executed a three-track PubMed search combining MeSH terms and free-text terms to cover the three clinical subdomains of the benchmark. All tracks were disease-anchored on IBD MeSH terms (“Inflammatory Bowel Diseases”, “Crohn Disease”, “Colitis, Ulcerative”) plus “IBD”[Title/Abstract], intersected respectively with: perioperative/anesthesia MeSH terms plus Enhanced Recovery After Surgery (ERAS) free-text; pain-related MeSH terms plus visceral-hypersensitivity and brain–gut-axis free-text; and analgesia MeSH terms plus major perioperative analgesic drug names. Track results were merged and de-duplicated by PMID, yielding 14,637 candidate records (fullqueries in Additional file 1: Supplementary Text 1).¹⁷ By design, every record was anchored on IBD MeSH terms; the corpus therefore deliberately excludes literature not indexed to IBD, including stand-alone regional-anesthesia anticoagulation guidelines (eg, ASRA/ESRA neuraxial guidance). This scoping reflects the intended use case—a disease-specific IBD perioperative assistant—but means that questions whose correct answer resides primarily in cross-domain anesthesiology sources are, by construction, not fully covered by the knowledge base. Accordingly, an incorrect response to a cross-domain question could reflect at least three distinct mechanisms: absence of the required authoritative source from the bounded corpus, retrieval of available but clinically mismatched evidence, or inappropriate model interpretation of the retrieved evidence. These mechanisms were considered separately when interpreting individual failure cases.

Inclusion and Stratification

Records with abstracts (n=12,068) were retained. A local Qwen3 model then performed automated relevance pre-screening (rubric in Additional file 1: Supplementary Text 1); records scoring >2 (n=5009) were included. We position this automated step as recall-oriented engineering pre-processing rather than a validated classifier; its agreement with expert judgment was moderate, and potential screening noise is addressed in Limitations. Among retained records, full text was successfully obtained and parsed via mapping PMIDs to their corresponding PubMed Central (PMC) linkage for 1020 records (depth-core layer); the remaining 3989 were kept as abstracts (breadth-support layer). The pipeline is shown in Figure 1.

Figure 1.

Construction pipeline of the locally deployed full-text IBD perioperative knowledge base. A three-track PubMed search (n=14,637) was filtered for abstract availability, then relevance-screened by a local Qwen3 model (score >2, n=5009); full text was retrieved for 1020 records (depth-core layer) while 3989 abstract-level records were retained as the breadth-support layer.

Two-Layer Structure and Parent–Child Indexing

The knowledge base was persisted in a local vector store (ChromaDB, cosine similarity). To avoid context fragmentation, parent documents were split into 400-character child chunks with 100-character overlap for precise retrieval, while the full parent text was stored in metadata for reassembly at retrieval time. The architecture is shown in Figure 2.

Figure 2.

Two-layer knowledge base with parent–child indexing and the two-stage retrieval architecture. Phase 1 illustrates offline knowledge construction, including multi-track literature acquisition, hybrid full-text/abstract processing, semantic embedding, and hierarchical storage in ChromaDB. Phase 2 illustrates online inference, including keyword-enhanced coarse retrieval of the top 15 child chunks, cross-encoder reranking to the top five evidence chunks, parent-document reassembly, and generation using the locally deployed language models.

Retrieval

Retrieval used a two-stage architecture. Stage I (coarse retrieval) embedded the query with paraphrase-multilingual-MiniLM-L12-v2 and retrieved the top 15 child chunks; a regex module up-weighted clinical entities (doses, age, core drugs) at the retrieval stage only, leaving the symmetry of the two arms’ generation conditions intact. Stage II (neural reranking) rescored query–candidate pairs with a BAAI/bge-reranker-base cross-encoder and selected the top 5 evidence chunks. Parent full text was reassembled from metadata, with per-document and total-context length caps to prevent context-window overflow on locally served models. Retrieved PMIDs were collected separately for objective traceability verification and were not written into the context supplied to the generator.^18–20 Additional implementation details of the retrieval pipeline are provided in Additional file 1: Supplementary Text 2.

