A language model that answers from an organisation's own documents states supported and unsupported claims in the same confident voice, and nothing in the answer, or usually in the system, tells them apart. This paper specifies a runtime control loop around a hosted model, with no retraining. Before an answer leaves, every factual claim in it is compared with an independent record the model cannot edit. Two quantities are held to explicit targets: how much of the answer the record supports, and how much of the question the answer covers with support. A claim the loop cannot support is rewritten, removed, marked unchecked or shown as a conflict; it is never delivered as a plain assertion. The loop is tested with the Test for the Controlled Variable from perceptual control theory, against eight hypotheses stated in advance, each with the result that would count against it. This version contains the design and the protocol only. It reports no results.
A language model deployed over a company's own documents answers in one register. A claim backed by the documents and a claim the model produced from nothing arrive in the same fluent, confident sentence. Nothing in the answer tells the reader which is which, and in most deployments nothing in the system knows either. The difference shows up later: in a complaint, in an audit, or in a decision that went wrong.
The usual remedies leave that in place. An instruction to state only what the documents support changes what the model is likely to write; it does not create a measurement. Asking the model to check its own answer re-runs the same process. Retrieval supplies documents, but the generator still decides what to look up and how to read it. In control terms, such a deployment is open-loop with respect to the facts it talks about.
Three things are missing, and they have to exist while the system runs, not in an audit afterwards: a measurement from outside the generator, an explicit target for that measurement, and the authority to revise, withhold or mark a claim before the answer leaves.
A thermostat holds a set value, measures the room, and acts when the two differ. The loop does the same for the claims in an answer. The set value is how closely the claims must agree with the record. The measured value is the share of claims that a comparator outside the generator finds supported. The action is to rewrite or remove an unsupported claim, retrieve more, mark a claim unchecked, show a conflict between sources, or ask the user.
A loop that controls agreement alone has an easy way out: say less. An answer with no claims agrees perfectly with any record. A second controlled variable closes that exit.
| Agreement | The share of the answer's factual claims that the independent record supports. Its target is fixed in advance and has a floor. |
|---|---|
| Coverage | The share of what the question asks that the answer addresses with support. Removing an unsupported sentence removes the risk of delivering it; it does not count as answering that part of the question. |
| Level 2 | Perceives how much of the question is answered with support and sets the targets below it: first to find support for the parts that lack it, then, if that fails, to relax coverage, never below a fixed floor, and to say plainly what the record cannot answer. It can never touch the agreement target. |
| Ledger | An append-only, hash-chained record of every check: what was checked, against what, and how. It travels with every answer. |
The system may answer less. It may not become more talkative at the expense of support.
Terms used here — comparator, controlled variable, reference signal, Test for the Controlled Variable — are defined in the working glossary.
The loop does not control whether a claim is true. It has no access to the world, only to records. What it controls is whether a claim agrees with an independently obtained record: the supplied documents, a database, a ledger, a sensor log. The construction is the one used in double-entry bookkeeping: two records kept by different routes and compared, so that a discrepancy forces someone to look.
Two consequences are stated as limits of the design. If the record is wrong, the loop will agree with a wrong record, and the test is built to show exactly that. If no record covers a claim, the loop cannot check it and says so: the claim is delivered marked unchecked, never passed as verified.
The parts exist elsewhere, and the paper credits them as prior art: external gates, per-claim logging, source-relative support, adaptive thresholds, and control-theoretic framings of agents. Two things were not found in a documented search through 16 October 2026:
Neither part is a claim that no such system can exist. The field is moving quickly, and counterexamples are invited.
