Implementation guide
OWASP AISVS v1.01
Model Behavior, Output Control & Safety Assurance · Source Attribution & Citation Integrity
Citations come from retrieval, not the model
Verify that RAG attributions are derived from retrieval metadata and are not generated by the model, so provenance cannot be fabricated.
OWASP AISVS v1.01, requirement 7.4.2
In plain English
Build citations from the retrieval system's own records. If you let the model write its own citations, it can invent documents, links and page numbers that look entirely real.
What good looks like
- Citations are assembled in code from the metadata of the chunks that were retrieved.
- The model can refer only to chunks it was given, by an identifier your code assigned.
- Any identifier in the output that does not match a retrieved chunk is dropped.
- URLs and titles shown to the user come from your index, never from model text.
How teams usually do it
- Number the retrieved chunks in the prompt, ask the model to cite by number, then map the numbers back to stored metadata in code.
- Use a model API citation feature that returns references to the supplied documents as structured data.
- Validate every citation marker after generation and remove the ones that do not resolve.
Suggested evidence
- The code that builds citations.
- A test where the model is pushed to cite a source that does not exist, showing it is dropped.
Common mistakes
- Asking the model to "include your sources" and displaying whatever it writes.
- Letting the model produce the URL.
- Accepting a chunk number without checking it was in the retrieved set.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.