Benchmark

Fifty high-difficulty clinical questions were reverse-engineered from authoritative guidelines (European Crohn’s and Colitis Organization (ECCO), American Society of Colon and Rectal Surgeons (ASCRS), and others), spanning IBD perioperative pain mechanisms, anesthetic management, analgesic regimens, high-risk dosing, drug interactions, and special complications. Questions emphasized precise numerical values (doses, titration, correction rates) and contraindication judgments. The full item set is provided in Additional file 1: Supplementary Text 5. The benchmark size was selected pragmatically to balance coverage of the predefined high-risk clinical domains with the workload required for blinded expert evaluation. Each of the 50 questions was evaluated under two retrieval conditions across two models, generating 200 model-condition answers; with three independent physician raters, this corresponded to 600 physician-level evaluations. The benchmark was therefore intended as a focused comparative stress test rather than an exhaustive representation of all perioperative IBD scenarios.

Conditions and Generation

For each question we generated two answers: a baseline (no-retrieval) answer and a RAG answer grounded in retrieved evidence. To ensure that differences were attributable solely to retrieval, the arms were held identical in sampling temperature (0.1), system-prompt skeleton, and output-format requirements; the only difference was the presence of retrieved context. The prompt required rigorous clinical answering, explicit declaration of insufficient evidence rather than fabrication, and prohibited any PMID, citation index, or reference list in the answer body; a safety-net regex further stripped residual markers, ensuring format homogeneity. The comparison was repeated independently on Qwen3-VL-8B and DeepSeek-8B to examine cross-model consistency.²¹ The prompt was finalized through iterative refinement prior to the formal experiment and then held fixed; iteration aimed solely at enforcing format homogeneity between the two arms to preserve scorer blinding, not at improving the performance of either arm. Both arms used an identical system-prompt skeleton, and the complete prompt template is provided in Additional file 1: Supplementary Text 3.

Dimensions and Blinding

Answers were assessed on four dimensions (clinical accuracy, patient safety, faithfulness, and evidence traceability; 1–5 each). The first three dimensions were scored independently by three blinded physicians from gastroenterology, anesthesiology, and pain medicine, each with 5–10 years of clinical experience. Scoring followed a prespecified written rubric with anchored 1–5 descriptors tailored to the perioperative IBD setting. Clinical accuracy reflected the medical correctness, appropriateness, and guideline concordance of the response to the specific clinical question. Patient safety reflected the potential for the response to cause clinically meaningful harm, including contraindicated treatment or unsafe dosing. Faithfulness reflected the absence of unsupported, fabricated, or clinically implausible statements.

For example, a safety score of 1 denoted recommendation of an absolute contraindication, whereas a faithfulness score of 2 denoted plausible but fabricated mechanisms or interactions. All three physicians applied the same rubric independently. The full rubric is provided in Additional file 1: Supplementary Text 6. These judgments were informed by the clinical guidelines from which the benchmark questions were derived and by the raters’ specialist expertise; however, we did not pre-author a single fixed gold-standard answer for each item. Scores were aggregated as the arithmetic mean of the three raters, with no consensus adjudication; agreement was instead quantified using the intraclass correlation coefficient.

Blinding was secured by three measures: format-homogeneous answers free of system-identifying citation markers; independent per-question randomization of the two arms to display positions A/B, with true identity held only in a researcher key; and withholding from scorers the fact that one answer came from a retrieval system. Evidence traceability was not scored subjectively (see 2.7), because PMIDs had been stripped to preserve blinding and because objective verification avoids the formatting bias whereby citation-bearing answers appear more credible. Because raters were source-blinded and answers were citation-free, faithfulness was operationalized as the absence of unsupported, fabricated, or clinically implausible statements based on the prespecified scoring rubric and guideline-informed expert judgment, rather than as passage-level grounding fidelity to the specific retrieved documents.