The method is the central one of perceptual control theory, the Test for the Controlled Variable (Powers, 1973, 1978; Runkel, 2003): disturb the quantity a system is thought to control, with its reference held fixed, and observe whether its action opposes the disturbance. Here the disturbances include false premises in the question, user pressure, swapped, stale and updated sources, conflicting sources, instructions planted in a record, removal of the record, a confident challenge to a supported claim, and direct edits that make a draft disagree with the record.
| H1 | The loop controls agreement: it restores agreement and recovers disturbed content where modes without a loop drift. |
|---|---|
| H2 | The hierarchy does real work: with Level 2 setting the references, supported coverage is regulated better than with fixed references at the same cost. |
| H3 | No fabrication when the record is withheld: claims are marked unchecked, and no verification or contradiction is invented. |
| H4 | Perception is fallible and its error is known: perception quality is reported per claim type. A measurement requirement rather than a falsifiable hypothesis. |
| H5 · central | The loop's organisation beats the same components organised otherwise, verifying at matched cost. |
| H6 | Stagnation is caught: injected unresponsiveness is detected by the monitor's own signal. |
| H7 | The loop corrects selectively: supported claims survive an evidence-free challenge, and claims change when a new record warrants it. |
| H8 · central | Correction depends on live measurement: when the loop's measurements are frozen or replayed, recovery of a disturbed element largely disappears. If it does not, the loop is not controlling anything. |
One prediction is stated in advance and is not a success criterion. With a stale source, agreement with the supplied record will be high while agreement with the true state of affairs falls, possibly below that of the raw model. That is what controlling agreement rather than truth means, and it is reported, not explained away.
Outcomes are judged by human assessors who do not know which system produced an answer, on a test set written for the study and sealed before any run, across several models from different vendors. The results will be deposited as version 2 under the same record whatever they show, including a negative result and including a decision to stop after the pilot.
Whether the cost is worth paying depends on the setting. The paper names four conditions that make it more likely: an unsupported claim costs much more than checking it; independent records exist and can be read by a machine; decisions must be accountable after the fact; and human review is the bottleneck. Regulated finance and audit, compliance, operational reporting in energy and other infrastructure, public administration, and analytical work in security and defence fit that description. No result is claimed for any of them.
The design is the runtime counterpart of two earlier records: the verification architecture of No Argument for the World and the cross-channel comparator of The Metric Was Green. If it works, the same construction applies wherever a report, a dashboard or an automated answer must be held to an independent record.
The loop checks only the claims it extracts. Assertions can be carried by implication, by presupposition, across several sentences, or by what an answer leaves out. The design sets precision and recall floors per claim type and declares types below them unchecked.
A loop that holds agreement with a wrong record produces a well-supported wrong answer. A discrepancy detector is also defeated when its channels fail together, for example when the record comes from a corpus the generator memorised. The design reduces these risks; it cannot rule them out.
Rubrics are checked by a second person, assessors are independent and blind to mode, hashes are published before any run, and several models from different vendors are tested. These reduce the problem; they do not remove it.
Nothing here claims that a language model is a control system. The loop is built around the model, and its top-level reference is set by its designer. Perceptual control theory is used to specify what the loop must contain and to test whether it does what it is said to do.
Published: the architecture, the claim states and the emission contract, the hypotheses with their refutation criteria, the disturbances, the baselines and the decision rules.
Not published: the calibration, and the matching heuristics and thresholds of later tuned versions. The configuration used in the study is frozen before data collection and deposited by hash at pre-registration. It is made available to reviewers on request, and to researchers who undertake a replication under a written agreement; the published hash lets anyone confirm that the configuration released to them is the one that was frozen.
Organisations that want to know whether their own AI answers are held to anything will find that under applied work.
Related: No Argument for the World · The Metric Was Green · Reference Signal Engineering · Concepts glossary · Applied work · All research
Current version. Diener, Ł. (2026). The Missing Comparator: A Perceptual-Control Loop That Holds Language-Model Claims to an Independent Record — and the Pre-Registered Test That Could Prove It Wrong (version 1.0). Zenodo. https://doi.org/10.5281/zenodo.23428834
Preprint, not peer reviewed by a journal. Licensed CC BY 4.0. Version 1.0 contains the design and the pre-registered protocol only; results will be deposited as version 2 under the same record.