How Do You Teach an Open Model Without Teaching It the Closed Model's Hallucinations?

When you train a smaller model on a larger model's outputs, you are teaching it to reproduce the distribution of those outputs. If the teacher answered confidently when it should not have, invented a policy detail, or cited a document section that does not exist, those outputs are in the distribution. The student learns that the shape of a good answer is a confident, complete, specific one, whether or not the specifics are true.

This is worse in the student than in the teacher. The teacher hallucinated on a minority of requests because it usually knew the answer. The student does not know the answer nearly as often, and it has been taught that not knowing is not an acceptable output. The result is a model that is fluent, on schema, and wrong more often than the teacher, in exactly the cases that matter.

The unit of checking is the claim, not the response. Break a teacher output into its factual assertions: the order shipped on Tuesday, the policy allows a refund within thirty days, the supplier appears on the sanctions list. For each one, ask whether something in the run supports it: a tool result, a document passage, a prior user turn, the instruction itself. A claim with a source is supported. A claim without one is unsupported, whether or not it happens to be true.

That last point is the one teams resist. A true but unsupported claim is still a hallucination for training purposes, because the student cannot learn to be right by luck. It can only learn to state what the evidence shows. Admitting true-by-luck outputs teaches the same habit as admitting false ones; the difference only shows up later, on inputs where luck runs out.

The rule is short. An output is admitted as a training target only if every factual claim in it is supported by evidence in the run, and every required claim the evidence supports is present. Outputs with unsupported claims are rewritten to remove them or to replace them with an abstention, and the rewrite is reviewed. Outputs that omit a finding the evidence clearly supports are rewritten to include it. Anything the reviewer cannot resolve is excluded.

This is a deterministic check wherever the evidence is structured. A tool result is a JSON object; a claim that cites a field can be matched to it. Where evidence is prose, a semantic check proposes the match and a reviewer confirms it on representative cases. The table below shows the claim states and what happens to an output in each.

After the admission rule runs, the training set is cleaner but lopsided. It contains supported answers and almost nothing else, because the closed model rarely abstained and the rule removed its fabrications rather than replacing them. A student trained on that set has never seen an example of saying the evidence is insufficient, and will not produce one. It will fill the gap with its best guess, which is the failure the whole exercise was meant to prevent.

So the set needs abstention examples on purpose: inputs where the evidence is partial or absent, paired with targets that say what is known, what is not, and what would resolve it. Parts 8 and 9 go into what those targets should look like for partial and no-evidence cases. The rewrites from the admission table are one source. Deliberately constructed cases with a tool that returns nothing are another. Aim for enough that abstention is a learned shape, not a rare accident.

There is a second failure hiding behind the first. A team that trains hard against hallucination can produce a model that abstains whenever it is unsure, which for a small model is often. The model stops inventing and starts refusing, and every request that needed a real answer gets a polite non-answer. Precision went up; recall collapsed. Both directions have to be measured, or the fix is a different failure with a better name.

The guard is a set of seeded adverse cases: inputs where the evidence clearly supports a specific, consequential finding, and the correct output has to state it. A sanctions hit the report must name. A refund the policy clearly allows. A deadline the document states. The student has to catch every one. If it abstains on any, the training set has too much abstention or too little contrast, and the balance is adjusted before the candidate goes anywhere near a gate.

The same adverse cases belong in the frozen evaluation set, not only in training. Choose them so each one has a deterministic answer the evidence supports, hold out a share the model never sees, and require zero misses. With zero misses on twenty-five held-out adverse cases, the rule of three puts the 95 percent upper bound on the true miss rate at roughly eleven to twelve percent; state that bound rather than claiming the model never misses.

A zero-miss requirement sounds strict and is the honest minimum. A single missed sanctions hit in a supplier-risk report is not a rounding error, and a gate that tolerates one has decided the report can be wrong sometimes without anyone signing off on that. If the customer's parity definition accepts a miss rate, it should say so in writing, which part 21 discusses.

Hallucination is the visible version of a broader problem: teacher outputs that do not match the evidence. Two other versions are common. The teacher contradicts a tool result, saying the lookup found nothing when it returned a hit. And the teacher omits a finding the evidence clearly supports, producing a shorter, more reassuring report than the facts warrant. Both are admitted only as corrected targets, and both are strong candidates for the adverse set because they represent the model being confidently incomplete.

Omissions are the subtle ones. An output with no false claims can still be wrong because of what it leaves out, and a claim-level check that only looks for unsupported assertions will pass it. The admission rule has to run in both directions: every claim needs support, and every supported required finding needs a claim. For structured outputs that is a coverage check against the evidence; for prose it is part of what the reviewer confirms on the representative case.

The evidence check is a training-data admission rule. It is not the evaluation. If the same check is used to select training examples and to score the candidate, the candidate is being scored on how well it matches a filter it was trained to match, which is circular. The gate needs its own truth: deterministic answer keys for synthetic cases, reviewer-confirmed outcomes for production cases, and a protected split the admission process never touched.

This separation also protects against a quieter drift, where the admission rule is tuned until the training set looks clean and the model looks good, and nobody notices the rule has started excluding hard cases. Report admission rates per claim class over time. A rule that starts excluding most partial-evidence cases is not making the data cleaner; it is making the model blind to that class.

Converra's judges produce step-level findings that quote the evidence a run carried, including whether an output's claims are supported by tool results and documents, and its regression testing keeps a set of scenarios the agent must keep passing. In the fine-tuning workflow, reviewed runs are curated into versioned datasets with per-example admission decisions, so an output enters training only after a decision that it should, and unresolved cases are excluded and counted.

Training runs on the customer's provider or infrastructure; Converra records the job and its gate result against the dataset version and holds the production switch behind an approval, with a parity verdict reported on real traffic afterwards. Converra does not use customer data to train any model without a written, tenant-exclusive election. No open-weight production verdict for a customer agent has been published yet; whether a given student has learned to abstain rather than invent is unobserved until it is measured on protected cases and on live traffic.