Objective Traceability Verification

Traceability was measured by verifying the existence of every unique PMID retrieved by the RAG arm via the PubMed E-utilities (esummary) endpoint, and mapping each question’s existence rate r to a 1–5 score by a pre-specified deterministic rule (r ≥ 0.95 scores 5; 0.80 ≤ r < 0.95 scores 4; 0.60 ≤ r < 0.80 scores 3; 0.30 ≤ r < 0.60 scores 2; r < 0.30 scores 1). Across the 50 questions, the RAG arm retrieved five evidence chunks each, yielding 236 question-level PMID instances after removing within-question duplicates (a single article could be retrieved for multiple questions; 187 unique PMIDs overall); the existence of each was verified against PubMed. The baseline arm, which performs no retrieval, was fixed at the lowest level by definition. We emphasize that existence verification confirms source existence only, not whether the retrieved literature is relevant to or substantively supports the clinical claim; the potential divergence between the two is the central theme of this study. Further details of the objective PMID verification procedure are provided in Additional file 1: Supplementary Text 4.

Separation of Generative Evaluation from Deployment Safety Rules

While our core evaluation focuses on the generative capabilities and intrinsic risks of the RAG system, real-world high-risk environments require hard constraints. Therefore, the target deployment architecture integrates a model-external deterministic safety layer: rule-based warnings or restrictions for high-risk or generally discouraged drugs, such as Nonsteroidal Anti-inflammatory Drugs (NSAIDs) in active or high-risk IBD contexts, and mandatory injection of stress-dose warnings for perioperative corticosteroid withdrawal. However, to avoid circular reasoning and isolate the model’s performance, this layer was deliberately disabled during evaluation. We evaluated the generative capability of the underlying RAG and model, not the rule layer’s interception.

Statistical Analysis

Each dimension and the four-dimension total were compared between baseline and RAG conditions using Wilcoxon signed-rank tests, with the clinical question treated as the pairing unit and the three-expert mean used as the question-level score. The clinical question was chosen as the pairing unit because the same underlying clinical scenario was evaluated under both baseline and RAG conditions, thereby providing a matched within-question comparison while minimizing between-question heterogeneity. Analyses were performed separately for each model, and two-sided P<0.05 was considered statistically significant. To directly assess whether the effect of retrieval augmentation differed between models, we additionally performed a model-by-retrieval interaction analysis at the question level. For each question and each clinical-content dimension, the RAG effect was calculated separately for Qwen3 and DeepSeek as the within-question difference between the RAG and baseline scores. The interaction contrast was then defined as the difference between these two model-specific RAG effects (Qwen3 ΔRAG−baseline minus DeepSeek ΔRAG−baseline) and was tested across the 50 paired questions using the Wilcoxon signed-rank test. Interaction analyses were performed for clinical accuracy, patient safety, and faithfulness. Evidence traceability was excluded because its between-condition difference was structurally determined by the study design. P values for the three interaction tests were adjusted using the Holm procedure.

Inter-rater reliability was assessed with the intraclass correlation coefficient ICC (2,1) (two-way random, absolute agreement): for the three subjective dimensions, 0.86, 0.89, and 0.93 on DeepSeek, and 0.88, 0.90, and 0.90 on Qwen3, all indicating excellent agreement.^22,23 For the six within-model content-dimension comparisons (three dimensions × two models), P values were adjusted using the Holm procedure; traceability was excluded because it was definitional and not significance-tested. Separately, the three model-by-retrieval interaction tests were Holm-adjusted as a distinct family of hypotheses. Effect sizes for the within-model paired comparisons are reported as matched-pairs rank-biserial correlations (rb). The Benjamini–Hochberg procedure yielded the same pattern of significance for the within-model comparisons.

This study is reported in accordance with the TRIPOD-LLM reporting guideline for studies evaluating large language models in healthcare.²⁴

Results

Inter-Rater Reliability

The three physicians showed excellent agreement on the subjective dimensions (ICC 0.86–0.93), indicating that judgments converged strongly across specialties. This high downstream human–human agreement indicates consistent physician scoring despite the moderate machine–human agreement observed during upstream automated pre-screening. Potential effects of pre-screening noise on corpus composition are considered separately in the Limitations (Table 1).

Table 1.

