Thinking to Recall: When One Made-Up Fact Poisons the Whole Answer
A colleague asked her AI assistant a question last week. Nothing exotic: a multi-step query about which regulatory body oversees a particular class of product, and what that body requires. The model produced a clean, well-structured answer. It named the authority. It listed the obligations. It read like the work of someone who knew the field.
One fact in the middle of the reasoning was wrong. The model had named the wrong authority. Everything after that point, the obligations, the thresholds, the advice, followed correctly from a false premise. The conclusion was confident, fluent, and incorrect. Neither my colleague nor the model could tell.
This is not a description of a rare failure mode. It is the standard operating condition of current reasoning models, and as of this month it has been measured at scale.
What "Thinking to Recall" established
In March 2026, a team at Google Research and the Technion published a paper, "Thinking to Recall" (arXiv 2603.09906) [1]. A Google Research blog post brought it to wider attention in late June 2026, which is why it is worth your time now. (The exact blog date is approximate at the time of writing; the paper itself is the March submission.)
The paper asks why chain-of-thought reasoning helps a model retrieve facts even for simple, single-hop questions that need no logical decomposition. The answer matters less than one of its measurements. On the SimpleQA-Verified benchmark [3], reasoning traces that contain at least one hallucinated intermediate fact produce a correct final answer 26.4 per cent of the time. Traces with no hallucinated fact produce a correct answer 41.4 per cent of the time. That is a gap of fifteen percentage points, on the same model, answering the same questions [1].
On the EntityQuestions benchmark, the gap is sharper still: 71.1 per cent correct for clean traces against 32.2 per cent for traces carrying a hallucinated step. Just under thirty-nine percentage points [1].
Read those numbers carefully, because the comparison is not between a good model and a bad one. It is the same model on the same questions, separated only by whether the reasoning it happened to generate was factually clean or factually corrupted. The model has no reliable way to know which of those two states it is in. That is the whole problem.
The paper offers a clean account of why reasoning helps in the first place, and it identifies two separate effects [1]. The first is a computational buffer: generating any reasoning tokens, even semantically empty ones, extends the model's effective working time and improves accuracy. This benefit has nothing to do with whether the reasoning is true. The second is factual priming: when the model writes down accurate intermediate facts, those facts steer it towards the right answer.
Hallucination poisoning rides entirely on the second effect. A false intermediate fact does not simply fail to help. It actively primes the model towards a wrong conclusion, because the model treats its own generated claim as a confirmed premise and reasons forward from it. The same mechanism that makes good reasoning helpful makes bad reasoning harmful. A recent peer-reviewed benchmark, FaithCoT-Bench at ICLR 2026, makes a related point from the other direction: a model can reach the right answer through wrong reasoning, which means final-answer accuracy alone systematically undercounts how often the reasoning process failed [4].
Why standard logic cannot prevent this
Here is the part that probabilistic safety techniques keep missing. The poisoning effect is not a training defect that more data will sand away. It is a structural feature of how the model handles a claim, and it has a precise logical description.
Standard predicate logic treats a statement like "the regulatory authority responsible for this product is X" as a single proposition that is either true or false. Non-Traditional Predication Theory, developed by Professor Horst Wessel at Humboldt University Berlin and the foundation of the work I do, refuses that shortcut [5]. It separates two logically distinct acts that ordinary logic runs together. The first act is existence: asserting that an entity is real, that it exists in the domain you are reasoning about. The notation is E!. The second act is predication: attributing a property to an entity already taken to exist. The notation is ℳ.
The order is not decorative. You can only sensibly evaluate whether X has a property once you have established that X exists. Assert the property without grounding the existence, and the statement is not false so much as ungrounded: there is nothing underneath it to check against the world.
Now look again at what a reasoning model does. When it writes "the regulatory authority responsible for this product is X", it has performed both acts in a single generative breath. It has asserted that X exists and that X has the property of being the responsible authority, and it has done so without separating the two, without grounding the first before asserting the second. If the predication is hallucinated, the model cannot distinguish that from a verified premise, because internally there is no distinction to draw. The composite simply becomes the input to the next step.
The paper shows, empirically, that hallucinated intermediate facts poison conclusions. The existence-predication separation explains why this is architecturally inevitable without external verification: predication without grounded existence creates an ungrounded premise, and reasoning from an ungrounded premise carries the defect into every step that depends on it. The paper found the symptom by measurement in 2026. The logic that names the cause has existed since 1992.
