When we benchmarked sixteen models on missing-record lookups, one result changed how we build detection. The fabricated values were not made up. In the hardest condition, 75 to 100 percent of fabrications from attention and hybrid models were a look-alike record's real value, copied verbatim. Ask about order #A-88213 and the agent answers with the address on file for #A-88218.
That failure has a property most hallucinations lack: the wrong answer has a source, and the source sits in the agent's own context window. You do not need a judge model to find it. You need a string comparison.
Moda now runs that comparison on your agent traffic. This post covers how the detector works and what it changes about the finding your on-call engineer reads.
The rule
Three steps, all deterministic, all running before any judge model:
- When an agent asserts a value for a key, an order ID, a customer name, a file path, we scan the conversation's context for that key. The embedding and trigram machinery in our pipeline already does this work for other detectors.
- No exact match, but near-duplicates within a small edit distance? The assertion gets flagged
interference_risk, carrying the look-alike count and the closest distance. Our benchmark data says this is the regime where fabrication climbs from single digits toward certainty, so the flag is worth having even when we cannot prove the value wrong. - If the asserted value matches one of those near-duplicates' values verbatim, we surface that line as the probable source. On attention-family models, that check alone accounts for 75 to 100 percent of interference fabrications we measured.
Provenance diagram. The agent asserts that order #A-88213 ships to 44 Harrow Lane. Scanning the six receipt lines in the context window finds no exact match for #A-88213, but three near-duplicate order ids: #A-88218 at edit distance 1, #A-83213 at edit distance 1, and #A-88231 at edit distance 2. The asserted address matches the near-duplicate #A-88218, whose address is 44 Harrow Lane, so the detector reports an interference-risk finding: the value was drawn from a look-alike order, not the queried one.
A diff instead of a shrug
Most hallucination findings read like suspicion: the model may have made this up. Suspicion is hard to act on. Nobody pages an engineer over "may have."
A provenance finding gives the engineer something else. The agent answered for order #A-88218 when the customer asked about #A-88213, and here is the line it copied from. That is a diff. It names the record the customer asked about, the record the agent used instead, and the one-character difference between them. You can verify it by looking at it, route it on the interference metadata, and hand it to the team that owns the data whose near-duplicates caused it.
The asymmetry matters for trust in the alert itself. A judge model saying "this looks wrong" inherits every doubt you have about judge models. A verbatim match between the asserted value and a look-alike's line is a fact about two strings.
Two smaller guards ship with it
The same study produced two cheaper checks, and both are now in the pipeline.
A stale-recall guard. We measured where each model family's recall falls off with context depth, and how often each fabricates past that point. When an assertion's only support sits beyond the deployed model's honest range, the guard flags it with a prior calibrated from those tables rather than a generic warning.
A prompt lint, in moda harness analyze. The benchmark found that format-forcing instructions like "answer with the number only" raise fabrication above asking with no instructions at all, because a format cue implies an answer exists. The lint catches those instructions on prompts that can face unanswerable questions, and flags prompts missing an explicit permission-to-decline line. The permission line is not a fix, our data shows it collapsing under look-alikes, but its absence is a free point of risk.
Why deterministic rules come first
Our own measurement stack taught us this the hard way. During the benchmark, our frozen scorer rated Claude Opus 5 at 94 percent fabrication under interference. A 151-item dual-blind audit put the true rate at 0. The model was politely declining in a phrasing our regexes had never seen, and the automated layer misread the best-behaved model in the study worst.
So the order of operations in Moda's hallucination unit is fixed: deterministic rules first, judge models second, audits of the judges always. The provenance detector fits that order because its core claim is checkable arithmetic. If the value your agent asserted exists verbatim in its context attached to a different key, no model needs to be consulted about whether that is concerning.
If your agents look things up in data where records resemble each other, the benchmark says this failure is already in your traffic. Now the alert can name its source.