Inter-Rater Reliability (ICC(2,1), Two-Way Random, Absolute Agreement, 3 Raters, N=50 Questions) for the Three Subjective Dimensions

Dimension	DeepSeek	Qwen3
Clinical accuracy	0.86	0.88
Patient safety	0.89	0.90
Faithfulness (no hallucination)	0.93	0.90

Traceability: Source-Existence Authenticity

All PMIDs retrieved by the RAG arm existed in PubMed (236 question-level instances, 187 unique; 100% existence rate, zero fabricated references). This gap is structural rather than statistical—it follows directly from the scoring definition (RAG necessarily supplies retrieved references; the non-retrieving baseline necessarily lacks them) and is therefore not subjected to significance testing. This establishes source-existence authenticity at the retrieval layer: the retrieval module returned exclusively authentic, PubMed-indexed records. It does not, however, establish that the generated answers are correctly grounded—a distinction examined in the following sections.

Clinical Content: Unstable and Direction-Reversing Effects of Retrieval

In contrast to the clear traceability advantage, RAG produced no stable, consistent improvement across the three content-quality dimensions (Table 2 and Figure 3). For clinical accuracy, RAG significantly improved scores on Qwen3 (3.64 vs 3.20, Δ=+0.44, P<0.001; Holm-adjusted P=0.003, rb=+0.61) but not on DeepSeek (2.85 vs 2.64, Δ=+0.21, P=0.09; Holm-adjusted P=0.27). However, the direct model-by-retrieval interaction for clinical accuracy was not statistically significant (interaction Δ=+0.23, P=0.117; Holm-adjusted P=0.117), indicating that the difference in accuracy gains between models was not formally established.

Table 2.

RAG versus Baseline Across the Four Evaluation Dimensions (Three-Expert Means, N=50 per Model)

Dimension	Model	RAG	Baseline	Δ	P (raw)	P (Holm)	rb
Clinical accuracy	DeepSeek	2.85	2.64	+0.21	0.09	0.27	+0.36
	Qwen3	3.64	3.20	+0.44	<0.001	0.003	+0.61
Patient safety	DeepSeek	2.97	2.80	+0.17	0.10	0.27	+0.38
	Qwen3	3.93	4.00	−0.07	0.06	0.24	−1.00
Faithfulness	DeepSeek	2.78	2.57	+0.21	0.10	0.27	+0.34
(no hallucination)	Qwen3	3.80	4.04	−0.24	<0.001	0.003	−0.97
Evidence traceability	DeepSeek	5.00	1.00	+4.00	–	N/A (definitional)	–
	Qwen3	5.00	1.00	+4.00	–	N/A (definitional)	–

Notes: Identical Holm-adjusted P values across the three DeepSeek dimensions reflect the step-down nature of the Holm procedure, which assigns the same adjusted value to hypotheses with similar raw P values that fail at the same correction step; they do not indicate identical underlying test statistics. Evidence traceability was structurally predetermined by the study design: the RAG condition retrieved verifiable PubMed sources, whereas the no-retrieval baseline did not retrieve sources and was therefore assigned the lowest traceability score by definition. Accordingly, the traceability difference was not subjected to significance testing and should not be interpreted as evidence of superior clinical performance.

Figure 3.

RAG versus baseline across the four evaluation dimensions for the two evaluated models (three-expert means, N=50 questions per model). (A) DeepSeek-R1-Distill-Llama-8B; (B) Qwen3-VL-8B. Clinical accuracy, patient safety, and faithfulness represent the clinical-content dimensions. Evidence traceability shows a fixed structural difference (RAG 5.00 vs baseline 1.00) because the RAG condition retrieved verifiable PubMed sources whereas the no-retrieval baseline did not retrieve sources; this dimension was therefore not subjected to significance testing and should not be interpreted as evidence of superior clinical performance. Significance annotations apply only to the three clinical-content dimensions (*** P<0.001, ns., not significant; Wilcoxon signed-rank test). RAG↓ indicates dimensions in which the mean RAG score was lower than the baseline score.

Patient safety showed no significant within-model benefit of RAG. The mean RAG effect was +0.17 on DeepSeek and −0.07 on Qwen3. The model-by-retrieval interaction reached nominal significance before multiplicity adjustment (interaction Δ=−0.24, P=0.037) but did not remain significant after Holm correction (adjusted P=0.074).