V.E.R.A.'s response: verify before you reason
V.E.R.A. (Verified Existence and Reason Architecture) is an open-source logic engine that implements this separation as a working pipeline that wraps an existing language model. It has three layers, and the order in which they run is the argument [6].
The first layer is the Krampitz Load Analyzer. Before any external check, it classifies each claim in the generation stream as e-type or n-type. An e-type claim asserts existence, quantity, or occurrence: "the authority responsible for X is Y" embeds an existence assertion and must be grounded before it is used as a premise. An n-type claim follows logically from premises already established: "therefore the obligation applies to this operator" needs no external grounding, provided its premises are sound. This classification gate is the existence-predication separation applied in software, at the point where it can still change what happens next.
The second layer is the E! Verification Service. For an e-type claim, it pauses generation, extracts the entity and the property being attributed to it, queries a structured existence corpus built under controlled provenance, and returns one of three verdicts: exists, does not exist, or unknown. The third layer, the D-Service, acts on those verdicts. An unknown or a does-not-exist return does not get papered over with a plausible guess. The claim is held, unknown is returned to the requester, and the chain that depended on the unverified fact is stopped rather than completed with a hallucinated premise.
That last move connects directly to the previous two episodes in this arc. Calibrated decline, the subject of an earlier piece, is exactly this: unknown is the correct answer when existence cannot be confirmed. External formal verification, the subject of the last one, is the same principle in the code-security domain. This week's evidence sits closest to home, because it comes from reasoning chains themselves, which is V.E.R.A.'s own ground.
On the project's own benchmarks, the triple-layer architecture produced a 28.9 per cent reduction in hallucination rate on the CogniGPT evaluations and a 21.1 per cent improvement in truthfulness on the TruthRL evaluations, measured in January 2026 [6]. Those are first-party measurements, not third-party validated figures, and they are not directly comparable to the Google paper's numbers, which use different tasks and methods. I report them as what they are: evidence that the existence-grounded approach was already producing measurable results before the empirical corroboration arrived.
Two boundaries need stating plainly, because the temptation to overclaim here is real. First, the Google paper's auditing pipeline uses an external verifier of its own: a second language model, Gemini-2.5-Flash, running search queries to check each intermediate fact [1]. That is not what V.E.R.A. does. V.E.R.A.'s E! service queries a structured, logic-governed existence corpus, not a second model running searches. The two systems share exactly one principle, that verification must sit outside the model being checked, and nothing more. The implementations and the logical grounding are different, and the convergence is on the principle, not the design.
Second, and this is the firewall that governs everything above: V.E.R.A. does not verify its own reasoning. A verifier that lived inside the process it was meant to check would inherit the same blind spot the model has. The external referent is the point. A system cannot be the judge of claims it is itself generating, which is why the existence corpus is separate, sourced, and outside the generation loop. State it twice and it is still true: nothing in this architecture asks the model to grade its own homework.
What this means for enterprise and governance
The governance implication lands at a level most monitoring does not reach. The OECD Due Diligence Guidance for Responsible AI, published in February 2026, requires organisations to monitor the effectiveness of their AI due-diligence measures and to assess, on a recurring basis, for previously undetected risks [7]. New Zealand is an OECD member, and the guidance applies to New Zealand enterprises deploying AI for consequential decisions.
Reasoning-chain hallucination is precisely the class of previously undetected risk that the guidance has in mind. Standard output monitoring, accuracy on a holdout set, will not catch it, because a clean trace and a poisoned trace can produce similar output distributions when the poisoning is partial. The European Union's AI Act makes a parallel demand: Article 72 requires providers of high-risk systems to monitor performance across the operational life of the system, including degradation [8]. A model that produces confident wrong conclusions from hallucinated premises is degrading in exactly this sense, but only a monitoring design that looks at the reasoning step, not just the final answer, will see it.