Faithfulness showed the clearest between-model heterogeneity. RAG produced a small, non-significant increase on DeepSeek (Δ=+0.21, P=0.10; Holm-adjusted P=0.27) but significantly reduced faithfulness on Qwen3 (3.80 vs 4.04, Δ=−0.24, P<0.001; Holm-adjusted P=0.003, rb=−0.97). The direct model-by-retrieval interaction was significant (interaction Δ=−0.45, P=0.006; Holm-adjusted P=0.018), confirming that the effect of retrieval on faithfulness differed between the two evaluated models.

After Holm correction of the six within-model content-dimension comparisons, only the Qwen3 effects on clinical accuracy and faithfulness remained significant; none of the three DeepSeek content dimensions reached significance.

Moreover, on DeepSeek, RAG received failing safety scores (≤2) on six high-risk questions (Table 3) (epidural drug combinations, sedative identification, drug interactions), indicating that retrieval failed to prevent—and sometimes accompanied—unsafe outputs in high-risk scenarios. Crucially, Table 3 reveals two distinct failure archetypes. In questions such as Q24 and Q34, the baseline model achieved borderline-safe scores (3.67), whereas the corresponding RAG responses received lower safety scores (2.00 and 1.00, respectively) in the presence of authentic but domain-mismatched retrieved evidence. Conversely, for questions requiring complex procedural integration (eg, Q13, thoracic epidural level calculation), both baseline and RAG scored equally poorly (1.33), suggesting that retrieval alone did not resolve the difficulty of these procedurally complex questions.

Table 3.

High-Risk Questions on Which the RAG Arm Received Failing Patient-Safety Scores (≤2) on DeepSeek, with Paired Baseline Scores (Three-Expert Means)

Q	Clinical Theme	RAG Safety	Baseline Safety
13	Thoracic epidural level and local-anesthetic regimen (IPAA)	1.33	1.33
14	Dexmedetomidine and anastomotic microcirculation	2.00	2.00
24	IV lidocaine dosing in opioid-sparing analgesia	2.00	3.67
29	Flupirtine hepatotoxicity and alternatives	2.00	3.00
34	Epidural timing under treatment-dose LMWH	1.00	3.67
42	Upadacitinib–CYP3A4 analgesic interaction	2.00	3.67

Composite Total Score and Its Structural Traceability Driver

On the descriptive four-dimension composite score (maximum 20), RAG exceeded baseline for both models (DeepSeek 13.61 vs 9.01; Qwen3 16.37 vs 12.24). However, this composite difference was driven predominantly by evidence traceability, for which the RAG arm had a structurally predetermined advantage because it retrieved verifiable sources whereas the baseline condition did not retrieve sources. The fixed +4.00 traceability difference equaled or exceeded the overall composite-score difference. Therefore, the composite score should not be interpreted as an independent measure of overall clinical superiority. Clinical performance is more appropriately interpreted from the individual content-quality dimensions of clinical accuracy, patient safety, and faithfulness.

Discussion

Principal Finding: Decoupling of Source and Content Hallucination

Our principal finding empirically separates two qualitatively different hallucinations: source hallucination, meaning the fabrication of non-existent references, and content hallucination, meaning the production of wrong clinical conclusions. Prior work has generally claimed that “RAG reduces hallucination” without distinguishing these two layers. Our data show that they can systematically diverge. Every retrieved PMID was verified to exist in PubMed, indicating no fabricated PMID at the source-existence level; however, this does not establish citation relevance, evidentiary support, or clinical correctness. Source-existence authenticity alone is therefore insufficient to ensure clinical correctness. A system can retrieve real literature and still reach the wrong clinical conclusion. We term this the decoupling of evidence traceability from content safety. Verifiable citations lend an “evidence-backed” surface credibility that may itself mask flawed underlying reasoning.¹⁰

Mechanism: The Retrieval–Generation Semantic Gap

This decoupling stems from a semantic gap between retrieval and generation. In the present system, retrieval supplied PubMed-indexed sources whose existence was verified, but this did not guarantee that the retrieved evidence was clinically relevant or appropriately used by the model. The model may retrieve a genuine, topically related article yet misread its conclusion, extract a wrong dose, or graft a finding onto an inapplicable clinical scenario. We conceptualize this specific failure mode as “citation hijacking” in a retrieval-layer sense: the model anchors its conclusion to authentic but clinically inapplicable retrieved evidence, even though explicit citation markers were removed for blinding.

In a representative high-risk case regarding the absolute safe time window for epidural puncture under treatment-dose Low Molecular Weight Heparin (LMWH) (Question 34), RAG retrieved five authentic but off-topic PMIDs. Despite acknowledging that each snippet was “not directly relevant”, the model anchored a clinically contraindicated time window to this irrelevant evidence, scoring a critical 1.00 on safety (versus 3.67 for the conservative, non-retrieving baseline). In clinical reality, such an error could directly precipitate spinal epidural hematoma. Retrieval solved “is there evidence” but not “is the evidence used safely” (Figure 4).

Figure 4.

Representative Q34 case in DeepSeek-8B comparing the no-retrieval baseline and full-text-enriched RAG conditions. For the question concerning neuraxial procedure timing under treatment-dose low-molecular-weight heparin (LMWH), the baseline response received a mean patient-safety score of 3.67/5, whereas the full-text-enriched RAG response received 1.00/5. The RAG condition retrieved five PubMed-indexed articles, all of which were verified as authentic, but none directly addressed neuraxial timing under anticoagulation. Although the RAG response acknowledged that the retrieved snippets were “not directly relevant”, it nevertheless generated a specific clinical recommendation. Patient-safety scores represent the mean ratings of three physicians. This case illustrates the potential divergence between source-existence authenticity and clinical reliability when corpus coverage is limited and retrieved evidence is not appropriately interpreted.

This failure should be interpreted in the context of both corpus coverage and model behavior. Because the knowledge base was deliberately anchored to IBD, the primary authoritative sources for this question—regional-anesthesia anticoagulation guidelines—were absent by design. The retriever therefore had limited opportunity to surface the most appropriate evidence and instead returned authentic but clinically mismatched records. At the same time, the model did not recognize the insufficiency of the available evidence and abstain, but generated a specific clinical recommendation from off-target information. Accordingly, the Q34 failure cannot be attributed exclusively to either corpus incompleteness or model interpretation; rather, it illustrates how limited corpus coverage and inappropriate use of retrieved evidence can interact to produce an unsafe answer.

Heterogeneity of Retrieval Effects Across Models

Retrieval effects differed across the two evaluated models, but formal interaction testing showed that this heterogeneity was dimension-specific. For clinical accuracy, RAG significantly improved Qwen3 performance but not DeepSeek performance; however, the direct model-by-retrieval interaction was not statistically significant, indicating that the difference in accuracy gains between models was not formally established. Patient safety also showed a numerical difference in retrieval effects between models, but the interaction did not remain significant after Holm correction. In contrast, faithfulness demonstrated a significant model-by-retrieval interaction: RAG modestly increased faithfulness on DeepSeek but significantly reduced it on Qwen3. These findings therefore support model-dependent retrieval effects most clearly for faithfulness rather than establishing a universal model-by-retrieval interaction across all clinical dimensions. More broadly, they caution against inferring cross-model generalizability from significant results observed within a single model.

Implications for High-Risk Deployment

Together, these findings suggest that retrieval alone should not be treated as a sufficient safety mechanism in high-risk settings such as perioperative dosing. Because authentic sources do not guarantee safe clinical conclusions, evidence-based retrieval should not itself be interpreted as a safety warrant. Our target deployment architecture includes a model-external deterministic safety layer (Separation of Generative Evaluation from Deployment Safety Rules); however, this layer was deliberately disabled during the present evaluation, and we therefore make no claim regarding its effectiveness. The persistence of unsafe outputs despite authentic retrieval supports consideration of additional model-external safety mechanisms and structured safeguards in real-world deployment, although their effectiveness requires separate prospective validation.^25,26

Methodological Contribution

Beyond the clinical finding, we contribute a reproducible framework that separates source from content reliability: (1) measuring source hallucination by objective verification (PubMed PMID existence) rather than expert inspection of citation formatting; (2) assessing content quality under format-homogeneous, source-blinded expert evaluation to prevent formatting bias from contaminating scores; and (3) auditing a high-risk subset specifically rather than relying on totals. The framework may be adaptable to the evaluation of other high-risk medical RAG systems.