For New Zealand organisations the exposure is concrete. Any enterprise using AI reasoning chains for compliance work, clinical decision support, legal review, or financial modelling is exposed to the effect these benchmarks measured, with no widely deployed remedy in place. The pharmaceutical case remains the clearest demonstration, because the stakes are unambiguous: an AI reasoning about a drug interaction from a hallucinated intermediate fact about a compound's properties would produce a confident wrong answer that looks identical to a reliable one. New Zealand's own AI guidance sits at the principles level and does not address reasoning-chain verification; organisations seeking direction at that layer can read the OECD framework directly. That is a description of where the guidance currently reaches, not a judgement of it.
The implication on the defence and sovereignty side is worth naming directly. In June 2026 the United States issued National Security Presidential Memorandum 11, which sets four pillars for artificial intelligence in national security work: adoption, adaptation, assurance, and accountability [9]. The assurance pillar requires systems to be reliable and able to be steered and corrected, and those are properties of the reasoning process, not of the final output alone. A system advising on threat assessment that reasons from a hallucinated fact about an adversary's capability is not assured in this sense; its failure is invisible to output-level checks. Access controls govern who can reach the system, not whether its reasoning is grounded. The structural answer, in the reasoning-chain case, is external existence verification at each step: the same accountability gap that lethal autonomous weapons frameworks have circled for a decade, now in the civilian reasoning layer.
External verification is not a feature you bolt onto a reasoning system once it is built. It is an architectural requirement for any system whose conclusions are derived from intermediate premises that are not themselves grounded. The Google paper reached that requirement empirically, from the reasoning side. Non-Traditional Predication Theory reached it logically, from the existence side, more than thirty years ago. The convergence is the finding.
If you run AI reasoning chains in a setting where a confident wrong answer costs something real, where in your stack would a single hallucinated intermediate fact get caught before it reached the conclusion, and how would anyone know it had?
The views expressed in this article are entirely my own, informed by more than 30 years of professional experience in architecture, security, and technology leadership in New Zealand. They do not represent the views of my employer, any government agency, or the New Zealand government. My commentary on legislation and policy is analytical, drawing on publicly available sources and my professional expertise in architecture, security, and AI governance. I follow the Public Service Commissioner's Code of Conduct for the Public Sector and social media guidance.
Andreas Hamberger is a New Zealand leader in Architecture & Security and Associate Member of the Institute of Directors. V.E.R.A. (Verified Existence & Reason Architecture) is an open-source logic engine available on GitHub.
I use AI tools, including Sudowrite, Claude, Perplexity AI, DeepSeek AI, ChatGPT, Grok, Copilot, Openart and Gemini, as deliberate production tools, not ghostwriters. This is consistent with my position: AI amplifies human judgement; it does not replace it. The frameworks, arguments, and editorial decisions in this series are original work. AI accelerated the process. The thinking is mine.
References
[1] Gekhman, Z., Aharoni, R., Ofek, E., Geva, M., Reichart, R., and Herzig, J. "Thinking to Recall." arXiv 2603.09906. March 2026. https://arxiv.org/abs/2603.09906
[2] Google Research. "Thinking to Recall (blog post)." late June 2026. https://research.google/blog/
[3] "SimpleQA-Verified: a fact-level factual accuracy benchmark." arXiv 2509.07968. 2025. https://arxiv.org/abs/2509.07968
[4] Shen, et al. "FaithCoT-Bench: instance-level faithfulness in chain-of-thought reasoning." arXiv 2510.04040. ICLR 2026. https://arxiv.org/abs/2510.04040
[5] Wessel, H. "Existenz, Ununterscheidbarkeit, Identitat." Wissenschaftliche Zeitschrift der Humboldt-Universitat zu Berlin, Reihe Geistes- und Sozialwissenschaft 41, pp. 30 to 39. 1992.
[6] Hamberger, A. "V.E.R.A. (Verified Existence and Reason Architecture): benchmarks and documentation." Te Pono Limited. January 2026. https://github.com/ahamberger/vera
[7] OECD. "Due Diligence Guidance for Responsible AI." February 2026. https://www.oecd.org/
[8] European Union. "Regulation (EU) 2024/1689 (Artificial Intelligence Act), Article 72: post-market monitoring." 2024. https://artificialintelligenceact.eu/
[9] The White House. "National Security Presidential Memorandum on Artificial Intelligence (NSPM-11)." 5 June 2026.
[10] Sciavolino, C., Zhong, Z., Lee, J., and Chen, D. "EntityQuestions: a benchmark of entity-centric factual questions." 2021. https://arxiv.org/abs/2109.08535