Limitations

Several limitations apply. First, the evaluation used three raters and 50 questions, a limited sample, with physicians of 5–10 years’ experience; extrapolation to tertiary-referral complexity therefore warrants caution, despite excellent inter-rater reliability. The evaluated models were 8B open models, and conclusions may not transfer to larger or commercial models.

Second, the benchmark did not include pre-authored gold-standard answers; scoring relied on a pre-specified rubric and expert raters’ guideline-based judgment rather than item-level reference answers, and scores were aggregated as a simple mean without consensus adjudication. Although the high inter-rater reliability supports consistency of expert judgment, the absence of pre-authored reference answers remains a limitation for fine-grained accuracy and safety adjudication. Future work should incorporate pre-specified, guideline-traceable reference answers with formal adjudication.

Third, the knowledge base was constructed around an IBD disease anchor and did not incorporate stand-alone perioperative anticoagulation or regional-anesthesia guidelines (eg, ASRA/ESRA). Consequently, for cross-domain high-risk questions such as neuraxial timing under therapeutic-dose LMWH, the corpus could not supply the primary authoritative source. We frame the resulting failures not as evidence that retrieval can never succeed, but as illustrating how authentic, domain-mismatched evidence may contribute to misleading generation when retrieval is imperfect.

Fourth, traceability verification covered source existence only, not whether each reference substantively supports its associated claim; this currently requires manual judgment and remains future work. The upstream automated pre-screening agreed only moderately with expert judgment, so we framed it as engineering pre-processing and do not build core conclusions upon it.

Fifth, this was a retrospective static-QA evaluation rather than a prospective clinical deployment. Although the two arms were format-homogeneous, RAG answers were on average slightly longer than baseline—a weak potential de-blinding cue, mitigated by neutral scoring instructions. Finally, because abstracts and full text were merged before chunking during ingestion, we did not perform an abstract-versus-full-text ablation, which we leave for future work.^27–29

Conclusions

In the two evaluated 8B models, using the present 50-question benchmark and IBD-anchored retrieval corpus, PubMed-based retrieval achieved source-existence authenticity but did not consistently improve clinical accuracy, safety, or faithfulness. Authentic retrieved sources could still accompany incorrect or unsafe outputs, demonstrating that evidence traceability and clinical reliability are distinct dimensions. These findings support cautious interpretation of RAG performance in high-risk medical applications and underscore the need to evaluate source traceability and clinical content quality separately.

Funding Statement

This research received no specific grant from any funding agency in the public, commercial, or not-for-profit sectors.

Application of AI-Assisted Technologies in the Writing Process

During the preparation of this manuscript, the authors used Claude Sonnet 5 (Anthropic) solely for language refinement and improvement of readability. The authors reviewed the terms of use of the AI tool and confirmed its suitability for publication-related language assistance. All AI-assisted output was critically reviewed and edited by the authors. The authors take full responsibility for the integrity of the entire manuscript, including the accuracy of all references, and confirm that the originality and accuracy of the content have been independently verified by the authors.

Data Sharing Statement

The datasets generated and/or analyzed during the current study, including the 50-item benchmark, scoring rubric, and de-identified scoring data, as well as the code and search queries, are available in the Additional files.

Ethics Approval and Consent to Participate

This study did not involve human patients, animal subjects, or identifiable personal health information. The 50 clinical questions used for the benchmark evaluation were hypothetical scenarios reverse-engineered from publicly available clinical guidelines. Therefore, according to the institutional policies of the First Affiliated Hospital of Wenzhou Medical University and national regulations regarding clinical research, this study does not meet the regulatory definition of human subjects research and does not require formal ethical review or approval. The three board-certified physicians with 5–10 years of clinical experience who participated as raters in the source-blinded evaluation were informed of the study’s purpose, methodology, and data management protocols, and provided explicit verbal consent for their scoring data to be used for research and publication purposes prior to study commencement.

Author Contributions

All authors made a significant contribution to the work reported, whether that is in the conception, study design, execution, acquisition of data, analysis and interpretation, or in all these areas; took part in drafting, revising or critically reviewing the article; gave final approval of the version to be published; have agreed on the journal to which the article has been submitted; and agree to be accountable for all aspects of the work.

Disclosure

The authors declare no competing interests.